A package from Lithuania arrived today that may be interesting for the Infosec Community at large. Arsenijs has finally implemented a theoretical approach to program SD Cards to be temporarily or 
permanently protected from write operations.  Having reliable read-only media can be very usefully in many situations - ranging from offensive to defensive. Implants will no longer suffer from premature SD Card failures, tools like CIRClean can get an additional layer of  tamper-resistance  and forensic operations become cost-effective.

Picture of the SD Card Locker

History

This device was developed by Karl Lunt back in 2013, then improved by Nephiel in 2014. Arsentijs recently discovered it was never sold or mass-manufactured. 

New in version 2

• Redesigned the laser-cut case to be thinner, making the "laser-cut case" locker version less bulky. It's also now transparent, except for the middle layer which is transparent orange.
• Added usage instructions on the bottom of the PCB. 
• Added a MicroSD slot on the bottom - it allows you to plug a MicroSD card in directly, without using any adapters. 
• Reinforced the MicroUSB port soldering 

Common Use cases :

• Make read-only Raspberry Pi SD cards
• Make virus-resistant LiveCDs (or, rather, LiveSDs) for all your computer maintenance needs
• Distribute SD cards with promotional materials
• Forensic research and data recovery (reading from the SD card while preventing all write operations)
• Test your SD-card-powered products for unexpected behavior (an SD card becoming read-only is a popular failure mode and tends to happen when the card controller detects severe data corruption).

Feature Set of the SD Card Locker

How does it work?

Larger SD cards have a mechanical "write protect" slide switch on the side. However, that switch is useless :

1. not all readers support it 
2. the OS can choose to ignore it 
3. it's not available on  MicroSD cards 
4. the switch tends to slide accidentally (or fall out of the SD card altogether) when you have no intention of enabling write protection.

The controller chips inside the SD cards (of all sizes, whether full-size or MicroSD) are required by the SD card standard to support a low-level command that locks the card into a read-only mode, preventing any changes - either temporarily (can be switched back to read-write) or even permanently (without a way to ever restore the write capability).

How to order ? 

You can order it from Tindie for only 12USD

Hints

• Look into zRAM (Virtual Swap Compressed in RAM,) to move your swap into RAM Memory, this way you can still swap effectively and even use RAM more efficiently.
• Use fstab to create directories (Like /etc/log) that only exist in RAM

TLS/SSL Audit 09 release
Getting my hands on code again feels good. I updated TLS/SSL Audit to version 0.9. I improved the custom rudimentary core TLS engine, it remains independent of any open-source or commercial TLS Stack (like openssl) and hence allows it to support any cipher-suite or protocol.

Changes

• Added CHACHA20 ciphersuites and modes [RFC7905]
• Updated a range of TLS1.2 ECDHE and PSK ciphersuites
• Updated the documentation
  
  Download

TLS/SSL Audit 0.9

• Download

I uploaded a new version of "Harden SSL/TLS"

Changes

• Added Windows 8 support
• Added Windows Server 2012 support
• Resolved an issue around P521 additions

About Harden SSL/TLS 

Harden SSL/TLS” allows to configure and harden the SSL/TLS settings of Windows System, ranging from Windows XP to Windows 8 and from Windows 2003 to Windows Server 2012.

Harden TLS allows to remotely set SSL policies allowing or denying certain ciphers/hashes or complete ciphersuites.

The foundation of this tool was the investigation and reverse engineering of the ciphers provided by the various SCHANNEL versions by G-SEC and presented in the paper “SSL/TLS Compatibility Report”.

This tool specific allows setting policies with regards to what ciphers and protocols are available to applications that use SCHANNEL crypto interface. A lot of windows applications do use this interface, for instance Internet Explorer and Apple Safari are a few of these.

Read more »

I have updated my little TLS/SSL Scanner called "SSL Audit" to version 0.8. I tweaked it slightly but the tool is still based on it's own rudimentary SSL Engine and hence is not limited by the number of ciphersuites and protocols available to OpenSSL or NSS.

By the way I am still a little bit proud of the SSL Stack fingerprinting feature. I haven't updated it recently but it still seems to work out nicely. Try it out and let me know, especially if you have access to less known ssl stacks.

Changes

• Added support for TLS 1.2 CAMELIA ciphersuites;
• Speed up SSLv2 enumeration;
• Added the complete range of ARIA ciphersuites (http://tools.ietf.org/html/draft-nsri-tls-aria-00)

SSL Audit v.08

Download

You can download the tool here | VT scan

I updated BTCrack Open Source Edition (BTCrack OSS) to version 1.01 by patching 2 bugs that were reported by Michael Ossmann and Carl Dunhamm.

Description

The  primary goal of BTcrack is to crack/recover the PIN and reconstruct the link-key from a previously captured Bluetooth pairing exchange. Together with Eric Sesterhen I released an open-source version of BTcrack in 2006 which since then is part of the tools included in Backtrack. You will find more information on BTCrack  and a POC video here.

Read more »

Preamble :

During my research on TLS/SSL Compatibility across different Operation Systems and Browsers I created supporting tools for myself and later decided to release them for the public.

"SSL Audit" remotely scans web servers for SSL support - unlike other tools it is not limited to ciphers supported by underlying SSL engines such as "OpenSSL" or "NSS" but can detect cipher suites based on it's own (simplistic) SSL/TLS engine. As a gimmick it features an innovative Fingerprinting engine that is based on behavioral heuristics.

Read more »

Subscribe to the RSS feed in case you are interested in updates

Copied from the post over at G-SEC:
At last. What started as an "I need an overview of best practise in SSL/TLS configuration" type of idea, ended in a 3 month code, reverse engineer and writing effort. I really hope this comes in handy for you and was worth the effort. This is the "Release candidate" version of the paper, should no errors be found it will be the final version.

This paper aims at answering the following questions :

• What SSL/TLS configuration is state of the art and considered secure (enough) for the next years?
• What SSL/TLS ciphers do modern browsers support ?
• What SSL/TLS settings do server and common SSL providers support ? 
• What are the cipher suites offering most compatibility and security ?
• Should we really disable SSLv2 ? What about legacy browsers ?
• How long does RSA still stand a chance ?
• What are the recommended hashes,ciphers for the next years to come

The paper includes two tools :

• SSL Audit (alpha) :  SSL scanner scanning remote hosts for SSL/TLS support (Video)
• Harden SSL/TLS (beta) : Windows server and client SSL/TLS hardening tool (Video)

Without further ado here is the complete package

PS: In order to know whether this type of publication is useful to some and whether I should spend time on such publications in the future, I would appreciate a heads-up if you find this to be interesting. Thierry

Subscribe to the RSS feed in case you are interested in updates

Developed as part of G-SEC's investigation into the "Secure SSL/TLS configuration Report 2010" (to be published) we developed this little tool called SSL Audit. (More to follow in the next days - stay tuned).

SSL Audit scans web servers for SSL support, unlike other tools it is not limited to ciphers supported by SSL engines such as OpenSSL or NSS and can detect all known cipher suites over all SSL and TLS versions.

Apart from scanning available ciphersuites it has an interesting tidbit : The Fingerprint mode (Experimental). Included is an experimental fingerprint engine that tries to determine the SSL Engine used server side. It does so by sending normal and malformed SSL packets that can be interpreted in different ways.

SSL Audit is able to fingerprint :

· IIS7.5 (Schannel)

· IIS7.0 (Schannel)

· IIS 6.0 (Schannel)

· Apache (Openssl)

· Apache (NSS)

· Certicom

· RSA BSAFE

Download available on the product page

Subscribe to the RSS feed in case you are interested in updates

http://blog.g-sec.lu/2009/07/new-advances-in-officeexcelpowerpoint.html

Dear Anti virus vendors,
Your clients are getting compromised this very minute, instead of spending your time to please gamers (??) how about you spend 0,001% of your budget to implement generic methods of detection, especially for gateways.

Usb write blocker is a small tool I created yesterday, it sets the registry keys to block write requests to USB devices. Comes usefull in several cases, in my case an unamed AV Software insisted on deleting my fuzz samples. Requires .NET 2.0 Framework.

Download USB Write Blocker

The respective registry key and value is :

Rootkey : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
Subkey : StorageDevicePolicies
Key : Writeprotect (Boolean)

If your into Network captures and forensics you really should take a look at the FREE version of Netwitness (released today) - Give it a try, it is versatile enough that it should give you benefits over wireshark also for pentests.

Video below :



http://download.netwitness.com/download.php?src=DIRECT

Https connections are often used to transfer important data, such as passwords, PINs, or credit card numbers. The browser ensures that the sender can be identified with a valid certificate and that the transferred data are encrypted. An error in the Debian Linux distribution has generated numerous certificates that are child's play to crack. Many servers still use these weak certificates, even though it is impossible to establish a secure connection using them. The heise SSL Guardian checks the SSL certificates and warns you when it detects a weak one.

Download :
http://www.heise-online.co.uk/security/Heise-SSL-Guardian--/features/111039/

Sensepost released their JSP/PHP/ASP pivot/covert channel named reDuh :

Basic concept :

• Glenn has the ability to upload / create a JSP page on the remote server
• Glenn wishes to make an RDP connection to the server term-serv.victim.com (visible to the web-server behind the firewall)
• The firewall permits HTTP traffic to the webserver but denies everything else

http://www.sensepost.com/research/reDuh/

Skape released whentrust as opensource :
http://www.codeplex.com/wehntrust

Thanks skape and good luck at MS

PS. Don't underestimate Whentrust, even with Windows2003 and Hardware NX it still increases protection (nx pages)

There are quite a few sql injection tools around, Pangolin is one of the most sophisticated blind SQL injetion tool I have come across, you can find it here :Pangolin Enjoy

For those into RCE, you surely came across Themida and know it can be a bitch.
Here is the PEB hooking loader from ARteam :

1. you will need to build fake_kernel32.dll and fake_advapi32.dllsolutions, and 2 dlls will be created in ..\..\fake\ folder.
2. in ..\..\fake\ folder you have adjust_fake.exe which you MUST use onnewly created dlls to get valid import table for kernel32/advapid32.dll
3. rebuild themida loader project, as fake_kernel32.dll and fake_advapi32.dllare stored in resources of themidaloader.exe
   

Another nice ARTeam release : http://arteam.accessroot.com/releases.html

Addendum :in other news ARTeam is hooking Services .exe To Hide Softice

Here is the white paper and the slides to Mark Dowd & Alexander Sotirov Talk "How to Impress Girls with Browser Memory Protection Bypasses" - a must read :

Especially the whitepaper has some interesting details.

Whitepaper :
http://taossa.com/archive/bh08sotirovdowd.pdf

Slides :
http://taossa.com/archive/bh08sotirovdowdslides.pdf

Here are the slides and the code from the Blackhat USRP talk :
http://ossmann.com/bh-usa-08/

I started using this tool last year ago during internal tests, it was immediately obvious to me that this is a great tool to have. It's name is Satori, if you never heard about it that's not a proof the tool is no good but rather that it's Author Eric Collman does not really seem to care if you do (or at least doesn't scream it from the top of every house)
I found out about Satori while reading the paper "Chatter on the Wire" (from the same author) which goes into great length about passive OS fingerprinting and it's potential for improvement as done by several other tools.

What is interesting is that the paper was not only theoretical but rather practical, it's outcome was Satori, a beautiful plug-in based Passive enumeration and Fingerprinting tool.
Satori uses Winpcap and captures packets passively at the NDIS level, every packet flying by is being scrutinised for information that might determine it's OS. Nothing new here you might say, well Satori does the fingerprinting on :DHCP, BOOTP, ICMP, TCP, CDP, EIGRP, HPSP , HSRP, HTTP, ICMP, IPX, SMB, SNMP, STP, UPNP precisely enough to either correlate the results with nmap or to rely on them. It makes spotting potential vulnerable systems a breeze.
It's obviously very handy for critical networks where you are not allowed to scan or to scan only a minimum. (This does exists.)



It shows it's strength when used in internal networks, I was able to spot machines that didn't belong in a certain critical network immediately (as they broadcasted their Netbios presence) by only using passive means. It's also very usefull when doing quick scans (nmap port 80 as example) across an internal network, it gathers all packets, makes a list of all responding machines, fingerprints them and gives you an exportable list. Very handy.. and speedy, I was able to pump 8000 packets per second thorough without any lags or problems.
Nice tool to have in your toolbox. Send it's author your support :)