Category Archives: security

Story of a failed pentest (threader.app)

Great story based on a true hacking attempt.

Except for the last bit which was dramatized, the author gave a fairly good first-person account of an internal pentesting being carried out. It involves everything from impersonation, social engineering, physical theft, wits and a good amount of luck.

“Good afternoon, Pam. I’m Josh from IT. We’re about to migrate your Citrix instance to a new server. I’m going to send you a 6 digit number. I’ll need you to read that off to me. As a reminder, IT will never ask for your password.”

I already had her password.

She gave a hesitant, “Okay…”

I clicked on the “Click for MFA token” button and stated, “Alright, I’ve sent you the number. You should get a text. Please read it to me.”

She said, “Umm, alright. Got it. It’s 9-0-5-2-1-2.”

Source: A thread written by @TinkerSec

The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies – Bloomberg

Bloomberg’s big story on alleged China hacking through server hardware implants. If true, it would be an absolutely incredible feat, equivalent in terms of impressiveness to the Stuxnet worm.

The attack by Chinese spies reached almost 30 U.S. companies by compromising America’s technology supply chain.

Source: The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies – Bloomberg

At the moment, Bloomberg seems to double-down on its story with the following statement:

“Bloomberg Businessweek’s investigation is the result of more than a year of reporting, during which we conducted more than 100 interviews,” a spokesperson told BuzzFeed News in response to a series of questions. “Seventeen individual sources, including government officials and insiders at the companies, confirmed the manipulation of hardware and other elements of the attacks. We also published three companies’ full statements, as well as a statement from China’s Ministry of Foreign Affairs. We stand by our story and are confident in our reporting and sources.”

It’ll be interesting to see who’s telling the truth as the story develops. Meanwhile, governments and companies around the world should be in panic mode, as they try to figure out if they are using Supermicro servers, and if so, whether they are affected by the so-called hacking.

(2018-Oct-04) Apple and Amazon both issued strong denials to the claims of the article.

(2018-Oct-04) Separately, Apple and Amazon both issued even stronger statements on their website to set the record straight on the matter.

(2018-Oct-05) Buzzfeed’s coverage of the story also seem to indicate that even senior staff in Apple doesn’t know about the alleged hacks.

(2018-Oct-20) Apple CEO Tim Cook Is Calling For Bloomberg To Retract Its Chinese Spy Chip Story

(2018-Oct-23) Amazon cloud chief Jassy follows Apple in calling for retraction of Chinese spy chip story

PIN number analysis

There are many articles on how people chooses passwords. This article is purely on analyzing PIN numbers. Some observations are obvious but there are quite insightful ones too.

There are 10,000 possible combinations that the digits 0-9 can be arranged to form a 4-digit pin code. Out of these ten thousand codes, which is the least commonly used?Which of these pin codes is the least predictable?Which of these pin codes is the most predictable?

Source: PIN number analysis

Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M — Krebs on Security

Spear-phishing is quickly becoming the most popular technique for hacking high-value targets. The SingHealth hack was suspected to be due to spear-phishing as well. HR is obviously most at risk, as they need to review resumes which can come as PDF or Word document.

The lawsuit notes the company determined that it was likely the same group of attackers responsible for both intrusions. Verizon also told the bank that the malware the attackers used to gain their initial foothold at the bank in the 2017 breach was embedded in a booby-trapped Microsoft Word document.

Source: Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M — Krebs on Security

SingHealth cyberattack: MAS orders financial institutions to tighten customer verification – Channel NewsAsia

Good pre-emptive measure to prevent possible misuse of information from the SingHealth hack.

“With immediate effect, all financial institutions should not rely solely on the types of information stolen (name, NRIC number, address, gender, race, and date of birth) for customer verification,” MAS said in a statement.

“Additional information must be used for verification before undertaking transactions for the customer. This may include, for instance, One-Time Password, PIN, biometrics, last transaction date or amount, etc.”

Source: SingHealth cyberattack: MAS orders financial institutions to tighten customer verification – Channel NewsAsia

Singapore health system hit by ‘most serious breach of personal data’ in cyberattack; PM Lee’s data targeted

This is indeed the most serious cybersecurity breach in Singapore so far. 1.5 million records were exfiltrated. If this were to happen to a private company, the fine for breaching PDPA would surely be significant. While cyber attacks are not uncommon or unexpected, having it happen in a way that affects so many people will surely bring pause to many ongoing and upcoming IT projects in the pipeline.

Source: Singapore health system hit by ‘most serious breach of personal data’ in cyberattack; PM Lee’s data targeted

‘Suspicious’ USB fan given out at Trump-Kim summit deemed safe | ZDNet

Much ado about nothing. The context was, some journalists were highly suspicious of the USB fan that was included in the goody bag for the media during the Trump-Kim summit in Singapore, deeming it a cybersecurity risk. It’s probably good not to plug untrusted USB devices into your machine but c’mon please give the organizers more credit than this.

A University of Cambridge researcher wanted to know if the fan was bugged.

Source: ‘Suspicious’ USB fan given out at Trump-Kim summit deemed safe | ZDNet

WINDOWS NTFS TRICKS COLLECTION

A collection of eye-opening NTFS tricks to do things that you normally can’t.

TRICK 1: CREATE FOLDERS WITHOUT PERMISSIONS (CVE-2018-1036/NTFS EOP) On Windows you can assign “special permissions” to folders like permissions that a user is allowed to create files in a folder, …

Source: MOV AX, BX Code depilation salon: Articles, Code samples, Processor code documentation, Low-level programming, Working with debuggers WINDOWS NTFS TRICKS COLLECTION

Malware Found In The Ubuntu Snap Store – Linux Uprising Blog

Be careful what you install, even if it’s from the official app/repository store. This also goes for browser extensions, docker images, Notepad++ add-ons, etc.

Oh, snap! Just because some packages are available to install directly from the Ubuntu Software Center doesn’t make them safe. This is proved by a recent discovery of malware in some snap packages from the Ubuntu Snaps Store.

Source: Malware Found In The Ubuntu Snap Store – Linux Uprising Blog

Malaysia general election candidates slam ‘dirty trick’ spam calls; Najib orders action

This is the classic DDoS attack, but with a twist. Instead of spamming servers through the Internet, someone is spamming phone lines through a phone botnet. Similar to DDoS, this makes it difficult for legitimate calls to go through.

Candidates for Malaysia’s 14th general election have claimed that their phones have been hacked and spammed with calls from overseas numbers.

Source: Malaysia general election candidates slam ‘dirty trick’ spam calls; Najib orders action