Christopher Truncer's Website and Portfolio

Well, I am happy to report that the results of my OSWP exam came in and I was successful in passing the exam!

This was probably one of the most fun certifications that I had a chance to study for. I already knew a good amount about breaking into wireless network, however I did not know all techniques, and that was exactly why I wanted to take the course.

Both the videos and the large pdf file provided go into detail describing different attacks and different scenarios that you could face. After working my way through all the videos, and the pdf file, I felt up to the challenge to take the exam.

About 15 minutes before my exam, I received an e-mail with the login instructions and the instructions for the exam itself. It was pretty much exactly what I had expected. Oddly enough, I was fairly nervous once I logged into the system. In retrospect, I have no idea why because I really knew all the material, and I’ve performed the same attacks on my own many times. Maybe it was just because I felt I already knew it all, that if I couldn’t pass, I really would have felt pretty ridiculous.

I also can’t talk such good things about this exam format as well. Sure, learning theory and being able to answer test questions are a tried and true method of learning material. However, I don’t think much else can represent truly knowing the material other than actually performing what was learned. All Offensive Security certifications are based on actually forcing you to demonstrate your knowledge. Not only does it make you prove your knowledge, but it also just makes it a lot more enjoyable.

Anyways, the exam was a good representation of the material that was learned during the course itself, and I would certainly recommend this course to others interested in learning about wireless security. If anyone has any questions about the certification, feel free to ask.

Next on my list, OSCP!

About a month ago I signed up for Offensive Security’s Offensive Security Wireless Professional (OWSP) certification. I’ve had a decent amount of experience hacking both WEP and WPA wireless networks, however, I knew that I did not know it all, and I wanted to get into something like the OSWP to fill in the gaps. After registering for the course, I am happy to say that the OSWP certainly did provide that service.

Once you’re registered, all candidates receive access to a large pdf file and a number of flash based training movies helping to explain all background information, and provide demonstration based training for the attacks you’re expected to perform. I really enjoyed it because the OSWP goes in depth on all attacks that one can carry out with the aircrack-ng suite and it provided the training on the attacks that I’ve never (had to) perform before. Beyond the attacks, the training materials provide an extensive technical background clearly explaining the theory behind wireless security, and the attacks.

I’m registered to take the test in a few weeks, so I’m looking forward to putting everything I’ve gained to the test. I’ll be sure to post once I know how everything went.

Hello all,

In this writeup, I will be providing proof that the owner/developer(s)/company that runs Theme It has developed an insecure iPhone and web application. The only reason I am releasing this information before a fix has been made is because the owner/developer(s)/company has ignored repeated attempts to get into contact with them.

A while ago I wrote about the web front end to the jailbroken iPhone’s theme store. There were a number of issues that I pointed out, and some issues have been fixed. Unfortunately, not all have, and the issues that have been still leaves your account vulnerable.

When first talking with the Theme It team, their reason for not securing their application was because “we are not a bank“. Any business/store that performs financial transactions should ensure its customer data is secured, both at rest and in transit.

While I obviously do not have access to Theme It’s back-end database to view how records are stored, we all have access to information sent to Theme It, and I can show you how Theme It does not protect user information. In fact, it is left clear-text for any person to sniff and steal user login information.

The Theme It team previously mentioned that “96% of its users don’t use the website” implying that they use the Theme It iPhone application. After reviewing the information transmitted from the Theme It app to its servers, it can be said that the application has not taken any steps to secure customer data (at the time of this writing).

To test, I simply had my iPhone join a network, and then had the iPhone open up the Theme It app, and connect with my account. What you see below is what any person sniffing traffic can see:

If you look at the information captured, you can see that nothing has been encrypted. The “pseudo” variable is your username, “password” is the password for your account, “device_id” is the UDID for your iPhone, “device_type” would be the type of iPhone you have, and “device_os” is what version of iOS you are running on your iPhone.

Any person on the network that the iPhone is transmitting on can sniff, intercept this traffic, and use its information to take over the customers account. Point being, the Theme It app does not take any steps to secure your personal information as it is being sent.

The Theme It Store also has a website that they allow users to connect to, purchase themes, administer their account, etc. I wrote about their website a few months ago informing users how all information that is transmitted to their server is in clear-text and can be sniffed by an attacker (this included username and password). The web site still transmits information in clear-text that can be sniffed. With the information that is sent to the Theme It website, any attacker is able to perform what is called a replay attack. What this means is that I can use the information I just sniffed from a customer logging in, send the exact same information to the Theme It server, and then be logged in with full control of the customers account. The picture below shows a successful replay of captured information on the test account I created:

To fix this issue, the easiest thing that the Theme It company can do is get a certificate which will allow a secure/encrypted connection directly to the server Theme It uses. If the company were to purchase a certificate, it would mitigate all attacks I have shown in this writeup.

I stated in multiple messages to both @fif7y and the official Theme It twitter account that I found their application is sending everything in clear-text, and that their web application is still vulnerable due to a lack of security. I have yet to see a fix or hear back from either. Hopefully we can see some security updates to their applications soon.

Good Morning all,

It’s been a busy past month for me, but I did happen to find a new vulnerability that exists in IP.Board. IP.Board is basically a web application that allows you to run a forum, with the option to purchase additional functionality, like blogs, a store, etc.

While I was looking into how IP.Board works, and running some tests and scans against it, I’ve discovered a couple of vulnerabilities in the application. At the moment, it seems to largely be information disclosure and XSRF vulnerabilities, but I am in the process of seeing if it is capable of further development into something a little more dangerous.

I’ve already reported some of the vulnerabilities to the developers of IP.Board, and they said that a fix has been created for their next update. I’ll be sure to let you know once it is released if it fixes the issue. The other outstanding vulnerabilities I want to look into as much as I can to see if it can result in a dangerous attack. As I find out more information, and understand how it works, I will then be able to provide a better report to the developers of IP.Board (Invision Services) about the vulnerability.

I am also currently working to get a CVE number reserved for the issue for proper tracking of the vulnerability.

Before you begin reading the writeup, I had contacted the company who’s server contains the vulnerability and disclosed all the information I had about what I did. Their response was that they didn’t consider it a risk, and weren’t going to be modifying the server security. So I am taking that as a “closed” issue on their end, and I’ll at least write it up.

While trying to determine how secure the server is that I have a website running on, I found an interesting hole. I consider user accounts to be basically half a password when attempting to access a box. If I have a username, then I know half of what I need to know to get in. So I tried testing to see if I could figure out the other user accounts that are on this shared hosting server a website of mine was put on.

I do have SSH and FTP access to the server, as I am a legitimate customer. So I SSHed into the machine, and tried running the “top” command. It returned some server stats and all user accounts that had an active running process. However, the user accounts were not displayed. Only the UID of the account. Also, I was unable to view the home directories of other users as my account was jailed. This would be good.

Then I had an idea. I uploaded a php page that ran the same command and would return the results to the web page. When I browsed to it, I had an unfiltered view of all user accounts on the server that had running processes. It became clear that the “nobody” account was not jailed, and as a result, I was able to make a page that used the nobody account to run the command. It returned all the same information, except this time it had the actual user accounts instead of just the UID.

It was an interesting find, and since the company is not considering this an issue, I figured it wouldn’t hurt to share with the world. Enjoy, and see if you can do the same thing on your servers.