Archive | January, 2009

Next-Gen Botnets Taking The Place of Storm and Srizbi

Your website & network are Hackable


Back in November there was a considerable drop in Spam when Spam friendly ISP McColo was cut off from the Internet by it’s upstream peer.

Srizbi worm was pretty smart though and was picking up again by the end of November. Later in the year the botnets were somewhat neutralised leading to a huge drop in spam.

But now, they are back – re-engineered – and ready to spam without going down again.

The demise late last year of four of the world’s biggest spam botnets was good news for anyone with an email inbox, as spam levels were cut in half – almost overnight. But the vacuum has created opportunities for a new breed of bots, some of which could be much tougher to bring down, several security experts are warning.

New botnets with names like Waledac and Xarvester are filling the void left by the dismantling of Storm and the impairment of Bobax, Rustock, and Srizbi, these researchers say. The new breed of botnets – massive networks of infected Windows machines that spammers use to blast out billions of junk messages – sport some new designs that may make them more immune to current take-down tactics.

Waledac is a good example. It appears to be a complete revision of Storm, that includes the same state-of-the-art peer-to-peer technology and fast-flux hosting found in its predecessor, according to researcher Joe Stewart of Atlanta-based security provider SecureWorks. But it differs from Storm in one significant way: Weak encryption protocols, which proved to be an Achilles Heel that led to its downfall, have been completely revamped

That’s one problem with attacking these botnets and the malware behind them, the people doing it aren’t kids having fun. They are business syndicates making serious money, so whatever you do – they are going to learn from it and adapt their software and methods to circumnavigate it.

That’s what seems to be happening now with Waledac, a new re-engineered version of Storm with stronger encryption protocols. They learnt from their mistakes and released a new, updated and more powerful version.

What amazes me is that in the Xarvester malware, it actually makes use of the Windows crash reports – sending them to the developers to make the bot more stable!

“Several researchers are actively studying the communications, but I don’t know if and when it will be broken and hijackable,” said Jose Nazario, a security researcher at Arbor Networks. “The guys behind the botnet seems intent on staying up and so evading researchers seems like the most appropriate thing to do.”

Waledac has amassed some 10,000 zombie computers so far, a tiny fraction of the bigger botnets. But Stewart expects it to be a major player in the coming months. Meanwhile, a spam botnet called Xarvester is making similar inroads. It is the world’s third-biggest spammer, accounting for over 13 percent of the world’s spam, according to Marshall. What’s more, its uncanny resemblance to Srizbi has sparked suspicions it is a reincarnation of that notorious botnet. Similarities include an HTTP-based command and control center that uses non-standard ports, encrypted template files used to send spam and configuration files with the common formats and data.

It also has a sophisticated feedback system that helps bot developers squash bugs so the software is harder to detect on a victim’s machine.

“Just like Srizbi, Xarvester has the ability to upload the Windows minidump crash dump file to a control server in the event that the bot crashes a system,” according to this analysis from Marshall. “This is presumably to help the botnet controllers debug their bot software.”

It seems like Xarvester has some uncanny resembelances to Srizbi too, so maybe it’s a new updated release from the same group which fixes the flaws that made Srizbi fail in the long term.

The infection rates for these bots are quite low currently, but due to the new measures the developers have taken they are likely to gain many more infections and be much harder to remove/detect and stop.

Source: The Register


Posted in: Malware, Phishing, Spammers & Scammers

Tags: , , , , , , , , , , , , , , , ,

Posted in: Malware, Phishing, Spammers & Scammers | Add a Comment
Recent in Malware:
- Cuckoo Sandbox – Automated Malware Analysis System
- movfuscator – Compile Into ONLY mov Instructions
- MISP – Malware Information Sharing Platform

Related Posts:

Most Read in Malware:
- Nasty Trojan Zeus Evades Antivirus Software - 77,514 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,635 views
- US considers banning DRM rootkits – Sony BMG - 44,988 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


The Associative Word List Generator (AWLG) – Create Related Wordlists for Password Cracking

Your website & network are Hackable


You may remember some time back we did a fairly exhaustive post on Password Cracking Wordlists and Tools for Brute Forcing.

Wyd the Password Profiling Tool also does something similar to AWLG but it’s a PERL script rather than being based online.

I’d prefer if AWLG let us download an offline version too personally.

About AWLG

The Associative Word List Generator (AWLG) is a tool that generates a list of words relevant to some subjects, by scouring the Internet in an automated fashion.

Inclusion Example: A search string including the words (without quotes): “steve carell” would give us a word list with lots of words associated with the actor Steve Carell. This includes all of the words from his MySpace page, words from the Wikipedia article on him, etc.

Exclusion Example: We know that Steve Carell is an actor for lots of things, including a show called “The Office”. A search string: “steve carell” with omissions: “office” and “michael scott” would find words from websites that mention Steve Carell, but do not mention the word “office”, “michael”, or “scott”.

Privacy policy

AWLG.org does not record any transmitted search strings or user information. AWLG.org does record statistical information such as total site usage, total number of words generated per search, etc.

You can get cracking with AWLG here:

http://awlg.org/index.gen


Posted in: Hacking Tools, Password Cracking

Tags: , , , , , , , , , ,

Posted in: Hacking Tools, Password Cracking | Add a Comment
Recent in Hacking Tools:
- DMitry – Deepmagic Information Gathering Tool
- Automater – IP & URL OSINT Tool For Analysis
- shadow – Firefox Heap Exploitation Tool (jemalloc)

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,981,451 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,434,190 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 680,877 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Fake CNN Site From Phishing E-mail Serves Trojan

Find your website's Achilles' Heel


The latest Phishing E-mails going round are leveraging on people’s need to digest the latest information, in this case about the Israel-Hamas conflict.

They set up a fake CNN site which prompts you to upgrade your flash player to view the video, of course it’s not Flash but a Trojan targeting your sensitive financial information.

I don’t think anyone reading this site would fall for this, but it’s good to be aware of it so you can let others know.

A new e-mail that is circulating looks like it comes from CNN and links to a fake CNN Web page offering “graphic” video related to the Israel-Hamas conflict but instead hosts a Trojan that steals sensitive data, RSA said on Thursday.

When someone clicks on the video link on the fake CNN site an error message pops up urging the visitor to download the latest version of Adobe Flash Player. Clicking on the download link installs an “SSL stealer” Trojan that captures financial and other sensitive information, RSA said in a blog.

The Trojan looks for encrypted communications between the computer and known financial institutions and when it sees data being sent it diverts it to a malicious third-party, said Sam Curry, vice president of product management and strategy at RSA.

It’s an interesting piece of malware, it seems to go after SSL communications and carries out some kind of man in the middle attack by redirecting the valuable SSL traffic to a malicious 3rd party website.

Not as simple as the usual crap which just infects the computer as a spam zombie or infests it with pop-up adverts for casinos and viagra.

The social-engineering attack is different in that the e-mail pretends to come from a media company and then tries to steal financial data, he said. “Normally when you get phished they send you an e-mail pretending to be from a bank or other financial institution,” he said.

RSA discovered the attack early on Wednesday and has worked with others to get the fake site shut down. At a peak on Thursday as many as 80,000 of the phishing e-mails were being sent out, according to Curry.

It seems to be reasonably wide spread, but not huge. It does pose some kind of a threat and I think organizations should perhaps send out some kind of memo about this as I’m sure there’s a lot of legitimate CNN Articles being forwarded around so this one might slip through and land someone in trouble.

As always – be vigilant!

Source: Cnet (Thanks Navin)


Posted in: Malware, Phishing, Spammers & Scammers

Tags: , , , , , , , , , , , , ,

Posted in: Malware, Phishing, Spammers & Scammers | Add a Comment
Recent in Malware:
- Cuckoo Sandbox – Automated Malware Analysis System
- movfuscator – Compile Into ONLY mov Instructions
- MISP – Malware Information Sharing Platform

Related Posts:

Most Read in Malware:
- Nasty Trojan Zeus Evades Antivirus Software - 77,514 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,635 views
- US considers banning DRM rootkits – Sony BMG - 44,988 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


OWASP (Open Web Application Security Project) Testing Guide v3 Released

Your website & network are Hackable


This project’s goal is to create a “best practices” web application penetration testing framework which users can implement in their own organizations and a “low level” web application penetration testing guide that describes how to find certain issues.

Version 3 of the Testing Guide was released in last month in December 2008, the project was part of the OWASP Summer of Code, started on April 2008 reviewing the version 2 and improving it.

OWASP Testing Guide v3 is a 349 page book; they have split the set of active tests in 9 sub-categories for a total of 66 controls to test during the Web Application Testing activity.

Each control has an OWASP name, so for example a SQL Injection is called: OWASP-DV-005, meaning that it is the 5th control of the Data Validation category. They got a dream team of 21 authors and 4 reviewers: after 6 months of hard work and great team work we realized the v3.

The Guide is a “live” document: the project always needs your feedback! Please join the testing mailing list and share your ideas here.

You can download OWASP Testing Guide v3 here:

OWASP_Testing_Guide_v3.pdf

Download the presentation here
Browse the Testing Guide v3 on the wiki here

Or read more here.


Posted in: Countermeasures, Web Hacking

Tags: , , , , , ,

Posted in: Countermeasures, Web Hacking | Add a Comment
Recent in Countermeasures:
- Cuckoo Sandbox – Automated Malware Analysis System
- Fully Integrated Defense Operation (FIDO) – Automated Incident Response
- MISP – Malware Information Sharing Platform

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,147 views
- Password Hasher Firefox Extension - 117,802 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,731 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


TJX (T.J. Maxx and Marshall’s) Hacker Jailed For 30 Years

Your website & network are Hackable


You should be familiar with the TJX case by now (TJX Largest Breach of Customer Data in U.S. History) and we’ve been following it here for a couple of years.

We reported back in August last year that the TJX Credit Card Hackers were Busted and now one of the 11 guys involved has been slammed with one of the longest ever cybercrime sentences. He wasn’t directly involved in the TJX hack but he does seem to be one of the ‘enablers’ trading the stolen details and aiding in money laundering. He he said to have a made a massive $11 million from this!

Yastremskiy – or ‘Maksik’ as he was sometimes identified – was one of 11 people eventually arrested at the request of the US Department of Justice, with the Ukrainian reportedly being apprehended in undignified fashion outside a Turkish nightclub in 2008.

Yastremskiy’s part in the crime was allegedly to have purchased credit card numbers stolen during the huge crime, providing the gang with an economic hub for its activities. Other members of the gang hailed from Estonia, Belarus, China, and several parts of the US itself, underlining the global nature of modern electronic crime.

Although not the perpetrator of the hack itself, Yastremskiy would have been essential to its success. He is reported to have been suspected of being behind other crimes not related to the TJX Maxx affair.

Apparently on top of the crazy life sentence (life sentence is usually considered as 25 years) he got fined $23,000 as well – but that’s peanuts compared to the 11 mills he’s made. I think it’s a pretty harsh sentence, but the guy was flaunting it…not very wise really. And he was committing some pretty serious offline fraud with the money laundering, he was bound to get screwed with the US on his tail.

He was actually charged in August when we reported it for trafficking in stolen credit card information harvested from a string of retail firms including TJX, OfficeMax, Barnes & Noble, Forever 21, DSW, and Marshall’s, amongst others.

The TJX hack will go down as the first major disclosed commercial hack in history, after US-based hackers were able to ‘wardrive’ their way into a poorly-protected Wi-Fi system used for point-of-sale traffic. Forty-five million customer credit cards were said to have been exposed, leaving parent company. TJX Maxx, owning up to potential liabilities of at least $118 million.

Security vendors queued up to declare their satisfaction at the sentence. “Yastremskiy will certainly have plenty of time to ponder whether his hacking activities were worthwhile,” commented Graham Cluley of Sophos.

“The length of this jail time should also make others engaged in cybercrime think again,” he said. “It may seem like the chances of being caught are small, but there are more and more convictions happening all the time, and the authorities are getting better than ever at co-operating at an international level to catch the bad guys.”

US authorities have filed extradition papers but he still stood trial in Turkey for separate offences, if he ever makes it to the US it’s a good guess that he can cut a sweet deal by being a star witness for the prosecution and getting a reduced sentence in a much more comfortable white-collar US prison.

What do you guys think about the sentence, too harsh?

Source: Network World


Posted in: General Hacking, Legal Issues

Tags: , , , , , , ,

Posted in: General Hacking, Legal Issues | Add a Comment
Recent in General Hacking:
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?
- Dradis – Reporting Platform For IT Security Professionals
- Kid Gets Arrested For Building A Clock – World Goes NUTS

Related Posts:

Most Read in General Hacking:
- 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) - 1,169,795 views
- Hack Tools/Exploits - 625,905 views
- Password Cracking with Rainbowcrack and Rainbow Tables - 434,227 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Time and Attack Mapper AKA TA-Mapper – Time/Effort Estimator Tool For Blackbox Security Assessment

Find your website's Achilles' Heel


Time and Attack Mapper (alternatively known as TA-Mapper) is an effort estimator tool for blackbox security assessment (or Penetration Testing) of applications. This tool provides more accurate estimation when compared to rough estimation. Penetration testers who always has hard time explaining/justifying the efforts charged (or quoted) to their customers can find this tool handy by able to calculate efforts with greater accuracy required for application penetration testing.

In addition, this tool helps application pen-testers in itemizing their penetration testing efforts into micro-level and provides more clarity of their pen-testing activities. In future the author has plans to extend this tool ability to generate test cases.

The tool was written back in 2004 to support a freelance assessment. The author was intrigued to write this tool when he was asked by one of his Fortune 100 customer to justify efforts quoted against the activities for a penetration testing assignment. It not just helped him win the project but also help him educate the customer in knowing the activities involved at the micro-level. After making few changes in the tool the author thought it has been kept private too long and it’s the right time to share it with the world.

How it works

The strength of this tool lies in the background factors that were taken into consideration which helps in making an accurate estimation.

The tool makes it calculation based on various test types set against individual attacks. Almost all attacks performed against an application involve different factors in the way it is tested. Hence those different factors make it more complex to make a generic calculation of efforts. Around seven different test types were identified where different complex factors were mapped and grouped to come up with a mathematical formula for calculating efforts against individual attacks.

You can download TA-Mapper here:

TA-Mapper.zip

Or read more here.


Posted in: General Hacking, Security Software

Tags: , , , , ,

Posted in: General Hacking, Security Software | Add a Comment
Recent in General Hacking:
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?
- Dradis – Reporting Platform For IT Security Professionals
- Kid Gets Arrested For Building A Clock – World Goes NUTS

Related Posts:

Most Read in General Hacking:
- 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) - 1,169,795 views
- Hack Tools/Exploits - 625,905 views
- Password Cracking with Rainbowcrack and Rainbow Tables - 434,227 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Cisco Vulnerability Given ‘Write Once, Run Anywhere’ Treatement

Your website & network are Hackable


This is an interesting development in router security, Cisco bugs have been popping up now and then – not that often – but usually when they do they are quite serious.

The problem with them was you needed so many variations unless you were just targeting one specific router, with that specific version of IOS and hardware. Now someone has applied the ‘Write Once, Run Anywhere’ programming principle to Cisco exploits enabling one exploit to run on a far wider variety of Cisco platforms than was previously possible.

This is quite serious as most of the Internet architecture is based at some point of peering on a Cisco device.

A researcher has discovered a way to reliably exploit a known security vulnerability in a wide class of Cisco System routers, a finding that for the first time allows attackers to hijack millions of devices with a single piece of code.

The discovery by Felix “FX” Lindner of Recurity Labs in Berlin brings the write-once-run-anywhere approach of software development to the dark art of compromising routers that form the core of the internet. Previously, reliable exploit code had to be specifically fashioned to one of more than 15,000 different supported builds of IOS, or Internet Operating System, which run various Cisco devices.

“What FX has shown, conclusively, is that when something comes out that can potentially compromise your router, you have to get on it as you would get on a remote vuln, for, say, your domain controllers or database servers,” said Dan Kaminsky, a fellow researcher who has reviewed Lindner’s findings (PDF). “Router infrastructure has been conclusively proven to be as generically vulnerable as commodity operating systems.”

FX who is better known from his association with Phenoelit recently demonstrated his findings at CCC (Chaos Communication Congress) with a known vulnerability.

If this gets into the wrong hands it could be bad new, but then as always I would assume it’s already in the wrong hands and has been for time (and they’ve been using it) under the radar.

The problem with routers is that once comprised subtle changes can be made to the routing tables and firewall rules that can severely compromise a network and be very hard to detect.

Each image version of IOS loads programs in substantially different parts of the device’s memory. Until now, the randomization made it virtually impossible for weaponized exploit code to know ahead of time where to stash malicious payloads for the specific device it was targeting. Lindner was able to work through this limitation by observing the behavior of software known as ROMmon, which is analogous to the ubiquitous bios software found on personal computers.

By using small chunks of ROMmon, Lindner has shown that it’s possible to drop code into specific memory locations and then execute it. At last week’s Chaos Communication Congress he used the technique to reliably exploit a known vulnerability across a wide class of Cisco routers. The exploit disabled the devices’ CPU caches and instead got them to load his own code.

The method works on any Cisco device that uses a PowerPC processor, which includes the widely used 2600 and 17000 series routers. He has yet to find a similarly reliable way to attack Cisco gear that uses MIPS microprocessors, but said he is close.

In the last part of the article they raise a very good point, it is extremely hard to update a router with IOS, especially the older ones as it can really b0rk the configuration and leave you in a heap of trouble.

During many audits I’ve found core Cisco devices running horribly out of date software with serious remote exploits.

I hope Cisco addresses this and makes it easier for their clients to keep running a secure version.

Source: The Register


Posted in: Exploits/Vulnerabilities, Hardware Hacking, Network Hacking

Tags: , , , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Hardware Hacking, Network Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- shadow – Firefox Heap Exploitation Tool (jemalloc)
- Intel Hidden Management Engine – x86 Security Risk?
- TeamViewer Hacked? It Certainly Looks Like It

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,985 views
- AJAX: Is your application secure enough? - 120,147 views
- eEye Launches 0-Day Exploit Tracker - 85,576 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


WITOOL v0.1 – GUI Based SQL Injection Tool in .NET

Find your website's Achilles' Heel


WITOOL is an graphical based SQL Injection Tool written in dotNET.

– For SQL Server, Oracle
– Error Base and Union Base

Interface

WITOOL v0.1 SQL Injection Tool

Features

  • Retrieve schema : DB/TableSpace, Table, Column, other object
  • Retrieve data : retrive paging, dump xml file
  • Log : View the raw data HTTP log

Environment

OS: Windows 2000/XP/VISTA
Requirement: Microsoft .NET(2.0) Library (Download Here).

You can download WITOOL v0.1 here:

WITOOL_V0.1_081231.zip

Or read more here.


Posted in: Database Hacking, Hacking Tools, Web Hacking

Tags: , , , , , , , , ,

Posted in: Database Hacking, Hacking Tools, Web Hacking | Add a Comment
Recent in Database Hacking:
- Onapsis Bizploit v1.50 – SAP Penetration Testing Framework
- OAT – Oracle Auditing Tools For Database Security
- ODAT (Oracle Database Attacking Tool) – Test Oracle Database Security

Related Posts:

Most Read in Database Hacking:
- Pangolin – Automatic SQL Injection Tool - 76,595 views
- bsqlbf 1.1 – Blind SQL Injection Tool - 54,427 views
- SQLBrute – SQL Injection Brute Force Tool - 41,063 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Recent in Phishing:
- Phishing Frenzy – E-mail Phishing Framework
- Gophish – Open-Source Phishing Framework
- sptoolkit Rebirth – Simple Phishing Toolkit

Related Posts:

Most Read in Phishing:
- Twitter DM Phishing Scam - 28,950 views
- yahoo password grabber - 19,140 views
- Digital Underground Offering Cheap Botnets For Hire - 15,482 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95