Comments on: Content Injection: Hack the Hacker http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/ Information Security Think Tank Sat, 02 Feb 2013 17:50:40 +0000 hourly 1 http://wordpress.org/?v=3.4.1 By: Hamid.K http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/comment-page-1/#comment-118985 Hamid.K Fri, 18 Apr 2008 19:56:52 +0000 http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/#comment-118985 While looking like a nice (but not new) idea , I believe it completely failed , for various reasons : 1- The same reason/capability make serious hackers bypass your IDS/IPS , makes them bypass this one. 2-As xnull already mentioned , every mechanism used for security(defense or defeat) at client-side should be considered broken . No matter how complex or obfuscated it is , it`s broken . 3-Now days , even beginners has learned to live without JS in their browsers . So maybe another solution should be applied ? 4- Wise people doing web-app testing (or hacking)check web-servers responses as much as they do for requests ! So such a behavior could be catchd almost immediately by them. 5- If the hacker is still getting back-traced after these all , for sure s/he must be a script-kiddie not capable of doing anything serious . so just making more noise in logs . The goal should be reducing them as much as possible , to be able to use them effectively . right ? 6- Even if #5 didn`t matched your business and you think with #5 your web-app/server could still get hurted , then this solution or trick is not for you ! Best advice for such system IMO is to completely shut it down , and sleep well at nights :) finally , I love your blog , and am learning new ideas each time I visit it . keep the great job guys . While looking like a nice (but not new) idea , I believe it completely failed , for various reasons :

1- The same reason/capability make serious hackers bypass your IDS/IPS , makes them bypass this one.
2-As xnull already mentioned , every mechanism used for security(defense or defeat) at client-side should be considered broken . No matter how complex or obfuscated it is , it`s broken .
3-Now days , even beginners has learned to live without JS in their browsers . So maybe another solution should be applied ?
4- Wise people doing web-app testing (or hacking)check web-servers responses as much as they do for requests ! So such a behavior could be catchd almost immediately by them.
5- If the hacker is still getting back-traced after these all , for sure s/he must be a script-kiddie not capable of doing anything serious . so just making more noise in logs . The goal should be reducing them as much as possible , to be able to use them effectively . right ?
6- Even if #5 didn`t matched your business and you think with #5 your web-app/server could still get hurted , then this solution or trick is not for you ! Best advice for such system IMO is to completely shut it down , and sleep well at nights :)

finally , I love your blog , and am learning new ideas each time I visit it . keep the great job guys .

]]> By: mordox http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/comment-page-1/#comment-118826 mordox Tue, 15 Apr 2008 10:46:41 +0000 http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/#comment-118826 Bharosa / Oracle OAAM too uses a client fingerprinting technology to identify threats Bharosa / Oracle OAAM too uses a client fingerprinting technology to identify threats

]]> By: Awesome AnDrEw http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/comment-page-1/#comment-118795 Awesome AnDrEw Mon, 14 Apr 2008 13:54:14 +0000 http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/#comment-118795 Out of the hundreds or thousands of attacks I receive daily a large number of them are through wget, Perl, Java, and similar applications which have been automated. Very few are from legitimate clients, but I do find a lot of attempts from Firefox users' who then try to spoof their User-Agent. A great way to tell the difference between bots and humans who are using real browsers is that in most cases even if Java, Javascript, and other embedded entities are disabled there will be a significant number of requests for other resources such as images or stylesheets (though this also depends on both the type and amount of content on a page). Most automated attacks only target a specific page, and do not make subsequent requests for the material placed on the page. I've set up my own layered system for custom intrustion detection, but some of the more interesting concepts along the lines of what you've talked about, which I have come up with, include using CSRF or 302 redirections to pass off the traffic to another host (I believe the owner of Blue Hat SEO did this when his website was being attacked, and redirected all of the malicious traffic to the FBI's website), bombarding the user with advertisements (this would only apply to those illegitimate requests caused by individuals), scanning the client for vulnerabilities, or attacking the client with one's own botnet. The CSRF issue is probably the most entertaining due to all of the possibilities it entails. Out of the hundreds or thousands of attacks I receive daily a large number of them are through wget, Perl, Java, and similar applications which have been automated. Very few are from legitimate clients, but I do find a lot of attempts from Firefox users’ who then try to spoof their User-Agent. A great way to tell the difference between bots and humans who are using real browsers is that in most cases even if Java, Javascript, and other embedded entities are disabled there will be a significant number of requests for other resources such as images or stylesheets (though this also depends on both the type and amount of content on a page). Most automated attacks only target a specific page, and do not make subsequent requests for the material placed on the page.

I’ve set up my own layered system for custom intrustion detection, but some of the more interesting concepts along the lines of what you’ve talked about, which I have come up with, include using CSRF or 302 redirections to pass off the traffic to another host (I believe the owner of Blue Hat SEO did this when his website was being attacked, and redirected all of the malicious traffic to the FBI’s website), bombarding the user with advertisements (this would only apply to those illegitimate requests caused by individuals), scanning the client for vulnerabilities, or attacking the client with one’s own botnet. The CSRF issue is probably the most entertaining due to all of the possibilities it entails.

]]> By: David Kierznowski http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/comment-page-1/#comment-118789 David Kierznowski Mon, 14 Apr 2008 10:30:54 +0000 http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/#comment-118789 Daniel, watch out for false positives :) xnull, I haven't actually heard of people doing this, although I have heard of peeps using a virtualised browser (i.e. VMWare etc). Yousif, thanks man, keep us posted on your blog progress, would be interesting to see what you come up with. Daniel, watch out for false positives :)

xnull, I haven’t actually heard of people doing this, although I have heard of peeps using a virtualised browser (i.e. VMWare etc).

Yousif, thanks man, keep us posted on your blog progress, would be interesting to see what you come up with.

]]> By: Yousif Yalda http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/comment-page-1/#comment-118743 Yousif Yalda Sun, 13 Apr 2008 18:02:50 +0000 http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/#comment-118743 Nice post, I agree with these methods. Now this is actual out-of-the-box thinking. Trapping the hacker scheme is always what I have in mind when implementing any type of IDS, specifically reducing the use of heavy technologies, and rather just applying what we already have customized in crafted requests in real-time. I'll too be discussing ways of IDS concepts on my blog soon, I'm working on a POC to release soon as well, good job man! Nice post, I agree with these methods. Now this is actual out-of-the-box thinking. Trapping the hacker scheme is always what I have in mind when implementing any type of IDS, specifically reducing the use of heavy technologies, and rather just applying what we already have customized in crafted requests in real-time. I’ll too be discussing ways of IDS concepts on my blog soon, I’m working on a POC to release soon as well, good job man!

]]> By: xnull http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/comment-page-1/#comment-118685 xnull Sat, 12 Apr 2008 18:06:38 +0000 http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/#comment-118685 David, that is fun to think about, but most attacker's browsers (at least ones used in a serious attack) are stripped down of Java, javascript, flash and many other functionalities (many times even cookies). Torbutton is an example of an add-on for Firefox which tries to do this for an attacker automatically. A lot of blackhats bother compiling a separate browser to be their Tor browser. Keep in mind that anything client-side is in complete control of the attacker and can also be defeated with just a little bit of creativity. David, that is fun to think about, but most attacker’s browsers (at least ones used in a serious attack) are stripped down of Java, javascript, flash and many other functionalities (many times even cookies). Torbutton is an example of an add-on for Firefox which tries to do this for an attacker automatically.

A lot of blackhats bother compiling a separate browser to be their Tor browser.

Keep in mind that anything client-side is in complete control of the attacker and can also be defeated with just a little bit of creativity.

]]> By: Dnaiel http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/comment-page-1/#comment-118674 Dnaiel Sat, 12 Apr 2008 09:00:18 +0000 http://www.gnucitizen.org/blog/content-injection-hack-the-hacker/#comment-118674 I actually use this at the moment, I won't say what I do when some useless c*nt tries to hack the box, but it's pretty effective to say the least. I actually use this at the moment, I won’t say what I do when some useless c*nt tries to hack the box, but it’s pretty effective to say the least.

]]>