Archive | May, 2011

Mac Malware Becoming a Serious Threat

Your website & network are Hackable


Malware on the ubiquitous Apple platform has always been scoffed at by Mac users, and it was fair enough really. There weren’t a whole lot of Mac users so the effort to develop malware for the Mac platform really wasn’t worth it.

The platform has exploded though with Macs being the weapon of choice for all the hipsters and yuppies out there, we wrote about Apple Struggling With Security & Malware back in 2009.

In 2010 we saw Sophos Launch a FREE Anti-Virus Software For Mac and in 2011 we saw a JAVA based cross platform trojan that also effected Mac machines.

Apple — and many Mac users — argue that Mac OS X has a special recipe for security that makes it less likely to be infected with malware. Many security researchers counter that the Mac’s seeming immunity stems not from its security, but from its lack of market share.

The debate may finally be settled. The emergence of a serious malware construction kit for the Mac OS X seems to mimic a 2008 prediction by a security researcher. The prediction comes from a paper written in IEEE Security & Privacy, which used game theory to predict that Macs would become a focus for attackers as soon as Apple hit 16 percent market share.

Last week, security researchers pointed to a construction kit for creating Trojans for the Mac OS X as a major issue for Mac users. Currently, three countries — Switzerland, Luxembourg and the United States — have Mac market share around that level.

“The kit is being sold under the name Weyland-Yutani Bot and it is the first of its kind to hit the Mac OS platform,” Peter Kruse, partner and security specialist at security firm CSIS, writes in a blog post. “CSIS finds this crimekit to be quite disturbing news since Mac OS previously to some degree has been spared from the increasing amount of malware which has haunted Windows-based systems for years.”

The prediction in the paper was that Mac would start being targeted when they reached a 16% market share, which has happened recently in 3 countries. There is not a trojan creation kit targeting Mac OSX – this makes threats on the platform a reality.

The original paper can be found here – j3attAO.pdf

The fact is that Mac users probably still don’t run anti-virus software because they don’t believe they need to, these threats could spread fast.


Weyland-Yutani Bot, named for the corporation in the 1979 movie Alien, is currently being sold by its developers. While it is not the first attack on the Mac OS X, crimeware has enabled criminals in the past to scale up attacks quickly.

“What is happening is that people are testing the waters,” says Adam O’Donnell, chief architect of the cloud technology group at SourceFire and the author of the 2008 paper. “It just becomes economically viable to do it, so you start seeing these attacks becoming more common.”

The 2008 paper used game theory to calculate when attackers would start seeing a payoff in focusing on the Mac OS X over Windows. It simplified the problem by assuming that all PC users ran antivirus software and that no Mac users did. The assumptions helped reduce the problem down to two factors: the effectiveness of the defenses and the marketshare of the dominant platform.

With detection rates for antivirus in the 80 percent range, the Mac OS X becomes an attractive target around 16 percent marketshare. If PC defenses are better than 80 percent, then the Mac market share at which attackers become interested drops. For example, if antivirus programs detect attack 90 percent of the time, then attackers will focus on the Mac OS X at approximately 6 percent marketshare, says O’Donnell.

“It is much more of an argument that at the low rates of penetration of the Mac in the market is why there is no malware,” he says. “You get a few points up, and like we are seeing now, you will start seeing malware.”

But even still, with AV software installed doesn’t make your computer the bastion of security. AV software still works on a reactive basis, there still is no real proactive security. AV heuristics are crap, they don’t detect anything.

Signatures still need to be updated and pushed out, and can be avoided. Especially by morphing software, the new generations of trojan and bot software are much more advanced than any AV system.

Source: Network World


Posted in: Apple, Malware

Tags: , , , , , , , , , , , , ,

Posted in: Apple, Malware | Add a Comment
Recent in Apple:
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- FBI Backed Off Apple In iPhone Cracking Case
- Mac OS X Ransomware KeRanger Is Linux Encoder Trojan

Related Posts:

Most Read in Apple:
- KisMAC – Free WiFi Stumbler/Scanner for Mac OS X - 83,032 views
- Apple Struggling With Security & Malware - 24,140 views
- Java Based Cross Platform Malware Trojan (Mac/Linux/Windows) - 15,964 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


peepdf – Analyze & Modify PDF Files

Find your website's Achilles' Heel


peepdf is a Python tool to explore PDF files in order to find out if the file can be harmful or not. The aim of this tool is to provide all the necessary components that a security researcher could need in a PDF analysis without using 3 or 4 tools to make all the tasks. With peepdf it’s possible to see all the objects in the document showing the suspicious elements, supports all the most used filters and encodings, it can parse different versions of a file, object streams and encrypted files.

With the installation of Spidermonkey and Libemu it provides Javascript and shellcode analysis wrappers too. Apart of this it’s able to create new PDF files and to modify existent ones.

Features

Analysis

  • Decodings: hexadecimal, octal, name objects
  • More used filters
  • References in objects and where an object is referenced
  • Strings search (including streams)
  • Physical structure (offsets)
  • Logical tree structure
  • Metadata
  • Modifications between versions (changelog)
  • Compressed objects (object streams)
  • Analysis and modification of Javascript (Spidermonkey): unescape, replace, join
  • Shellcode analysis (sctest wrapper, Libemu)
  • Variables (set command)
  • Extraction of old versions of the document

Creation/Modification:

  • Basic PDF creation
  • Creation of PDF with Javascript executed wen the document is opened
  • Creation of object streams to compress objects
  • Embedded PDFs
  • Strings and names obfuscation
  • Malformed PDF output: without endobj, garbage in the header, bad header…
  • Filters modification
  • Objects modification

With all the recent PDF security scares and PDF hacking it’s important to have adequate tools for PDF analysis.

There are some other tools for dealing with PDF Analysis like:

PDFResurrect v0.9 Released – PDF Analysis and Scrubbing Utility & Origami – Parse, Analyze & Forge PDF Documents.

You can download peepdf here:

peepdf-0.1.zip

Or read more here.


Posted in: Forensics, Hacking Tools, Privacy

Tags: , , , , , , , , , , ,

Posted in: Forensics, Hacking Tools, Privacy | Add a Comment
Recent in Forensics:
- Cuckoo Sandbox – Automated Malware Analysis System
- Web Application Log Forensics After a Hack
- CapTipper – Explore Malicious HTTP Traffic

Related Posts:

Most Read in Forensics:
- NetworkMiner – Passive Sniffer & Packet Analysis Tool for Windows - 66,476 views
- raw2vmdk – Mount Raw Hard Disk (dd) Images As VMDK Virtual Disks - 34,465 views
- OpenDLP – Free & Open-Source Data Loss Prevention (DLP) Tool - 29,726 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


VUPEN Whitehats Claim To Have Broken Chrome Sandbox

Your website & network are Hackable


The big news recently is that someone has finally managed to pop the formidable Chrome browser, as we know from following Pwn2Own – it’s been safe for 3 years in a row.

It has a sandbox, ASLR and DEP and that’s a pretty heavy combination to keep users safe from malicious software coming in via the web browser. VUPEN (a French infosec consultancy) claims to have broken ALL of these defenses allowing them to execute code using the browser on the latest version of Chrome.

Do bear in mind however as of now this is just a claim, there’s a video of the exploit in action – but that doesn’t prove anything either.

Researchers say they’ve developed attack code that pierces key defenses built into Google’s Chrome browser, allowing them to reliably execute malware on end user machines.

The attack contains two separate exploits so it can bypass the security counter measures, which include address space layout randomization (or ASLR), data execution prevention (or DEP), and a “sandbox” designed to isolate browser functions from core operating-system operations. So far, there have been relatively few reported exploits that can penetrate the sandbox, and that’s one of the reasons the browser has managed to emerge unscathed during the annual Pwn2Own hacker competition for three years in a row.

“While Chrome has one of the most secure sandboxes and has always survived the Pwn2Own contest during the last three years, we have now uncovered a reliable way to execute arbitrary code on any installation of Chrome despite its sandbox, ASLR and DEP,” researchers from France-based Vupen Security wrote in a blog post published on Monday.

The interesting part, and the thing that is causing a lot of debate (as per usual) is the disclosure policy by VUPEN. These guys are not going to tell Google, they say they will tell their clients for attack and defense purposes – but honestly? What good would a working exploit like this be in terms of defense? Unless you can perhaps add it into your IPS/IDS.

The only power/value I can see it having is in attack circumstances and from their attitude it seems like they will sell/rent this exploit out to the highest bidders. Scruples aside I have to say the bounty offered by Google definitely wouldn’t cut it in this case.


The Vupen researchers said they plan to share technical details of the exploit only with government customers “for defensive and offensive security.” Neither Google nor the public will be privy to the specifics.

“We’re unable to verify VUPEN’s claims at this time as we have not received any details from them,” a Google spokesman said. “Should any modifications become necessary, users will be automatically updated to the latest version of Chrome.”

Google to date has awarded more than $150,000 under its bug bounty program, which pays as much as $3133.7 for reports of serious security bugs.

As is typical with attacks that bypass security sandboxes, the Vupen proof-of-concept actually contains two separate exploits, said Chaouki Bekrar, the company’s CEO.

It’s an interesting attack vector if it does really work and if as is claimed – it’s reliable and repeatable. I’d like to see it verified somehow though, but unless Google gets their hands on the code – that’s extremely unlikely.

And well if it is real these two exploits combined into a deadly package would certainly be worth a LOT on the black market. Either way, it’s certainly providing a lot of PR coverage for VUPEN.

Source: The Register


Posted in: Exploits/Vulnerabilities, General Hacking

Tags: , , , , , , ,

Posted in: Exploits/Vulnerabilities, General Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- Shadow Brokers NSA Hack Leaks 0-day Vulnerabilities
- Pompem – Exploit & Vulnerability Finder
- Bug Bounties Reaching $500,000 For iOS Exploits

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 235,401 views
- AJAX: Is your application secure enough? - 120,195 views
- eEye Launches 0-Day Exploit Tracker - 85,636 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


ArpON v2.2 Released – Tool To Detect & Block ARP Spoofing

Find your website's Achilles' Heel


ArpON (ARP handler inspection) is a portable handler daemon that make ARP secure in order to avoid the Man In The Middle (MITM) through ARP Spoofing/Poisoning attacks. It detects and blocks also derived attacks by it for more complex attacks, as: DHCP Spoofing, DNS Spoofing, WEB Spoofing, Session Hijacking and SSL/TLS Hijacking & co attacks.

This is possible using three kinds of anti ARP Poisoning techniques: the first is based on SARPI or “Static ARP Inspection” in statically configured networks without DHCP; the second on DARPI or “Dynamic ARP Inspection” in dynamically configured networks having DHCP; the third on HARPI or “Hybrid ARP Inspection” in “hybrid” networks, that is in statically and dynamically (DHCP) configured networks together.

SARPI, DARPI and HARPI protects both unidirectional, bidirectional and distributed attacks: into “Unidirectional protection” is required that ArpON is installed and running on one node of the connection attacked; into “Bidirectional protection” is required that ArpON is installed and running on two nodes of the connection attacked; into “Distributed protection” is required that ArpON is installed and running on all nodes of the connections attacked. All other nodes without ArpON will not be protected from attack.

ArpON is therefore a host-based solution that doesn’t modify ARP’s standard base protocol, but rather sets precise policies by using SARPI for static networks, DARPI for dynamic networks and HARPI for hybrid networks thus making today’s standardized protocol working and secure from any foreign intrusion.


Features

  • It detects and blocks Man In The Middle through ARP Spoofing/Poisoning attacks in statically, dynamically (DHCP), hybrid configured networks
  • It detects and blocks derived attacks: DHCP Spoofing, DNS Spoofing WEB Spoofing, Session Hijacking, SSL/TLS Hijacking & co
  • It detects and blocks unidirectional, bidirectional and distributed attacks
  • Doesn’t affect the communication efficiency of ARP protocol
  • Doesn’t affect the race response time from attacks
  • Multi-threading on all OS supported
  • It manages the network interface into unplug, boot, hibernation and suspension OS features
  • It works in userspace for OS portability reasons
  • Easily configurable via command line switches, provided that you have root permissions
  • Tested against Ettercap, Cain & Abel, dsniff and other tools

You can download ArpON v2.2 here:

ArpON-2.2.tar.gz

Or read more here.


Posted in: Countermeasures, Network Hacking

Tags: , , , , , , , , , , , , , , ,

Posted in: Countermeasures, Network Hacking | Add a Comment
Recent in Countermeasures:
- OpenIOC – Sharing Threat Intelligence
- Cuckoo Sandbox – Automated Malware Analysis System
- Fully Integrated Defense Operation (FIDO) – Automated Incident Response

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,195 views
- Password Hasher Firefox Extension - 117,850 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,740 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Sony Loses 25 Million More Customer Account Details Through SOE (Sony Online Entertainment)

Find your website's Achilles' Heel


I actually misread this news at first and thought it was an additional leak from the Sony PlayStation Network (PSN) Hack that has been flooding the news, but sadly for Sony this is an entirely different hack carried out at the same time.

It turns out around the same time PSN got hacked SOE (Sony Entertainment Online) also got hacked and critically an ‘old’ payment details table was stolen that contained credit card details.

It looks like Sony has been hacked REAL hard this time, perhaps some splinter cell of Anonymous really is laying the smackdown on them.

Sony warned that personally identifiable information for an additional 25 million customers was exposed after discovering a massive security breach extended to its online computer games service.

The intrusion on Sony Online Entertainment systems exposed data for 24.6 million users, including their name, address, email address, birthdate, phone number, and login name. Those behind the attack likely also made off with passwords that were hashed, although Sony didn’t address critical details, including what hashing algorithm was used and whether random values known as salt were used to prevent crooks from converting hashes into cleartext.

Sony also warned that that the SOE attackers may also have stolen an “outdated database” that stored data for some 12,700 payment cards belonging to customers located in Europe. The majority of SOE card information was stored in a “main credit card database” that was “in a completely separate and secured environment” that Sony analysts don’t believe was accessed.

The warning came a day after Sony closed the SOE’s Station.com website, because investigators “discovered an issue that warrants enough concern for us to take the service down effective immediately.”

As mentioned in the previous post comments, Sony also warned that the PSN hack could have exposed 10 million credit card details.

The latest news is that SOE was hacked resulting in 25 million customer accounts being exposed and the possibility of 12,000 sets of payment details being exposed is there too.

If you add up the numbers – in one week Sony has managed to expose over 100 million user accounts, that’s quite a feat.


Combined with a previously reported hack on the company’s PlayStation Network, in which sensitive data for 78 million users is believed to have been stolen, the new disclosure means Sony has exposed personally identifiable information for 102.6 million user accounts. Sony has said that the passwords in the previously disclosed attack were also hashed, but so far hasn’t supplied the same crucial details.

For the first time, Sony hinted that it would compensate users for the cost of enrolling in programs designed to prevent identity theft. “The implementation will be at a local level and further details will be made available shortly in each region,” Tuesday’s press release from Sony said.

The company also said SOE users will get 30 free days of additional time on their subscriptions and compensation of one day for each day the system is down. Sony hasn’t said when it expects to restore SOE service. It has said that PSN and Qriocity services will be progressively restarted over the coming week.

The intrusion on SOE happened on April 16 and 17, around the same time as the attack on the PSN, from April 17 to April 19. Sony closed the PSN on April 20, but didn’t disclose the extent of the breach until six days later. Security experts have already said that the amount of information believed to have been stolen in the PSN hack, and the number of users affected, means the attackers had sustained access to the core parts of Sony’s network.

It seems like they are considering ways of compensating their users for the downtime, the same can’t be said for PSN as it’s a free service. I wonder if any more news is going to come out about this, if the main Sony database was breached that would be tragic.

I can see them getting in some hot legal waters over all this data-loss. There are rumours that the main credit card database was compromised, but so far Sony has denied this and stated there is no evidence pointing to that.

Either way it’s an interesting case and I’m just waiting to see where else it’s going to go.

Source: The Register


Posted in: Legal Issues, Privacy

Tags: , , , , , ,

Posted in: Legal Issues, Privacy | Add a Comment
Recent in Legal Issues:
- The Panama Papers Leak – What You Need To Know
- FBI Backed Off Apple In iPhone Cracking Case
- TalkTalk Hack – Breach WAS Serious & Disclosed Bank Details

Related Posts:

Most Read in Legal Issues:
- Class President Hacks School Grades - 80,715 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,651 views
- One Of The World’s Most Prolific Music Piracy Groups Busted - 43,629 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


sslsnoop v0.6 – Dump Live Session Keys From SSH & Decrypt Traffic On The Fly

Find your website's Achilles' Heel


sslsnoop dumps live session keys from openssh and can also decrypt the traffic on the fly.

  1. Works if scapy doesn’t drop packets. using pcap instead of SOCK_RAW helps a lot now.
  2. Works better on interactive traffic with no traffic at the time of the ptrace. It follows the flow, after that.
  3. Dumps one file by fd in outputs/
  4. Attaching a process is quickier with –addr 0xb788aa98 as provided by haystack INFO:abouchet:found instance @ 0xb788aa98
  5. how to get a pickled session_state file : $ sudo haystack –pid pgrep ssh sslsnoop.ctypes_openssh.session_state search > ss.pickled

Not all ciphers are implemented.

Workings ciphers: aes128-ctr, aes192-ctr, aes256-ctr, blowfish-cbc, cast128-cbc
Partially workings ciphers (INBOUND only ?!): aes128-cbc, aes192-cbc, aes256-cbc
Non workings ciphers: 3des-cbc, 3des, ssh1-blowfish, arcfour, arcfour1280

It can also dump DSA and RSA keys from ssh-agent or sshd ( or others ).

You can download sslsnoop here:

trolldbois-sslsnoop.zip

Or read more here.


Posted in: Cryptography, Exploits/Vulnerabilities, Network Hacking

Tags: , , , , , , , , , , , , ,

Posted in: Cryptography, Exploits/Vulnerabilities, Network Hacking | Add a Comment
Recent in Cryptography:
- PEiD – Detect PE Packers, Cryptors & Compilers
- DROWN Attack on TLS – Everything You Need To Know
- Dell Backdoor Root Cert – What You Need To Know

Related Posts:

Most Read in Cryptography:
- The World’s Fastest MD5 Cracker – BarsWF - 47,776 views
- Hackers Crack London Tube Oyster Card - 45,087 views
- WPA2 Vulnerability Discovered – “Hole 196” – A Flaw In GTK (Group Temporal Key) - 33,167 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95