The Extremist Threat from Metallica

No, this is serious - James Hetfield from Metallica questioned by airport security personel before the Live Earth concert in London because of "taliban-like beard" :

"According to British newspaper The Times, the rocker jetted into Luton airport ahead of Saturday's Live Earth concert at Wembley Stadium - where his legendary rock band was due to perform - but was halted by officials before he could leave the terminal. The legendary frontman was then subjected to a brief line of questioning, after which security-conscious officials were left red-faced when Hetfield explained he was a member of a world-famous rock band."

In 2007, if you're named Muhammad you'll be living the life of someone else's stereotype that you're a terrorist, and with a beard it's even more suspicious, which is perhaps why Muslims in the U.K started an anti-terror campaign "Not in Your Name" trying to distinguish themselves from such simple and totally wrong stereotypes.

Continue reading →

Terrorist Groups' Brand Identities

The author of this terrorist groups' logos compilation is greatly using business logos identity building analogy to discuss whether or not logos of terrorist groups successfully communicate their message or vision :

"I did some research and rounded up as many logos as I could find from terrorist groups past and present. While I hate to give terrorists any more attention, I still think it’s interesting to see the various approaches they took in their logos, and wonder what considerations went into designing them. Does the logo successfully convey the organization’s message? Is it confusingly similar to another group’s logo? Does it exhibit excessive drop shadows, gradients, or use of whatever font is the Arabic equivalent of Papyrus?"

And while it reminds me of another business analogy, namely a A Cost-Benefit Analysis of Cyber Terrorism, such analogies clearly indicate two things - first, branding is something they are aware of, and second, they understand that evil advertising can easily turn into propaganda and a brainwashing tool given the numerous PR channels they already actively use -- pretty much every Web 2.0 company that is out there. The screenshot above represents an advertisement of the Mujahideen Secrets Encryption Tool, more screenshots of which you can find in a previous post. Despite that the tool is freely available for the wannabe jihadists to use, and that no one is ever going to receive a box-copy of it physically, GIMF took the time and effort to come up with a box-style software product ad realizing the basics of branding, namely that each and every contact with the brand -- GIMF in this case -- can either weaken or strengthen a brand's image in the perception of the prospective user/customer.

Continue reading →

Zero Day Vulnerabilities Auction

Theory and speculation, both finally materialize - an 0bay auction for security vulnerabilities was recently launched, aiming to reboot the currently not so financially favorable for researchers full disclosure model, and hopefully, create a win-win-win solution for Wabisabilabi, the vendors and the researchers themselves :

"We decided to set up this portal for selling security research because although there are many researchers out there who discover vulnerabilities very few of them are able or willing to report it to the right people due to the fear of being exploited. Recently it was reported that although researchers had analyzed a little more than 7,000 publicly disclosed vulnerabilities last year, the number of new vulnerabilities found in code could be as high as 139,362 per year. Our intention is that the marketplace facility on WSLabi will enable security researchers to get a fair price for their findings and ensure that they will no longer be forced to give them away for free or sell them to cyber-criminals."

As I've been covering the topic of commercializing vulnerability research since I've started blogging, and my second post was related to 0bay or "How Realistic is the Market for Security Vulnerabilities?" I'll briefly summarize the key points and let you deepen your knowledge into the topic by going through the previous posts related to buying and selling vulnerabilities, even requesting ones on demand -- which is perhaps the most sound market model in my opinion at least in respect to relevance.

Back in December, 2005, the infamous WMF vulnerability got sold for $4000 to be later on injected into popular sites, and embedded whereaver possible. The idea behind this attack? Take advantage of the window of opportunity by the time a patch by Microsoft is released, but instead of enjoying the typical advantage coming from full disclosure exploit and vulnerabilities sites, the attackers went a little further, they also wanted to make sure that the vulnerability wouldn't even appear there at the first place. And while it later became a commodity, WMF DIY generators got released for the script kiddies to generate more noise and the puppet masters to remain safe behind a curtain of the click'n'infect kiddie crowd.

Several months later, hinted by a person whose the perfect representation of the phrase "Those who talk know nothing, those who don't talk they know" tipped me on a zero day shop site -- The International Exploits Shop -- that was using a push-model that is a basic listing of the vulnerabilities offered and the associated prices, even taking advantage of marketing surveys to figure out the median price customers would be willing to pay for a zero day vulnerability.

Commercializing vulnerability research the way the company is doing it, will inevitably demonstrate the lack of communication and incentives model between all the parties in question. Moreover, if you think that a push-model from the researcher compared to a pull one, even on demand is better think twice - it isn't. If I'm a vendor, I'd request a high profile vulnerability to be found in my Internet browser in the next two months and offer a certain financial incentive for doing so, compared to browsing through listings of vulnerabilities in products whose market share is near the 1%. For the computer underground, or an information broker, there's no such thing as a zero day vulnerability because they understand the idea that in times when everyone's fuzzing more effectively than the vendors themselves, or transparency and social networking has never been better, a zero day to some is the last month's zero day to others.

Questions remain :

- how do you verify a vulnerability is really a zero day, when infomediaries such as iDefense, Zero Day Initiative or Digital Armaments delay "yesterday's" security vulnerability or keep you in a "stay tuned" mode? How can you be sure you as an infomediary are not part of a scheme that's supplying zero days to both the underground and you?

- why put an emphasis on something's that's a commodity, but forgetting that closing a temporarily opened up window of opportunity posed by today's zero day will lose its value in less than a minute by the time an IDS signature takes care of it while a patch is released? In exactly the very same fashion of malicious economies of scale, a stolen personal and financial information is lossing value so that the attackers are trying to get rid of it as soon as possible, by the time it value doesn't decrease to practically zero. Stay tuned for a zero day vulnerabilities cash bubble.

- how do you put a value on a vulnerability and what is your criteria? Of course, monocultural OSs get a higher priority, but does this mean that a zero day in MAC would get more bids because of the overall perception that it's invincible and the verification of such vulnerability would generate endless media echo effect, while someone's checking your current zero day propositions to see if the one he came across is still not listed there? For instance, Wabisabilabi have posted a Call for iPhone vulnerabilities in the first days of their launch.

Theoretically, if everyone starts selling zero day vulnerabilities they find, there will be people who will superficially increase a zero day's value by holding it back and keeping quiet for as long as someone doesn't find it as well. Here's an interview I took from David Endler at the Zero Day Initiative you may find informative, and more opinions on the topic - Computerworld; Dark Reading; Slashdot; The Register; TechTarget; Heise Security; Techcrunch, and an interesting quote from a BBC article that the initiative is aiming to limit the flow of vulnerabilities to the underground :

"By rewarding researchers, the auction house aims to prevent flaws getting in to the hands of hi-tech criminals."

It would have absolutely zero effect on the flow of vulnerabilities in computer underground circles, mostly because if someone likes the idea of getting a one time payment for its discovery, others would get a revenue stream for months to come by integrating it into the underground ecosystem. Even the average MPack attack kit, compared to others I've seen showcases the reality - a huge number of people are infected and no zero day vulnerabilities are used but ones for which patches are available for months. Moreover, they don't just buy stockpiles of zero day vulnerabilities, but are actively discovering new ones as well and holding them back for as long as possible as I've already mentioned.

And another one from CNET :

"WSLabi is backed by about 5 million euros ($6.8 million) from individual investors, and hopes to float on a stock exchange (probably London's AIM or a similar exchange in Oslo) in around 18 months."

Is this for real, and if so, it makes it yet another investment in the information security market to keep an eye on in the very same fashion I've been following and speculating on SiteAdvisor's eventual, now real acquisition. But WSLabi's road to an IPO would be a very, very bumpy one. Everyone's excluding the obvious, namely that the biggest and most targeted vendors could ruin WSLabi's entire business model by starting to offer financial incentives let's call them for zero day vulnerabilities, or perhaps keep it pragmatic, namely ignore the fact that someone's trading with zero days regarding their products mainly because the vendors cannot be held liable for not providing patches in a timely manner or not reacting to the threat.

Two projects worth considering are the ElseNot one, listing exploits for every Microsoft vulnerability ever, and eEye's Zero Day Tracker, keeping track of unpatched vulnerabilities. Make sure what you wish for, so it doesn't actually happen.

Continue reading →

Hacking the iPhone

Faster than you can say hacked! In the first days of what can be described as yet another case study on marketing buzz generation done by evil brand managers, DVD Jon is coming up with universal unlocking app for the iPhone, the folks at Errata Security join the party by announcing several vulnerabilities within the device as well :

"So far, Errata has found three main flaws in the long-awaited and much-hyped mobile phone/music/video player/mobile Web/email client device: a heap overflow bug in its Safari browser; a potential denial-of-service bug in its Bluetooth feature; and a data "seepage" bug that could cause seemingly innocuous data to be exposed by chatty client applications over a WiFi connection."

And here's someone pen-testing the entire device to figure out that data is leaking out. On the compatibility front, this is already proving quite handy, and regarding this step-by-step disassembly of the iPhone, a factory manager in China is definitely in a good mood today.

Cartoon courtesy of Caglecartoons. Continue reading →

Mujahideen Harvest Magazine - Issue 41

Compared to the quarterly released Technical Mujahid E-zine, the yearly updated Jihadist Security Enclopedia, or the regularly updated terrorism glorifying blogs, the Mujahideen Harvest magazine is released monthly, and represents a complete account of mujahideen activities in Iraq, featuring successful attacks and coming up with top 20 lists of the best explosions. It's latest issue 41 is 45 pages long, and details the strategies and events related to each attack in a daily like journal entry. This magazine (Mujahideen Harvest) is 100% conventional warfare achievements related, and from an OPSEC perspective, is an indispensable account into each and every attack that occurred in between the last and the current issue was released from the perspective of the mujahideen militants. Some more info on the "publishing house" that's been releasing it :

"The Mujahideen Shura Council is an umbrella organization of a number of different Islamic terrorist groups active in Iraq, attacking U.S. and coalition forces. For some time, they have been issuing monthly printed reports in Arabic about their “successes” against U.S. forces. Almost without exception, these reports are pure Islamic propaganda and issued to rally the terrorists fighting in the Iraqi theater. The statistics they provide are usually inflated and frequently used by other terrorist groups and once translated, are often cited by anti-war, anti-U.S. groups to sway public opinion. For their October report, they made it easier to attract Western sympathizers." Continue reading →

Exploits Serving Domains - Part Two

The saying goes that there's no such thing as free lunch, so let me expand it - there's no such thing as free pr0n, unless you don't count a malware infection as the price. What follows is a demonstration of the Zlob trojan in action that occurs though the usual redirectors, and here's a related article emphasizing on the IFRAME embedded pr0n sites directing traffic to the redirectors :

"Right now, we are not sure whether the porn sites are compromised to host the IFRAMES, are created to do so or are being paid to host the IFRAMES," acknowledged Trend Micro. The attack probably began June 17, the company said. Other researchers have continued to dig into the Mpack-based attacks and have shared some of their findings. Symantec Corp., for instance, asked how hackers were able to infect so many sites in such a short time and how they could inject the necessary IFRAMES code -- the malicious code they added to the legitimate sites' HTML that redirected visitors to the Mpack server -- so quickly."

Psst - they are hosting the IFRAMES, whether compromised or equal revenue sharing among the parties is a question of another discussion. The attack is quite widespread in the time blogging, check for yourself to get a full listing of all the IFRAME-ed pr0n sites in question. Let's dissect the central hosting locations where all other sites ultimately lead to.

At miss-krista.info - 66.230.171.36 - we have an IFRAME pointing us to todaysfreevideo.com/ad/6811214.html - 81.0.250.239 - where we are offered to download two pr0n videos, todaysfreevideo.com/teens/mr-tp01-2g2s1/1/movie1.php and todaysfreevideo.com/teens/mr-tp01-2g2s1/1/movie2.php, but the actual malware is hosted at an internal page at downloadvax.com - 85.255.118.180 -- and while as usual we get a 403 Forbidden at the main index, within to domain the pr0n surfer gets infected with the Zlob Trojan.

File size: 70853 bytes

MD5: 009ca25402ee7994977f706b96383af0

SHA1: ab60ecefcf27420a57febd5c8decc5c9f34f0e74

packers: BINARYRES

Obviously, unsafe pr0n surfing leads to malware transmitted diseases, but why exploit serving domains when no vulnerabilities get exploited at these URLs? Mainly because miss-krista.info is part of the exploits hosting domain farm I discussed in part one.

Related posts:

Exploits Hosting Domains

The MPack Kit Attack on Video

Massive Embedded Web Attack in Italy

Testing Anti Virus Software Against Packed Malware

Continue reading →

Post a Crime Online

In exactly the same fashion of Chicago's Crime Database, a community powered site integrating crime reports on Google Maps, Postacrime.com aims to empower police officers with citizen submitted crimes in progress :

"POSTACRIME.COM is a free service for anyone to upload photo or video content of burglary, theft, vandalism, or other criminal acts that have been caught on camera for the purpose of identification by the public. Often times Law Enforcement is unable to apprehend criminals, even if with the best video evidence, because no one is able to identify the criminal caught on camera. POSTACRIME.COM hopes to change that."

If the site reaches YouTube's popularity by disintermediating police forces ongoing intestigative efforts, it could also act as an early warning system for the criminals themselves, especially to change areas of operation. The site is pitching itself as the World's Largest Crime Prevention Network, a bold vision despite that I find it as an informediary categorizing user submitted crimes and hoping the publicity will help identify and criminal and hopefully restore the stolen goods -- you wish. You cannot prevent crime Web 2.0 style at least not in this way, you can aggregate publicly available crime data and present a (heat) map of a certain location based on a specific time for trends analysis. Continue reading →

Exploits Serving Domains

More cyber leads from the previous analysis of Mpack embedded dekalab.info with a particular malicious domains farm emphasis as follows. Multiple redirectors, blackhat SEO, XOR-ifying javascript obfuscation and a piece of rootkit installed, pretty much everything's in place as usual. The majority of redirectors are part of an exploit serving domains farm. The whole process starts from trancer.biz :

trancer.biz/sys/index.php
81.95.149.176
HTTP/1.1 302 Found
Server: nginx/0.5.17
Date: Tue, 26 Jun 2007 11:51:30 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Location: cawajanga.biz/ts/in.cgi?oscorp

HTTP/1.1 302 Found
Server: nginx/0.5.17
Date: Tue, 26 Jun 2007 11:51:31 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Location: blooded.biz/2103/index.php

Then we get redirected to blooded.biz's obfuscated payload
81.95.149.176 in between loading cawajanga.biz/ts/in.cgi?oscorp and mobi-info.ru where the deobfuscated XOR-ifying javascript leads us to the exact payload location the output of which is in the form of Rootkit.Win32.Agent.fb

File size: 7503 bytes
MD5: 09994afd14b189697a039937f05f440f
SHA1: b9832689aa1272f39959087df41cea13fc283910 Continue reading →

Early Warning Security Event Systems

Years ago, early warning systems for security events used to be a proprietary service available to a vendor's customers only, or even worse, to the vendors themselves. But with more vendors realizing the marketing potential behind viral marketing, and the need for more transparency on the state of Internet attacks, nowadays such EWS's are either publicly available at a vendor's site, or accessible due to the emerging CERT-ization and aggregation of honeypot data on a coutry level courtesy of the local CERTs themselves. And such is the case with ARAKIS :

"an early warning system operated by CERT Polska. ARAKIS aggregates and correlates data from various sources, including honeypots, darknets, firewalls and antivirus systems in order to detect new threats. The dashboard provides a snapshot of activity on the Internet based on data gathered from a selected group of sensors."

PING sweeps dominate the local threatscape? As always, nobody likes shooting into the dark unless of course they really have to. Several more publicly available early warning systems for security events worth considering are :

ATLAS: Active Threat Level Analysis System
CipherTrust's Real-Time PC Zombie Statistics
WatchGuard's Real-Time Spam Outbreak Monitor
ProjectHoneypot's Spam Harvesting Statistics

as well as several malware outbreaks related early warning systems:

Trend Micro's Virus Map
F-Secure's World Map
PandaSoftware's Virus Map
McAfee's Virus Map

As far as any other non IT security incident on a worldwide scale is concerned, the Global Map of Security and Terrorist Events, maps the "big picture".

The syndication of such publicly available data into a central dashboard is nothing new, but with so many CERTs in Europe the next big milestone to be achived should be to first integrate the data between themselves, share with vendors and vice versa, and then communicate the big picture for industry insiders and outsiders to see. An effort which could really undermine the commercial EW systems, ones whose business model is getting outdated with every day.

The FBI's recent "Operation Bot Roast" not only reminds me of the Wardriving Police who will wardrive and leave you flyers that you're vulnerable, but also that when proactive measures cannot take place post-event ones dominate - "Dude, you're malware-infected and sending spam and phishing emails to yourself!" - not exactly what pragmatic is all about :

"OPERATION BOT ROAST is a national initiative and ongoing investigations have identified over 1 million victim computer IP addresses. The FBI is working with our industry partners, including the CERT Coordination Center at Carnegie Mellon University, to notify the victim owners of the computers."

One thing I've learnt about end users, either educate and evaluate the results, or directly enforce practices leaving them with no other option but to stay secure by default. Most importantly, with major U.S based ISPs sending out spam, thus having the largest proportion of infected customers are publicly known. So instead of giving out anti virus tips, cooperate with ISPs on the concept of filtering outgoing spam messages, and DDoS attacks.

With malicious economies of scale, that is botnet masters automating the entire process of exploiting unpatched PCs, using old-school social engineering attacks taking advantages of opened up "event windows", packing and crypting their malware to exploit the flows in the current signatures-based detection hype - is such an initiative really worth it? Time will show, but what could follow are fake FBI emails telling everyone that they're infected, a little something about the operation itself, and how visiting a certain malware embedded web site will disinfect your PC the way we've seen it happen before.

Continue reading →

Security Comic Strips

If all rest is a commodity but attitude, let me introduce you to the first two additions from my new Unstripped Security comic strips series to be expanded on a weekly basis. Strip One - The Blackberry Espionage Saga presenting the irony in the International Intelligence Community, and Strip Two - It's All a Matter of Perspective discussing the different perspectives of commonly stereotyped participants during a malicious Internet attack. Feel free to email and embed them within your thoughts, blogs and sites, include a backlink to Unstripped Security, and subscribe to the RSS feed to get notified on the latest strips. Enjoy! Continue reading →

Cell Phone Stalking

Six year olds install hardware keyloggers at the U.K's Parliament , and now as you can listen to the sweet sixteen's voice in this video, they also know how to take advantage of commercially available cell phone snooping services such as Flexispy for instance :

"Just ask Tim Kuykendall, whose cell phone provided a portal through which a hacker gained access to the most intimate details of his life, recording family members' conversations and snapping pictures of what they were wearing. “We’ve had [times] where I’m having a conversation in my home and I get a voice mail and the conversation’s replayed; received a phone call or even checked my voice mail from a message and while I push 'OK' to listen to [it] I’m hearing a conversation going on in the living room between my daughter and my wife,” he told FOX News."

The successful surveillance however, doesn't make him a hacker, rather a customer of a product, but what's worth considering is how did he manage to infect their cell phones at the first place, namely socially engineering them remotely, or physically infecting the mobile device. Meanwhile, Flexispy is continuing its compatibility efforts among popular Symbian, Symbian 9, Windows Mobile, and BlackBerry devices, aiming to strengthen its position as mobile device activity monitoring solution for some, and cell phone stalking service to others -- two-sided copywriting messages aim to convince those who might be eventually opposed to the idea.

Related posts:

USB Surveillance Sticks

Outsourcing the Spying on Your Wife

Continue reading →

The MPack Kit Attack on Video

Video demonstration of MPack courtesy of Symantec, goes through various infected sites and showcases the consequences of visiting them : "This video demonstrates how a system is compromised by a malicious IFRAME and how the MPack gang has accomplished this on literally thousands of websites (mostly Italian) through usage of an IFRAME manager tool."



Meanwhile, dekalab.info is yet another malicious URL exploiting MDAC ActiveX code execution (CVE-2006-0003) for you to analyze, among the many already patched vulnerabilities used in the latest version of Mpack. The question remains - how many zero days are currently exploited in the wild through the MPack kit? The "best" is yet to come, paying attention to the periodical new supply of loaders -- 58.65.239.180 got last updated Date: Thu, 21 Jun 2007 22:02:08 GMT -- indicates commitment.

Input URL: dekalab.info

Responding IP: 203.121.78.127

203.121.64.0 - 203.121.127.255

TIME Telecommunications Sdn Bhd

Interesting enough, the original source of the IFRAME attack 58.65.239.180 remains active, still acting as a redirector to 64.62.137.149/~edit/ which is again an exploit embedded page generated with the MPack kit :

- 58.65.239.180

58.65.232.0 - 58.65.239.255

HostFresh

- alpha.nyy-web.com (64.62.137.149)

64.62.128.0 - 64.62.255.255

Hurricane Electric

Evasive malware embedded attacks are aiming the improve their chances of not getting detected. If your browser cannot be exploited all you will see at these IPs/URLs is a :[ sign, the rest is the obfuscated javascript attack you can see in the screenshot. Here's the deobfuscated reality as well. Periodically monitoring these IPs will result in a great deal of undetected malware variants. AVs detecting the current payload

eTrust-Vet - Win32/Chepvil!generic

File size: 7283 bytes

MD5: ae4e60d99ec198c805abdf29e735f1a7

SHA1: b0d1b68460683d98302636ab16a0eaa4b579397d

Aruba.it's comments on the case as well. Now, let's move on, shall we?

Continue reading →

A Blacklist of Chinese Spammers

With China no longer feeling pround of its position in the top 3 main sources of spam on a worldwide basis, the coutry is going a step beyond the bureaucratic measure to fight spam by licensing email servers undertaken back in April, 2006, and has recently launched a blacklist of Chinese spammers :

"The comprehensive anti-spam processing platform (http://www.iscbl.anti-spam.cn/) will post a regularly updated blacklist of spam servers, allowing telecom operators and mail service providers to access the information. Over 100,000 IP addresses have been blacklisted thanks to public reports, said Zhao Zhiguo, vice-director of the telecommunications department of the Ministry of Information Industry. A "white list" of mail service providers will also be posted on the website, boosting the development of lawful mail service providers, such as the country's big players Sina, 163 and Sohu. ISC Secretary-General Huang Chengqing said the website will gradually open to the public and businesses to accelerate anti-spam efforts domestically and internationally."

And despite that major blacklist providers have been providing such lists for years, China's inside-towards-outside approach is a great example on the most effective, yet not so popular approach of dedicating more efforts into filtering outgoing spam, compared to the current approach of filtering incoming one. Only if responsibility is forwarded to the ISPs doing nothing to filter outgoing spam -- who will later on offer you a free spam protection to differentiate their USP -- we can start seeing results. 7h3 r3$t i$ a cat and mouse game, and overall decline in the confidence and reliability of email communications.

World spamming map courtesy of Postini.

Continue reading →

A List of Terrorists' Blogs

Following previous posts "Full List of Hezbollah's Internet Sites", and "Hezbollah's DNS Service Providers from 1998 to 2006", here's a list of terrorist/jihadists related blogs hosted at Wordpress.com, spreading propaganda, violent videos, and yes, glorifying terrorism. The raw content is fascinating, and the main idea behind this multilingual propaganda translations are to wage a "battle of ideas".

The list and associated analyses :

01. The Global Islamic Media Front

Keywords density :
you 531

allah 493

their 381

they 312

them 306

which 278

we 269

his 266

not 253

have 251

02. The Global Islamic Media Front - in German

Keywords density :

die 389

der 374

von 215

ist 187

sie 175

den 163

zu 161

das 143

dass 136

es 129

03. Abusayfullah

Keywords density:

he 33

his 25

we 25

they 23

allah 23

news 23

shaykh 17

people 16

wa 16

fighting 14

04. Caravan of Martyrs

Keywords density:

he 186

his 147

not 124

allah 122

him 106

they 104

them 82

one 73

you 69

their 66

The following are no longer updated :

Inshallahshaheed

Alkarnee

Truthline

Moderatesrefuted

Naseeha

Here are some more worth going through or crawling :

Jihad Fields are Calling!

Crusader Watcher

As always these are just the tip of the iceberg, but yet another clear indication of the digitalization of jihad.

Continue reading →

MANPADS and Terrorism

Can terrorist entities easily obtain shoulder-launched surface-to-air missiles and how are they achieving it? How is sensitive military technology leaking into the hands of those supposedly not in a position to take down modern aircraft? Did the overall shift of discussion aiming to shred more light into the guerilla type of asymmetric dominance terrorists have, excluded the real discussion of how MANPADS and night vision equipped fighters take lifes on a daily basis in the very sense of conventional warfare?

FAS analyst Matt Schroeder tries to answer these questions in a recently released publication entitled "Global efforts to control MANPADS" :

"Preventing the acquisition and use of man-portable air defence systems (MANPADS) by terrorists and rebel groups has been a matter of concern since the early 1970s. However, despite the persistence of the threat MANPADS pose to aviation, it was the 2002 al-Qaeda attack on an Israeli civilian aircraft flying out of Mombassa, Kenya, that focused world attention on the issue. This introductory section continues by providing some basic information on the development and main types of MANPADS and their capabilities. Section II of this appendix gives an overview of the main threats posed by the weapon. Section III reviews efforts to control the weapon prior to the Mombassa attack, and section IV examines contemporary counter-MANPADS efforts. Section V presents some concluding observations and recommendations for further action."

Export controls, stockpile destruction, physical security and stockpile management practices, buy-back programmes, and active defence measures: airports and airliners are among the key topics discussed. Here's a related post on the topic "Video Shows Somali Insurgent with Sophisticated SA-18 Missile" as well.

Images courtesy of a MANPADS related article in the second issue of the Technical Mujahid E-zine.

Continue reading →

Massive Embedded Web Attack in Italy

This summary is not available. Please click here to view the post. Continue reading →

Israeli Reconnaissance Satellite C&C - Video

Catchy demo of a C&C center in Israel, via Cryptome. A violation of OPSEC? Not necessarily given that some of the synchonized displays are blurred, but the main purpose behind the clip is to communicate that - "yes our IMINT is powerful enough". Some of the most recent satellite reconnaissance developments are a great example of the utopian tracking of non-existing terrorists' physical assets, such as boats in this case, even white horses in Afghanistan.

"The ocean-surveillance satellites, part of the National Ocean Surveillance System (NOSS), will track possible terrorist activities at sea. The two satellites will fly in a regimented formation within their elliptical orbits above the Earth so that they will be able to precisely determine the positions of ocean-going vessels at different times. This data will be combined with data from 18 other NRO satellites orbiting the Earth, which are spaced apart at six or seven different sections above the Earth’s surface."

And while the U.S is investing in a satellite reconnaissance without any "fog of war", an effort that's enviable, but highly innefective when it comes to fighting terrorism, Japan which is still heavily relying on U.S sharing of reconnaisance satellites' data is facing criticism for not registering some of its spy satellites, a common practice among many other nations :

"Tokyo has been operating spy satellites for four years that have not been registered with the United Nations, despite having signed an international treaty that requires it to report them. The Convention on Registration of Objects launched into Outer Space, adopted in 1974 and proclaimed in 1976, required signatories to identify the artificial satellites and other objects they put in space. Japan signed that treaty in 1983. Treaty violations are not subject to punishment."

precisely the type of possible pre-launch information leakage I pointed out in a previous post on stealth satellites :

"You can't hijack, intercept or hide from what you don't see or don't know it's there, and stealthy satellites are going to get even more attention in the ongoing weaponization of space and the emerging space warfare arms race. Here's a huge compilation of articles and news items related to the development of stealthy satellites."

A pre-launch leak in today's OSINT world is the worst enemy of the concept of stealth satellites. Here's an in-depth assessment of China's anti-satellite programs worth going through as well.

Related posts:
Satellite Imagery of Secret or Sensitive Locations
U.K's Latest Military Satellite System
The History and Future of U.S. Military Satellite Communication Systems
China Targeting U.S Satellite - Laser Ranging or Demonstration of Power?
Open Source North Korean IMINT Reloaded
Iran Bans Purchase of Foreign Satellite Data Continue reading →

DIY Malware Droppers in the Wild

The revenge of the script kiddies, or the master minds releasing DIY tools to let 'em generate enough noise as I've pointed out in my future trends of malware paper? Further expanding the Malicious Wild West series, here are two more recently released DIY malware droppers. The detection rate for the generated dropper of the first one is disturbing given it's not even crypted :

AVG - 06.12.2007 - Downloader.VB.KK
NOD32v2 - 06.12.2007 - probably unknown NewHeur_PE virus
Panda - 06.12.2007 - Suspicious file

No AV detects the packer itself!

File size: 311296 bytes
MD5: 1944378cba81bcd894d43d71dc5fccb5
SHA1: 920505f2124e8a477ab26a28f81a779d717882be

The second one has a much higher detection rate of both the packer and the dropper :

File size: 19001 bytes
MD5: abad61857c4b79773326496dec11929b
SHA1: 5c74c3572febf7f468b41d9bdc5cbc19eb2348b5

PandaLabs has recently conducted a study on the increasing use of packers and cryptors by malware authors worth mentioning :

"There are many different packers. According to the PandaLabs study, UPX is the most common and is used in 15 percent of the malware detected. PECompact and PE, are used in 10 percent of cases. However, according to PandaLabs, there are more than 500 types of packers that could be used by cyber-crooks. “In essence it is a stealth technique. The increasing use of these programs highlights how keen Internet criminals are for their creations to go undetected,” explains Luis Corrons, technical director of PandaLabs."

You may also be interested in finding out how popular anti virus vendors perform agains known, but crypted malware.

Related posts:
A Malware Cryptor
A Malware Cryptor 2
A Malware Loader Continue reading →

Homosexual Warfare

Applause for the non-lethal weapons R&D, but a Gay Bomb using aphrodisiacs to provoke sexual behaviour on the field courtesy of the Pentagon, is far more creative than a vomit beam for instance :

"In one sentence of the document it was suggested that a strong aphrodisiac could be dropped on enemy troops, ideally one which would also cause "homosexual behaviour". The aphrodisiac weapon was described as "distasteful but completely non-lethal". In its "New Discoveries Needed" section, the document implicitly acknowledges that no such chemicals are actually known."

Just imagine the situation when a century later, a futuristic History Channel displays holograms of such warfare activities. More info on the Gay Bomb, as well as video of soldiers on LSD -- exceptional warriors win their battles without waging wars. Continue reading →

Censoring Flickr in China

Since I've been discussing China's Internet censorship practices, and I've been doing it pretty much since I've started blogging, this is the most recent example of how what's thought to be the most robust and sophisticated censorship system in world is a useless technological solution if not implemented "properly". The news of the government censoring a very popular site will spread faster, but instead of applying the predefined subversive content detection practice and allow anything else, they're mocking their overhyped censorship system by blocking the entire site instead of either removing the content in question or blocking access to the specific Flickr set. Futile attempt? For sure, but far more gentle approach of censorship compared to the current one.

Various news sources reported that China's censoring the entire Flickr. As you can see the greatfirewallofchina.org test confirms the block, but it also confirms that Flickr.com itself is not censored but any other content within. How come? The idea is that the user user is left with the impression that it's a technical glitch at Flickr.com compared to receiving a censorship warning or even a 404 when accessing the main page. Logging in Flickr is possible -- verified though a Beijing based proxy manually -- uploading is also possible, but not content can be seen.

Flickr = a Yahoo! media company with which the Chinese government has been keeping close ties in the past so that jailed journalists started filling lawsuits against Yahoo. Various bloggers speculated that China banned the entire site due to the leak of protestor's photos on it, and taking into consideration China's ongoing censorship of mobile communications such as SMS messages which I covered in a previous post, you may notice that the first image of the received sms for the time and place of the protest is censored by the photographer herself, especially the time of receivement. The protest is also on YouTube, so would YouTube be logically next to get blocked? I doubt so as basically, the protest will position itself as an even more high priority issue for the Chinese government. The censorship trade-off, should you censor it and add more exclusiveness to it, or ignore and act like it's nothing serious? Undermine censorship by spreading the censored item further.

Even more interesting is the fact that couple of months ago, Google's shareholders were about to wage a proxy battle in order for them to convince top management in the long-term effects of censorship. Google convinced them that the revenues streaming from China with its near the top Internet population are more important and so they agreed. Obviously, Yahoo's shareholders are too, not keen of the fact that their investments are driving the oppression of Chinese citizens, and have recently proposed a similar resolution :

"Amnesty International has today (11 June) expressed its support for two shareholder resolutions up for vote at tomorrow's Yahoo! annual meeting in California, one calling on the company to oppose internet repression in countries such as China, and one requesting the creation of a corporate Board Committee on Human Rights."

New media companies are helpless and obliged under Chinese law to censor if they don't want to lose the option to do business in (Soviet) China, therefore a nation-2-nation actions must be taken especially from the world's major evalgelists of a free society and democracy. The rest is a twisted reality - a Tiananmen Square image search outside China, and a Tiananmen Square image search in China, everything's "in order". Continue reading →