I thought this was cool. It may come in handy for Ham Radio.
Archives for : JAVA
I was asked some time ago to provide a list of things which may be considered when looking at Internet Banking.
Below is the list. It was just a brain dump and as such may not be complete.
Don’t underestimate the value of standards for your infrastructure, website configuration, database engine configuration/architecture,staging environment and development/QA environments.
Some thoughts:
- Many don’t lock accounts after X failed logins, this is normally done for good customer service, but leaves the system vulnerable.
– And all the other things expected for a remote login session (forced password changes, aging, etc))
– Tools such as Brutus may be use to brute force hack authenticated sessions.
- Many allow session sequence numbers to be incremented, allowing an authenticated user to view other customer session.
– These may be server side, client side, cookie based, etc.
– Get someone to check the development methodologies and the code being used.
– Database query strings can be placed into test entry fields, allowing table dumps to browser.
– Check all pages served are secure and contain user authentication flags.
- Customer data may not be segregated, this needs to be checked.
- Customer data should not reside on the Web Server.
- Authentication databases / system data should not reside on the webserver.
- The databases should reside on a private/semi-private network.
– A different segment to the main banking system.
- Webserver should be dual homed or equivalent (some VLAN techniques are good)
– Separate private and public network cards, monitoring/backup/administration
– Infrastructure set-up to explicitly deny inbound/outbound ports, private IP & monitoring escaping from the network.
- At all data segregation points ensure rules are in place which appreciates the traffic though that point.
- All customer data where possible should be sourced from a secure back-end database.
– This may be a staging environment. i.e. no the main banking system.
– This usually allows for transactions to appear real time to the customer.
– Many transactions may be batched in reality. (internal or external to the bank)
- Ensure suitable rules have been set-up on firewalls.
– There should be inbound and outbound rules on firewalls and filtering routers.
- Don’t allow any infrastructure on the front end to allow remote administrative connections. (telnet, etc.)
– Use the serial console port to connect to a server or back-end terminal server.
- Look for the segregation / staging of online customer content from main banking systems
- Ensure that a separate development / QA / production environment system and suitable process is in place.
- Services not used by the system are active
– These should be disabled.
- Port scan of the supporting infrastructure (routers /switches) and server(s).
– Investigate the reasons for all open ports.
- Don’t use the main gateway for trusted partner access (clearing / RAS / etc.)
- Do all that standard IIS checks and NT checks (Sample scripts, change management, patching methodologies, etc.)
- Ensure denial of service precaution have been taken into account for all infrastructure and server equipment.
- Check the adequacy of the escalation procedures used.
– Look for real-time monitoring and alerting.
– Look for responsibility matrix.
– Look for ownership of issues.
- Consider upstream carrier(s) vulnerability (denial of service, IP spoofing, DNS hacking, etc)
- Consider social engineering of customer, administrative, partner accounts / systems / infrastructure.
– Helpdesk procedures and policies and/or alternate technologies (Caller ID, Gateway IP, etc.).
- Use dynamic passwords where possible (SecureID, TACACS, etc.).
- Use encrypted tunnelling where needed (IPSec, Firewall 1, etc)
- Consider looking at other customer authentication methods to enhance existing methods.
– Digital cert, IP address locked to account, etc.
– Consider use of CVV or CVN for bank issued cards.
- Consider how passwords are distributed /changed for customers.
– Plain text email, telephone, etc.
– Can passwords be changed online?
- Is additional authentication used between sections of the services once authenticated?
- Consider what the customer has access to once authenticated.
– Look at SWIFT, RTGS, inter-bank transfers, access to credit cards, etc.
– If an attacker does get in, what can the do?
- Use techniques to ensure pages, customer details are not cached at ISP, or client system.
– These are flags that can be set within pages.
– Normally SSL is cached, but some proxy vendors have been playing with techniques to do so.
– Caching of SSL pages on the client system can be turned on on some browsers.
– May banks use a Java (or similar) applet for all customer interaction, restricting all caching issues.
- Ensure paper based and on-line liability clauses are available are address all effected areas.
- Ensure within the customer sign-up process banking liability is reduced.
– I’ve seen statements like “use this system at your own risk, responsibility for any liability or claim will NOT……”
– Not very customer focused, but that’s what their legal department recommended.
All of the above can effect the security and/or operation of an on-line banking system.
Other things to consider:
- External development and support of the application.
- Ownership and management of the hardware/applications
- Publishing points for new content (internal/private/trusted network or Internet)
- Topology of front end. i.e. Security Architecture document should be in place and managed appropriately.
- Are limited AP tests performed whenever changes are made to the environment? i.e. integrated AP into Change management process.
- Database access. Is it buffered or is it live to the core banking systems.
- What facilities are provided? Direct debit + Credit Card + SWIFT + ……. Consider different scenarios for your attack depending on the feature.
- What other services are shared within the network segment that the Internet Banking service is running. Can this be used to compromise the Internet Banking site. eg. different support/business/development organisations with differing security strategies/profiles.
- Consider all external supporting services within you AP. Look at internal/external DNS poisoning opportunities, mail relay, etc. What IPS’s do they use has the ISP any opportunity to access systems or supporting services which may affect Internet Banking.
- Depending on the size of the Bank, many organisation do not use the same support groups for infrastructure and the application. As a result external connections to the infrastructure may be provided for an external support organisation to administer the infrastructure.
- Look at the business and user authentication methods and paths (client side certs, secure ID, SMART Card, etc). Consider two factor authentication and modern user identification methods. eg. what is your favourite food in addition to normal usernames and passwords. Do system administration staff use dynamic passwords (secureID, etc)?
- See if the Internet Banking application sends email to users which may contain interesting information.
- Better access to the application can generally be gained after access to the system. i.e. get an legitimate account on the system. I have found that some sample/administration screens have been restricted to authenticated users only.
- Consider social engineering the Help desk to have an account password reset.
When considering Mobile Banking security and the associated risks, an assessment approach depends greatly on the solution being created or provided.
Generally the approach is based on layered standards, supporting and surrounding the technologies and techniques used.
Here are some things to consider.
Security assessments generally focuses on two main things.
1/ Sensitivity of the data
What is being sent. eg. Pin, credit card numbers, account balance, home address, bank account number, etc.
Data may not be sensitive to the bank, but may be considered by the client as sensitive.
etc……….
2/ Opportunity to access the data.
What medium is being used?
Is it technology/technique easy or trivial to hack?
What encryption is being used?
Are all data paths secure (client and back end)?
Is there a 3rd party involved in the switching of the transactions?
etc………
Things to consider:
- Pin resets sent via SMS to client, should not be used as the only method of accessing accounts. An additional client specific (possibly static) pass word/phrase should be used in addition to a dynamically generated pin. SMS can be sniffed (depending on mode and location).
- If WAP is used, are all devices capable of encryption? If devices are not capable of encryption, do we deny access to these devices? If client side JAVA or intelligent device (win CE, etc), ensure this can not be compromised by a Trojan’s and other key logging techniques.
- Has the organisation considered client side certificates to verify the device prior to transactions being accepted? Consider multiple device and user identification methods (very solution dependant).
- Most mobile POS terminals encrypt the client entered Pin number, but do not encrypt everything within the transaction. If the transmission medium is compromised, we should consider if the encryption can be cracked and if unencrypted data is sensitive. Consider additional data encryption encapsulation i.e. use of all of message encryption (SSL, IPSEC) or use a terminal that utilises Derived Unique Key Per Transaction (DUKPT).
- Many banking applications have been affected by typical hacks such as session hijacking, SQL injection, non random session keys (client side and server side), etc… These typical hacks should be considered in your Secure SDLC and QA Processes once you are aware of the technology used and/or deployed.
- PBX systems and cabling distribution frames can have devices connected to collect transactions. Wireless devices are now being connected to these systems. The attacker sits in their car in the car park outside. This is often done in super markets.
- Wireless transaction gateways if not encrypted are easily collected by anyone within wireless range. 802.11 and other wireless/infra-red mediums are being used (assess the technology and medium being used).
- Has the organisation considered dynamic keys for mobile users? There are some very low cost SecureID type solutions available today, but customers need to have these devices on them when they want to do a transaction.
A blog posting on BoingBoing provides further discussion as to the
inappropriate deployment and of RFID chips within the existing payment
marketplace.
http://www.boingboing.net/2006/10/23/report_contactless_c.html
The underlying point of this article is, the card schemes and banks said they are using key rotating encryption of all data between the card and the acquirer/issuer, but this is clearly not the case in many situations.
Another interesting paper is ‘RFID Payment Card Vulnerabilities Technical Report’ located at:
http://www.nytimes.com/packages/pdf/business/20061023_CARD/techreport.pdf
I recently had a couple of complaints in regards to the new Website. It turns out the site looks OK in Firefox but does not seem to work very well with Internet Explorer.
I ran the W3C Validator located at http://validator.w3.org/
When executed against the site it found 11 errors. The files and fixes (highlighted in RED) are described below.
File: Header.php
Error: required attribute “type” not specified
<script type=”text/javascript” src=”<?php bloginfo(‘template_directory’); ?>/js/addEvent.js”></script>
<script type=”text/javascript” src=”<?php bloginfo(‘template_directory’); ?>/js/sweetTitles.js”></script>
I have also seen some other errors in Header.php, but they don´t seem to be a big problem.
Error: document type does not allow element “li” here; missing one of “ul”, “ol”, “menu”, “dir” start-tag.
Update
I finally worked out what was going on…
It was the mod_rewrite (RewriteEngine) in the .htaccess file.
I´m running WPSuperCache, so I thought this may have caused some issues.
As it turned out it was the WordPress section of the .htaccess which was causing the problems. I probably modified it at some stage…
Another Problem Found and Fixed
I have been having problems when placing graphics into a posting, where although the WYSIWYG editor shows the correct layout, the text below the image wraps around the graphic when the site is viewed.
After some looking around, I found a similar article written in relation to a different theme. As it turns out the fix for the DUST-317 Theme is the same.
Edit the DUST-317 Theme style.css located in the DUST-317 theme directory. Search for this line.
#content p img{float:left;border:none;margin-right:10px;margin-bottom:10px;}
Remove the float:left; for the above line, making it look like this.
#content p img{border:none;margin-right:10px;margin-bottom:10px;}
ThatÅ› it… now the text sits under the graphics OK.
http://www.eng.tau.ac.il/~yash/kw-usenix06/index.html </a>
Check it Out…
How to Build a Low-Cost, Extended-Range RFID Skimmer
Also some of the supporting documents.
A Practical Relay Attack on ISO 14443 Proximity Cards
S4100 Multi-Function Reader Module Data Sheet
Security Analysis of a Cryptographically-Enabled RFID’s
Summary
In November 2003, Adam Laurie of A.L. Digital Ltd. discovered that there are serious flaws in the authentication and/or data transfer mechanisms on some bluetooth enabled devices. Specifically, three vulnerabilities have been found:
Firstly, confidential data can be obtained, anonymously, and without the owner’s knowledge or consent, from some bluetooth enabled mobile phones. This data includes, at least, the entire phone book and calendar, and the phone’s IMEI.
Secondly, it has been found that the complete memory contents of some mobile phones can be accessed by a previously trusted (“paired”) device that has since been removed from the trusted list. This data includes not only the phonebook and calendar, but media files such as pictures and text messages. In essence, the entire device can be “backed up” to an attacker’s own system.
Thirdly, access can be gained to the AT command set of the device, giving full access to the higher level commands and channels, such as data, voice and messaging. This third vulnerability was identified by Martin Herfurt, and they have since started working together on finding additional possible exploits resulting from this vulnerability.
Finally, the current trend for “Bluejacking” is promoting an environment which puts consumer devices at greater risk from the above attacks.
Vulnerabilities
The SNARF attack:
It is possible, on some makes of device, to connect to the device without alerting the owner of the target device of the request, and gain access to restricted portions of the stored data therein, including the entire phonebook (and any images or other data associated with the entries), calendar, real-time clock, business card, properties, change log, IMEI (International Mobile Equipment Identity [6], which uniquely identifies the phone to the mobile network, and is used in illegal phone ‘cloning’). This is normally only possible if the device is in “discoverable” or “visible” mode, but there are tools available on the Internet that allow even this safety net to be bypassed[4]. Further details will not be released at this time (see below for more on this), but the attack can and will be demonstrated to manufacturers and press if required.
The BACKDOOR attack:
The backdoor attack involves establishing a trust relationship through the “pairing” mechanism, but ensuring that it no longer appears in the target’s register of paired devices. In this way, unless the owner is actually observing their device at the precise moment a connection is established, they are unlikely to notice anything untoward, and the attacker may be free to continue to use any resource that a trusted relationship with that device grants access to (but note that so far we have only tested file transfers). This means that not only can data be retrieved from the phone, but other services, such as modems or Internet, WAP and GPRS gateways may be accessed without the owner’s knowledge or consent. Indications are that once the backdoor is installed, the above SNARF attack will function on devices that previously denied access, and without the restrictions of a plain SNARF attack, so we strongly suspect that the other services will prove to be available also.
The BLUEBUG attack:
The bluebug attack creates a serial profile connection to the device, thereby giving full access to the AT command set, which can then be exploited using standard off the shelf tools, such as PPP for networking and gnokii for messaging, contact management, diverts and initiating calls. With this facility, it is possible to use the phone to initiate calls to premium rate numbers, send sms messages, read sms messages, connect to data services such as the Internet, and even monitor conversations in the vicinity of the phone. This latter is done via a voice call over the GSM network, so the listening post can be anywhere in the world. Bluetooth access is only required for a few seconds in order to set up the call. Call forwarding diverts can be set up, allowing the owner’s incoming calls to be intercepted, either to provide a channel for calls to more expensive destinations, or for identity theft by impersonation of the victim.
Bluejacking:
Although known to the technical community and early adopters for some time, the process now known as “Bluejacking”[1] has recently come to the fore in the consumer arena, and is becoming a popular mechanism for exchanging anonymous messages in public places. The technique involves abusing the bluetooth “pairing”[2] protocol, the system by which bluetooth devices authenticate each other, to pass a message during the initial “handshake” phase. This is possible because the “name” of the initiating bluetooth device is displayed on the target device as part of the handshake exchange, and, as the protocal allows a large user defined name field – up to 248 characters – the field itself can be used to pass the message. This is all well and good, and, on the face of it, fairly harmless, but, unfortunately, there is a down side. There is a potential security problem with this, and the more the practice grows and is accepted by the user community, and leveraged as a marketing tool by the vendors, the worse it will get. The problem lies in the fact that the protocol being abused is designed for information exchange. The ability to interface with other devices and exchange, update and synchronise data, is the raison d’être of bluetooth. The bluejacking technique is using the first part of a process that allows that exchange to take place, and is therefore open to further abuse if the handshake completes and the “bluejacker” successfully pairs with the target device. If such an event occurs, then all data on the target device becomes available to the initiator, including such things as phone books, calendars, pictures and text messages. As the current wave of PDA and telephony integration progresses, the volume and quality of such data will increase with the devices’ capabilities, leading to far more serious potential compromise. Given the furore that irrupted when a second-hand Blackberry PDA was sold without the previous owner’s data having been wiped[3], it is alarming to think of the consequences of a single bluejacker gathering an entire corporate staff’s contact details by simply attending a conference or camping outside their building or in their foyer with a bluetooth capable device and evil intent. Of course, corporates are not the only potential targets – a bluejacking expedition to, say, The House of Commons, or The US Senate, could provide some interesting, valuable and, who’s to say, potentially damaging or compromising data.<<<
The above may sound alarmist and far fetched, and the general reaction would probably be that most users would not be duped into allowing the connection to complete, so the risk is small. However, in today’s society of instant messaging, the average consumer is under a constant barrage of unsolicited messages in one form or another, whether it be by SPAM email, or “You have won!” style SMS text messages, and do not tend to treat them with much suspicion (although they may well be sceptical about the veracity of the offers). Another message popping up on their ‘phone saying something along the lines of “You have won 10,000 pounds! Enter this 4 digit PIN number and then dial 0900-SUCKER to collect your prize!” is unlikely to cause much alarm, and is more than likely to succeed in many cases.
Workarounds and fixes
We are not aware of any workarounds for the SNARF or BLUEBUG attacks at this time, other than to switch off bluetooth. For permanent fixes, see the ‘Fixes’ section at the bottom of the page.
To permanently remove a pairing, and protect against future BACKDOOR attacks, it seems you must perform a factory reset, but this will, of course, erase all your personal data.
To avoid Bluejacking, “just say no”. 
The above methods work to the best of our knowledge, but, as the devices affected are running closed-source proprietary software, it not possible to verify that without the collaboration of the manufacturers. We therefore make no claims as to the level of protection they provide, and you must continue to use bluetooth at your own risk.
Who’s Vulnerable
To date the quantity of devices tested is not great. However, due to the fact that they are amongst the most popular brands, we still consider the affected group to be large. It is also assumed that there are shared implementations of the bluetooth stack, so what affects one model is likely to affect others. This table is accurate to the best of our knowledge, but without the cooperation of the manufacturers (which we currently do not have), it is not possible to conduct more extensive validation.
The devices known to be vulnerable at this time are:
| Vulnerability Matrix (* = NOT Vulnerable) | ||||||
| Make | Model | Firmware Rev | BACKDOOR | SNARF when Visible | SNARF when NOT Visible | BUG |
| Ericsson | T68 | 20R1B 20R2A013 20R2B013 20R2F004 20R5C001 | ? | Yes | No | No |
| Sony Ericsson | R520m | 20R2G | ? | Yes | No | ? |
| Sony Ericsson | T68i | 20R1B 20R2A013 20R2B013 20R2F004 20R5C001 | ? | Yes | ? | ? |
| Sony Ericsson | T610 | 20R1A081 20R1L013 20R3C002 20R4C003 20R4D001 | ? | Yes | No | ? |
| Sony Ericsson | T610 | 20R1A081 | ? | ? | ? | Yes |
| Sony Ericsson | Z1010 | ? | ? | Yes | ? | ? |
| Sony Ericsson | Z600 | 20R2C007 20R2F002 20R5B001 | ? | Yes | ? | ? |
| Nokia | 6310 | 04.10 04.20 4.07 4.80 5.22 5.50 | ? | Yes | Yes | ? |
| Nokia | 6310i | 4.06 4.07 4.80 5.10 5.22 5.50 5.51 | No | Yes | Yes | Yes |
| Nokia | 7650 | ? | Yes | No (+) | ? | No |
| Nokia | 8910 | ? | ? | Yes | Yes | ? |
| Nokia | 8910i | ? | ? | Yes | Yes | ? |
| * Siemens | S55 | ? | No | No | No | No |
| * Siemens | SX1 | ? | No | No | No | No |
| Motorola | V600 (++) | ? | No | No | No | Yes |
| Motorola | V80 (++) | ? | No | No | No | Yes |
+ We now believe the 7650 is only vulnerable to SNARF if it has already been BACKDOORed.
++ The V600 and V80 are discoverable for only 60 seconds, when first powered on or when this feature is user selected, and the window for BDADDR discovery is therefore very small. Motorola have stated that they will correct the vulnerability in current firmware.
Disclosure
What is the Philosophy of Full Disclosure, and why are we providing the tools and detailing the methods that allow this to be done? The reasoning is simple – by exposing the problem we are achieving two goals: firstly, to alert users that the dangers exist, in order that they can take their own precautions against compromise, and secondly, to put pressure on manufacturers to rectify the situation. Consumers have a right to expect that their confidential data is treated as such, and is not subject to simple compromise by poorly implemented protocols on consumer devices. Manufacturers have a duty of care to ensure that such protection is provided, but, in practice, commercial considerations will often take precedence, and, given the choice, they may choose to simply supress or hide the problem, or, even worse, push for laws that prevent the discovery and/or disclosure of such flaws[5]. In our humble opinion, laws provide scant consumer protection against the lawless.
After 13 months, and in consideration of the fact that affected manufacturers had acknowledged the issues and made updated firmware available, Full Disclosure took place at the Chaos Computer Club’s annual congress – 21C3, in Berlin, 2004.
Slides from the disclosure talk can be found here: http://trifinite.org/Downloads/21c3_Bluetooth_Hacking.pdf
Tools
Proof of concept utilities have been developed, but are not yet available in the wild. They are:
- bluestumbler – Monitor and log all visible bluetooth devices (name, MAC, signal strength, capabilities), and identify manufacturer from MAC address lookup.
- bluebrowse – Display available services on a selected device (FAX, Voice, OBEX etc).
- bluejack – Send anoymous message to a target device (and optionally broadcast to all visible devices).
- bluesnarf – Copy data from target device (everything if pairing succeeds, or a subset in other cases, including phonebook and calendar. In the latter case, user will not be alerted by any bluejack message).
- bluebug – Set up covert serial channel to device.
Tools will not be released at this time, so please do not ask. However, if you are a bona-fide manufacturer of bluetooth devices that we have been otherwise unable to contact, please feel free to get in touch for more details on how you can identify your device status.
Credits
The above vulnerabilities were discovered by Adam Laurie, during the course of his work with A.L. Digital, in November 2003, and this announcement was prepared thereafter by Adam and Ben Laurie for immediate release.
Adam Laurie is Managing Director and Chief Security Officer of A.L. Digital Ltd.
Ben Laurie is Technical Director of A.L. Digital, and author of Apache-SSL and contributor to many other open source projects, too numerous to expand on here.
A.L. Digital Ltd. are the owner operators of The Bunker, the world’s most secure data centre(s).
e: adam@algroup.co.uk
w: http://www.aldigital.co.uk
e: ben@algroup.co.uk
w: http://www.apache-ssl.org/ben.html
Further information relating to this disclosure will be updated at http://www.bluestumbler.org
References:
[1]
- http://www.bluejackq.com/
- http://www.theregister.co.uk/content/6/33781.html
- http://news.bbc.co.uk/1/hi/technology/3237755.stm
[2]
[3]
- www.outlaw.com
[4]
- bluesniff
- btscanner
- redfang
[5]
[6]
- http://www.babt.com/gsm-imei-number-allocation.asp
- http://www.mobiledia.com/glossary/68.html
- BBC News Technology Page
- The Register
- ZDNet UK (Original Coverage)
- ZDNet UK (Nokia response)
- ZDNet (Sony Ericsson response)
- Slashdot
- The Times
- The Times (Palace of Westminster)
- The Bluetooth SIG.
- Bruce Potter’s Defcon-11 presentation [Powerpoint].
- @Stake’s Bluetooth Discovery Paper [PDF].
- Marcel Holtmann’s German papers.
- Marcel Holtmann’s other papers.
- Bluetooth Device Security Database.
- Martin Herfurt’s CeBIT snarfing expedition.
- Slides from Blackhat/DEFCON talk.
In the news
Other related links
Fixes