Comcast Hijackers Say They Warned the Company First

Friday, May 30th, 2008

The computer attackers who took down Comcast's homepage and webmail service for over five hours Thursday say they didn't know what they were getting themselves into. In an hour-long telephone conference call with Threat Level, the hackers known as "Defiant" and "EBK" expressed astonishment over the attention their DNS hijacking has ...

Detecting Rogue Wireless

Monday, April 28th, 2008

Wireless networking technologies are a rich playground for hackers -- both ethical penetration testers and malicious attackers. There are many avenues of attack, ranging from attacking the infrastructure, the clients, or the actual traffic through man-in-the-middle sniffing and manipulation. Rich Mogull covered the wireless “Evil Twin” attack in his recent ...

Securing the Internet’s DNS

Thursday, April 24th, 2008

The Internet is slowly inching closer to ratcheting up the security of its Domain Name System (DNS) server architecture: The Internet Corporation for Assigned Names and Numbers (ICANN) plans to go operational with the secure DNS technology, DNSSEC, later this year in one of its domains. ICANN officials said the organization ...

Kraken Reverts to HTTP

Tuesday, April 22nd, 2008

Following a friendly heads up from someone yesterday morning, I re-loaded the following Kraken samples into my honeypot: 1d51463150db06bc098fef335bc64971 65b958bf6f5eddca3d9455354af08b6f 6ec7d67d5553cbec2a99c7fbe385a729 7ecef2f126e66e7270afa7b803f715bc 8fd8c67103ec073d9303a7fbc702f89a and began monitoring them. Each sample proceeded to update itself; the updated binary is around 160KB, given a random name and placed in the system32 directory, and no longer has an imagefile icon. The names/MD5 values of ...

sqlninja 0.2.2 Released – SQL Injection Tool

Tuesday, April 15th, 2008

Sqlninja is a tool targeted to exploit SQL Injection vulnerabilities on a web application that uses Microsoft SQL Server as its back-end.  Its main goal is to provide a remote shell on the vulnerable DB server, even in a very hostile environment. It should be used by penetration testers to ...