My wife has been going through a LOT of hoops with T-Mobile and the piece of trash Sidekick phone that I bought for her. Through all of this, she asked me to look at her microSD card to make sure that there wasn't anything malicious on there.
I had no problem with doing this and it even gave me an excuse to go through six other microSD cards that I haven't looked at in a long time (and it was GOOD that I DID finally look....but that is a whole different subject). So I logged into my box and plugged the microSD card into an adapter and then into the computer. I have looked at almost every file that exists on a microSD used by an Android phone (2.2.1 and earlier) so nothing really stuck out in the file directories. However, one thing DID stick out.
Android uses a folder called .bookmark_thumb1 under the root. I have never been suprised by this folder until the night I was doing this check for my wife, and thus I have NEVER made the time to actually look into the purpose of the folder. Suffice to say that when I glanced at the screenshots that were in this folder, I was very (VERY) annoyed to see the login page for one of my banks as well as all of the login boxes filled in. Now, these were just screenshots, so there was no revelation of the password used even though the username was definitely visible. This caused me to want to look into this folder a little bit.
After getting back to the hotel tonight and still being wired from Michigan's win over Virginia Tech, I thought I would spend five minutes on this. What I have learned:
- The behaviour (taking screenshots of ANY page you visit) is common and actually used by the system in relation to the bookmark maintaining.
- This is not, but "could" be a security risk
- There is both a permenant fix and a temporary fix.
What follows are just a couple steps for the permenant and temporary fixes and some links to some articles already published about this folder.
Temp Fix
After you are done browsing the web (and maybe using some applications), us a file brower (either from the market place or via mounting the SD/microSD card to your laptop) and delete the files or the whole folder. The folder is automatically recreated when a new internet browsing session is initiated.
Permenant Fix
Delete the .bookmark_thumb1 folder. create a blank textfile with the name .bookmark_thumb1. The bookmarking implementation will no longer work properly, but the folder will NOT be recreated and there will be NO more storage of session bookmarks.
Links:
http://www.androidcentral.com/htc-browser-bookmark-images-scare
http://forum.xda-developers.com/showthread.php?t=1230655
http://forums.androidcentral.com/t-inspire-4g/90666-need-help-figuring-out.html
So this isn't a "new" issue...probably isn't an issue to most people. BUT, I did spend a few minutes researching it so it was worth mentioning on here.
Wednesday, January 4, 2012
Tuesday, December 13, 2011
Cracking WEP....part 1 of a little bit of frustration
I found a new project that I want to work on. Actually, I was invited to work on yet another web-based application project that I think will be completely awesome. But that is not the project I am referencing for this post. Nope...I want to play around with password cracking.
I know that WEP is not the strongest; it is the easiest to crack anymore, especially with methods such as the PTW approach (Pychkine, Tews, Weinmann) or the older Korek attack (either one can be easily run through aircrack-ng). However, after an interesting time at a relatives (one of my Michigan cousins named Henry....one of three) over thanksgiving week, I wonder more and more about the issues surrounding the creation, storage, and transmission, of solid passwords.
A password should be hard to crack, easy to memorize, should work on the system it's established for (think earlier LANMAN stuff). I think everyone agrees upon this. However, there have been some divergent schools of thought for sometime now on what a "solid" or "strong" password consists of in general terms. Everyone with access to something on the Internet in the last decade has had to have noticed the change in complexity requiremenets. It is not uncommon anymore for a password to have requrements such as:
- length (12+ chars)
- at least one from each group:
---- uppercase letters
---- lowercase letters
---- numerals
---- special charactors (%,#,$,%,^,&, for example)
- can't be reused X amount of times
- and so on.
On top of making a password hard to guess...and hopefully hard to crack (although I believe that ALL passwords, given the time and processing power, can be cracked), the method of how a password is encrypted and transmitted is constantly being revised and tested. Some of these include client-side encryption (OR hashing, with or without a salt), server-side (BAD Idea if you ask me), WEP, WPA2 with PEAK, etc.
Getting back to my point, I recently stayed at Henry's (my relative) house. I was on vacation and had zero desire to do anything with a computer. That was until he made a comment about his wireless router password using WEP. He didn't challenge me, but I thought it would be fun to capture some traffic and see if aircrack-ng, or even Cain & Able could crack his password. So, I deferred getting the password from him and proceeded to break out my AirPCAP tool and just "collect" some IV's. I figured that with 128-bit encryption set on his six year old router, that it wouldn't take long to gather enough IV's and crack the password. Afterall, my wife's cocky aunt had refused to give me her WPA2 protected password and I proceeded to gain that one (and two of her neighbors accidentally) within about 20 minutes. (I should add, with some cockyness, that she hasn't tried to talk trash to me again...LOL). Since the WPA2 crack was SOOOOO quick, and since my unique IV collection amount kept climbing rather quickly, I was certain that I would have his password in no time.
I was wrong. Henry's password proved to be VERY difficult for aircrack, using either Korek or PTW attacks. I decided to query Henry about his setup....I wasn't trying to force anything, just trying to crack gracefully. After talking with Henry, I verified that: 1) he was not broadcasting his ESSID (Cain picked that up for me really quickly though), it was only WEP he was using, and that NO special charactors were used. One question I neglected to ask him was the length of his password. It was LONG...30 chars
I decided that I would collect at least 50,000 unique IVs. With a 128-bit key, PTW should be OK with 40,000+ IVs. I let this collection run for awhile (I didn't actually clock it) and then piped it to the cracker.
The aircrack-ng GUI provides a relatively great UI. I used a variety of settings to attempt both the Korek attack and the PTW attack, even though I was seriously short of IVs for Koreks. I tried with and without using a known ESSID and/or BSSID, and after seeing the password, I tried adding 1,2,3,4, and 5 of the first decrypted charactors. No Joy!!! I couldn't believe it. I chalk some of this failure up to my trying to be gentle. However, and here is where my new side-project is coming from, it REALLY got me thinking about the value of computational complexity versus a just plain long password of numbers and letters. An interesting side not to this was that Henry's password contained ONLY charactors used in hex (A-F and 0-9), had at least two dictionary words at the start of the password and used some pretty common key-stroke patterns.
So know I want to spend some quality time with different crackers, password creation methods, encryption and hashing algorithms, etc. and just run some test on cracking WEP versus WPA2 and using passwords that contain only alpha-numerics and NOT special charactors. I think I will also compare passwords that are collections of dictionary words versus complex passwords. This just sounds like a LOT of fun to me.
I know that these types of evaluations have been done numerous times...but it sounds like fun AND it sounds like a realistic way to get more familiar with the tools and get reaquainted with some of the protocols. In any event, I am rambling which means I need to call it a day. Tomorrow's a busy day of more compliance work and a Doctor's appointment...yay. Plus, I guess it's time to start getting some rest if I am going to initiate this project and a few others I mentioned in an earlier post.
I know that WEP is not the strongest; it is the easiest to crack anymore, especially with methods such as the PTW approach (Pychkine, Tews, Weinmann) or the older Korek attack (either one can be easily run through aircrack-ng). However, after an interesting time at a relatives (one of my Michigan cousins named Henry....one of three) over thanksgiving week, I wonder more and more about the issues surrounding the creation, storage, and transmission, of solid passwords.
A password should be hard to crack, easy to memorize, should work on the system it's established for (think earlier LANMAN stuff). I think everyone agrees upon this. However, there have been some divergent schools of thought for sometime now on what a "solid" or "strong" password consists of in general terms. Everyone with access to something on the Internet in the last decade has had to have noticed the change in complexity requiremenets. It is not uncommon anymore for a password to have requrements such as:
- length (12+ chars)
- at least one from each group:
---- uppercase letters
---- lowercase letters
---- numerals
---- special charactors (%,#,$,%,^,&, for example)
- can't be reused X amount of times
- and so on.
On top of making a password hard to guess...and hopefully hard to crack (although I believe that ALL passwords, given the time and processing power, can be cracked), the method of how a password is encrypted and transmitted is constantly being revised and tested. Some of these include client-side encryption (OR hashing, with or without a salt), server-side (BAD Idea if you ask me), WEP, WPA2 with PEAK, etc.
Getting back to my point, I recently stayed at Henry's (my relative) house. I was on vacation and had zero desire to do anything with a computer. That was until he made a comment about his wireless router password using WEP. He didn't challenge me, but I thought it would be fun to capture some traffic and see if aircrack-ng, or even Cain & Able could crack his password. So, I deferred getting the password from him and proceeded to break out my AirPCAP tool and just "collect" some IV's. I figured that with 128-bit encryption set on his six year old router, that it wouldn't take long to gather enough IV's and crack the password. Afterall, my wife's cocky aunt had refused to give me her WPA2 protected password and I proceeded to gain that one (and two of her neighbors accidentally) within about 20 minutes. (I should add, with some cockyness, that she hasn't tried to talk trash to me again...LOL). Since the WPA2 crack was SOOOOO quick, and since my unique IV collection amount kept climbing rather quickly, I was certain that I would have his password in no time.
I was wrong. Henry's password proved to be VERY difficult for aircrack, using either Korek or PTW attacks. I decided to query Henry about his setup....I wasn't trying to force anything, just trying to crack gracefully. After talking with Henry, I verified that: 1) he was not broadcasting his ESSID (Cain picked that up for me really quickly though), it was only WEP he was using, and that NO special charactors were used. One question I neglected to ask him was the length of his password. It was LONG...30 chars
I decided that I would collect at least 50,000 unique IVs. With a 128-bit key, PTW should be OK with 40,000+ IVs. I let this collection run for awhile (I didn't actually clock it) and then piped it to the cracker.
The aircrack-ng GUI provides a relatively great UI. I used a variety of settings to attempt both the Korek attack and the PTW attack, even though I was seriously short of IVs for Koreks. I tried with and without using a known ESSID and/or BSSID, and after seeing the password, I tried adding 1,2,3,4, and 5 of the first decrypted charactors. No Joy!!! I couldn't believe it. I chalk some of this failure up to my trying to be gentle. However, and here is where my new side-project is coming from, it REALLY got me thinking about the value of computational complexity versus a just plain long password of numbers and letters. An interesting side not to this was that Henry's password contained ONLY charactors used in hex (A-F and 0-9), had at least two dictionary words at the start of the password and used some pretty common key-stroke patterns.
So know I want to spend some quality time with different crackers, password creation methods, encryption and hashing algorithms, etc. and just run some test on cracking WEP versus WPA2 and using passwords that contain only alpha-numerics and NOT special charactors. I think I will also compare passwords that are collections of dictionary words versus complex passwords. This just sounds like a LOT of fun to me.
I know that these types of evaluations have been done numerous times...but it sounds like fun AND it sounds like a realistic way to get more familiar with the tools and get reaquainted with some of the protocols. In any event, I am rambling which means I need to call it a day. Tomorrow's a busy day of more compliance work and a Doctor's appointment...yay. Plus, I guess it's time to start getting some rest if I am going to initiate this project and a few others I mentioned in an earlier post.
Wednesday, November 30, 2011
Updating My Certs - GPEN
Sat and passed the GPEN last week. It was a great class with John Strand in Baltimore. Test was definitely different than practice tests, but not so bad. Just because I am bored right now, I have updated my cert logo picture. :-)
Monday, November 21, 2011
Making my work day EASIER via a quick script
When I get to work, I have a group of things on the Windows box (that I am stuck using) that I both have to and want to have open on my desktops:
Outlook, for that annoying now enterprise email
Browser: with mutliple tabls to highly used sites
Some tools I use on a daily basis
File Browser
etc.
Bottom line is that I LOVE scripts. Well, I just plain love programming, and ANY kind of code is fun code to me. I believe that anyone working in IT more than a day at least KNOWS the value of scripting some tasks. I take it a little further and will try to script anything and everything I can. Whether it's OS apps I need or new Macros in UltraEdit, I REALLY want to make things as easy and streamlined as possible.
There are multiple solutions to using startup scripts. In GPOs you can assign scripts to the user(s) or to the actual box, at both start-up or shutdown. You can use a scheduled task to do something after a login executes or at particular times (like open your timecard application at lunchtime, for instance).
Another way....my preferred way, is write a simple bat file that will do what I want when I log onto the box, and I copy it to (Windows 7 Profession)
C:\Users\myusername\AppData\Roaming\Microsoft\Windows\Start Menu
Once I have a working bat file in this location, EVERY time I log in, the bat file runs and my world is at peace.
As an example one is below (really quick since I have a cert exam in 6 hours and it might be a good idea to get some sleep). I am doing this from memory so I am not 100% certain on the "start" syntax...but I know it's close.:
mybat.bat
@echo off
start /d "MyEmail" /PATHTOOUTLOOK/ outlook.exe
start /d "MyPages" /PATHTOFIREFOX/ firefox.exe http://www google.com http://www.espn.com
exit 0
In my example script, I am using firefox as opposed to IE. This is more than just personal preferrence. As of the last time I check, IE8 and IE9 did not support a way to open multiple tabs in one browser from the command line. I will recheck this and edit the entry if I find and test successfully some evidence contrary to what I initially read about this with IE8/9.
Outlook, for that annoying now enterprise email
Browser: with mutliple tabls to highly used sites
Some tools I use on a daily basis
File Browser
etc.
Bottom line is that I LOVE scripts. Well, I just plain love programming, and ANY kind of code is fun code to me. I believe that anyone working in IT more than a day at least KNOWS the value of scripting some tasks. I take it a little further and will try to script anything and everything I can. Whether it's OS apps I need or new Macros in UltraEdit, I REALLY want to make things as easy and streamlined as possible.
There are multiple solutions to using startup scripts. In GPOs you can assign scripts to the user(s) or to the actual box, at both start-up or shutdown. You can use a scheduled task to do something after a login executes or at particular times (like open your timecard application at lunchtime, for instance).
Another way....my preferred way, is write a simple bat file that will do what I want when I log onto the box, and I copy it to (Windows 7 Profession)
C:\Users\myusername\AppData\Roaming\Microsoft\Windows\Start Menu
Once I have a working bat file in this location, EVERY time I log in, the bat file runs and my world is at peace.
As an example one is below (really quick since I have a cert exam in 6 hours and it might be a good idea to get some sleep). I am doing this from memory so I am not 100% certain on the "start" syntax...but I know it's close.:
mybat.bat
@echo off
start /d "MyEmail" /PATHTOOUTLOOK/ outlook.exe
start /d "MyPages" /PATHTOFIREFOX/ firefox.exe http://www google.com http://www.espn.com
exit 0
In my example script, I am using firefox as opposed to IE. This is more than just personal preferrence. As of the last time I check, IE8 and IE9 did not support a way to open multiple tabs in one browser from the command line. I will recheck this and edit the entry if I find and test successfully some evidence contrary to what I initially read about this with IE8/9.
Tuesday, October 11, 2011
SANS560 at SANS Baltimore 2011
Just a quick one here. Today was day 2 of SANS Balitmore 2011, and I am even more impressed with the presentations we had today in SANS560 than we had in day 1. John Strand is our instructor, something a co-worker and I intentionally attempted to schedule, and it's been well worth it so far. It's not every day I get time to play with nmap, nessus, scapy, hping2, and tcpdump (well...tcpdump is pretty much everyday for me), but we spend some actual FUN time in those today. At least it was fun for me. There did appear to be some that struggled with the exercises due to a lack of non-familiarity. However, it seems as though everyone is enjoying it.
My employer paid for part of this training, but a chunk of change still had to/has to come from me. Had the class been boring or non-informative, I think I would be a little ticked off. However, even with having some experience pen-testing and having gone through other pen test training, I am so far thinking that I have gotten over 1000% ROI and that this has been one of the better classes so far...or it at least rivals the SANS507 I took earlier this year from David Hoelzer.
One of the nice things about most of today just being review...I could rather quickly run through the examples and work on installing both BackTrack 5r1 AND the newest release of Doug Burk's SecurityOnion (which there really is no excuse for anyone NOT to have by now). I am just having too much nerdy fun this week!
My employer paid for part of this training, but a chunk of change still had to/has to come from me. Had the class been boring or non-informative, I think I would be a little ticked off. However, even with having some experience pen-testing and having gone through other pen test training, I am so far thinking that I have gotten over 1000% ROI and that this has been one of the better classes so far...or it at least rivals the SANS507 I took earlier this year from David Hoelzer.
One of the nice things about most of today just being review...I could rather quickly run through the examples and work on installing both BackTrack 5r1 AND the newest release of Doug Burk's SecurityOnion (which there really is no excuse for anyone NOT to have by now). I am just having too much nerdy fun this week!
Subscribe to:
Posts (Atom)