Christopher Truncer's Website and Portfolio

Before you begin reading the writeup, I had contacted the company who’s server contains the vulnerability and disclosed all the information I had about what I did. Their response was that they didn’t consider it a risk, and weren’t going to be modifying the server security. So I am taking that as a “closed” issue on their end, and I’ll at least write it up.

While trying to determine how secure the server is that I have a website running on, I found an interesting hole. I consider user accounts to be basically half a password when attempting to access a box. If I have a username, then I know half of what I need to know to get in. So I tried testing to see if I could figure out the other user accounts that are on this shared hosting server a website of mine was put on.

I do have SSH and FTP access to the server, as I am a legitimate customer. So I SSHed into the machine, and tried running the “top” command. It returned some server stats and all user accounts that had an active running process. However, the user accounts were not displayed. Only the UID of the account. Also, I was unable to view the home directories of other users as my account was jailed. This would be good.

Then I had an idea. I uploaded a php page that ran the same command and would return the results to the web page. When I browsed to it, I had an unfiltered view of all user accounts on the server that had running processes. It became clear that the “nobody” account was not jailed, and as a result, I was able to make a page that used the nobody account to run the command. It returned all the same information, except this time it had the actual user accounts instead of just the UID.

It was an interesting find, and since the company is not considering this an issue, I figured it wouldn’t hurt to share with the world. Enjoy, and see if you can do the same thing on your servers.

In case you haven’t heard what has happened, a group of hackers, called fail0verflow, recently gave a presentation that demonstrated the lack of security on Sony’s Playstation 3 console. The team demonstrated how the attack can be performed on the system and used to discover Sony’s private key used to sign software on the Playstation.

Geohot, then based his attack off of fail0verflow’s work, was successful in finding the Playstation’s private key, and posted on his website. For a few days, the world wondered, what will Sony’s response be? And now we know…

Sony originally filed for an injunction against geohot and the fail0verflow team to force them to remove their tools/information off of the internet, ideally prevent the spread of the tools, and force them to stop all future work. The lawsuit has since been updated with Sony now also seeking damages.

This court case, if it makes it to court, has the ability to set a dangerous precedent, but also a very consumer friendly precedent. It was ruled last year that it is 100% legal to unlock and jailbreak an iPhone for use on other carriers and/or to access an app store that is not allowed by Apple. At the moment, the ruling is only extended to the phone, but it is mine, the EFF’s, and probably many others out there who hope that it can be granted to consoles, and eventually all electronic gadgets.

The way Sony wants this to rule, it is only designed to benefit the big businesses. I completely agree with Sony protecting its system and doing anything it can to prevent software piracy. I am against piracy, and would just like to see the console opened up for homebrew. However, Sony is specifically going against security researchers with this lawsuit. Researchers need to have the right and ability to test the security of gadgets/systems/etc. and release information to the public without the fear of lawsuits. Without this, security would not be where it is today. Without the ability to research and release, systems will stay unpatched as a result of vulnerabilities that would have not been discovered. It would only put consumer information at risk, and protect the companies who don’t want to spend the time properly securing their infrastructure.

Lets hope the courts can see clearly all the facts.

So I’ve just started studying for the CISSP. I’ve been doing so for about a week now, and I am feeling very confident with all the content that I have read. The big thing I have noticed when working to obtain all my certifications is that the material needs to make logical sense, as I am very much a logical thinker. As long as the material is, then it will not be an issue for me understanding any of it.

Additionally, I’ve been working a lot with Backtrack 4 lately. I’ve been playing around with a lot of the tools again and I still believe it is the best security based linux distro available. The number and quality of tools built into it is superior than anything else I have used. It never hurts to to have a great understanding of these tools, and I’ll continue to do so.

I purchased a couple different books to help me study and obtain the CISSP. The first one, and probably the most popular one, is Shon Harris’s All in One Study guide. I also purchased her smaller book that contains practice tests. The other book I bought is the (ISC)2′s official study guide. It’ll be interesting to read through both and see which I book works best for me. As of now, I’m going to keep working my way through the Access Control domain. and on from there!