BackBox Membership, now open

Online subscriptions to our association are officially open. Click here to join us.

Becoming a member of our association will make you part of a group of people who share the same interests and whose goal is to promote and encourage the availability of cutting edge open-source security-oriented technologies. The small subscription fee enables us to keep on improving our Project and to plan official BackBox events.

Benefits of registered/paid membership:

  • Direct interaction with the BackBox core team to get support
  • Test and participate on the new BackBox beta release and new tools
  • Discount and vouchers for events and training courses
  • Access to the list of available job offers
  • And much more…

The price for the membership is €10.00 per Year and, if you join now, your membership will be valid up to december 2018.

Join the BackBox Community and be involved in our ambitious project!

False CVE on BackBox 4.6 unmasked

A member of BackBox community brought to our attention the existence of CVE-2017-7397 asking if it were an actual vulnerability.

Short answer: No, it’s not.

Long answer: Here follows our analysis.

We started by taking a look at CVE requirements for new CVE submissions (http://cve.mitre.org/cve/request_id.html).

We noticed that CVE registration requires that the vendor should be notified of the issue raised. Yet, no one, neither the author of the exploit (FarazPajohan https://www.exploit-db.com/author/?a=8879) nor the person who claims to have exploited the system (Hosein Askari), did attempt to get in touch with us in relation to this discovery.

Having found his personal email, we approached Hosein Askari, the person who claimed to have exploited the system, asking him to prove what he stated in the CVE. So far, we haven’t heard back from him.

Said that, our team has worked to test the exploit in order to confirm whether the statement published at the following link were true or false:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7397

Having clear in mind that our first and only interest is to test the CVE, we set up our target virtual machine running BackBox Linux v4.6 (the “vulnerable” version, according to the CVE), ready to perform all kind of tests to be sure that we leave no blank spaces.

On the attacker’s side, we downloaded the exploit from https://www.exploit-db.com/exploits/41781/ and compiled it with gcc. Once we got the binary, we executed the exploit against the target VM.

In the meanwhile, we monitored the health status of the target. The target VM didn’t feel the CPU consumption claimed in the CVE, rather it was in quite a healthy state.

We have performed several additional tests, both on BackBox 4.6 and the latest stable release 4.7. The result was absolutely negative: the system did not suffer any impairment, no crash occured and no anomalies in the CPU consumption/usage were detected.

Given our results, we have opened a dispute with Mitre (which you can find in the CVE page now) to declare the author’s statement to be untrue, with no foundations and no proof of concept. Moreover, the author even recycled an old exploit, which can be found here: https://www.exploit-db.com/exploits/41350/

Reading his description of the CVE, he refers to RFC1812 section 5.3.7. However, taking a look at RFC1812 section 5.3.7, it is specifically about routers. Below a snippet from the Introduction of https://tools.ietf.org/html/rfc1812 :

[...]
This memo defines and discusses requirements for devices that perform
the network layer forwarding function of the Internet protocol suite.
The Internet community usually refers to such devices as IP routers or
simply routers;
[...]

In conclusion, we state that the CVE-2017-7397 is completely false and based on imaginary assumptions, without any proof of concept. We have asked MITRE to revoke this CVE, marking it as false record.

We would like to invite anyone, including the author, to prove us otherwise. Also, we remind everyone that we are a Free Open Source Software Community and as such we will be delighted if someone will report us bugs and/or vulnerabilities on our system. In the end, this is what a community is made for.

Happy Hacking!

BackBox 4 kernel stack up to date

Ubuntu systems already have LTS enablement stacks that provide newer kernel and X support for existing Ubuntu LTS releases. As we all know, BackBox core system is built on Ubuntu system and therefore the same principle can be applied.

For those who are impatient and want to upgrade the kernel stack with their current BackBox 4.x to the latest available, you can follow the instructions below:

$ sudo apt-get install --install-recommends linux-generic-lts-xenial xserver-xorg-core-lts-xenial xserver-xorg-lts-xenial xserver-xorg-video-all-lts-xenial xserver-xorg-input-all-lts-xenial libwayland-egl1-mesa-lts-xenial

And we are all good just like that!

The full description for Ubuntu systems can be found at https://wiki.ubuntu.com/Kernel/LTSEnablementStack (Ubuntu 14.04 LTS – Trusty Tahr)
If any issues occur, feel free to get in touch with BackBox Community where you will have support.