https://jon.oberheide.org/ Recent content on Jon Oberheide Hugo -- gohugo.io en-us Fri, 15 May 2015 00:00:00 +0000 https://jon.oberheide.org/blog/2015/05/15/estimating-googles-two-factor-2sv-adoption/ Fri, 15 May 2015 00:00:00 +0000 https://jon.oberheide.org/blog/2015/05/15/estimating-googles-two-factor-2sv-adoption/ As a two-factor authentication vendor, reporters often ask us about the state of strong authentication. A common question that comes up is: How many people actually use two-factor authentication? What is the largest two-factor deployment? Well, the largest scale deployments of two-factor are often consumer use cases. Despite having very low adoption rates in terms of % of total users, large service providers like Google, Microsoft, Apple, etc have hundreds of million of users, dwarfing the 2FA deployments of even the largest enterprise use cases. https://jon.oberheide.org/blog/2013/07/16/rekey-fixing-androids-master-key-vulnerability/ Tue, 16 Jul 2013 00:00:00 +0000 https://jon.oberheide.org/blog/2013/07/16/rekey-fixing-androids-master-key-vulnerability/ Safely patch the Master Key vulnerabilities on your rooted Android device. Avoid waiting months or years for your carrier to deliver a security update. Created by your friendly neighborhood security experts at NEU and Duo Security. What is ReKey? Earlier this month, RFP from BlueBox published a sneak preview of his upcoming BlackHat talk, detailing a vulnerability in the Android platform that affects nearly all Android devices. Soon after, a vulnerability of similar nature and impact was published on Chinese forum. https://jon.oberheide.org/blog/2013/02/25/bypassing-googles-two-factor-authentication/ Mon, 25 Feb 2013 00:00:00 +0000 https://jon.oberheide.org/blog/2013/02/25/bypassing-googles-two-factor-authentication/ TL;DR - An attacker can bypass Google’s two-step login verification, reset a user’s master password, and otherwise gain full account control, simply by capturing a user’s application-specific password (ASP). (With all due respect to Google’s “Good to Know” ad campaign) Abusing Google’s (not-so-) Application-Specific Passwords Google’s 2-step verification makes for an interesting customer story in some of the challenges that go with such a wide-scale, comprehensive deployment of strong authentication. https://jon.oberheide.org/blog/2012/09/12/early-results-from-x-ray-over-50-of-android-devices-are-vulnerable/ Wed, 12 Sep 2012 00:00:00 +0000 https://jon.oberheide.org/blog/2012/09/12/early-results-from-x-ray-over-50-of-android-devices-are-vulnerable/ Later this week, on Friday, I’ll be presenting the preliminary results from our X-Ray project at Rapid7’s United Summit conference in San Francisco. X-Ray is Duo’s mobile app that performs “vulnerability assessment” on Android devices. Instead of scanning for malicious apps installed on the device like a mobile antivirus app would do (a nearly-intractable problem), X-Ray can identify known, yet unpatched, vulnerabilities in the mobile platform itself that could be exploited to take full control of users’ phones. https://jon.oberheide.org/blog/2012/07/25/announcing-xray-for-android/ Wed, 25 Jul 2012 00:00:00 +0000 https://jon.oberheide.org/blog/2012/07/25/announcing-xray-for-android/ The first public of X-Ray is now available! X-Ray 1.0 supports 8 of the most common privilege escalation vulnerabilities that affect the Android platform. What is X-Ray? X-Ray allows you to scan your Android device for security vulnerabilities that put your device at risk. X-Ray was developed by the security experts at Duo Security. We hope that X-Ray will empower users with knowledge of vulnerabilities on their devices and allow them to take action to improve their security. https://jon.oberheide.org/blog/2012/07/16/exploit-mitigations-in-android-jelly-bean-4-1/ Mon, 16 Jul 2012 00:00:00 +0000 https://jon.oberheide.org/blog/2012/07/16/exploit-mitigations-in-android-jelly-bean-4-1/ It’s been a few months since our analysis of the new ASLR support in Android ICS 4.0. Given that ICS 4.0 is old news now with the recent release of Jelly Bean 4.1, I thought it was about time to give an update on the ASLR capabilities as well as cover some of the other improvements in exploit mitigations present in Jelly Bean. As a quick recap of the current state of ASLR in Android ICS: https://jon.oberheide.org/blog/2012/06/21/dissecting-the-android-bouncer/ Thu, 21 Jun 2012 00:00:00 +0000 https://jon.oberheide.org/blog/2012/06/21/dissecting-the-android-bouncer/ At SummerCon this year, Charlie Miller and I gave a talk on Android\’s Bouncer. Our presentation materials are now publicly available. The week before our presentation, we also posted a teaser video showing our remote connect-back shell that we used to explore the Bouncer environment: Enjoy! https://jon.oberheide.org/blog/2012/03/21/announcing-vpn-hunter/ Wed, 21 Mar 2012 00:00:00 +0000 https://jon.oberheide.org/blog/2012/03/21/announcing-vpn-hunter/ Today, we’re excited to announce the public launch of VPN Hunter! VPN Hunter is a service that discovers and classifies the VPNs and other remote access services of any organization. Given only an organization’s domain name (eg. msu.edu), VPN Hunter can find a wide range of remote access services associated with that organization, such as: SSL VPNs: VPN Hunter will seek out SSL VPNs from vendors including Juniper, Cisco, Palo Alto, Citrix, Fortinet, F5, SonicWALL, Barracuda, Microsoft, and Array. https://jon.oberheide.org/blog/2012/02/27/aslr-in-android-ice-cream-sandwich-4-0/ Mon, 27 Feb 2012 00:00:00 +0000 https://jon.oberheide.org/blog/2012/02/27/aslr-in-android-ice-cream-sandwich-4-0/ When I first saw the release notes for the new Android Ice Cream Sandwich (ICS) platform, I was excited to see that Google mentioned that \“Android 4.0 now provides address space layout randomization\”: For the uninitiated, ASLR randomizes where various areas of memory (eg. stack, heap, libs, etc) are mapped in the address space of a process. Combined with complementary mitigation techniques such as non-executable memory protection (NX, XN, DEP, W\\^X, whatever you want to call it), ASLR makes the exploitation of traditional memory corruption vulnerabilities probabilisticallydifficult. https://jon.oberheide.org/blog/2011/11/27/csaw-ctf-2011-kernel-exploitation-challenge/ Sun, 27 Nov 2011 00:00:00 +0000 https://jon.oberheide.org/blog/2011/11/27/csaw-ctf-2011-kernel-exploitation-challenge/ My challenge for this year\’s NYU Poly CSAW CTF finals was a Linux kernel exploitation challenge disguised as a crypto challenge. The challenge and solution are described below. The Challenge Each team is given unprivileged remote shell access to a Linux VM. There is a custom kernel module, SqueamishOssifrage.ko, loaded.The full source code of the kernel module is provided to the team. SqueamishOssifrage.c is reproduced below (and can be downloaded here): https://jon.oberheide.org/blog/2011/09/08/tool-releases-ksymhunter-and-kstructhunter/ Thu, 08 Sep 2011 00:00:00 +0000 https://jon.oberheide.org/blog/2011/09/08/tool-releases-ksymhunter-and-kstructhunter/ I\’m releasing a couple tools I use internally for Linux kernel exploit development: ksymhunter and kstructhunter. They\’re probably only useful for like ten people on the planet, but oh well, enjoy! ksymhunter Kernel symbols are definitely a useful resource when writing Linux kernel exploits. Whether you\’re looking for particular structures in kernel memory or pulling the old commit_creds technique for convenient privilege escalation, having access to a kernel symbol table can be incredibly useful for an exploit writer. https://jon.oberheide.org/blog/2011/07/06/stackjackin-2-electric-boogaloo/ Wed, 06 Jul 2011 00:00:00 +0000 https://jon.oberheide.org/blog/2011/07/06/stackjackin-2-electric-boogaloo/ Last month at SummerCon, Dan Rosenberg and I talked about our stackjacking technique for exploiting kernel vulnerabilities on grsecurity/PaX-hardened Linux kernels, in a presentation titled \“Stackjacking and Other Kernel Nonsense.\” While we covered a lot of material from our original stackjacking presentation, we also presented on a couple new items extending the original stackjacking technique: We discussed about how enhancements to the vanilla Linux kernel, such as SMEP, may make stackjacking an effective approach for vanilla kernel exploitation. https://jon.oberheide.org/blog/2011/06/21/rsa-proofing-our-duo-push-two-factor-authentication/ Tue, 21 Jun 2011 00:00:00 +0000 https://jon.oberheide.org/blog/2011/06/21/rsa-proofing-our-duo-push-two-factor-authentication/ So…RSA happened. We haven’t commented much on the RSA breach, primarily because, instead of ambulance chasing, we’ve been busy working on some technology to prevent RSA-style attacks from impacting our Duo Push authentication, which is the subject of today’s post. However, I think there are a couple interesting points that can be drawn from the RSA breach: First, the RSA breach has shown that two-factor technology is incredibly effective. The attackers targeting Lockheed Martin and company had to plan an entirely separate operation to compromise RSA’s internal secrets to even get their foot in the door of the defense contractors. https://jon.oberheide.org/blog/2011/06/08/duo-push-the-next-generation-of-two-factor-authentication/ Wed, 08 Jun 2011 00:00:00 +0000 https://jon.oberheide.org/blog/2011/06/08/duo-push-the-next-generation-of-two-factor-authentication/ We’re excited to announce that we’ve officially launched Duo Push, a new authentication method that leverages modern smartphones to provide two-factor authentication that’s both resistant to the latest threats and is actually enjoyable to use! But first, some background… When we first started Duo, we set out to create a two-factor authentication platform that was not only secure, but also easy to use and manage. We saw that two-factor authentication technologies were avoided not because they failed to offer an increase in security, but because their cost, management complexity, and user annoyance factor were prohibitively high. https://jon.oberheide.org/blog/2011/05/28/when-angry-birds-attack-android-edition/ Sat, 28 May 2011 00:00:00 +0000 https://jon.oberheide.org/blog/2011/05/28/when-angry-birds-attack-android-edition/ It\’s been about six months since I reported a vulnerability in the Android mobile platform that allowed the unprompted installation of arbitrary applications with arbitrary permissions on a victim\’s device. While the vulnerability has long been fixed on Android handsets around the world, I\’ve yet to write up any technical details about it, and it\’s unlikely you\’ve heard of it unless you were present at our ShmooCon presentation earlier this year. https://jon.oberheide.org/blog/2011/04/20/stackjacking-your-way-to-grsec-pax-bypass/ Wed, 20 Apr 2011 00:00:00 +0000 https://jon.oberheide.org/blog/2011/04/20/stackjacking-your-way-to-grsec-pax-bypass/ This April at Hackito Ergo Sum in Paris and Immunity\’s Infiltrate in Miami, Dan Rosenberg and I presented on a technique to exploit grsecurity/PaX-hardened Linux kernels. Read on for a brief overview of our presentation and a link to the full slides and PoC code. The Stackjacking Technique In our slides, we presented a technique to exploit a grsecurity/PaX-hardened Linux kernel (eg. GRKERNSEC_HIGH) given the existence of two exploitation primitives: https://jon.oberheide.org/blog/2011/03/07/how-i-almost-won-pwn2own-via-xss/ Mon, 07 Mar 2011 00:00:00 +0000 https://jon.oberheide.org/blog/2011/03/07/how-i-almost-won-pwn2own-via-xss/ No, seriously. The good: Google has patched a serious vulnerability I discovered in the Android web market. The bad: Since the Android web market was launched earlier this year, it was possible to remotely install arbitrary applications with arbitrary permissions onto a victim\’s phone simply by tricking them into clicking a malicious link (either on their desktop OR phone). The exploit works universally across all Android devices, versions, and architectures. https://jon.oberheide.org/blog/2010/11/29/exploiting-stack-overflows-in-the-linux-kernel/ Mon, 29 Nov 2010 00:00:00 +0000 https://jon.oberheide.org/blog/2010/11/29/exploiting-stack-overflows-in-the-linux-kernel/ In this post, I\’ll introduce an exploitation technique for kernel stack overflows in the Linux kernel. Keep in mind this does not refer to buffer overflows on the kernel stack (whose exploitability is well understood), but rather the improper expansion of the kernel stack causing it to overlap with critical structures which may be subsequently corrupted. This is a vulnerability class in the Linux kernel that I do not believe have been exploited publicly in the past, but is relevant due to a recent vulnerability in the Econet packet family. https://jon.oberheide.org/blog/2010/11/02/csaw-ctf-kernel-exploitation-challenge/ Tue, 02 Nov 2010 00:00:00 +0000 https://jon.oberheide.org/blog/2010/11/02/csaw-ctf-kernel-exploitation-challenge/ The finals for NYU Poly\’s CSAW CTF was this past weekend in New York City. I thought I would post the kernel exploitation challenge I developed for the final round. Feel free to try your hand at solving it! The Setup Each team is given unprivileged remote shell access to a Linux VM. There is a vulnerable kernel module (csaw.ko) loaded into memory: csaw@csaw ~ $ lsmod Module Size Used by csaw 1111 0 The kernel module exposes a /proc/csaw interface with which the team can interact with and attempt to exploit the vulnerability contained in the kernel module. https://jon.oberheide.org/blog/2010/10/23/linux-kernel-pktcdvd-memory-disclosure/ Sat, 23 Oct 2010 00:00:00 +0000 https://jon.oberheide.org/blog/2010/10/23/linux-kernel-pktcdvd-memory-disclosure/ A vulnerability in the pktcdvd driver in the Linux kernel allows for the disclosure of 4 bytes of kernel memory. In this post, I\’ll describe the tad bit of magic that\’s necessary to exploit the vulnerability on both 32-bit and 64-bit hosts to disclosure an arbitrary amount of kernel memory. The Vulnerability The vulnerability was first introduced in 2.6.10 (way back in 2004) and was recently discovered in late September 2010 by Dan Rosenberg. https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/ Fri, 10 Sep 2010 00:00:00 +0000 https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/ Ben Hawkes discovered a vulnerability in the Controller Area Network (CAN) packet family in the Linux kernel that results in a controllable overflow of a SLUB-allocated structure. As there\’s not a whole lot of modern, public examples of SLUB overflow exploits, I\’ll describe my exploit of the CAN vulnerability in detail. The Vulnerability Ben provides the full details of the vulnerability in his blog post: A controller area network is backed by the AF_CAN datagram socket type. https://jon.oberheide.org/blog/2010/08/10/dexcode-teardown-of-the-android-sms-trojan/ Tue, 10 Aug 2010 00:00:00 +0000 https://jon.oberheide.org/blog/2010/08/10/dexcode-teardown-of-the-android-sms-trojan/ I got my hands on a copy of the recent Android SMS trojan that commits toll fraud via SMS messages to premium Russian shortcodes. What follows is a brief teardown of the APK and disassembly of the trojan\’s dexcode and description of its malicious functionality. It\’s incredibly simple in nature so there\’s not much detail to go into. Package: RU.apk Package Name: org.me.androidapplication1 Permissions Requested: android.permission.SEND_SMS Contents: ./classes.dex ./res ./res/drawable . https://jon.oberheide.org/blog/2010/06/28/a-peek-inside-the-gtalkservice-connection/ Mon, 28 Jun 2010 00:00:00 +0000 https://jon.oberheide.org/blog/2010/06/28/a-peek-inside-the-gtalkservice-connection/ This posts aims to peek inside the Android GTalkService connection and observe its protocol. In particular, we\’re interested in the INSTALL_ASSET message and whether or not it is protected by any additional cryptographic signatures beyond the intended guarantees provided by the SSL transport. A Brief Introduction to the GTalkService If you haven\’t read the previous post on the GTalkService and INSTALL_ASSET/REMOVE_ASSET, do so first. In short, the GTalkService is a persistent connection maintained from your Android phone to Google\’s servers at all time. https://jon.oberheide.org/blog/2010/06/25/remote-kill-and-install-on-google-android/ Fri, 25 Jun 2010 00:00:00 +0000 https://jon.oberheide.org/blog/2010/06/25/remote-kill-and-install-on-google-android/ In this post, I\’ll talk about the REMOVE_ASSET and INSTALL_ASSET mechanisms that can be invoked by Google via Android\’s GTalkService to not only remotely remove applications from an Android device but also remotely install new applications. RootStrap Background So if you didn\’t check out my slides from SummerCon last week in NYC, I talked a bit about a program called RootStrap in the second half of my talk. RootStrap is intended as an example of an application that could be used to bootstrap a rootkit (hence the name). https://jon.oberheide.org/blog/2010/06/21/summercon-2010-slides/ Mon, 21 Jun 2010 00:00:00 +0000 https://jon.oberheide.org/blog/2010/06/21/summercon-2010-slides/ SummerCon was absurdly fun. Thanks for redpantz for putting on a great event and all the NY guys for making it a blast. My talk was on a few random Android topics...slides are available below. I threw everything together about 12 hours before my talk so it\’s a little rough around the edges and a few slides have been redacted for now. https://jon.oberheide.org/blog/2010/04/25/source-boston-slides/ Sun, 25 Apr 2010 00:00:00 +0000 https://jon.oberheide.org/blog/2010/04/25/source-boston-slides/ Just got back from SOURCE Boston. SOURCE was a great event: a great line-up of speakers, fun social events (thanks to Rapid7 and iSEC for sponsoring), and smooth execution (props to Stacy and Zach). My talk was on the topic of Linux kernel security, slides are available here. https://jon.oberheide.org/blog/2010/04/10/reiserfs-reiserfs_priv-vulnerability/ Sat, 10 Apr 2010 00:00:00 +0000 https://jon.oberheide.org/blog/2010/04/10/reiserfs-reiserfs_priv-vulnerability/ A vulnerability in the ReiserFS filesystem of the Linux kernel (versions <= 2.6.34-rc3) allows for the unprivileged reading and writing of objects in the .reiserfs_priv path. Leveraging extended attributes and POSIX file-based capabilities, this vulnerability allows for privilege escalation on systems with a ReiserFS filesystem. The Vulnerability The vulnerability was introduced in May 2009 in commit 677c9b2. The commit was intended to simplify the logic around ReiserFS\’s privroot, a virtual path located at . https://jon.oberheide.org/blog/2009/10/04/linux-kernel-x86-64-register-leak/ Sun, 04 Oct 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/10/04/linux-kernel-x86-64-register-leak/ A recent vulnerability in the Linux kernel (versions <= 2.6.32-rc1) allows the leakage of certain register contents. The x86-64 registers r8-r11 may be leaked to 32-bit unprivileged userspace applications that switch themselves into 64-bit mode. Introduction In order to understand this vulnerability, we first need to talk a bit about the x86-64 architecture (aka amd64). One of the key design decisions of x86-64, which fueled its adoption over IA-64, is its backward compatibility with 32-bit code. https://jon.oberheide.org/blog/2009/09/28/disabling-green-dam-with-dam-burst/ Mon, 28 Sep 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/09/28/disabling-green-dam-with-dam-burst/ Dam Burst is a simple utility that allows an unprivileged user to disable the censorship functionality of the Green Dam Youth Escort software. Dam Burst operates by injecting code into a running application and removing the Green Dam hooks that enable it to monitor and block user activity, effectively restoring the running application to its original uncensored state. Unlike other tools that disable or uninstall the Green Dam software, Dam Burst does not require administrative privileges. https://jon.oberheide.org/blog/2009/08/29/linux-kernel-getname-stack-memory-disclosures/ Sat, 29 Aug 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/08/29/linux-kernel-getname-stack-memory-disclosures/ In this post, we\’ll look at some kernel stack information disclosures in the getname() functions of several socket AFs recently discovered in the Linux kernel. The Vulnerability The getname() function of an address family in the kernel is used to retrieve information about a given socket. This information, in the form of a sockaddr struct, is accessed from userspace through the getsockname(2) and getpeername(2) system calls for bound and connected sockets respectively. https://jon.oberheide.org/blog/2009/08/10/polypack-at-usenix-woot-09/ Mon, 10 Aug 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/08/10/polypack-at-usenix-woot-09/ We just presented our PolyPack research today at the USENIX Workshop on Offensive Technologies (WOOT \‘09) in Montreal, Canada. Links to the paper and presentation materials are after the jump. Paper: /files/woot09-polypack.pdf Presentation: /files/woot09-polypack-pres.pdf From the PolyPack website: \“PolyPack is a research project at the University of Michigan aimed at understanding the impact of malware packers on modern antivirus products. PolyPack highlights the failure of signature-based antivirus against common, widely available packers, investigates the role that diversity plays in the capabilities of both the packers and antivirus engines, and demonstrates the ease and efficacy with which an attacker could deploy an online packing service for nefarious purposes in a deployment model known as crimeware-as-a-service (CaaS). https://jon.oberheide.org/blog/2009/07/12/hijacking-tinychat-screencasts/ Sun, 12 Jul 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/07/12/hijacking-tinychat-screencasts/ Tinychat is a sweet site that allows for simple chat, video conferencing, and screencasting. In this post, I\’ll detail how to hijack Tinychat screencasts by injecting images of your own. I had played with Tinychat recently and decided to poke at it some more when mubix held a Metasploit-related screencast a couple days ago. Tinychat\’s multimedia features operate with a mix of JavaScript, Java, and Flash. Just looking at the initial JavaScript used to set up the screencasting applet set off some alarms: https://jon.oberheide.org/blog/2009/06/30/analysis-of-a-trojaned-ssh-sshd/ Tue, 30 Jun 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/06/30/analysis-of-a-trojaned-ssh-sshd/ Some information about a trojaned ssh client and sshd server discovered in a recent compromise. I didn\’t find any details on this particular OpenSSH backdoor via Google, so hopefully this information will be of use to anyone who runs into it on their boxes. The compromise of a group of small number of Linux boxes in a University unit was first discovered when the attackers began launching ssh brute force attacks from the boxes. https://jon.oberheide.org/blog/2009/04/20/udev-local-privilege-escalation/ Mon, 20 Apr 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/04/20/udev-local-privilege-escalation/ A recent bug found by Sebastian Krahmer in udev has considerable security impact across a wide range of Linux distributions. At the core of the vulnerability is the udevd daemon, responsible for receiving and handling various device events from the kernel. These events are delivered to udevd via netlink, a socket family (AF_NETLINK) commonly used for IPC between userspace applications and the kernel. However, netlink is not exclusively for kernel/userspace communication and can also be used to send messages between userspace applications. https://jon.oberheide.org/blog/2009/04/15/panera-gift-card-security/ Wed, 15 Apr 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/04/15/panera-gift-card-security/ A bit of information on Panera Bread\’s gift card security, or lack thereof. Traditional gift card security often involves a randomized account number and a scratch-off PIN number. Randomized account numbers prevent attackers from guessing valid accounts numbers to use. Scratch-off PIN numbers prevent attackers from checking/using card numbers and from going in to brick-and-mortar stores to capture numbers of unactiviated cards on the racks (checkout clerks are advised to discard any cards that already have the PIN scratched-off or otherwise tampered with). https://jon.oberheide.org/blog/2009/03/25/dpkt-tutorial-4-as-paths-from-mrt-bgp/ Wed, 25 Mar 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/03/25/dpkt-tutorial-4-as-paths-from-mrt-bgp/ Previously we looked at creating ICMP echo requests, parsing a PCAP file, and doing DNS spoofing with the dpkt framework. Today I will show how to parse the AS paths of BGP messages out of MRT routing dumps. Parsing BGP routing information is fun. However, before projects like RouteViews were around, getting a global view of Internet routing in real-time simply wasn\’t possible. But thanks to RouteViews, we can extract useful routing information from the MRT dumps from a number of providers\’ perspectives. https://jon.oberheide.org/blog/2009/03/07/arbsec-01-wrap-up/ Sat, 07 Mar 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/03/07/arbsec-01-wrap-up/ ARBSEC 01 was a great success! Thanks for everyone who came out, Bar Louie for hosting, and dugsong for taking some pictures! Be sure to join us for future ARBSEC meetings, the first Wednesday of each month. jose, grue, steiza, svowels, mattbing, and more. honey, jono, olga, bfields, nuxi, and more. Dropping some Barracuda 0-day! https://jon.oberheide.org/blog/2009/02/19/arbsec-officially-launched/ Thu, 19 Feb 2009 00:00:00 +0000 https://jon.oberheide.org/blog/2009/02/19/arbsec-officially-launched/ ARBSEC, a CitySec-style meetup for security professionals in the Ann Arbor area, has been officially launched! Our first meeting, ARBSEC 01, will be at 6:00pm on March 4th at Bar Louie in Ann Arbor. What An informal meetup of information security professionals in Ann Arbor. Unlike other meetups, you will not be expected to pay dues, \“join up\“, or present a zero-day exploit to attend. Where ARBSEC 01 is held at Bar Louie, located at 401 E Liberty St, on the northeast corner of Liberty and Division. https://jon.oberheide.org/blog/2008/12/20/dpkt-tutorial-3-dns-spoofing/ Sat, 20 Dec 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/12/20/dpkt-tutorial-3-dns-spoofing/ In our first and second dpkt tutorials, we looked at the simple construction and parsing of packets respectively. Our third tutorial combines both parsing and construction of packets in a single utility for performing DNS spoofing (a la dsniff\’s dnsspoof). dpkt is a sweet framework for creating and parsing packets. While dpkt doesn\’t have much documentation, once you get the hang of using one module, the rest fall into place fairly easily. https://jon.oberheide.org/blog/2008/11/20/virustotal-python-submission-script/ Thu, 20 Nov 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/11/20/virustotal-python-submission-script/ Here is a simple python script for batch malware submissions to VirusTotal via its email interface. Simply replace the SMTP-related variables at the top of the script and you\’re ready to rock! Download vtsubmit.py #!/usr/bin/env python # vtsubmit.py # VirusTotal Submission Script # Jon Oberheide <jon@oberheide.org> # http://jon.oberheide.org import os, sys, email, smtplib, hashlib SMTP_HOST = '_HOST_' SMTP_PORT = 587 SMTP_USER = '_USER_' SMTP_PASS = '_PASS_' TO_ADDR = 'scan@virustotal.com' FROM_ADDR = '_EMAIL_' def main(): if len(sys. https://jon.oberheide.org/blog/2008/10/15/dpkt-tutorial-2-parsing-a-pcap-file/ Wed, 15 Oct 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/10/15/dpkt-tutorial-2-parsing-a-pcap-file/ As we showed in the first dpkt tutorial, dpkt makes it simple to construct packets. dpkt is equally useful for parsing packets and files, so in this second tutorial we will demonstrate parsing a PCAP file and the packets contained within it. dpkt is a sweet framework for creating and parsing packets. While dpkt doesn\’t have much documentation, once you get the hang of using one module, the rest fall into place fairly easily. https://jon.oberheide.org/blog/2008/09/04/bash-brace-expansion-cleverness/ Thu, 04 Sep 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/09/04/bash-brace-expansion-cleverness/ Brace expansion is a nice feature in the Bash interpreter that happened to be exactly what I needed during an audit. A good thing to log away in memory in case you ever find yourself in a pen-test environment with similar constraints. Bash Command Injection During an audit of a popular email appliance, I encountered a scenario where attacker controlled input was improperly sanitized and passed as the argument to a command in a shell interpreter. https://jon.oberheide.org/blog/2008/08/25/dpkt-tutorial-1-icmp-echo/ Mon, 25 Aug 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/08/25/dpkt-tutorial-1-icmp-echo/ In this dpkt tutorial, I will demonstrate how to construct and send a simple ICMP echo packet. dpkt is a sweet framework for creating and parsing packets. While dpkt doesn\’t have much documentation, once you get the hang of using one module, the rest fall into place fairly easily. I\’ll be doing a number of dpkt tutorials with simple tasks in hopes of providing some \“documentation by example\“. If you have any tasks you\’d like to see done in dpkt, drop me a line. https://jon.oberheide.org/blog/2008/08/10/hardening-dns-with-ip-ttls/ Sun, 10 Aug 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/08/10/hardening-dns-with-ip-ttls/ During Paul Vixie\’s talk at WOOT on some of the operational challenges of deploying source port randomization functonality in BIND, I started thinking of a few simple ways to harden DNS infrastructure against VU#800113 by leveraging the IP TTL value. DNS Cache Poisoning In order to increase the resilience of DNS against Dan Kaminsky\’s cache poisoning attack, source port randomization has been added to recursive DNS resolvers. Now, in addition to guessing the 16-bit TXID, the attacker must also guess the 16-bit source port that the resolver used for the particular query. https://jon.oberheide.org/blog/2008/08/02/hotsec-2008-and-usenix-security-2008/ Sat, 02 Aug 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/08/02/hotsec-2008-and-usenix-security-2008/ I\’m back from San Jose finally and while I won\’t be breaking down a full review of HotSec and USENIX Security like I did for WOOT, I thought I would point out some of the more interesting presentations I was able to attend. HotSec 2008 Panic Passwords: Authenticating under Duress Jeremy Clark and Urs Hengartner, University of Waterloo Some interesting duress schemes were presented such as 5-dictionary (using 5 distinct words from dictionary to prevent from invalid keys being interpreted as a duress key). https://jon.oberheide.org/blog/2008/07/28/woot-2008-the-good-the-bad-and-the-ugly/ Mon, 28 Jul 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/07/28/woot-2008-the-good-the-bad-and-the-ugly/ Day one of my trip out to San Jose to attend the WOOT, HotSec, and USENIX Security trifecta is over. The 2nd Workshop on Offensive Technologies (WOOT) took place today and I\’ll be breaking it down with \“The Good, The Bad, and The Ugly\“. I\’ll be discussing a few of the presentations at WOOT today: the ones that peaked my interest (The Good), the ones that didn\’t meet my expectations (The Bad), and the funny or miscellaneous topics that were discussed (The Ugly). https://jon.oberheide.org/blog/2008/07/21/pdpt-passive-dns-port-test/ Mon, 21 Jul 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/07/21/pdpt-passive-dns-port-test/ The Passive DNS Port Test (PDPT) tool acts as a passive DNS monitor to flag resolvers that may be vulnerable to the cache poisoning issue described in CERT VU #800113. Similar to OARC\’s porttest, this monitor will judge the source port behavior of resolvers based on the standard deviation of observed source ports. The Passive Approach Another VU #800113-related testing tool? Of course, we\’ve already seen a number of tools released to help administrators identify and patch vulnerable resolvers: Dan has the DNS Checker tool on his website to allow visitors to test their resolvers. https://jon.oberheide.org/blog/2008/07/21/uofm-specific-phishing-campaign/ Mon, 21 Jul 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/07/21/uofm-specific-phishing-campaign/ While receiving phishing emails in my University inbox is a common occurrence, a recent email caught my eye due to its increased sophistication and University-specific information. Email Contents Dear Umich.edu WEBLOGIN Subscriber To complete your Umich.edu WEBLOGIN account, you must reply to this email immediately and enter your password here (*********) Failure to do this will immediately render your email address deactivated from our database. You can also confirm your email address by logging into your Umich. https://jon.oberheide.org/blog/2008/04/09/beware-of-google-app-engine-sdk/ Wed, 09 Apr 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/04/09/beware-of-google-app-engine-sdk/ An easily exploited vulnerability in Google App Engine\’s SDK can put your development servers at risk. While this bug is trivial to fix, engineers at Google have declined to address the vulnerability, so be cautious when using the SDK to develop your web service. The Vulnerability The vulnerability exists in the mail API of the Google App Engine SDK, specifically in google/appengine/api/mail_stub.py: def _SendSendmail(self, mime_message, popen=subprocess.Popen, sendmail_command='sendmail'): try: tos = [mime_message[to] for to in ['To', 'Cc', 'Bcc'] if mime_message[to]] sendmail_command = '%s %s' % (sendmail_command, ' '. https://jon.oberheide.org/blog/2008/02/22/black-hat-dc-2008-briefings/ Fri, 22 Feb 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/02/22/black-hat-dc-2008-briefings/ Just arrived home from Washington, DC where I attended and presented at the Black Hat DC Briefings. I was fairly busy throughout the briefings and didn\’t make it to as many presentations as I hoped, but I thought I\’d detail a few of the more interesting ones. Presentations of Interest Cracking GSM David Hulton and Steve, Pico Computing, Inc. David and Steve\’s presentation on GSM cracking definitely received the most attention of the briefings. https://jon.oberheide.org/blog/2008/02/10/exploiting-live-virtual-machine-migration/ Sun, 10 Feb 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/02/10/exploiting-live-virtual-machine-migration/ Later this week, I\’ll be presenting at the Black Hat DC Briefings on weaknesses in the security of live virtual machine migration as implemented by popular vendors such as VMware and Xen. I thought I\’d provide a teaser in advance of my presentation detailing some of the topics that will be discussed. A Trip Down Memory Lane If you take a look back at the past few years, we\’ve seen a systematic breaking down of isolation boundaries within our computing platforms as new technologies such as virtualization are employed. https://jon.oberheide.org/blog/2008/01/15/detecting-and-evading-cwsandbox/ Tue, 15 Jan 2008 00:00:00 +0000 https://jon.oberheide.org/blog/2008/01/15/detecting-and-evading-cwsandbox/ CWSandbox is one of the most comprehensive and full featured platforms for automated malware analysis. In this post, we detail how a malware sample being analyzed by CWSandbox may detect and evade the monitoring functionality of CWSandbox in order to disguise its malicious activities. Introduction to CWSandbox CWSandbox is a platform developed by Sunbelt Software to automate the analysis of malware samples inside a controlled environment. It generates detailed reports of the runtime behavior of malware by monitoring the Win32 API calls a sample makes during its execution. https://jon.oberheide.org/blog/2007/11/30/xkcd-malware-visualization/ Fri, 30 Nov 2007 00:00:00 +0000 https://jon.oberheide.org/blog/2007/11/30/xkcd-malware-visualization/ A recent xkcd comic related to malware visualization is eerily similar to a system we\’re currently running at the University of Michigan. The xkcd Comic Our System The system pictured is a production version of an architecture we proposed last year at HotSec \‘07 (paper, presentation), essentially a network-based AV service. The backend analysis system consists of Xen-based virtualized containers which host various detection engines. Candidate executables/files are acquired by a lightweight host-agent (hooking CreateProcess on Win32, Dazuko on Linux/BSD, etc) and transmitted to the backend for analysis by a bajillion (ok, maybe only 12) antivirus and behavioral engines. https://jon.oberheide.org/blog/2007/08/15/facebook-xss/ Wed, 15 Aug 2007 00:00:00 +0000 https://jon.oberheide.org/blog/2007/08/15/facebook-xss/ Facebook\’s new-fangled applications functionality seemed like a ripe opportunity for nasty cross-site scripting bugs. As it turns out, multiple XSS vulnerabilities were present in the fb:swf tag of the Facebook Markup Language. FBML XSS Vulnerabilities Given that Facebook seems to roll out tons of new functionality all the time without proper security testing and auditing, I was sure there had to be at least a few holes. I finally got the motivation to do some bug hunting while at USENIX Security, where I met a student, Adrienne Felt, from University of Virginia who was presenting at the poster session about an XSS vuln she had found in Facebook. https://jon.oberheide.org/blog/2007/08/10/usenix-security-hotsec-woot-2007/ Fri, 10 Aug 2007 00:00:00 +0000 https://jon.oberheide.org/blog/2007/08/10/usenix-security-hotsec-woot-2007/ I recently attended the USENIX Security Symposium in Boston, MA. I also attended two of the co-located workshops: the Workshop on Hot Topics in Security (HotSec), at which I presented a research paper focusing on a new paradigm for antivirus deployment, and the Workshop on Offensive Technologies (WOOT). HotSec 2007 Workshop At HotSec, I presented our paper titled \“Rethinking Antivirus: Executable Analysis in the Network Cloud\“. The abstract follows: https://jon.oberheide.org/blog/2007/07/20/dimva-2007/ Fri, 20 Jul 2007 00:00:00 +0000 https://jon.oberheide.org/blog/2007/07/20/dimva-2007/ I just got back from Switzerland, and despite numerous flight delays, cancellations, and lost luggage (thanks NWA!), it was a great trip. I presented some of my research at the Fourth International Conference on Detection of Intrusions and Malware and Vulnerability Assessment (DIMVA), and got to spend some vacation time in Zurich, Lucerne, and Milan, Italy. Characterizing Dark DNS Behavior The research I presented at DIMVA focused on the measurement of dark DNS, or the DNS queries associated with darknet addresses. https://jon.oberheide.org/blog/2007/05/07/pynids-05a-update-released/ Mon, 07 May 2007 00:00:00 +0000 https://jon.oberheide.org/blog/2007/05/07/pynids-05a-update-released/ pynids is a python wrapper for libnids, a Network Intrusion Detection System (NIDS) library offering sniffing, IP defragmentation, TCP stream reassembly and port scan detection. This release is an update to Michael Pomraning\’s 0.5 release to allow control of libnid\’s checksumming options. Checksum Control Many modern NICs provide both TX and RX checksum offloading for TCP and other protocols. This offloading functionality may cause the BPF tap utilized by libnids to observe packets with incorrect checksums, and drop legitimate packets during their processing, believing them to be invalid due to the incorrect checksum. https://jon.oberheide.org/blog/2007/04/12/cosign-sso-vulnerability/ Thu, 12 Apr 2007 00:00:00 +0000 https://jon.oberheide.org/blog/2007/04/12/cosign-sso-vulnerability/ During an independent audit, I discovered a critical vulnerability in Cosign, a web-based single sign-on (SSO) platform which is currently in use at numerous large universities. Introduction to Cosign Cosign is a web-based single sign-on system, written at the University of Michigan as part of the National Science Foundation Middleware Initiative (NMI). Cosign is deployed extensively at the University of Michigan and at educational institutions and other organizations around the world. https://jon.oberheide.org/blog/2007/02/12/t-mobile-wifi-hotspots/ Mon, 12 Feb 2007 00:00:00 +0000 https://jon.oberheide.org/blog/2007/02/12/t-mobile-wifi-hotspots/ Some random technical notes on the T-Mobile WiFi Hotspots offered at locations such as Starbucks. Since I spend a fair amount of time at the 24-hour Starbucks on Washtenaw, I often end up playing around with the Cisco WAP instead of actually doing work. Cisco WAP Devices The T-Mobile hotspots are powered by a WAP and access control device from Cisco. I attempted several times to social engineer my way into the back up a Starbucks to get a picture of the actual equipment, but to no avail. https://jon.oberheide.org/blog/2007/01/17/umich-rfid/ Wed, 17 Jan 2007 00:00:00 +0000 https://jon.oberheide.org/blog/2007/01/17/umich-rfid/ Given my previous experience with the Mcard identification system at the University of Michigan, I was interested when I heard that RFID technology was being integrated into the Mcards. I will explore the Mcard RFID and other current uses of RFID on campus. Mcard RFID The Mcards distributed for the University of Michigan Health System (UMHS) contain RFID technology from HID Corp. HID\’s Prox is a proximity-based access control system utilizing identification tags and readers that operate on the 125 khz frequency. https://jon.oberheide.org/blog/2006/11/24/aimject-released/ Fri, 24 Nov 2006 00:00:00 +0000 https://jon.oberheide.org/blog/2006/11/24/aimject-released/ Aimject facilitates man-in-the-middle attacks against AOL Instant Messenger\’s OSCAR protocol via a simple GTK interface. This 1.0 release brings Aimject functionality to the masses, being available for Linux, BSD, OS X, and Win32 platforms. Introduction Instant messaging and real-time network communication are becoming increasingly prevalent in both personal lives and the workplace. While recent events have brought IM privacy to the attention of mass media, security in most systems has not been properly addressed. https://jon.oberheide.org/blog/2006/11/13/google-safe-browsing/ Mon, 13 Nov 2006 00:00:00 +0000 https://jon.oberheide.org/blog/2006/11/13/google-safe-browsing/ While Google\’s Safe Browsing service has been available for some time via the Google Toolbar, this feature will see wide deployment with the release of Mozilla Corp\’s Firefox 2. In this analysis, we will delve into the workings of Google\’s Safe Browsing service and its integration with Firefox. Safe Browsing Google Safe Browsing (SB) is an initiative to curb malicious phishing activity by warning users when they navigate to a potential phishing site. https://jon.oberheide.org/blog/2006/09/22/pybgpdump-released/ Fri, 22 Sep 2006 00:00:00 +0000 https://jon.oberheide.org/blog/2006/09/22/pybgpdump-released/ I\’m happy to announce the availability of pybgpdump 0.1, a tool to assist in the rapid analysis of BGP routing datasets. It combines the functionality of libbgpdump and the ease of python to parse BGP messages from MRT dumps. Features Currently, analysis of BGP routing data is primarily done in C, using either libbgpdump (RIPE) or route_btoa (Labovitz). While effective in their own right, they lack the ease, speed, and simplicity of python development. https://jon.oberheide.org/blog/2006/09/15/mozilla-autoupdate-vuln/ Fri, 15 Sep 2006 00:00:00 +0000 https://jon.oberheide.org/blog/2006/09/15/mozilla-autoupdate-vuln/ Mozilla\’s auto-update system is a feature recently added to Firefox and Thunderbird that promises to bring prompt security updates to users without manual interaction. Unfortunately, this feature contains a vulnerability allowing attackers to hijack the update process and deliver malicious updates, resulting in the victim\’s host being compromised. Methodology To check for updates, Firefox contacts aus2.mozilla.org over HTTPS and requests the following XML file: /update/1/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/update.xml This URL template is stored in the app. https://jon.oberheide.org/blog/2006/08/31/mprint-privacy-violations/ Thu, 31 Aug 2006 00:00:00 +0000 https://jon.oberheide.org/blog/2006/08/31/mprint-privacy-violations/ mPrint is a useful service provided by ITCS of the University of Michigan to allow web-uploaded documents to be printed on campus printers. Unfortunately, the designers of mPrint included several \“features\” that violate the privacy of its users without their knowledge. Web Interface Previously, mPrint consisted of a simple form to upload documents and select a printer to send the job to. This was an extremely useful service if a user had internet access but did not have any University printers locally configured on their computer. https://jon.oberheide.org/blog/2006/02/15/honeyd-remote-fingerprint/ Wed, 15 Feb 2006 00:00:00 +0000 https://jon.oberheide.org/blog/2006/02/15/honeyd-remote-fingerprint/ Honeyd is a low-interaction honeypot developed by Niels Provos designed to emulate services and personalities of virtual hosts and networks. As honeypot deployments must remain undetected to maintain their value, the ability of an attacker to effectively and remotely fingerprint Honeyd is a serious issue. IP Fragment Reassembly According to the Internet Protocol specification (RFC 791), a correct IP stack implementation must identify corresponding fragments by matching the source address, destination address, identification number, and protocol number. https://jon.oberheide.org/blog/2005/04/06/umich-mcard-vuln/ Wed, 06 Apr 2005 00:00:00 +0000 https://jon.oberheide.org/blog/2005/04/06/umich-mcard-vuln/ After investigating the security of the Mcard magnetic card system at the University of Michigan, which is used for student and faculty identification cards, I discovered that it is trivial to forge anyone\’s Mcard given only their UMID/uniqname. Introduction The University of Michigan\’s student/faculty identication cards, Mcards, are used for a variety of uses such as photo ID, meal plans, Entree Plus, TCF debit card, and access to dorms, computer labs, and other University buildings. https://jon.oberheide.org/blog/2004/07/25/wolverine-access-vuln/ Sun, 25 Jul 2004 00:00:00 +0000 https://jon.oberheide.org/blog/2004/07/25/wolverine-access-vuln/ While arranging my class schedule at the University of Michigan, I discovered a vulnerability in Wolverine Access that allowed unrestricted access to the social security numbers, names, and addresses of every student in the University including recent alumni. Introduction Wolverine Access (WA) is the University of Michigan\’s online records and registration system. It handles academic, financial, employment, and personal information of students, faculty, and staff. It is based on PeopleSoft software and maintained by MAIS. https://jon.oberheide.org/0trace/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/0trace/ Description 0trace.py is a python port of Michal Zalewski’s 0trace hop enumeration tool. 0trace was originally announced on Bugtraq on January 6th: I'd like to announce the availability of a free security reconnaissance / firewall bypassing tool called 0trace. This tool enables the user to perform hop enumeration ("traceroute") within an established TCP connection, such as a HTTP or SMTP session. This is opposed to sending stray packets, as traceroute-type tools usually do. https://jon.oberheide.org/advisories/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/advisories/ Some ancient advisories from a prior life: CVE-2011-1352 Android < 2.3.6 PowerVR SGX Privilege Escalation Exploit CVE-2010-4347 Linux Kernel < 2.6.37-rc2 ACPI custom_method Privilege Escalation Exploit CVE-2011-1352 Android < 2.3.6 PowerVR SGX Privilege Escalation Exploit CVE-2011-???? Linux Kernel grsecurity < 201109142336 Kernel Memory Disclosure CVE-2010-4347 Linux Kernel < 2.6.37-rc2 ACPI custom_method Privilege Escalation Exploit CVE-2010-4073 Linux Kernel < 2.6.37-rc1 compat_sys_semctl 92-Byte Stack Disclosure CVE-2010-3848 Linux Kernel < 2.6.36.2 Econet Privilege Escalation Exploit https://jon.oberheide.org/aimject/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/aimject/ Description Aimject facilitates man-in-the-middle attacks against AOL Instant Messenger’s OSCAR protocol via a simple GTK interface. Features sign-on/off detection message interception/decoding message injection into arbitrary conversations synchronization of AIM sequence numbers and fnac ids cloning of font styles/screenname formatting to avoid detection selective muting of conversation participants integrated ARP/DNS spoofing Dependencies libdnet >= 1.10 libpcap >= 0.8.3 gtk+-2.0 >= 2.6 glib-2.0 >= 2.6 libglade-2.0 >= 2.5.1 Download Downloads have been archived. https://jon.oberheide.org/damburst/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/damburst/ Description Dam Burst is a simple utility that allows an unprivileged user to disable the censorship functionality of the Green Dam Youth Escort software. Dam Burst operates by injecting code into a running application and removing the Green Dam hooks that enable it to monitor and block user activity, effectively restoring the running application to its original uncensored state. Unlike other tools that disable or uninstall the Green Dam software, Dam Burst does not require administrative privileges. https://jon.oberheide.org/flowscrub/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/flowscrub/ Description flowscrub provides multi-format (pcap, netflow, silk), multi-layer (link, network, transport, application), and multi-attribute (ethernet.src, ip.ttl, tcp.sport, http.uri, etc) transformations (set, zero, mask, rand, hash, etc) for flexible and powerful flow anonymization using simple configuration files. Sample Usage smi:/Volumes/pcap jonojono$ ls -lh -rw-r--r-- 1 root wheel 568M 24 Aug 2006 2006-08-24.01.pcap.gz -rw-r--r-- 1 root wheel 421M 24 Aug 2006 2006-08-24.02.pcap.gz -rw-r--r-- 1 root wheel 428M 24 Aug 2006 2006-08-24.03.pcap.gz . https://jon.oberheide.org/gdnet/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/gdnet/ Description gdnet is a graphical tool demonstrating the power and simplicity of the libdnet interface. Using the GTK+ toolkit, it provides a variety of networking features in a simple, easy-to-use interface. Dependencies libdnet >= 1.10 gtk+-2.0 >= 2.6 glib-2.0 >= 2.6 libglade-2.0 >= 2.5.1 Download Downloads have been archived. Screenshot https://jon.oberheide.org/ncd/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/ncd/ Description ncd.py is a simple and fast implementation of Normalized Compress Distance (NCD). It was developed to replace CompLearn’s NCD which is overly complex and has severe memory leaks. ncd.py supports multiple compression algorithms (zlib, bz2) and compression levels (1-9). It will output an NxN distance matrix along with the input fileset to text or pickle formats. Download Downloads have been archived. Usage Output usage: ncd.py [OPTION] [FILE]... options: -h, --help show this help message and exit -c COMPRESSOR compressor algorithm (zlib, bz2) -l LEVEL compression level (1-9) -f FORMAT output format (text, pickle) -o OUTPUT output filename https://jon.oberheide.org/patents/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/patents/ Some granted patents from a prior life: Network service for the detection, analysis and quarantine of malicious and unwanted files Priority Date: 2007-08-06 [US-8621610-B2] System and method of notifying mobile devices to complete transactions Priority Date: 2010-03-03 [US-9544143-B2] [US-9992194-B2] [US-10129250-B2] [US-11172361-B2] System and method of notifying mobile devices to complete transactions after additional agent verification Priority Date: 2010-03-03 [US-9532222-B2] [US-10445732-B2] [US-10706421-B2] [US-11341475-B2] System and method for embedded authentication Priority Date: 2010-12-02 https://jon.oberheide.org/projects/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/projects/ Some ancient projects from a prior life: kstructhunter - Routines for hunting down kernel structs. ksymhunter - Routines for hunting down kernel symbols. Dam Burst - Unprivileged bypass of the Green Dam censorship software. dpkt - Fast, simple packet parsing in python. pdpt - Passive discovery of resolvers vulnerable to CERT VU #800113. flowscrub - Simple, powerful flow anonymization. vnclogger - Passive network keylogger for VNC/RFB connections. pynids - Updated release of libnids python wrapper. https://jon.oberheide.org/pybgpdump/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/pybgpdump/ Description pybgpdump combines the functionality of libbgpdump and the ease of python to parse BGP messages from MRT dumps. Features currently support for IPv4 BGP4MP_MESSAGE and BGP4MP_MESSAGE_32BIT_AS supports uncompressed, gzip’ed, and bzip2’ed files transparently includes sample programs, such as route_btoa.py Dependencies dpkt SVN/1.7 Download Downloads have been archived. https://jon.oberheide.org/pynids/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/pynids/ Description pynids is a python wrapper for libnids, a Network Intrusion Detection System library offering sniffing, IP defragmentation, TCP stream reassembly and TCP port scan detection. Let your own python routines examine network conversations. Changelog This pynids distribution is an updated version of Michael Pomraning’s 0.5 series. The 0.6 series brings updates to the bundled version of libnids (from 1.19 to 1.24), checksum disabling, packet timestamps, pcap stats, and a variety of fixes. https://jon.oberheide.org/research/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/research/ I completed my PhD in Computer Science at the University of Michigan with a thesis titled “Leveraging the Cloud for Software Security Services”. My advisor was Farnam Jahanian. Below are some academic papers, security research, and invited talks: 2016 Security and Usability from the Frontlines of Enterprise IT Jon Oberheide USENIX Enigma 2016 San Francisco, CA, January 2016 [presentation] [event] Fundamentals, Fears, and Futures Jon Oberheide Michigan Cyber Summit https://jon.oberheide.org/vnclogger/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/vnclogger/ Description vnclogger.py acts as a simple pcap-based keylogger for VNC/RFB sessions. Combine it with your favorite MITM technique to sniff the keystrokes off existing VNC network connections. Key events are automatically logged to a file for each observed VNC connection. Dependencies dpkt pypcap pyevent Download Downloads have been archived. Usage and Example Output Example output of vnclogger.py: apollo ~ # ./vnclogger.py -i wlan0 listening on wlan0: port 5900 1229730196. https://jon.oberheide.org/winnie/ Mon, 01 Jan 0001 00:00:00 +0000 https://jon.oberheide.org/winnie/ Description winnie is a network scanner capable of detecting honeypot deployments using Honeyd <= 1.0. The issue causing the vulnerability is present in Honeyd’s IP fragment reassembly code which does not follow RFC 791. Honeyd incorrectly omitted the IP protocol number when searching for corresponding fragments for reassembly. By constructing a fragmented TCP SYN packet with a different IP protocol number in each packet, it is possible to elicit a SYN/ACK response from addresses monitored by Honeyd, thereby exposing the honeypot deployment.