Developers Club geek daily blog

"VKontakte" not only does not pay users for the found vulnerabilities, but also does not consider them

1 year, 6 months ago
In my modest opinion, bugs from discharge of banal SQL of injections in GET parameters and execution of commands through payp consign to the remote past. Different frameworks the developed in tens and in hundreds of people, automated testing and the best practicians of programming practically do not leave chances of what at the beginning of two-thousand was the ordinary. In my opinion, the current time is a time of races of conditions, logical bugs, miskonfiguration and of course XSS. Which lead, to different serious effects.

Without denying the fact of existence simple critical vulnerabilities to this day that is confirmed in practice, would like to tell about one interesting and in too time a simple logical bug on the social network VK.com.

Read more »


Security Week 52-53: a backdoor at Juniper with a thick layer of cryptography, vintage Java, gopo-bug bounty

1 year, 6 months ago
While the fir-tree already costs, but salads are not cut yet, it is a high time to talk last time this year about safety news. Last week I reported on "non-standard" best news of year, and in general for the remained time anything special did not occur. Though is not present, there is one news which is worthy the separate narration. Two backdoors found on December 17 in software for the network devices Juniper could fill up the long, but undistinguished list of bugs, exploits and incorrect configurations in routers and house routers. But later it became clear that in this history there is a mass of nuances, it touches not only upon a subject of a safe koding, but also enciphering, and even hints on participation of intelligence agencies appeared.

Generally, interesting the termination of year turned out. In addition to Juniper, two more popular news go to a subject of okolobezopasny policy more. Traditional rules: every week edition of the news website Threatpost selects three most significant news to which I add the expanded and ruthless comment. All episodes of series can be found on a tag. The first episode of new year will come out the countries on January 8!

Read more »


As I looked for (and found) a difference in two byte by byte identical files

1 year, 6 months ago
We have one .NET-application which is able to load and use plug-ins. Plug-ins — business good. It is possible to expand functionality, it is possible to update quickly them from the website, it is possible even to give to users SDK and to allow to write the plug-ins. We also did all this. Our plug-ins represented normal .NET-assemblies which needed to be thrown in a certain folder from where the basic of the application loaded them and used. Well, you, probably represent as — Assembly.Load (), we look for the class implementing the necessary interface further, we create object of this class, etc. All this worked long ago, is stable and nothing portended trouble. But suddenly at some point there was a need to create the plug-in consisting of several files. In this regard was decided to consider as a plug-in not just .NET-assembly (1 file), and zip-archive in which can be as one assembly, and several files. In this regard plug-ins in archives were necessary to teach to pack the bild-server, and the main application — to extract them in the right place. In general a task on 10 code lines. Nothing portended trouble. And here I from the bild-server download collected archive with a plug-in, I will extract it in the necessary folder, I start the application, and … does not work! Stop how does not work? It same plug-in!

Further — more. I ask to do the same procedure my colleague, on its computer. It tries — and everything works for it! But how so? One application version, the same file from the bild-server. Some difference in an environment? I sit down at the colleague's computer, I try once again — does not work! It in it tries time on mine — works! That is it turns out that the file "remembers" who extracted it! We call the third colleague to observe this circus. Consistently, on the same computer, in turn we do the same actions: we download archive with a plug-in, we will extract in the necessary folder, we start the application. When it is done by me — the program does not see a plug-in when it is done by the colleague — everything works. On the third circle of these interesting experiments suddenly we notice a difference in actions: I extracted a plug-in with standard means of Windows, and my colleague — with the help 7-Zip. Both was caused by us from a context menu of archive so in the beginning nobody noticed a difference in click on not that point. Well ok. It turns out, the file retrieved from zip-archive with the help 7-zip differs from the same file from the same archive retrieved by means of the standard Windows archiver?

By the way, until you opened article under a cat, answer for yourself a question whether there can be it that contents of files of valid zip-archive at extraction 7-zip and through the conductor of Windows will be a miscellaneous?

Read more »


Underground market of crankcases. Transfer of the book "KingPIN". Chapter 29. "One Plat and Six Classics"

1 year, 6 months ago
Kevin Poulsen, the editor of the WIRED log, and in blackhat childhood the hacker of Dark Dante, wrote the book about "one acquaintance".

In the book the way from the teenage geek (but at the same time rolling), to the experienced cyberkingpin, and also some methods of work of intelligence agencies on capture of hackers and crankcases is shown.

The quest on transfer of the book began in the summer in Itshny camp for seniors — "The Pin: school students translate the book about hackers", then were connected to transfer also Habrayuzera and even a few edition.

Chapter 29. One Plat and Six Classics

(for transfer thanks to Vyacheslav Slinkin)

Did not realize Kate Mularski that does when undertook DarkMarket.

Its days became true madness. Every day began at 8 in the morning with check of ICQ of the messages which fell down in a night regarding any work for MasterSplinter-and.

It went to DarkMarket — service functioned. To come across here on Iceman-and it was always extremely heavy.

Then queue of tiresome work on backup of a DB came. Iceman reset tables twice in vain attempts to expose Mularski so now fuss with backups was part of morning routine. It was impossible to forget about investigation: so far the base continued to be copied, the simple script which author was a NCFTA programmer scanned every line regarding 16-place numbers, beginning with digits 3 on 6. The stolen credit cards automatically were sorted by BIN and went to the relevant banks for immediate cancellation.

Then Mularski fluently browsed private messages, selected the most interesting chats and checked them in the FBI-ovsky central database of electronic surveillance under the name ELSUR. The following neskolk was spent hours for writing of the report. Under a nickname of Master Splinter, Mularski began to cash funds for the modest sums. Some banks agreed to promote and shared the available dump with fake names, but real transactions which processing was financed already from budget FBR.ON transferred them the list with numbers PIN of crankcases over all country, financial institutions in turn daily reported on that where and when withdrawal of funds was performed. Mularski transferred information to local agents depending on the city where operations were made that led to regular writing of detailed notes.

At three o'clock, when crankcases began to appear in a network, the "second" life of Mularski turned into a scorching heat.

Read more »


GOTPass: new besparolny authentication system of the user

1 year, 6 months ago


For last several years the idea that a user authentication method by means of passwords became a little outdated was repeatedly introduced. Some companies, agreeing with this opinion, try to create new authentication systems which would be safer of standard methods, and at the same time more convenient for work. One of such systems is developed by researchers from Plymouth university.

Scientists called the GOTPass project, it is the combined system in which patterns, images and the one-time password integrate. All this is necessary for creation of system which can be more convenient and safer, than usual to us authentication methods.

Read more »


What happened to google public dns in Russia?

1 year, 6 months ago
It is not a toaster, but a problem it was shown across all Russia couple of hours ago. The address 8.8.8.8 does not work though responds. Maybe who knows that he happened? The address 8.8.4.4 does not give record too.

P.S. If who sees this post though at itself on servers will correct if this DNS was used.
To check or dig @8.8.8.8 google.com or nslookup google.com 8.8.8.8
Whether Google Public DNS 8.8.8.8 or 8.8.4.4 in Russia works for you

512 people voted. 385 people refrained.

The users only registered can participate in poll. Enter, please.

Read more »


The botnet from thousands of cracked routers of Aethra was used for attack to the Wordpress-websites

1 year, 6 months ago


The Italian company VoidSec working in the field of information security published material about recently found botnet from Aethra routers. As it appeared, these devices are subject to cracking, and malefactors use botnets from such devices for carrying out brute force attacks on the websites Wordpress.

One of such attacks was found by the specialist of the company when that analyzed a log of the Wordpress-websites which underwent attack. As it appeared, attack went from quite close range of IP addresses. After the detailed analysis it turned out that attack was performed with IP, otnsyashchikhsya to 6 Internet service providers: Fastweb, Albacom (BT-Italia), Clouditalia, Qcom, WIND, and BSI Assurance UK. 4 providers work in Italy. The majority of these companies set to clients Aethra routers.

Read more »


Underground market of crankcases. Transfer of the book "KingPIN". Chapter 28. "Carder Court"

1 year, 6 months ago
Kevin Poulsen, the editor of the WIRED log, and in blackhat childhood the hacker of Dark Dante, wrote the book about "one acquaintance".

In the book the way from the teenage geek (but at the same time rolling), to the experienced cyberkingpin, and also some methods of work of intelligence agencies on capture of hackers and crankcases is shown.

The quest on transfer of the book began in the summer in Itshny camp for seniors — "The Pin: school students translate the book about hackers", then were connected to transfer also Habrayuzera and even a few edition.

Chapter 28. Court of crankcases

(for transfer thanks of drak0sha)

Kate Mularski it was emaciated.

At first he talked over with the agent in branch of the Secret service on other end of the city. "It seems to me you some troubles threaten". One of uncountable informants heard that Iceman found out incontestable proofs that the Master Splintr was or the informer, the spy of corporate safety, or the federal agent. Iceman temporarily integrated with the former enemy of Silo and prepared the detailed presentation for the manual Carders Market and Dark Market-á. Iceman and Silo obviously wanted to condemn the Master Splintr.

Everything began with the Silo code. Popularity of the Master Splintr as spammer and programmer made him the specialist in the field of reviews of a malicious code DarkMarket-and. It was one of benefits of its secret operation: Mularski will be able to evaluate the latests version of the confidential attacking code and to transfer them to CERT which, in turn, will send them to all anti-virus companies. The malicious code can be found still before it appears in the black market.

This time Mularski charged a code as a training task to one of students of CMU passing training in NCFTA. According to standard procedure the student started the program in the isolated mode on the virtual computer — some kind of program bowl of Petri which can be cleaned later. But he forgot about the USB stick in USB port. On it were loaded an empty form of account about a malicious application with the NCFTA logo and main objectives of research. Before the student realized that occurred, the document appeared in Silo hands.

Six administrators and moderators of DarkMarket received the copy of the Silo code. Now Canadians knew that one of them was a federal agent.

Read more »


Non-standard top of events in the field of IT safety of 2015

1 year, 6 months ago
Here also time to repeat exercise which I the first time executed exactly a year ago came. Then I took 10 most popular news from our website Threatpost and tried to find out — why they, actually, drew public attention — both specialists, and normal users. Such method has obvious shortcomings — on popularity of articles a lot of things influences, and is not obligatory at all that the most popular news about incidents in the cyberworld are at the same time and the most important. But there are also advantages: events in the field of information security there is a huge number, and each participant of their discussion, depending on specialization and personal interests, will select "very best". And here — if not the most objective, then the independent tool of an assessment.

This year the selection of the most visited news successfully is divided into five main categories:
— Low-technology threats for users
— "Vulnerabilities in unexpected places": safety of "Internet of things", home and industrial network devices,
— Data encryption problems
— Loud vulnerabilities in key platforms and "high tech" of cyberthreats — examples of the most advanced attacks
— Routine, but dangerous vulnerabilities in widespread software

Here on them we will also walk.

Read more »


Let’s Encrypt in a Plesk-panel

1 year, 6 months ago
On December 3 there was a public release of a beta of Let's Encrypt. This joyful event was already covered on Habré. Briefly I will remind, this piece gives the chance to set the free entrusted certificate on the website. In addition to free certificates, Let's Encrypt still the tool for invoicing, updating, a withdrawal of certificates that, as envisioned by authors, will facilitate life to system administrators.

In this article I will tell about features of Let's Encrypt about which you should not forget, and about how to use it if your server works under control of the Plesk panel.

Read more »