Are you a coder or white-hat hacker looking to make some money on the side? Bug bounty hunting might be the perfect gig for you.
What Is Bug Bounty Hunting?
Bug bounty hunting is being paid to find vulnerabilities in software, websites, and web applications. The security teams at major companies don't have enough time or manpower to squash all the bugs they have, so they reach out to private contractors for help. Basically, you use your tools to break things (or break into things), write up a vulnerability report to the company who's issued the bounty, then get paid. Some hackers make tens of thousands of dollars a year on the side just hunting bugs.
To do it, however, you'll need to at least know some basic coding and computer skills. Fortunately, we've got tons of great resources to help get you started, and coding is pretty easy to teach yourself. That said, if you have no idea what any of this stuff means as you read on, bug bounty hunting probably isn't for you.
Do Some Research and Get Your Tools
Once you've got a grip on basic coding, you need to take a deep dive into web applications and how they work. Lucky for you, there's tons of great resources out there that can point you in the right direction. Start by reading:
The Web Application Hacker's Handbook ($30)
OWASP Testing Guide v4
Then get the right tools. You'll need:
Kali Linux (free)
Burp Suite ($349 a year, but very popular)
OWASP Zap (free alternative to Burp Suite)
Then check out the OWASP WebGoat lab, where you can practice finding bugs and vulnerabilities in web applications, and take a look at the Google Bughunter University as well. They have lots of great information bug hunting and how to write solid vulnerability reports that will get you paid. Sites like Bugcrowd and HackerOne can help with that aspect as well. (Patrick Allan/lifehackers.com)
Following the recent "KRACK Attack" Wi-Fi WPA-2 exploit, Apple has
cited that it has addressed the issue in its macOS, iOS, tvOS and
watchOS betas, but has yet to officially state as to whether a patch is
en route for its AirPort series of routers.
Sources within the company have stated that the patch to remove
hardware susceptibility was included in a "previous" beta of the current
range of operating systems, indicating a release before Monday’s batch.
Given that the most recent firmware update for the AirPort routers was
released in December of 2016, it's presently unknown as to whether Apple
would release a patch for the KRACK exploit for its AirPort routers.
The KRACK exploit itself takes advantage of a four-way handshake
between a router and a connecting device to establish the encryption
key. Properly executed, the third step can be compromised, resulting in
the re-use of an encryption key —or in some cases in Android and Linux,
the establishment of a null key.
Security researchers have claimed that the attack vector has been
opened up in Android 6.0 or later devices. Other operating systems,
including iOS and macOS are less impacted, but "a large number of
packets" can still be decrypted from all.
The attack uses one or more of 10 different exploits. The details of
the exploit were submitted for review on May 19th, and a conference
presentation will be delivered on November 1st.
Vanhoef first notified vendors with products he
personally tested and found to be vulnerable "around" July 14, 2017.
After determining that this was a vulnerability of the protocol, not of a
vendor-specific implementation, Vanhoef approached CERT/CC, which in turn notified product vendors on August 28th.
Who is affected
Practically any device capable of
sending or receiving a Wi-Fi signal is affected. Because of the nature
of the attack, the client device is the target and is, therefore, the
highest priority for patching.
In Vanhoef's proof of concept against a phone running Android
6.0, the behavior of wpa_supplicant—a Wi-Fi library used in Android and
various Linux distributions—causes the encryption key to be erased from
memory after being installed the first time. As such, if an attacker
retransmits part of the handshake, the library will reinstall the
cleared key, effectively replacing the key with a blank one.
According to Vanhoef, "This makes it trivial to intercept and
manipulate traffic sent by these Linux and Android devices." He also
noted that 41% of Android devices run Android 6.0 or above, where this behavior was introduced. At press time, a patched wpk_supplicant is in testing for Fedora, though no patch has yet been introduced for Ubuntu.
For enterprise Wi-Fi
deployments, Ubiquiti
noted that UniFi access points on firmware 3.9.3 and above are not
affected by WPA2 key issues, but that fast BSS transition is still
affected, though that feature is in beta. Zyxel has posted a page detailing the rollout of patches to address this issue, projected to begin next month. Aruba has posted a memo and updated firmware to address this issue.
What can be done to mitigate damage
For mobile,
particularly Android devices, avoiding connecting to Wi-Fi networks in
public places—even if they are protected networks.
It is
possible to patch devices in a backward-compatible manner, though
distribution of these patches is likely to take time. Check with your
product vendors to see if a patch is available or necessary. (techrepublic.com)
A vulnerability in the WPA2 protocol allowing attackers to read encrypted information transmitted over Wi-Fi was discovered by Mathy Vanhoef, a post-doctorate researcher at KU Leuven.
Due to a flaw in the design of the protocol itself—not a specific
vendor implementation—attackers can capture part of the handshake
message, and use modified versions of that to trick devices into
installing a blank encryption key, a process called "key reinstallation
attacks," or KRACKs by Vanhoef.
How the attack works
Because of the depth and nuance of this vulnerability, collectively KRACK has 10 CVE identifiers assigned to it.
The lynchpin of the vulnerability is the four-way handshake used when a
client device attempts to join a protected network. After verifying the
Wi-Fi password for the network itself, the encryption key for the
session is negotiated. These handshake messages can be captured and
manipulated by an attacker, and rebroadcast to a device which proceeds
to reinstall the encryption key.
The WPA2 handshake design
permits for the possibility of a dropped packet during handshake.
Therefore, the third step of the four-way handshake—in which the
encryption key is negotiated—may be rebroadcast to the client if the
access point has not received an acknowledgement. Per protocol design,
the client may receive the encryption key multiple times, and is
expected to reinstall that key, resetting the incremental packet transit
number ("nonce") and receive reply counter. Attackers can take
advantage of this behavior to replay, decrypt, or forge packets.
Naturally, this ability extends to TCP SYN packets, making it
possible for attackers to hijack TCP connections, in functionally the
same way attackers inject data on unprotected Wi-Fi networks.
Researchers have discovered a key flaw in the WPA2 WiFi
encryption protocol that could allow hackers to intercept your credit
card numbers, passwords, photos and other sensitive information. The
flaws, dubbed "Key Reinstallation Attacks,"
or "Krack Attacks," are in the WiFi standard and not specific products.
That means that just about every router, smartphone and PC out there
could be impacted, though attacks against Linux and Android 6.0 or
greater devices may be "particularly devastating," according to KU
Leuven University's Mathy Vanhoef and Frank Piessens, who found the flaw.
Here's how it works. Attackers find a vulnerable WPA2 network, then
make a carbon copy of it and impersonate the MAC address, then change
the WiFi channel. This new, fake network acts as a "man in the middle,"
so when a device attempts to connect to the original network, it can be
forced to bypass it and connect to the rogue one.
Normally, WPA2
encryption requires a unique key to encrypt each block of plain text.
However, the hack described in the Krack Attack paper forces certain
implementations of WPA2 to reuse the same key combination multiple
times.
The problem is made worse by Android and Linux, which,
thanks to a bug in the WPA2 standard, don't force the client to demand a
unique encryption key each time. Rather, they allow a key to be cleared
and replaced by an "all-zero encryption key," foiling a key part of the
handshake process. In some cases, a script can also force a connection
to bypass HTTPS, exposing usernames, passwords and other critical data.
The
system takes advantage of a flaw in the "handshake" method to direct
users to the malicious network. Neither WiFi passwords nor secret keys
can be obtained, the researchers say, as the hack works by forging the
entire network. As such, it can't be used to attack routers, but hackers
can still eavesdrop on traffic, making it particularly dangerous for
corporations.
As shown above, the researchers did a proof-of-concept attack on
Android, and were able to decrypt all the victim's transmitted data.
They point out that this will "not work on a properly configured HTTPS
site," but will work on a "significant fraction" that are poorly set up.
Other devices, like those running MacOS, Windows, OpenBSD and other
operating systems, are affected to a lesser extent. "When attacking
other devices, it is harder to decrypt all packets, although a large
number of packets can nevertheless be decrypted," say the researchers.
After earlier, more limited hacks, the WPA2 protocol has been suspect
for a while, so many security folks were already bracing themselves for
something bad. If you still doubt the seriousness of it, Alex Hudson,
for one, is actually advising Android users to "turn off WiFi on these
devices until fixes are applied." He adds that "you can think of this a
little bit like your firewall being defeated."
As such, you can
protect yourself to a great extent by sticking with sites that have
solid, proven HTTPS security. And of course, the attack won't work
unless the attacker is nearby and can physically access your network.
The
problem should be relatively easy to fix. A firmware change can force
routers to require a dedicated certificate for each handshake, instead
of relying on the one already generated. And, as the security
researchers who discovered it say, "implementations can be patched in a
backwards-compatible manner."
That means if you patch your Android
device and not your router, you can still communicate and be safe, and
vice-versa. Nevertheless, they also advise to patch all your devices as
soon as security updates are available. For more details about the hack,
check this very detailed FAQ from Aruba Networks. (Steve Dent, engadget.com)
News that someone exploited an Instagram security hole to steal info from some of its most popular accounts got worse when they began selling it. Hours after the hack was disclosed, hackers established a searchable database named Doxagram allowing users to search for victims’ contact information for $10 per search.
The hacker provided a list of 1,000 accounts they said were available for searching on Doxagram to the Daily Beast, and the list included most of the 50 most-followed accounts on the service. Hackers say they have information on file for 6 million users.
The Verge reports this dark web service is no longer available, but The Daily Beast chatted with operators of the "Doxagram" database who provided a sample of the info that included addresses and numbers for about 1,000 accounts. The info did not appear to be from previous leaks, and some owners confirmed their entries were valid.
But even with the site shut down, contact information for dozens of celebrities now appears to be floating around on the dark web. A cybersecurity firm named RepKnight said it found what purported to be contact information for celebrities including:
Actors: Emma Watson, Emilia Clarke, Zac Efron, Leonardo DiCaprio, Channing Tatum. Musicians: Harry Styles, Ellie Goulding, Victoria Beckham, Beyoncé, Lady Gaga and Rihanna, Taylor Swift, Katy Perry, Adele, Snoop Dogg, Britney Spears. Athletes: Floyd Mayweather, Zinedine Zidane, Neymar, David Beckham, Ronaldinho.
For celebrities and other high-profile users, the hack could mean having to change a phone number, email address, or both. But it can also be used along with social engineering techniques to gain access to the account itself. That seems to be what happened to Gomez, Instagram’s most-followed user. Her account was briefly taken down Monday after it was used to post nude photographs of Justin Bieber, her ex-boyfriend.
In another statement, Instagram again confirmed the bug, saying that while no passwords were revealed, the bug did allow access to phone numbers and email addresses even if they weren't public. The hackers were selling access to the database at a price of $10 for each query, and told Ars Technica today that they had made at least $500 already. According to them, an automated process could steal info from up to one million accounts per hour, and Instagram didn't close the hole until 12 hours after their attack started and he had accessed 6 million accounts.
Initially, Instagram's alert said that "high-profile" users may have had information revealed, but even with 700 million or so active users, there may be more people who need to know their information is out there. (engadget.com/theverge.com)
