Google vs. SideJacking, round 7

Google recently made a change that allowed you to configure your Gmail account to force SSL. Last I looked at Gmail, it would still leak cookies even if you thought you were using SSL. This latest change from Google appears to have fixed this.

If you enable this in your account, Gmail will not allow you to use non-SSL. If you attempt to log into "http://mail.google.com", it will switch to "https://mail.google.com".

Moreover, the session cookie "GX" is set with the "secure" flag. That means you won't disclose if even if you try normal HTTP. I have not yet been able to grab the cookie and hijack an SSL Gmail session yet. I can still hijack a lot of other Google stuff. For example, I'm posting by hijacking my own Blogger account.

Background Info

The following is the cookie specification for cookies sent by the server:

Set-Cookie: =[; =]
[; expires=][; domain=]
[; path=][; secure][; HttpOnly]


When "HttpOnly" is set, this means that cookies can only be set when within HTTP headers but not with JavaScript, thus preventing some cross-site-scripting attacks. When "secure" is set, this means the cookie is set with HTTPS but not HTTP.

When looking at the Gmail cookies, only the "GX" cookie is set with "secure" flag, all the rest can be sent via HTTP. However, the "GX" cookie is the important one that allows me to hijack the session, so that's probably appropriate.

Oh the zealots will be on the warpath...

http://www.theregister.co.uk/2008/08/13/phishers_attack_mac_faithful/

I can't wait to see what excuses the Mac zealots come up with for this or the horrible showing the iPhone had at Defcon regarding the Wall of Sheep.

Booting OSWA on Eee PC with SD flash

These are some notes for making a bootable SD flash card for my Eee PC from the "OSWA Assistant" bootable CD.

A bootable or "live" CD is a popular way of distributing hacking tools. You just put the CD into any computer and boot from it (instead of your normal hard disk). You get a Linux desktop and pointers to a list of common programs. The most famous of these is probably the "Backtrack CD.

Another one for wireless auditing is "OSWA Assistant". I've never used it before, but they were handing out CDs at BlackHat 2008 Vegas.

The computer I want to use for this Asus Eee 2G Surf", a $299 disposable laptop. Everybody should probably have a handful of these around to play with.

The problem with the Eee PC is that it doesn't have a CD-ROM drive, so I can't boot the OSWA CD. However, it does have three USB ports and one SD flash port. The SD port is especially nice for booting. You can get 2-gig SD flash cards for $7; they are hella cheap.

To make a bootable SD card from the CD, I went through the following steps.

Step 1: I copied all the files to the SD card. I first put the SD flash card into my Windows PC which became the "D:" drive. I downloaded the latest oswa-assistant.iso image from the OSWA website, opened it in WinRAR on my Windows PC, and extracted all the files to the "D:" drive. You can use pretty much any tool for extracting the files, I just happened to have WinRAR handy. I didn't even know that WinRAR could extract files from ISOs - I just assumed that is the sort of thing that WinRAR ought to be able to do.

Step 2: I needed to make the flash bootable. Most bootable CDs use a tool called "isolinux" to go through the boot process. There is a sibling tool called "syslinux" for making bootable Linux flash devices, such as USB flash or SD flash. I downloaded the syslinux archive, extracted to "C:\syslinux". I opened a command prompt, went to "C:\syslinux\win32" and ran "syslinux.exe -ma D:" to make the SD card bootable.

Step 3: I had to change the "isolinux" configuration to a "syslinux" one. I renamed the "D:\boot\isolinux" directory to a "D:\boot\syslinux" directory instead. I also had to rename the "isolinux.cfg" file in that directory to "syslinux.cfg".

Step 4: I had to configure the Eee PC to boot from SD, otherwise it will boot from its own hard disk. When the system boots, I hit "F2" to go into the BIOS configuration, and change the boot order so that Removable Devices are at the top of the list.

At this point, the system boots. However, there several problems. First, it complains "You passed an undefined mode number.", which refers to the fact that it doesn't understand something about the text mode screen. Simply hit to continue.

When it reaches "Starting udev hot-plug hardware detection...", it will hang for a while with the message "Starting udev hot-plug hardware detection… udevd-event[2706]: run_program: '/sbin/modprobe' abnormal exit". Don't worry, it will continue on with the boot process after about 5 minutes. It's a bit annoying though. I wish I knew what was failing.

Step 5: There was one fatal error. X Windows hangs looking for an AGP card. The In order to fix this, I had to edit the "D:\boot\syslinux\syslinux.cfg" file and put "noagp" on the second line:
APPEND ramdisk_size=100000 init=/etc/init lang=us apm=power-off vga=791 initrd=minirt.gz nomce loglevel=0 quiet BOOT_IMAGE=oswa noagp

Step 6: Profit!

Reporters "hacking" at BlackHat

I was there when this happened: "Reporters At Black Hat Get Bounced For Hacking" (Slashdot).

The problem is the ying-and-yang of cybersecurity. On one hand, security is serious business. When you cross a line, people with guns show up at your door. On the other hand, learning about security is often playful and fun.

The "Wall of Sheep" rides the controversial grey area between the two. They sniff passwords from the conference network and display them (or at least, the first three letters) on a screen. It's a playful way of reminding people about the chronic problem that they are sending their passwords unencrypted on the network.

Whereas the primary BlackHat network advertised the fact that it was being monitored, different rules applied to the press network. A member of the French press didn't understand the difference between the two, pulled passwords from the press network, and attempted to submit them to the Wall of Sheep.

There was not malicious intent here. The guy didn't understand the difference between the two networks. His intent was to join the playful education game, not to hack into somebody's account.

I would suggest that CMP Media's response was a bit harsh. A private rebuke would be appropriate, but a public fuss goes too far. BlackHat is constantly mired in controversy between "education" and the often shady side of where that education comes from (vulnerability disclosure, revealing of trade secrets, etc.). I would prefer to see them err on the side of education, rather than erring on the side of "being serious about security".