This post is just to inform everyone that do not expect any new blog posts here, I am moving everything to Jekyll + Github pages. You can find the old posts and all the new posts here: https://httpscolonforwardslashforwardslashwwwdotzoltanbalazsdotcom.com/ So long Google.
Introduction It was 20 November, and I was just starting to wonder what I would do during the next month. I had already left my previous job, and the new one would only start in January. Playing with PS4 all month might sound fun for some people, but I knew I would get bored quickly. Even though I have some limited red teaming experience, I always felt that I wanted to explore the excitement of…
You either landed on this blog post because you are a huge fan of Hacktivity you bought this badge around a year ago you are just interested in hacker conference badge hacking. or maybe all of the above. Whatever the reasons, this guide should be helpful for those who never had any real-life experience with these little gadgets. But first things first, here is a list what you need for hacking the…
TL;DR: Don't build a burner device. Probably this is not the risk you are looking for. Introduction Every year before DEF CON people starts to give advice to attendees to bring "burner devices" to DEF CON. Some people also start to create long lists on how to build burner devices, especially laptops. But the deeper we look into the topic, the more confusing it gets. Why are we doing this? Why are…
Recovering data from a backup should be an easy thing to do. At least this is what you expect. Yesterday I had a problem which should have been easy to solve, but it was not. I hope this blog post can help others who face the same problem. The problem 1. I had an encrypted Time Machine backup which was not used for months 2. This backup was not on an official Apple Time Capsule or on a USB HDD,…
Disclaimer: This is my personal opinion. I am not an expert in attribution. But as it turns out, not many people in the world are good at attribution. I know this post lacks real evidence and is mostly based on speculation. Let's start with the main facts we know about the WADA hack, in chronological order: 1. Some point in time (August - September 2016), the WADA database has been hacked and…
From time to time, I get disappointed how much effort and money is put into securing computers, networks, mobile phones, ... and yet in 2016 here we are, where not much has changed on the defensive side. There are many things I personally blame for this situation, and one of them is the security tips. The goal of these security tips is that if the average user follows these easy to remember rules,…
The time has come. I bought my second IoT device - in the form of a cheap IP camera. As it was the most affordable among all others, my expectations regarding security was low. But this camera was still able to surprise me. Maybe I will disclose the camera model used in my hack in this blog later, but first, I will try to contact someone regarding these issues. Unfortunately, it seems a lot of…
TL;DR, most of the security news about IoT is full of FUD. Always put the risks in context - who can exploit this and what can the attacker do with it. Most story only covers the latter. Introduction There is rarely a day without news that another "Internet of Things" got hacked. "Smart" safes, "smart" rifles, "smart" cars, "smart" fridges, "smart" TVs, "smart" alarm systems, "smart" meters,…
Introduction Whenever security professionals recommend the 5 most important IT security practices to average users, one of the items is usually something like: “Avoid using open Wifi” or “Always use VPN while using open WiFi” or “Avoid sensitive websites (e.g. online banking) while using open WiFI”, etc. What I think about this? It is bullshit. But let’s not jump to the conclusions. Let’s analyze…
TL;DR: Are you into red teaming? Need persistence? This post is not that long, read it ;) Are you into blue teaming? Have to find those pesky backdoors? This post is not that long, read it ;) In the previous post , I listed different ways how a Windows domain/forest can be backdoored. In this new post, I am digging a bit deeper, and list the most common/known ways malware can survive a reboot,…
When the Kerberos elevation of privilege (CVE-2014-6324 / MS14-068) vulnerability has been made public, the remediation paragraph of the following blog post made some waves: http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx "The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain."…
This post is going to be a rather strange post compared to previous ones. But bear with me, in the middle of the post you will see why this post fits the IT security topic. I'm also terribly sorry for not posting recently, but I was busy with my SPSE and SLAE certification. Both are recommended for Python and Assembly noobs like me. But back to this post. A little bit of history Cheating in games…
This is just a collection of links about my DEF CON 22 presentation, and the two tools I released: Slides: http://www.slideshare.net/bz98/defcon-22-bypass-firewalls-application-white-lists-secure-remote-desktops-in-20-seconds Tools: https://github.com/MRGEffitas/Write-into-screen https://github.com/MRGEffitas/hwfwbypass Presentation video from Hacktivity:…
In the previous blog post , I have covered the different passwords you have to protect, the attackers and attack methods. Now let's look at how we want to solve the issue. Password requirements So far we have learned we have to use long, complex, true random passwords. In theory, this is easy. Now, this is my password advice for 2014: Password character classes Use upper-lower-digit-special…
TL;DR: different passwords have different protection requirements, and different attackers using various attacks can only be prevented through different prevention methods. Password security is not simple. For real advise, checking the second post (in progress). Are you sick of password advices like "change your password regularly" or "if your password is password change it to pa$$w0rd"? This post…
This is the second blog post in the "Attacking financial malware botnet panels" series. After playing with Zeus , my attention turned to another old (and dead) botnet, SpyEye. From an ITSEC perspective, SpyEye shares a lot of vulnerabilities with Zeus. The following report is based on SpyEye 1.3.45, which is old, and if we are lucky, the whole SpyEye branch will be dead soon. Google dorks to find…
In the Hacking Windows 95, part 1 blog post, we covered that through a nasty bug affecting Windows 95/98/ME, the share password can be guessed in no time. In this article, I'm going to try to use this vulnerability to achieve remote code execution (with the help of publicly available tools only). The first thing we can do when we have read access to the Windows directory through the share, is to…
DSploit After playing with the applications installed on the Pwn Pad , I found that the most important application (at least for me) was missing from the pre-installed apps. Namely, DSploit . Although DSploit has tons of features, I really liked the multiprotocol password sniffing (same as dsniff) and the session hijacking functionality. The DSploit APK in the Play Store was not working for me,…
Disclaimer : Don't hack anything where you don't have the authorization to do so. Stay legal. Ever since I bought my first Android device, I wanted to use the device for WEP cracking. Not because I need it, but I want it :) After some googling, I read that you can't use your WiFi chipset for packet injection, and I forgot the whole topic. After a while, I read about hacking on tablets (this was…
I have read a blog post , where you can build your own privacy proxy server built on Raspberry PI. The post got me thinking about how I can use this to protect my privacy on my Android phone, and also get rid of those annoying ads. Since I own a Samsung Galaxy S3 LTE with Android 4.3 (with a HW based Knox counter), rooting the phone now means you break Knox, and loose warranty . Past the point of…
TL;DR: Don't use MD-5 to identify malware samples. Believe me, it is a bad idea. Use SHA-256 or a stronger hash function. This post is dedicated to all malware researchers , still using MD-5 to identify malware samples. Before deep-diving into the details, let me explain my view on this topic. Whenever you want to identify a malware, it is only OK to publish the MD-5 hash of the malware if you…
I played with leaked financial malware recently. When I saw these panels are written in PHP, my first idea was to hack them. The results are the work of one evening, please don't expect a full pentest report with all vulns found :-) The following report is based on Zeus 2.0.8.9, which is old, but I believe a lot of Zeus clones (and C&C panels) depend on this code. First things first, here are some…
During a CTF game, we came across very-very old systems. Turns out, it is not that easy to hack those dinosaur old systems, because modern tools like Metasploit do not have sploits for those old boxes and of course our "133t h4cking skillz" are useless without Metasploit... :) But I had an idea: This can be a pretty good small research for fun. The rules for the hack are the following: Only…
In the first post of this DNSSEC series, I have shown the problem (DNS vulnerabilities), and in the second post , the "solution." In this third post, I am going to analyze DNSSEC. Can DNSSEC protect the users against all of the attacks? Or just part of them? What about corner cases? The following list are the attack types from the first post , where DNSSEC can protect the users: DNS cache…