Christopher Truncer's Website and Portfolio

About a month ago I signed up for Offensive Security’s Offensive Security Wireless Professional (OWSP) certification. I’ve had a decent amount of experience hacking both WEP and WPA wireless networks, however, I knew that I did not know it all, and I wanted to get into something like the OSWP to fill in the gaps. After registering for the course, I am happy to say that the OSWP certainly did provide that service.

Once you’re registered, all candidates receive access to a large pdf file and a number of flash based training movies helping to explain all background information, and provide demonstration based training for the attacks you’re expected to perform. I really enjoyed it because the OSWP goes in depth on all attacks that one can carry out with the aircrack-ng suite and it provided the training on the attacks that I’ve never (had to) perform before. Beyond the attacks, the training materials provide an extensive technical background clearly explaining the theory behind wireless security, and the attacks.

I’m registered to take the test in a few weeks, so I’m looking forward to putting everything I’ve gained to the test. I’ll be sure to post once I know how everything went.

I can very happily say that I have passed the CISSP exam!

I originally posted that I first started studying for the CISSP in January, but I stopped for a couple months as I switched jobs, and wanted to be able to get acclimated with the new workplace. Finally around April I started studying for the CISSP from the moment I got home until I went to bed. Pretty much I spent any spare time I had studying.

My study materials included Shon Harris’s All In One CISSP Study book 5th edition, Shon Harris’s additional questions, the Official ISC2 CISSP Study guide, and a paid test subscription to cccure.org’s test questions. While I had all these materials, the two biggest sources of information was Shon Harris’s AIO book, and the cccure.org test engine. I believe just constant studying and constant test taking forced me to learn the material, and I was able to use it to take and pass the exam!

I sat for the exam on June 12th in Reston. I was maybe the 5th person done taking the test at exactly 2 hours and 59 minutes into the 6 hour exam. I walked away feeling fairly confident that I did well, and just hoping that I passed.

Waiting to find out the results is the worst. I kept taking one small practice test a day just in case I would have to retake the test again so I could help keep it all fresh in my mind. It took just about 2.5 weeks to find out how I did. I was at a conference when I got the e-mail from ISC2 on June 29th. Very nervously I opened up the e-mail, and was very very very relieved when I saw the “Congratulations”.

It was a long time studying, and required a lot of time to learn all the material, but it was well worth the effort in the end. As of now I have passed the exam, but I will not receive the actual certification until around April of 2012. Needless to say, I think the hard part is past me.

Hello all,

In this writeup, I will be providing proof that the owner/developer(s)/company that runs Theme It has developed an insecure iPhone and web application. The only reason I am releasing this information before a fix has been made is because the owner/developer(s)/company has ignored repeated attempts to get into contact with them.

A while ago I wrote about the web front end to the jailbroken iPhone’s theme store. There were a number of issues that I pointed out, and some issues have been fixed. Unfortunately, not all have, and the issues that have been still leaves your account vulnerable.

When first talking with the Theme It team, their reason for not securing their application was because “we are not a bank“. Any business/store that performs financial transactions should ensure its customer data is secured, both at rest and in transit.

While I obviously do not have access to Theme It’s back-end database to view how records are stored, we all have access to information sent to Theme It, and I can show you how Theme It does not protect user information. In fact, it is left clear-text for any person to sniff and steal user login information.

The Theme It team previously mentioned that “96% of its users don’t use the website” implying that they use the Theme It iPhone application. After reviewing the information transmitted from the Theme It app to its servers, it can be said that the application has not taken any steps to secure customer data (at the time of this writing).

To test, I simply had my iPhone join a network, and then had the iPhone open up the Theme It app, and connect with my account. What you see below is what any person sniffing traffic can see:

If you look at the information captured, you can see that nothing has been encrypted. The “pseudo” variable is your username, “password” is the password for your account, “device_id” is the UDID for your iPhone, “device_type” would be the type of iPhone you have, and “device_os” is what version of iOS you are running on your iPhone.

Any person on the network that the iPhone is transmitting on can sniff, intercept this traffic, and use its information to take over the customers account. Point being, the Theme It app does not take any steps to secure your personal information as it is being sent.

The Theme It Store also has a website that they allow users to connect to, purchase themes, administer their account, etc. I wrote about their website a few months ago informing users how all information that is transmitted to their server is in clear-text and can be sniffed by an attacker (this included username and password). The web site still transmits information in clear-text that can be sniffed. With the information that is sent to the Theme It website, any attacker is able to perform what is called a replay attack. What this means is that I can use the information I just sniffed from a customer logging in, send the exact same information to the Theme It server, and then be logged in with full control of the customers account. The picture below shows a successful replay of captured information on the test account I created:

To fix this issue, the easiest thing that the Theme It company can do is get a certificate which will allow a secure/encrypted connection directly to the server Theme It uses. If the company were to purchase a certificate, it would mitigate all attacks I have shown in this writeup.

I stated in multiple messages to both @fif7y and the official Theme It twitter account that I found their application is sending everything in clear-text, and that their web application is still vulnerable due to a lack of security. I have yet to see a fix or hear back from either. Hopefully we can see some security updates to their applications soon.

Update 3: After very briefly looking at traffic sent from the browser to Theme It’s server, the password appears to be hashed, but obviously the hash is still easily sniffed. I’ll have to look into this to determine if the site is still vulnerable via a replay attack.

Update 2: I have been in continued contact with the developers of Theme It, and I am now glad to say that the security vulnerabilities I have documented here no longer exist. All passwords sent when logging in and updating user account passwords are no longer clear text. The purpose of this post was to bring security issues that exist up, and ensure that they are fixed. In the case of passwords being sent in the cleartext, they have been.

Update 1: I am pleased to announce that this post has had its desired effect. While the developer(s) was unhappy that this information was posted, he has actually gone back and updated the way the site handles user authentication and the user information collected. The initial login process is no longer viewable via intercepting network traffic. Additionally, the appears to no longer be needing a physical address associated with your Themeit account. There is still an issue that your username and password IS still sent in the cleartext when you are already logged in and are updating your password. This appears to be the final remaining (obvious) vulnerability still present on the site.

I wanted to write about a web application that I have found to be incredibly insecure. Similar to the previous vulnerability I wrote about, I got in contact with the application Owner/Lead Fif7y. However, no action has been taken to fix the issue as it still exists.

For those that do not know, Themeit is a store that has been recently developed for selling iPhone themes. It’s labeled as being made by Fif7y and sells a wide range of iPhone themes. However, in order to get an account on the website you have to create a username, password, but also submit a number of personally identifiable information.

When analyzing this, there is no real need for this site to collect your home address. Since the