Troy’s ultimate list of security links

http://www.troyhunt.com/2015/09/troys-ultimate-list-of-security-links.html

Saturday, 26 September 2015

I’ve got a heap of resources I constantly come back to in talks, workshops and just during the course of my everyday work. Frankly, I have trouble remembering them all myself plus I reckon they’re kinda useful for other people too so I thought I’d drop them all into a post here. If you’ve got good stuff I’ve missed (and you almost certainly will), drop it into the comments below as I’d love to add to my own set of resources plus that way it gets shared with everyone. Enjoy!

SSL / TLS / HTTPS

1. Is TLS fast yet – A great site debunking the myths of SSL/TLS speed cost
2. Firesheep – A watershed moment for SSL by demonstrating the ease with which unprotected traffic can be intercepted and sessions hijacked
3. Qualys SSL Labs – Tests a variety of attributes of the SSL implementation by pointing it at any URL
4. CloudFlare – Get SSL for free on any website
5. Let’s Encrypt – It’s coming, and it promises to fix the current mess that is CAs and configuring certs
6. Betsy’s free wifi – Shows a young girl standing up a rogue wifi hot spot
7. Chromium HSTS preload list – All the sites submitted for HTTP strict transport security preload (a depressingly small number of them)
8. HTTP Shaming – Sensitive data sent insecurely? Name and shame!

DDoS

1. Krista’s professional DDoS service – Video of an innocent teenager promoting a DDoS service
2. Norse – Totally awesome real time map of DDoS attacks that’s absolutely mesmerising to watch
3. Booter promotional video – Very professional advert for a “booter” service (complete with “Epic DDoS interface”)
4. networkstresser.com – Example of a DDoS service… protected by CloudFlare… the world’s largest provider of DDoS defences…

SQL injection

1. sqlmap – The tool for mounting SQL injection attacks tests against a running site
2. Drupal 7 SQL injection flaw of 2014 – great example of how impactful it still is (patch it within 7 hours or you’re owned)
3. Ethical Hacking: SQL Injection – If you really want to go deep, here’s five and a half hours worth of Pluralsight content

XSS

1. XSSposed – List of sites found to be vulnerable to XSS (including attack vector)
2. Dutch banks doing the Harlem Shake – Video collage of a number of Dutch banks with XSS risks being made to do the Harlem Shake via a script reflected from the URL
3. XSS Filter Evasion Cheat Sheet – Because XSS payload filtering is almost always insufficient
4. </xssed> – Heaps of XSS news and lists of vulnerabilities

Security scanners

1. NetSparker – My favourite dynamic analysis tool due to ease of use and practicality (especially good for developers who may not live in security land)
2. OWASP Zed Attack Proxy (ZAP) – Great tool for dynamic analysis security testing and ha a whole raft of other users too (oh – and it’s free!)
3. Burp Suite – Seriously powerful with a heap of different tools and a freebie version to get you started
4. Fiddler – Not a security tool per se, but I use it extensively to inspect website behaviour, tamper with requests and modify responses on the wire
5. Acunetix – Popular dynamic analysis tool similar to NetSparker but is let down a bit in the usability stakes IMHO
6. Nikto2 – Freebie open source app scanner sponsored by NetSparker

Exploit databases and breach coverage

1. seclists.org – Heaps of exploits consolidated from various bug tracking lists
2. Exploit Database – Very comprehensive list of vulnerabilities
3. PunkSPIDER – Lots of vulnerabilities of all kinds all over the web (about 90M sites scanned with over 3M vulns at present)
4. Data Loss DB – Good list of breaches including stats on number of records compromised
5. Information is Beautiful: World’s Biggest Data Breaches – Fantastic visualisation of incidents that give a great indication of scale

Cracking software

1. Hashcat – The tools for cracking hashed passwords; totally free with a great supportive community
2. John the Ripper – Also top notch password cracking software with some different approaches to Hashcat
3. RainbowCrack – Rainbow tables are becoming less relevant in the era of fast GPUs and tools like Hashcat, but it’s worth a mention anyway
4. Aircrack-ng – For all your 802.11 WEP and WPA-PSK key cracking needs

Hacking and penetration testing tools

1. Metasploit – The canonical pen testing tool; seriously advanced and enormously powerful
2. BeEF – The Browser Exploitation Framework offering remote control over a target’s browsing session
3. Kali Linux – All your pen testing bits in one image!
4. Backtrack-linux – Fallen out of favour a bit as Kali has emerged, but still deserves a mention
5. Nmap – For all your mapping of network things needs
6. Wireshark – When you need to down to monitoring at the packet level

Vulnerability definitions

1. The OWASP Top 10 Web Application Security Risks – The canonical categorisation of the top risks on the web today
2. SANS 20 Critical Security Controls – Great consolidation of security controls presented in an easily consumable fashion

Security headers

1. Fiddler extension for CSP – Massively streamlines your creation of a CSP by building the policy as you browse
2. SecurityHeaders.io – Everything security header related and a great place to assess your current state
3. Report URI – Analyse your CSP and HPKP headers plus log your exception reports there
4. Make any website do the Harlem Shake – if you can run this in the console against a website, they almost certainly don’t have a CSP prohibiting arbitrary content from being loaded into the site

Passwords

1. OWASP Password Storage Cheat Sheet – There are plenty of bad ways of doing it, this is a great resource documenting the good ways
2. Jimmy Kimmel “What is your password” – video of interviewing people and engineering them into disclosing their password
3. Diceware – A popular method of creating strong pass phrases suitable for use as a password

Password managers

1. 1Password – Still my favourite password manager; client based, runs on all devices and the keychain is syncable via multiple mechanisms
2. LastPass – A web based password manager (albeit with rich clients as well), one of the big players in password managers
3. KeePass – A popular free alternative to commercial password managers

Account management

1. Adult Friend Finder password reset – Enumeration done wrong; initiate a password reset for any email address and be told if they’re a member of a highly personal site
2. Entropay password reset – A great example of not disclosing the existence of an account (try resetting an account that isn’t registered on their system)
3. Botnet brute force attack against GitHub – I regularly use this as an example of how hard it can be to defend against brute force

Personal security

1. F-Secure’s Freedome – My VPN of choice with lots of exit nodes around the world and a promise of no logging
2. mycreditfile.com.au – This is an Aussie version so do find one local to you if you’re not down under, but identity protection and credit alerts is a “must have” today IMHO

Googledorks

1. Google Hacking Database – Great collection of Googledorks categorised by various classes of expose data
2. Google Hacking for Penetration Testers – In case you prefer books over web pages

Other tools and links

1. Have I been pwned? – How could I not include this?! My own tool, now being put to particularly good use by large enterprises monitoring tens of millions of people
2. Mailinator – create temporary email addresses for testing
3. Shodan – Find devices connected to the web (cameras, SCADA systems, etc.)
4. Reitre.js – “What you require you must also retire”: Helps identify JavaScript libraries with known vulnerabilities
5. urlQuery.net – Analyses web-delivered malware by inspecting an individual URL and identifying malicious behaviour
6. Phish5 – I’m yet to use them but I hear good things; phishing attacks are enormously effective and these guys help you test your organisation for how well equipped people are to recognise the attacks
7. Plain Text Offenders – Been emailed your password? Name and shame!
8. Kaspersky Real Time Threat Map – Very cool visualisation of the real time threat Kaspersky is seeing
9. Tor Browser Bundle – Access the underwebs and browse anonymously

Security statistics reports

1. Verizon Data Breach Investigations Report – The annual DBIR is based on real world security incidents and is a great resource for evidence-based security metrics
2. WhiteHat Security Statistics Report – Based on findings in the websites they monitor with their security products so another good evidence-based report
3. Trustwave Global Security Report – Another annual report driven from real world investigations (plus they use the terms “threat intelligence”, “seedy criminal underground” and “data defender” so you know it’ll be good!)
4. Websence Threat Report – Created by Websense Security Labs, a fairly high level overview of the threat landscape
5. HP Cyber Risk Report – More cyber, more statistics, more reports

Noteworthy books

1. We are Anonymous – Still one of my favourite security books, a look inside Lulzsec and how it all unravelled
2. Ghost in the Wires – The story of Kevin Mitnick’s early days and an absolutely fascinating read
3. Data and Goliath – Just because you’re paranoid doesn't mean they’re not after you! Excellent read on data collection by Bruce Schneier

Other things you should be reading

1. What Every Programmer Absolutely, Positively Needs To Know About Encodings And Character Sets To Work With Text – Because encoding is one of those things you just need to know

Awesome people you want to read and follow

1. Mikko Hypponen
2. Brian Krebs
3. Jeremiah Grossman
4. Scott Helme
5. Bruce Schneier
6. Kevin Mitnick
7. Swift on Security
8. Brian Honan
9. Graham Cluley
10. Rob Graham

What did I miss?

Lots. Leave your favourites in the comments, I’d love to see them!

The Very Unofficial Dummies Guide to Scapy

https://theitgeekchronicles.files.wordpress.com/2012/05/scapyguide1.pdf

Introduction to Python for Security Professionals

http://www.slideshare.net/j0b1n/introduction-to-python-for-security-professionals

Build Your Own Scary Surveillance Jeep For Under $5000 With This Hacker's Guide

http://www.forbes.com/sites/thomasbrewster/2015/09/15/diy-stingray-jeep/

If you could turn your car into a surveillance vehicle capable of intercepting telephone calls, jamming communications and manipulating electronic systems run by critical infrastructure providers, would you do it? What if it cost less than $5000?
This is possible thanks to cheap kit and open source software, says security consultant and pro hacker from Coalfire, Drew Porter. He’s kitted out his own 2008 Jeep Grand Cherokee Overland with nearly $5000 in radio, computing and power hardware so it can snoop on all kinds of information as he drives around. And Porter will teach others how to create their own covert spy car at the upcoming DerbyCon conference in Louisville, Kentucky later this month.
Porter has taken “war driving” – hacking on wheels – to the extreme to prove a point: as legal battles over NSA snooping and police use of phone-tracking Stingrays are waged, anyone can carry out similar surveillance with minimum effort and funding. “It started as a hidden project, mostly to hide it from my wife,” Porter joked. “It worked really well for three months. So it’s definitely spot on with the covertness.”
 
His own stealth mobile comes with two low-profile Ultra Wideband antennas collecting signals between the 700MHz-2700MHz bands of spectrum, and two more for capturing signals in the 125MHz-630MHz range. Along with the 7-inch HD monitor, a keyboard and mouse, they’re the only things that make the Jeep look a little different.
Everything else is hidden. Under the boot (pictured below) are two power converters to keep the operation running, a mini computer (Porter changes between an AMD BRIX and an Intel INTC +0.00% NUC) to handle all the data constantly coming in through the antennas, two power amplifiers and two low noise amplifiers to pick up weaker signals. There’s also the most expensive piece of kit, the USRP B210, a software-defined radio (SDR) that’s responsible to tuning into the various signals in the surrounding area. SDRs are remarkably useful for hackers of all ilks, as they can be quickly tinkered with to pick up on signals from different frequencies, whilst feeding the data back to linked software. They can be incredibly cheap, as $120. The USRP B210 cost Porter $1100. In total, he spent $4419 of his own money.

Recommended by Forbes

A host of computing, software defined radio and battery power kit, hidden in the back of Drew Porter’s stealth Jeep.

The Redz SIGINT software for on-the-move surveillance, or “war driving”, will be released later this month.

All of that hardware is managed by Porter’s bespoke software, dubbed Redz SIGINT (for signals intelligence). It allows him to view and interact with the surrounding spectrum at any time. It comes with various tools that form a veritable Swiss army knife for on-the-go hackers: a signals jammer to interrupt communications, analysis software for “unknown signals of interest” and a tool for replaying captured signals.
One of the “offensive” parts of Redz SIGINT is the IMSI capture tool. Such technology is built by a range of manufacturers, government contractor Harris HRS +0.00% Corp being the most famous, as it created the Stingray used by various police forces in the US. Stingrays essentially trick phones in a nearby area to connect to it. Combined with other software, they can be used to collect location data, phone information and the content of calls and texts. They’ve become a subject of controversy in recent years due to the FBI’s deployment of them without a warrant. A US Department of Justice announcement this month affirmed that warrants had to be obtained before a Stingray was put to use.
A 2008 price list obtained by Public Intelligence indicated Harris’ Stingray started at $75,000, though the additional software and antennas would have pushed the price up by tens of thousands of dollars. A Stingray 2 cost $148,000 on its own. But Porter was able to create a cheap and cheerful version of a Stingray by altering OpenBTS, an open source technology that is traditionally used to create cellular network access points.
“There was a whole bunch of news about Stingray. Everyone was like, it costs so many hundreds of thousands of dollars and … it’s very noticeable. I was like, I have a similar system that doesn’t cost hundreds of thousands of dollars that isn’t really noticeable,” he told FORBES. “Obviously police have different capabilities and they have greater capabilities … but this is generally what can be done with relatively cheap equipment.”
Porter was keen to point out he only used his personal Stingray, jammers and other “active” intelligence gathering tools in controlled environments with willing participants; only passive surveillance of open information was harvested in public environments.
What use might the spy Jeep be to more malicious war drivers? Outside of straight-up spying on people’s phones, they could look at disrupting critical infrastructure. Porter says he has regularly worked with companies managing America’s power. In one case, he found a firm responsible for running a water power plant used one signal to open and close water gates. He collected this signal, analysed it and discovered he could simply replay it to activate the gates. “That’s one example of using a software-defined radio that could be quite devastating for a critical infrastructure environment,” he added.
At DerbyCon, he will release the alpha version of Redz SIGINT and a PDF guide, “Build Your Own Covert SIGINT Vehicle”. Porter hopes his stealth Jeep will prove just how cheap and easy it is for anyone to surveil. “The hardware is cheap enough, the equipment is good enough to do real signals intelligence which can be scary. I’m sure there are a lot of people who don’t want civilians to go signals intelligence, but it is a fact of our life, where everything in our life has to be connected now and really this Jeep takes advantage of that.”
We could all be Big Brother if we wanted.

Operation Iron Tiger, hackers target US Defense Contractors

http://securityaffairs.co/wordpress/40199/cyber-crime/operation-iron-tiger.html

Experts at Trend Micro uncovered the Operation Iron Tiger, a cyber espionage campaign carried out by Chinese hackers on United States Defense Contractors.

Security experts at Trend Micro have uncovered a new targeted attack campaign dubbed Operation Iron Tiger. Threat actors behind the Operation Iron Tiger have stolen trillions of data from defense contractors in the US. Stolen data include intellectual property, including emails and strategic planning documents and many other highly confidential information that could be used by attackers to destabilize an organization.
The experts speculate that the Iron Tiger Operation was carried out by the China-based group dubbed “Emissary Panda.”

“Operation Iron Tiger is a targeted attack campaign discovered to have stolen trillions of data from defense contractors in the US, including stolen emails, intellectual property, strategic planning documents—data and records that could be used to destabilize an organization.” states a blog post published by Trend Micro.

In August 2015, researchers at Dell discovered that the Panda Emissary group used Watering hole attacks as the attack vector, they compromised websites popular with a target organization’s personnel.
The Panda Emissary (also known as TG-3390) targeted high-profile governments and organisations searching for defence aerospace projects.
The group is active at least since 2010 targeting organization in APAC, but since 2013 it is attacking high-technology targets in the US.
The experts consider the Panda Emissary a “highly competent and sophisticated group“, Trend Micro revealed to have seen them steal up to 58 GB worth of data from a single target.

“The Iron Tiger actors can be skilled computer security experts but sparingly used advanced techniques, given their weakly protected target networks. They do not follow a specific schedule when it came to launching attacks. Instead, they prioritize attacks based on a list of chosen targets.” states the experts.

The attackers used spear-phishing emails to carry on the attacks, the experts at Trend Micro analyzed in detail the accounts used by the hackers and the composition of the email messages (i.e. subject, language, message).
Trend Micro published a detailed report on the Operation Iron Tiger, the investigation allowed the experts to analyze the TTPs (Tactics, Techniques and Procedures  of the threat actor.
Below the key findings of the report:

• The group’s use of exclusive hacking tools and malware, such asdnstunserver, PlugX, Gh0st, to name a few
• The threat actor group’s use of public resources as Blogspot™ and the Google Cloud Platform™
• The group patched one of their compromised servers to avoid being hacked
• Key identification elements leading to at least one individual physically located in China
• The use of code-signing certificates of Korea-based security company SoftCamp Co., Ltd.
• The group’s list of targets, which include military defense contractors, intelligence agencies, FBI-based partners, and the US government
• Their use of a unique method to intercept  Microsoft Exchange credentials

Enjoy the full research paper entitled “Operation Iron Tiger: Exploring Chinese Cyber Espionage Attacks on US Defense Contractors.”
Pierluigi Paganini
(Security Affairs – Operation Iron Tiger, cyber espionage)

Share it please ...

Share this:

• Email
• Twitter129
• Print
• LinkedIn183
• Facebook124
• More
• 
  

Chinacyber espionageHackingOperation Iron TigerSecurity Affairs

Breaking News Cyber Crime Intelligence Malware

---

Share On

Pierluigi Paganini

Pierluigi Paganini is Chief Information Security Officer at Bit4Id, firm leader in identity management, member of the ENISA (European Union Agency for Network and Information Security)Treat Landscape Stakeholder Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.