Hackers Could Become The Hacked?

Use Netsparker


It looks like someone is going after the bad guys in a new way, by hacking them back! It’s no news to us that many hacking tools and script kiddy trojan kits are badly programmed..a lot of them have back-doors and the client-side tools have easy exploits that enable you to take over the ‘hackers’ machine.

It’s certainly an interesting approach.

Eriksson, a researcher at the Swedish security firm Bitsec, uses reverse-engineering tools to find remotely exploitable security holes in hacking software. In particular, he targets the client-side applications intruders use to control Trojan horses from afar, finding vulnerabilities that would let him upload his own rogue software to intruders’ machines.

He demoed the technique publicly for the first time at the RSA conference Friday.

“Most malware authors are not the most careful programmers,” Eriksson said. “They may be good, but they are not the most careful about security.”

He’s turned his attention to quite a few of the more popular pieces of mass-distributed malware and found holes in all of them. Those labeled as Remote Administration Tools (RATs) were extremely popular back in the days when Back Orifice, Netbus and Deepthroat first hit the scene. They are still used nowadays but there are newer variants.

Eriksson first attempted the technique in 2006 with Bifrost 1.1, a piece of free hackware released publicly in 2005. Like many so-called remote administration tools, or RATs, the package includes a server component that turns a compromised machine into a marionette, and a convenient GUI client that the hacker runs on his own computer to pull the hacked PC’s strings.

Pcshare_2Using traditional software attack tools, Eriksson first figured out how to make the GUI software crash by sending it random commands, and then found a heap overflow bug that allowed him to install his own software on the hacker’s machine.

The Bifrost hack was particularly simple since the client software trusted that any communication to it from a host was a response to a request the client had made. When version 1.2 came out in 2007, the hole seemed to be patched, but Eriksson soon discovered it was just slightly hidden.

It’ll be interesting to see what else he comes up with and if he can break into any of the big botnets like Storm or Kraken using this method.

That would certainly herald some interesting news.

Source: Wired Blog and thanks to Pantagruel for the heads up.

Posted in: Exploits/Vulnerabilities, Malware

, , , ,


Latest Posts:


snallygaster - Scan For Secret Files On HTTP Servers snallygaster – Scan For Secret Files On HTTP Servers
snallygaster is a Python-based tool that can help you to scan for secret files on HTTP servers, files that are accessible that shouldn't be public and can pose a s
Portspoof - Spoof All Ports Open & Emulate Valid Services Portspoof – Spoof All Ports Open & Emulate Valid Services
The primary goal of the Portspoof program is to enhance your system security through a set of new camouflage techniques which spoof all ports open and also emulate valid services on every port.
Cambridge Analytica Facebook Data Scandal Cambridge Analytica Facebook Data Scandal
One of the biggest stories of the year so far has been the scandal surrounding Cambridge Analytica that came out after a Channel 4 expose that demonstrated the depths they are willing to go to profile voters, manipulate elections and much more.
GetAltName - Discover Sub-Domains From SSL Certificates GetAltName – Discover Sub-Domains From SSL Certificates
GetAltName it's a little script to discover sub-domains that can extract Subject Alt Names for SSL Certificates directly from HTTPS websites which can provide you with DNS names or virtual servers.
Memcrashed - Memcached DDoS Exploit Tool Memcrashed – Memcached DDoS Exploit Tool
Memcrashed is a Memcached DDoS exploit tool written in Python that allows you to send forged UDP packets to a list of Memcached servers obtained from Shodan.
QualysGuard - Vulnerability Management Tool QualysGuard – Vulnerability Management Tool
QualysGuard is a web-based vulnerability management tool provided by Qualys, Inc, which was the first company to deliver vulnerability management services as a SaaS-based web-service.


3 Responses to Hackers Could Become The Hacked?

  1. zupakomputer April 16, 2008 at 2:31 pm #

    It hadn’t surprised me to see the amount of comments to some of the tools postings claiming they are viruses etc….

    same kind of idea as honeytraps really; at the end of the day right enough – if you’re using a machine to remote control another machine, then you’re also most likely using existing tools to mask your ID while you do that, and that means as long as the link is active it’s certainly probable.

    It’s trickier to resolve the originator if there’s no head node(s), and if they’ve written their own specialist hiding configs on a control node.

    Still though, when it comes to finding who’s behind a spam-ad blight….they could just check the addresses of where the products are mailed from, and how you go about ordering them in the first place. You won’t necessarily locate the computer people, but you’ll find someone that hired them.

    And if no to that last bit – well, can I get a safe place like that to order ganj from then? Well?

  2. fever April 17, 2008 at 4:35 am #

    agreed

    it could be too easy to backtrack a hacker out the hole he came in.
    imagine breaking into storm or kraken and using them against the builder of the botnet., or just that little script kiddie who keeps bothering you. the possibilities are almost endless.

  3. Yash Kadakia April 20, 2008 at 9:01 pm #

    I’m not surprised to see this happening, so many people use this tools with no understanding of them.

    A while back I did some research on the same; and I found tons of Keyloggers and Backdoor Softwares that had holes and backdoors in the client.

    I recently encountered a Remote Administration software, on reverse engineering we found that by sending the client a series of packets in a predefined order; it was possible to have the server run on that particular system.

    I personally use Sandboxie (http://www.sandboxie.com), to analyze any unknown or suspect worthy files.