Blog - CyDefe: Recent Episodes
CYDEFE Cyber Security Team
CYDEFE CYCast is a network security podcast that breaks down network security and cyber security news to help everyday users.
On this episode we discuss Drovorub, Blue Team Con, a Snapdragon chip flaw, and some more conspiracy theories.
On this episode we discuss mental health, eavesdropping on people using their light bulbs, ripple20, and some conspiracy theories.
Hashing has become a critical part of the information security landscape, from adding an extra layer of security when you store data, to verifying the integrity of files. This lab will test your ability to both generate and decode hashes. The hashing algorithms used in these labs are utilized every day in corporate environments. By knowing how to generate hashes users can ensure and verify data integrity. Being able to crack hashes gives an auditor the ability to validate the strength of passwords generated by their users
You can find this awesome CyDefe Labs assessment through Cybrary. Check it out at https://www.cybrary.it/catalog/assessment/hashing-assessment/
Want to check out all of the amazing content we have to offer on CyDefe labs? Go to https://www.cybrary.it/catalog/ and search for CyDefe. Once you choose one of our sets of challenges you will be redirected into our platform.
What categories do our challenges cover?
SOC (Junior)
SOC (Entry)
SOC (Senior)
CTF
Pentest
Attacks 101
ATT&CK Matrix
Basic Network Devices
Basic Network Protocols
Cable basics
Cryptography
Encryption basics
Incident Response
Linux Basics
Linux System Admin Basics
Memory Analysis Basics
Network Types
OSI Model
OSINT
Packet Analysis
Packet Analysis Basics
Password Hashes
Recon
Registry Analysis
Reverse Engineering
Steganography
TCP/IP basics
Vulnerability Scan
Windows Basics
ICS Packet Analysis
There has been a lot of changes lately with CyDefe Labs. We are currently partnered with Cybrary and are providing assessments for their courses. If you are interested in trying out our challenges visit the Cybrary market place to try out our content.
It's been a crazy past month for CyDefe Labs. We have almost 600 players now, tons of new challenges, and some awesome partnerships we are working on. Partnerships such as working with the Midwest Cyber Center as well as Dragos Inc. We also have great content on the way for all of our players and we cant wait to show it off. If you like the content we have produced so far you are going to really enjoy what is coming down the pipeline.
What do we have in store for our amazing players? We have more reverse engineering challenges, brand new ICS related challenges, and a live environment with network traffic to analyze and windows boxes to exploit. The live environment will be hosted by the Midwest Cyber Center, and the ICS related content will be provided by Dragos Inc. A big thank you to both of those partners for their contributions to our platform.
We will also be pumping out more tool usage tutorial on our CyDefe blog so keep and eye for them as well. A few of those tutorials just may help you solve a handful of our challenges, and some of them will be general good to know tools. Either way you will learn something new.
If you are interested in submitting content we would love to have it. Players can submit blog posts, or challenges for our players. If you do submit content you will be listed as a content creator and we will highlight your awesome contributions to our free infosec training platform.
If you want to help keep CyDefe labs running please either donate to our Patreon at https://www.patreon.com/CyDefe or buy some swag at https://www.cafepress.com/cydefe
As always a big thank you to all our players, keep checking back every week for our new content., and happy hacking everyone.
The hacker methodology is comprised of a few different phases. They are recon (both active and passive), gaining access (aka exploitation), Escalation of privilege, maintaining access, and covering tracks. Over the next few weeks I will be covering basics for each of these phases and a few tools for accomplishing these phases.
The recon phase of an assessment can be broken down into two parts. The passive recon phase (often called OSINT[Open Source Intel]) and the active recon phase (often called scanning and enumeration). For this article I will be discussing the passive recon, it’s benefits, and some techniques for performing passive recon.
The biggest benefit that can be gained from passive recon is gaining a better understanding of the environment that you will be assessing. For that a few tools that can be used are nslookup, dig, whois, dnsdumpster, and google dorks. These tools will help you paint a picture of the environment, users in that environment, and potential targets for your assessment. These are only a few of the tools that can be used. There are many many more available and I will be writing more guides over the coming weeks.
Some of the first tools I would use to gain information are nslookup and dig, which are two command line based tools that can be found in linux nativley. You can utilize both nslookup and dig in windows as well however you will have to install dig. These tools allow you to check records for a domain like A, MX, TXT, PTR and other advanced DNS records. An example of how these tools would be used is
$ dig google.com ; <<>> DiG 9.10.3 <<>> google.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4373 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;google.com. IN A ;; ANSWER SECTION: google.com. 81 IN A 172.217.9.14 ;; Query time: 12 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Fri Feb 02 09:00:36 CST 2018 ;; MSG SIZE rcvd: 55and $ nslookup google.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: google.com Address: 172.217.14.174
As you can see from this we gain important IP information about our target. This gives us a starting point for further information gathering in the passive phase and targets for our active phase.
The next tool I would utilize is whois. Whois is a web based tool, however there is a cmd line version you can use as well. This tool will give you information such as the domain name, what registrar was used to register the domain, when it was registered, when the registration expires, who registered it, and contact info. This information can tell us a few different things. We know how far back to look with the waybackmachine to identify any kind of sensitive information that may have been on the companies website as well as any web functionality(such as admin pages) they may now be hiding.
Below is a quick guide for dumping and analyzing windows and linux memory. If you wish to utilize the volitility framework it can be found at volatilityfoundation.org. This guide will help you with some of the challenges available on CyDefe Labs. Check those out at Labs.CyDefe.com
Check back frequently for more guides, tips, and trick with DFIR, pentesting, reverse engineering and much much more. Many of the guides and tips we will be post will help you in real world environments and with our platform. Happy hacking everyone.
MEMORY ACQUSITION
WINPMEM/LINPMEM
- Windows
a. C:> winpmem_.exe -o F:\mem.aff4
b. C:> winpmem_.exe F:\mem.aff4 -e PhysicalMemory -o mem.raw
- Linux
a. ./linpmem_.post4 -o F:\mem.aff4
b. ./linpmem_.post4 F:\mem.aff4 -e PhysicalMemory -o mem.raw
- Linux Alt
a. sudo dd if=/dev/fmem of=/tmp/memory.raw bs=1MB
VOLATILITY USAGE
Example usage: ./volatility__lin64_standalone --profile= -f
LISTING AVAILABLE PROFILES
- info - Displays a list of profiles
a. ./volatility__lin64_standalone --info
ROGUE PROCESS IDENTIFICATION
- pslist - High level view of running processes
a. # ./volatility__lin64_standalone --profile= pslist -f
- psscan - Scan memory for EPROCESS blocks
a. # ./volatility__lin64_standalone --profile= psscan -f
- pstree - Display parent-process relationships
a. # ./volatility__lin64_standalone --profile= pstree -f
ROOTKIT IDENTIFICATION
- psxview - Find hidden processes using cross-view
a. # ./volatility__lin64_standalone --profile= psxview -f
- modscan - Scan memory for loaded, unloaded, and
a. unlinked drivers
i. # ./volatility__lin64_standalone --profile= modscan -f
- apihooks - Find API/DLL function hooks
a. -p Operate only on specific PIDs
b. -Q Only scan critical processes and DLLS
i. # ./volatility__lin64_standalone --profile= apihooks -f
- ssdt - Hooks in System Service Descriptor Table
a. # ./volatility__lin64_standalone --profile= ssdt | egrep –v ‘(ntoskrnl|win32k)’ -f
- driverirp - Identify I/O Request Packet (IRP) hooks
a. -r Analyze drivers matching REGEX name pattern
i. # ./volatility__lin64_standalone --profile= driverirp –r tcpip -f
- idt - Display Interrupt Descriptor Table
a. # ./volatility__lin64_standalone --profile= idt -f
NETWORK ARTIFACTS
- Connections - List of open TCP connections
a. # ./volatility__lin64_standalone --profile= connections -f
- connscan - ID TCP connections, including closed
a. # ./volatility__lin64_standalone --profile= connscan -f
- sockets - Print listening sockets (any protocol)
a. # ./volatility__lin64_standalone --profile= sockets -f
- sockscan - ID sockets, including closed/unlinked
a. # ./volatility__lin64_standalone --profile= sockscan -f
- netscan - Scan for connections and sockets
a. # ./volatility__lin64_standalone --profile= netscan -f
We are back after a very long break due to work. In this episode we have brand new intro music, discuss the yahoo hack and a apache tomcat vulnerability, and record in the same room for the first time in 2.5 years.
On this episode we discuss malware being discovered pre-installed on android devices. We also discuss Confide and how it isn't as secure as we thought it was.
What is TOR?Tor allows users to browse the Web anonymously and is run by volunteers worldwide. This Software is a browser and is developed by the Tor Project. The software goes by the alternative names "The Onion Router", and TOR browser. By using this software TOR allows individuals to access "the deep web" which is the not indexed portion of the internet
Why is this software called "The Onion Router"? TOR uses uses a technique called onion routing to conceal the users activity. How does this work? The Tor Browser connects to several different relays, wiping its tracks each step of the way, making it difficult to figure out where, and who, you really are.
How to get startedFirst you need to download the TOR browser. This software is a modified version of firefox. The software is available for Windows, Linux, and Mac OS. If your looking for a mobile version you can download the android app as well. The mobile app can be found in the google play store a second option is the apk which can be found here.
How to installLinux ``` tar xzf tor-0.2.9.9.tar.gz
cd tor-0.2.9.9
./configure && make
make install ``` then simply type tor into your terminal to launch the TOR browser
WindowsRun the .exe install file.
Once install browse to the folder called Tor Browser and inside you'll see "Start Tor Browser.exe". After you click Start Tor Browser.exe you will recieve a prompt with the option to connect.
After you select connect the TOR browser will launch.
On this episode we talk about the return of carbanak and an individual facing jail time for creating keyloggers.
On this episode we talk about Microsofts new privacy dashboard, and a lot of ransom happening in the cyber world.
This months puzzle is a programming puzzle.
You have to create code for a computer which uses a language from the 90s. There are only a couple characters it takes and for some reason it is really sensitive to more than 50 characters of input. You need to get it to print out 1000 Xs and it's memory will overload and shutdown.
Hint:Wikipedia List of Programming Languages
On this episode we discuss a USB killing device, Krebs on security getting DDoSed by an IOT bot, and another data breach.
On this episode Micheal and i talk about CVE-2016-5696 better known as the off path attack.
On this weeks episode we are joined by Ben0xA who works for https://www.trustedsec.com you can follow him on twitter @Ben0xA. This week we discuss Macs and iPhones have a Stagefright-style bug, Android banking malware blocks victims’ outgoing calls to customer service, Hidden 'backdoor' in Dell security software gives hackers full access, and Companies failing to plan for many cyber dangers.
In this episode we discuss the HummingBad Android malware being distributed by yingmob.
On this episode we discuss Facebook being sued over privacy concerns, Facebook tracking non-users, and audio fingerprinting being used to track web users.
On this weeks episode we discuss checking for malware in your firmware with Google's VirusTotal, Getting pwned by hearthstone hacking tools, Fake Flash Update Serves OS X Scareware, and the FBI trying to scrub its employees data off of the web.
Linkshttp://motherboard.vice.com/read/-the-fbi-is-trying-to-scrub-its-employees-hacked-data-off-the-web
https://www.theguardian.com/technology/2016/feb/10/hacking-gold-hearthstone-symantec-malware-blizzard
http://mashable.com/2016/02/02/virustotal-firmware-scanner/#szZeMIzsGSqp
http://www.securityweek.com/fake-flash-update-serves-os-x-scareware
Videos
On this weeks episode we are joined by Ben Miller and Jayson Street. We discuss three stories from 2015 and talk about our predicitons for 2016.
On this week’s episode we discuss Microsoft’s operations center to fight cyber threats, Dell added Cylance, a bug in Gmail app for Android allows anyone to send spoofed emails, and Siri’s lockscreen bypass
On this weeks episode we are joined by Shannon Morse. We discuss hacking chip and pin cards, malware that replaces your browser, a FitBit danger, and the rise of OS X malware.
On this week’s episode we discuss fake blue screen of death, ad blocking, a critcal WinRAR vulnerability, and a shortage of cyber professionals.
On this week’s episode we discuss a new version of the Carbanak malware, a new malware breaks impenetrable corporate defenses, internet of things and vulnerable baby monitors, and malware construction kits.
On this week’s episode we discuss bittorrent, insiders creating malware, paylpal vulnerabilities, and pawnstorm.
On this weeks episode we talk about hackers showing off long distance Wi-Fi radio proxy at DEF CON, a critical IoT security flaw, Dropbox isnt as secure as you think it is, and another Android vulnerability.
This week we had the amazing Jayson Street join us to discuss the Mac Thunderstrike2 vulnerability, Man-in-the-cloud attacks, Lockheed Martin's open source tools, and hackers exploiting flash on yahoo.
This week we discuss Facebook's plan to deliver internet via drones and lasers, Onstar getting pwned by white hat hackers, The risk your webcam now poses to you due to hackers and RAT malware, and how to protect yourself from malware sent via text.
This week we discuss Mac os x vulnerabilities, The Ashley Madison hack, OpenSSH vulnerabilities and WordPress Flaws.
This week we talk about the Hacking Team hack and many of its implications. We also annouce the key for our Mr.Robot giveaway.
July 4th
-Attack began
July 5th
-400 GB of data were uploaded. Source codes uploaded to GitHub and audio recordings, emails, documentation, invoices, and source code spread via torrents
July 6th
-Hacking teams twitter was compromised with a tweet stating “help were being attacked” and the attackers continued to tweet for many hours after
This week we discuss U.S. hosting the most botnets, Sony, samsung disabling windows updates, the polish airline hack and Mr.Robot
On this weeks episode we discuss the last pass hack, a Samsung smartphone flaw, exposed internet of things devices, and cyber crime can give attackers a 1,425% return on investment
This week Facebook privacy concerns, Chinese hackers, FireEye and visa create a pact, and more vulnerable routers.
This week malicious Minecraft, Facebook scammers, Internet of things security problems, and Facebook stalking.
The world of cyber security is daunting to many people. With so many terms and devices talked about it can look like a very confusing world for some. Where should you start though? What should you protect yourself against? If this question is answered incorrectly it can be very devastating for an organization.
Thanks to organizations like OWASP starting points for securing your assets can be established. With the changing dynamics of many organizations it is hard to determine what a standard security model should look like. However there are two very important areas that every organization should protect. These areas are mobile devices and privacy.
If you are implementing a BYOD (Bring you own device) model in your organization there is a list of very important things to watch for when it comes to mobile devices. The list is as follows.
This episode has been archived.
Show Notes:Microsoft ATP: http://blogs.office.com/2015/04/08/introducing-exchange-online-advanced-threat-protection/
This episode has been archived.
Show Notes :F secure router checker
- https://campaigns.f-secure.com/router-checker/
Fing App
- https://play.google.com/store/apps/details?id=com.overlook.android.fing&hl=en
- https://itunes.apple.com/us/app/fing-network-scanner/id430921107?mt=8
Many users don't know how to audit or properly troubleshoot their network due to overly complicated applications or they are unsure where to start. Fing assists with these tasks and helps simplify them.
Fing takes the power of traditional PC based audit tools and places them neatly in an easy to use mobile app. Fing offers a multitude of easy to use functions which allows a user to quickly and accurately audit their network.
These include
- Ping - measure the round-trip time for packets sent by Fing to a destination host.
- Traceroute - identify the hops
- Domain Lookup - translate a domain name like google.com into IP address, and vice versa.
- Wake On LAN - wake up devices that may be switched on from the network.
CYDEFE has decided to attempt a new format for our website. We hope everyone enjoys the new layout and our podcast.