Category: security

There are many things I did not put into my CV. It is hard to explain, to present to others. Sometimes I can not find words. And also by night, I become a different person (Dr. Jekyll and Mr. Hyde). Not sure how to organize topics - by area or year. I think the year would be fine.

1998-2003

Most ISP (Bosnia and Herzegovina) have been hacked(from my side) and reported to them (it was a weird thing to explain ppl that they have a bug, issue, security issue, to update things, etc). From my bag of tools goes:

• Mysql without a password but root/toor and qwerty or 123456789 for SSH/Admin page
• RPC that has a format bug (RH 6.0)
• default password, default users
• not having blocked NetBIOS (but even if they put password there was a way to crack that because of a flaw)
• Huh and others
• RE my fav app: System Mechanic. I learned about approx 30 days how to crack this app. Later same skills I used to crack the app and find how they work. Connect with other security people.
• cracked several encrypted texts (Ceasar, viegner) with statistics and logic
• Build the first game in Visual Basic with minimum information(one book for VB) and reverse engineering (mind experiment, thinking)

2004

My first bank job. I got a position as an IT technician. I got hacked ATM - and reported it to the bank (the security officer was my good friend from high school). The same situation is still present in most Bosnia and Herz Banks. SMS banking - they start to apply new SMS banking and also pay through SMS. I demonstrate an issue with local telecoms - spoofing SMS and sending money to other people's accounts. They stop to plan SMS banking in this direction. First war game server. It was fun. I did play later more than 2 times: at BalCcon, and at Ericsson.

2006

The web application at government, police, and telecoms - I did send an email but they did not read or they promise me I to get jailed. SQL injection, non-authorization, bad permission for accounts, etc.
I did not care what they think - I told them they can do that - but at that time Bosnia and Herz did not have a law on that - so it was funny. They did not get the idea of how this information was good for them. They saw me as a danger and risk to them.

Made some videos for Youtube in 2006:

(irssi, Slackware, and 4 computers, direct connection to the net)

2007

A lot of hacking, and a lot of playing with networks, and systems. The found issue in PPPoE and how to crack any wifi at that time in Bosnia and Herzegovina. It was funny - I send a report to one big WIFI ISP. Found that people massive use admin/admin on some ISP - I automate the gathering of this info and send a report to ISP. Later I hack several times their servers and report them to them. Last my hack was SQL injection and report it to them. They respond with "does not matter, no one besides you would hack us" - this was a failure. Later in 2008, happen several hacks of this ISP and 10k users' DB was "shared" over the net. We found bad guys but the police did not have the law on this and how to handle the situation. So they left them out.

2008

Busted first spam king in Bosnia and Herzegovina. He was using several ISP and dumped my email from some DB to send me spam. He did it wrong. I found him - reported and give info to ISP. They did the next steps. Also, half of my friends and non-friends have free internet. I found a way to get a free net each time I hack some ISP to give me 1 year or more free net. So I share it with people. Main domain name register for domain .ba - SQL inje. Reported - they switch to using rewriting to URL. The code is still there with bugs.

2009

Start to examine a global threat - people, tools, operations. From organized crime groups, and state-level hackers to small-script kids. It was fun to watch criminals, police, and FBI agents how they play games. In the end, I gather a good base on how things go underground. From OSINT skills to satellite hacking. Develop the first symmetric algorithm that I would cryptoanalysis in 2012 and find an issue. Cracked Cyber Command hash as part of the challenge. I was the 9th person who did that.

2010

Hacked 2 banks in Saudia Arabia as part of the pent-testing contract that I did have with one company. My NDA was finished so in short: bypass some security(not sure to say but it was Gmail security at one side that block PDF with exploit code and after execution, RAT is downloaded&executed PC ), plant RAT, gather info, print screen, write a document(they did have more SQL inje, non-auth URL access, and others) and get money from the client. I did get an offer later in 2013 but I refuse. Simple for me this was fun. For them, it was a job (and not fun at all) + with the money I got. The local CyberCrime unit refuses my CV. Later in front of them(this Cyber Crime unit), I would be offered a job by the FBI but I refuse. (later in 2012, I would give some tips on this)

2011

First, a remote job. Later I got one more. The second one was Ipercast - I found a lot of security issues (ex PHP shell execution and gathering info about clients, files, etc )

2012

I start to work for the best company in the world. Ipercast. They are the first CDN and from them was made Akamai. Bussines unit that was in Bosnia and Herz. was planned to be closed because of financial issues. With my own skills and directed by my CTO Alexander - we bring one solution that saves 25 jobs positions. The solution would be used by Vodaphone Germany, it would bring a lot of cash and a similar approach would be used for RAI Italia, Sony Germany, and others. Manipulating on the low level with streaming for different protocols (RTMP, HTP, RTPS, others). I started a project(for one NGO): Streaming. It included a special type of streaming and security. It was a combination of many things. My NDA was ended now. Later by this year, I was approached by people from the Cyber unit and FBI to work for them. I demonstrate skills that at that time were advanced for these units and organizations. I refuse because: I did not want to do what other people want me to do + I was working for the best company in the world with the best position in the world. My job offers me freedom, travel, and combines all my skills. I was paranoid and at some point, they start to follow me, read my email, read my chats - this was exposed when we met - I told to FBI that it was wrong to read my emails, and chats, send black van (I made a picture of a black van, you can ask Milos - BalCcon organization. He saw and he was laff at that time), agents, etc and local police follow my IMEI and position as a local secret agency follow my traffic (I found how things go from the law, technical specification, how they manage - complete picture). Also, I did show a picture of the FBI van to people who organize BalCcon (Balkan Security conference) 9 months before this happens(only proof for now). They laff. Everyone laff at that time. But not me. I am still paranoid. News and some insider got the wrong information. I spend the next 4 years removing this title and text through cyberspace. It was wrong and not ethical at all. Bosnia and Herz do not have any laws to prevent similar situations. https://web.archive.org/web/20170926234049/https://www.nezavisne.com/novosti/hronika/U-akciji-FBI-ja-uhapsen-haker-Vladimir-Cicovic/171278

2013

My company tries to get a server with a domain in China. I found the issue after my sysadmin team tries to resolve it with no success: It was a China firewall that works on the domain level. It was fun. I put all my effort to help a group of people to fight against the first information warfare - anti-vaxer propaganda. I gather information as part of a group, and find weaknesses inside false news distribution - but the government in Bosnia and Herz did not want to know this. As also the cyber unit as also the Ministry of Health and CERT RS. The first victim, a baby, who did not get the vaccine to stop some nasty thing was to die 2 years later because their parents got influenced by this false news. This continues in 2020 - and the government does not have a proper reaction - instead, it getting more worst especially because people are not able to take critically thinking on the topic.

2014

Flood. Bosnia and Herzegovina. I help the local Red Cross to use automatic sending text on all numbers for volunteers with one button. I found a way how to organize communication in parts there was no electricity. Also, use the normal distribution to find how many there are baby and diabetic patients in the flooded area. My CTO did have an issue with Gmail. I troubleshoot and found that Gmail has issued 4 days before they were put into the board as an official issue. I try to contact them. Also later I would find a security issue with their emails that still exist. If you see a green icon (for TLS secure email sending) it was me. Still - they can not handle how email arrives at them or goes to other SMTP - in other words, all emails you send are not secure they are open to reading whoever intercepts them.
One of the largest DDOS attacks on local TV stations and finding a person who did this also found a solution to stop the current one. In this case, local CERT RS also Cyber Unit - did not find a way to help local TV stations. I did ask them to involve me in this kind of case - they never did. Discovered that MTEL telecom ISO27001 - before they apply to the public. I was using a private URL when they accessed it. In other words, they can follow what and when someone visits through this ISP.

2015

Told the Bosnia and Herz. Ministry of Security for "top security software for encryption messages" - not to use because it has a flaw. They did not respond to this. They don't know what to do. Offered help to local Cyber Unit for solving the case of encrypted hard disk - simple, unofficial channels I send the query to allow me to crack password for encrypted hard disk. They refuse. Why? You need to ask them. For me, it brings fun and intellectual challenges.

Hunted Islamic State through the internet. Find them all that makes propaganda war against Bosnia and Herz government. Found names, locations, and profiles - and report them. After one month of spreading fear to citizens - I got a little bit angry about this. The only reason why this happens is they get me angry as also the government that spends millions of euros on software and weapons and has no chance to find people over the internet. Find IP (first email on the picture) and 1-2h later full name, location, and other information.
I got a response from the Ministry of Security (thanks, and in a live TV conference he mention "We got help from a hacker that hack banks" - like there are 1000 of them in Bosnia and Herz. It was scary at the moment. I was hoping this will stay in the shadows) Email that was sent at that time:

2016

Moved to Amsterdam, and meet Dutch hackers. Learn new things.

2017

I got an interview with Facebook and Google(Ireland - not California). Reject interview for Google after failing the Facebook interview(Got 2 programming task, simplest one - fall both). In the end - I did not see myself inside that kind of company. I love algorithms, programming, math, and puzzles - but simple I don't see myself in that kind of company. Only I promise to myself - if any day in the future I want to go - it would be booking dot com. I forget to mention I fall an interview with booking dot com in 2015. Face-to-face interview. Simple I did not prepare myself and the persons who interview me - did not get my idea correctly. It happens (I did not present small detail and the complete troubleshooting question goes in the wrong direction)

2018

Someone send anonymous mail to one of the judges as a threat - I asked again some politicians to help this Cyber Unit to identify the person who did this. From my perspective - it was possible for even a person to use a proxy and hide very well (from information that I read from the news).

2019

Start working for ZenDev and Ericsson as a consultant.
(found bugs in ssh of Ericsson router - "it is not our job". Ok)

One person tries to blackmail the woman for her photos (she sends them to him, a romantic affair) to send to her husband. Options to inform the police or the real husband were not good at all. (kids, marriage, too much newspaper) I exploited that he (the person who blackmailed) did not know a real husband. So I called this person yelling, threatening to call the police, and told him that I forgive my "wife". He got a message and leave the poor woman alone. (this happen in Bosnia and Herzegovina FYI - and I was using Viber with a number from Bosnia and Herz - so he could not notice my location)

2020

0wned some tweeter bots from local Bosnia and Herz. CERT (they mess up with keys) - reported to them as part of ethical hacking.

Srdjan Rajcevic, at that time the main person in the Ministry of Scientific and Technological Development, Higher Education and Information Society - false some massive retweets - and he and his personal "bots" (people that support him and pay as well for that) put a false story that behind this "massive RT" was me. I was of course laff - it was not me and the tools they use is a marketing tool that promotes tweets (more RT, more rank on google). I did notice until 23h that evening - someone was systematically searching me through Google, going over my profiles (GitHub, Facebook, blog post, and this blog, etc). Then I get alarmed. Returned complete the day starting from 8 in the morning so I got this:

• 8 am Srdjan google me with his iPhone, from home and his wife also (from an Android phone)

• 9 am The chief of his cabinet or someone else - google me, view my personal blog

• On 16 that day he state that he know who did this "attack" (it is not an attack and every person was laff in this from the IT sector in Bosnia and Herz) (https://www.klix.ba/vijesti/bih/iz-vlade-rs-a-se-pozalili-da-lazni-profili-napadaju-njihove-naloge-na-drustvenim-mrezama/200415125)

• 16:30 Police from Bosnia google me (they lack "security of operations")

• At 21:30 there was IP. .. from Stockholm. It was a domain of the Swedish police, "whois records". I check - it was really them.

Also notice that Srdjan R. has iPhone, iTablet, and Mac laptop. Later I will get information that one company doing this to all people in the government of R.Srpska. (name of the company, it is connected with the most winning solution for government proposals)

Crap. But then again - I did not do anything and thank the high power of the internet - complete my traffic is "captured" or "followed" here in Sweden - so even if they try to check they can see that it was not me. So I got relaxed. and laff on all this. Forgot to mention - I am using the internet to harvest information about who is harvesting information on me. I called contra-OSINT and I am doing this since 2008 when my paranoid nature starts.

Also: "DDOS attack" on journalist: https://www.infoveza.com/milan-curlic-curla-iz-banjaluke-prijetio-nasoj-redakciji/ - I found this person. He believes that anonymity exists :)

2021

One of my friend got death threat https://www.gerila.info/novosti/drustvo/banjalucki-komicar-mirko-komljenovic-prijavio-da-dobija-prijetnje/ It was the same person from the upper link "DDOS attack"

Later in 2021, there was a scandal of blackmailing a young politician with his private video. No one in the media published but the video was "viral". Actually, he has more than one video and this group of people (yes, they are identified and reported to the police - no one did take any steps to bring this person to justice. Why? Ask the police) Send a note to him that I want to help and RNR starts (all this was done by law and nothing was illegal in this process - that is more fun): - removed 5-6 domains and WordPress (wordpress.com tnx to these nice people) - block emails (tnx to Yahoo admins) - recover the true identity of these people - find start point where to go (the person who was blackmailing the victim used his real CC to pay domain) So in the short idea was to block all content (there were 2-3 new videos that did not get in public) and because I removed them several times - all news got removed as content and they start from the beginning. So people lost interest in this type of page and did not follow it (they changed all the time domains with new but they did not become viral as with the first video) and blackmailers get issues setting up new domains and blogs as emails also (they are not so technical skilled people)

Got "thank you" in a live tv show from the victim: https://www.youtube.com/watch?v=_CDgudFisCc

2022

Find some person who sends a death threat to some official https://srpskainfo.com/srpskainfo-donosi-detalje-hapsenja-mahmutovic-priznao-da-je-prijetio-kojicu-foto/

Made some inspiration for the new generation https://www.youtube.com/watch?v=sjimiYjYzGk (all mentioned things are old or legal - but also if you do not get caught then it is ok hahaha joke. no illegal things)

2023

I have all passwords: https://github.com/vladimircicovic/wifi_pass

Maybe is time to start a security carrier.

Ovo je kratki pregled sadržaja baze koju je nepoznata osoba skinula sa sajta lakodoposla dot com i ujedno savjet kako da osigurate tudje i svoje privatne informacije. Ovdje će izostati analiza šifri (karakteristike, frekvencija, duzina, ostalo) koja bi trebalo da bude u narednom periodu a i ujedno će sadržaj biti u Wifi pass fajlu

Baza se pojavila prvo na jednom od reddit subova, tj skrihshoot a poslije nekog vremena i link ka kompletnoj bazi.

Šta se nalazi u bazi?

Baza sadrži informacije o poslodavcima i radnicima koji traže posao. Jedan dio se odnos na komunikaciju izmedju administracije sajta i poslodavaca gdje se vrši plaćanje usluga. Svi skupa imaju sljedeće informacije: ime/prezime, email, šifre, adresa/ulica/grad, broj telefona, datum rodjenja.

Slika zapisa baze

Baza sa korisnicima počinje nekad od 2008 godine a posljednji unos/izmjene su 28 Jula 2022 u 02:21

Informacija o datumu kreiranja zadnjeg naloga je jako bitna kao i broj kreiranih naloga ukupno i vremenski period.

Baza sadrži oko 510.000 zapisa radnika. Od toga je u 2022 godini registrovano 10.000.

Kako su došli do baze?

Baza je vjerovatno skinuta sa nekim od alata (sqlmap, sqlninja i slično) a preko buga u sajtu (vjerovatno SQL injection). Napadac je vjerovatno onda prebacio u svoj phpmyadmin pa dumpo/izbacio bazu u sql fajl i okacio na jedan od foruma. Razlog je gledanje informacija iz baze (tražio je kartice, pristupne šifre, mailove i drugo) U ovom teksu se neću baviti propustima i ovo sve navedeno je nagadjanje u nedostatku informacija.

Kako ne raditi sa privatnim informacijama

Ovo je najbitniji dio teksta i ovome sam želio pisati. Ovdje ću tek nekoliko osnovnih i bitnih stavki vezano za sigurnost napomenuti. Ima ih još pa čak u narednom periodu planiram preduzeti neke korake kako bi se generalno stanje na ovom polju u BH/SRB/CG/HR počelo mjenjati.

Trajanje zapisa privatnih informacija

Svako kreiranje naloga treba da ima kada je osoba zadnji put se logovala. Iz te informacije treba izvršiti da poslije 90 dana neaktivnosti šaljemo korisniku email upozorenja a zatim ako nema odgovora - brišemo iz baze. Sa ovim pristupom od 510.000 privatnih informacija, šteta bi se svela na svega 2000 do 4000 naloga.

Kvalitet šifre + 2FA ili čak OAuth2 identifikacija

Sve šifre se čuvaju u nekoliko formata: plain text, wordpress hash(wp hash) i bcrypt hash(bcrypt). Sajt lakodoposla nema minimum duzine (idealno 12 do 16), miks slova, brojeva i specijalnih znakova. Prilikom kreiranja naloga šifre kao "12345678" je moguće unijeti. Takve stvari su nedopustive.

Sajt takodje nema 2FA (izuzetno lako integrisati sa freeOTP) koji bi u slučaju pogadjanja šifre moguće je sačuvati pristup sajtu (pod uslovom da nema curenja baze i slično). Čak i ako se koristi ista šifra za različite sajtove 2FA pravi ogromnu razliku.

freeOTP logo

Sljedeći iz ovog arsenala je OAuth2 protokol koji može da posluži za registraciju i pristup sajtu. Sa SSO (single sign-on) korisnik može autorizovati sajt da preuzme informacije i kasnije da pristupi istom tom sajtu. Ovdje se ne mora posjedovati šifra - sve se čuva u OAuth provajderu a minimum informacija koje sajt treba da ima su email, ime i prezime, ostalo.

OAuth2 - slika preuzeta sa InterSystems Learning Services youtube kanala

Minimiziranje dijeljenja privatnih informacija i skladištenja u bazi

Imamo nekoliko bitnih privatnih informacija koje moramo držati u bazi a sve se mogu redukovati i smanjiti negativni uticaj curenja informacija. Ovdje pričamo o ime/prezime, email, broj telefona, CV-iju, tekstualne poruke.

Ime i prezime: redukovati na samo ime sa početnim slovom prezimena. Apsolutno nebitno poslodavcu a u komunikaciji kasnije moguće je saznati.

Email: Ukratko moguće je u bazi drzati email koji je povezan sa korisnikom i loginom, a da pri tome ne držimo pravi email. Slanje na ovaj email bi mogao samo servis zbog informacija/resetovanja i slično. Samim tim bi npr imali 9dc3242cd523367c2296afbc65520f29@domena.com gdje bi na email serveru identifikacija za 9dc3242cd523367c2296afbc65520f29 bila prema ovojenekimail[at]gmail dot com. Naravno, ovdje se može smanjiti veličina hasha, uzeti neki drugi koji pruža bolju sigurnost (argon2id, scrypt, PBKDF2) i napraviti format koji je pogodan za email adresu.

Broj telefona: Ako postoji mogucnost izbaciti skroz. Ako bas se mora implementirati onda bi jedinstveni ID bio u bazi a pravi broj bi se čuvao na drugom mjestu i informacije slale kroz REST API.

CV: Izbaciti sve privatne detalje, imena firmi - kasnije je moguće poslati zainteresovanom poslodavcu puni CV sa detaljima. Ovdje bi trebalo da sama firma koja vodi sajt pregleda isti taj CV i ukloni isto sve privatne detalje radnika i firmi.

Tekstualne poruke: Godina je 2022 i vi dalje vjerujete da vam niko neće sem vas samih čitati poruke? Public key, moguće je šifrovati poruke i držati ih kao takve u bazi i za svaku sesiju / tekst imati ključ koji se opet čuva sa master ključem / privatnim ključem (ovdje treba PKI al ideja je da se poruke ne ostavljaju u otvorenom tekstu). Uglavnom: ne ostavljajte poruke u bazi u "otvorenom tekstu"

Zaključak

Ovaj incident je samo "demo" sajtova u SRB/HR/BH/CG/MK gdje se ne vodi računa o privatnosti korisnika. Samo da je ispoštovano pravilo 90 dana il manje - uticaj ovoga bi bio redukovan sa 510.000 zapisa na 2000 do 4000. Pričamo o brojevima telefona, email adresama, datumima rodjenja, punim imenima i prezimenima oko pola miliona ljudi. Ovakve informacije se mogu koristiti za dalji napad, uznemiravanje ljudi, preprodati ili zloupotrebiti na druge načine. Sajt se nalazi na Linodu u USA - isto nedopustivo kada znamo da informacije gradjana Srbije treba da budu u Srbiji. Nisam spominjao standarde, penetration testing, hardening sajta i drugo - koji bi definitivno smanjili šansu da se dese ovakvi ishodi.

Zahvalnica

Gospodinu @milos_rs_ koji je pokazao skrinshoot i naveo početni dio (phpmyadmin). Svima koji stvaraju i kreiraju sadržaj a vezano za računarsku sigurnost.

Twint is an OSINT tool for Twitter intelligence gathering and it is used by many people in the security industry (as others also). In this short article, I am going to give you a list of commands to run with no problem.

Twint is currently archived and the normal setup produces an issue. So, in this article, you will see how to run it with no issue.

Source of twint: https://github.com/twintproject/twint I would guess you are running Linux and have docker installed. There is 2 possible way. One is using docker - and the other we skip docker install and run other commands (if our Linux is Ubuntu/Debian and support python 3.6 or 3.9)

As the first step, you need to download the docker image.

docker run -ti --rm kalilinux/kali-rolling:latest bash

If all goes fine (pull, and running bash under docker) you will get into prompt of Kali Linux.

We go to the next step in this process install and run python3.9/virutalenv and activate envoriment

apt update && apt -y install git python3.9 python3-pip

pip3 install virtualenv

virtualenv --python=python3.9 py39

cd py39

source bin/activate

After this, you will get into a virtual env for development.

Setup and run of twint.

pip3 install --upgrade -e git+https://github.com/twintproject/twint.git@origin/master#egg=twint;

twint -u twitter --user-full

If all goes ok - it would show information on user @twitter

Imagine that certification authority without your permission publish certificate for your site and for example the same one gets used by cybercriminals. Your online shop gets BGP hijacked and you lose millions.

So how to prevent this type of attack?

One way is to use CAA DNS records. What does that mean? It means that you put exactly what CA you want only to use. So others CA become a fraud. And if happen - you get a message on this.

It is a security mechanism to prevent stealing SSL/TLS certificates and imitates your (let say) online shop and stealing millions from your clients and from you.

Example of the records:

dig CAA vladimircicovic.com

; <<>> DiG 12.11.3-1TAONSA_linuxOS<<>> CAA vladimircicovic.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10986
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;vladimircicovic.com.       IN  CAA

;; ANSWER SECTION:
vladimircicovic.com.    10800   IN  CAA 0 iodef "mailto:someemail@localhost.com"
vladimircicovic.com.    10800   IN  CAA 0 issue "letsencrypt.org"
vladimircicovic.com.    10800   IN  CAA 0 issuewild "letsencrypt.org"

;; Query time: 307 msec
;; SERVER: 
;; WHEN: Sat May 09 20:06:28 CEST 2020
;; MSG SIZE  rcvd: 174

So important to set iodef, issue, issuewild to CAA works properly.

You can ignore the given record but keep in mind this How 3ve’s BGP hijackers eluded the Internet—and made $29M could happen to you.

Yea this is a scary blog post about how people lose money if they don't read this post :D

Picture was taken from http://www.tankado.com

This is a small post about how to start web security. Idea is to put just 2 things. Two sites for practice, one good book and docker example of the vuln web app.

Book The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws

Site 1 Web security academy

Site 2 CTF hacker 101

Damn Vuln Web App DVWA docker

Besides this, you will need Burp suite and Kali or Blackarch.

This is a short intro in this area. Read a book, apply to sites or docker, and practice.

U slobodno vrijeme kada nemam sta da radim sasvim slucajno sam naletio na github repo (tamo gdje ostavljamo kod za publikaciju, da se koristi od strane drugih ljudi) ministra Rajcevica.

Sve bi bilo super da unutar tog koda nije pobrisana baza sa pravim kljucevima od bota koji je trebao da sluzi za raniju verziju CERT-vog profila gdje bi taj bot kacio vijesti i informacije na tviter. Github sve pobrisane fajlove cuva kao dio baze koda. Tako da je nemoguce pobrisati bilo sta - sem ako se kompletan repo pobrise sa githuba.

github repo bota

Nakon 3 min pregleda koda dosao sam do zakljucka da postoji baza sa kljucevima koja je pobrisana. Prva pomisao mi je bila da pripada profilu ministra jer je pisalo njegovo tviter nalog ime. Prvo sto sam uradio jeste poslao CERTu da kljuceve pobrisu i da se uradi tzv revoke (znaci da se obnove novi kljucevi dok se stari u ovom slucaju za koje znamo odbacuju za dalje koriscenje).

Isti dan su naveli da je slucaj zatvoren. Sacekao sam 24h. sljedeci dan sam shvatio da kljucevi nisu ponisteni i da se i dalje u upotrebi.

Pregledom starog bloga g ministra Rajcevica naisao sam da su kljucevi zapravo za bot a ne njegov profil.

Blog arhiva Rajcevic

Tu sam nasao da je trebalo da bude kao neki bot koji bi se koristio u ex-CERT RS gdje bi isti kacio na tviter informacije i slicno.

Nakon citanja online manuala - napravio sam kod koji za 30 sek radi verifikaciju da je moguce pristupiti nalogu.

Sa kljucevima koji su procurili, okacio sam nekoliko tvitova.

slika je jednim dijelom ministrova

Takodje sam napomenuo ministra da ukloni kljuceve koje on ni do dan danas nije uspio da ukloni. Zapravo uklonio je privatne informacije sa bota tako da ne bi mogao biti povezan. Sem profilne slike koja je 50% njegova.

Takodje sam poslao nekoliko poruka DM tako da uklone kljuceve koje koriste njegovim pratiocima pa i ministru Rajcevicu.

Nakon toga je samo uklonio informacije sa opisa bota kao i link ka blogu.

Prije svega ovoga bio sam blokiran na tviteru od strane ministra nakon nekoliko pitanja za koje nije mogao il nije zelio da da odg. Pitanaj su bila uljudna i bez ruznih rijeci.

Da sumiramo sve ovo: Kod ovog tviter bota je online 3 god i pored svih ljudi u ministarstvu, CERTu, i jos nekoliko kompanija sa kojima saradjuju nisu bili u stanju da uklone ovaj propust. Sada se postavlja pitanje sta je sa kompletnom infrastrukturom vlade RS i agencija. Naravno nisam imao ugovor sa ministrom niti vladom RS za ovo ali je kljuc bio tu svo vrijeme i pitanje je sta bi se desilo kada bi neko ozbiljan krenuo na kompletnu infrastrukturu vlade RS? Da li ovo znaci da nisu u stanju da zastite sopstveni kod a kamoli kompletne mreze i servere ? . Trebalo mi je nekoliko minuta da sve ovo uvezem - zamislite profesionalne grupe sajber kriminalaca.

Pouka svega je da nikada ne ostavljate u otvorenom tekstu sifre, kljuceve i druge bitne stvari - a pogotovo da i sifrovane ne leakujete na internet.

Ovo me podsjeca na likove koji su pravili kod u C za irc botove tamo 1999 do 2001 sa bugom tipa format string (ako neko zna o cemu se radi) i kako je bilo moguce preko nekoliko komandi da se odstampa sifra i user glavnog korisnika i pristupi botu. To su bila neka druga vremena.

EPILOG: nekoliko ljudi je naslo da su napravili istu gresku - pa su mi se zahvalili za pisanje clanka jer su i sami uklonili slicne probleme (pobrisane kljuceve, sifre iz koda koji su jos uvijek tu na githubu)

In free time, I stumbled accidentally to Github repo of current minister for cybersecurity and computer science (and 2 other things that I don't remember).

here: github - Srdjan Rajcevic

After 3 min review - I found "delete" credentials from SQLite DB. My first thinking was that cred is used for private profile - so I report to local CERT RS on this. The response the same day as case closed.

But it was not. Keys did not delete or revoked. After 24h I checked

After reviewing what keys are used - I found it that was meant to be part of ex-CERT twitter bot for news. But it was never finished. Here is ex blog of the minister blog webarchive

I make simple bot code in less than 30 sec (just google it for API and documentation)

Run with proper keys. Boom! twitter bot has a half picture of minister

Also, I send DM to all followers to revoke bot keys. But up today - keys are not revoked. Also, all info is removed I guess it was hard to receive this kind of info especially if you are marked as someone who can protect the complete infrastructure of one government.

And before this, I got blocked from the account minister for "cybersecurity" and 3 things I don't remember. My question on some topic hit him hard.

To sum all this: The bot was there for 3 years and no one from ex and current CERT was able to catch "leaked credentials" which wonder me - what would happen if we start to review the complete infrastructure of government? Yes, I don't have a penetration-tester agreement so this was closed to "hack a profile" of the minister. It was fun - not a hacking just joke with ppl. Take me no more than 5 min (3 to find + 1 read a review of bot + 1 for the PoC)

Do not leave cred in the open text - always encrypt. Use some strong encryption to protect your secret. Then do not share your secret in any way. Review your code.

Also, this reminds me like the 1999-2001 period when beginners code in C for IRC bots and they leave format string bug on some command and you print complete memory and get password/user for master user. That was a good time.

EPILOG: several people thank me on this because they did same mistake.

A Bug's Life: Story of a Solaris 0day - Marco Ivaldi - INFILTRATE 2019 from Immunity Videos on Vimeo.

Često se ljudi zapitaju kakva je sličnost izmedju računarskih i bioloških virusa. Ali i koja stvar ih čini "smrtonosnim".

Prvo da vidimo opšte karakteristike jednih i drugih: - Infekcija (način prenošenja, brzina zaraze) - Samoodrživost ( otpor i održivost u različitim uslovima ) - Nevidljivost / Stealth / Sakrivanje

Infekcija

Biološki virusi imaju nekoliko načina a to su dodirom, vazduhom, preko materijala i drugo. Računarski virusi mogu koristiti internet (email, ostale protokole TCP/IP, USB, fajlove (generalno fajlove), aplikacije poput IM skype viber whatsapp) Ovdje se gleda opet kolika je brzina replikacije, brzina prenošenja kao i procenat efektivnosti (npr da li ce većina ljudi kliknuti na link il fajl u email-u)

Samoodrživost

U oba slučaja zavisi od virusa i na način koji kada dodje do novog hosta / žrtve spoljni faktori ne utiču na dalje širenje. Npr Windows XP ali ne i Windows 98 ili osoba koja nema faktore da se virus zadrži (npr pere ruke, ne dira lice)

Nevidljivost / Stealth / Sakrivanje

Svaki virus (iz oba segmenta) uspijeva da se prosiri prije nego se počne otkrivati, spriječavati upravo zbog svoje nevidljivosti il da kažem sto je duži period neprimjetnosti kod hosta / žrtve to je širenje veće.

Uglavnom ovo su tri zajedničke karakteristike računarskih virusa i bioloških virusa. Imenovanje i kako se opisuju u imenu ću da preskočim.