Gryffin: A Large Scale Web Security Scanning Platform Project By Yahoo

Gryffin: A Large Scale Web Security Scanning Platform Project By Yahoo!

Gryffin is a large scale web security scanning platform. It is not yet another scanner. It was written to solve two specific problems with existing scanners: coverage and scale.

Better coverage translates to fewer false negatives. Inherent scalability translates to capability of scanning, and supporting a large elastic application infrastructure. Simply put, the ability to scan 1000 applications today to 100,000 applications tomorrow by straightforward horizontal scaling.

Coverage

Coverage has two dimensions - one during crawl and the other during fuzzing. In crawl phase, coverage implies being able to find as much of the application footprint. In scan phase, or while fuzzing, it implies being able to test each part of the application for an applied set of vulnerabilities in a deep.

Crawl Coverage

Today a large number of web applications are template-driven, meaning the same code or path generates millions of URLs. For a security scanner, it just needs one of the millions of URLs generated by the same code or path. Gryffin's crawler does just that.

Page Deduplication

At the heart of Gryffin is a deduplication engine that compares a new page with already seen pages. If the HTML structure of the new page is similar to those already seen, it is classified as a duplicate and not crawled further.

DOM Rendering and Navigation

A large number of applications today are rich applications. They are heavily driven by client-side JavaScript. In order to discover links and code paths in such applications, Gryffin's crawler uses PhantomJS for DOM rendering and navigation.

Scan Coverage

As Gryffin is a scanning platform, not a scanner, it does not have its own fuzzer modules, even for fuzzing common web vulnerabilities like XSS and SQL Injection.

It's not wise to reinvent the wheel where you do not have to. Gryffin at production scale at Yahoo uses open source and custom fuzzers. Some of these custom fuzzers might be open sourced in the future, and might or might not be part of the Gryffin repository.

For demonstration purposes, Gryffin comes integrated with sqlmap and arachni. It does not endorse them or any other scanner in particular.

The philosophy is to improve scan coverage by being able to fuzz for just what you need.

Scale

While Gryffin is available as a standalone package, it's primarily built for scale.

Gryffin is built on the publisher-subscriber model. Each component is either a publisher, or a subscriber, or both. This allows Gryffin to scale horizontally by simply adding more subscriber or publisher nodes.

Operating Gryffin

Pre-requisites

1. Go
2. PhantomJS, v2
3. Sqlmap (for fuzzing SQLi)
4. Arachni (for fuzzing XSS and web vulnerabilities)
5. NSQ

• running lookupd at port 4160,4161
• running nsqd at port 4150,4151
• with --max-msg-size=5000000

6. Kibana and Elastic search, for dashboarding

• listening to JSON over port 5000
• Preconfigured docker image available in https://hub.docker.com/r/yukinying/elk/

Installation

go get github.com/yahoo/gryffin/...

Run

TODO

• Mobile browser user agent
• Preconfigured docker images
• Redis for sharing states across machines
• Instruction to run gryffin (distributed or standalone)
• Documentation for html-distance
• Implement a JSON serializable cookiejar.
• Identify duplicate url patterns based on simhash result.

Download

Malvertising Campaign Targeting On Top Adult Websites

Oops! Malvertising Campaign Targeting On Top Adult Websites.

Malvertising assault focusing on various grown-up sites, including xhamster, which draws in near a large portion of a billion visitors per month.

What is Malvertising ?
Malvertising (from "malicious advertising") is the use of online advertising to spread malware. Malvertising involves injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages.

According to report of Malwarebytes,

Malvertising first check that, whether you are running Internet Explorer, and exploits the CVE-2013-7331 Microsoft. XMLDOM ActiveX control vulnerability in Microsoft Windows 8.1 and earlier.

Image by Malwarebytes

The malicious advert served by TrafficHaus was for a dating application called ‘Sex Messenger’ and was displayed often enough that we were able to reliably reproduce the infection in our lab, something that isn’t always feasible when it comes to malvertising.

Malwarebytes researcher also identiify that Microsoft Azure and RedHat cloud platforms and now are seeing IBM’s Bluemix being leveraged by threat actors who enjoy the free HTTPS encryption that it provides them in the delivery of malicious code.

Researchers also spotted latest attack on xHamster website that time distributes browser-based ransomeware.

Below websites are latest victim of Malvertising attack

• Forbes
• Yahoo
• Microsoft
• Realtor

How can we protect?

• To update latest OS
• Always Keep your Computer to protect by Internet Security
• Use AdBlocker add-on in your browser

We have also deleted all third party ads due to Malvertising.

Please read: >> Malvertising Hits 10 Million In 10 Days.  You Might Be Under Attack While Surfing The Web.

How To Detect Potentially Malicious PHP Files

How To Detect Potentially Malicious PHP Files ?

Here is the tool called PHP-malware-finder by nbs-system. 


What does it detect?

PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.

The following list of encoders/obfuscators/webshells are also detected:

• Best PHP Obfuscator
• Carbylamine
• Cipher Design
• Cyklodev
• Joes Web Tools Obfuscator
• Php Obfuscator Encode
• SpinObf
• Weevely3
• atomiku
• cobra obfuscator
• phpencode
• webtoolsvn

How does it work?

Detection is performed by crawling the filesystem and testing files against a set of YARA rules. Yes, it's that simple!

How to use it?

$ ./phpmalwarefinder -h
Usage phpmalwarefinder [-cfhw] <file|folder> ...
    -c  Optional path to a configuration file
    -f  Fast mode
    -h  Show this help message
    -v  Verbose mode

Or if you prefer to use yara:

$ yara -r ./malwares.yara /var/www

Download

Biggest Security Breach In Apple App Store Gets Malware Infected

Biggest Security Breach In Apple App Store Gets Malware Infected.

Hundred of Apple Apps gets Malware Infected. It's including the top apps like Angry Birds 2 and WeChat Chinese version. Hackers targeted on app developers and once infected app installed on victim iPhone device, they could steal all data including Logins and Passwords.

The Malware known as XcodeGhost, it also read and write information on the users clipboard. Mostly Asian countries were targeted.

According to report of Intercept,
Although XcodeGhost is the first malware to spread this way in the wild, the techniques it uses were previously developed and demonstrated by Central Intelligence Agency researchers at the CIA’s annual top-secret Jamboree conference in 2012. Using documents from NSA whistleblower Edward Snowden

According to U.S.-based cybersecurity firm Palo Alto Networks Inc.
The attack affected more than three dozen apps. "We believe XcodeGhost is a very harmful and dangerous malware that has bypassed Apple’s code review and made unprecedented attacks on the iOS ecosystem’"

Apple said in the statement,
We recently removed apps from the App Store that were built with a counterfeit version of Xcode which had the potential to cause harm to customers. You should always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software."

How can we protect?

Whether you downloaded Xcode from Apple or received Xcode from another source, such as a USB or Thunderbolt disk, or over a local network, you can easily verify the integrity of your copy of Xcode.

To verify the identity of your copy of Xcode run the following command in Terminal on a system with Gatekeeper enabled:
spctl --assess --verbose /Applications/Xcode.app

where /Applications/ is the directory where Xcode is installed. This tool performs the same checks that Gatekeeper uses to validate the code signatures of applications. The tool can take up to several minutes to complete the assessment for Xcode.

The tool should return the following result for a version of Xcode downloaded from the Mac App Store:
/Applications/Xcode.app: accepted
source=Mac App Store

and for a version downloaded from the Apple Developer web site, the result should read either
/Applications/Xcode.app: accepted
source=Apple

or

/Applications/Xcode.app: accepted
source=Apple System

Any result other than ‘accepted’ or any source other than ‘Mac App Store’, ‘Apple System’ or ‘Apple’ indicates that the application signature is not valid for Xcode. You should download a clean copy of Xcode and recompile your apps before submitting them for review.


What's new update?

The malicious version of apps removed from Apple App Store and developers update them with fixed all security flaws.

Anonymous Hacked Government of Philippines National Telecom Commission (NTC) Website

Anonymous Hacked Government of Philippines National Telecom Commission (NTC) Website. 

The reason behind to hack NTC website are charging and delivering of Internet Services.

Internet access in the Philippines costs $18/Mbps, as compared to the global average of $5/Mbps.

In the message posted on website, Anonymous Philippines said,

"Greetings Citizens of the world, We are Anonymous.

We, Anonymous Philippines, are sympathizing with our fellow Filipino netizens whose battle cries are the 
"OVER PROMISED, UNDER DELIVERED" system of our internet service providers; it is the neigh direct proportionality of our
internet speeds and bandwidths in relation to price. We, as a country, suffer on the bottom of the internet pyramid having
one of the lowest internet speeds while paying the same amount, or even higher, compared to other countries; adding
DATA CAPPING to our "UNLIMITED" data plans sums up to our great burden as an avid follower of the internet - for studies and such.

We are calling forth the attention of the NATIONAL TELECOMMUNICATIONS COMMISSION for this matter in hand; with this we
talk as a whole...as ONE, we are asking for fairness in charging and serving our data services; Unlimited should be patterned to
its name - "UNLIMITED"; not "UNLIMITED with 800MB cap". A 2MBPS speed should never be a 56kbps. A 98% service reliability should be
always on the 98% part, not the 2% one.

We are Anonymous
We are Legion
We do not Forgive
We do not Forget

EXPECT US!"

The website is Still down..

PEinjector - MITM Portable Executable (PE) File Infector

PEinjector - MITM Portable Executable (PE) File Infector

The executable file format on the Windows platform is PE COFF. The peinjector provides different ways to infect these files with custom payloads without changing the original functionality. 

It creates patches, which are then applied seamlessly during file transfer. It is very performant, lightweight, modular and can be operated on embedded hardware.

Features

• Full x86 and x64 PE file support.
• Open Source
• Fully working on Windows and Linux, including automated installation scripts.
• Can be operated on embedded hardware, tested on a Rasperberry Pi 2.
• On Linux, all servers will be automatically integrated as service, no manual configuration required.
• Plain C, no external libraries required (peinjector).
• MITM integration is available in C, Python and Java. A sample Python MITM implementation is included.
• Foolproof, mobile-ready web interface. Anyone who can configure a home router can configure the injector server.
• Easy to use integrated shellcode factory, including reverse shells, meterpreter, ... or own shellcode. Everything is available in 32 and 64 bit with optional automated encryption. Custom shellcode can be injected directly or as a new thread.

peinjector

Provides PE file patching as a service. Just send the raw header of your PE file and you’ll receive a custom-made patch for it. Can be remotely controlled via a command protocol.

peinjector-control

Web interface to configure and control a peinjector server. A small shellcode factory with some basic shellcodes, automatic encryptoin/obfuscation and thread generation is provided - alternatively, custom shellcode can be injected.

peinjector-interceptor

Sample MITM integration. Based on Python and libmproxy, supports SSL interception, can act as transparent Proxy, HTTP Proxy, ... . Provides seamless PE patching capabilities.

Download

Your Chrome Gets Crash By Using These String Code URL

Your Chrome Gets Crash By Using These String Code URL  

We have tested these 16 characters strings and it still works on Windows and Mac.

This security issue was found by Andris Atteka. By mouse over on link its enough for your chrome Crash.

Security Flaw Strings are:

http://a/%%30%30
file:///%%300
http://biome3d.com/%%30%30

He said in the blog,

"Recently I reported a crash bug in Google Chrome (issue #533361). This issue reminded me of the recent Skype vulnerability - both occur with simple URL strings. So how can you crash Google Chrome? By adding a NULL char in the URL string:

http://biome3d.com/%%30%30

Unfortunately no reward was awarded as this was deemed to be only a DOS vulnerability. Anyway, making secure software is much harder than finding issues in it. Thanks Google."

Hope Google will be fixed this issue soon.