Wow, Way to go guys, Moving on….
April 21, 2009
The title says it all….
Hackers Swipe Terabytes of Sensitive Pentagon Data
Apparently the F-35 program has been hacked multiple times. Nice 
Way to go with maintaining our pointy tip of the spear. You develop, we rip it from you. Billions in R&D lost. However if I was on the other side of the fence, and I had the capabilities I would steal it from you to if I knew you were too gutless to stop me or fight back.
This is entirely possible. I was on a proactive malware seek and destroy digital forensics team for a major defense contractor where we found some of our workers doing DEVELOPMENT work via AirForce Virtual Private Network remote access on small little systems such as AirForce One, the B-52, the Prowler and other air based electronic attack platforms and systems.
The developer was going out getting all kinds of little opensource and development tools and using them in his work, and somehow got all munged up with a malware infestation. Needless to say we escalated that quickly however it amplifies the seriousness of if you get compromised and what can happen.
Firms like Northrop, Lockheed, BAE, Boeing are supposed to be the best in the cyber business but with firms so large and expertise so sparse, you cant guard everything all the time constantly. Theres lots of technical solutions for things however budgets are sparse and will is low, and Beauracracy is RAMPANT. Process and Rules choke out agility and innovation.
At the end of the day I believe game changers are needed to begin the targeted and offensive attacks of known cyber operators that are doing this for profit and espinage gain. I mean doing really bad things to these people and their systems and organizations.
The gauntlet is thrown, you have been slapped, what the fuck are you going to do about it…
Series: Looking through the keyhole – 76Service
March 25, 2009
A very slick Exploit pack that is destined to have a future. Mad props to one of my favorite researchers Dancho Danchev on making this information so accessible. He provides excellent analysis and commentary and in my opinion is a leading researching with the right mindset for this work.
Series: Looking through the keyhole – Zeus
March 25, 2009
Zeus is a devastating crimeware kit that is highly prevalent. It focuses on banking and financial information data theft.
Here is an example of one of its Command and Control Interfaces.
As you can see this is prevalent in the wild as shown here by Malware Domain List
Zeus is also known as NTOS or WSNPoem or PRG. It has a long history and is responsible for MASSIVE amounts of data theft. To include goverments, corporations and individuals. Encrypted data stores of over 500 GB have been found and it is estimated to have been in operation in some locations for years unoticed.
It is even vulnerable to exploits
Many have analyzed Zeus and its progeny. Here is a good example.
Frank Boldewin has done some awesome reversing and analysis of Rustock, Storm, Zeus, and other samples from some of the most notorious pieces of crimeware prevalent today.
I will mirror his content in all its glory here for posterity BUT he deserves all the credit. You can learn alot by reviewing other peoples research.
For more on ZEUS check out this awesome Zeus Tracker
This is a great trend and what is clearly needed for the community. HOWEVER…..
Ask your self. If stuff can stay running long enough to be tracked, and you clearly see the scale and the scope here, There is a SERIOUS problem with enforcement. So what do you do?? Especially for a Crimeware based Software as a Service Organization running via a Bullet Proof host provider out of a foreign country with no Law Enforcement cooperation?
All of these links are active and can allow you to download and reverse the Zeus binaries. The configuration files, typically a .bin file hold encrypted information that represents the financial institutions target set.
The answer is simple, you go unattributable, you exploit their systems and either Crypto lock them or Cyberdestroy them. That is the answer. Has it been done yet?? Not that I know of. Who is man enough to make the first move.
It could be the shot heard round the world that would change the rules of the game. And Im all for it. Surgical, devastaing cyber strikes on known, persistant malware infrastructure.
Here are some of Zeus’s advertised capabilities from the Authors themselves…
“ZeuS has the following main features and properties (full list is given here, in your part of assembling this list may not): - Written in VC + + 8.0, without the use of RTL, etc., on pure WinAPI, this is achieved at the expense of small size (10-25 Kb, depends on the assembly).
- Workaround most firewall (including the popular Outpost Firewall versions 3, 4, but suschetvuet temporary small problem with antishpionom). Not a guarantee unimpeded reception incoming connections.
- Difficult to detect finder / analysis, bot sets the victim and creates a file, the system files and arbitrary size.
- Works in limited accounts Windows (work in the guest account is not currently supported).
- Nevid ekvaristiki for antivirus, Bot body is encrypted.
- Some way creates a suspected its presence, if you do not want it. Here is the view of the fact that many authors do love spyware: unloading firewall, antivirus, the ban on their renewal, blocking Ctrl + Alt + Del, etc.
- Locking Windows Firewall (the feature is required only for the smooth reception incoming connections).
- All your settings / logs / team keeps bot / Takes / sends encrypted on HTTP (S) protocol. (ie, in text form data will see only you, everything else bot <-> server will look like garbage).
- Detecting NAT through verification of their IP through your preferred site.
- A separate configuration file that allows itself to protect against loss in cases of inaccessibility botneta main server. Plus additional (reserve) configuration files, to which the bot will apply, will not be available when the main configuration file. This system ensures the survival of your botneta in 90% of cases.
- Ability to work with any browsers / programs work through wininet.dll (Internet Explorer, AOL, Maxton, etc.):
- Intercepting POST-data + interception hitting (including inserted data from the clipboard).
- Transparent URL-redirection (at feyk sites, etc.) c task redirect the simplest terms (for example: only when GET or POST request, in the presence or absence of certain data in POST-request).
- Transparent HTTP (S) substitution content (Web inzhekt, which allows a substitute for not only HTML pages, but also any other type of data). Substitution of sets with the help of guidance masks substitute.
- Obtaining the required contents page, with the exception HTML-tags. Based on Web inzhekte.
- Customizable TAN-grabber for any country.
- Obtaining a list of questions and answers in the bank “Bank Of America” after successful authentication.
- Removing POST-needed data on the right URL.
- Ideal Virtual Keylogger solution: After a call to the requested URL, a screenshot happening in the area, where was clicking.
- Receiving certificates from the repository “MY” (certificates marked “No exports” are not exported correctly) and its clearance. Following is any imported certificate will be saved on the server.
- Intercepting ID / password protocols POP3 and FTP in the independence of the port and its record in the log only with a successful authorise.
- Changing the local DNS, removal / appendix records in the file% system32% \ drivers \ etc \ hosts, ie comparison specified domain with the IP for WinSocket.
- Keeps contents Protected Storage at first start the computer.
- Removes S ookies from the cache when Internet Explorer first run on a computer.
- Search on the logical disk files by mask or download a specific file.
- Recorded just visited the page at first start the computer. Useful when installing through sployty, if you buy a download service from the suspect, you can see that even loaded in parallel.
- Getting screenshot with the victim’s computer in real time, the computer must be located outside the NAT.
- Admission commands from the server and sending reports back on the successful implementation. (There are currently launching a local / remote file an immediate update the configuration file, the destruction OS).
- Socks4-server.
- HTTP (S) PROXY-server.
- Bot Upgrading to the latest version (URL new version set in the configuration file).“
Bot:
- There has its own process, through this can not be detected in the process list.
=============================================================
Here is an example of the builder interface.
Here is another Console
Here is some more Excellent Analysis on this.
24.10.2008
Slides of my Hack.Lu 2008 speech “Rustock.C – When a myth comes true”
Rustock.C – When a myth comes true.pdf
14.02.2008
With “More advanced unpacking – Part II” i show you how to decrypt an infamous reallife malware called WSNPOEM aka Infostealer.Banker.C The binaries are usually created with a tool called ZEUS Builder and there exist lots of different versions in the wild. I found samples with and without rootkit functionality, as well as ontop packed binaries, meaning they are additionally protected/packed with tools like Aspack, ACProtect, Polycrypt and so forth. We will discuss all 3 types and how to deal with them in 3 different ways. – 1. Manual unpacking + import fixing – 2. Manual unpacking + Auto import fixing – 3. Auto unpacking/import fixing – Stage 2 introduces a nice tool called “Universal Import Fixer” and Stage 3 shows how to automate unpacking/import fixing with OllyDbgScript.
More advanced unpacking – Part II.zip
21.01.2008
This new unpacking tutorial goes far more into depth as the beginners tutorial i have released last year. It aims to show some generic tricks and tools, that can be used on many other protectors. Enjoy!
More advanced unpacking – Part I.zip
21.09.2007
This paper is an analysis of the malware Peacomm.C aka StormWorm. It mainly focuses on extracting the native Peacomm.C code from the original crypted/packed code and all things that happens on this way, like: XOR + TEA decryption, TIBS unpacking, defeating Anti-Debugging code, files dropping, driver-code infection, VM-detection tricks and all the nasty things the rootkit-driver does.
Peacomm.C – Cracking the nutshell.zip
21.01.2007
This paper is an analysis of the Rustock.B rootkit. The rootkit used several proprietary obfuscation/packing methods to hide the native driver code from prying eyes. I have divided the paper into two main parts. The first part, which is divided in three stages, describes how to extract the native rootkit driver code without the use of kernel debuggers or other ring0 tools. The second part basically does the same, but much faster and with lesser efforts using the SoftICE kernel debugger. Each part shows various possibilities for solving the different problems facing the researcher when analyzing Rustock. All the code and IDB files are included in the package!
A Journey to the Center of the Rustock.B Rootkit
13.12.2006
This flash movie covers how to manual unpack and Auto-IAT fix UPX and Aspack packed binaries. It might be useful for people who are new to malware analysis and don’t have a clue how to unpack and repair a binary. The introduced technique works for many other easy executable packers like FSG too. For best view use a resolution of 1024×768 or higher and select fullscreen (F11) in your browser.
Manual unpacking and Auto-IAT fixing UPX and Aspack
18.03.2006
My first paper is a step by step guidance how to use the world’s best debugger called SoftICE, which is part of Compuwares Driverstudio. This essay discusses the installation & configuration of the debugger, the most useful commands SoftICE offers, a rocking extension called IceExt, as well a categorized list of good breakpoints. For a better understanding screenshots are placed at distinctive points.
SPOTLIGHT: Shine Bright.
March 25, 2009
This site will begin to host and post Dossiers on known, identified Cybercriminals embracing the concept of “Open Source Evidence”
Send Comments and we will begin to publish case files.
Series: Looking through the keyhole – Multi Exploits Pack
March 25, 2009
Here is an older version. ALL the credit for this goes to the awesome guys at Finjin who seem to have no reservation about showing to the world the innovations and backends of these infrastructures of evil.
All of their reports can be found on their Malicious Page of the Month section on their website.
I will be attempt to add my spin to research and look for new angles, Much of this will be reference material for building on further research. Additionally the goal will be to capture as much code as possible and hosting it here Offensive Computing Style to further research and awareness.
This pack is called Multi Exploits Pack Version 3.1
NOTE: Early on in order to avoid analysis, sophisticated IP access monitoring is being done to ensure that clients cannot connect to these sites multiple times. Sounds like a good opportunity to identify any configuration settings that all unfettered access to IPs for adminstration. If they are stupid enough to put something like that in there, its a good way to conduct attribution.
Here is the annoying thing.
Note the original posting in a forum to sell this puppy. Malware authors need to be contacted somehow to sell their stuff. NOTICE THE ICQ ID that for some reason was blurred by the Finjin report.
As you can see here there is a Targetable Identifier. The ICQ number. THANKS FINJIN for bluring it. This information is useful to the community. Maybe even possible Mob effects can take over for a little bit of Internet Justice.
This is a perfect target to identify the actors and Attribute them. Law Enforcement should be beating down ICQ operators doors to get a real world Identity on these people, and force them to roll on their clients, better yet pay them to SNITCH or setup a STING.
Or just publish in underground channels that the Individual is now working for law enforcement. Next thing you know this devious little reputation poisoning attack leads to a dead Russian programmer who turns up in an alley.
Eventually we will need to up the cost to these guys for doing the things they do. Currently there is almost no risk to their operations. We need to change that. How, by changing tactics…. and being ruthless.
Series: Looking through the keyhole – NeoSploit
March 25, 2009
Neosploit is an oldie but goodie. There are many versions and at one point it had a lot of marketshare. It also was one of the first to be ripped and used / configured by many others. Cannibals eat their own it seems. The effect this has is it drives down exploit pack prices.
It is written in C as a CGI program to be run on a web server. It is possible that it was written by “Grabarz”
Known Versions 3.0.7, 3.1, 2.0.13, 2.0.17, 2.0.15, 2.0, 1.5, 1.0
Supposedly this crew quit development but their source code and legacy will remain as more and more of these crimeware kits are cloned and innovated by others.
I will be searching for the source code of this to make it available for research.
Why? To exploit that’s why. Usually the nubs that run this shit are clueless on how to secure their own systems. Also we can take advantage of backdoors the authors put into to rip the data from the users. No honor among theives of course.
However these decentralized operations are complex to unravel. The problem is that many times researchers do find out who it is, then notify the authorities to no avail.
I am advocating as a Thought Meme the era of Open Source Evidence. What does this mean exactly? It means the active and aggressive publication and publishing of evidence that validates and verifies known malware authors and crimeware authors. The evidence should clearly incriminate said parties. The evidence should be Posted FIRST to the open source in hightraffic blogs and then reported to Authorities.
Law enforcement has had plenty of time to pursue these guys and in their Investigations “keep all hush hush” about the evidence and the personalities and organziations behind this fiasco of a mess. I the mean time victims suffer, with no compensation, retribution, or entity to champion their woes. I have said many times. We are sheep among wolves, and our protectors are down the street, hanging out at MacDonalds.
Here is another screenshot of Neosploit.
Here is some additional detail such as the login page..
These are the sites the criminal compromised with Iframes
Here is a Geographic distribution of the PWNed victims
Series: Looking through the keyhole – AdPack
March 25, 2009
Here is a kit called AdPack. I will begin to start searching for the Source Code or backend code for each of these exploit packs and post them here for Security Research and Analysis. This stuff itself is not dangerous. These are command and control mechanisms to report and monitor botnets.
What IS dangerous is the fact that software and systems do not automatically slipstream vulernability fixes / patches to their users, ensuring that a time gap occurs which gives malicious users the opportunity to exploit systems.
We need to really start rethinking the concepts of software and challenge our traditional assumptions if we are every truly going to make progress in this area.
INTELLIGENCE:
Who coded this, in what language, what is its current black market price, exploitable?
How prevalent or what kind of market share does it have?
What is its backend db?
Apparently there are many configuration vulnerabilities such as weak passwords that can be leveraged to compromise the back end components such as the FTP server, which also may be vulnerable.
What web servers are typically used for these packs? nginx? some other?
Here is a link to some other ADpack screens as well as a C&C Interface for running commands.
As you can see above, if you get access to the command and control site you can destroy the system. Reference the UnInstall Me feature. Get System info is a good way of notifying affected organizations. Clearly they dont understand the concept of Privledged commands and Role based Access Control. Nor is each members campaign usually segregated from other members campaigns thus no privacy per say.
Additionally these kits are like a Service so many users run multiple campaigns. Sounds like STING TIME>
It would be entirely plausible to generate a fake service like this with fake simulated information Lure them in, identify them, then SMASH THEM.
You could provide fake or previously compromised data stores, and simulate the growth of their botnets. It would be all you need to Sow distrust and paranoia into people tempted to get into this line of nefarious work.
Here is what appears to be a localized Russian version of Adpack
Series: Looking through the keyhole – Unique Pack
March 25, 2009
Unique Pack – Unique Sheaf Exploits
NOTE: the possible author of the pack.
Indication of author is not tantamount to owner of pack or operator of pack.
Most of these things are coded collaboratively from many authors and geographic locations.
For perspective this would be a true realization of the distruptive nature of open source software.
The only real intelligence value of these things are:
What unique identifiers are in the kits that could allow for detection. See GOOGLE hacking.
["unique sheaf sploits" "Vparivatel" "All Vpars" "Totals/Loads"]
What language is used, can the implementation be exploited.
How can you pwn the server to monitor usage? Exploitable??
Are the operators stupid enough to connect directly or do they come in via proxied connections such as Tor?
WHERE is the DROP SITE? Can we Trojan the drop site with a payload to track the movement of its data?
Can we poison Pill the data (via Cryptographic attack or assured destruction Secure delete) or the systems that use the data?
