September 2019

Vulnerability in SIM-cards, how to protect against Simjacker



The vulnerability of Simjacker can spread to more than 1 billion mobile phone users worldwide.
A new and previously unrecognized critical vulnerability has been discovered in SIM cards, which could allow remote attackers to compromise targeted mobile phones and spy on victims simply by sending an SMS message.
This vulnerability, dubbed “SimJacker,” is located in certain software called S @ T Browser (a dynamic toolkit for SIM cards) embedded in most SIM cards that is widely used by mobile operators in at least 30 countries and can be used no matter what phones the victims use.
Well, what's wrong with that? A special private company that works with governments has been actively exploiting the SimJacker vulnerability for at least the past two years to conduct targeted monitoring of mobile phone users in several countries.
S @ T Browser, short for SIMalliance Toolbox Browser, is an application that installs on various SIM cards, including eSIM, as part of the SIM Tool Kit (STK) and is designed to enable mobile operators to provide some basic services, subscriptions, and additional wireless services for its customers.

Because the S @ T Browser contains a number of STK instructions — such as sending a short message, setting up a call, launching a browser, providing local data, launching on command, and sending data — that can be caused by simply sending an SMS message to the device, the software offers a runtime environment to run malicious commands on mobile phones.

How does the Simjacker Vulnerability work?


Discovered by researchers from AdaptiveMobile Security in a new study published on September 12, 1919, the vulnerability can be exploited using a GSM modem for $ 10 to perform several tasks listed below on a target device by simply sending an SMS message containing a certain type of spy code .
  • Retrieving the location of the target device and IMEI information,
  • Spreading false information by sending fake messages on behalf of the victims,
  • Performing premium rate fraud by dialing premium rate numbers,
  • Spy on the surroundings of victims by ordering the device to call the attacker’s phone number,
  • The spread of malware, forcing the victim’s phone browser to open a malicious web page,
  • Perform denial of service attacks by disconnecting the SIM card and
  • Getting other information, such as language, type of radio, battery level, etc.

  • During the attack, the user is completely unaware that he received the attack, that the information was extracted and that it was successfully deleted,” the researchers explain.


    This attack is also unique in that the Simjacker attack message can be logically classified as carrying full malware load, especially spyware. This is because it contains a list of instructions that the SIM card must follow. Simjacker is the first real attack in which spyware is sent directly to SMS.
    Although technical details, a detailed document and proof of concept of the vulnerability are planned to be published in October this year, the researchers said they observed real attacks on users with devices from almost all manufacturers, including Apple, ZTE, Motorola, Samsung, Google, Huawei and even IoT with SIM cards.
    It turns out that all manufacturers and models of mobile phones are vulnerable to SimJacker attacks, since this vulnerability uses outdated technology built into SIM cards, the specification of which has not been updated since 2009, which potentially puts more than a billion people at risk.

    Simjacker Wildlife Vulnerability

    Researchers say that the Simjacker attack worked very well and has been used successfully for many years, "because it used a combination of sophisticated interfaces and obscure technologies, showing that mobile operators cannot rely on standard installed security features."

    Simjacker is a clear danger to mobile operators and subscribers. This is potentially the most sophisticated attack that has ever existed on major mobile networks. ”
    said Ketal MacDade, CTO at AdaptiveMobile Security, in a press release.





    “This is the main alarm signal that shows that hostile actors are investing heavily in increasingly sophisticated and creative ways to undermine network security.” This threatens the security and trust of customers, mobile operators and affects the national security of entire countries. "

    Moreover, now that this vulnerability has been publicly disclosed, researchers expect hackers and other attackers to "develop these attacks in other areas."

    Researchers have responsibly revealed the details of this vulnerability of the GSM Association, a trading organization representing the community of mobile operators, as well as the SIM alliance, representing the major manufacturers of SIM cards / UICC.

    SIMalliance acknowledged the issue and provided recommendations for security SIM card manufacturers for S @ T push messages.

    Mobile operators can also immediately eliminate this threat by setting up the process of analyzing and blocking suspicious messages containing S @ T browser commands.
    We, as a potential victim, as a user of a mobile device, can do nothing if we use a SIM card with S @ T Browser technology deployed on it, except for a request to replace our SIM card on which patented security mechanisms are installed.
    More information about Simjacker can be found at www.simjacker.com, and Katal MacDade, CTO of AdaptiveMobile Security, will introduce Simjacker at the Virus Bulletin Conference, London, October 3, 2019.
    What's more pleasant when you change distribution to have available his configuration files carefully preserved?

    When you spend time tweaking the configuration of the display server or its favourite text editor, the idea of ​​losing these famous files gives cold sweats.

    Only when we want to make a backup of these files we must do everything by hand and especially we always tend to forget some.
    This for this reason that I tinkered a little script Bash that collects your conf files and makes a nice tar.bz2 archive ready to be copied away from crashes.
    You can download the script in question here: saveconfig.sh
    This script is very easily customisation. It is divided into two sections: the first contains the commands (the script itself) and the second part is a list of files to save.
    You can add filenames as well as directories. In all cases we must give the full path from the root (/). If you indicate a directory, all its content will be copied ... so think about what you add! It may be best to give filenames belonging to the same directory rather than giving the entire directory (I am thinking in particular of the hidden directories used by browsers which contain the cache of your navigation).

    Launched as a lambda user, saveconfig.sh saves the system configuration files (in / etc, / usr ...).
    Launched in root, the script will additionally record the configuration of each "human" user (whose uid is greater than or equal to 500)
    User configuration files must be indicated using the keyword _USER_ which will be replaced when using the script by the home directory of this user (nothing very complicated, you will easily understand by looking at the list of files by default).

    Small note: saveconfig.sh does not keep the file permissions in memory ... but it is easily modifiable by modifying the arguments passed to tar and cp.
    The script needs bash, awk, tar and bzip2 to work.

    4 operating systems to turn your computer into a NAS server

    There are currently a large number of NAS server manufacturers, such as ASUSTOR, QNAP, Synology or Thecus among others, however, you may have a computer that you want to convert into a NAS server, with the aim of reusing it to give you a second life and act like a true NAS server. Do you want to know what operating systems exist to turn your computer into a complete and advanced NAS server?

    FreeNAS: one of the most advanced operating systems for NAS based on FreeBSD

    FreeNAS is an operating system based on FreeBSD, it is one of the most advanced, although it is not difficult to install and manage. FreeNAS is compatible with the ZFS file system, one of the most advanced currently, and that is that ZFS incorporates native features such as Snapshots to protect all information from possible ransomwares, allows great file integrity, and we will not need any type of driver RAID, since it incorporates the possibility of configuring RAID-Z of different levels. Once you test how ZFS works, you are unlikely to use a different file system to store all your information.





    Other features of FreeNAS are that it incorporates a large number of services installed by default, such as SMB / CIFS, FTP, AFP, iSCSI and many more, since it will allow us to install additional software as a plugin, so that we can easily install a BitTorrent client such as Transmission, Plex Media Server, and many more. It will also allow us to perform advanced backups, replication of data in another FreeNAS, and even encrypt the entire contents of hard drives with AES-XTS, which can be accelerated if your CPU is compatible with AES-NI.
    Finally, the graphical user interface of the latest versions of FreeNAS is really well maintained, with very well designed graphics, a very intuitive interface, and really fast, ideal for managing the FreeNAS efficiently.
    We recommend you visit the official FreeNAS website where you will find all the information about this operating system.


    XigmaNAS (formerly known as NAS4Free): based on FreeBSD


    XigmaNAS was formerly known as NAS4Free, but the developers changed the name of the project. XigmaNAS is also based on the FreeBSD operating system, just as FreeNAS does. This operating system can be installed on any platform that supports x64 architecture, and that has at least 2GB of RAM.
    This operating system supports most file sharing protocols such as CIFS / SMB, FTP, FTPES, NFS, AFP, and many others such as Rsync, iSCSI and more. The operating system allows you to use the ZFS file system, although it also supports software RAID, in addition, it has the ability to encrypt entire disks to protect private information. XigmaNAS can be installed on a micro SD card, flash drive or on an SSD / HDD without problems.

    XigmaNAS also allows us to install additional software, specifically all the software from the FreeBSD repositories, and we can even virtualize operating systems inside, since it has an integrated Virtual Box, that is, if you want or need to use Windows or Linux to perform some task, you will be able to install it virtualize it without problems.

    Finally, as for the graphical user interface, in our opinion it is quite simple, much simpler than that of FreeNAS. However, this graphic interface is functional and is really fast, although its design is quite old since it has been years without having a full face wash.

    We recommend you visit the official website of XigmaNAS where you will find all the information about this operating system.

    OpenMediaVault (OMV): based on Debian


    OpenMediaVault is the favorite NAS server-oriented operating system for Debian lovers, as this OMV is based on the popular Debian distribution, so you will feel at home if you have used it before.

    OpenMediaVault incorporates a graphical user interface via the web that will allow us to configure in an advanced way the main network services, such as Samba, FTP, FTPES, SSH, SFTP, Rsync and much more, and we will also have a BitTorrent client and we will even have the possibility of installing additional software, of course, software downloaded directly from Debian repositories, so the possibilities are almost unlimited.


    OpenMediaVault does not have ZFS, but it does incorporate the possibility of configuring a RAID via software. If you think you don't need all the benefits of ZFS, this operating system is a very good option to reuse your computer and turn it into a NAS server. In addition, it is compatible with Raspberry Pi and other boards, since it supports ARM architecture.
    We recommend you visit the official OpenMediaVault website where you will find all the information about this operating system.

    XPEnology: Synology's operating system on any computer

    XPEnology is a bootloader that will allow us to boot the Synology operating system (DiskStation Manager or also known as DSM), in such a way that we will have the Synology NAS operating system, in a normal and current computer, without using your hardware


    The features of DSM using XPEnology are exactly the same as on a NAS server, we recommend you access the official XPEnology website where you will find all the information on how to download this bootloader, how to install it, how to run DSM and much more.


    When we talk about Kali Linux, we mean one of the most important and best known ethical hacking suits worldwide. It offers a wide range of possibilities to users and that makes each new version make many are attentive to their news. In this article we echo thenews of Kali Linux 2019.3, as well as explain how we can download this Linux distribution.


    As often happens with each new update, whatever the type of program or system, they bring improvements. These improvements translate into new functions or tools that make the day-to-day life of users benefit. But you also have to keep in mind that with each new version, present problems are corrected.

    Kali Linux allows users to perform different ethical hacking tests. Now they have a series of novelties that make this Linux distribution even more attractive. We are facing the third update of this current version. We will comment on the most important changes.

    What's new in Kali Linux 2019.3

    One of the novelties of Kali Linux 2019.3 that we can mention is that they have started usingCloudflare CDN to host the repository and distribute content to users. This they do to improve the quality and speed of downloads.


    There are also changes regardingmetapackages. Now there is an additional and unique image called kali-linux-large-2019.3-amd64.iso.

    Kali Linux 2019.3 is not a great update that brings very significant changes, however ithas improved certain applications. For example we talk about tools like Burp Suite, HostAPd-WPE, Hyperion, Kismet andNmap. All of them have been updated to a new version and have included improvements.

    One of the significant changes in relation to applications is that it now includesAmass. It is a tool that security professionals can use to map the network and discover possible external threats. Now this tool comes standard with Kali Linux.

    For the rest, it should also be mentioned that improvements have been made in terms of failures and security errors. Corrections that, in short, make this new version safer.




    How to get Kali Linux 2019.3

    It should be mentioned that for those users who already have this distribution installed and have it updated they will not have much to do. They would simply have to run the root @ kali command: ~ # apt update && apt-and full-upgrade to make sure they have the most current version.
    For those users who do not have it installed or want to obtain the ISO for some reason, it is best to go to the official website . There you just have to go to the download section and download the version you want (64 bits, 32 bits ...).

    As we always say, it is important to download software from official and reliable sites. We must avoid doing it from third-party links that we don't really know who it belongs to and what could be behind it.
    In addition, having updated systems can bring important benefits. On the one hand we will have the most updated tools and thus obtain improvements in performance. However, security is also very important. Security vulnerabilities are corrected with each new update . Faults that can be exploited by cyber criminals and that have been patched.



    Capture The Flag (CTF in English) is a computer security competition that allows learning issues related to computer security in a fun way. These types of skills are usually of two types. The CTF of the jeopardy type have challenges that, when resolved, give us a secret text called a flag or flag . This flag is nothing more than a text under a specific format (in this case FLAG = { characters-that-are-changing }  ), and once found it will let us know that we solved the challenge. The junior CTF corresponds to this category.
    A second type of CTF is called attack-defense. In it, each team must defend a server or a network with vulnerable services from the rest of the teams.

    What is the junior CTF?

    It is an annual computer security competition in the form of a CTF aimed at people who want to take their first steps in the area of ​​computer security in a playful way.

    General CTF issues

    Categories & Challenges

    There are 6 possible categories: reverse engineering, forensics, web, SQL injection, cryptography and networks. The challenges are of increasing difficulty and the greater the difficulty of the exercise, the higher the score.

    Teams

    The challenges can be solved individually or by teams of up to 3 people.

    Platform

    Once a challenge has been resolved and the flag identified, this text should be entered on the platform where the challenges are downloaded and, if correct, the points will be automatically added to the team.

    Flag format

    The format of the flag of all challenges is FLAG = { characters-that-are-changing }  
    they are 32 hexadecimal characters. 
    The text-changing- always has 32 hexadecimal characters regardless of upper or lower case. An example FLAG would be: FLAG = {0123456789abcdef0123456789abcdef}

    Awards

    1st prize tickets to the Ekoparty and Kit Raspberry  Pi.
    2nd prize tickets to the Ekoparty and Arduino Kit.
     3rd prize tickets to the Ekoparty.
    If a winning team has 3 members, each of them will take the indicated prize.

    Requirements

    • Bring computer.
    • We recommend that you have Virtualbox installed or the possibility of booting from a USB the image of Kali Linux .
    • Be physically present at OLX Argentina to participate (Miñones 2177, CABA, Argentina).
    • No previous knowledge in computer security is necessary. It will be useful to have general computer knowledge such as Linux environment management and basic programming.
    • Not work or have worked in the area of ​​computer security or have previously participated in a CTF, given the introductory nature of the event (except for the previous editions of the CTF Junior).

    Android Apps for Penetration Testing







     Androwarn tool scans and detects harmful files in Android applications.

    Androl4b doing reverse engineering applications through the Default device is installed on the device to analyze applications.

    Mobile-Security-Framework MobSF This tool is used in the API analysis of open source applications and detect security vulnerabilities by.

    Vezir Project is an imaginary system penetration test and analysis software and malicious applications that are hacked phones.

    MARA Tool If you are interested in the field of reverse engineering this tool will do the job through your tasks.

    FSquaDRA this tool scans Android applications and detect malicious packets to the phone by reading the application algorithm.

    CFGScanDroid role of this tool is to examine (CFG) signatures for open source applications and are also detects malicious applications within devices.

    RiskInDroid Tool The role of this tool is to examine the powers of applications within the device and also to detect applications with sensitive powers that threaten the safety of devices.

    AndroTickler  A java tool that helps to pentest Android apps faster, more easily and more efficiently. AndroTickler offers many features of information gathering, static and dynamic checks that cover most of the aspects of Android apps pentesting. It also offers several features that pentesters need during their pentesters.

    Android_Penetration_Testing_script This is a shell script for automating the android Penetration testing Process