Core Security: Fun with my web logs

 fun, lolwhat  3 Responses »
Jun 282009
 

Just a little noodling around, followed by fun facts:

HacBook:~ wesley$ nslookup coresecurity.com
Server:		10.0.0.1
Address:	10.0.0.1#53

Non-authoritative answer:
Name:	coresecurity.com
Address: 208.253.45.70

HacBook:~ wesley$ whois 208.253.45.70
MCI Communications Services, Inc. d/b/a Verizon Business UUNET1996B (NET-208-192-0-0-1)
208.192.0.0 - 208.255.255.255
CORE SECURITY TECHNOLOGIES UU-208-253-45-64-D9 (NET-208-253-45-64-1)
208.253.45.64 - 208.253.45.127

# ARIN WHOIS database, last updated 2009-06-28 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

HacBook:~ wesley$ grep 208.253.45 *.log > corelog_lol.txt
HacBook:~ wesley$ wc -l corelog_lol.txt
124 corelog_lol.txt

McGrew Security Late Show Fun Facts about Core Security visitors to the site :

And my favorite:

  • 1 computer with the FunWebProducts adware/spyware.

Update 6/29/09 3:26 PM

Someone at Core just figured out that mcgrewsecurity.com ranks higher than coresecurity.com for their own party:

20090629.log:208.253.45.86 - - [29/Jun/2009:14:15:29 -0400]
"GET /2009/06/24/core-security-apologizes-not-cool-enough-for-core-2009-gathering-proposed/ HTTP/1.0" 200 5366
"http://www.google.com/search?q=core+security+party+at+black+hat&rls=com.microsoft:en-us:IE-SearchBox&ie=UTF-8&oe=UTF-8&sourceid=ie7&rlz=1I7ADBF_en"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"

(and the FunWebProducts one came back)

 Posted by wesley at 8:58 pm

Core Security Apologizes, "Not Cool Enough For Core 2009" gathering proposed

 fun, lolwhat  6 Responses »
Jun 242009
 

This afternoon I received a very polite call from Kim Legelis, the vice-president of marketing at Core Security.  She and I talked for some time about the problems I spoke about in yesterday’s post, and how changes need to be made to the process they use to invite people to their “cool kids” party at Black Hat.  Over the past day I have gotten feedback from readers of this blog and followers on twitter about other cases where Core hasn’t been the friendliest to deal with.  I took the conversation as an opportunity to mention those issues, as well, and that Core, as a company with a great product, needs to be a little more careful with how they interact with the community.

I enjoyed speaking with Kim candidly about the alienating (and silly) nature of the phone conversation I had yesterday.  She assures me that they’re taking the feedback and using it to improve their processes.  If that turns out to be the case, then great!  If you, as a reader, have had a bad experience contacting Core Security, either in the past or after this incident, I would encourage you to share it in the comments for this post.  I’m sure they’re reading now.

I’m looking forward to dropping by the Core Security booth at Black Hat USA 2009 this year.  If you are going too, perhaps we’ll arrange a “Not Cool Enough For Core 2009″ outing at a buffet that night.  I’ll even let you put yourself on a “Maybe List” for it, in case you want to stay in the “waiting list” limbo for Core’s ;-) .  If you are interested, leave a comment or drop me an email if you want to be private and sneaky about it.

 Posted by wesley at 3:53 pm

Perl hacking is dead (lol)

 fun, skiddies  20 Responses »
May 262009
 

Script kiddie forum pic of the day:

perlhackingisdead1

Naughty avatar censored, but I kept the language in case you want to try and make any sense of this chunk of thread.  PsyKon-X’s contribution is particularly hard to read through:

Perl does indeed work my friend but the coders in which the perl hack was designed for are being patched faster than the hacker is making the perl scripts, and also depends on if the person using the script for example is using phpbb and hasnt patched it with the new version this is vulnrable

Diagram that sentence.

All of you whitehats posting scripts to milw0rm are killing the perl hacking scene ;-) .

 Posted by wesley at 12:22 pm

Switching themes

 fun  No Responses »
May 252009
 
Hold on to your butts

This morning, I had the urge to change the look of the site.  I have changed the theme of the site (for the better, I think), and I’ve put some of my static pages under the control of WordPress so that I can manage them from its control panel. Things might be broken for a little while, but I think it’s already under-control.

 Posted by wesley at 12:08 pm

Download Stealing the Network's "The Final Chapter" for free until May 6

 book review, fun  2 Responses »
May 042009
 

If you read my review of Stealing the Network: The Complete Series Collector’s Edition, then you’d know that the only real additional content in the new edition is a new chapter by Ryan Russell: “The Final Chapter”.  I liked Ryan’s conclusion to the story, but I doubt that many people who already own the other Stealing the Network books would want to purchase the compilation just for that.

Now, and if you act fast, you won’t have to.  It turns out that the Windows Secret Newsletter is giving away a PDF which contains the entirety of “The Final Chapter” (preceded by a sample of 5 pages of text from another chapter).  It’s only available until May 6th, though, so you’ll want to go ahead and act if you want it.

All you have to do is subscribe to their newsletter, and you’ll be given a link to download the PDF.  They don’t even verify your email address before giving you the link, so I’d advise just punching anything that works into the field:

Enjoy!

 Posted by wesley at 7:17 pm

Skimmers on ATM Machines

 fun, hardware  1 Response »
Apr 062009
 

Lately, I’ve really enjoyed having The Consumerist in my RSS reader.  There’s always a lot of great stories about companies screwing over people, people getting in contact with the right people to straighten things out, and nice tips and tricks for when it happens to you.  It’s one of my favorite non-security-related blogs in my reader, however today it had a post that’s definitely of-interest for my security blog followers:

Take a look at that thing!  Very cool.  Has it’s own memory and a usb port to dump the data it records.  It would have been very tempting to keep it and reverse engineer it if I had found it :-) .  This sort of thing is definitely something the bank and police (not to mention bank customers!) need to know about, though.

 Posted by wesley at 4:17 pm

Santa Claus is Hacking to Town Challenge Results

 exploitation, fun, links, vulnerabilities, web  1 Response »
Jan 212009
 

Over at the excellent ethicalhacker.net site, the results of the Santa Claus is Hacking to Town Skillz Challenge have been posted:

These challenges are a lot of fun, and educational as well.  Ed Skoudis puts a lot of effort into writing and judging them.  There’s a whole archive of previous challenges available here, and I highly recommend at least reading through, if not working through, some of the previous challenges.  

This time around, I managed to get an honorable mention for my entry!  I’m very happy with this.  I was unable to test the Windows-centric parts of my solution before I had to submit it and move on to real work, so that part wasn’t %100, but I did have a really solid way of getting netcat onto the web server via the command-injection-vulnerable script, and some nice netcat pivoting.  

Oh, and apparently I’m a security stud! :

We had entries from notable security studs like Wesley McGrew, Raul Siles, Ryan Linn, Mark Baggett, Zoher Anis, Paul Tartar, and others.

I might put “notable security stud” on some business cards, or maybe a button, now.

 Posted by wesley at 8:58 am

Poking around my Google search referrals

 fun, web  3 Responses »
Jan 072009
 

Every night, Analog generates a summary of this site’s logs from the past seven days, and when I bother to check it, it’s an entertaining read.  My favorite part is the “Search Query Report”, which scrapes through my logs, pulling out the search terms people are using on Google (and other search engines) to get to my site.  I think it’s an interesting form of “pre-viewing feedback”, or, more clearly, a reflection of what people are expecting to see when they click a link to go to my site.

Today, I’ve decided to have a bit of fun, share a few of the funnier/more-interesting recent queries, and respond to them.  After all, it is my place to please my new readers ;) :

  • 0×000000 the hacker webzine dead
    • Is it?  It is down.  That’s a shame, I enjoyed reading the articles there, and hadn’t noticed that my RSS reader hasn’t picked up new posts since September.
  • script kiddies haven
    • That is exactly what you have found here at McGrewSecurity.com ;-)
  • personal password management
    • In an early post to this site, I discussed using Pwman3 with a hack I described to make it use pwgen as a password generator.  Nowadays, however, I highly recommend KeePassX.  It works great on OS X, Windows, and Linux.
  • describe ram images
    • Well, I’ll give it a shot:  A RAM image would be a byte-for-byte copy of the contents of RAM at some point in time.  A snapshot in time, if you will.  It’s likely to contain code and data (such as text, images, and even passwords) that were in memory at the time of the image-taking.  You can make one yourself with one of my tools, msramdmp, now that you understand what you are creating.
  • trend micro boycott
  • sans security training rapidshare links, (among other searches for pirated SANS materials)
    • Oooh naughty naughty.  I know it must be expensive to travel to SANS conferences from Saudi Arabia, but perhaps you could do the @Home options.
  • how can i dig up root fs on runescape
  • how to make a runescape phisher
    • I get a lot of search hits from people who are looking for phishing kits. Are these things really that hard to make?  I don’t think so.  A lot of the ones that are out there and available to download also secretly shuffle off the passwords to hurr_ima_hacker@yahoo.com as well.  Phishers phishing phishers.
  • yousif yalda docs
    • A lot of searches like this.  There’s no shortage of people out there mad at this guy.  If you’re new here, you can have some laughs here, here, and here.

This was fun to put together, so I’ll do it again sometime when I gather up more of these interesting search terms.

 Posted by wesley at 3:39 pm

Pretending to be a Printer with Netcat

 fun  5 Responses »
Jan 062009
 

My wife has discovered just how much money she can save shopping for our groceries using all of the coupons she has found online.  There are entire communities of people who follow and report on the deals you can find.  The only problem for her has been that many of the coupons she has found require a special application by the coupon.com folks.  The application is Windows/OS X only, and she runs Ubuntu.

Since I’m the one with the MacBook, it has become my duty to print the coupons that she forwards along to me.  I was happy to see there was an OS X version of the app, and installed it, only to find out the following:

Well that’s sort of annoying.  It just sends the job right off to the default printer, without asking about anything beforehand.  What’s worse for me is that it won’t “print” to a “graphic format like a PDF”.  A large percentage of my time, I’m not on a network with a printer, so I typically print things to postscript (.ps) files (bravo to Apple for building this into the OS and making it so easy).  When I want the hardcopies, I just tar them up and send them to a shell account on a server where I do have access to a printer.

Since this app doesn’t give me the usual printing dialog box with the option to “print to .ps”, I just had to hack together something.  I created a new printer in “System Preferences”->”Print & Fax”, with the following settings:

I then set this as my default printer.  Next, I set up a netcat listener to listen on the JetDirect port (9100), wait for a print job, and dump the incoming postscript to a file:

nc -l 9100 > output.ps

Once netcat is running and listening, you can print to the printer that you set up, and the result is a postscript file that you can then view, convert, print, etc.  It’s a pretty simple and painless procedure, if you’re dealing with an app that doesn’t play nicely with the printer dialog box.

 Posted by wesley at 1:20 pm

Yousif Yalda Part 2: Script Kiddies in the Mist

 fun, skiddies  33 Responses »
Sep 012008
 

…in which, our intrepid security geek finds out that there is a $400 bounty on his head.

Posts like this don’t have much technical content, but they’re fun, and the last one has been a wildly popular part of the site.  While you’re laughing your butt off, I hope you take away the real message here: do some background research on who you’re dealing with in the computer security scene.  If you got here by googling up information on this particular skiddie, then you’re already one step ahead of the game.  Just because someone has a legit-looking website and blog doesn’t mean they’re on the up-and-up :)

Since my first post about Yousif’s activities, I’ve had the pleasure of many late-night phone calls from him, being DOS’d for about a half hour, and having his friend threaten to hack my coffee maker.  I was promised a beat-down at Black Hat, although I unfortunately could not make it.  I am, however, sort of disappointed that I don’t warrant being stabbed, like Yousif has threatened to do to Lee Hinman over at the excellent writequit.org blog.  He is, however, willing to pay someone else to do the dirty work.

In the meantime, he hasn’t let up in his activities.  He has been hanging out on an Internet marketing forum, although his taste for script-kiddie hacking has not subsided.  He still has a penchant for attacking sites outside of well-defined pen-tests, still loves to threaten people who correct him, and runs his own small botnet.

Apparently looking to supplement his vapt-sec.com income with some cost-per-action fraud, he’s been hunting around for cohorts to develop software to fill out forms and offers on CPA advertisers, and to come in through his referral links from multiple IP addresses to fill out forms.  I took this as an opportunity to form my own “black hat” alter-ego, and have a good heart-to-heart chat with Yousif.  After a couple of boring evening chat sessions building up my “black hat” cred with him, he began to open up.

The following are some choice excerpts and quotes.  I’ve censored both his language and mine.  I do swear in-person, occasionally on IRC, and rarely on the blog, however I did ratchet it up about 12 notches with “elite yousif”, to build rapport.

Since he gets others to write his software for him, he occasionally gets his languages confused:

11:03:05 PM elite yousif: So
11:03:12 PM elite yousif: You know anyone who has botnets
11:03:39 PM bhb: i have a couple friends who might.  have a need?
11:03:50 PM elite yousif: Yeah
11:04:37 PM elite yousif: It’s quite helpful in CPA
11:05:16 PM bhb: yeah i was thinking of writing some code to work through a botnet, filling stuff and using the random ID generator
11:05:27 PM elite yousif: No need, lol.
11:05:35 PM elite yousif: I’m making something like that as we speak.
11:05:39 PM bhb: nice
11:05:50 PM bhb: what language do you code in
11:06:01 PM elite yousif: What language did I code this in?
11:06:11 PM bhb: yah
11:06:41 PM elite yousif: Net
11:06:54 PM bhb: c#
11:06:55 PM bhb: ?
11:07:21 PM elite yousif: nope
11:07:22 PM elite yousif: .NET <
11:07:29 PM elite yousif: Microsoft, ya know?
11:08:01 PM bhb: .net’s a platform, theres lots of languages you can code targeting .net
11:08:06 PM bhb: vb.net maybe?
11:08:13 PM elite yousif: Yeah, that’s right.
11:08:21 PM elite yousif: Vb.NET <

Don’t mess with this guy.  Especially in school:

11:56:56 PM elite yousif: No one ***** w/ me..
11:56:59 PM elite yousif: No one @ all.
11:57:02 PM elite yousif: Not even in school
11:57:03 PM elite yousif: They know
11:57:05 PM elite yousif: I can change their grade
11:57:09 PM elite yousif: expell them
11:57:10 PM elite yousif: frame them
11:57:11 PM elite yousif: etc
11:57:17 PM elite yousif: I can drop your docs too
11:57:21 PM elite yousif: know what shoe size you wear
11:57:23 PM bhb: heh nice
11:57:25 PM elite yousif: know your fam history
11:57:27 PM elite yousif: CC
11:57:29 PM elite yousif: S#
11:57:30 PM elite yousif: where u live
11:57:30 PM elite yousif: etc
11:57:59 PM bhb: knock some kiddies on their ***** online lol
11:58:18 PM elite yousif: lol
11:58:59 PM bhb: ***** haters lol
11:59:09 PM elite yousif: I know AOL internals too
11:59:11 PM elite yousif: ppl who work there
11:59:13 PM elite yousif: with high privs.
11:59:14 PM elite yousif: can easily
11:59:16 PM elite yousif: hi jack
11:59:19 PM elite yousif: any AOL/AIM account
11:59:22 PM elite yousif: and get info behind it
11:59:23 PM elite yousif: =D
11:59:31 PM elite yousif: i social engineer as well
12:00:08 AM bhb: hah that’s useful

A social engineering mastermind, to be sure.

Here, he’s a little sore that his affiliate program dropped him after figuring out his referrals weren’t legitimate:

12:03:12 AM elite yousif: you haven’t made any money in CPA yet?
12:03:43 AM bhb: haven’t even started.  just been reading up on it on the side, besides coding and work
12:04:30 AM elite yousif: ah
12:04:40 AM bhb: you made much?
12:04:42 AM elite yousif: I got my account terminated
12:04:45 AM elite yousif: 2 days ago
12:04:48 AM elite yousif: from a network
12:04:52 AM elite yousif: ***** bro, i swear
12:04:52 AM bhb: haters
12:04:53 AM elite yousif: I lost
12:04:56 AM elite yousif: 2000+ dollars
12:04:59 AM elite yousif: I better get my ***** back
12:05:00 AM elite yousif: OR
12:05:08 AM elite yousif: I’m gonna make my affiliate managers life a living HELL
12:05:14 AM elite yousif: I have access to her AIM account
12:05:15 AM elite yousif: verizon
12:05:17 AM elite yousif: photobucket
12:05:19 AM elite yousif: paypal
12:05:20 AM elite yousif: blogger
12:05:23 AM elite yousif: and some other *****
12:05:25 AM elite yousif: and facebook
12:05:29 AM elite yousif: she doesn’t know it yet
12:05:31 AM elite yousif: but I phished that *****

Bragging about taking down RSnake’s site (note: there’s an excellent chance this never really happened):

3:00:44 AM elite yousif: you know rsnake?
3:00:46 AM elite yousif: robert hansen
3:00:48 AM elite yousif: famous as *****..
3:00:49 AM bhb: yeah
3:00:51 AM elite yousif: k
3:00:51 AM elite yousif: well
3:00:53 AM elite yousif: his site
3:00:54 AM elite yousif: let me find it
3:01:03 AM bhb: ha.ckers.org or something
3:01:22 AM elite yousif: nah
3:01:23 AM elite yousif: his company
3:01:29 AM bhb: oh i dunno
3:02:26 AM bhb: sectheory?
3:02:58 AM elite yousif: yeah
3:02:59 AM elite yousif: rofol
3:03:02 AM elite yousif: i ddosed that
3:03:03 AM elite yousif: with my friend
3:03:04 AM elite yousif: in like
3:03:05 AM elite yousif: what
3:03:06 AM elite yousif: maybe
3:03:09 AM elite yousif: 3 mins
3:03:10 AM elite yousif: it was down
3:03:14 AM elite yousif: some security expert eh?

If there were any doubts about how he’s taking part in CPA fraud:

4:44:10 PM bhb: how are you supposed to make any money at it if you arent botting it anyways lol
4:44:25 PM elite yousif: what do you mean?
4:44:48 PM bhb: like automating it through a bunch of proxies/bots
4:45:02 PM bhb: how can you find that many people wanting to do it legit to keep making money
4:45:14 PM elite yousif: lol
4:45:17 PM elite yousif: u infect more victims
4:45:22 PM elite yousif: you market your trojan or w.e.
4:45:27 PM elite yousif: and more ppl open it
4:45:37 PM bhb: heh yeah so a loose definition of “legit” lol :D
4:45:48 PM elite yousif: yep
4:45:48 PM elite yousif: lol
4:45:59 PM elite yousif: you know what company is cool though?
4:46:03 PM bhb: you have nice custom trojans for it?
4:46:03 PM elite yousif: ******
4:46:10 PM elite yousif: i talked to the owner
4:46:10 PM bhb: cool you work with them too?
4:46:12 PM elite yousif: really cool guy
4:46:14 PM elite yousif: says
4:46:18 PM elite yousif: i can do black hat if i want
4:46:21 PM elite yousif: and he wont term. my account

Then, I managed to get him on the subject of yours truly :) :

5:02:12 PM elite yousif: LOL
5:02:19 PM elite yousif: http://archives.neohapsis.com/archives/fulldisclosure/2008-08/0545.html
5:02:21 PM elite yousif: that link u sent me
5:02:25 PM elite yousif: i know the guy who wrote that
5:02:27 PM elite yousif: wesley mcgrew
5:02:30 PM elite yousif: that dude is such a *****
5:02:36 PM bhb: he talks like one
5:03:01 PM elite yousif: he started talking ***** about my business and me because he claims that i hack around sites without permission and that i gave him access to my computer, WTF..
5:03:25 PM elite yousif: so i told him to go to black hat in vegas, and he said hes not going this year — i told him if i saw him id tackle him

I’m not really sure if the following about the director of Black Hat contacting him is true (I never contacted the Black Hat folks about it, since it’s not really a credible threat).  He probably just made it up after he found out how much Black Hat costs:

5:05:11 PM elite yousif: u know what he did
5:05:11 PM elite yousif: he spoke with teh director of black hat
5:05:11 PM elite yousif: and he told him that i would beat his ***** if i saw him
5:05:11 PM elite yousif: so he got scared
5:05:11 PM elite yousif: so the director listened to him
5:05:20 PM elite yousif: and said i cant attend black hat this yea
5:05:20 PM elite yousif: year*
5:05:38 PM bhb: lol that’s hilarious did the director email you or something
5:05:44 PM elite yousif: no he IM’d me
5:05:51 PM bhb: ahah
5:05:52 PM elite yousif: then i followed his profile and he actually WAS the director of black hat
5:05:54 PM elite yousif: oh well
5:05:59 PM elite yousif: he knew i wasn’t kidding

This did happen, although he and his friends would usually get bored and give up after a few calls:

5:06:00 PM elite yousif: i called him
5:06:03 PM elite yousif: 1000 times
5:06:07 PM elite yousif: i cussed him out badly
5:06:12 PM elite yousif: and i demanded to talk to his wife
5:06:14 PM elite yousif: so i can cuss her outtoo
5:06:17 PM elite yousif: her out too*
5:06:18 PM elite yousif: but he wouldn’t elt
5:06:20 PM elite yousif: let*

Remember kids, don’t DDOS on a school night:

5:14:51 PM elite yousif: ask him if i DDoSed his *****
5:15:03 PM elite yousif: he’ll either lie and say ‘it’s server issues @ night” or he’ll admit like a ***** i owned him
5:15:25 PM bhb: hah what an idiot.  how long did you ddos him for
5:15:36 PM elite yousif: for about 2-3 hrs
5:15:42 PM elite yousif: i was bored and it was late
5:15:45 PM elite yousif: i had school next morninig
5:15:47 PM elite yousif: so i let him go
5:15:48 PM elite yousif: lol

There’s a $400 bounty on my head.  My wife, a friend, and I considered faking some photos and video to claim it, but I guess we’re just too nice:

5:33:36 PM elite yousif: can you go to missipi?
5:33:39 PM elite yousif: ill pay you like
5:33:42 PM elite yousif: 400
5:33:44 PM elite yousif: to beat his ***** for me
5:33:46 PM elite yousif: no joke
5:34:03 PM bhb: lol maybe if im hard up for some money one day
5:34:14 PM bhb: you should definitely go though, that ***** would be classic
5:34:28 PM elite yousif: do u know anyone would do it?
5:34:34 PM bhb: show all the whitehats that you dont ***** with the blackhats cause they take it into RL
5:34:36 PM elite yousif: i seriously will pay $400 for it
5:35:06 PM bhb: i dont know anyone up for that but it shouldnt be too hard to find
5:35:20 PM bhb: lol craigslist, i bet theres tons of local rednecks there that would do it
5:35:27 PM elite yousif: lol
5:35:35 PM elite yousif: id rather talk to someone i already know
5:36:03 PM bhb: hah just tell them the money transfers when you see a jpg of his bloody nose lol
5:36:33 PM elite yousif: rofl
5:36:35 PM elite yousif: good idea
5:37:28 PM bhb: http://northmiss.craigslist.org/
5:38:10 PM bhb: i dunno what category lol
5:38:15 PM elite yousif: lol
5:38:17 PM elite yousif: murder
5:38:20 PM bhb: loool
5:39:57 PM bhb: services – labor & moving, that probably has the most steroid pumped rednecks
5:40:15 PM elite yousif: lol
5:40:21 PM elite yousif: bro i would never do it off tehre
5:40:27 PM elite yousif: ***** u know feds just hang out there
5:40:30 PM elite yousif: waiting for somone to ***** up

I’ll leave you with the last words he had to say to my dummy AIM account:

7:28:14 PM elite yousif: yo
7:28:30 PM elite yousif: is there a way to make your cd burner recognize dvd-r’s?

Brilliant.

 Posted by wesley at 1:46 pm
 Older Entries  Newer Entries
© 2012 McGrew Security Suffusion theme by Sayontan Sinha