Defencely USP for Major Finance Brokering Giants! Are you Ready!?

As part of our ongoing efforts to spread cyber security awareness, we’ve taken measures to go an extra mile & bring you rich blog posts about tales & adventures at Defencely Lab. We are going to explain & demonstrate how we chained up critical information to gain access to millions of customer accounts in order to safeguard our valued clientele pro-actively.

Majority of our clienttele are major finance brokering companies & we’d like to add that as the industry is grooming under leadership of real time markets, it’s critical to retain the value accordingly & an online heist would certainly impact as part of financial loss to the growing company.

We are intentionally excluding the names of the target to stick to confidentiality clause which we’ve signed up. At this point, our readers should be able to have an analogy of the steps which are taken & mentioned in this post to get the complete picture of what’s happening.

We have been assigned the same target several times for serious security threats, we have reported some SQL Injection’s and some more serious security threats but the vendor was still not satisfied. This was time to escalate this more and make it more serious.

We started enumerating the target. While the enumeration process was going on, we got hands on a HTTP Service running on a port `8080`.

This was not any white-box – Pentest, we were not having any test credentials to check out the application. We don’t want to miss anything out this time, so we checked if these login parameter’s were properly sanitized. I tried breaking the Query – No errors thrown.

We were sure that this is a Time based Blind SQL Injection. We made the application sleep(20) for 20 seconds. Not wasting much of our time thrown the same to SQLMap. Exploitation process was quite slow, even after increasing the threads.

The application was built under ASP.NET framework – most probably written in C# with DBMS used was MSSQL. If you have used SQLMap before, you already know there’s a flag used for gaining os-shell if requirements meets & depending on the DBMS detected.

We gave this a try – this flag in SQLMap checked if the xp_cmdshell is enabled on the target system and luckily our target was having that enabled. SQLMap promoted us with this screen:

We were happy that we gained a not-a-proper shell but at least have command execution in there this time ..

As this is a Windows System .. i executed the some commands to make sure everything is working fine .. but the problem was no standard output was thrown our side. So were not able verify if everything is working that side and the commands are actually getting executed.

To make sure if the commands are getting executed i started capturing the ICMP packets on my side and tried pinging from the target system.

 

Pinging our system from the target

Capturing the ICMP packets on our side:

We received several requests from a specific IP. Including an Web Address on the headers.

We opened up the website and it was of an ISP. Our target was at the TOP of their client list.

Now it was time to get a proper shell on the target. We were not sure if powershell was present there on the target. Simply typed powershell.exe on the os-shell prompt and it was a long delay and did a exit from the prompt. What we did is, created a file name ‘def.txt’ on our local and started the inbuilt Python HTTP Server and tried downloading the file on the target’s machine using powershell ..

We can see, it actually tried downloading the file from our created HTTP Server ..

Tried downloading netcat on the target machine to initiate a connection between both the target and my system. But there was some kind of firewall dropping my netcat connection every time i connect to the target ..

But a simple MSF reverse TCP did the work ..

That’s all we have for now. Let’s look forward to more amazement at Defencely Red Team Operations Labs next week for absolutely yet another amazing uncover story of how we’re adding value to our customerbase with insider threat program as well as routine sound-ful & an offensive Vulnerability Assessment followed by a Penetration Test for critical applications both at the staging level & production bases. Our manual security assessments methods have proved the best value. Feel free to touchbase at shritam@defencely.com, Shritam Bhowmick, Red Team Lead @Defencely for any Security Operations Related queries or say “Hi” to us at hi@defencely.com for inquiries.

We should see you again next week with another operational tale of the broad security premises where 0days are always a possibility & at proximity of a security compliance issue which always will be a sooner or later decision by the Indian E-Commerce Management & stakeholders.

Let’s act pro-actively.

 

How Chaining Of Attack Vectors Gave Defencely an Upper Hand in Pentests!?

Howdy,

Today as part of our ongoing efforts to spread cyber security awareness, we’ve taken measures to go an extra mile & bring you rich blog posts about tales & adventures at Defencely Lab. We are going to explain & demonstrate how we chained up critical information to gain access to millions of customer accounts in order to safeguard our valued clientele pro-actively.

We are intentionally excluding the names of the target to stick to confidentiality clause which we’ve signed up. At this point, our readers should be able to have an analogy of the steps which are taken & mentioned in this post to get the complete picture of what’s happening.

CONTENTS

  1. Understanding the workflow of the Application.
  2. Technical Understanding.
  3. Chaining up and Exploiting the vulnerability on the basis of Collected information.

WORKFLOW

Our target had an Android Application as well as a Web Application giving ourselves a wide scope to start enumerating and having a general idea of how their applications were working at the back-end, we look our own research time to be spend wisely before we actually started to hit the targets.

Working of the Web Application: This web application allows anyone to Sign Up for their services hosted on a particular sub-domain say example.target.com. And once you’re signed up as a normal user with the company you can upload your details and information related to you on the account to set it up according to the services offered.

Working of the Android Application: This Android Application is of their Partners Portal. The Android Application was more interesting as this Application doesn’t allows everyone to sign up as a Partner, You need to verify yourself as a legitimate person having skills on the works they offer & submitting documents related to the work they are offering. We reverse engineered the APK file & The only thing which were similar between the Web App & the Android App was both their APIs which were connecting to the same domain but having different endpoints.

So, this was going really interesting as we do not have access to any of their test credentials for the Partner’s Android App to test their API endpoints. We were only left with the reverse engineered files & codes on the desk. Now we have a basic idea about how things were working, let us jump into the technical understanding of the application and lets understand how we escalated this from having nothing to compromising millions of their accounts registered with the company.

TECHNICAL UNDERSTANDING 

If you want to register yourself as a Partner you need to call them on a given number on the website to their 24 * 7 available customer support and can provide details they needed to verify yourself as a legitimate partner.

So, what would you have done if you were at the same scenario we were? It’s obvious. We called them up & social engineered them to make them believe that we want to sign up as a partner and provided some legit looking details which were actually dummy details created at our end. The verification process was over, everything went fine. But they informed us that they will take couple of days to provide us the credentials to partner portal. We know we have deadlines, 2-3 days was a long time and we can’t afford wasting time on just registering a account on their partner’s portal.

If you remember we already have reversed engineered the APK file. So we went that way. We started looking into the huge source codes available.

We were looking through the directory structures and found some susceptible files where we can now at least concentrate into.

Above are the files we were specifically looking into. We started reading the codes of the ISignIn.java  file. And within a couple of minutes we found something really interesting which took our attention and made everything clear about the Login mechanisms they were using and how they were Saving passwords to the databases at the back-end.

Lets look at the code and understand the mechanism.

Vulnerable Code which could allow us to take over Partner Accounts: 

@FormUrlEncoded
@POST("/ppapp/savepassword")
void getSavePassword(@Field("mobile") String str, @Field("password") String str2, @Field("confirmPassword") String str3, Callback<OTPModel> callback);

This particular function took our attention which were sending some form-collected data into the POST parameters to the endpoint /ppapp/savepassword. I was pretty sure the developers were using this function to set new passwords for the users.

But here the question arises. How we are going to exploit this vulnerability? If we look into the function, we can see the function getSavePassword takes three functions parameters in.

getSavePassword(@Field("mobile") String str, @Field("password") String str2, @Field("confirmPassword")

  1. `mobile` parameter
  2. `password` parameter
  3. `confirmPassword` parameter

We need to full fill the need of supplying three parameters to the function to make the request happen. You might have noticed they are changing the password of users putting mobile phone number as their uniquely identified kind a`key`.

The first priority here is we need to have a mobile number already registered with the company. And to full fill the need we started enumerating other files which might throw us some more details regarding users already registered.

While enumerating other files, we found another endpoint which seems to be related with the customer profile details or vice versa.

We started searching where and how this endpoint @GET("/getprofilejson") is working by looking at the source codes left with us.

We found that the endpoint @GET("/getprofilejson") is working with two HTTP GET parameters.

  1. `uri`
  2. `consumerId`

Enumerating the source codes more and more gave us the values which were fitting into these two parameters. The `uri` parameter is taking a `location` which in my case was %2Feast%2Fassam%2Fbongaigaon%2F and `consumerId` was of 6 digit integer value, so i just passed a random 6 digit integer value ‘123456’ But nothing happened.

I wrote a python script to bruteforce the `consumerId`.

The API endpoint was throwing data’s at ‘391149’ which holds a token value for ‘example_profile_id’ and meant to be supplied as HTTP POST  parameter on the endpoint @GET("/getprofilejson") as "example_profile_id=82f088332d0611e484950e2f866a9102" to get hold on the registered customer profile details.

Our goals are achieved. Now we have a registered customer’s phone number. It’s time to code a exploit and make it happen. Lets jump into the last section of exploitation.

 

EXPLOITING THE VULNERABILITY

A coded up exploit to account take over.

Response:

We finally coded a mass account take over exploit where the script grabs user’s phone number bruteforcing the `consumerId` and passing the token value retrieved from the response to get phone numbers of the users and finally the invoking the  @POST("/ppapp/savepassword") endpoint to directly changing the password.

 

That’s all we have for now. Let’s look forward to more amazement at Defencely Red Team Operations Labs next week for absolutely yet another amazing uncover story of how we’re adding value to our customerbase with insider threat program as well as routine sound-ful & an offensive Vulnerability Assessment followed by a Penetration Test for critical applications both at the staging level & production bases. Our manual security assessments methods have proved the best value. Feel free to touchbase at shritam@defencely.com, Shritam Bhowmick, Red Team Lead @Defencely for any Security Operations Related queries or say “Hi” to us at hi@defencely.com for inquiries.

We should see you again next week with another operational tale of the broad security premises where 0days are always a possibility & at proximity of a security compliance issue which always will be a sooner or later decision by the Indian E-Commerce Management & stakeholders.

Let’s act pro-actively.

The Scary Truth About PayPal Security

paypal-security-threats

Fort Knox or Facade?

PayPal – with billions of dollars in online and real-life goods and services being bought through it every day, one might easily believe that this company has a veritable fortress of security protocols in place to protect its customers’ financial information.

And while it’s true that PayPal does take security seriously, the fact is that no company is immune from every potential threat or exploit.

Hackers go out of their way to plant false cookies, send spoofed emails, and install “sniffers” in the background that actively look for security holes to exploit

Potential threats can seem endless.

Beyond the common types of hacks, PayPal also has to watch out for 0 day vulnerabilities which can manifest quickly and spread like wildfire before a patch is created or released.

For PayPal to Be Secure, Its Users Need to Be Secure

Even if PayPal’s own infrastructure is secure, they can’t always count on their users being as savvy.

“PEBKAC Error: Problem Exists Between Keyboard and Chair”

Many of us know someone – a relative or a friend perhaps – who received an honest-looking PayPal email telling them their account had been hacked, their password had been changed, or they had purchased something they know they didn’t buy.

Of course, when faced with this kind of message, many people instinctively insist “That wasn’t me!” and login to a near-perfectly crafted PayPal.com replica, divulging their username and password which are promptly shuttled into the eager hands of hackers and then sold to the underbelly of the digital black market.

Not surprisingly, these opportunists take no prisoners, draining bank accounts, making mass-purchases on credit cards and debit cards, and leaving the bewildered victim picking up the pieces of their shattered financial lives.

PayPal does its part to remind consumers about not clicking on any emails from unrecognized links or senders, and to check their address bar for the common “https://” that denotes a secure site, but no method is 100% foolproof, especially when dealing with less tech-savvy users who choose guessable passwords like “love” and “123”.

The Defencely Difference

Defencely was recently honored on PayPal’s Wall of Fame for bringing a security issue to their attention that PayPal’s own engineers had failed to spot.  The Wall of Fame is an honor that few online security firms can claim – another testament which supports Defencely’s mission to make the web a safer place for everyone.

Not surprisingly, hackers are always trying to stay one step ahead of the antivirus, spyware and penetration testing companies.  But companies like Defencely are starting to beat them at their own game, putting up formidable digital walls that even the most sophisticated ‘script kiddies’ can’t break through.  Like modern-day burglars, hackers are only interested in easy access by any means possible.

And while PayPal must always stay active and prepared for new threats, it’s nice to know that there are companies like Defencely who are working alongside them, bringing new vulnerabilities to light and helping to squash exploits before they get a stranglehold on the server.

[maxbutton id=”1″]

Defencely Recognized by PayPal for its Security Expertise

11

What a way to cap off a week. Defencely along with it’s web application security services have yet again been onto recent acknowledgement pages on biggest giants of the web world. To start off with the posts, here’s to what Defencely provides:

  1. An antique set of quality security service.
  2. State of art Vulnerability Assessment and Penetration Tests.
  3. Quick code review with Code Auditing Servcies.
  4. Network Security Engagements.
  5. Mobile Application Security Engagements.
  6. Quality Reporting as Deliverables.

Benefits of Defencely services would fall short for this post. Before starting off, It’s a precise formula for every company in the information security market to have expertise set of skilled developers, researchers, and home-grown enterprenuers; Defencely as it’s proved now hasn’t fallen short of in any yet and would continue providing best security 360 degree cyber suite as professional services to MEGA corporate business and ensure Busness stays at safe hands with a complete security package at unbeatable price ranges. Quality Assurance, and benefeciaries matter for these big giants and they could not keep their eyes moving fast enough when ‘Defencely’ security experts lay their hands on the keyboard and start considering ‘security’ as their primary business of the day.

Within a short 1-year commencement under expertise umbrella, Defencely had hand picked security researchers, trained them into their concerned portfolios and hence have been looking forward to create a history in India with it’s efforts to change the face of industrial information security war, as it’s played by the con and defended by the Defencely Standards. This post is regarding one of the many achievements Defencely is proud to share with the world wide web and the followers. The excerpt goes as mentioned below:

Earlier this week we were recognized by AT&T on their Security Acknowledgements page, and now we’ve received the same from PayPal.

PayPal has recognized Defencely on its 2013 Big Bounty Wall of Fame, for our security work helping them keep their service as one of the safest ways to pay online.

PayPal oversees millions of transactions per day, so online security is of utmost importance to the successful running of its business.

We’re only happy to help businesses like PayPal stay secure, while making a positive influence on the online security community.

“Security success is the sum of small efforts, day in, day out.”  That’s the motto we live by here at Defencely..

[maxbutton id=”1″]