#/blog

Someone else’s trash is another man’s treasure

Everyone in a company is responsible for company’s data security. A company can spend billions of dollars on all kinds of security equipment, but it only takes one person for company’s security to be compromised [1].

Among various techniques and methods used during Penetration Test sometimes we also do “Dumpster Diving”, which involves searching throughout the trash or garbage looking for something useful to gain access to the network or to get data that helps at next steps. Seemingly innocent information like organizational charts, calendar entries, or phone records can be used in a social engineering attack. (more…)

Wi-Fi security in Ljubljana

Here is a short story about access points (AP). We were wardriving through Ljubljana with a mission to analyze the security of Ljubljana’s Wi-Fi network. Our focus was collecting information about different authentication types in use. The goal was to capture a representative set of information about AP’s so that some assumption about security of Wi-Fi could be given. The only hardware we used was our Android mobile phone with the great Wigle Wifi Wardriving Android application. We already had a large database and we combined it with a smaller one that was obtained fresh from wardriving. The next step was to narrow down the area. Wigle Wifi app stores information about AP’s in a local SQL-lite database, so limiting the area was a piece of cake. (more…)

Security BSides Ljubljana Real-CTF

In the spirit of Security BSides Ljubljana 2015 there was CTF contest titled Real-CTF. Why choose such a title? Because it was designed like a virtual company with lots of vulnerabilities. Of course, the number and impact of vulnerabilities were enhanced so that the playground area was spread in X in Y axis of fun. Here is a short write up.

(more…)

Challenges for youngsters

Viris participated on event Challenges for youngsters, organized by SPIRIT Slovenija. There are series of workshops through whole year where youngsters are invited to solve business challenges for different types of companies. Youngsters have one week to solve concrete challenge and to present results. This workshops should also help prospective youngsters get jobs. More information at http://www.podjetniski-portal.si/o-podjetnistvu/izzivi-mladim or at https://www.facebook.com/
pages/Izzivi-mladim/752286194841442
.

Security BSides is Coming to Slovenia

Community of information security enthusiasts is organizing Security BSidesLjubljana conference, which will take place on 12 March 2015. The conference is organized in the spirit of other BSides and will include topics like hacking and cracking, protection, security and new technologies. BSidesLjubljana invites all authors that are willing to reveal old, new and still accurate topics, to submit their papers. Call for papers is open till 15 February 2015. More information at http://bsidesljubljana.si/cfp/.

Analysing Android Applications or just cheating in Games

The growing number of Android based devices, the simplified development process of Android applications and their wide spread usage is attracting potential attackers that are after financial gain. By analyzing the area of security issues addressing Android applications (APK’s ), we found out that there is no such thing as good tool to help with runtime analysis and we are too lazy to debug all the time. Therefore we developed a tool called Vaccine. Vaccine is used for dynamically analyzing APK’s. For detailed explanation continue reading. If you just want to use Vaccine visit link https://github.com/viris/android/tree/master/vaccine. Readme contains some additional information about how to use Vaccine.

(more…)

Using Fiddler

Fiddler is a proxy that can intercept all the HTTP(S) traffic that’s flowing between your client and the server you’re connected to. (more…)

MiniUPnPd Analysis and Exploitation

UPnP Summary

Universal Plug and Play (UPnP) is a network protocol that allows seamless discovery of network devices in order to communicate with each other. The UPnP daemons are enabled by default on various devices like routers, printers, smart TVs etc. UPnP daemon is listening on UDP port 1900 and can expose the SOAP interface to the client. The problem is that there are various vulnerabilities present in UPnP daemon executables as well as the libraries they use which the attacker can use to exploit the target.

(more…)

Teensy and Slovenian Keyboard Layout

Recently we have had a project and we had to simulate attacks with social engineering. One of the attacks was also visiting a company as an IT administrator, gaining access to the premises and inserting a Teensy USB HID into desktop computer running Windows 7 or Windows 8.

(more…)

Malware Surveillance in Slovenia: Science-Fiction or Reality

In the last couple of years malware has reached a widespread use not only in a widespread world, but also in Slovenia. This is not something that isn’t happening in our country, but is a reality. Let’s take a look at the first picture [1], which presents the countries targeted by the NetTraveler malware. We can see that most of the world is affected and Slovenia is also present on the map.

(more…)