Category Archives: Byte

Technology as a way of life

27
Nov

A cookie authentication vulnerability for WordPress

Posted by | Categories Byte | Tagged

Securiteam reports of a vulnerability in WordPress’ cookie authentication. Through this vulnerability, an attacker can generate a valid login cookie for any user account without using a brute force attack (assuming that the attacker can gain at least read-only access to the WordPress database). When a cookie is generated, an attacker can perform limited SQL injection and be granted administrator access to that WordPress installation.

(Structured Query Language (SQL) injection is a technique used by hackers to execute destructive and admin-only SQL statements. Read more here.)

When a WordPress user (of any level) logs in, the WordPress system queries the database for the user name and password for authentication. If the credentials are OK, the system generates two cookies and save them in the user’s cookie cache. One of the cookies contain the user’s password encoded using double MD5 hash.

* Why save a cookie? A cookie allows a user to gain access to any WordPress administrative pages without signing in each time.
* MD5 is a cryptographic hash function used to protect passwords. When a new user registers with a WordPress-powered site, his password is encoded using MD5 and is saved in that form in the database.

Now, where is the problem? WordPress stores the password in the cookie in the MD5(MD5(password)) format. What does it mean? The password saved in the cookie is actually a password in the clear, which means that you can actually know what the password is using MD5!

What the hacker now needs is to gain access to a WordPress database. A hacker can do this by looking for a database backup that anyone can view, or looking for a WordPress installation that is vulnerable to SQL injection. When that happens, a hacker can gain administrative access.

Securiteam has listed several workarounds:

– Protect the WordPress database, and do not allow backups to be released.
– Keep your WordPress installation up to date. This should reduce the risk that your database will be compromised.
– Do not share passwords across different sites.
– If you suspect a database to be compromised, change all passwords to different ones. It is not adequate to change the passwords to the same ones, since WordPress does not “salt” the password database.
– Remove write permissions on the WordPress files for the system account that the webserver runs as. This will disable the theme editor, but make it more difficult to escalate WordPress administrator access into the capability to execute arbitrary code
– Configure the webserver to not execute files in any directory writable by the webserver system account (e.g. the upload directory).

27
Nov

Using Smart 3G: Port blocking is no more

Posted by | Categories Byte | Tagged ,

Mobility Philippines reports that Smart has started unblocking ports for its 3G service. I had checked that out and here’s what I found:

* I can now access my site’s cPanel, which means port blocking on HTTP is lifted.
* I can now chat via Internet Relay Chat, which means common IRC ports (starting at port 6666) are now open.
* I can now download via torrents. Port forwarding is now allowed over Smart 3G.

Note that there is nothing spectacular about torrent speeds over Smart 3G (at least on my end).

Now if only Smart implements HSDPA (and that would mean getting an HSDPA phone).

22
Nov

Rethinking the Asus eee PC

Posted by | Categories Byte | Tagged ,

An Asus eee PC is a tempting gadget. Its appeal is on its size and price. When it was announced, I was one of those who rejoiced, but the later price announcements were disappointing.

For example, an Asus 4G would cost around Php 16,999 at PC Corner, and the high-end Asus 8G is already pegged at Php 25,000. Here are the specs of an 8G (taken from Asus eee PC Web site):

Display: 7 in.
Processor: Intel 900 MHz
Disk capacity: 8 Gb
Memory: 1 Gb DDR2
Wi-Fi: Yes

And the Asus eee PC 16G, pegged at Php 29,999 has the following specs (speculation on the part of the retailer, as Asus has not made an official announcement):

Display: 10 in.
Processor: Intel 1.2 GHz
Disk capacity: 16 Gb
Memory: 1 Gb DDR2
Wi-Fi: Yes

I think it is ridiculously priced. Compare 16G with a cheap Acer Aspire 4310, priced at Php 29,700:

Display: 14.1 in.
Processor: Intel Celeron M 1.73 GHz
Disk capacity: 80 Gb
Memory: 512 MB DDR2
Wi-Fi: Yes

Asus eee PC wins in weight and size.

What stops me from getting an Asus eee PC? It’s a question of whether it will serve its purpose on my part.

* I am using Smart 3G for Internet connection at home, using Sony Ericsson P1i as modem. Now, SE’s PC Suite is Windows-only; the eee PC comes with Xandros Linux. While Windows XP can be installed, I will have to get an external DVD drive. Yes, DVD, because the Asus Rescue Disk is in DVD format. So, an external optical drive is additional expense, so add Php 4,000 to the total price. The price of the OS is not factored in yet.
* I can still use the phone as modem without the PC Suite, if I follow the steps here. I am not sure if the workaround will work, since Ubuntu and Debian-based Linux is needed.
* Storage is measly. That means I can install only a few applications. I intend to use it as home work computer, and let my brothers use the desktop PC at home.

So, as of now, I will not be getting an Asus eee PC. I have to think of my options first. Now, if only we have Black Fridays here…

21
Nov

LTO Web site hacked

Posted by | Categories Byte | Tagged , , ,

The Web site of the Land Transportation Office of the Philippines has been hacked. Here is a screen shot of the hacked site:

(Click on image to view full size.)

The page also displays YOUR IP address.

Based on the page, the defacement was done by a Turkish hacker.

(Thanks, Shari, for the tip!)

20
Nov

Random links of interest, 3

Posted by | Categories Byte | Tagged , , ,

Ok, links that might interest you:

* Pioneer is testing a new television service, wherein a user can download from any channel for a fee. The service will also be made available to yet-to-be-announced portable devices. Yeah, Pioneer is targeting cable providers and Apple.
* Well, what do you know? Asus eee PC is turning out to be a diamond in the rough (well, maybe not). If you have an Asus eee PC, you might want to install Mac OSX Leopard, for the sheer, geeky fun out of it. Now if only the price in the Philippines is not as ridiculous as it is now.
* Want free MP3s? Want to listen to relatively-unknown artists? Head over to RCRD LBL!

20
Nov

iPhone sending user data to Apple?

Posted by | Categories Byte | Tagged ,

Well, file this under who-tells-the-truth department.

9to5mac reports that Apple is tracking iPhone user data, as reported in a hackint0sh thread. The thread based the assumption on strings found in two apps, where there is a URL with an identifier named IMEI in the string.

But this assumption is immediately debunked by docpool, stating that it is the application ID that is being referenced by the string IMEI. It also linked to a German site, which claims that the application ID is being sent, not the IMEI.

Now, will security analysts stand up and clear this mess up?

20
Nov

PayPal intros Secure Card

Posted by | Categories Byte | Tagged ,

PayPal introduces another service that aims to solve several problems at one stroke.

Called Secure Card, it is a browser plugin that allows a PayPal user to pay for an item from a Web site that does not accept PayPal. It also helps in filling up payment forms. It also has anti-fraud features to warn users if they are browsing known fraudulent sites.

Probably the most important feature is the Secure Card. Secure Card allows PayPal users and potential PayPal users who don’t own a credit card to make orders online. Using the plugin, a random Mastercard credit card number will be generated, which can be used for that transaction. You will be also prompted by the plugin to Autofill forms at appropriate places, making the checkout experience faster than the usual.

The plugin works for Windows users with Internet Explorer or Firefox installed.

Here are some screenshots of the PayPal plugin at work.

After installation, this screen appears. The plugin icon appears at the address bar.

You are then prompted to select an image for security purposes, just like Yahoo’s anti-phishing mechanism. You can’t use your own photo, though.

You are asked for your PayPal login credentials.

Here is the drop-down menu when the plugin icon is clicked.

When the plugin detects that you are about to enter shipping details, it asks if you want the plugin to autofill the form.

15
Nov

Using Smart 3G: What you can and cannot do

Posted by | Categories Byte

Using your Smart 3G phone as modem, and Smart 3G for your internet access? Or about to use it? Here’s what to expect (or not to expect):

* The connection depends on 3G coverage. It also depends on whether you livein a bunker or an attic.
* Connection is also affected by the weather. Bad weather=sucky connection.
* It is faster than a dialup connection.
* You cannot download via torrents. Smart does not forward the port necessary for torrent clients.
* You cannot use Internet relay chat (IRC). Most IRC servers require IRC clients to respond to ident requests.
* Some ports via HTTP are blocked. This is significant for those who access their Web sites via a cPanel.
* You can do FTP.
* You can get/share files via P2P.

Will update this list when I get to find out new things.

13
Nov

Google: Onward, world domination!

Posted by | Categories Byte

I think Google really has a world domination plan hidden somewhere in its Googleplex.

First, The Guardian reports that Google and Pop Idol’s Simon Fuller are in secret talks. Now, no details are divulged, but conjectures are flying on the deal, like Google is about to take on TV broadcasters with original content shown on YouTube, with ads, of course. People watch TV shows online anyway, so I think this is a good idea for Google to invest in. Google to become a broadcaster? Well, if Google acquires a major TV network….

Second, to jumpstart the budding Google juggernaut called Android, Google has launched a US$10 million Android Developer Challenge. In time with the release of the Android SDK (which you can download here), the challenge calls for developers to build mobile apps based on Android. Google is hoping that when Android-powered phones roll out next year, there will be enough third-party mobile apps for users to choose from.

Hmm. I suggest antivirus vendors should begin developing solutions for Android. With such an open system, malware authors may want to target Android, specially when they can get money from such a venture. Symantec Security Response Weblog already has a cautionary look at Android’s security.

And lastly, and the most ambitious (if true). There is a rumor of Google acquiring Sprint. In a certain standpoint, this action makes sense, when you factor in Android and the Open Handset Alliance. Too bad Sprint is a CDMA telco. Just the same, if this rumor is true and it has come to fruition, isn’t that scary?

8
Nov

Web security service for PS3

Posted by | Categories Byte

Together with the release of firmware version 2.0 of PLAYSTATION 3 is a new Web security service by Trend Micro. Called Trend Micro Web Security for PS3, it is a URL filtering and Web reputation service designed to protect the PS3 user from malicious and inappropriate Web content. In a sense, the service serves as a gatekeeper, checking a Web site or URL and blocks those that it deems malicious or fraudulent.

And it’s free. Until April 30, 2008, that is. To activate the service, at the PS3 home, launch Internet Browser. Select Tools, then at Browser Security select “Start Trend Micro Web Security for PS3.”

While there is no malware threat that is specific for PS3, fraudulent sites are everywhere, and it pays to have some knowledge and a free security service.

For Trend Micro, this is a strategic move. In Japan, people are spending more on high-tech devices (like game consoles) than PCs, so there is already a market for their product. Too bad PS3 still lags behind the Nintendo Wii and Microsoft Xbox 360.

[Trend Micro Press Release]