Skip to content

Posts from the ‘*nix’ Category

15
Dec

OpenBSD IPSec Possibly Probably Not Backdoored by FBI

In a post to the OpenBSD mailing list, developer Theo de Raadt reveals an email from an ex-contributor (Gregory Perry) alleging that money was accepted from the FBI around 2000-2001, in return for implementing a backdoor into the IPSec stack. Such a backdoor would give the FBI the ability to eavesdrop on any IPSec connection made using OpenBSD, or any other projects that have since made use of its IPSec code.

Clearly this would be a big deal if true, and although we know that open source projects are regularly backdoored by rogue developers or ‘hackers’ (such as the recent ProFTPd backdoor), it is not often that we hear of governments inserting some themselves. Should we be surprised? After all it is known that the NSA was involved with the development of DES by altering the algorithm’s S-Boxes and suggesting a shorter key length. There are also rumors of a covert backdoor in several versions of the Windows OS. That said, many people are smelling a troll in this case.

Following this information (can we call it a leak rumor?), OpenBSD’s IPSec code will undoubtedly come under quite a bit of scrutiny, and I’m sure we will hear a lot more about it should anything untoward be uncovered.

Read the full mailing list post here, archived below for posterity.

[Update] Scott Lowe denies being affiliated with the FBI, and Jason Wright denies having inserted a backdoor. This is sounding more and more like a trolling. To what end, I couldn’t speculate. It’s also worth noting that this kind of activity would probably not fall under a normal NDA, but under a government-level Top Secret classification which lasts at least 25 years…

An interesting observation about OpenBSD IPSec and Stuxnet. Read moreRead more

3
Dec

ProFTPD 1.3.3c Briefly Backdoored by Hackers

Servers of the widely popular FTP server, ProFTPD, were compromised (probably with 0day) on the 28th of November 2010. During the attack, some source code was modified to insert a backdoor. The source files affected were for ProFTPD version 1.3.3c., between the 28/11/2010 and 02/12/2010.

The backdoor introduced by the attackers allows unauthenticated users remote root access to systems which run the maliciously modified version of the ProFTPD daemon.

If you installed or updated ProFTPD from one of the official mirrors during that time, it is recommended that you recompile from a known good version of the code. The source modification was spotted and rectified on 01/12/2010. MD5 sums for the valid source tarballs:

8571bd78874b557e98480ed48e2df1d2 proftpd-1.3.3c.tar.bz2

4f2c554d6273b8145095837913ba9e5d proftpd-1.3.3c.tar.gz

Hit the jump for details on how the backdoor is triggered. A Metasploit module is available to automate the exploit. Read moreRead more

29
Nov

Armitage: Metasploit Attack Management GUI

Armitage, by Raphael Mudge, is a great little user interface for Metasploit which allows you to easily discover targets, deliver exploits, and manage your attacks to do things like pivots without any hassles.

Getting started with Armitage in Backtrack 4 R2 is easy. First, start the MySQL DB with /etc/init.d/mysql start (root/toor), and then start the Metasploit RPC daemon:

cd /pentest/exploits/framework3
./msfrpcd -f -U msf -P test -t Basic

Once msfrpcd is running, simply launch Armitage using the script provided and click Connect (you may need to check the Use SSL checkbox).

Armitage is written in Java, and works in Linux, Windows and Mac OS X. Download it here.

[Update] Armitage has been added to the Backtrack repos. Here’s a short tutorial, and check out the video tutorial below.

[Updated 21/01/2011] Hak5 episode 882 features a tutorial with mubix and Mudge (Hak5).

25
Nov

Pauldotcom Episode 221 – Talking Single Packet Authorization

Episode 221 of Pauldotcom Security Weekly is available for download. In it I give a tech segment about Single Packet Authorization, briefly describe how to configure your firewall and use fwknop to dynamically open ports.

The podcast is available on iTunes, and by direct download. Check out the show notes for full details. Thanks for having me on the show guys!

Here is a short video of fwknop in action:

23
Nov

BackTrack 4 r2 “Nemesis” Released

[Update 10/5/2011] BT4r2 is now superceded by the new and improved BackTrack 5!

BackTrack 4 r2 (codename “Nemesis”) has been released and brings a number of updates aimed at improving “desktop responsiveness, better hardware support, broader wireless card support, streamlined work environment”.

Updates include an updated kernel (2.6.35.8) with improved wireless support, USB 3.0, faster responsiveness, pruned and new packages, and a new BackTrack wiki for more documentation and support.

Users with existing BT4 installs/VMs can simply perform an update using:

apt-get update && apt-get dist-upgrade

BackTrack 4 r2 is available as a 2GB ISO, or 2.4GB VMWare image, on the downloads page (the BT4 download links appear to have been removed in favour of BT5).

css.php
WordPress Blog
WordPress Themes