Archive | January, 2009

Next-Gen Botnets Taking The Place of Storm and Srizbi

Don't let your data go over to the Dark Side!


Back in November there was a considerable drop in Spam when Spam friendly ISP McColo was cut off from the Internet by it’s upstream peer.

Srizbi worm was pretty smart though and was picking up again by the end of November. Later in the year the botnets were somewhat neutralised leading to a huge drop in spam.

But now, they are back – re-engineered – and ready to spam without going down again.

The demise late last year of four of the world’s biggest spam botnets was good news for anyone with an email inbox, as spam levels were cut in half – almost overnight. But the vacuum has created opportunities for a new breed of bots, some of which could be much tougher to bring down, several security experts are warning.

New botnets with names like Waledac and Xarvester are filling the void left by the dismantling of Storm and the impairment of Bobax, Rustock, and Srizbi, these researchers say. The new breed of botnets – massive networks of infected Windows machines that spammers use to blast out billions of junk messages – sport some new designs that may make them more immune to current take-down tactics.

Waledac is a good example. It appears to be a complete revision of Storm, that includes the same state-of-the-art peer-to-peer technology and fast-flux hosting found in its predecessor, according to researcher Joe Stewart of Atlanta-based security provider SecureWorks. But it differs from Storm in one significant way: Weak encryption protocols, which proved to be an Achilles Heel that led to its downfall, have been completely revamped

That’s one problem with attacking these botnets and the malware behind them, the people doing it aren’t kids having fun. They are business syndicates making serious money, so whatever you do – they are going to learn from it and adapt their software and methods to circumnavigate it.

That’s what seems to be happening now with Waledac, a new re-engineered version of Storm with stronger encryption protocols. They learnt from their mistakes and released a new, updated and more powerful version.

What amazes me is that in the Xarvester malware, it actually makes use of the Windows crash reports – sending them to the developers to make the bot more stable!

“Several researchers are actively studying the communications, but I don’t know if and when it will be broken and hijackable,” said Jose Nazario, a security researcher at Arbor Networks. “The guys behind the botnet seems intent on staying up and so evading researchers seems like the most appropriate thing to do.”

Waledac has amassed some 10,000 zombie computers so far, a tiny fraction of the bigger botnets. But Stewart expects it to be a major player in the coming months. Meanwhile, a spam botnet called Xarvester is making similar inroads. It is the world’s third-biggest spammer, accounting for over 13 percent of the world’s spam, according to Marshall. What’s more, its uncanny resemblance to Srizbi has sparked suspicions it is a reincarnation of that notorious botnet. Similarities include an HTTP-based command and control center that uses non-standard ports, encrypted template files used to send spam and configuration files with the common formats and data.

It also has a sophisticated feedback system that helps bot developers squash bugs so the software is harder to detect on a victim’s machine.

“Just like Srizbi, Xarvester has the ability to upload the Windows minidump crash dump file to a control server in the event that the bot crashes a system,” according to this analysis from Marshall. “This is presumably to help the botnet controllers debug their bot software.”

It seems like Xarvester has some uncanny resembelances to Srizbi too, so maybe it’s a new updated release from the same group which fixes the flaws that made Srizbi fail in the long term.

The infection rates for these bots are quite low currently, but due to the new measures the developers have taken they are likely to gain many more infections and be much harder to remove/detect and stop.

Source: The Register


Posted in: Malware, Phishing, Spammers & Scammers

Tags: , , , , , , , , , , , , , , , ,

Posted in: Malware, Phishing, Spammers & Scammers | Add a Comment
Recent in Malware:
- PEiD – Detect PE Packers, Cryptors & Compilers
- Mac OS X Ransomware KeRanger Is Linux Encoder Trojan
- Veil Framework – Antivirus Evasion Framework

Related Posts:

Most Read in Malware:
- Nasty Trojan Zeus Evades Antivirus Software - 77,470 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,584 views
- US considers banning DRM rootkits – Sony BMG - 44,977 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


The Associative Word List Generator (AWLG) – Create Related Wordlists for Password Cracking

Cybertroopers storming your ship?


You may remember some time back we did a fairly exhaustive post on Password Cracking Wordlists and Tools for Brute Forcing.

Wyd the Password Profiling Tool also does something similar to AWLG but it’s a PERL script rather than being based online.

I’d prefer if AWLG let us download an offline version too personally.

About AWLG

The Associative Word List Generator (AWLG) is a tool that generates a list of words relevant to some subjects, by scouring the Internet in an automated fashion.

Inclusion Example: A search string including the words (without quotes): “steve carell” would give us a word list with lots of words associated with the actor Steve Carell. This includes all of the words from his MySpace page, words from the Wikipedia article on him, etc.

Exclusion Example: We know that Steve Carell is an actor for lots of things, including a show called “The Office”. A search string: “steve carell” with omissions: “office” and “michael scott” would find words from websites that mention Steve Carell, but do not mention the word “office”, “michael”, or “scott”.

Privacy policy

AWLG.org does not record any transmitted search strings or user information. AWLG.org does record statistical information such as total site usage, total number of words generated per search, etc.

You can get cracking with AWLG here:

http://awlg.org/index.gen


Posted in: Hacking Tools, Password Cracking

Tags: , , , , , , , , , ,

Posted in: Hacking Tools, Password Cracking | Add a Comment
Recent in Hacking Tools:
- Recon-ng – Web Reconnaissance Framework
- INURLBR – Advanced Search Engine Tool
- DNSRecon – DNS Enumeration Script

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,969,295 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,387,123 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 674,106 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Fake CNN Site From Phishing E-mail Serves Trojan

Don't let your data go over to the Dark Side!


The latest Phishing E-mails going round are leveraging on people’s need to digest the latest information, in this case about the Israel-Hamas conflict.

They set up a fake CNN site which prompts you to upgrade your flash player to view the video, of course it’s not Flash but a Trojan targeting your sensitive financial information.

I don’t think anyone reading this site would fall for this, but it’s good to be aware of it so you can let others know.

A new e-mail that is circulating looks like it comes from CNN and links to a fake CNN Web page offering “graphic” video related to the Israel-Hamas conflict but instead hosts a Trojan that steals sensitive data, RSA said on Thursday.

When someone clicks on the video link on the fake CNN site an error message pops up urging the visitor to download the latest version of Adobe Flash Player. Clicking on the download link installs an “SSL stealer” Trojan that captures financial and other sensitive information, RSA said in a blog.

The Trojan looks for encrypted communications between the computer and known financial institutions and when it sees data being sent it diverts it to a malicious third-party, said Sam Curry, vice president of product management and strategy at RSA.

It’s an interesting piece of malware, it seems to go after SSL communications and carries out some kind of man in the middle attack by redirecting the valuable SSL traffic to a malicious 3rd party website.

Not as simple as the usual crap which just infects the computer as a spam zombie or infests it with pop-up adverts for casinos and viagra.

The social-engineering attack is different in that the e-mail pretends to come from a media company and then tries to steal financial data, he said. “Normally when you get phished they send you an e-mail pretending to be from a bank or other financial institution,” he said.

RSA discovered the attack early on Wednesday and has worked with others to get the fake site shut down. At a peak on Thursday as many as 80,000 of the phishing e-mails were being sent out, according to Curry.

It seems to be reasonably wide spread, but not huge. It does pose some kind of a threat and I think organizations should perhaps send out some kind of memo about this as I’m sure there’s a lot of legitimate CNN Articles being forwarded around so this one might slip through and land someone in trouble.

As always – be vigilant!

Source: Cnet (Thanks Navin)


Posted in: Malware, Phishing, Spammers & Scammers

Tags: , , , , , , , , , , , , ,

Posted in: Malware, Phishing, Spammers & Scammers | Add a Comment
Recent in Malware:
- PEiD – Detect PE Packers, Cryptors & Compilers
- Mac OS X Ransomware KeRanger Is Linux Encoder Trojan
- Veil Framework – Antivirus Evasion Framework

Related Posts:

Most Read in Malware:
- Nasty Trojan Zeus Evades Antivirus Software - 77,470 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,584 views
- US considers banning DRM rootkits – Sony BMG - 44,977 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


OWASP (Open Web Application Security Project) Testing Guide v3 Released

Cybertroopers storming your ship?


This project’s goal is to create a “best practices” web application penetration testing framework which users can implement in their own organizations and a “low level” web application penetration testing guide that describes how to find certain issues.

Version 3 of the Testing Guide was released in last month in December 2008, the project was part of the OWASP Summer of Code, started on April 2008 reviewing the version 2 and improving it.

OWASP Testing Guide v3 is a 349 page book; they have split the set of active tests in 9 sub-categories for a total of 66 controls to test during the Web Application Testing activity.

Each control has an OWASP name, so for example a SQL Injection is called: OWASP-DV-005, meaning that it is the 5th control of the Data Validation category. They got a dream team of 21 authors and 4 reviewers: after 6 months of hard work and great team work we realized the v3.

The Guide is a “live” document: the project always needs your feedback! Please join the testing mailing list and share your ideas here.

You can download OWASP Testing Guide v3 here:

OWASP_Testing_Guide_v3.pdf

Download the presentation here
Browse the Testing Guide v3 on the wiki here

Or read more here.


Posted in: Countermeasures, Web Hacking

Tags: , , , , , ,

Posted in: Countermeasures, Web Hacking | Add a Comment
Recent in Countermeasures:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- PEiD – Detect PE Packers, Cryptors & Compilers
- NAXSI – Open-Source WAF For Nginx

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 119,985 views
- Password Hasher Firefox Extension - 117,692 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,696 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


TJX (T.J. Maxx and Marshall’s) Hacker Jailed For 30 Years

Cybertroopers storming your ship?


You should be familiar with the TJX case by now (TJX Largest Breach of Customer Data in U.S. History) and we’ve been following it here for a couple of years.

We reported back in August last year that the TJX Credit Card Hackers were Busted and now one of the 11 guys involved has been slammed with one of the longest ever cybercrime sentences. He wasn’t directly involved in the TJX hack but he does seem to be one of the ‘enablers’ trading the stolen details and aiding in money laundering. He he said to have a made a massive $11 million from this!

Yastremskiy – or ‘Maksik’ as he was sometimes identified – was one of 11 people eventually arrested at the request of the US Department of Justice, with the Ukrainian reportedly being apprehended in undignified fashion outside a Turkish nightclub in 2008.

Yastremskiy’s part in the crime was allegedly to have purchased credit card numbers stolen during the huge crime, providing the gang with an economic hub for its activities. Other members of the gang hailed from Estonia, Belarus, China, and several parts of the US itself, underlining the global nature of modern electronic crime.

Although not the perpetrator of the hack itself, Yastremskiy would have been essential to its success. He is reported to have been suspected of being behind other crimes not related to the TJX Maxx affair.

Apparently on top of the crazy life sentence (life sentence is usually considered as 25 years) he got fined $23,000 as well – but that’s peanuts compared to the 11 mills he’s made. I think it’s a pretty harsh sentence, but the guy was flaunting it…not very wise really. And he was committing some pretty serious offline fraud with the money laundering, he was bound to get screwed with the US on his tail.

He was actually charged in August when we reported it for trafficking in stolen credit card information harvested from a string of retail firms including TJX, OfficeMax, Barnes & Noble, Forever 21, DSW, and Marshall’s, amongst others.

The TJX hack will go down as the first major disclosed commercial hack in history, after US-based hackers were able to ‘wardrive’ their way into a poorly-protected Wi-Fi system used for point-of-sale traffic. Forty-five million customer credit cards were said to have been exposed, leaving parent company. TJX Maxx, owning up to potential liabilities of at least $118 million.

Security vendors queued up to declare their satisfaction at the sentence. “Yastremskiy will certainly have plenty of time to ponder whether his hacking activities were worthwhile,” commented Graham Cluley of Sophos.

“The length of this jail time should also make others engaged in cybercrime think again,” he said. “It may seem like the chances of being caught are small, but there are more and more convictions happening all the time, and the authorities are getting better than ever at co-operating at an international level to catch the bad guys.”

US authorities have filed extradition papers but he still stood trial in Turkey for separate offences, if he ever makes it to the US it’s a good guess that he can cut a sweet deal by being a star witness for the prosecution and getting a reduced sentence in a much more comfortable white-collar US prison.

What do you guys think about the sentence, too harsh?

Source: Network World


Posted in: General Hacking, Legal Issues

Tags: , , , , , , ,

Posted in: General Hacking, Legal Issues | Add a Comment
Recent in General Hacking:
- Dradis – Reporting Platform For IT Security Professionals
- Kid Gets Arrested For Building A Clock – World Goes NUTS
- Drones, Tor & Remailers – The Story Of A High-Tech Kidnapping

Related Posts:

Most Read in General Hacking:
- 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) - 1,167,482 views
- Hack Tools/Exploits - 620,745 views
- Password Cracking with Rainbowcrack and Rainbow Tables - 431,972 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Time and Attack Mapper AKA TA-Mapper – Time/Effort Estimator Tool For Blackbox Security Assessment

Don't let your data go over to the Dark Side!


Time and Attack Mapper (alternatively known as TA-Mapper) is an effort estimator tool for blackbox security assessment (or Penetration Testing) of applications. This tool provides more accurate estimation when compared to rough estimation. Penetration testers who always has hard time explaining/justifying the efforts charged (or quoted) to their customers can find this tool handy by able to calculate efforts with greater accuracy required for application penetration testing.

In addition, this tool helps application pen-testers in itemizing their penetration testing efforts into micro-level and provides more clarity of their pen-testing activities. In future the author has plans to extend this tool ability to generate test cases.

The tool was written back in 2004 to support a freelance assessment. The author was intrigued to write this tool when he was asked by one of his Fortune 100 customer to justify efforts quoted against the activities for a penetration testing assignment. It not just helped him win the project but also help him educate the customer in knowing the activities involved at the micro-level. After making few changes in the tool the author thought it has been kept private too long and it’s the right time to share it with the world.

How it works

The strength of this tool lies in the background factors that were taken into consideration which helps in making an accurate estimation.

The tool makes it calculation based on various test types set against individual attacks. Almost all attacks performed against an application involve different factors in the way it is tested. Hence those different factors make it more complex to make a generic calculation of efforts. Around seven different test types were identified where different complex factors were mapped and grouped to come up with a mathematical formula for calculating efforts against individual attacks.

You can download TA-Mapper here:

TA-Mapper.zip

Or read more here.


Posted in: General Hacking, Security Software

Tags: , , , , ,

Posted in: General Hacking, Security Software | Add a Comment
Recent in General Hacking:
- Dradis – Reporting Platform For IT Security Professionals
- Kid Gets Arrested For Building A Clock – World Goes NUTS
- Drones, Tor & Remailers – The Story Of A High-Tech Kidnapping

Related Posts:

Most Read in General Hacking:
- 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) - 1,167,482 views
- Hack Tools/Exploits - 620,745 views
- Password Cracking with Rainbowcrack and Rainbow Tables - 431,972 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Cisco Vulnerability Given ‘Write Once, Run Anywhere’ Treatement

Cybertroopers storming your ship?


This is an interesting development in router security, Cisco bugs have been popping up now and then – not that often – but usually when they do they are quite serious.

The problem with them was you needed so many variations unless you were just targeting one specific router, with that specific version of IOS and hardware. Now someone has applied the ‘Write Once, Run Anywhere’ programming principle to Cisco exploits enabling one exploit to run on a far wider variety of Cisco platforms than was previously possible.

This is quite serious as most of the Internet architecture is based at some point of peering on a Cisco device.

A researcher has discovered a way to reliably exploit a known security vulnerability in a wide class of Cisco System routers, a finding that for the first time allows attackers to hijack millions of devices with a single piece of code.

The discovery by Felix “FX” Lindner of Recurity Labs in Berlin brings the write-once-run-anywhere approach of software development to the dark art of compromising routers that form the core of the internet. Previously, reliable exploit code had to be specifically fashioned to one of more than 15,000 different supported builds of IOS, or Internet Operating System, which run various Cisco devices.

“What FX has shown, conclusively, is that when something comes out that can potentially compromise your router, you have to get on it as you would get on a remote vuln, for, say, your domain controllers or database servers,” said Dan Kaminsky, a fellow researcher who has reviewed Lindner’s findings (PDF). “Router infrastructure has been conclusively proven to be as generically vulnerable as commodity operating systems.”

FX who is better known from his association with Phenoelit recently demonstrated his findings at CCC (Chaos Communication Congress) with a known vulnerability.

If this gets into the wrong hands it could be bad new, but then as always I would assume it’s already in the wrong hands and has been for time (and they’ve been using it) under the radar.

The problem with routers is that once comprised subtle changes can be made to the routing tables and firewall rules that can severely compromise a network and be very hard to detect.

Each image version of IOS loads programs in substantially different parts of the device’s memory. Until now, the randomization made it virtually impossible for weaponized exploit code to know ahead of time where to stash malicious payloads for the specific device it was targeting. Lindner was able to work through this limitation by observing the behavior of software known as ROMmon, which is analogous to the ubiquitous bios software found on personal computers.

By using small chunks of ROMmon, Lindner has shown that it’s possible to drop code into specific memory locations and then execute it. At last week’s Chaos Communication Congress he used the technique to reliably exploit a known vulnerability across a wide class of Cisco routers. The exploit disabled the devices’ CPU caches and instead got them to load his own code.

The method works on any Cisco device that uses a PowerPC processor, which includes the widely used 2600 and 17000 series routers. He has yet to find a similarly reliable way to attack Cisco gear that uses MIPS microprocessors, but said he is close.

In the last part of the article they raise a very good point, it is extremely hard to update a router with IOS, especially the older ones as it can really b0rk the configuration and leave you in a heap of trouble.

During many audits I’ve found core Cisco devices running horribly out of date software with serious remote exploits.

I hope Cisco addresses this and makes it easier for their clients to keep running a secure version.

Source: The Register


Posted in: Exploits/Vulnerabilities, Hardware Hacking, Network Hacking

Tags: , , , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Hardware Hacking, Network Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?
- DROWN Attack on TLS – Everything You Need To Know

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,086 views
- AJAX: Is your application secure enough? - 119,985 views
- eEye Launches 0-Day Exploit Tracker - 85,455 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


WITOOL v0.1 – GUI Based SQL Injection Tool in .NET

Cybertroopers storming your ship?


WITOOL is an graphical based SQL Injection Tool written in dotNET.

– For SQL Server, Oracle
– Error Base and Union Base

Interface

WITOOL v0.1 SQL Injection Tool

Features

  • Retrieve schema : DB/TableSpace, Table, Column, other object
  • Retrieve data : retrive paging, dump xml file
  • Log : View the raw data HTTP log

Environment

OS: Windows 2000/XP/VISTA
Requirement: Microsoft .NET(2.0) Library (Download Here).

You can download WITOOL v0.1 here:

WITOOL_V0.1_081231.zip

Or read more here.


Posted in: Database Hacking, Hacking Tools, Web Hacking

Tags: , , , , , , , , ,

Posted in: Database Hacking, Hacking Tools, Web Hacking | Add a Comment
Recent in Database Hacking:
- Onapsis Bizploit v1.50 – SAP Penetration Testing Framework
- OAT – Oracle Auditing Tools For Database Security
- ODAT (Oracle Database Attacking Tool) – Test Oracle Database Security

Related Posts:

Most Read in Database Hacking:
- Pangolin – Automatic SQL Injection Tool - 75,987 views
- bsqlbf 1.1 – Blind SQL Injection Tool - 54,297 views
- SQLBrute – SQL Injection Brute Force Tool - 40,564 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Recent in Phishing:
- Gophish – Open-Source Phishing Framework
- sptoolkit Rebirth – Simple Phishing Toolkit
- ICANN Hacked Including Root DNS Systems

Related Posts:

Most Read in Phishing:
- Twitter DM Phishing Scam - 28,940 views
- yahoo password grabber - 19,120 views
- Digital Underground Offering Cheap Botnets For Hire - 15,404 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95