Showing posts with label hacking. Show all posts
Showing posts with label hacking. Show all posts

Friday, 6 January 2017

Administrator : Fired Employee Stole Software Serials!

Today I've had to deal with a security issue for a friend, a certain department manager had a machine with a set of serial numbers for each of his developers tool stack, quite expensive stuff, these were stored in a text file on his desktop in a folder called "serials".

The problem?  Before Christmas an individual was asked to leave the company, his parting gift?... He stole all the software.

They knew this because he got a little drunk with a common friend of the manager over New Years and boasted he'd be starting his own company with the same software stack... We're talking about £4000 worth of software.

The machine the chap was working on (windows 7) was pretty locked down, he could not  install, nor run a cloner, nor could he add a drive or boot from CD/USB or even get into the BIOS settings to take the software directly off as it was installed.

My friend, investigating, suspected that the chap had simply taken the serial numbers, the manager frankly denied this.  His machine was checked, no-one had been accessing it other than him, there was no file sharing set up and it too could not be booted into anything other than the Windows 7 installation on the machine....

There was no-way, in the managements eyes, that the software could go missing... My friend suspected different... And so co-opted me to help, getting a copy of the disk I was not able to log-on, but I could see a whole bunch of scripts run at start up, whenever ANY user logged onto the system, they ran a series of scripts, one of which was a batch file (slaps forehead).

This batch file was stored as a regular file in a folder "C:\devscripts" and could be written too... I had a hunch this was where something could go wrong, but couldn't initially see how, the file looked unchanged... But then I noticed a hidden folder... a git repo metadata folder... in the same directory.... It seems the source of both this folder and the file was a git repo, so updates to the devscripts would be stored and commited to the git repo... and pulled to each machine every-reboot.

But the git-repo was open for ANYONE to commit to!

The developer had simply, within the massive cloud of commits, committed a new batch file to the repo.  This new script started the python interpreter with the command line "-m http.server 8080 C:\Users\<manager>".

The development machines used port 8080 for the remote debugger, and let this connection start without warning the user that a new firewall rule was required.

The developer then simply used "wget --spider" to pull all the files from the managers desktop, this included a bunch of documents about staff performance and of course the serials folder in it's entirety.

Once he had all these files, just before the festive break and his departure he committed the original script again which removed the starting of python.  He did this in the midst of the sprints to the break no-one noticed that their commit numbering had slipped by a place!

If he had reverted the repo he'd have needed the managers approval, but as it was the script just went from green to a yellow to a green against their sign off system, so no-one paid it any attention that the revisions had slipped in date & time.  And that the sign-off system didn't treat the signature of the commit as being different was a bug in the system.

So the lessons to learn...
  • Don't let batch files start as the root user on a machine, EVER!
  • Don't update said files from a public or even open internal source
  • Don't just ignore any subtle changes (like the commit number order changing) when you observe them!
And when you fire a developer, fire them!  Don't let them sit there with anything connected to your network, you just fired them!  They'll want revenge!

Saturday, 24 December 2016

Administrator : Blocking Spammers & Hackers (Basics)

To see whom has been trying to connect to your Debian (or Ubuntu) server, use:

cat /var/log/auth.log | grep "Failed"

This will list out the failed attempts, then add the successful with:

cat /var/log/auth.log | grep "session opened" | grep "LOGIN"

You can note the IP addresses for the unwanted attempts and block them with iptables, like this:

sudo iptables -I INPUT -s AAA.BBB.CCC.DDD -p tcp --dport ZZZ -j REJECT

Where the IP to block is "AAA.BBB.CCC.DDD" and the port is "ZZZ" as a number, so to block 192.168.0.1 on port 7000 you would do:

sudo iptables -I INPUT -s 192.168.0.1 -p tcp --dport 7000 -j REJECT

Instead of REJECT you can use DROP, and in place of tcp you can use udp and icmp protocols.

To block a whole subnet range I just do this:

sudo iptables -A INPUT -s AAA.BBB.CCC.000/AAA.BBB.CCC.255 -p tcp --dport ZZZ -j DROP

This makes all addresses in the range not respond, the range could have been 192.168.0.0/192.168.0.255, or you could block higher up the range like this 192.168.0.0/192.160.255.255, the first address range blocks just the last section subnet mask, the second blocks the last two sections of the subnet mask!

You can view the iptables in use with:

sudo iptables -L



Why Does This Exist?
Its not often I have to actually turn a server towards the outside world, my personal servers usually sit on my LAN and never route to the internet, like-wise the items I provision in the office are for internal use...

Yesterday however, I had the pleasure of being told to make a service available to the outside world...

No big deal, it's Apache2 on a Ubuntu host, set up done... And I only opened port 80 then left it... All was fine...

It has run for six hours... six... On a brand new acquired IP address, no-one but the recipient at the far end knows about the server being there, it has no DNS entry, it has no other services, just port 80 and ssh open...

Yes, I have had hacker, poking, security breach attempts from China, Vietnam, the British Virgin Islands, Canada, the Netherlands and Russia...

The mind boggles at quite how much hacking and infiltration is going on out there...

I've been checking the mainly ssh breach attempts with the command:

cat /var/log/auth.log | grep "Failed"

I run this to a file and then have a python script to log the IP addresses into a table for me, and I can then just block them individually or as a subnet range, though iptables.

I also check for successful logins just in case with:

cat /var/log/auth.log | grep "session opened" | grep "LOGIN"

I wonder however whether a python script to manage all this for me might be in order... Hmmm, project time!

Tuesday, 21 June 2016

Project - Socket 775 to Socket 771 Xeon - Update

As an update to my original post, I got another socket 775 motherboard and took a video of how to cut the tabs off the socket, making it able to accept a socket 771 Xeon, but doing so with the original chip in place, to protect the socket pins.

Check it out here:



Saturday, 2 April 2016

PC upgrades, and more coding ideas

As you can see, I'm in the middle of working on some PC kit.  Upgrading the in-laws old kit and retiring one of mine in the process.

I'm going to be working on the second part of my functional programming post later today, covering some alternate languages and better explaining maintainable code with relation to those parameters being passed.

Friday, 1 April 2016

Coding Standards: Functional Programming (Code Maintainability)

Functional Programming

When I were a lad, and was being taught to program, I read a bunch of Basic code and wrote great long lists of instructions; that's pretty much how many people in the 90's described programmers, coders or hackers "someone who spends lots of times typing great long lists of instructions into their computer" - Robert X Cringley.

However, long lists only get you so far, so my next step into the world of programming was to learn Pascal, and I first read a simple book as part of my A-Level, by P. M. Heathcote, which introduced very basic programs in Pascal, something like...

program HelloWorld (input, output)
begin
    println ('hello world');
end;

So, I suddenly had this idea of putting the long lists of instructions into sort of functions:

program HelloWorld2 (input, output)

   procedure foo()
   begin
       println ('foo');
   end;
   
   procedure bar()
   begin
       println ('bar');
   end;
   
begin
   print ('hello ');
   foo();
   print (' and hello ');
   bar();
end;

(Note: before you call me out and say you can "GOSUB" or "CALL" other functions in BASIC, not in the dialect I first learned, all you could do was SUB to a line number, following the instructions until you used RET to go back to where you were... So they were technical functions, or procedures, but they were really just more lines of code within the huge list of lines of code, no indentified in anyway, except by comments, as being functions).

Interestingly at this time, I was taught there were two kinds of functions you could call, ones which returned a value, known as "functions" in Pascal, and ones which didn't return anything known as "Procedures".  These latter you'll be very aware of from other langugages like C, where the return type is part of the function declaration, so "void foo();" obviously doesn't return anthing, whilst "int bar();" returns an integer.

That "Procedure/Function" definition stuck with me a long while, I was a kid, I was taught something and got a certificate to say to the world "He knows what he's talking about", so it was with some trepidation, years later, that I had to admit it was rubbish and everything was a function.

And this revelation came with my being taught about "Functional Programming", this was important for large projects written in languages like C, because you really wanted to start to learn how to keep functions doing one task.  So when you designed, named, write and test a piece of code, you can break it down, and know each piece, or each function, is doing just one job.

"void Max(const int& p_Left, const int& p_Right, int& p_Result)"

Here I've just defined a function prototype, even without my explaining, I'm pretty sure you could guess what it does... Yes, it takes the left and right integers given and decides which is the bigger, placing that value in the result.

We can design code, define the prototype, and hand the nitty gritty of the actual code body of to someone else, to write the body of it, or just to test our implementation works.  And though this is a trivial example, think about a single function to say format a disk, it might contain calls to dozens, or hundreds, of other functions, but it itself does one task, and each sub task is itself kept in a single function so you break the whole job down.  Within your large projects therefore you maintain a level of ease in how to debug, maintain and update the code, if your "foo" function doesn't work, just fix that one function and re-test, there shouldn't be multiple-foo's and there shouldn't be more than one task performed within the code inside "foo".

This was the first major meeting, and teaching, I had on "Functional Programming", and it was something I took to heart.  My code took on very much a "one function" style, where each function had a single purpose.

Twenty years on, and even in an Object Orientated world (of C++, C# and Java) I utilise the functional idea.

The main thing applying the single function ideal to my code has lead to is a vast improvement in maintainability, this has been important for my job and on going sanity with large projects.

However, there are other caviates, for there are other parts to functional thinking which have to be taken into account.  For example, are you going to allow functions in your code to have just one, or multiple exit points from a function?  For example:

const int bar (const int& p_i)
{
   return p_i * 2;
}

const int foo ()
{
    if ( x > 0)
    {
        return bar(x);
    }
    else
    {
    return bar(-x);
    }
}

This is perfectly reasonable code, foo does one job, deciding upon the value of x which value to pass, however, this is a trivial example, what if there are tens, hundreds or even thousands of different paths you could take as the result of foo?... A case statement with every character possible already throws hundreds of options our way, so it's not out of the ordinary.

You could be tracing through this code and ANY of those many exit points could fail, causing a crash, which you then have to dig through after the stack has all unwound.

Using many exit points is fine, if you can justify it, please don't get the impression I'm hating on the concept, if you have a low memory situation for example, I can see you won't have space spare for my suggested solution; and this is part of the many trade-offs you will learn about in a career of programming, when to, and when not to employ a technique.

But in the above example, I would change foo as follows:

const int foo ()
{
    int l_result = 0;
    if ( x > 0)
    {
l_result = bar(x);
    }
    else
    {
    l_result = bar(-x);
    }
    return l_result;
}

So, you see I have a local value copy, this is using more memory, and wants to allocate that memory... and there are other options than allocating that as a local variable, but for maximum maintainability keeping that value within the actual function is a key feature of this example.

And so how does this assist in maintainability?  Well, we can now debug the function a lot more easily, we can see the value of "l_result" at any moment in a watch within the debugger, we can wrap individual - failing - calls to "bar" into try-catch statements and debug the returned value for the whole function at the return at the bottom.

I've seen some horrors in the poor use of both returning from within a function, where return points are hidden three, four or more nestings deep, and it's made for nothing but frustration, try to avoid multiple function exit points.

What else does functional programming offer us?... Well, it also offers us an easy way to make code self-documenting, if we have a function like the "max" function earlier, it explained itself in just it's definition, take advantage of that fact.

But what about functions inside objects?  I hear you cry, well lets take a pure C++ example, in C++ (or at least most C++ compilers) we're allowed to just define a function prototype and go to town, but that's really; technically; C not C++.  To make things C++ we really should have the functions all inside a class definition... I stick to this idea, even if we just need a pseudo class of static functions:

class Helpers
{
    public:
    
          static void Max(const int& p_Left, const int& p_Right, int& p_Result);
          
          static const int Sum(const int& p_Left, const int& p_Right);
          
 };

 One can see what the functions mean, and the function have meaningful names, the class itself can have, a useful name, and indeed the class can then be in a namespace which itself has an even more useful name.  So we build up not complexity, as some assume, but ease of division of functionality, breaking numbers from user interfaces from strings from file management, break it down, divide and conquer, that was the original purpose of functions in computing, and so that original function is now emphasised in the languages and methods we employ today.

 C++, C#, java, Python, all can benefit from using the function idiom... Your projects certainly can.

Monday, 8 December 2014

The Hack

I've been off work, obviously with my feet, however, I've also been off because I've moved house, which took just over a week.  There are a couple of bits and bobs left at the old house and the sale is progressing, whether it all gets done for Christmas and the wife and I can actually celebrate is anyones guess.

Those events are however not what I want to talk about today, no todays topic is one of the systems under my control being the subject of a hack, a successful hack too.

I've been in this game a long time, I've administered Unix, VAX VMS, Sun Solaris, Windows and Linux servers, I've seen access attempts, heard social engineers (cold callers) and even found evidence of folks trying to pick locks to server and switching equipment cabinets.

Until this hack however I'd never lost control of a machine, never had any damage done, and never expected such a strange attack.

The target machine for these problems was a Windows 7 32 Bit virtual machine, being used as a development box with an externally open port to a fixed IP on the local LAN, which the IT Admin had wired upto the company external IP Address and a third party company routed a tunnel through our firewall.

Through this single IP/Port combination the Windows machine was compromised...

Oddly, and quite annoyingly, the IT Admin immediately pointed his finger at one of the pieces of software I was running "Apache"... Could you imagine the uproar in the world at large if Apache web server had a vulnerability which allowed the kind of hack I'll detail later?... Let me just say, I ribbed him back about it, but his inert and instant finger pointing away from what I believe the true problem child annoyed me.

The other software being run on the machine was Visual Studio 2013, whether that is vulnerable, I don't know, perhaps however one would expect some evidence that online/connected services being used by Visual Studio were accessed, some log or trace, and there aren't any, the only traces left were in the Windows logs (event viewer).  Reinforcing my annoyance at the finger being pointed away from Windows.

The user software being operated did not contain any code to do the actions carried out on the machine, indeed only Windows contains the ability to do what was done, so this was the final nail in the coffin for me Windows was to blame.

What was the hack?  You know what, I have no idea, having gone through the evidence and checked I have no idea what allowed the activity, however here's my general pattern pulled from the event viewer.

Thursday 13:30  Machine left in Idle.
Friday 03:01  External Access Logon Requested
Friday 03:03  Logon negotiated with null GUID

(This logon was never listed as successful, only that it was negotiated, I therefore suspect an IP Spoofing attack or some kind).

Friday 03:04  Logon elevated to grant all tokens

Whoever this was, they spent about three hours poking about insude the machine, then logged off.

Saturday 03:01  Logon negotiated with null GUID
Saturday 03:01  Logon elevated to grant all tokens
Saturday 03:03  All user accounts set locked
Saturday 03:13  Volume Shadow Copy started
Saturday 03:23  Volume shadow Copy crashed
Saturday 03:24  Unknown Application reported 100% CPU
Saturday 03:38  New user account created with name "hahaha"

Several more shadow volume copies occur, then this person logs off.

Sunday 04:13   hahaha logs on
Sunday 04:15 All user accounts set to disables, except hahaha
Sunday 06:38 hahaha logs off
Sunday 06:39   Machine shutdown by hahaha

That's what they did, not a lot I admit, however, we have the times this happened, we have the Event View log as proof, and we pay a company to look after the company firewall... So they have access logs right?... Right?... RIGHT?...

Nope, apparently it is too much hassle to check the logs, and according to one source "we get port scanned 100 times a day, what's the point of chasing down one hack?"... erm because they got in... they didn't just scan they got in, and for the life of me I can't figure out how.

Windows was patched, firewall was on, only a none-standard port was open and it was only listening with a custom application with a specific and narrow role to carry out...

Everything else on the machine was not available to that port, or on the second network adapter in the machine!

Friday, 4 October 2013

Funny Old Week

This week I've pretty much sworn off World of Tanks, and been enjoying mixed results in War Thunder.  I say mixed because I updated to 1.35 and started playing with good results over last weekend, the weekend crowd seemed to contain just enough noobs and vets to balance things out.

But as the week progressed there seemed to be only the hardcore element playing, so there was the 1 shot 1 kill cannon brigade, souring through the clouds in their P-39's, and then the undestroyable A20's, despite my filling them with all the lead from a Beaufighter MkXX (so 4x mg and 4x20mm cannon).

Then the Yak9T UFO pilots who just zap you with their xray (literally I was surgically removed from so many different aircraft by P39 or Yak9T pilots as to make me wonder if they were using aimbots or cheats).

In the end, I went to play some Minecraft, now I don't play that much of this, but when I did I just play and dig and build and dig.  But I always play with one rule, if I die I'm dead.  Start over.  Some call this hard core, but I don't.  Its just what I do, so I'm getting really good at setting up a wheat farm, collecting animals and making myself a little house and then I set about digging a shaft to diamond depth.  My problems come along later, when I'm trying to collect XP for enchants.  I go scurrying about and I don't find enough target mobs.  So, in my current game I'm going to try and make a sky placed mob generator and farm it.

I also, this new world spawned right next to (literally 22 blocks from) a zombie spawner, so I plan to dig it all out around and build a trap for that.

Then on the fully side of things I saw this... and I can't but help say that picture looks just like the bitch who lives across the street from us....

Tuesday, 2 April 2013

E-mail Hacked, WarThunder Ruins Economy & Minecraft restart


What a bit of a roller coaster time I've been having, lots of personal stuff, but then technology has slowly crept back into me.

I'm still enjoying WarThunder - though less so with the currently fucked economic model (I have Spitfire Vb and Vc, as well as two differnet model 109's to buy - all for 100,000 credits, whilst only able to earn about 10,000 per game, this means I'm going to take about 50 games to earn the cash -  and I only get to play 2-3 games an evening, so this is over a months grind to just play the next level of aircraft) and to be honest I can do without a grind of a game.

They did a good job with the April Fools joke in game however - I did enjoy flying in the My Little Pony Airforce, and the artwork was top notch, however I'd have been happier to see an economy fix.

Also, there was an event on Sunday where for winning your first and fifth fight you'd get gold eagles, I never saw this advertised, I never understood the text in game, and I never won in the one game I played that evening, so I never got any gold eagles and this makes me sad, from such PR highs to lows all in the space of a weekend.

The other technology news was that one of my e-mail addresses was hacked, by a chap in India, whom I thoroughly intend to visit and castrate.  Seems he trawled and then trolled my Yahoo e-mail password and started to spam people in my address list at 3am.  The next morning my wife asked "Why were you up at 3am sending me this"... and of course she'd clicked the fucking link, so I had to wipe the laptop, and change my yahoo account and all manner of things.  But being in possession of an ounce of technical nouse I fired  up a virtual machine and tracked this link mailed around down, I also tracked the links in the dozens of failed mail daemon delivery messages spammed from my account.  And they all went back to an educational establishment in the Punjab.

I sent a mail to the administrator of said Educational Establishment, but I don't hold much hope of them cracking down on this shit, not least because this place in the Punjab appears to be a rocky stoney mountain when you look on Google earth, but the image of the site as shown on their web page looks like a none-descript office building from Droitwich - no offence to Droitwich.

The other thing that's been going on is Minecraft - I've had minecraft since it first came out - I've even studied the java code under the hood - yes I'm that much of a geek.  But I've only really played it once.

I started to play it again - mostly as I'm so agreeved at WarThunder - but also because I'm still without power on my main gaming PC so wanted something I can run on the laptop whilst on battery power.

Anyway, I've started to enjoy Minecraft some, I have a little railway, I've got a cow farm, and I'm starting to automate somethings with the seemingly magic redstone.  I've been to the nether and I plan to open a big mining facility to discover more diamonds.  But I'm also tempted to start to record my exploits, and make a series of progress videos.  IJevin on YouTube does a good job of this, but he does seem to appear with lots of gear start off the bat, I'd rather show everything in real-time - or at least sped up in places - to show every rock, every seed, every stick gathered and how it came along.  But this is a pipe dream, I don't have a voice for YouTube video commentary, and I don't have the time, though I've love to have more YouTube content.

Thursday, 6 December 2012

Captain Crunch Cameo

On the Fedora front page are a series of pictures, when the one regarding community comes up I was immediately struck by the chap with the flame ginger beard, not that I have anything against him, but he attracted my eye... And its a good job he did, because to the left, sort of hedging into view is a chap whom to the casual observer would look like a guy who was dragging in off the street.  Literally from laying a sleep on the street.

But, the casual observer would be oh so wrong, take a look:


You see, that awkward looking chap with the beard and very new looking Fedora hat, is none other than a hero of mine, John Draper.  Affectionately known as Captain Crunch.

He is one of the original Phone Phreaks and original Hackers, and when I say hacker, I mean great programmer, this guy was at one time locked up in prison and only let out to work during the day, so he would work all day on software (I think) and then as he had to report back to prison (for being prosecuted for phone phreaking) he would take a copy of the source code with him and work on the source code so his following day would be doubly productive.

Now that is a great programmer.  I wish I have ever had the balls to try that, I suppose with a modern operating system and all the different threads, libraries and dependencies such work would be near impossible.  But back then, he did it... 

The software he wrote is also a piece of software a lot of people have probably heard about, or even use, it was EasyWriter for the Apple II.  One of the first Word Processors in the fledgling personal computer world.

John himself has appeared on a few documentaries in his time, and you can find some of them on YouTube.  You can read more about him on Wikipedia, and unlike other Wikipedia pages his entry is rather accurate (least according to the other books I've checked it against - books I might add which pre-date the internet and wiki's, so I trust).

The only two questions remain... Why is John stood there?... And quite why is he Scratching?

By the way, there was a webpage up earlier in the year about "Saving Captain Crunch", I believe John suffers a motor neurone degenerative disorder, and the site was up to try to earn some spondulix to pay for treatment - John - Pop to the UK, the NHS'll take a look, I pay enough National Insurance you can have a bit!


Sunday, 4 December 2011

Slice a Penny Off Of Each Transaction Hack...

So, I'm sat this evening just going through some old videos (VHS Tapes, you know those old things before digital storage)... and one of them I've pulled up is "Hackers" from 1995... an instant, if in accurate technically, classic for the hacking, freaking, social engineering and coding worlds.

I'd always had this information filed away in the back of my mind, but the hack involved is a worm, which takes fractions of a cent from each transaction at a huge firm... Sound Familiar?... It should, its the same sort of thing as Richard Prior was drafted in to do in Superman III... and that hack itself was used as the basis (directly) for the hack mentioned in "Office Space"...

Come to think of it, its a pretty weary, well worn hack... One which clearly saunters into the movie executive world in different guises every ten years or so...

My question is... who's going to use it next?  iPhone is huge, Steve Jobs has gone to the great "fuck you all do it my way" shack in the sky... how long before someone puts eCredit, or Wireless banking, or whatever through the "skim 0.00001 cents each time" rigmarole?