Skip to main content

Posts

Showing posts from 2014

ShellShock Basics - Updated Oct 1st

Update 2 - October 1st: As expected still lots going on;

As the mainstream media attempts to make sense of all the hype surrounding the latest security vulnerability, IT support staff are left to try to make sense of it all and determine what if anything needs to be done.

Background: Bash (aka Bourne-again Shell) is used as an interactive shell on most Unix-like operating systems.  It comes by default on many popular distributions such as Ubuntu, OSX, and other Linux platforms.

The bug:  One feature of the shell is to allow a user to set environment variables, unfortunately the bash shell does a poor job of interpreting these values and if the right sequence of characters is used, extra commands can be executed.
Apparently introduced in the 1980'sInitial NVD CVE - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271Followup NVD CVE (incomplete patch) - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169
Exploitation:  By simply injecting extra code that will get pa…

Testing the CVE2014-0160 HeartBleed Attack - Part I

This is part one of a multi-part series associated with the HeartBleed vulnerability.  This part deals with getting your environment setup with a vulnerable SSL webserver (using Kali Linux), and the client software used to test for and exploit it.

Setup the vulnerable web server.

Kali Linux already has apache installed, so simply enable the SSL mod, create a directory to hold the key material, generate the private key and ssl cert, and restart the server to

sudo a2enmod ssl
sudo mkdir /etc/apache2/ssl
cd /etc/apache2/ssl
sudo openssl req -x509 -nodes - days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/webserver.key -out /etc/apache2/ssl/webserver.crt
Then you'll need to edit the ssl site configuration to enable it for your ip address (not the one below).

vi /etc/apache2/sites-available/default-ssl Add the information for your server.

ServerName 192.168.4.134:443
and change the following lines to use the newly generated key material:

SSLCertificateFile /etc/apache2/ssl/webserver.cr…

Edmonton HeartBleed Information Session - April 16th, Royal Glenora Club

Since the latest major OpenSSL vulnerability was publicly disclosed, many people and organizations are scrambling to understand, respond and prepare themselves for the future.  Twitter, vendor support channels and media outlets have been quick to cover different angles of the issue but there has been overwhelming amount  of information released.
With all this information, it can be difficult to understand what's relevant.  To help clarify we holding a special ISACA sponsored 2-hour session on Wednesday, April 16th, starting at 12:00pm at the Royal Glenora Club.  
Benoit and I will be attempting to explain as much of the issue as we can from a technical and non-technical perspective, discussing the vulnerability, its scope with relation to our personal and professional lives and other related concerns such as our trust in the public PKI system.  The second hour we will be an interactive discussion about how others are dealing with problem, questions about related topics, and peer disc…