Heartbleed - Hype or Holy S#it?!

There are many articles describing the Heartbleed vulnerability (CVE-2014-0160), best summed up by this XKCD comic http://xkcd.com/1354/

In short - If the target server is vulnerable, it will return chunks of information stored in memory that it shouldn't. From a security standpoint, this is really bad. 

Heartbleed has received a lot of media attention over the last week, a lot more than what the standard run-of-the-mill newfound exploit gets. But is it worth the hype? The majority of articles on the topic covered the theory and the resolution. So what about in practice? How easy would it be to successfully locate and exploit a server to obtain sensitive information?

In about 30 minutes I had myself an answer. Turns out it wasn't that hard at all.....

---

- Locate a target server, Google "Secure login", or "staff login", or similar. They're usually protected with SSL (HTTPS).

- Confirm the site is vulnerable to Heartbleed via any number of online testing sites.

- Download and compile publicly available exploit code on your platform of choice. (Kali Linux is a good choice)

- Run the exploit against the server, then 'strings' the output, searching for anything interesting.....

# strings out | grep password
browserName=Explorer&browserVersion=8&operatingSystem=Windows&userName=██████&password=██████&x=36&y=7@

user_id=███████&password=██████&browser=Microsoft+Internet+Explorer&browserName=Explorer&browserVersion=8&operatingSystem=WindowsR4

---

Done. Valid user names and passwords straight from a "secure target server" itself.

Note: This is probably the least technical example of how Heartbleed can be exploited in the real-world. This is just the tip of the iceberg. You can bet the professional cyber-crims are all over this like nothing else, and with an arsenal of tools at their disposal.

In theory AND in practice, Heartbleed is very, very serious. If a website you're responsible for is running a vulnerable version of OpenSSL you DO need to act. If you're a user, you'll need to ensure your host isn't vulnerable, then change your password(s)!

https://shanemiller.net/

Kew's 'Free Gift' DVDs. Malware or.....?

Kew is known for a few things..... The recently passed Dancing Man, chicken parmas at the Skinny Dog, Leo's Supermarket with a fine selection of stinky cheeses, the old Kew Lunatic Asylum, more private schools than you can poke an oversized 4WD at, and now for 'Free Gift' DVD distribution..... yeah, what!?

These DVDs used to be posted into everyone's mail boxes but times are tight. They are now left in public places such as the public phone booth outside Leo's and on footpaths.

Since the rain outside means I'm confined indoors like Julian Assange at some obscure foreign embassy, I decided to finally have a good look at exactly what these DVDs contained..... *warning* Do not try this at home. I am a trained professional have a fair idea of what I'm doing.

DVD #1. Something about Myki.... with unclosed brackets!Argh!
The Myki picture on the left is just a paper print-out... nothing more...

Disc analysis:

Volume Label: LG_COMBI_RECORDER

Size: 3.94GB

All dates: Jan 1st 2007 (Faked. A news segment on disc is 30th May other content is from late May 2012.)

3x Videos (Info below)

--------------

  Disc Info:

                 dataLength: 32

                   erasable: 0

               sessionState: 3

                 discStatus: 2

                 firstTrack: 1

               sessionCount: 1

    firstTrack(lastSession): 1

     lastTrack(lastSession): 8

                      DID_V: 0

                      DBC_V: 0

                      URU_V: 1

                      DAC_V: 0

                       DBit: 0

             BGFormatStatus: 0

                   discType: 0

                     discId: 0

       lastSessionLeadInMSF: 0:00:00

        lastStartLeadOutMSF: 0:00:00

                discBarCode: 0

                discAppCode: 0

  Track Resources:

                 dataLength: 10

              maxTrackCount: 695

         assignedTrackCount: 8

    maxAppendableTrackCount: 3

       appendableTrackCount: 687

-------------------
File Listing:

dr-xr-xr-x  3 user  staff   88  1 Jan  2007 .

drwxrwxrwt@ 7 root    admin  238 21 Jun 10:11 ..

dr-xr-xr-x  2 user  staff  820  1 Jan  2007 VIDEO_TS

./VIDEO_TS:

total 8272772

dr-xr-xr-x  2 user  staff        820  1 Jan  2007 .

dr-xr-xr-x  3 user  staff         88  1 Jan  2007 ..

-r-xr-xr-x  1 user  staff     163840  1 Jan  2007 VIDEO_TS.BUP

-r-xr-xr-x  1 user  staff     163840  1 Jan  2007 VIDEO_TS.IFO

-r-xr-xr-x  1 user  staff      59392  1 Jan  2007 VIDEO_TS.VOB

-r-xr-xr-x  1 user  staff      98304  1 Jan  2007 VTS_01_0.BUP

-r-xr-xr-x  1 user  staff      98304  1 Jan  2007 VTS_01_0.IFO

-r-xr-xr-x  1 user  staff  983169024  1 Jan  2007 VTS_01_1.VOB

-r-xr-xr-x  1 user  staff  527378432  1 Jan  2007 VTS_01_2.VOB

-r-xr-xr-x  1 user  staff      98304  1 Jan  2007 VTS_02_0.BUP

-r-xr-xr-x  1 user  staff      98304  1 Jan  2007 VTS_02_0.IFO

-r-xr-xr-x  1 user  staff  983285760  1 Jan  2007 VTS_02_1.VOB

-r-xr-xr-x  1 user  staff  983148544  1 Jan  2007 VTS_02_2.VOB

-r-xr-xr-x  1 user  staff  105785344  1 Jan  2007 VTS_02_3.VOB

-r-xr-xr-x  1 user  staff      65536  1 Jan  2007 VTS_03_0.BUP

-r-xr-xr-x  1 user  staff      65536  1 Jan  2007 VTS_03_0.IFO

-r-xr-xr-x  1 user  staff  651976704  1 Jan  2007 VTS_03_1.VOB

------------------

Just a single session video disc..... No Auto-Run that launches a fake AV installer, no infected PDF files to exploit an unpatched Adobe Acrobat, nothing juicy at all!  Disappointing to say the least.

At this point I've concluded we're dealing with a crazed tin-foil hatter. Or to be a lot more specific, a 45-60yo, white male, with facial hair, single, possible mental issues (autistic?), socially stunted, preference for brown pants and cardigans, balding, walks with a shuffle, has a faded fluro-strapped backpack from the mid 1990's with New Kids on the Block on it that he stole from St Vinnies.

So let's have a look at the content of the videos:

The DVD has a basic menu for three videos. Created using some freeby DVD authoring software. Little effort put into it. I tried a few Google Image searches with this image to determine which DVD authoring software was used, no luck there. The IFO files contained nothing other than video specifications/etc.... boring!

DVD Menu. 0/5 for effort buddy.

1st video - 41mins29sec. 
ABC1 News/Lateline. 7 News - Myki segment (34min-36min). Today Tonight.
You'd think a tin-foil hatter who makes a DVD about Myki would get straight to the point. No, it takes 34minutes of random badly tracked fuzzy viewing to get to the first Myki segment on the disc.

Argh my eyes! Seriously, sort that shit out with a HD TV Tuner or something better.

2nd video - 55mins43sec
More Lateline/ABC News/Sunrise/7 News
Public transport/Myki segment (51mins-53mins)
Again, in no hurry to cut to the chase. Almost 1hr of useless crap to get through before the Myki segment....

3rd video - 18mins20sec.
Some Christian movie... Anti Satanic info, with EuroVision! Ghost scene from Channel 10. Christian cartoons. Now we're having some fun! We're off the Myki bandwagon and are on the train to Cookyville, stopping all stations!

Wonky Jesus... in the house!

Rock'n'Roll!

Bedtime reading.....

Finland at Eurovision..... 2006.

Ghost.... Some Swayze from this crazy....

A flying baby. What the serious......

@scootaworks on Twtter points out that the disc volume label indicates the DVD was most likely made with a standalone LG DVD player. A little bit more research comes up with something like this: http://www.lg.com/ae/home-entertainment/video/LG-dvd-combi-RC388.jsp Consistent with the dodgy production values of this disc.

Conclusion: 

These DVDs that I picked up are harmless to your computer, the same can't be said about their content to your brain. There is some fairly bizarre stuff on them. My best guess is that some warped nutter has a message he wants to distribute to the world..... and optical media is the method to his madness.

With the rapid demise of optical drives, Cooky McSpaz will soon need to move to USB keys (handy to erase and re-use!) or take 'to the cloud' and go with a pure digital distribution method..... given he can't even figure out basic video capture, editing, and DVD authoring, I think we're pretty safe this won't happen any time soon.

So my recommendation for finding media? Just bin it....... or.....