Tests and other Media topics

[polonus]

I give an example of a problem site: solarlist.com Identity verified but with warnings
Encryption (HTTPS) (1)
Communication is encrypted
Site tries to load scripts from sources that weren't verified - so-called mixed content.
Possible Frontend SPOF from:

maps.google.com - Whitelist
(75%) - <script type='text/javascript' src='http://maps.google.com/maps/api/js?sensor=false&ver=1.0'>
html5shiv.googlecode.com - Whitelist
(71%) - <script src="http://html5shiv.googlecode.com/svn/trunk/html5.js">
fonts.googleapis.com - Whitelist
(69%) - <link href='http://fonts.googleapis.com/css?family=Open+Sans:300,400,700' rel='stylesheet' type='text/css'>
(69%) - <link href='http://fonts.googleapis.com/css?family=Open+Sans:300,400,700' rel='stylesheet' type='text/css'>
s3.amazonaws.com - Whitelist
(11%) - <script src="//s3.amazonaws.com/scripts.hellobar.com/c42e00ca9c042c9f6457cf24ee9836a494d021b3.js" type="text/javascript">

See check: http://certificate.revocationcheck.com/solarlist.com

See: https://www.eff.org/https-everywhere/atlas/domains/solarlist.com.html

The following sites know that you visited this page. Click on a site to find out what more it knows about you.
-amazonaws.com
-google.com
-vimeo.com

Netcraft Website Risk Ranking 1 red out of 10: http://toolbar.netcraft.com/site_report?url=https://solarlist.com

Scanning target:  162.159.246.65 on port 443 ...

Found 1 servers with port 443 open
Checking for SSLv3 POODLE vulnerability...

IP address   Hostname   Status   Vulnerable ciphers
162.159.246.65      NOT Vulnerable   
Where I sacnned this? Here: https://pentest-tools.com/vulnerability-scanning/ssl-poodle-scanner

polonus

[polonus]

Test for  X-XSS-Protection: 1; mode=block: http://www.enhanceie.com/test/xss/BlockMode.asp

What is this? X-XSS-Protection is a HTTP header understood by Internet Explorer 8 (and newer versions). This header lets domains toggle on and off the "XSS Filter" of IE8, which prevents some categories of XSS attacks. IE8 has the filter activated by default, but servers can switch if off by setting.
As  it seems to me (proof is hard to find) that it only protects against Reflected XSS (infosecisland.com/blogview/…), also because it does not have any mean to detect Stored XSS (also called Persistent XSS) info credits go to Luca Invernizzi at stackoverflow!

polonus

Netcraft extension and malware script detector will be flagging this and block it as well:

This page has been blocked by the Netcraft Extension for the following reason:

Suspected XSS Attack

Blocked URL: http://webdbg.com/test/xss/HelloBlockMode.asp?lotsoX=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx etc.

D

[polonus]

With voices heard to legalize mass surveillance at least until 2020, here is an insteresting website with projects to opt out (where and while still possible) -> https://prism-break.org/en/

Disclaimer: Using the recommended projects on this site will not guarantee that 100% of your communications will be shielded against surveillance states. Please do your own research before trusting these projects with sensitive information.

Disclaimer quote taken from above website. Link source - Peng Zhong 2015.

polonus

P.S. A weird test result: https://en.wikipedia.org/wiki/Intelligence_Quotient_%28IQ%29_and_Browser_Usage

D

[polonus]

Open port check tool: http://www.yougetsignal.com/tools/open-ports/
The open port checker is a tool you can use to check your external IP address and detect open ports on your connection. This tool is useful for finding out if your port forwarding is setup correctly or if your server applications are being blocked by a firewall. This tool may also be used as a port scanner to scan your network for ports that are commonly forwarded. It is important to note that some ports, such as port 25, are often blocked at the ISP level in an attempt to prevent malicious activity.
Combine with a Dazzlepod IP check: https://dazzlepod.com/ip/

Mind that the results can only be for IPs you own and you cannot publish third party scan results.

polonus

[polonus]

A short survey of IP blocklists:

https://atlas.arbor.net/
http://support.clean-mx.de/clean-mx/viruses
http://www.cymru.com/Documents/bogon-dd.html
http://www.dshield.org/ipsascii.html
http://www.emergingthreats.net/index.php/rules-mainmenu-38.html
http://code.google.com/apis/safebrowsing/
http://hosts-file.net/
http://malc0de.com/database/
http://www.malwaredomains.com/wordpress/?page_id=66
http://www.malware-control.com/
http://malwared.ru/database.php?page=1
http://www.malwaredomainlist.com/hostslist/hosts.txt
http://www.malware.com.br/lists.shtml
http://www.malwareurl.com/
http://www.norse-corp.com/darklist.html
http://openphish.com/
http://mdl.paretologic.com/
http://www.phishtank.com/phish_archive.php
http://www.projecthoneypot.org/list_of_ips.php
http://www.scumware.org/
http://www.shadowserver.org/wiki/pmwiki.php?n=Services/Reports
http://labs.snort.org/iplists/
http://mtc.sri.com/
http://sucuri.net/?page=tools&title=blacklist
http://www.threatstop.com/
http://urlblacklist.com/
https://zeustracker.abuse.ch/blocklist.php
https://zeustracker.abuse.ch/monitor.php?browse=binaries
http://www.blade-defender.org/eval-lab/
https://malwr.com/
http://www.nictasoft.com/viruslib/   

(link source credits go to CWZ)

polonus

[polonus]

Another good initiative with https being phased in: https://sslbl.abuse.ch/

Also some interesting SSL checking links given.
Like to add:
https://ssl.trustwave.com/support/support-certificate-analyzer.php?address=
https://www.whynopadlock.com/
https://certlogik.com/ssl-checker/www.reddit.com/
https://www.poodlescan.com/
https://shaaaaaaaaaaaaa.com/
https://www.trustworthyinternet.org/ssl-pulse/
https://pentest-tools.com/vulnerability-scanning/openssl-heartbleed-scanner

polonus

[polonus]

Real World Protection Test Results, download here: http://www.av-comparatives.org/wp-content/uploads/2015/05/avc_factsheet2015_04.pdf

polonus

[polonus]

Next to this DNS scanner: http://www.dnsinspect.com/stabletransit.com/1431899954
I stumbled upon this one: http://www.nabber.org/projects/dnscheck/?domain=stabletransit.com *
Both can be nicely combined when you dive into some DNS issue.
So tried to get scan results with stealth nameservers *.
Read: https://support.dnsmadeeasy.com/index.php?/Knowledgebase/Article/View/108/16/why-am-i-getting-these-stealth-name-server-errors-and-warnings link article author Jennifer Oles
Stealth name servers should never listed as authorative!
* This scan was started because of this report: http://toolbar.netcraft.com/site_report?url=http://sbdforms.com
and the Nameserver given there.

My good friends, enjoy,

polonus

[polonus]

Generate hashes online with this generator: http://www.sha1-online.com/
Example: $ echo -n \`\^\-\,\;\:\!\?\.\'\"\(\)\[\]\{\}\§\@\*\/\\\&\#\%\±\<\=\>\|\~\$\€ | openssl
Output  f44e3004f07d617b06f61b57803a7abe30d414fd  (shellshock bash bug)

fork bomb () { :; }; ){ :|: & };: -> 57785764f85505a15dd38ea7ffab35bc43512136
Result for md5:  8cf37ff23da0423b9c167dc05b6217ea

Enjoy,

polonus

[polonus]

Tested the avast forum site against Logjam PFS Deployment: Test A ServerGo
Warning! This site uses a commonly-shared 1024-bit Diffie-Hellman Group, and might be in range of being broken by a nation-state. It might be a good idea to generate a unique, 2048-bit group for the site.
Big Blue now safe, Firefox and Google Chrome still unpatched.
Due to the weakened export downgraded encryption (USA export encryption restrictions during the 90's and beyond caused this threat) Logjam is now a problem to be mitigated all over the world.
Server test can be found here: https://weakdh.org/sysadmin.html

polonus

[bob3160]

Tested the avast forum site against Logjam PFS Deployment: Test A ServerGo
Warning! This site uses a commonly-shared 1024-bit Diffie-Hellman Group, and might be in range of being broken by a nation-state. It might be a good idea to generate a unique, 2048-bit group for the site.
Big Blue now safe, Firefox and Google Chrome still unpatched.
Due to the weakened export downgraded encryption (USA export encryption restrictions during the 90's and beyond caused this threat) Logjam is now a problem to be mitigated all over the world.
Server test can be found here: https://weakdh.org/sysadmin.html

polonus

It's actually the cyber crook that caused this problem. It's their exploitation of this 'weakness' that's the problem. (I'm being sarcastic.)

[polonus]

Hi bob3160,

And did not government promise recently they would no longer sit on these hacks, but to reveal them to us? 

All your weakened encrypted traffic could be easily siphoned and decrypted by design, alas large parts of that traffic.
Read: http://www.dailydot.com/politics/logjam-vpn-top-sites-vulnerability/

UC Browser, very popular in China was deliberately being infested by NSA etc.: https://citizenlab.org/2015/05/a-chatty-squirrel-privacy-and-security-issues-with-uc-browser/

Intelligence services "helped" general internet security big time during recent years with their paranoia (ironic and sarcastic remark)  )

polonus

[DavidR]

Tested the avast forum site against Logjam PFS Deployment: Test A ServerGo
Warning! This site uses a commonly-shared 1024-bit Diffie-Hellman Group, and might be in range of being broken by a nation-state. It might be a good idea to generate a unique, 2048-bit group for the site.
<snip>
polonus

I think the key (excuse the pun) here is might and being broken by a nation-state. When it comes to nation states, they might have the resources to break it, but you would have to wonder, would they want to I'm sure this type of stuff would have to be attractive enough to make it worthwhile.

[polonus]

Hi DavidR,

That is not the point here, whether government had the might to decrypt weakened encryption for global surveillance purposes. I understand we normally don't do that in our homes. The point is that it was done deliberately by having stronger encryption restrictions for everyone abroad and downgrading the initial encryption strenght to be able to decrypt.
Particular governments and big corporation entities worked hand in foot to achieve such a situation.

Who was asking for normal secure encryption strength to be deliberately and secretely lowered to an extent so that eavesdropping mode could be reached. Those with strong encryption were not endangered in the first place (cybercriminals etc.), the security of the normal law-abiding citizen was endangered big time and these citizens  weren't aware.

Now webmail and webserver admins all over the world have to clear up the mess after some parties could realize their global surveillance wet dreams. and parts of the internet will stay inherently insecure and dangerous in the aftermath.
Big Brother has arrived and he will never go away again.

polonus

[bob3160]

Big Brother has arrived and he will never go away again.

Big Brother has been there since 2007 so this certainly isn't new.
Almost all the surveys I've read also confirm that most people don't care.
It's only some of the Geeks that seem to get their feathers ruffled any time one of theses articles comes out.