534 Biographies of Jihadist Fighters

On the look for patterns of terrorist behaviour researchers often stereotype in order to portrait a terrorist. The Book of Martyrs (compiled in English on June 9th, 2007) is a great OSINT source for analysts and intelligence agencies wanting to obtain data regarding the lifetime or jihadist martyrs, segmented on a per country basis, including photos, poems, interviews, transcripts, and links to multimedia files. Much like the Technical Mujahid E-zine, the Mujahideen Harvest magazine, and the Jihadist Security Encyclopedia, this E-book is a yet another handy source of OSINT data, at least in respect to jihadist social networks :

“Therefore, out of these 81 names: 40 are from the Arabian Peninsula, 7 from Yemen, 7 from Syria, 5 from Algeria, 4 from Kuwait, 4 from Iraq, 3 from Turkey, 1 each from Bahrain, Bangladesh, Tunisia, Libya, France and the USA whilst the nationalities of the remainder are unknown. Theses figures correspond to the relative contribution of the Muslim Ummah towards the Jihad in the world today. Sadly, there are hardly any Muslims from Western nationalities and usually they are the most vocal in their slogans for Jihad.”

A link to a video entitled "Russian Hell in the year 2000, Jihad in Chechnya Part One" 511MB is included :

"At the time of release of this CD, (July 2000), nine months of the War have passed with no end in sight. Russian casualties stand at over 15,000 killed or missing in action (MIA) and over 30,000 injured. They have lost hundreds of battle tanks, fighting vehicles and trucks and tens of fighter aircraft and helicopter gunships."

To a second video entitled "Russian Hell in the year 2000, Jihad in Chechnya Part Two" :

"Exclusive, live film footage of two martyrdom operations carried out against Russian Barracks in Argun and Gudermes in July 2000 Combat footage of Mujahideen operations, ambushes and remote-control detonation of Russian Military vehicles throughout the Year 2000 Video of the nine OMON troops after they were executed due to the failure of the Russian Government to hand over the Russian War Criminal Colonel Yuri Budanov to the Mujahideen (April 2000)"

And to a third one entitled "The Martyrs of Bosnia Part One and Part Two" :

"This unique video by Azzam Publications, the first of its kind in the English language with real-life combat footage and the first of a four part series, narrates the biographies of some of these magnificent individuals, who sacrificed their own lives in order to bring life to those around them."

Some interesting sections related to ITsecurity and anonymity as well :

- Useful programs to protect personal information on computer and on-line

Tor [Anonymous web-surfing] ; True crypt [File & disk encryption - better than PGP] ; Window Washer [Shred free space and files] ; Spy Sweeper [Spyware remover] ; Avast [Anti-virus protection] ; Outpost [Computer Firewall] ; Winpt [secure encrypted email - better than PGP] ; Ad-aware professional [ Another spyware remover ] ; AbiWord [Open source - Better alternative to Word] ; Enigmail

- Best method to protect your chat!

Use Gaim with OTR plugin and and configure to use TOR network ; Gaim [Encrypt your chat conversations]; Off-the-Record Messaging [OTR Plug-in]

- Must have programs for your USB drive

Mobility Email - Best option for sending secure encrypted emails ; GAIM - for secure chat conversation ; Portable Firefox ; TorPark - for anonymous web browsing ; True Crypt - Best disk encryption & file protection program ; Tutorial for securing a USB drive using True Crypt ; Cyber Shredder : File wiping utility ; ClamWin [Open source anti-Virus Program] ; Greatnews - The Intelligent RSS Reader ; Foxit PDF Reader opens PDF files ; Abiword - full featured open source word processor ; Portable Open Office is really the only option for an Office Suite

Propaganda and twisted reality and its best hosted at Archive.org, courtesy of Azzam Publications.

Continue reading →

PayPal's Security Key

PayPal's recently introduced Security Key two-factor authentication for the millions of its customers in cooperation with VeriSign's growing centralization of two-factor authentication in a typical OpenID style -- Ebay's also a partner -- is adding an extra layer of security to the authentication process, it's a fact. The entire strategy relies on the fact that, if a customer's accounting details get keylogged, or they fall victims into a phishing scam and provide the accounting data themselves, the phishers or malware authors wouldn't be able to login since the key generated in the time of keylogging wouldn't be active by the time the malicious parties use it the next time. PayPal's Security Key :

"Generates a unique six-digit security code about every 30 seconds. You enter that code when you log in to your PayPal or eBay account with your regular user name and password. Then the code expires – no one else can use it. Watch the demo"

However, given the spooky commitment from phishers and malware authors we've been witnessing for the last several years years, wouldn't they entirely bypass this extra layer for authentication by basically purchasing the $5 Security Key and like legitimate customers, start generating security codes ending up with having both the accounting data, and the ability to generate valid access codes as well? Take E-banking for instance, the pseudo random key generators issued by different banks are supposed to have different algorithms for generating the codes, so that we never get the chance to discuss monocultural insecurities in two-factor authentication. Malicious parties are no longer interested in showing off as rocket scientists, but as a pragmatic and efficiency centered crowd. The way keylogging evolved into "form grabbing" and entire sessions hijackings of malware infected PCs right after the user herself authenticates though several factors based authentication, in this very same way malicious parties started coming up with ways of bypassing compared to directly confronting the security measures put in place.

The flexibility of notifications for financial transactions via alert based system and static receipt of notices sent to a mobile are an alternative. For instance, via the web interface of my E-banking provider I can set to receive an SMS when a given range of money come and go out of the account, sort of an early warning system for self-vigilance. What I'm missing is a historical "last logged from" feature, and the option to receive an SMS each and every time, I or maybe not me logs into the account. Features like these should be provided on an opt-in basis, and those customers truly perceiving the value of them will pay for the service. As always, the market delivers what the customer wants - two-factor authentication, and the irony from a psychological perspective is that in fact, those with less income are more vigilant for possible fraud attempts, than those with more income who are more gullible since they can afford the losses. Continue reading →

The Shark 2 DIY Malware

The Shark2 DIY malware (screenshots, its features, checksums of the builder, and the detection rates as of Saturday, 28th of July) finally made it though the mainstream media, as yet another DIY malware builder in the wild, despite that the what's promoted as a RAT but is actually a malware, has been around since November, 2006 :

"The tool is being distributed via several underground internet forums. Software development is almost equivalent to that available from legitimate software vendors with regular updates to the code bringing the latest detected version up to version 2.3.2. Virus creation toolkits have been available for years, but have mostly been restricted to the creation of mass mailing worms and their ilk. DIY phishing kits that dumb down the process of constructing fraudulent websites began about two years ago. Shark 2 makes the process of infecting targets for phishing attacks or performing other malign actions easier than ever. It means money making malware rackets are no longer the preserve of those with at least some programming skills."

As I've already pointed out in numerous posts, the ongoing trend of disseminating DIY malware is mainly done in order to generate as much noise as possible thought the easy of use of such builders by the average script kiddies. And while the infamous Sub7 DIY malware had the same features within its builder without, of course, Shark2's anti-sandboxing capabilities, back in 2003 Sub7's mission was more of a intellectual opportunism one, compared to today's noise generation mindset of sophisticated malware authors wanting to remain as untraceable as possible. DIY malware builders evolved proportionally with the malware authors' needs for diversity of the way the malware "phones home" in order to get efficiently controlled and the data within the infected host efficiently abused.

Every newly configured trojan variant thought the builder is an undetected piece of malware in terms of signatures based scanning, and always in the nasty combination with malware packers and crypters. Even more interesting is the fact that the authors behind the trojan are also reading the news, and as always, periodically verifying the detecting rates of the builder, namely, the checksums of the new builder compared to the one as of 28th of July that I provided have changed, and so is the detection rate for the latest release (15th of August) :

Detection rate : 4 AVs out of 32 (12.5%) detect it

AntiVir 2007.08.15 TR/Sniffer.VB.C.2

F-Secure 2007.08.15 Backdoor.Win32.VB.bax

Kaspersky 2007.08.16 Backdoor.Win32.VB.bax

Webwasher-Gateway 2007.08.15 Trojan.Sniffer.VB.C.2

File size: 2506752 bytes

MD5: e63498f392eed84b1c8a66dbb288d459

SHA1: 5aa39b70d17d16055d8084e534806d8e26a37fda

Continue reading →

Pharming Attacks Through DNS Cache Poisoning

A month ago, a detailed assessment of a recently released vulnerability in BIND9 was conducted by Amit Klein to highlight the wide impact typical nameserver vulnerabilities have in general, and this one in particular. Now that an exploit is available as well, the possibility for large scale pharming attacks in an automated fashion, becomes fully realistic :

"A program has appeared on the Milw0rm exploit portal which is able to exploit the recently reported vulnerability in the BIND9 nameserver. Transaction IDs can be predicted or guessed relatively easily, so the cache of a vulnerable nameserver can be poisoned. Phishers can use cache poisoning for pharming attacks on users by manipulating the assignment of a server name to an IP address. Even if the user enters the name of his bank in the address line of his browser manually, he will still be taken to a counterfeit web page."

Pharming, like any other threat usually receives a cyclical media attention, either prompted by a massive discovered attack, or to build awareness on an advanced phishing scheme to come in a typical "focus on current instead on emerging trends" mindset. How would access to a namerserver be obtained if not by hacking into it? The never-ending underground economy's supply of goods model indicates that certain goods such as access to breached FTP, Web and DNS servers change value over time through the release of such exploits. So suddenly, an access to a namerserver gets a higher valuation than usual.

I've been using a handy Firefox add-on to keep track of the constantly changing IPs of various cyber jihadist forums and web sites for quite some time now. The tool is actually pitching itself as an anti-pharming add-on you ought to evaluate for yourself :

"SCM performs Site Continuity Management validations on websites to help prevent Pharming attacks. Pharming attacks are an advanced form of Phishing where an adversary poisons the data held in the user’s DNS server. SCM is believed to be the first add-on to protect users from this advanced attack."

Continue reading →

DIY Phishing Kits

Rock Phish's efficiency-centered approach in terms of hosting numerous phishing pages on a single domain, often infected home user's host, easily turned it into the default application for DIY phishing attacks. And despite that we still haven't seen a multi-feature phishing kits like the ones I'm certain will emerge anytime now, here's an automatic URL redirector of data submitted to a phishing site that's showcasing the ongoing DIY phishing kits trend. Basically, once the source code of a, for instance, fake paypal login page is pasted, it will ensure all the submitted accounting data is forwarded to the malicious server where it gets logged. The main aim of this tool isn't to achieve mass scale efficiency as is the case with Rock Phish, but to make it easier for phishers to poin'n'click create or update the fake pages to be hosted on a Rock Phish domain. The program's intro :

"Steps to creating a fake login, simple as 1,2,3. Go you your web site or the site you have permisson to make a fake web login and right click then press "Source". Double click here to begin. Enter the redirection URL. The redirection URL is the site in which the user who enters their login details will be forwarded to after they fill out the form. Optional : For some web sites after you creat the phisher some images will not load properly. This is due to the source directing the images to be loaded from your database instead of their database. For example you will probably find this in your source img src="/images/image.gif". To fix this you would have to direct the source to load from the site's database by editing the source to look a little like this img src="http://site.com/images/image.gif". To automatically do this double click here."

Why are DIY phishing kits turning into a commodity, and what are some of the strategies to deal with phishing sites?

- fake pages for each and every financial institution plus the associated images are a commodity. They look like the real ones, sound like the real ones, but anything submitted within gets forwarded to a third party presumably using DIY tools like these

- phishing should be treated as spam, namely it should never reach the end user's mailbox, but as we've already seen in the past, certain financial institutions are trying to rebuild confidence in the email communication with their customers whereas they should build more awareness on how they'd never ever initiate such communication as it will create even more confusion for the customer, the one who's still not aware of the basic phishing techniques

- HTTP referer logs to static images via email clients or web based emails could act as an early warning system and provide a list of URLs to be automatically feeded into a to-be shut down tracking system, ones we've seen getting commercialized by vendors already

- Phishing has become such a widespread problem that he latest versions of IE and Firefox now have anti phishing protection built-in. Moreover, phishing sites are known to exploit browser vulnerabilities to hide the real .info and .biz extension of a site, so that a built-in anti phishing toolbar picks up where the browser can no longer perform.

As far as the recent increase of Rock Phish domains is concerned, DSLreports.com has been keeping track of, and shutting down Rock Phish domains for a while. Once shut down, new domain names usually recently dropped ones appear online, such as userport.li and userport.ch for instance. Go through an article on "The History of Rock Phish" as well. Continue reading →

The Storm Worm Malware Back in the Game

After coming across the story on how Storm Worm is taking over the world for yet another time, I wondered - who are the novice malware authors behind Storm Worm that switch tactics by the time their old ones become inefficient? After commenting on the first Storm Worm wave -- it's not even a worm -- with an emphasis of the outdate social engineering techniques it was using back in January, 2007, it's time we assess the current situation and how have Storm Worm evolved. What has changed? Direct .exe email attachments matured into a direct link to an infected IP address. Mass mailings are now sent with campaign ID to measure efficiency. Outdated social engineering tactics became a direct exploitation of old and already patched vulnerabilities to ensure a higher probability of infecting the visitor whose lack of understanding on how client side vulnerabilities should get a higher priority compared to visual .exe vigilance often result in an infection. Here's a sample infected IP spreading Storm Worm binaries :

Message content : "Your Download Should Begin Shortly. If your download does not start in approximately 15 seconds, you can click here to launch the download"
Original URL : 77.96.240.142 /?232c3a9ebeed435601e5ee71
Binary URL : 77.96.240.142/ecard .exe
Server response : HTTP/1.1 200 OK
Server: nginx/0.5.17
Date: Thu, 09 Aug 2007 00:12:15 GMT
Content-Type: text/html
Transfer-Encoding: chunked
X-Powered-By: PHP/5.2.1

Email spoofed from : "postcards.com" jyg @ alltel.net
Mail server : exchange.moneytreemortgage.biz, 64.220.230.118
IP blacklisted by : SpamCop, CASA-CBL, UCEPROTECTL1, PSBL
Sender's IP : 73.208.110.36
IP blacklisted by : Spamhaus PBL, NJABL Dynablock

ecard.exe
Detection rate : 17 AVs out of 32 detect it (53.13%)
File size: 113195 bytes
MD5: 63fe9896fbbca6471ec216c9dee0b0e9
SHA1: 170eb66ca28f74d291e07a0383564b465d373f06

file.exe - downloader
Detection Rate: 17 AVs out of 32 detect it (53.13%)
File size: 4608 bytes
MD5: 7ea2baadfe3a8a54635cea72526ff391
SHA1: ae32bb7df491fb52650144931c10a7bd5ebf6a2c

alt.exe
Detection Rate : 17 AVs out of 32 detect it (53.13%)
File size: 113168 bytes
MD5: 4ac8a3242e945215469ec08bc5603418
SHA1: 75b8aadab3626e39b570d7e7494d3be63cc582d1

At every infected IP acting as a web server, we have a typical MPack style XOR-ifying javascript obfuscation. And while it's not that hard to deobfuscate it, the interesting part is the type of vulnerabilities exploited to obtain the downloader and the payload. The current campaign is a good example of a fast-flux network as the malware authors used one mail server to sent the email, another IP as actual sender, and a third one where the payload, the downloader are hosted with the web page itself using the Q4-06 Roll-up package exploits kit :

"This is a set of exploit scripts mostly from the end of 2006. It includes an MS06-042, a SetSlice, an MDAC, a WinZip, and a QuickTime. It is typically encrypted using a wide variety of javascript obfuscators, but is usually about the same source code underneath. Recently it sometimes includes an ANI exploit from April 2007."

As we have already seen with the most recent and wide scale malware campaigns, such as with the IcePack's and MPack's kits, the malware authors are entirely relying on patched vulnerabilities compared to purchasing zero day ones, further fueling the superficial zero day vulnerabilities cash bubble, and proving that using old vulnerabilities is just as effective as using a zero day one - they are both unpatched at the end user's PC. Ensure attacks using outdated vulnerabilities cannot take place by patching, and don't forget that Storm Worm is among the many other malware and spam oubtreaks currently active in the wild.

Related posts:
Malware Embedded Sites Increasing
Massive Embedded Web Attack in Italy
The MPack Attack Kit on Video
The WebAttacker in Action
The IcePack Malware Kit in Action
The Underground Economy's Supply of Goods

More info:
Malware - Future Trends
New wave of nuwars storming in
Storm Worm Continues to Spread
The Storm Worm
Storm Worm growth is getting out of hand, researchers fear
Storm Trojan Worm evolves and creates Havoc on the Internet, warns SecureWorks
Storm Worm's Virulence May Mean Tactics Change
Storm Worm Hype Batters Media Continue reading →

A Cyber Jihadist DoS Tool

I've seen mail bombers courtesy of chinese hacktivists released during the China/U.S cyber skirmish, encryption tools released by cyber jihadists, and now we have a fully working multi-thread HTTP GET flooder for attacking "infidel" sites as the authors put it. The tool itself and the tutorial pointing to ping flooders circa 1999 aren't disturbing. What's disturbing is the time when cyber jihadists stop re-inventing the wheel to achieve a better branding effect, and start outsourcing their DDoS needs to groups who are vulnerable to a single weakness only - lack of ethics and the financial proposition they'll get. The numbers within the screenshot are part of a descriptive tutorial on how to use the tool, which is a part of the cyber jihadists' al-jinan.org DDoS initiative, so basically once cyber jihadists download E-jihad, the tool periodically "phones home" to obtain IPs of sites to be attacked and included in the DoS tool. Here's more info :

"The "Electronic Jihad Program" is part of the long-term vision jihadi Web site Al-jinan.org has to use the Internet as a weapon, something that affects any organization that relies on the Web. Electronic Jihad allows users to target specific IP addresses for attack in order to take any servers running at those IP addresses offline. The application even includes a Windows-like interface that lets users choose from a list of target Web sites provided via the Al-jinan site, select an attack speed (weak, medium, or strong), and the click on the "attack" button."

Moreover, despite that the al-jinan.org's "Electronic Jihadists Against Infidel Sites" campaign is shut down, the initiative is constatly switching locations, and is currently active at another domain. Compared to aj-jinan.org's E-jihad app that was distributing the IPs to be attacked, this campaign only recomments the use of a ping flooder. You can also amuse yourself wih this attack technique. The idea is to open 5 IFRAMEs, and reload them every 5 seconds, the site under "iframe attack" is islam-in-focus.com. Aspirational initiative, with thankfully lame execution. Continue reading →

A Commercial Click Fraud Tool

India's secret army of "ad clickers" employed on a revenue sharing basis is an already well known threat to the future online advertising, especially with its cost-effective model of outsourcing click fraud to human clickers, and while the public's attention is always orbiting around the use of botnets to commit click fraud, in the vary same way we have malware pretending to be a RAT, and spamming tools pretending to be email verification ones, we also have commercially available web clickers, while they're in fact click fraud tools. Click, click, click, or click once only to have a web clicker automatically aggregate and verify working proxies in between launching multiple threads against a web site presumably owned by the clicker? And no botnet needed? A commercial click fraud tool called, well, the Web Clicker :

"uses public proxies to load and click those banners. Advertisement systems will recognize every proxy as a single unique user clicking on the banner.Server administrators have to get aware of this heavy security hole, as customers may use this program to earn hundreds of dollar a month! You as a server administrator and software developer have the opportunity now to test your own servers to improve protection and to detect possible cheating schemes.If you need additional information, check the links below or try WebClicker right now! You can take a look at some WebClicker screenshots first if you like."

In previous posts "Latest Report on Click Fraud", and "AdSense Click Fraud Rates", I pointed out that click fraud has become so evident that :

"Third party companies emerged and started filling the niche by coming up with click fraud analytics software so that Google's major customers, even the small to mid-size business could take advantage of an automated way to analyze click anomalies."

And while Google are publicly admitting that click fraud is a fact and commissioning third-party analysis of their actions to detect and prevent it, such commercially available tools require no botnets, but a minor investment in proxy servers providing service, and the software itself. Finally, India's army of "ad-clickers" will achieve fraudulent economies of scale if empowered with such tools. Some issues to keep in mind :

- The tool can be used as a click fraud assessment one, so that ad networks can verify their susceptibility to such applications, or webmasters the detection rate of their click fraud analyzing solution. The main concern is that the tool is sold on a volume basis, so malicious parties can easily obtain it in between the ones they're already using

- Each and every security vendor has a huge database of malware infected, spam and phishing emails sending IPs, and while they're already figuring out ways to commercialize these databases, an ad network could greatly benefit by integrating such data within their system and thinking twice before counting a click from these hosts

- The more the advertiser is aware of the click fraud problem, the more would her requirements and expectations become. If advertising networks based on a CPC model don't build better awareness on their mitigation practices, the entire CPC ad model is at stake

Here are some tips on DIY click fraud prevention, Yahoo's and Google's comments on the latest report released by Click Forensics, a report on Combating Click Fraud with interesting perspectives on the possible tactics, and a very in-depth analysis of advertising models and how fraudulent publishers benefit from them.

Overall click fraud rate per quarter courtesy of the Click Fraud Network.

Continue reading →

Delicious Information Warfare, Friday, 3rd

It's time for this week's research papers, tools and services worth going through. Catch up with last week's content, stay informed, and keep in mind that the most prolific threat of them all is the lack of a decent situational awareness.

Papers and Publications :

Presentations and White Papers from Black Hat 2007
"The entire collection of presentations and white papers per researcher from this year's Black Hat Con."

Netcat for the Masses
"Having had numerous people recently ask me about the various uses for Netcat I decided to put together a document showing a few handy uses for good ol' Netcat. Netcat has been described as telnet on steroids or a Swiss army knife, both excellent descriptions for this versatile little tool."

Spam Report May 2007
"In May, spam accounted for 70% - 80% of all email traffic on the Russian Internet. No major fluctuations were observed. Spam reached a high of 86% of all email traffic on May 28th, and hit a low of 65.4% on May 21."

How To Harden PHP5 With Suhosin On Fedora 7
"Suhosin is an advanced protection system for PHP installations that was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against bufferoverflows or format string vulnerabilities and the second part is a powerful PHP extension that implements all the other protections."

Microsoft UK Events Website Hacked
"A detailed analysis how the website was hacked and how it could have been avoided."

Implementing Effective Vulnerability Remediation Strategies Within the Web Application Development Lifecycle
"Once you've completed a security assessment as a part of your web application development, it's time to go down the path of remediating all of the security problems you uncovered. At this point, your developers, quality assurance testers, auditors, and your security managers should all be collaborating closely to incorporate security into the current processes of your software development lifecycle in order to eliminate application vulnerabilities."

Defend Your Code with Top Ten Security Tips Every Developer Must Know
"There are many ways to get into trouble when it comes to security. You can trust all code that runs on your network, give any user access to important files, and never bother to check that code on your machine has not changed. You can run without virus protection software, not build security into your own code, and give too many privileges to too many accounts. You can even use a number of built-in functions carelessly enough to allow break-ins, and you can leave server ports open and unmonitored. Obviously, the list continues to grow."

Security Testing Enterprise Messaging Systems
"This paper discusses potential security weaknesses that may be present in messaging systems either as a result of software flaws, application design or the misconfigurations of services. It focuses on TIBCO Rendezvous, as an example of a commonly used enterprise messaging system. Recommendations are then presented which mitigate these security issues."

How to Cheat at Configuring Open Source Security Tools - book excerpt
"The perfect book and companion Web site for multi-tasked security professionals and IT managers responsible for securing corporate networks using the 10 most popular tools including: Snort, Nessus, Wireshark, Nmap, and Kismet on Windows, Linux, or Max OS X."

Controlling Website Account Information
"When creating a website that requires authentication, the designer must keep in mind that passwords should be stored in an encrypted format. There must also be a password policy set before launching the site; this could include the password requirements as well as how the website and webmaster should control user passwords. The last decision to be made is how access will be granted to the users; this includes how they will provide credentials, how their credentials will be authenticated, and how to track the user’s authentication from one page to another."

Security Data Visualization - book excerpt
"In Security Data Visualization, the author creates graphical windows into the world of computer security data, revealing fascinating and useful insights into networking, cryptography, and file structures. After learning how to graph and display their data correctly, readers will be able to understand complex data sets at a glance."

US-CERT Quarterly Trends and Analysis Report, Vol. 2, Issue 2
"This report summarizes and provides analysis of incident reports submitted to US-CERT during the U.S. Government fiscal year, 2007 second quarter (FY07 Q2)."

Security Tools :

BotHunter
"BotHunter is a passive traffic monitoring system, which ties together the dialog trail of inbound intrusion alarms with those outbound communication patterns that are highly indicative of successful local host infection. When a sequence of in and outbound dialog warnings are found to match BotHunter's infection dialog model, a consolidated report is produced to capture all of the relevant events and event sources that played a role during the infection process."

PDFassassin
"PDFassassin is a module for SpamAssassin that allows for the scanning of PDF files in email message attachments. Email bodies are scanned upon connection and checked for PDF attachments. Text is extracted from the PDF via pdftotext and scanned by SpamAssassin. Should the PDF contain images, the gocr program is called to extract the text content."

Advanced CheckSum Verifier (ACSV) v1.5.0
"The Advanced CheckSum Verifier is an handy and fast windows utility for verifying integrity of files by using the CRC32 or MD5 checksum calculation algorithms for Windows users. It will allow you to verify the accuracy of your data after you burn a CD or transfer a files over a network. Adding an little checksum file to your data files will allow in further easily to verify their integrity at any time."

Blue Pill Project
"The New Blue Pill is significantly different from the original Blue Pill, not only because of the various features that it implements, but also because of the different architecture it was based on (HVM-like approach, similar to that used by XEN 3)."

PyFault - Python Based Fault Injection in Win32 Based Application
"PyFault is a python library aimed at fault injection scenarios in Win32 based applications. Currently it only implements a DLL injection and ejection mechanism, but we aim to add more functionality to it,and of course all requests are welcome."

Astaro Security Linux 6.311
"Astaro Security Linux is an all-in-one network security gateway that includes a firewall, intrusion protection, virus protection, spam protection, URL filtering, and a VPN gateway. Features include stateful packet inspection, deep packet filtering, intrusion detection and prevention, portscan detection, content filtering, virus detection for email and Web traffic, profile handling, IPSec, SSL, and PPTP VPN tunneling, spam blocking, proxies for HTTP, FTP, POP3, SMTP, DNS, VoIP, SOCKS, and Ident, logging, and reporting."

EasyIDS v0.2
"EasyIDS is an easy-to-install intrusion detection system based upon Snort. EasyIDS is designed for the network security beginner. EasyIDS includes CentOS Linux, Snort, MySQL, BASE, ntop, oinkmaster, and more."

Trace Explorer
"Trace Explorer aggregates traceroutes to many popular websites and makes them searchable, allowing you to discover which web sites are hosted near each other, at a particular ISP, or behind a specific router."

SAGATOR
"SAGATOR is an email antivirus/antispam gateway. It is an interface to any smtpd, which runs an antivirus and/ or spam checker. Its modular architecture can use any combination of antivirus/spam checker according to configuration. It currently supports clamav, nod32d, AVG, sophos, TrendMicro AV, Symantec AV, spamassassin, bogofilter, and quickspamfilter."

Firefox: 10 tips to bolster your privacy
"In this hack, we’re going to highlight 10 tips to bolster your privacy when surfing the Internet with Firefox. You can use any of these tips to add an extra layer of privacy to your browsing at work, on public computers or just on a shared computer at home."

Binary Tools
"reverse: takes the input file, reverses it (first byte becomes last byte, …) and writes it to a new file. middle: extracts a sequence of bytes from the input file and writes it to a new file."

IM-Filter
"IM-Filter is a daemon that runs on a firewall and filters ICQ traffic. The daemon can identify file transfers, handle UIN and word blacklists, manage a list with currently logged in users. and log messages sent via the ICQ protocol."

Jesse's JavaScript compiler/decompiler fuzzer
"This fuzzer constructs random strings with JavaScript statements andexpressions (sometimes with syntax errors), and asks the JavaScript engine totreat them as functions."

50+ Firefox Add-ons For Security and Privacy
"While these issues are best fixed with a soon-to-be-released patch*, we were inspired to look at the wider issue of keeping your Firefox browser secure. We present a plethora of security extensions for Firefox, followed by those that will keep your private data….private."

The Crypto CD
"CryptoCD is a collection of software that provides secure communication through the Internet. The programs cover tasks like email encryption, secure chat, and anonymous Web browsing."

GMER
"GMER is an application that detects and removes rootkits."

RenaissanceCore 0.9.0
"The RenaissanceCore IDS consists of four components: a stateful IDS sensor, a graphical user interface, a database backend, and a two-way interface between the IDS sensors and the database. Each component can run on a separate host."

Sevices & Misc :

The Pwnie Awards
"An annual award ceremony celebrating (or making fun of) the achivements and failures of security researchers and the wider security community."

USB patch released. HALLELUJAH!
"The patch was written for and, therefore, tested on Apple TV software version 1.0. If you have 1.1, the patch might not work. Please let us know if you can get the patch to work on 1.1."

Wordpress ZeroDay Vulnerability Roundhouse Kick and why I nearly wrote the first Blog Worm (updated)
"Much time has passed since I wrote the last Full Disclosure Publication on this Blog, it was about the security vulnerability in Akismet, a Wordpress antispam plugin. This time you will witness something which impacts huge parts of the Blogosphere, I will tell you my story."

The Story of DEFCON - Video
"Jeff Moss, the founder of DEFCON and Black Hat, tells the history of the largest hacker conference and how it all got started. Find out more about the early days of the hacking scene when dial-up was considered fast, how the security space changed around the conference as years went by, and discover some bizarre things that take place at the event." Continue reading →

GIMF Now Permanently Shut Down

That was fast, and we could easily start talking about the average time it took to shut down cyber jihadist communities like these. On Tuesday after I pointed out that it took a month to shut down GIMFs English and German version blogs, and how they've switched to a third one, it's now down too, for less than 48 hours. Limiting cyber jihadists opportunities to operate and develop online communities is directly undermining their supporters' confidence in GIMF's ability to remain online. And despite that the blogs have been around for quite a while taking advantage of an effective one-to-many communication model, they're now finally down. Intact, however, still remain Jihad Fields are Calling! with their eye catching Jihadist Wallpapers Gallery, and the Caravan of Martyrs with another Jihadist Gallery worth checking out, especially the comments within. Continue reading →

Average Online Time for Phishing Sites

Some vendors specialize in clustering phishing attacks to better understand the phishing ecosystem and reveal all of its nodes. Others too, armed with opportunistic business development strategies are developing a market segment to provide their customers with services for timely shutting down a phishing or malicious web site. Symantec recently released informative averages on the time a phishing site remains online, confirming the need for a such a market segment and prompting the discussion on alternative solutions :

"Our analysis shows how ISPs in some countries are relatively slower than others to shut down attacks. For example, Taiwan’s average shutdown time has been only 19 hours on 92 attacks, while in Australia the average for 98 attacks has been almost one week for a single shutdown. Other countries slow to respond include the USA and India. Countries identified as responding quickly include Germany, Netherlands, Japan, Estonia, Poland and Russia."

Moreover, May's report from the Anti-Phishing Working Group has an ever better sample consisting of 37438 unique phishing sites, where the average time online for a phishing site was 3.8 days, and the longest time online was 30 days. Why are certain ISPs slower in shutting down phishing sites compared to the others? What motivates the best performing ones to react immediately? It's all a matter of perspective. Let's consider the facts :

- DIY phishing kits such as Rock Phish significantly increased the number of phishing sites, but sacrificed efficiency for quality. Rock Phish's major strength is Rock Phish's major weakness, namely that of centralization, so the phisher ends up with a single IP hosting phishing sites for numerous banks. In fact, according to IBM's X-Force, single domains were carrying an average of 1000 phishing sites

- Phishing sites hosted at home users PCs are harder to shut down compared to those hosted on a web server

- Russia is responding faster than the U.S because according to the APWG's Countries hosting phishing sites stats, Russia's percentage is 7.41% compared to the U.S 32.41%. We have the same situation with countries hosting trojans and downloaders where Russia accounts for 6% compared to China with 22%. It does not mean Russia is out of the game, not at all, but the way you may have a Russian phishing/malware campaign hosted in the U.S, you may also have a U.S phishing/malware campaign hosted in Russia

- The lack of incentives for ISPs to be in a hurry and the lack of accountability for them if they are not in a hurry. Perhaps if the vendors developing the market segment for shutting down phishing sites start sharing revenues in a win-win-win fashion, it would make a difference if no legislations are in place

- XSS vulnerabilities within E-banking sites often act as redirectors, so while you're shutting down the yet another .info domain, the XSS is still there waiting to get abused

- In a fast-flux empowered malicious economies of scale attacks, any stats should be considered at least partly "scratching the surface" only due to the fact that, while the redirector may be in the U.S, the second one with the phishing site may be in Russia, and the third one hosting the malware in Taiwan. And so, while you've shut down the most obvious nodes, the campaign remains in tact, and gets automatically re-mixed to achieve malicious diversity using the same domain names, but under different and dynamic IPs next time

What would be the most effective approach for the most targeted financial services to protect their customers from phishing attacks? Hire brandjacking monitoring services to shut down efficiently and persistently, the generated phishing sites with DIY phishing kits, educate E-banking customers, or do both? Assess their unique situation and balance while considerating that some folks still don't know what phishing really is. Now, try explaining to them what form input grabbing malware tools such as the Nuclear Grabber are.

Related posts:
A Client Application for Secure E-banking?
The Rock Phish Kit in action
The Brandjacking Index
Security threats to consider when doing E-banking
Banking Trojan Defeating Virtual Keyboards
Defeating Virtual Keyboards Continue reading →

Feeding Packed Malware Binaries

Remember the avvcc.com domain which I mentioned in a previous example of a fast-flux network using the WebAttacker kit two months ago? It's still up and running this time hosting online gaming accounts password stealer, and the binary is packed using five different packers in exactly the same fashion like the binary obtained two weeks ago. The domain itself is a great example of a fast-flux network, a term coined by the Honeynet Project to showcase the growing complexity and evasive techniques introduced by the malicious ecosystem, on their road to invisibly control, evaluate and manage their malicious campaigns online.

Packed binary obtained two weeks ago :

File size: 205917 bytes
MD5: ef11bed4a5f4d61ad771204d1ec6ac25
SHA1: 6c35869de5ef20b949b3d9f53e111f26f4631569
packers: PECompact, NsPack
packers: PECOMPACT, BINARYRES, NSPACK
packers: ZIP, PecBundle, PECompact

Packed binary as of today :

File size: 76800 bytes
MD5: 17d12aecb7aba82ecc38dd6d2dd3e3b3
SHA1: 439947056d1005ec8738ed19e84bbba043556a2f
packers: PECOMPACT, BINARYRES
packers: PecBundle, PECompact

Both binaries have a relatively high detection rate, but that's not the point. The point is the ongoing trend of malware embedded web sites, which in combination with a fast-flux network prompts the need for re-evaluating your security policies and preemptive security strategy.

Fast-flux networks graph courtesy of the Honeynet Project & Research Alliance. Continue reading →

GIMF Switching Blogs

The Global Islamic Media Front like pretty much all other cyber jihadist supporters, and jihadist media agencies, seem to have fallen in love with Wordpress. Exactly one month since I posted a list of terrorism supporting or glorifying blogs, both GIMF's English and German version blogs were shut down. Strike one for the good guys. But did they really dissapear from the cyber jihadist blogosphere? Not at all. The Global Islamic Media Front simply switched propaganda to this blog. Among GIMF's most notable IT releases are the Mujahideen Secrets Encryption Tool, and the quarterly released Technical Mujahid E-zine. Continue reading →

World of Warcraft Domain Scam

World of Warcraft playing species, beware! Can you find the differences? Depending on the font type, font size and email client, an euphoric gamer can easily fall victim into this, and she will, since the domain is currently redirecting to Blizzard's real WoW site in Europe. As you can see in the attached screenshot, this domain registered a week ago aims to trick you, and your email client font preferences, into thinking VV equals W, and that vvovv-europe.com is indeed wow-europe.com.

vvovv-europe.com
69.147.83.157
Creation Date........ 2007-07-25
Expiry Date.......... 2008-07-25

Some developments on the cybersquatting front :

"The Coalition Against Domain Name Abuse (CADNA) is announcing the launch of its national campaign against Internet fraud. A non-profit organization based in Washington D.C., CADNA is leading the way in confronting cybersquatting – the fraudulent abuse of domain name registration that threatens the future viability of Internet commerce. Although the Anti-Cybersquatting Consumer Protection Act (ACPA) was introduced in 1999, cybersquatting remains an underestimated threat. The number of .com domain names alone has doubled since 2003, and the number of cybersquatting disputes being filed with the World Intellectual Property Organization (WIPO) is on the rise – up 25% in 2006 from 2005. According to a recent independent report, cybersquatting increased by 248% in the past year."

So far, this remains the most creative typosquatting "scam to come" I've seen in a while. Continue reading →

The IcePack Malware Kit in Action

The IcePack is a rather average web based malware C&C kit compared to for instance, the Black Sun, the Cyber Bot, Mpack, and mostly to Zunker. Average in terms of the lack of unique features offered, which makes me think that it's a hybrid of publicly obtainable stats and exploits rotation modules.

After providing you with in-depth overviews of the WebAttacker and the Mpack kit large scale attacks in previous posts, in this post I'll showcase the IcePack kit in action. As I've already pointed out in a previous post related to the increasing number of malware embedded sites, malware authors are diversifying their traffic aggregation approaches, and are either exploiting the sites themselves, their ISP's CPanel, or using push, pull and passive embedding techniques to achieve their goal.

Listening to your infection? Indeed. In the middle of the month, the Brazil's fan sites of popular music bands such as t.A.T.u and Linkinpark got IFRAME-ed, and had their visitors infected with a IcePack loader. Let's assess the URL within the IFRAME appropriately.

URL : hllp://my-loads.info

IP : 203.121.71.165

Response : HTTP/1.1 200 OK

Date: Mon, 30 Jul 2007 01:02:43 GMT

Server: Apache/1.3.37 (Unix) mod_ssl/2.8.28 OpenSSL/0.9.8a PHP/5.2.3 mod_perl/1.29

FrontPage/5.0.2.2510
X-Powered-By: PHP/5.2.3

Transfer-Encoding: chunked

Content-Type: text/html

Then, we are taken to a not so sophisticated obfuscation pointing us to the vulnerabilities exploited and the actual binary. Detection rates for the loader so far :

AntiVir 2007.07.28 TR/Crypt.U.Gen

AVG 2007.07.28 Obfustat.AGS

eSafe 2007.07.29 suspicious Trojan/Worm

Ikarus 2007.07.29 Trojan-Downloader.IcePack

McAfee 2007.07.27 New Win32

Panda 2007.07.29 Generic Malware

Sophos 2007.07.26 Mal/HckPk-A

Sunbelt 2007.07.28 Trojan-Downloader.IcePack

Symantec 2007.07.29 Downloader

Webwasher-Gateway 2007.07.29 Trojan.Crypt.U.Gen

File size: 6792 bytes

MD5: ce3291be2ded8b82fc973e5f5473b1fe

SHA1: fcf4cab3ade392c611c95e16c913fbc967577222

More screenshots of the IFRAME at Finjan's blog and a comment on evasive attacks : "The toolkit also uses evasive attack. By blocking specified countries and multiple instances from the same IP address, it minimizes exposure to security vendors." Very true. Re-visting it again, I no longer get exploited.

Ice Pack kit screenshots courtesy of IDT Group member while pitching the kit.

Continue reading →

Shark2 - RAT or Malware?

The latest release (26 July 2007) of the Shark2 RAT (Remote Administration Tool) once again demonstrates how thin is in fact the line between RATs and malware. Moreover, the reality on how malware is often pitched as a RAT for educational purposes only, whereas it includes typical malware-like features such as virtual machine detection and anti virus detection, ones not so common for RAT's such as PC Anywhere for instance. So, it's not a RAT but malware. More on Shark2 :

"sharK is an advanced remote administration tool written in VB6. With sharK you will be able to administrate every PC in the world (using Windows OS) remotely. Here are some facts:

* sharK uses RC4 to encrypt the traffic with a random cypher generated every new startup.

* sharK is able to resume downloads and uploads when the server disconnects on the next connect

* sharK is completly Plugin based! So you have a very small server and never need to update it (except on core changes)

* Compressed Transfers

* Thumbnail Previews of Pictures

* Screen Capture with VNC-Technology (Only the parts of the pic that are changed since the last shot will be transfered)

* Keylogger works with Keyboard hooking

* You have a real DOS-Shell instead of dos-output like in the most Remote Administration Tools

* Interactive Process Blacklist

* Virtual-Machine detection"

Vendors detecting the latest builder already, despite the logical crypter obfuscations to come :

AntiVir 7.4.0.50 2007.07.28 TR/Sniffer.VB.C.2

CAT-QuickHeal 9.00 2007.07.28 Backdoor.VB.bax

Fortinet 2.91.0.0 2007.07.28 W32/VB.BAX!tr.bdr

Ikarus T3.1.1.8 2007.07.28 Backdoor.Win32.VB.bax

Kaspersky 4.0.2.24 2007.07.28 Backdoor.Win32.VB.bax

MD5: d5eca6c6a1956cb2f4261da1b8f25ee2

SHA1: b603d0d6e3dff0f5f01e86eb82eb80a0e0455445

Continue reading →

Delicious Information Warfare, Saturday, 28th

Here are some of the most interesting security papers, tools and services I stumbled upon during the week. Enjoy, and stay informed!

Papers and Publications :

- Exploiting the iPhone - Paper + Video
"Shortly after the iPhone was released, a group of security researchers at Independent Security Evaluators decided to investigate how hard it would be for a remote adversary to compromise the private information stored on the device. Within two weeks of part time work, we had successfully discovered a vulnerability, developed a toolchain for working with the iPhone's architecture (which also includes some tools from the #iphone-dev community), and created a proof-of-concept exploit capable of delivering files from the user's iPhone to a remote attacker. We have notified Apple of the vulnerability and proposed a patch. Apple is currently looking into it."

- The Evolution of GPCode/Glamour RansomWare
"This report contains a description of the more obscure, previously undocumented traits belonging to the GPCode/Glamour trojan. The code is a modified version of the Prg/Ntos family which was detailed in depth during our Encrypted Malware Analysis in November 2006. While a majority of the functionality has not changed since then, this recent variant is distinctive enough to warrant additional research. In
particular, the trojan is now equipped with the ability to encrypt a victim’s files on disk. The motive for adding this feature is clearly monetary, as the victim is advised that the files will remain encrypted unless $300 is turned over to the authors, in exchange for a decryption utility."

- A Guide to Security Metrics
"In the face of regular, high-profile news reports of serious security breaches, security managers are more than ever before being held accountable for demonstrating effectiveness of their security programs. What means should managers be using to meet this challenge? Some experts believe that key among these should be security metrics. This guide provides a definition of security metrics, explains their value, discusses the difficulties in generating them, and suggests a methodology for building a security metrics program."

- Secure File Deletion - Fact or Fiction?
"This paper will deal with how and where some of these files are created and how to securely remove them from a system. Microsoft Windows operating systems and associated applications will be the main focus. This paper is divided into two main sections, the first section is designed to be a primer on the types of information that can be found on a hard drive. It is not designed to be a fully detailed data recovery/computer forensics tutorial, but is designed to show security professionals how much information can be found on a hard drive. The second section deals with the concepts behind securely deleting files and associated data from a hard drive."

- Group Policy Extensions in Windows Vista and Windows Server 2008 - Part 1
"Some of the more useful new group policy settings included in Windows Server 2008 and Windows Vista."

- Hooking CPUID - A Virtual Machine Monitor Rootkit Framework
"One of the fascinating debates taking place around the web is whether or not an OS can detect if it is running inside a VM. Surely a VMM will never be able to fool an external clock but discounting that, who knows? In any regard, I have written a small VMM that attempts to place the host OS into a VM and then handles the basic subset of unconditional VM-exits. Great. Now what?"

- BIND 9 DNS Cache Poisoning
"This weakness can be turned into a mass attack in the following way: (1) the attacker lures a single user that uses the target DNS server to click on a link. No further action other than clicking the link is required (2) by clicking the link the user starts a chain reaction that eventually poisons the DNS server?s cache (subject to some standard conditions) and associates fraudulent IP addresses with real website domains. (3) All users that use this DNS server will now reach the fraudulent website each time they try to reach the real website."

- Secure Programming Best Practices for Windows Vista Sidebar Gadgets
"Today, the Windows Vista Sidebar hosts Gadgets built from HTML, JavaScript, and potentially ActiveX controls, and because Gadgets are HTML, they are subject to Cross-site Scripting style bugs. These bugs are extremely serious because script in the Sidebar is capable of running arbitrary code in the context of the locally logged-on user. This document outlines some of the secure programming best practices that should be considered when building Windows Vista Sidebar Gadgets."

- Wardriving Bots
"wardriving-bot's are autonomous systems that are installed in a train, car, bus, taxi or truck and collect wardriving data's, like SSID, GPS-data, MAC address and all other stuff, that kismet can handle. after collecting this data, encrypting, the bot try to send this information back to the Bot-Handler with using a "open" accespoint or a HotSpot."

- KYE: Fast-Flux Service Networks
"This whitepaper details a growing technique within the criminal community called fast-flux networks. This is an architecture that builds more robust networks for malicious activity while making them more difficult to track and shutdown. This is the first KYE paper we are releasing in both .pdf and .html format."

Security Tools :

- Atsiv v1.01 - load, list and unload signed or unsigned drivers on 32 and 64 bit versions of Windows XP, 2K3 and Vista
"Atsiv is a command line tool that allows the user to load and unload signed or unsigned drivers on 32 and 64 bit versions of Windows XP, Windows 2K3 and Windows Vista. Atsiv is designed to provide compatibility for legacy drivers and to allow the hobbyist community to run unsigned drivers without rebooting with special boot options or denial of service under Vista."

- Secunia Personal Software Inspector - Checks Over 4,200 Applications for Latest Patches
"The Secunia PSI detects installed software and categorises your software as either Insecure, End-of-Life, or Up-To-Date. Effectively enabling you to focus your attention on software installations where more secure versions are available from the vendors."

- HIHAT - High Interaction Honeypot Analysis Toolkit
"The High Interaction Honeypot Analysis Toolkit (HIHAT) allows to transform arbitrary PHP applications into web-based high-interaction Honeypots. Furthermore a graphical user interface is provided which supports the process of monitoring the honeypot and analysing the acquired data."

- GPCode Ransom Trojan Decoder
"Recent reports of GPCode, a Ransom Trojan that encrypts files and asks for $300.00 to unlock the victim files have been hitting headlines in the news. Secure Science has offered a freely available decoder for freeing up the files without any problems. This program was written as open source software in the interest of support for other researchers. If you have become a victim of the GPCode Ransom trojan, please download a copy and run it on your systems and it will decrypt the files back to the state they were in before the trojan infected the computer."

- Rootkit Detective v1.0
"McAfee Rootkit Detective is a program designed and developed by McAfee Avert Labs to proactively detect and clean rootkits that are running on the system."

- CSRF Redirector
"Inspired by the XSS POST Forwarder, I just created the CSRF Redirector. It's a simple tool that makes it easy to test CSRF using POST, hopefully demonstrating how prevalent CSRF vulnerabilities are as well as reducing the misconception that forging a POST request is complicated."

- WordPress Security Scanner
"The WordPress version survey was largely successful; it was released on both Slashdot and SecurityFocus which I am quite pleased about, but now onto something even more interesting - that was just the appetizer. I received alot of questions regarding how my survey was conducted. I was going to write an aftermath post (which I still may do), but decided to release my tool, "wp-scanner" instead."

- WAZ v 1.0 - Windows Anti DDoS Tool
"Through my study and research I found lots of networks that are under the hood of Ddos attacks.WAZ is a solution to this. The tool is fully functional and effective in stopping the Ddos agents. You can find lots of Ddos agents like Trinoo, WinTrinoo, Shaft, Mstream, Stacheldhart Ver 1 & 2, Trinity, Entitee etc. They are considered to be the best agents to launch distributed denial of service attacks."

- The Ultimate Distributed Cracker
"The main purpose of UDC is the recovery of the passwords by the given hash-values (NTLM, MD5, SQL, SHA1 and 40+ other). The typical user can recover own forgotten passwords, for example, Windows NT/XP/2003 authorization passwords. Multithreaded and distributed recovery modes are supported. The new method for precalculating Hybrid Attack using Rainbow Tables is introduced. Now there's nothing unbreakable"

- MITRE Honeyclient Project
"Honeyclients can proactively detect exploits against client applications without known signatures. This framework uses a client-server model with SOAP messaging as the primary communication method, and uses the free version of VMware Server as a means of virtualizing the client environment."

- PSA3 - PHP Source Auditor III
"PHP Source Auditor III (or PSA3) was created in order to quickly find vulnerabilities in PHP source code. Written in Perl."

- Javascript LAN scanner
"Any information obtained using the scanner will not be logged in any way. All new router form submissions are anonymous"

Services & Misc :

- 10 Free Services to Send Self-Destructing/Auto-Expiring Emails
"Self Destructing emails delete the original message once it has been read by the recipient. While they are not completely fool proof, for example, someone can take a photo of the message with the camera, the record on the Internet does not remain. Here are a few self destructing email providers that you might find useful for sending emails. Some even provide free plug-ins for sending emails through a desktop based email client such as Outlook or Thunderbird."

- Video - Using Darik's Boot and Nuke (DBAN) to Totally Wipe a Drive
"Another continuation of my file carving video and selective file shredding (DOD 5220.22-M) to thwart forensics tools video, this video shows how to use Darik's Boot and Nuke (DBAN) to totally wipe a drive. DBAN is a great tool to add to your anti-forensics tool box."

- Videos from the ToorCon Information Security Conference

- CISSP Certification Verification Site
"Check (ISC)? credential status for an individual or find credential holders within a company or geographic area." Continue reading →

More Malware Crypters for Sale

There's an ongoing trend among malware authors to either code malware crypters and packers from scratch and sell then at a later stage, or even more interesting, obtain publicly available crypters source code, modify, add extra featured and new encryption routines and make them available for sale. The rise of DIY malware crypters enables literally everyone to fully obfuscate an already detected piece of malware, so that if no extra security measures but only virus signatures scanning are in place, an infection takes place.

The first crypter has the following options :

- Memory execution/injection within its own process, execute in a default browser's memory, or no execution in memory takes place but dropping

- Custom encryption with min and max encryption layers, RC4, and NTDLL Compression API

The second crypter, a previous version of the first one, has the following options :

- custom resource names

- scramble

- custom encryption layer

Moreover, realizing the ongoing competition among coders or modifyers of malware crypters, services such as already packed dozens of bots often act as a bargain in case of a possible and much more flexible purchase. The third crypter is a perfect example of a source code modification since its lacking any significant and unique features.

The most dangerous threat, however, remains your lack of decent situational awareness.

Continue reading →