OptimizePress–0day in Wild

I know many of you use OptimizePress, but there is an unauthenticated file upload vulnerability with the code which essentially means a hacker can upload code to your server and have that code be executed. Disabling the plugin will not do you any good, but adding an .htaccess rule to protect your /wp-content/themes/OptimizePress/lib/admin/ should reduce the risk, but I’m not sure if it will break all your landing pages. Deleting the file “media-upload.php” from that same directory will give you the most surety to removing the vulnerability while keeping your existing landing pages working.

Note that the original exploit code was posted on PasteBin on November 21st, and it appears that sites have been exploited already.

Stay safe out there!

Changing Scope

My personal blog will now be focused on tips as it relates to entrepreneurship. While brainstorming topics to post about, I’m thinking about productivity, learning techniques, quantified self lessons, startup life, and of course cyber security. Speaking of cyber security, I will likely have a cyber security slant to everything I post about as that topic is still a passion of mine.

Sign up for the newsletter to make sure you are getting all of my tips.

Google Alerts–RSS no more

We all knew that Google was turning off the Reader application today, but what I didn’t know was how it would effect me as I still use a stand alone RSS client/application. This morning when reviewing my daily feeds, all of my Google Alert feeds had a no longer in service message!

So I logged into Google Alerts to double check and I was greeted with this message:google-alerts-rss-no-more

 

Luckily there is another service that will assist us from talkwalker.com. The interface feels exactly like Google Alerts, and they even can import the csv file generated from the Google Alerts export feature! Migration was as simple of a few clicks for myself and the most time consuming piece was pointing to the new feeds.

So far the results seem to be accurate when doing sample tests which is certainly a good thing.

In general, I hope this is not the trend of RSS dying as it is a super useful mechanism for users like myself.

I’m still looking for a good solution to Twitter’s death of user and search based rss feeds as well if anyone has a suggestion.

Amazing Two Months

The last two months for me has been crazy and amazing at the same time. I launched another company named “Godai Group” and released a whitepaper that myself and Peter Kim did research on for the last year on “Doppelganger Domains”.

Wired.com was the first major news group to write a story on and it blew up from there. On that single day it spread to numerous sites in the United States such as CNN, Slashdot, MSNBC, and GCN. I expected the story to go big because of the wide implication and impact of the issue of Doppelganger Domains, but what happened next was a pleasant surprise. The story went international and spread to the United Kingdom, Australia, Japan, India, Russia, China, Canada, and many other areas! And from there radio and print wanted to run a story as well which was quite a fun experience to interview with them and get the research out to another set of audience. This whole experience was great, and I’m thankful to all the various media outlets that carried the story. I hope that businesses take it seriously and take action.

For now, I want to get back to producing and hold off on putting on the PR hat again for a little bit.

China Trip Reflection – Part 1 – Gear

I just came back from a two week trip to China, and I wanted to share with you my thoughts on what worked and what didn’t work in terms of gear that I brought.

What worked

  • Duffle bag used for short overnight trips. The majority of the trip was in Shanghai, but I took two, two-day side trips to Hangzhou and Nanjing. If I were to bring my big suitcase with me, it would have been somewhat of a hassle on the train as the overhead area isn’t that deep.
  • 26” suitcase. I knew I was going to buy things while out there, but I didn’t know how much extra space I needed. The 26” suitcase felt really empty on my way out there, but on the way back it was the perfect size for everything I brought back home. I didn’t extend the suitcase either, so there was still room to spare.
  • Lowepro Versapack 200 AW – I took this bag everywhere with me. The top compartment was large enough to store all the non-camera stuff I needed for that day. It also was able to hold all the various items I bought while on the trip. The bottom section took care of my DSLR and other camera related items. Backpack straps and design made it comfortable to use throughout the trip.
  • R-strap for my DSLR camera. This strap is much more comfortable and easier to use than my op/tech strap.
  • Vitamin C. I took 500mg pills and lots of cough drops with me. Thankfully, I never caught a cold out there.

What didn’t work

  • Bringing smaller US currency. You will ultimately exchange it all, so why bring smaller bills? Maybe a few dollar bills is fine, but no need for $10 or $20s.
  • Original Sonicare toothbrush /w power converter. I love my Sonicare toothbrush, and I brought it with me. The one downside to the original model is that its only rated for 120 watts so I needed a power converter to recharge the device while in China. For whatever reason, it never fully charged which resulted in one session per a several hour charge. This wasn’t a huge failure, but I did have to bring the charging station with me on the side trips. If the device was able to hold a full charge, I would have been one item lighter while on the side trip. I think the only solution here would be to buy the newer model.
  • Wallet designed for US currency. The RMB is a bigger than the USD so my wallet never closed properly.

What I should do or buy for next time

  • Electronic translator. Either a dedicated one, or an ipod touch /w an app. Not being able to speak Chinese in certain areas where nobody speaks English makes things difficult.
  • Emergency items in case I miss a flight. Because of weather issues in Shanghai, I missed my original flight home and ended up staying an additional 10 hours in Hong Kong. Since I already checked my suitcase, I didn’t have much with me so perhaps bring a change of clothes and some various toiletries with me in the case I’m stuck somewhere.
  • Bug spray? I probably got bit over ten times on my body, and I think on my last trip out there, I got bit several times as well.

Overall, I think I did fairly well in terms of gear that I bought on this trip. Next post will have a bunch of pictures from the trip. I just need to process them first.

Nessus Tools: HTML reports revisited

On a recent engagement, I noticed that people were wasting time scrolling through nessus reports to find vulnerabilities in which they either need to confirm, or dig into deeper. There were many findings that would automatically be written up because there is nothing to further exploit, and the supporting information in the output was good enough. And of course there is informational things in the report like traceroute output, ping times, mac address, operating system, etc. Good information to have, but not really needed while in vulnerability assessment / penetration testing mode.

I really needed something to just show me the interesting things to focus on. Since I had all the nessus data in a database already via nbe2sql, I quickly wrote some sql statements and parsers to solve my problem and make a pretty report.

The latest release of the nessus tools has two more html reports.

  • One script is called report_auto which generates html that contain findings to simply write up. For each vulnerability type there is a table with IP and supporting information columns. 
  • The other script is called report_manual which generates html that contain findings or information to pursue.

Do note that only a handful of nessus pluginid’s are supported in the script. If you want other checks included please provide me with some sample data and I will get it included.

Code:

I do hope that others find these additions useful. I really hate it when testers have to spend time on low level findings. Yes they still need to be looked at and written up, but testers should be focusing on the interesting stuff.