DropBox's Terms of Service (ToS) change

A little while ago, DropBox changed their terms of service to update it with a few things. One of them being government taps. Lots of companies and consumers are concerned with the NSA sniffing data they shouldn't be snooping in on. As apart of this concern, DropBox has released a new agreement for their users. They have sent emails to their current users that is as follows as below (part of it):

If you click the link "Government Data Request Principles", then you will notice near the bottom it states the below image:

        "Governments should never install backdoors into online services or compromise infrastructure to                   obtain user data". 

This is great news because this means the NSA cannot install backdoor taps into DropBox in order to clamp down on people who may be using DropBox for legit reasons. If you upload just normal documents, they COULD sniff it and just read what it contains. This isn't right because people have a sense of privacy when they do this and by installing backdoors and reading this content it breaks that sense of privacy.

Of course this doesn't apply to people who use DropBox for illegal reasons. The government can still file a government subpoena and gain access to your data. DropBox has to provide them with the data because of the subpoena. 

Information gathering

A lot of people think that Hacking or Cracking is the only way to get digital data that is sensitive, but in reality there are many other methods. Social engineering, Dumpster diving, etc. are many other ways to get information the public was never meant to see.

Social engineering is simply making a phone call, knowing the right points of contacts and making sure you know what information you want. Kevin Mitnick was the famous hacker who used this method to gain usernames and passwords from people. http://en.wikipedia.org/wiki/Kevin_Mitnick

An example is as follows, a local IT member gets a call for a password reset from a person who is posing to work with the corporation. Now, because the company is so large, this IT person does not know everyone and cannot recognize their voice. Let's say this hacker starts a casual conversation with the IT person and starts talking about politics or the game that happened the night before. They could, also, say they need access to their account, immediately, for an important meeting. Once the IT person resets their password and lets them know it, then you have successfully gained access to an account you weren't supposed to have access to. Let's say they just reset it and never gave you the password, but you know through research that when they reset passwords it usually consists of some facets of their email address and something else you already know, which makes it easy to gain access to their password and account.

Many companies simply throw out information such as Health information or Military information in the trash. They don't shred this information or do anything to destroy this sensitive information. Some may even just dump it out back after they empty the office's trash cans. This leaves the data open and vulnerable to prying eyes walking around on the street. One can simply, jump in the dumpster and start searching for this data and presto, you have sensitive information in hand.

So there you have it, some simple ideas and alternatives that you can use to find out sensitive information.

Please remember that performing ANY of these tasks could force you to face legal action from the company you are attempting to gain physical access to the dumpster or calling to find out information. So please do not perform these actions, unless you have permission. I am not responsible for any legal repercussions you may face for your actions.

Apple iOS 7.0.6's patch and the security flaw that prompted the patch

Let's consider a scenario where you need to connect to your bank via a website. How can you ensure that the communication link between you and your bank is secure?

Secure Sockets Layer (SSL) or the newer version of SSL: Transport Layer Security (TLS) is two encryption protocols that can be used to make sure that no third party is listening in on your conversation with your bank. When a communication between two entities IS intercepted, then we consider this a Man in the Middle Attack or MitM.

A MitM attack is where the Victim is communicating with the Web Server via an SSL connection. The attacker listens in on this communication and grabs all the sensitive data being transferred between the two connections. The Victim will have no idea that this is occurring.

The issue with iOS before 7.0.6 was that this SSL connection was not verified before the connection was created. So this created issues with MitM attacks. If you have an iPhone, then you should update as soon as possible. Currently, OS X does not have a patch for this, yet.

You can see the security flaw advisement posted on Apple's website here: http://support.apple.com/kb/HT6147

The description mentions:

iOS 7.0.6

• Data Security 

• Available for: iPhone 4 and later, iPod touch (5th generation), iPad 2 and later 

• Impact: An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS 

• Description: Secure Transport failed to validate the authenticity of the connection. This issue was addressed by restoring missing validation steps. 

• CVE-ID 

• CVE-2014-1266

Privileged network means that if you and the attacker are sitting at Barnes and Nobles together, then he/she can start sniffing your secure connections, which in the case of banking or any sensitive information is concerned, you don't want that.

You can see the function (highlighted below) where the issue occurs.

static OSStatus
SSLVerifySignedServerKeyExchange(SSLContext *ctx, bool isRsa, SSLBuffer signedParams,
                                 uint8_t *signature, UInt16 signatureLen)
{
    OSStatus        err;
    SSLBuffer       hashOut, hashCtx, clientRandom, serverRandom;
    uint8_t         hashes[SSL_SHA1_DIGEST_LEN + SSL_MD5_DIGEST_LEN];
    SSLBuffer       signedHashes;
    uint8_t   *dataToSign;
 size_t   dataToSignLen;

 signedHashes.data = 0;
    hashCtx.data = 0;

    clientRandom.data = ctx->clientRandom;
    clientRandom.length = SSL_CLIENT_SRVR_RAND_SIZE;
    serverRandom.data = ctx->serverRandom;
    serverRandom.length = SSL_CLIENT_SRVR_RAND_SIZE;


 if(isRsa) {
  /* skip this if signing with DSA */
  dataToSign = hashes;
  dataToSignLen = SSL_SHA1_DIGEST_LEN + SSL_MD5_DIGEST_LEN;
  hashOut.data = hashes;
  hashOut.length = SSL_MD5_DIGEST_LEN;
  
  if ((err = ReadyHash(&SSLHashMD5, &hashCtx)) != 0)
   goto fail;
  if ((err = SSLHashMD5.update(&hashCtx, &clientRandom)) != 0)
   goto fail;
  if ((err = SSLHashMD5.update(&hashCtx, &serverRandom)) != 0)
   goto fail;
  if ((err = SSLHashMD5.update(&hashCtx, &signedParams)) != 0)
   goto fail;
  if ((err = SSLHashMD5.final(&hashCtx, &hashOut)) != 0)
   goto fail;
 }
 else {
  /* DSA, ECDSA - just use the SHA1 hash */
  dataToSign = &hashes[SSL_MD5_DIGEST_LEN];
  dataToSignLen = SSL_SHA1_DIGEST_LEN;
 }

 hashOut.data = hashes + SSL_MD5_DIGEST_LEN;
    hashOut.length = SSL_SHA1_DIGEST_LEN;
    if ((err = SSLFreeBuffer(&hashCtx)) != 0)
        goto fail;

    if ((err = ReadyHash(&SSLHashSHA1, &hashCtx)) != 0)
        goto fail;
    if ((err = SSLHashSHA1.update(&hashCtx, &clientRandom)) != 0)
        goto fail;
    if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0)
        goto fail;
    if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
        goto fail;
        goto fail;
    if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)
        goto fail;

 err = sslRawVerify(ctx,
                       ctx->peerPubKey,
                       dataToSign,    /* plaintext */
                       dataToSignLen,   /* plaintext length */
                       signature,
                       signatureLen);
 if(err) {
  sslErrorLog("SSLDecodeSignedServerKeyExchange: sslRawVerify "
                    "returned %d\n", (int)err);
  goto fail;
 }

fail:
    SSLFreeBuffer(&signedHashes);
    SSLFreeBuffer(&hashCtx);
    return err;
}

SOURCE: http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c?txt

Having an extra "goto fail;" outside of an IF statement basically makes the rest of the code null and invalid. The code will execute all the way up to the IF statement, then execute the "go to fail;" statement and never makes it to the rest of the code. Apple argues that this code still takes care of MOST SSL connections, but when we are talking about sensitive information, you dont want something that works MOST of the time. You want something that works ALL the time.

Wireshark at a glance

Wireshark or as it was formally known, Ethereal, is a tool that network administrators can use to sniff packets going across the wire. You can view many things from this perspective, such as login credentials going across the wire via clear text. You can also diagnose issues that may be occurring in your application your PC is running.

Wireshark gets installed in Promiscuous mode and this mode will allow you to sniff packets going across the network to and from any computer. (All traffic.)

In order for a network admin to stop this from happening is creating VLANs or Virtual Local Area Networks. By doing this, they can segment the network into many sub groups and separate them by routers. If this process is completed or exists in a network, then you can only sniff the traffic in your VLAN.

Go to the following link: http://www.wireshark.org/download.html in order to download Wireshark.

The installation screen will give you the below options.

In order for Wireshark to work, you will need to install WinPcap. Allow it to do so, when prompted.

When Wireshark opens, you will see the below screen. You will need to select an interface to listen for traffic on. This option will be under the "Capture" section. Once you select an interface, you can click "Start" and you will start to see traffic.

This is what the next screen will look like. You will of course see many updates happening, which is all the traffic occurring on your network/PC. You can stop the capture by clicking the square red button. This will NOT clear the screen for you, but will allow you to analyze the data easier.

If you cannot figure out which interface is active, you can click the button under "File" and it will bring up a window that will help you determine which one is active.

In order to take Wireshark out of promiscuous mode, you can go to "Capture" and select "Options". This will bring up the below window and the circled area is the checkbox you can uncheck or verify that this mode is active.

Now you are ready to start sniffing traffic on your network!

Do not sniff traffic in public places you do not have permission to be sniffing data in. I am not responsible for ANY legal repercussions you can face for the misuse of this blog or product. This information is for educational purposes ONLY.

Different types of Hacking

So what is hacking and how does it work?

First off, remember that anything that you learn in this blog is to be used ONLY for educational purposes and if you use this information for malicious purposes, you may face legal prosecution. 

There are many different types of hackers, but lets first define what a "hacker" is. The media defines a "hacker" as someone who breaks into systems and steals data for their own greedy purpose. 

In the hacking world, people who actually do this are called "crackers". They crack passwords and many other things. From this you can see how the name fits, but this world expands more than this.

We can classify these people into 3 categories:

• White hat
• Black hat
• Grey hat

White hat "hackers" are people who know have hacking skills and know how to exploit computers in the same fashion as "crackers", but their goal is to break into a system to better understand how to secure it.

Black hat "hackers" are people who break into a system to steal data and sell the data. These people may break into many different systems, deploy viruses, delete critical data and just flat out take out a service; they may cause havoc on a network.

Grey hat, these people are on the line of black and white. These members may use their skills for the side of good of helping other people out, but at the same time on another note use their skills to break into systems to steal data and resell it. 

I just talked about these three terms in the global world as far as the terms go, but we can talk about these terms in the world of Penetration Testing or PenTesting. Corporations may hire people to test their network. A white hat person is greatly associated with this scenario, but grey hats are people who can also be hired. Grey hats in this scenario are people who know very little about the target network. Black hat members hired to perform a PenTest know nothing about the network.

When corporations hire these members, they need to have an established set of permissions and a Non-disclosure Agreement (NDA) signed with the hiring corporation. This means that when the hired hackers find data that could compromise a company's network, they can not share it with anyone, but the company. If they share it with an outside entity, then they may face legal repercussion. 

Ethical hackers can be hired for this specific kind of testing. Ethical hackers need to follow protocol in order to provide a corporation with the necessary information they require about their network while maintaining a code of ethics. 

With all of this being said, not everyone is out to get you and not all hackers are bad. Some are out there to help you. So just remember you don't have to be on the dark side in order to know cool stuff!

A look into the world of Tor

Tor is a free tool that anyone can download, run and use to anonymize their internet activity. Think of Tor as in you talking to someone to get information about someone else. The person you are trying to get information about doesn't know you are getting information about them because they aren't answering your questions, but you still got the information you wanted.

In order to get Tor, go to: https://www.torproject.org/download/download

Once you run Tor, it will look like the below image. It will connect to the Tor network for you.

Once you have connected to the Tor network, FireFox will open up and tell you your IP address for the network. You can now start browsing the internet and not be traced!

The below image gives you a better idea of how Tor works. User 2 is trying to communicate with User 1. Let's say User 1 is a person or it can be a website. All User 2 has to do is connect to the Tor network and ask the network to fetch the website or a connection with User 1. Once Tor does this, they can bring you back the information you requested. Tor communicates with other Tor servers via an encrypted line so there is no trace that User 2 actually communicated to User 1. 

Now these Tor routers or servers are usually PCs and these PCs can exist anywhere in the world! A person in the US can bounce their connection off a PC in Germany. This has its pros and cons though. The pro here is that it doesn't look like you are accessing the websites. The con is that it takes forever to bounce a signal off a machine halfway across the planet, to your destination and back to you.

Also note that in RED, this is an unencrypted line and any information you pass to your destination is completely visable. So you don't want to be logging into any servers. 

Just remember that this information is NOT intended to be used for anything malicious and this information is for educational purposes ONLY. I am not responsible for any legal repercussions you face for your misguided actions conducted within Tor.

Credit Card Numbers - In-depth analysis

Every day everyone uses a credit card to pay for many different things out there. Whether it be your normal bills, or going out to eat, but how do they work?

• How do websites know my credit card is valid? 
• Do they have these numbers stored or do they pole credit card providers for the information? 

These are some of the questions we will be going over today.

A good resource, even though it is Wikipedia, is: http://en.wikipedia.org/wiki/Bank_card_number

The first 6 digits help you identify the vendor of the credit card number. Depending on the vendor, it may only be up to 4.

The first digit of a credit card number is the Major Industry Identifier (MII). MII digits represent the following issuer categories:

• 0 – ISO/TC 68 and other future industry assignments
• 1 – Airlines
• 2 – Airlines and other future industry assignments
• 3 – Travel and entertainment and banking/finance
• 4 – Banking and finance
• 5 – Banking and finance
• 6 – Merchandising and banking/finance
• 7 – Petroleum and other future industry assignments
• 8 – Healthcare, telecommunications and other future industry assignments
• 9 – National assignment

So now we have the first few digits identified. What do the other numbers mean?

In the old days, if you typed in your credit card number and purchased something online or provided your card over the phone, the manufacture would take up to a week to tell you the credit card number is wrong.

Now-a-days they can use an algorithm to validate the credit card number and tell you right away, before you even submit your card, that it is invalid. The algorithm is called the Luhn algorithm. This is the basic concept of how it works:

1. From the rightmost digit, which is the check digit, moving left, double the value of every second digit; if the product of this doubling operation is greater than 9, then sum the digits of the products.
2. Take the sum of all the digits.
3. If the total modulo 10 is equal to 0 (if the total ends in a zero) then the number is valid according to the Luhn formula; else it is not valid.

After you complete the math provided above on the given credit card number, the last digit is what you should come up with. If the digit does not match what you got, it's an invalid credit card. If it does, it's valid.

Since we like to focus on C#, I will post a C# implementation of the Luhn algorithm at a later time.