Archive for the ‘annoyances’ Category

Account Collision on Twitter?

Thursday, April 23rd, 2009

So, here’s an interesting tidbit for all you aspiring Twitter hackers . . .

As some of you may know, the OWASP DC Chapter just announced that the US AppSec for 2009 will be hosted in Washington DC this coming November.

In preparation for this, I had registered a twitter account, @AppSecDC the day before on the 21st.

All seemed well, but as I was waiting to make the announcement, and wanted the account to remain “invisible” from the twitter stream, I didn’t make any tweets on it. I did however enter the account information into several different twitter clients on several machines without issue.

After the OWASP meeting this evening, I went to send out the inaugural tweet from the new appsec account — only to be told by Tweetie (a Twitter client app for the uninitiated) that it couldn’t authenticate the account. When I tried through the web, I got a message that the account was locked out. I decided this was curious, but not initially suspicious, as if I had typed it into my Twitter client wrong and it had been sitting there all meeting long trying to update, it might not be surprising if it had gotten locked out. I made the call that I would investigate when I got home.

Upon getting home, I was fairly surprised to see that I still couldn’t log in. At this point, I started getting a tad suspicious. Could Mikeyy or his ilk have figured out a clever way to hack my account . . . before it had ever done anything? Being in AppSec unfortunately can make everything you do a target to some folks. Looking up the account, I was surprised to see that the handle displayed was now different! I know that you can change the handle on an account, but the change seemed . . . well . . . very unhackerly. Who was going to hack our account and change the “real  name” to “Nancy?”

1-url-doesnt-match-name

However, it did appear that for whatever reason, @AppSecDC was now coming up as @iwantsamoa. Trying a password reset didn’t work, implying that the email address in the user profile had been modified as well.

(more…)

Posted in Twitter, annoyances | 7 Comments »

An Introduction to NoScript

Tuesday, April 14th, 2009

If you’ve been sleeping through the past weekend, you probably haven’t heard about “Mikeyy” and the Cross-Site Scripting worms which have been plaguing Twitter.

Saving ranting and rhetoric for a separate post, an ethical reaction to this is to attempt to educate people as to how they can protect themselves from things like this in the future.

Since I am often extolling the virtues of NoScript, and routinely suggest it as a counter measure, I figured this would be a good time to write up a tutorial on the subject (and I’ve gotten several requests for it as well).

NoScript is an add-on for the Firefox web browser, which in addition to a few others, can provide users with one of the safest (and most configurable) ways to browse the internet and determine what content is allowed to execute in your browser (and what is not). It is not a cure-all, and does not protect you from all types of web attacks by any means, but it does protect against a lot of common “drive-by” attacks that take internet users unawares, and, if properly configured, would have protected Twitter users from the Mikeyy worms.

(more…)

Posted in NoScript, Twitter, Web Security, XSS, annoyances, information security | 1 Comment »

Nmap for Conficker

Tuesday, March 31st, 2009

I tried out some of the Conficker tools mentioned earlier. Following Dan Kaminsky’s suggestion, the script is a little clunky, and it’s a LOT easier to run it using NSE (the Nmap Scripting Engine).

You are dealing with a beta build pulled from the nmap SVN, but it worked just fine doing import, make, and install on an OS X 10.5.6 box with the developer tools installed.

NSE’s output is a little wordy, so you probably want to dump output to something else to read it. Zenmap of the last production build seems to do just fine as well, though there’s really not that much it gives you in this case.

e.g.

(more…)

Posted in annoyances, information security | 7 Comments »

What WILL they think of next

Monday, March 9th, 2009

In the continuing decline of the Internet, I seem to have spotted a new type of blog-spam on my blog — trackback spam. A site is automatically reposting blog posts onto a blog that looks (only to the very clueless) like a blog, but is covered with ad links (and lord knows what else if you have scripting enabled).

Yet another facet of never lacking for things to do.

Posted in annoyances | No Comments »