So I originally came up with this Idea for Counterterrorism a while ago and have modified it for Cyberwar conflict.  It goes like this.  Why are’nt more terrorists Killed on a daily basis by powers that can do it and have the will?  For the completely countervailing reason that usually trumps Direct Action.  Intelligence gathering. Plain and Simple.  INTs collection is used on a world wide basis to target actors.  However, Pre 9/11 completely showed a lack of will and balls to actually take care of problems for completely bullshit reasons.    Lawyers, human rights blah blah. Bureaucracy.  Apethy and pragmatic thought.


My solution for terrorists was this.  You all the INT collection you want.  But 1 [ONE] DAY EVERY YEAR you have a what I will term a BLACK NOVEMBER. What is it do you ask.  Its a kill pulse.  all the intelligence derived and gathered and fused and generated during the year gets put into a master target list.  And direct action takes place Syncronized.   This will have the immediate effect of Dramatically draining the SWAMP immediately, eliminating alot of the BS INTEL noise you get in collection efforts and clear the way for a new round of intel gathering, new link analysis and Intel collection.

Direct action will be expendable, and non-attributable and revolve around “accidents or otherwise mundane unfortunate circumstances”  Better not to attack that much attention unless thats what you want to go for.

I then evolved this concept to Terrorist electronic communication forums which present the inherent evil in allowed for dispursement of terrorist ideaology, plans, TTPs and other Terrorist crap.  So the BLACK NOVEMBER would essentially over time corrupt any backups of data that was being made, then target and destroy, Crypto attack or secure delete all world wide terrorist extremeist forums and other info material that is in direct control of mal actors.

One, this highly disruptive attack would sow CHAOS into the ranks, break communication mechanisms, force the reestablishment of new networks and comms that can be rapidly identified and tracked to be put into the next yearly Purge cycle for cyberwipe.

So after this I come to my 3rd evolution of BLACK NOVEMBER.  That is doing the same thing but targeting the numerous cybercrime forums, tool factories, egosites, and Botnet command and control sites that exist throughout the Internet. [NOTE: IF IT WASN'T ALREADY OBVIOUS. you do this Non-attributable, preferably geographically spread across the Internet IP space and Geographies, you also use massive variation in code, techniques, and character sets and styles.  Unless of course you don't care about attribution for the shock factor]

This can be a massive sweep or it could be a certain number of high threat target sets.  Either way, this pulse of cyberpurging would ENSURE ONE THING. That there are no excuses, no compromises, and real,…REAL action taken against at least the Technical mal-infrastructure that pervades the net and sucks like a vampire of our National Security and Economic Security.

I will be the first to say that I dont think our authorities have the will, vision, foresight, or balls to ever consider any of these actions.  However I will say this.  I am laying out there as a though meme, a destabilizing concept that needs to be expanded and discussed and further investigated….
SO WHAT…. DO YOU HAVE A BETTER SOLUTION?  If so fire away propose one.  And don’t rehash any of the ideas that have been bandied about for years.  Come up with something original.

Yes folks, we need a Phoenix Program for Cyber.  That’s what I’m saying.

So if you really want to know who some of the bastards are that are royally EFFIN you on a daily basis and are apart of the bacteria we call the malicious cyber crime hacker underground here we go.

FBI a 100 people in a US/Egyptian Phishing network.  The 3 ring leaders are US chumps, all young.


Kenneth Joseph Lucas, 25, Nichole Michelle Merzi, 24, and Jonathan Preston Clark, 25

Now is the time for a little Tar and Featherin’   Unfortunately that is only really useful for malactors that are operating with impunity in public and not arrested.  They have other things to worry about now. I will use this as an interesting experiment to post as much publicly obtainable information on these three ring leaders as possible.  Its not going to be tomorrow that they can live this down.

It would be interesting to flesh out why types of options, tactics, techniques and procedures one could come up with to implement cyber mob justice.  I might expand on that later but the possibilities are endless and extend beyond the virtual world to real real bad physical and other dimensions.  Its all a matter of how far you want to go.

I will start with Maltego/Google/Facebook and work my way out from there.

Sounds it was a typical financial phish organization , they got several million buck, they were tipped off by banks to the Feds in 2007.  So seeing how its almost 2010, it took the Feds approx 2 1/2 years to build a case.  I’m sure they do great work but that is WAY to slow to act on people.  We gotta step up the volume of arrest, Publicize all the members that are involved and HOPEfully slam them with charges like bank/wire fraud that may pop them for 20 years in the PEN.  Now that is nice.


Better get out the Vaseline boys and girls..   I would be curious to know what the fate is for the perps in Egypt.  Ill get back to that.

So everyone excepts the fact that Banker trojans can get in the middle of your SSL session, monitor for access to any arbitrary web site, and compromise the credentials and insert additional code to capture additional data.  Key examples of this are the Awesome malware samples of , and , , and others. I have the code for some of these and the Website target list is represented as a simple XML file.

In fact here is the Manual on Zeus.  This stuff is open source now so there will HUNDREDS of these out there with tons of spinoffs, customization, truly crime for the masses.  Go to to see what I mean.

User’s Guide (Draft)

= Contents =

1. Description and features.
2. Setting up the server.
2.1. HTTP-server.
2.2. The interpreter PHP.
2.3. MySQL-server.
2.4. Control Panel.
2.4.1. Installation.
2.4.2. Update.
2.4.3. File / system / fsarc.php.
3. Setting Bot.
4. Working with BackConnect.
5. Changelog.
6. F.A.Q.
7. Myths.

= 1. Description and features. =
ZeuS – software to steal personal user data from remote systems, Windows. On
plain language of “trojan”, “backdoor”, “virus”. But the author does not like these words, therefore, further documentation
He will call this software “Bot”.

Boat is fully based on the WinAPI Interception in UserMode (Ring3), this means that the bot does not use
drivers or treatments in Ring0. This feature makes it possible to run even on
Guest Account. Plus, it ensures greater stability and adaptability
on next versions of Windows.

Bot is written in Visual C + + version 9.0 +, with no additional libraries are used
(no msvcrt, ATL, MFC, QT, etc. used). Code is written with the following priorities (in descending order):
1. stability (carefully checked all the results of the call functions, etc.)
2. size (to avoid duplication of algorithms, repetitive calls, functions, etc.)
3. speed (not the type of instruction while (1 ){..}, for (int i = 0; i <strlen (str); i ++){..}).

Functions and features bot:
1. Sniffer traffic for the protocol TCP.
1.1. Interception of FTP logins on any port.
1.2. Interception of POP3 logins on any port.
1.3. The interception of any data from the traffic (a personal request).

2. Intercepting HTTP / HTTPS requests to wininet.dll, ie all programs working with this
library. This includes Internet Explorer (any version), Maxton, etc.
2.1. Substitution ..

3. The functions of the server.
3.1 Socks4/4a/5.
3.2 Backconnect for any services (RDP, Socks, FTP, etc.) on the infected machine. You can
access to a computer that is behind a NAT, or, for example, that
banned from the internet connection.
3.3 Getting a screenshot of your screen in real time.
– other not leasted features —

= 2. Setting up the server. =
The server is the central point of botnet’s control, it get reports from bots
and sends commands. It is not recommended to use the “Virtual Hosting” or “VDS”, because
with large botnet, the load on the server will increase, and this type of hosting is quite
quickly exhausted their resources. You need a “Dedicated Server” (DS), the recommended minimum

1. 2GB of RAM.
2. 2x CPU frequency 2 GHz,
3. SATA hard drive 7200rpm +

Bot requires HTTP-server with PHP + Zend Optimizer, and MySQL-server.

NOTE: For Windows-systems is very important to edit (create) the following registry value:
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Tcpip \ Parameters \ MaxUserPort = dword: 65534

– 2.1. HTTP-server. –
As an HTTP-server is recommended to use: for nix-systems – Apache version 2.2+, for
Windows-systems – IIS version 6.0+. We recommend that you keep the HTTP-server on port 80 or 443 (this
positive effect on bots number, as providers / proxy can block access to other
non-standard ports).

Download Apache:
or IIS:

– 2.2. The interpreter PHP. –
The latest version of the control panel designed for PHP 5.2.6. It is highly recommended
use the version is not lower than this version. But in extreme cases of not less than 5.2.

It is important to make the following settings in php.ini:

safe_mode = Off
magic_quotes_gpc = Off
magic_quotes_runtime = Off
memory_limit = 256M; or higher.
post_max_size = 100M; or higher.

and recommended to change the following settings:

display_errors = Off

Also need to add Zend Optimizer (acceleration of the script, and run the protected
scripts). We recommend version 3.3.

We do not recommend to use PHP as HTTP-CGI.

Download PHP:
Download Zend Optimizer:

– 2.3. MySQL-server. –
MySQL is required to store all data on botnet. The recommended version is not lower than 5.1.30, as well
worth considering that when the control panel in the older versions have some
problem. All table control panel, go to a MyISAM, it is important to optimize
speed of work with this format, on the basis of the available server resources.

We recommend the following changes to the MySQL-server setup (my or my.ini):

max_connections = 2000 # Or higher

Download MySQL:

– 2.4. Control Panel. –

2.4.1. Setting.
Appointment of files and folders:
/ install – the installer.
/ system – the system files.
/ system / fsarc.php – a script to call an external archiver (section 2.4.3).
/ system / config.php – config file.
/ theme – the theme file (design), without Zend can freely change.
cp.php – control panel.
gate.php – gate for bots.
index.php – empty file to prevent listing of files.

The control panel is usually located in your folder in the distribution server [php]. All contents of this
folder, you need to upload to the server in any directory accessible by HTTP. If you download it through
FTP, all files you download in binary mode.

To nix-systems exhibit the right:
. – 777
/ system – 777
/ tmp – 777

For Windows-systems:
\ system – the right to full write, read only for users of the under which the access
via HTTP. For IIS this is usually IUSR_ *.
\ tmp – as well as for the \ system.

Once all files are downloaded, you need a web browser to run the installer on the URL
. Follow the instructions appeared, in the case of
mistakes (you will be notified in detail) in the installation, check that all fields are correct,
and correct installation of the rights to the folder.

After installation, we recommend that you delete the directory install, and rename files cp.php (entrance to the
panel) and gate.php (gate for bots) in any files you want (don’t change the extension).

Now you can safely enter into the control panel by typing in the browser URL renamed
File cp.php.

2.4.2. Update.
If you have a new copy of the control panel, and want to update an older version, the
should do the following:

1) Copy the files a new panel in place of old ones.
2) Rename files cp.php and gate.php under their real names of your choice during installation
the old control panel.
3) In any case, the right to re-set the directory in accordance with paragraph 2.4.
4) with a browser to run the installer for URL , and
appeared to follow the instructions. The process of the installer may take a fairly large
period of time, this is due to the fact that some tables may be re-records.
5) You can use the new control panel.

2.4.3. File / system / fsarc.php.
This file contains a function to call an external archiver. At this time, archive
used only in “Reports:: Search in files” (reports_files), and is called to load
Files and folders in a single archive. By default, set to Zip archive, and is
universal for Windows and nix, so all you have to do is to install the system this
archive, and to the right in its execution. You can also edit this file to work with
any archiver.

Download Zip: .

= 3. Settings.       =

= 4. Working with BackConnect =
Working with BackConnect regarded as an example.

IP of BackConnect-server:
Port for the bot: 4500
Port for the client application: 1080

1) Run the server application (zsbcs.exe or zsbcs64.exe) on the server has an IP in
Internet application specifies the port, which is expected to connect from the bot, and the port to
which will connect the client application. For example zsbcs.exe listen-cp: 1080-bp: 4500,
where 1080 – the client port 4500 – port to the bot.

2) Required command (bc_add service server_host server_port) will be sended to bot, where the service –
port number or name * service, which needs to connect to the Bot.

* currently only supported in the name of socks, which allows you to connect to the built-in
Socks-bot server.

server_host – a server that zapusheno server application. It can be used IPv4,
IPv6, or domain.
server_port – a port that is specified in the option cp server application. In this case, 4500.

Example: bc_add socks 4500 – as a result you get the socks,
bc_add 3389 4500 – as a result you get rdp.

3) Now you need to wait for bot to connect to the server, in this period, any attempt to client
applications to connect will be ignored (will disconnect the client). When bot
connects, in server’s console will be output line: “Accepted new conection from bot …”.

4) After connecting the bot, you can work with their client. Ie you just
connect to the server to the client port (in this case 1080). For example, if you gave
command “socks”, a port on the client you will be expected to Socks-server, if port 3389, then
you connect to 192.168.100:1080 as a normal RDP.

5) After that, when you do not need BackConnect of the bot for a certain service, you must pay
click bc_del service server_host server_port, where all the parameters must be identical
parameters bc_add, which must be removed. You can also use the spec. characters
‘*’ And ‘?’.

For example: bc_del * * * – deletes all BackConnects from this bot.
bc_del * 192.168 .* * remove all backconnects, connect to the server with IP 192.168 .*.
bc_del 3389 4500 – specifically removes one backconnect.

1) You can specify any number of backconnects (ie bc_add), but they should not be shared
combination of IP + Port. But if there is such a combination, will be launched first added.
2) For each backconnect, you must run a separate server application.
3) if the connection (drop server drop bot, etc.), bot will repeat the connection
to the server indefinitely (even after rebooting the PC), until backconnect will not be removed
(ie bc_del).
4) As a service to bc_add, you can use any open port at the address
5) The server application supports IPv6, but in principle at the present time, this support is not particularly
6) You can launch the server application under wine. Writing the same elf application is currently not
7) It is recommended to use the option bp popular application server ports (80, 8080,
443, etc.), because other ports may be blocked by the provider of bot.
8) should not be allowed to connect to different bots on the same server port at the same time.
9) The method of such a connection might be useful for bots, which are outside the NAT, because sometimes
Windows firewall or ISP may be blocked from the Internet connection.

NOTE: This feature is not available in all builds Bot.

= 5. History. =
Conditional tags:
[*] – Change.
[-] – Fix.
[+] – New feature.

[Version, 20.12.2008]
[*] Documentation in txt format. chm not used anymore.
[+] Now the bot is able to receive commands not only with the sending status, but when sending
files / logs.
[+] Local data requests to the server and the configuration file is encrypted with RC4 (you can specify your key).
[*] Fully updated protocol bot <-> server. Perhaps less load on the server.

[-] Fixed the bug that blocking bots on limited account.
[*] Written a new PE-crypter. Now PE-file is very accurate and the most
simulates the results of the MS Linker 9.0.
[*] Updated build process in bilder.
[*] Optimized compression of the configuration file.
[*] The new format is a binary configuration file.
[*] Rewritten the process of assembling the binary config file.
[*] Socks and LC are now working on a port.

Control Panel:
[*] The status of the control panel is BETA.
[*] Changed all MySQL tables.
[*] Control Panel moving on UTF-8 charset (may be temporary problems with
displaying characters).
[*] Updated geobase.

[Version, 30.12.2008]
[*] BOFA Answers are now sent as BLT_GRABBED_HTTP (was BLT_HTTPS_REQUEST).
[-] Small error when sending reports.
[-] The size of the report could not exceed ~ 550 characters.
[-] A low timeout for sending POST-requests
resulting in a blocked sending long (more than ~ 1 Mb) Report on slow
compounds (not stable), as the theoretical implications – bot altogether stopped sending

[+] In the case record and record type BLT_HTTP_REQUEST BLT_HTTPS_REQUEST field SBCID_PATH_SOURCE
(in the table will path_source) added path URL.

Control Panel:
[*] Updated redir.php.

[Version, 11.03.2009]
[-] Fixed bug in HTTP-injections exists for all versions of bot. When
use in the asynchronous mode wininet.dll, was lost time
synchronize flows generated wininet.dll, with the result that, under certain conditions
been an exception.
[+] By an HTTP-injection now also change the files in the local cache.
The absence of this refinement can not always activate HTTP-injection.
[+] Reduce the size of PE-file.

[Version, 28.03.2009]
[-] Minor bug in crypter, thanks to Avira.

[*] Changed protocol of bot’s commands.

Control Panel:
[*] Completely rewritten Control Panel.
[*] Design rewritten to XHTML 1.0 Strict (for IE does not work).
[*] Bot is now again able to receive commands only when sending a report on the online status
(too high load).
[*] Updated geobase.

[Version, 02.04.2009]
[+] When using HTTP, the header User-Agent is now read by Internet Explorer, rather than
is a constant as before. Theoretically, because of the constant User-Agent’a, queries
providers may be blocked or fall under suspicion.

Control Panel:
[-] Fixed a bug displaying records containing characters 0-31 and 127-159.

= 6. F.A.Q. =
Q: What’s the version numbers mean?
A: a.b.c.d
a – a complete change in your bot.
b – the major changes that cause complete or partial incompatibility with previous
c – correct errors, refine, add features.
d – the number of reFUDs for the current version

Q: How does the generated Bot ID?
A: Bot ID consists of two parts:% name% _% number%, where the name – the name of the computer (the result of
GetComputerName), a number – a certain number that is generated on the basis of some unique operating system data.

Q: Why is the traffic is encrypted using symmetric encryption (RC4), but not asymmetric (RSA)?
A: Because the use of complex algorithms does not make sense, you need to encrypt only to hide
traffic. Plus RSA only in terms of not knowing the key is in the Control Panel will not
ability to emulate her answers. And what meaning is to defend this (globally

Q: I damaged tables / files panel, what should I do?
A: Play the instructions specified in paragraph 2.5.

7. Myths =
M: ZeuS uses a DLL.
A: False. There is only one executable PE file (exe). Dll, sys, etc. not used.
This myth has gone due to the fact that in some version for bot
storage configuration used for files with such extensions.

M: ZeuS uses COM (BHO) for the interception of Internet Explorer.
A: False. Used WinAPI interception of wininet.dll.

Cake to implement.  Now here’s the JMP.  heh get it?

WHAT IFFFFFFFFFF……   You just simply re-tune the list to CRITICAL internal corporate DATABASE authentications and systems.  Say the DOD, say the Federal Government, SAY with the use of internal help DOD contractors, say Intel Agencies, say Fortune 500.  Anywhere and everywhere where systems are now really and the bullshit farce of security that we now call SSL.

SSL was put in place to protect sessions, simple as that.  Well if any piece of malware can go undetected, and simply access / read / write to the process memory of Internet Browsers, insert logic and get in the middle, redirect traffic, capture credentials, insert traffic, well then I say your fucked.  And every system that is relying on a Web based interface for access is fucked. Unfortunately. [THE CHIEF CULPRIT HERE IS THE WINDOWS 32//64 API SET]

I am calling on Microsoft to release full and open disclosure of their API set that is categorized to WARN developers and the general public at large how dangerous some of their APIs are when it goes toward completely undermining the security of any system.  These functions have useful purposes, extensibility, patching, debugging yadda yadda.  But wake up, its a new day and this stuff is MAD dangerous, enabling all this cyber bS. so something needs to be rethought, and redone to change the game.


Do you want to operate you mission critical systems on code that allows for this to happen???  At least provide detailed, granular reporting and auditing when these dangerous functions occur.

The SetWindowsHookEx function installs an application-defined hook procedure into a hook chain. You would install a hook procedure to monitor the system for certain types of events. These events are associated either with a specific thread or with all threads in the same desktop as the calling thread.

OpenProcess Function

Opens an existing local process object.

VirtualAllocEx Function

Reserves or commits a region of memory within the virtual address space of a specified process. The function initializes the memory it allocates to zero, unless MEM_RESET is used.

VirtualProtectEx Function

Changes the protection on a region of committed pages in the virtual address space of a specified process.

SO ESSENTIALLY IF I CAN RUN CODE ON YOUR MACHINE, I JUST OPEN A “TRUSTED” PROCESS, THAT BYPASSES YOUR FIREWALL, i.e. IE  HAR! get it?  open the process, change the Virtual Memory protection, Allocate memory and write to it, then set hooks or execute code and PWND your done.

Now does that seem fair?

So I make this prediction with the hopes of enlightening people and the industry as a whole.  CAUTION the worst is coming.  These simple pieces of malware will remain undetected, and they Will be re-tuned to target MUCH MUCH more sensitive systems and then there will be hell to pay.  We gotta rethink people or we will all burn.

So after attending a training event in which CERT-CC staff said they are always run ragged notifying compromised organizations of a compromise I came up with an idea that quits wasting tons of freaking time.  Instead of having every security company on the planet contacting and maintaining lists for POCs, emails, phone numbers of security staff of every organization on the planet in order to notify them that 10000 of their users are now compromised, theft of PII, botnet infiltration, whatever you just do this.

Set up a Industry Security Notification portal where organizations can register and a organizational RSS feed is dynamically created for them.  A XML data sharing schema is put in place to represent the details of said compromise.  It would have a Organizational tag on it that identified the specific organization.  If a security organization obtains information of a compromise of PII from say 10 different companys, they split the data up by company and post directly to the organizations RSS Data feed to which they have previously subscribed when they signed up.

This way Due Diligence of notification has been accomplished, and the or other security firm can wipe its hands of its notification duties, and go about actually doing specialized R&D to solve this mess once and for all instead of spending precious time on bullshit.

Organizations that have not registered with the Portal site, would still have their RSS compromise detailed information published, however it would be an encrypted blob.  All that would be shown is the organization name and very high level details of the event.  Im sure if published publically personal and professional networking would take over and they would find our really quickly, check the details and resolve the issues.

Once events are resolved, they can be archived off the portal in to the organizations account and taken off of the public dashboard associated with the site.

Lets call this the Web2.0 solution to Incident Response Notification and a better and smarter responsible way for companies to quit doing waste of time work and start doing Real work.

OMG – its so simple….


Now someone just needs to get off their ass and implement it.  How about the Big 5 to start.  Microsoft, Symantec, McAffee, Trend, Cisco.  Start setting an example and respond to a critical industry security need that helps all of us and presents a Gamechanger for Cybersecurity.

Here is an example of data repatriated via a 10 day Rustock/Mebroot/Torpig botnet takeover.  The researchers captured the data and then analyzed it and went scratchin their heads as to who to contact about the data, how to notify the victims and the sheer scope and bullshit that would be need to do all the notifications.  HERE is an example that justifies the implementation of my idea.



Get every new post delivered to your Inbox.