[Weekly Viewing] You and Your Research & Ruby 2.0

This week we have another two videos lined up for you. The first, by Haroon Meer, I was luckily enough to see in person at Brucon 2011. It is one of the best talks I have ever had the privilege to see, by anyone. If you’re ever going to watch one of these ‘Weekly Viewing’ videos of mine make it be this one.

The second video is by Matz, the creator of Ruby, where he talks about Ruby’s development and the new features of Ruby 2.0. In his talk Matz says that Ruby 1.8 will die soon. So update already! ;)

#HITB2012KUL D1T2 – Haroon Meer – You and Your Research

read more…

Posted on 16 March, 2013 by ethicalhack3r

No Comments

[Weekly Viewing] Web App Security and Zero Days

This is a first of hopefully many weekly posts in which I will share online security related videos that I’ve watched during the week and think are worth sharing. This week I’ve got two great videos lined up for your viewing pleasure.

[OWASP AppSec USA 2012] Effective Approaches to Web Application Security – Zane Lackey

In this video Zane Lackey from Etsy talks about how to make a developer’s job easier by making things safe by default, how to detect risky functionality and how to automate aspects of web application security monitoring and response.

Effective Approaches to Web Application Security – Zane Lackey from OWASP AppSec USA on Vimeo.

read more…

Posted on 10 March, 2013 by ethicalhack3r

No Comments

Sony Freedom Of Information (FOI) Request

On the 14th of January the UK Information Commissioner’s Office (ICO) sent Sony Computer Entertainment Europe Limited a monetary penalty notice of £250,000 following ‘a serious breach of the Data Protection Act’.

To be able to quantify how much the ICO was fining Sony for individual user’s data the exact number of UK PSN users would need to be known. A couple of sources put this number at 3 million but I’m not sure where the original 3 million figure came from nor how accurate it really is [0][1].

If we were to take this 3 million figure at face value, the ICO fined Sony (£250,000 / 3,000,000) £0.000083 per user’s data. According to the ICO, £250,000 is ‘reasonable and proportionate’ in this case. To get a more accurate figure I sent the ICO a FOI request to ask for the redacted figure in the monetary penalty notice document which simply states “The Network Platform was used by an estimated REDACTED million customers in Europe, the Middle East, Africa, Australia and New Zealand with REDACTED million of those customers based in the UK.”.

read more…

Posted on 7 March, 2013 by ethicalhack3r

2 Comments

WordPress plugin Asset manager upload.php Arbitrary Code Execution

The ‘Inj3ct0r Team‘ compromised an ExploitHub.com database and released a file publicly which contained some of the data about the exploits that ExploitHub buy and sell.

I saw the file yesterday, had a quick skim over it, but didn’t think too much of it. That is until WPScan team member @gbrindisi pointed out that it contained 2 WordPress plugin vulnerabilities.

WordPress plugin Asset manager upload.php Arbitrary Code Execution,25.0000,2012-06-27 12:37:03,"491",Sooraj
WordPress plugin WP-Property uploadify.php Arbitrary Code Execution,25.0000,2012-06-27 12:44:25,"491",Sooraj

The vulnerability details and exploits are likely in the hands of the Inj3ct0r Team and god knows who else. We found the latest ‘asset-manager’ plugin (version 0.3) to be vulnerable and created a simple PoC. The ‘wp-property’ plugin did not contain the ‘uploadify.php’ file which is stated to be vulnerable, did they buy/sell vulnerabilities that hadn’t been verified? The ‘asset-manager’ plugin is not as popular as the ‘wp-property’ plugin and has only been downloaded ~700 times.

The ‘asset-manager’ vulnerability title states that the vulnerability lies within the ‘upload.php’ file. Taking a look at this file it is obvious to see why it is vulnerable.

read more…

Posted on 12 December, 2012 by ethicalhack3r

1 Comment

Introduction to the WordPress XML-RPC API

WordPress 3.5 was recently released which now comes with the WordPress API “always enabled”. Personally I think this adds unnecessary risk by increasing the attack surface. How many WordPress user’s actually use the API? I would put my money on it being a very small fraction, either way I’m sure the WordPress Core Development team had good reason to enable the API by default. After spending 5 minutes looking for where to turn the API off in WordPress 3.5 I gave up. Huh, I’ll have another look sometime soon.

I’ve had a play with the API in the past, however, I’ve always found it hard to get going as the information on how to interact with the API is a bit sparse. Having played with it for an hour or so this evening I thought I’d share some of the information on how to get started (as well as a self reminder ;).

The latest API calls can be found on WordPress’s Codex here. It doesn’t list all available calls, to find these let’s extract them from the ‘wp-includes/class-wp-xmlrpc-server.php’ file.

read more…

Posted on 11 December, 2012 by ethicalhack3r

3 Comments