Midnight Research Labs

MRL challenge coin
aaron posted in Uncategorized on September 12th, 2009
comments:0

This post is long overdue since we’ve had these for at at least a couple months now, but I definitely wanted to give props to Jeremy for hooking us up with some cool MRL coins that he had created. He has a pretty good blog post on the process of how he created them. He also included a small QR code tag in the design. If you’re a MRLB member, hit me up, and I’ll give you one if you don’t have one already (as inventory allows).

Jeremy also has lots of other interesting laser/robotics/art/music projects on his site (who doesn’t love laser bacon), so check it out. Also, if like his work, or you’re feeling generous, consider donating or buying one of his Jansen walker robot kits. Especially since he just fried his laser’s power supply.

Here are some pictures of the process:

NAISG presentation
aaron posted in Uncategorized on September 12th, 2009
comments:0

If you’re around Boston this Thursday night, definitely check this interesting presentation from Zach at the Boston NAISG (National Information Security Group) on “Disclosure Samsara” or “The Endless Responsible Vulnerability Disclosure Debate”. This is the official meeting page, and details for the time/location/RSVP can be found there. It will be held at the Microsoft building in Waltham, and chances are there will be some type of MRL caravan, so let us know if you’ll be heading out.

Here’s the full synopsis on the talk:

Vulnerability disclosure can help make software and hardware vendors and service providers accountable for shortcomings in their offerings; and full disclosure can give IT and information security professionals the information they need to validate the resilience and efficacy of their controls. Generally speaking, a happy balance is achieved when vulnerabilities are disclosed in a responsible manner. But what is “responsible?”

It’s been nearly a decade since the introduction of RFPolicy, a document often considered to be the basis for modern, responsible vulnerability disclosure, yet there still remains a significant division between the camps of “full disclosure,” “partial disclosure,” and “zero disclosure.” The “responsible disclosure” debate seems to be an endless cycle, coming back fully reconstituted just when we think it’s run dry.

Lawsuits, gag orders, and boatloads of drama are some of the negative points researchers have dealt with when disclosing a bug or flaw to a vendor. This type of reaction can be very discouraging for a security researcher, possibly resulting in them avoiding communication with the vendor in favor of disclosing it outright or even selling the details to the highest bidder.

With continued, accelerated awareness and discussion, the information security community can work toward solidifying an approach to responsible disclosure that, amongst other things:

* Facilitates interaction between the researcher and vendor or service provider
* Acknowledges the researcher’s work
* Provides adequate protection for the security researcher
* Builds a reasonable timeline and plan for a solution to the bug or flaw and its public disclosure (and keeps parties from stalling)

Zach Lanier is a New England-area security consultant and occasional security researcher. His areas of focus are network and application penetration testing, intrusion analysis, and general hackery. He’s the maintainer of the Security Twits list and one of the co-founders of Midnight Research Labs Boston, a local hackerspace.

Open Security Foundation Mangle-A-Thon
aaron posted in Uncategorized on August 21st, 2009
comments:0

Midnight Research Labs Boston will be hosting the Open Security Foundation’s inaugural “Mangle-A-Thon” on September 19, 2009. This free event, broken up into two to three sessions, is a great opportunity to learn about and contribute to the Open Source Vulnerability Database (OSVDB), the DataLossDB, and more. As an added bonus, the OSF will be providing food and drinks.

Seats are limited, so register now!

Reposted from n0where.org

Back!
aaron posted in Uncategorized on August 21st, 2009
comments:0

After a hardware failure on our primary server the day after our secondary went away, we’re finally back! I’m hoping that’s the last of the fail for a while, . We’ll still have a couple of infrastructure changes over the next couple weeks, but hopefully the website should be stable. Lots of things have been going on in the last month or so, and other new things should start to trickle out over the next few weeks. We’re starting to schedule events at our fledgling hacker space near Boston, and we also have a couple new tools we hope to release in the near future. Stay tuned and keep hacking.

Lots of new conference videos online
aaron posted in Uncategorized on January 20th, 2009
comments:0

Here are a few sets of conference videos that are now online:

– Hack in the box – Malaysia videos. Day1 — Day 2. Even though it’s a pirate bay link, the videos were linked from the main HITB page, so I’m assuming it’s legit, .

– Microsoft’s BlueHat 8 videos. Day 1 — Day 2.

– Dojosec videos.

– (edited to add) 25C3 videos are also now online. Awesome.

Happy torrenting.

Kenshoto stepping down?
aaron posted in Uncategorized on January 16th, 2009
comments:0

It looks like kenshoto is stepping down as the organizer for one of the largest hacking competitions in the world. An announcement has been made on the defcon forums for new organizers.

From the announcement:

WANTED:
An evil large multinational corporation, or…
An nefarious group of genius autonomous hackers, or…
A shadowy government organization from somewhere in the world
TO:
Host, recreate, and innovate the worlds most (in)famous hacking contest.

Kenshoto has always done an amazing job at both the pre-qualification rounds as well as the main competition. They really stepped up the game as more of an art than just a competition. Their efforts will be missed as we look forward to who will carry the torch next.

Wepawet: analyzing web-based malware
aaron posted in Uncategorized on January 15th, 2009
comments:0

This is a pretty cool looking website/service from the Computer Security Group at UC Santa Barbara that will analyze flash and javascript for malicious content. It will actually de-obfuscate javascript and pull out the active exploits that it uses. I’m guessing that it’s also doing some dynamic analysis because it is able to see the exact request/responses that it’s making. Here is a sample report that shows multiple exploit attempts and the actual malware. The website says that it’s currently in alpha and it will have the ability to submit URLs (instead of javascript/flash files) soon.

Via www.offensivecomputing.net

0day in WowWee Rovio Robot
aaron posted in Uncategorized on January 14th, 2009
comments:1

You can’t use it in your plot to take over the world with remote control robots yet, but there’s a new 0day in the WowWee Rovio that will allow remote snooping of the audio/video data that comes from the robot. Other things you can do remotely are get configuration data, update the firmware, and send things to the speaker. It looks like the Rovio is a fancy robotic pseudo-telepresence toy for your dog.

From the advisory text:

Unfortunately, Rovio’s access control mechanisms (username/password) are not
completely utilized across the platform even when enabled. Certain URLs and
RTSP Streaming capabilities of the device are accessible with no
authentication. Furthermore, deployment of the device in the default
configuration attempts to use UPnP to automatically configure your firewall to
allow external access to the mobile webcam platform.

Happy 2008^H9!
aaron posted in Uncategorized on January 14th, 2009
comments:0

I don’t want to bore anyone with arbitrary end of year statements/predictions, but I did want to acknowledge the milestone. 2008 was a pretty good year, and we’ve managed to get back into an regular schedule again with meetings twice a month. We’re looking forward to an exciting 2009, and have a couple new projects that we’re working on that we can hopefully start posting about soon. More fun stuff on the horizon.

BotHunter LiveCD and new releases
aaron posted in Uncategorized on November 12th, 2008
comments:0

It looks like BotHunter has been busy since the last time I was looking at them. They have a new Live CD to test out the software, and some new releases with some new features (including a GUI) that are worth checking out. Here’s the blurb on what bothunter does:

BotHunter is a passive network monitoring tool designed to recognize the communication patterns of malware-infected computers within your network perimeter. Using an advanced infection-dialog-based event correlation engine (patent pending), BotHunter represents the most in-depth network-based malware infection diagnosis system available today.

Last time I tried them out, the installation was a bit clunky, but overall it was a very valuable tool. Having the correlation between the different major points in the bot life cycle really helps with a much more accurate detection. In tests it was doing a way better job at reducing false positives to come up with some usable results than a traditional IDS.

If you’re interested in the subject, this is a good white paper on their design, how they do the correlation between different points in the life cycle, and some of the anomaly detection features they’ve added among other things. I thought it was well worth the read.