OpenIOC – Sharing Threat Intelligence

Find your website's Achilles' Heel

OpenIOC is an open framework for sharing threat intelligence, sophisticated threats require sophisticated indicators. In the current threat environment, rapid communication of pertinent threat information is the key to quickly detecting, responding and containing targeted attacks.

OpenIOC is designed to fill a void that currently exists for organizations that want to share threat information both internally and externally in a machine-digestible format. OpenIOC is an extensible XML schema that enables you to describe the technical characteristics that identify a known threat, an attacker’s methodology, or other evidence of compromise.

OpenIOC - Sharing Threat Intelligence

Why OpenIOC

  • Sophisticated Indicators – Traditional methods of identifying security breaches no longer work. Simple signatures are too easy for an intruder to circumvent. Organizations need to be able to communicate how to find attackers on their networks and hosts using a machine digestible format that removes human delay from intelligence sharing.
  • Advanced Threat Detection – By using the OpenIOC framework, you will have the most advanced threat detection capability available. By joining the OpenIOC community, your organization can benefit from the network effect of threat intelligence from organizations within your industry, as well as global Fortune 1000 companies.
  • Extendable & Customizable – By allowing for extensions and customization, OpenIOC offers your organization the option of using MANDIANT’s field tested Indicators of Compromise, as well as creating your own custom sets of indicators, and any combination thereof that you need to complete your mission.

The Framework Schema

  • It’s Really Simple – The base OpenIOC schema is a simple framework that is written in XML to document and categorize forensic artifacts of an intrusion that can be identified on a host or network. You can easily extend the base schema to include additional indicators from a variety of sources.
  • Mandiant Indicators – OpenIOC ships with a base set of indicators provided by MANDIANT. These indicators describe over 500 facets of environments that can be used to track down advanced attackers, which have been vetted through years of MANDIANT’s experience responding to some of the world’s largest and most sophisticated computer attacks.
  • Extendable – Every environment is different, and you may find custom needs that your environment, market sector, or industry has that are not included in the base set of IOC terms. You are free to create and add your own sets of indicators and extend OpenIOC as you see fit.

You can download the IOC Editor here:

Or read more here.

Tags: , , , , , , ,

Posted in: Countermeasures, Security Software | Add a Comment

Up1 – Client Side Encrypted Image Host

Your website & network are Hackable

Up1 is a client side encrypted image host that that can also encrypt text, and other data, and then store them, with the server knowing nothing about the contents. It has the ability to view images, text with syntax highlighting, short videos, and arbitrary binaries as downloadables.

Up1 - Client Side Encrypted Image Host

How it Works

Before an image is uploaded, a “seed” is generated. This seed can be of any length (because really, the server will never be able to tell), but has a length of 25 characters by default. The seed is then run through SHA512, giving the AES key in bytes 0-256, the CCM IV in bytes 256-384, and the server’s file identifier in bytes 384-512. Using this output, the image data is then encrypted using said AES key and IV using SJCL’s AES-CCM methods, and sent to the server with an identifier. Within the encryption, there is also a prepended JSON object that contains metadata (currently just the filename and mime-type). The (decrypted) blob format starts with 2 bytes denoting the JSON character length, the JSON data itself, and then the file data at the end.

Image deletion functionality is also available. When an image is uploaded, a delete token is returned. Sending this delete token back to the server will delete the image. On the server side, HMAC-SHA256(static_delete_key, identifier) is used, where the key is a secret on the server.


The browser-side is written in plain Javascript using SJCL for the AES-CCM encryption, with entropy obtained using the WebCrypto APIs and encryption performed within a Web Worker. The video and audio players just use the HTML5 players hopefully built into the browser. The paste viewer uses highlight.js for the syntax highlighting and line numbers.

The server-side is written in Node, although we also have a Go server which uses no dependencies outside of the standard library. The only cryptography it uses is for generating deletion keys, using HMAC and SHA256 in the built-in crypto/hmac and crypto/sha256 packages, respectively.

Client Utilities

  • ShareX, a popular screenshot and image uploader, now merged with Up1 support
  • upclient, a command-line tool for uploading to Up1 servers

You can download Up1 here:

Or read more here.

Tags: , , , , , , , ,

Posted in: Cryptography, Privacy | Add a Comment

Criminal Rings Hijacking Unused IPv4 Address Spaces

Find your website's Achilles' Heel

So apparently this Hijacking Unused IPv addresses has been going on for a while, but with quite a lot number of attempts recently it’s ramped up a LOT since the September announcement by ARIN about IPv4 depletion. There was only only 50 hijacking attempts between 2005 and 2015.

Criminal Rings Hijacking Unused IPv4 Address Spaces

Since September, ARIN has already seen 25 such attacks though – which is basically 5 years worth.

IPv4 addresses are now so valuable that criminals are setting up shell companies so they can apply for addresses, then resell them to users desperate to grow their networks.

Criminals are doing so because there are no more IPv4 addresses left: the American Registry for Internet Numbers (ARIN) ran out in September 2015.

ARIN maintains a waiting list for address buyers and also oversees a market for used IPv4 addresses. While it is conceivable that some users will hand back addresses they no longer require, the IPv4 transfer market is short of stock.

Hence criminals’ interest in ways to land themselves IP addresses, some of which were detailed this week by ARIN’s senior director of global registry knowledge, Leslie Nobile, at the North American Network Operators Group’s NANOG 67 conference.

Nobile explained that criminals look for dormant ARIN records and try to establish themselves as the rightful administrator. ARIN has 30,556 legacy network records, she said, but a validated point of contact for only 54 per cent of those networks. The remaining ~14,000 networks are ripe for targeting by hijackers who Nobile said are only interested in establishing legitimacy with ARIN so they can find a buyer for un-used IPv4 addresses possessed by dormant legacy networks.

So if you’re a company that owns a dormant IPv4 address space, give it back or sell it – because people need it! And secondly, it might get stolen anyway.

From the figures it seems there’s about 15,000 dormant network records without a validated point of contact.

Criminals do so by finding dormant ARIN records and Whois data to see if there is a valid contact, then ascertaining if IPv4 allocations are currently routed. If the assigned addresses are dark and no active administrator exists, hijackers can revive dormant domain names or even re-register the names of defunct companies in order to establish a position as legitimate administrators of an address space. If all goes well, the hijackers end up with addresses to sell.

This activity is not rampant, but is rising fast: Nobile said ARIN detected about 50 such hijacking attempts between 2005 and 2015. Since announcing IPv4 depletion in September 2015 the organisation has detected about 25.

Nobile said ARIN has also found “fraud rings … people who set up shell companies in order to hoard IPv4 address spaces.”

These fraudsters came into existence just before the depletion of the IPv4 address space. One entity created 30 shell companies with the sole intention of securing addresses for later re-sale.

“They were good,” Nobile admitted. “They got by us.”

ARIN’s tightened its checks of late to stop hijackers and fraudsters. Nobile suggested you do likewise by keeping Whois records up to date and responding to ARIN’s annual point of contact validation request.

Keep your WHOIS records up to date, especially contact details for your network blocks, even if they are in use – it will go a long way towards not getting jacked.

Same goes for domains.

Source: The Register

Tags: , , , , , , , , ,

Posted in: Legal Issues, Network Hacking | Add a Comment

shadow – Firefox Heap Exploitation Tool (jemalloc)

Your website & network are Hackable

shadow is a new, extended (and renamed version) of a Firefox heap exploitation tool, which is quite a swiss army knife for Firefox/jemalloc heap exploitation.

shadow - Firefox Heap Exploitation Tool (jemalloc)

If you want to dive in really deep to this tool, and the technicalities behind it check this out – OR’LYEH? The Shadow over Firefox [PDF]


shadow has been tested with the following:

  • Windows 8.1 x86-64
  • Windows 7 SP1 x86 and x86-64
  • WinDBG 6.3.9600.17200 x86 (since Firefox stable is x86-only currently)
  • pykd version
  • Many different Firefox releases, but extensively with: 31.7.0-esr, 35.0.1, 36.0.1, 38.0.5, 39.0, 40.0, 43.0. 44.0.


When you issue a jemalloc-specific command for the first time, shadow parses all jemalloc metadata it knows about and saves them to a Python pickle file. Subsequent commands use this pickle file instead of parsing the metadata from memory again in order to be faster.

When you know that the state of jemalloc metadata has changed (for example when you have made some allocations or have triggered a garbage collection), use the jeparse command to re-parse the
metadata and re-create the pickle file.

Symbol Support

The symbol command allows you to search for SpiderMonkey and DOM classes (and structures) of specific sizes. This is useful when you’re trying to exploit use-after-free bugs, or when you want to position interesting victim objects to overwrite/corrupt.

In the “auxiliary” directory you can find a small PDB parsing utility named symhex. Run it on “xul.pdb” to generate the Python pickle file that shadow expects in the “pdb” directory (as “pdb/xul-VERSION.pdb.pkl”). Before running symhex make sure you have registered “msdia90.dll”.

You can download shadow here:

Or read more here.

Tags: , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Hacking Tools, Programming | Add a Comment
Cuckoo Sandbox - Automated Malware Analysis System

Cuckoo Sandbox – Automated Malware Analysis System

Cuckoo Sandbox is Open Source software for automating analysis of suspicious files. To do so it makes use of custom components that monitor the behaviour of the malicious processes while running in an isolated environment. In other words, you can throw any suspicious file at it and in a matter of seconds Cuckoo will provide […]

Tags: , , , , , , , ,

Posted in: Countermeasures, Forensics, Malware, Security Software | Add a Comment
Intel Hidden Management Engine – x86 Security Risk?

Intel Hidden Management Engine – x86 Security Risk?

So it seems the latest generation of Intel x86 CPUs have implemented a Intel hidden management engine that cannot be audited or examined. We can also assume at some point it will be compromised and security researchers are labelling this as a Ring -3 level vulnerability. This isn’t a new issue though, people have been […]

Tags: , , , , , , ,

Posted in: Exploits/Vulnerabilities, Hardware Hacking | Add a Comment
FIDO - Automated Incident Response

Fully Integrated Defense Operation (FIDO) – Automated Incident Response

FIDO is an orchestration layer which enables an automated incident response process by evaluating, assessing and responding to malware. FIDO’s primary purpose is to handle the heavy manual effort needed to evaluate threats coming from today’s security stack and the large number of alerts generated by them. As an orchestration platform FIDO can make using […]

Tags: , , , , , , , ,

Posted in: Countermeasures, General Hacking, Security Software | Add a Comment
Unicorn - PowerShell Downgrade Attack

Unicorn – PowerShell Downgrade Attack

Magic Unicorn is a simple tool for using a PowerShell downgrade attack to inject shellcode straight into memory. Based on Matthew Graeber’s PowerShell attacks and the PowerShell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18. Usage is simple, just run Magic Unicorn (ensure Metasploit is installed and in the right […]

Tags: , , , , , , , , , , ,

Posted in: Hacking Tools, Windows Hacking | Add a Comment
Web Application Log Forensics After a Hack

Web Application Log Forensics After a Hack

Sites get hacked, it’s not pleasant but it happens. A critical part of it, especially in my experience, has been the web application log forensics applied directly after an attack. You can usually piece together what happened, especially if the attacker doesn’t rotate IP addresses during the attack. With a little poking around and after […]

Tags: , , , , , , , , ,

Posted in: Advertorial, Forensics | Add a Comment
movfuscator - Compile Into ONLY mov Instructions

movfuscator – Compile Into ONLY mov Instructions

The M/o/Vfuscator (short ‘o’, sounds like “mobfuscator”) helps programs compile into only mov instructions, and nothing else – no cheating. Arithmetic, comparisons, jumps, function calls, and everything else a program needs are all performed through mov operations; there is no self-modifying code, no transport-triggered calculation, and no other form of non-mov cheating. The compiler currently […]

Tags: , , , , , , , , ,

Posted in: Malware, Programming | Add a Comment