A revised bill putting the burden to protect copyrighted material on the entity is what is required not giving the government the ability to make the decision what to block and what not to block. Our government has more important issues to deal with then doing the legal leg work that these entities should be doing to protect their content.

Watch the video below for more information:

http://www.youtube.com/watch?v=n0X5WCmyokw

To get more information on the bill from a more reliable source (EEF):  https://www.eff.org/deeplinks/2012/01/how-pipa-and-sopa-violate-white-house-principles-supporting-free-speech

To sign the petition click here:

https://blacklists.eff.org/

Daniel Suarez wrote in his book Daemon about a man that upon his death a strategically crafted computer system that would launch a mulitude of events that range from something extremely simple to murder. In the book he mentions how there are a multitude of systems monitoring different resources for this person’s death. What if we eliminated the need for such a vast system and used the number one social media site and a simple application. What if we stream line the process?

Today I stumbled upon an application for the social media giant Facebook called “If I Die” (http://www.ifidie.net). This application allows you to record a message or a post that upon your death and verification of your three trustees will be posted to your Facebook account. Wow now over several million people will know I am dead before the newspapers even have the first obituary with my death printed.

So you are now thinking how does this line up with the book the Daemon? Well let’s go back a few months to my Facebook bot I wrote (http://www.digitaloffensive.com/2010/08/facebook-bot-fbcbot-pl/). This bot would monitor my Facebook account for key word posts then launch commands locally to carry out my wishes. So right now you are probably thinking that’s all fine and dandy if you have a system you can guarantee will be up and running all the time as well at least for a short time after your death. Well what about cloud computing? How about Amazon cloud? They offer you a free cloud system as long as you stay below a certain usage each month. From my past usage of the system they charge you at the end of the month or in increments for usage of the cloud. So even if you are dead and your bill can’t be paid it does not matter cause after your bot detects your death it can now do whatever you want, such as create a bot net.

So the process would be this. Upon my death (if this application still exists) my bot running on the cloud will see my post that will give it my final command. It will then check several sites like ww.exploit-db.com for new vulnerabilities. It will then use key Google Dorks from what it found on exploit-db.com to build a list of vulnerable servers and to use the code found on that site to start attacking and infecting these hosts. Right now you are wait this is illegal! What do I care I am dead! Once the infection spreads to multiple hosts it does not matter if my cloud is shut down for nonpayment as my bot net has started.

Now that you have an idea where I am going with this train of thought think about other things you can do? You have a life time to prepare your master piece

Pictures and code for fbcbot.pl ” I am dead code will be posted shortly”

A little over a year ago Nettalk came on the scene as a competitor to Magic Jack. They were not only a competitor, but a neighbor having their corporate office located extremely close to Magic Jack’s office. Their claim to fame was you did not need to have your PC on to use their device to make calls.

Since day one there was a group of people that were dead set to find the coveted SIP Credentials that would allow them to bring their own device and not have to use the nettalk device. Magic Jack has successfully, for the most, part made this impossible for the users which drove more clients over to Net talk and other services.

Nettalk has not been so successful in blocking its users from obtaining their credentials; though until now it was only possible to obtain your own credentials.  A research from West Bengal India has discovered a way to do get everyone’s credentials and has released a tool to do it.

The researches name is not 100% known.  The aliases on the http://www.magicjacksupport.com forum are “vj224” and “Valavan Jabbar” is in the signature. Recently, the signature also contained the website: http://www.visva-bharati.ac.in/Rabindranath/Rabindranath.htm . It looks like the mods have edited the post as well to remove the tool and contact information. Looking at the pictures and the post: http://magicjacksupport.com/nettalk-sip-via-tftp-t10925.html It is quite easy to figure out how this person did this and how to reproduce this with a few lines of code.

The vulnerability is mostly from negligence and poor design. The researcher more than likely used a packet sniffing tool to discover vulnerability and then attempted an exploit manually.

Based on the post on the  Magic Jack Support forums and the screen shots I took: An attacker can download the configuration of any Nettalk user by knowing the MAC address of the device and the last 4 digits of the device serial number;  Using a simple brute force method you can quickly pull the configurations of multiple users in matter of hours, if not minutes. To speed up the attack you can find the manufacture of the Ethernet chip in the device and see what numbers they use for the start of the MAC to define that it is theirs. This will cut down the amount of possibilities you need to guess.  You could even run the code in The Cloud like several password cracking tools use today.

Write up of the Researcher’s findings: http://magicjacksupport.com/nettalk-sip-via-tftp-t10925.html

Screenshots and my personal logs with dates:

On 6/24/2011 I received a LinkedIn invite from a Thomas Hutton a Senior Engineer of nettalk. Since contacting Nettak, Thomas has altered his LinkedIn profile to hide all relations to Nettalk. Through the magic of Google cache here is his profile before edit. Below the before is the after edit.

Before Edit: (Click for larger view)

After Edit: (Click for larger view)

I accepted his invite and moments later I got the following message from him accusing me of releasing this vulnerability and tool, he then continues to slander me questioning my moral and ethics. Ethics and morals is something that separates the Information Security Professional from the malicious hacker.

I like for you all to reread the first line, second sentence. Yes you read it right Nettalk knew its client’s data was vulnerable and chose to ignore the vulnerability hoping no one else would find it.

I responded to these acquisitions with the following message:

This all took place around 8:30 am EST on 6/24/2011. It is now 5:00 PM EST on 6/24/2011 and I have not received and apology from him. I have contacted Nettalk customer service and I am awaiting a response from corporate to provide them this information. If they do not respond by close of business today I feel that is my duty to inform its clients about their blatant neglect for their client’s privacy and safety.

In the meantime nettalk should turn off the tftp server or setup a filter on their firewalls / IPS to look for multiple connections from the same IP for different configuration files.

06/25/2011 – Nettalk has not responded yet to my reach out attempts. Thomas has basically changed all his Linkedin information. [RECOMMENDATION] Clients of Nettalk should keep an eye on their phone bills and their personal information. Using the SIP credentials not only can an attacker place a call they can receive calls as well. This means they can impersonate you and gather additional information to use in other unethical ways.

If you are visiting my site from Nettalk please feel free to contact me via email. Provide your telephone number and position in that email and I will be more then glad to call you to discuss this.

A little over two years ago I met the girl of my life, not knowing at the time she would one day be my wife.

Social Engineering: The Ring

One day while out shopping she found the ring she would later on wear. The only issue I had was it was more then what I planned on. Though how could you say no to the one you love. I did not let her know at the time and continued to ask what she thought of other rings making sure her heart was definitely set on that one.
Then one evening as I was getting ready to leave work I called her letting her know I was going to stop at the store to get some water. She told me since I did not feel well that she would stop at the store for me and meet me at home. I figured this be the best opportunity to surprise her. Though I was super ill I ran to the store and bought the ring knowing that she would stop by there on the way to get the water to look at it like she normally did. I got to the store and purchased the ring to find that this is a one of a kind ring with no others available like it from that store. Nor did any other stores have one. I spent the last several months visiting jewelers showing them pictures of the ring and asking if they had one like it, all of them were amazed by the design. Once I heard this I knew she would call me tonight to let me know that the ring was gone. Like clockwork the call came through and you can hear the disappointment in her voice.

Phase 1 was completed she had no idea that I bought it for her or what was to come.

DNS Poisoning and ARP Spoofing: The Proposal

Before continuing to read, for those non technical people out there or in the event that the owner of Hip2Save ever reads this, NOTHING malicious was done to their site and all the below took place on my own personal network using our own personal equipment.

What is a better way to say I love you then poisoning the one’s you love DNS to send her to a false site that looks like the original site but has a personal deal, poem and directions. I decided to use the site www.hip2save.com. The site offers daily deals and she loves to visit the site and get free / discounted products, I know we will have to work on her giving away her info so freely. I used wget –m to download a mirrored copy of their site to my apache directory on my backtrack box and altered the page to look like the below image:

That was the easy part. The next part was carrying out the actual spoof and poisoning. Remember it is a race condition to see what DNS server answers first. So I cheated here and set my firewall to my malicious DNS server that I installed on my backtrack so I knew I would win. When I think about it, it would have been easier to setup my own zones for the sites I wanted to hijack, but where would the challenge be there. With that in place I used Dsniff’s arpspoof to take care of the arp s this did not take out my wireless switch like ettercap did. Then I used ettercap –T –q –P dns_spoof (after editing the etter.dns file of course). I also enabled IP forwarding so the packets could be forwarded out and I used my DNS server to handle all the non hijacked sites. The above took several days of testing and researching before I knew without a doubt that it would all work.

Exploitation: Popping the question

Several hours after she got home from work we were both sitting on the couches watching TV and surfing the net when she said “what is this” and started to cry (Happy tears). I was like what’s wrong as I got off the couch and approached her to see what she was talking about (already knowing).  I pulled the ring out and asked her to marry me while getting down on one knee.
She said: Yes and was extremely impressed with my idea for the proposal and even though she doesn’t know anything about hacking she asked that I explain to her how I did it.

To purchase this service click the buy it now button. In the comments put you’re State, City and Area code so we can give you a list of numbers available in your area. I there is no numbers available in your area (highly unlikely) we will refund you your money or find one closer to you. You can try the service for 90 days and if you don’t like it cancel it any time with in the first 90 days and you will be only charged for the minutes used, phone number, E911 and taxes.

Accounts can take up to 24 hours to setup and verify the buyer. You will need to fax a signed contract and TOS agreement back to us.

If you are a pen tester and want to do war dialing contact us for a special deal on using our service with warvox.

I figured it was about time that I showed what I have setup in my home for a phone system. This is only the start as new products come in and as budget allows we like to purchase new items to see how we can tie them into the system.

Our current wish list includes an IP based Door Phone / Bell. There are a few on the market but the price tags run from 150 to over 1,000 dollars.

Currently on our home phone system we are using our own VoIP service from our spin off company called VoIP My Way (http://www.voipmyway.com), which is fully up and running but we are currently working on pricing and a website. Our current thought process is to offer it like Magic Jack does with a mixture of what Whistle phone does. Basically for a low monthly fee you can have unlimited* calling to the US and Canada and basically won’t need any dongle. To help offset costs we are going to play a 15 to 20 second ad on all outbound calls. Ad free plans will be available as well.  At home we also use whistle phone as a backup trunk and for long calls to save costs.

We use to run a Magic Jack trunk on there as well but do to the recent changes we are still investigating how to get it to work again. For now it is disabled and the number forwards to our new number. Guess who will not be renewing with Magic Jack this coming year.

Our system currently runs on a Gateway Desktop computer that has 2 TB of space, 2 Gig of ram and a P4 3.8 processor, though the actual PBX runs in VMware Server on that desktop. The desktop also serves as our streaming media server, file server and general internet surfing. The VMware instance of our PBX is running PBX in a Flash, which is basically a modified version of CentOS, Asterisk and FreePBX compiled together into quick and easy to install PBX system. The VMware instance is configured with 20 gigabytes of hard drive space, 512 MB of memory and bridged networking. This setup currently supports anywhere from 1 caller up to 5 callers at any given time. Our biggest issue becomes bandwidth, depending what the kids are doing or I am downloading.

The PBX in a Flash and the firewall has been configured to work with NAT as described in our article located here: http://www.digitaloffensive.com/2010/05/overcoming-sip-over-nat/

For testing and daily use we have several types of phones tied into the system. The Cisco 7940 is automatically configured via a config file it pulls down from the TFTP server that runs on the PBX. The Android phone is a Motorola Droid X, it is running the newest version of SIPdroid that allows it use either 3G or WIFI to connect to the PBX to send and receive calls.  The laptop is running X-lite from Counter Path. On the laptop I also have my Bluetooth head set tied into it so I can talk as I work. Finally what I consider to be the cherry on top is the Linksys SIPura 2100. I spent a lot of time looking for a cheap way to tie my analog phones into my VoIP based PBX. Originally when I ran the PBX on its own hardware I was looking at purchasing a FXS card but for a good card with good call quality you were looking at over 100 + dollars.  That is what got me thinking about using an ATA to connect the phones to the VoIP PBX. After a few hours of eBay I got myself the Linksys SIPura for $10.00 and the rest of that story can be read in our upcoming article on how to configure the ATA to work on Asterisk. The ATA allows me to plug one line into my homes phone outlet to connect the phones in all the rooms. The other port we use for faxing.

As always if you have any questions or comments let us know.

Side note for the Magic Jack staff that I know visit the site, if you would just provide the SIP to us even if you charged 10 dollars more a year and no support for bring in your own device then we would not have to write these tools and you can make more money off of us.

Thanks

For the time being we are offering SIP retrieval once again. Though once we pull your information we will test it and once tested and confirmed working payment will be non returnable. So if they change this a week from now you can not ask for a refund.

For those that want to do it themselves my articles will still help you do this. If you find my article useful please visit a sponsor or two as they help to pay for my time and hosting fees.

Side note is reports also state that the username for some is ending in 02.

Good Luck

We have been able to rule out the following false information that is circulating on the net. From the dumps and the traffic we captured they are still using proxy01 and the user account is still E########01.

Until we can get a few test Jacks to test with we are temporarily removing the SIP retrieval service.

If you have a jack you want to donate please contact us as we work on this issue.

Looking for someone that has the time, motivation and ability to generate leads and write proposals to help grow our business. This is a commission based position and due to that there is no benefits being offered. All commissions will be based on the final contract amount and paid after successful completion and payment of the contract. At the current time we are not taking applications from recruiters. All applicants must be at least 18 years old to apply.

You must have:

1. Good writing skills
2. Speaking skills
3. Basic understanding of computers. Knowledge of Information Security is a pro.
4. Must be US based and a citizen
5. Must be willing to sign a NDA

If you are interested in this position please send your resume to us.

If you like your SIP info retrieved for you, we offer remote retrieval support for $10.00 per Magic Jack:

I have also corrected the download link for the mjproxy source code in my article: http://www.digitaloffensive.com/mjproxy.c.tar.gz

I have updated the WordPress code on the site as well as added WordPress Security scanner to detect malicious files and help to thwart any hack attempts. I have also added a share mod to this site so you can instantly post my posts to Facebook, Twitter, Digg and so on.
Till next time take care.

For those that know me each you I volunteer some of my time to help college students who are interested in Information Security put their knowledge to the test through the CCDC (Collegiate Cyber Defense Competition).

Each year I join other professional penetration testers and security guru’s to fill the role of the “Red Cell”. We become the guys that you learn fear for the next 12 to72 hours depending if it is the regional prelim or regional final CCDC event. We have one purpose and one purpose only to get in to the students fictitious company and cause them to lose points and business.

In the mean time the students are broken down by colleges. The student teams are referred to as the “Blue Cell” and each group has the exact same network that they are working with as well as the exact same business injects they must complete in order to gain points. The students take on the role of a newly hired IT firm as the company had just released all their IT staff for one reason or another and the CEO is demanding the business to continue as normal (Sounds familiar?)

At the end of each event since this is a learning experience for the kids we do a question and answer session to give these students the opportunity to ask us how it was done. What they can do better and so on and so forth.

Now for the first time ever you can see the full length CCDC documentary that was professionally filmed in HD at http://www.youtube.com/user/CyberWATCHcenter.

I make appearances and interviews in several of the videos.

To learn more about the CCDC check the following sites:

http://www.cyberwatchcenter.org/

http://www.nationalccdc.org/

Thanks

Michael