False CVE on BackBox 4.6 unmasked

/in

A member of BackBox community brought to our attention the existence of CVE-2017-7397 asking if it were an actual vulnerability.

Short answer: No, it’s not.

Long answer: Here follows our analysis.

We started by taking a look at CVE requirements for new CVE submissions (http://cve.mitre.org/cve/request_id.html).

We noticed that CVE registration requires that the vendor should be notified of the issue raised. Yet, no one, neither the author of the exploit (FarazPajohan https://www.exploit-db.com/author/?a=8879) nor the person who claims to have exploited the system (Hosein Askari), did attempt to get in touch with us in relation to this discovery.

Having found his personal email, we approached Hosein Askari, the person who claimed to have exploited the system, asking him to prove what he stated in the CVE. So far, we haven’t heard back from him.

Said that, our team has worked to test the exploit in order to confirm whether the statement published at the following link were true or false:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7397

Having clear in mind that our first and only interest is to test the CVE, we set up our target virtual machine running BackBox Linux v4.6 (the “vulnerable” version, according to the CVE), ready to perform all kind of tests to be sure that we leave no blank spaces.

On the attacker’s side, we downloaded the exploit from https://www.exploit-db.com/exploits/41781/ and compiled it with gcc. Once we got the binary, we executed the exploit against the target VM.

In the meanwhile, we monitored the health status of the target. The target VM didn’t feel the CPU consumption claimed in the CVE, rather it was in quite a healthy state.

We have performed several additional tests, both on BackBox 4.6 and the latest stable release 4.7. The result was absolutely negative: the system did not suffer any impairment, no crash occured and no anomalies in the CPU consumption/usage were detected.

Given our results, we have opened a dispute with Mitre (which you can find in the CVE page now) to declare the author’s statement to be untrue, with no foundations and no proof of concept. Moreover, the author even recycled an old exploit, which can be found here: https://www.exploit-db.com/exploits/41350/

Reading his description of the CVE, he refers to RFC1812 section 5.3.7. However, taking a look at RFC1812 section 5.3.7, it is specifically about routers. Below a snippet from the Introduction of https://tools.ietf.org/html/rfc1812 :

[...]
This memo defines and discusses requirements for devices that perform
the network layer forwarding function of the Internet protocol suite.
The Internet community usually refers to such devices as IP routers or
simply routers;
[...]

In conclusion, we state that the CVE-2017-7397 is completely false and based on imaginary assumptions, without any proof of concept. We have asked MITRE to revoke this CVE, marking it as false record.

We would like to invite anyone, including the author, to prove us otherwise. Also, we remind everyone that we are a Free Open Source Software Community and as such we will be delighted if someone will report us bugs and/or vulnerabilities on our system. In the end, this is what a community is made for.

Happy Hacking!

BackBox 4 kernel stack up to date

/in

Ubuntu systems already have LTS enablement stacks that provide newer kernel and X support for existing Ubuntu LTS releases. As we all know, BackBox core system is built on Ubuntu system and therefore the same principle can be applied.

For those who are impatient and want to upgrade the kernel stack with their current BackBox 4.x to the latest available, you can follow the instructions below:

$ sudo apt-get install --install-recommends linux-generic-lts-xenial xserver-xorg-core-lts-xenial xserver-xorg-lts-xenial xserver-xorg-video-all-lts-xenial xserver-xorg-input-all-lts-xenial libwayland-egl1-mesa-lts-xenial

And we are all good just like that!

The full description for Ubuntu systems can be found at https://wiki.ubuntu.com/Kernel/LTSEnablementStack (Ubuntu 14.04 LTS – Trusty Tahr)
If any issues occur, feel free to get in touch with BackBox Community where you will have support.

Hacker by trade: Simulation of a Penetration Testing

/in

JEToP – Junior Enterprise Polytechnic University of Turin
Wednesday 13th April 2016, 09:00 – 19:00

Shielder is proud to announce an event that will be held at Polytechnic University of Turin

The purpose of this event is to offer participants a quick and charming introduction to the complex world of Information Security and Penetration Testing.

A Penetration Test in simple words is an attack on a computer system that seeks for the weaknesses of the target system, which can potentially let malicious users (attackers) to gain access to the system’s data by taking control of it.

The idea is not to introduce people (participants) how to attack systems but rather allow them to be able to identify the weaknesses and vulnerabilities that their systems are affected by. To allow everyone to protect their system and avoid any kind of unpleasant incidents such as unauthorized access, data loss/steal or permanent access by third parties. The event is mainly organized to this end.

While an attacker will need to find just a single vulnerability to be able to compromise a system (that is all he/she needs in the other end), a Penetration Tester thinks wider and tries to find the maximum number of vulnerabilities and weaknesses – possibly all – that an attacker may use. Once all the test is been actioned/performed, a Penetration Tester will have to report all the vulnerabilities discovered on the system and give guidelines to his/her employer (company) about how to fix such security holes to improve the companies (or even its own) systems.

During this organized event the following topics will be covered:

  • Introduction to Penetration Testing
  • Live vulnerability assessment, analysis and management of a target system (LAB)
  • Live pentest (attack) following the findings and vulnerabilities reported (LAB)
  • Mitigation of vulnerabilities
  • Question/Answer session and Free Talk

In order to facilitate this event we will be using BackBox Linux which one of the world’s notorious Penetration testing Linux distribution. BackBox has a collection of tools that are designed for both professional and passionate Pentesters. BackBox is a Free Open Source Community and therefore it is freely available and it can be downloaded by everyone from the official web site “https://backbox.org/download”

There will be 2 coffee breaks during the event (one before the lunch and another one after lunch). At the end of the event, the organizers are thinking of moving to Einaudi 57 for a drink, where anyone is invited to meet the guys working at Shielder and have a chat with them.

Don’t miss it!