FormFox

April 6, 2008 – 3:06 PM

I’ve just recently caught wind of a Firefox plugin called FormFox.  Here’s the description from the website:

Do you know where your form information is going? This extension displays the form action (the site to which the information you’ve entered is being sent.) In any place where you can enter data, from search boxes to order forms, mouse over the final Submit button to reveal the destination.

I tested it out quick on a few websites and I can see how this might be useful.  I know that on more than one occasion I’ve wondered where my form data was being passed to and I’ve always had to “view source” and check the action of that form.  I mainly wanted to see if it went to a non-secure or a secure page.  This plugin will help with that because I now just need to hover my mouse over the Submit object and it will pop-up a tooltip showing me exactly where my data is going.  Here’s a few examples:

Read the rest of this story…

MySQL SQL Injection Cheat Sheet

April 6, 2008 – 8:55 AM

Some useful syntax reminders for SQL Injection into MySQL databases…

This post is part of a series of SQL Injection Cheat Sheets.  In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend.  This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.

The complete list of SQL Injection Cheat Sheets I’m working is:

I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.

Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.

Read the rest of the story…

Phishing Revisited

April 6, 2008 – 8:26 AM

As Chris mentioned in a previous post we used social engineering and phishing emails as an attack vector. The scope of the engagement prevented us from collecting any data that could be used to identify the user. The client was not out to make examples of their staff but to see how well their education and training programs were working. I commend that approach as our goal as pentesters is not to simply own the network (well it is. :)) but we are also there to provide the data and metrics to help improve the client’s overall security.

But what if the scope required that you use the phishing attack to capture user data and even possibly, as Chris stated, upload and use the credentials of the user to dig deeper into the network.

Let’s take a look at how you can use a simple page containing some javascript and php (or perl) to accomplish this. First let us determine what we are looking to collect from the client machine and user. One restriction is we cannot upload anything (backdoor, etc…) to the client machine. So what can we collect then? We can collect the credentials (username/password) entered by the user, computer’s hostname, local and remote IP Addresses, Firefox plugins and more. Let’s assume that we are using the same phish as in the previous post. We are going to use the same perl mass mailer and the same html pages. Well that’s great but how do you collect all that data?

Let’s start with the page we want the user to see when they click on the link in the email. We’ll call it login.html, a fake login page. I will simply show the code need to begin collecting the data. I’ll leave the design and layout up to you.

Read the rest of this story…

Adobe Pushes Photoshop to 64 bits–for Windows Only

April 6, 2008 – 7:36 AM

Adobe’s flagship product, Photoshop, will become a 64-bit application in the next major revision to the company’s bundle of creative pro applications, Creative Suite 4. However, the 64-bit version will only be available to Windows users because of a change Apple made at its Worldwide Developers Conference (WWDC) in 2007.

The good news is that Adobe will make a 64-bit version for the Mac in the future.

“We can reassure people that literally from the day we found out Carbon 64-bit was cancelled, we have been figuring out what we need to do to get there,” John Nack, senior product manager for Adobe Photoshop, told Macworld.

At WWDC 2007 Apple discontinued its Carbon 64-bit program, which left company’s like Adobe without an avenue to make its current codebase 64-bit. What Adobe has to do now is transition all of the old Photoshop code to Apple’s native Cocoa programming language, where it can then be made 64-bit.

“If you want to go 64-bit on the Mac, you have to port to Cocoa and that’s not a trivial task,” said Nack.

Read the rest of this story…

Internet Fraud Dupes Men More Often Than Women

April 6, 2008 – 7:31 AM

When it comes to being taken in by Internet fraudsters, men have a knack for losing cash, according to a new report from the Internet Crime Complaint Center.

Data compiled from more than 206,000 complaints received last year by the U.S. Internet Crime Complaint Center (IC3) shows that men lost US$1.67 to every $1 lost by women in online fraud.

Identifying Fraud Trends

The IC3 is the clearinghouse for online crime complaints in the U.S., and its database is used by regulators and law enforcement to get a picture of criminal trends and, in some cases, help hunt down the criminals. It is a joint effort run by the U.S. Federal Bureau of Investigation and the National White Collar Crime Center.

The organization says that buying patterns and human nature play into the findings.

“Historically men were more apt to purchase large ticket item like electronics … that could explain a lot of it,” said John Kane, the IC3 research manager who wrote the report.

But with women now spending more online, the difference is also due to the fact that certain types of schemes seem to suck men in. “Men tend to fall victim … to business investment schemes and some other schemes that have a higher dollar loss,” Kane said.

Investment fraud complaints, where the average loss is more than $3,500, were overwhelmingly submitted by men, Kane said. Compare that to something like auction fraud, where both men and women are frequently victimized. The average loss there is just over $480.

Men also tend to be the victims of check fraud (average loss: $3,000) and Nigerian letter fraud scams ($2,000), Kane said.

Crime Climbs

Overall, Internet crime is netting the bad guys more money than ever.

Total losses from 2007 complaints came to $239 million, up $40 million from 2006.

The 2007 data, released Thursday, shows that the total number of complaints received by the group was actually down for the second year in a row. In 2007 the IC3 Web site logged just under 207,000 complaints. In 2005 that number was over 231,000.

Kane credited the drop in complaints to increased consumer awareness, but according to Gary Warner, director of research in computer forensics with the University of Alabama at Birmingham, there may be another explanation.

Warner spends a lot of time studying the criminals and said that in recent months, researchers have noticed that credit card numbers have often been stolen and then not used. “One theory is that nobody wants to go to jail for stealing $40,” he said. “So when they get access to these accounts, they’re using only the ones that they can get the most value from.”

Often, criminals will do a balance check and then sell only the cards with the highest balances. “I think there’s a little bit of filtering on the criminal side that’s at play here,” he said.

There was another interesting finding in the 2007 data. The IC3 found that many countries that were commonly linked with cybercrime were the sources of the incidents it tracked, but it did not list China as a top source of perpetrators. China has been named as the source of many online attacks over the past year, but it didn’t make IC3’s list of top 10 countries by perpetrators.

Leading the list were the U.S., the United Kingdom and Nigeria.

Source: PC World