Since this morning, as I am home sick, I have decided to give Strain 2 from my previous post a try.
I installed a Windows 2008 Standard in a virtual environment to run the malware.
It started by doing a DNS request for "kemolderin.com" (resolution 66.199.231.30 on 02/07/2012 at 2:09 EST). It then connected to that IP on port TCP/80 and did a "POST /wap/udp.php" with a very long string of data.
The answer from the server was "HTTP/1.1 302 Found" , with a few extra data (c0 83 a4 1c 1d 5f 72 ab).
The fun thing is I tried to browse to the same page, but I was greeted with a "Suspended Domain".
At this time, that's it folks. I will monitor the machine next time I reboot it, and I will try with a windows XP as soon as I have one.
Tuesday, February 7, 2012
Fedex, DHL, Deutschen Post and you've got ... a virus
Among the many things I truly love about my Google Mail is its ability to detect viruses in what people try to send me. But first things first.
I used to operate my own mail server for nearly a decade. Along the road came the installation of an antis-spam daemon (spamassassin team: you rock!), an attempt at installing an anti-virus/anti-malware using ClamAV, and various other tweaks and tunes to make it (a) work correctly and (b) avoid something that approaches 90% of undesirable content.
Also, as I am more and more often traveling, I installed a webmail application on my server, so I could process my mail without having to establish a POPS/IMAPS connection to my server. This came with the loss of a few features, but all in all, it was working OK.
Then one day, I tried Google Mail. The interface is sleek and easy to use, I have all my features back and things. And Google gets my e-mail on my "own" address.
So recently, I have started getting more and more "Message left on server: ...." as it contains a potential virus or suspicious attachment. And more and more, I have been intrigued about these.
They all purport to come from DHL, FedEx or Deutschen Post. They all have a ZIP attachment, and they all enjoin you to take an immediate action: execute the piece in the attachment. The title are visibly generated at random for the last part, all the zip have an executable. The latter has a title that is non random: in all the recent zip files I received, the exec file name is "Deutschen_Post_oder_DHL-ID.exe".
In these, I have identified two different strains.
The first one has a MD5 hash value of "3162d052c388c5310a5f1a9f429c670c" and a size of 135168 bytes. As of 02/07/2012 10:58am EST, only 14 scanners out of 42 detect the executable file as malware (Report on VirusTotal.com), less than 40%.
The second strain has a MD5 hash value of "c497c6d0b69cb2e03236af82cc651193" and a size of 114688 bytes. As of 02/07/2012 11:05am EST, only 10 scanners out of 43 detect the executable file as malware (Report on VirusTotal.com), less than 30%.
As (a) the names are consistent except for a random part in the zip file, (b) the archive content is exactly the same within a strain and (c) that I got these from various IPs, I lean toward an automated type of distribution, possibly a worm or a bot type.
I still need to do some homework and play with these to see whether they point to the same "owner".
I used to operate my own mail server for nearly a decade. Along the road came the installation of an antis-spam daemon (spamassassin team: you rock!), an attempt at installing an anti-virus/anti-malware using ClamAV, and various other tweaks and tunes to make it (a) work correctly and (b) avoid something that approaches 90% of undesirable content.
Also, as I am more and more often traveling, I installed a webmail application on my server, so I could process my mail without having to establish a POPS/IMAPS connection to my server. This came with the loss of a few features, but all in all, it was working OK.
Then one day, I tried Google Mail. The interface is sleek and easy to use, I have all my features back and things. And Google gets my e-mail on my "own" address.
So recently, I have started getting more and more "Message left on server: ...." as it contains a potential virus or suspicious attachment. And more and more, I have been intrigued about these.
They all purport to come from DHL, FedEx or Deutschen Post. They all have a ZIP attachment, and they all enjoin you to take an immediate action: execute the piece in the attachment. The title are visibly generated at random for the last part, all the zip have an executable. The latter has a title that is non random: in all the recent zip files I received, the exec file name is "Deutschen_Post_oder_DHL-ID.exe".
In these, I have identified two different strains.
The first one has a MD5 hash value of "3162d052c388c5310a5f1a9f429c670c" and a size of 135168 bytes. As of 02/07/2012 10:58am EST, only 14 scanners out of 42 detect the executable file as malware (Report on VirusTotal.com), less than 40%.
The second strain has a MD5 hash value of "c497c6d0b69cb2e03236af82cc651193" and a size of 114688 bytes. As of 02/07/2012 11:05am EST, only 10 scanners out of 43 detect the executable file as malware (Report on VirusTotal.com), less than 30%.
As (a) the names are consistent except for a random part in the zip file, (b) the archive content is exactly the same within a strain and (c) that I got these from various IPs, I lean toward an automated type of distribution, possibly a worm or a bot type.
I still need to do some homework and play with these to see whether they point to the same "owner".
Saturday, February 4, 2012
Upgrade of an Ironport proxy
From time to time, you may experience failure when upgrading a Cisco Ironport from one version to another. In my case, I had been struggling for days to go from 7.1.0 to 7.1.1.
At the CLI, the upgrade command would fail after a certain random time, claiming a network connectivity issue. I also have a message popping-up:
High Latency: (109.905s) for <coro #1 name='<function coro_reader at 0x296995a4>' dead=0 started=1 scheduled=0 at 0x294b7a44>
The solution - in my case - was to disable WCCPv2 on the box and revert to "L4/no device". The upgrade went through like a charm.
Wednesday, January 25, 2012
Video conferencing and meeting room snooping
There is a very good article in the NYTimes concerning the use of video conferencing devices as means to snoop in a meeting room. The issue is not new and dates back in the age of PABX and analog phones.
However, the ease with which HD Moore was able to enter a number of corporations is concerning.
Also, I distinctly remember a consultant from a vendor that makes both video conference equipment and firewalls tell us to "disable the protocol inspection for SIP and think of having the server directly on the Internet, as it would be easier than opening all the required ports".
Coming from a consultant who is supposed to know his subject: scary ...
However, the ease with which HD Moore was able to enter a number of corporations is concerning.
Also, I distinctly remember a consultant from a vendor that makes both video conference equipment and firewalls tell us to "disable the protocol inspection for SIP and think of having the server directly on the Internet, as it would be easier than opening all the required ports".
Coming from a consultant who is supposed to know his subject: scary ...
Thursday, January 12, 2012
Read My E-mail? Get a Warrant
This is another example of a not-so-well-thought action. True, this may help the police to catch the bad guys and in certain cases to save lives. But ...
What about the possible abuses? If I were the spouse or kid of a police official, I would really be concerned about the possibility that the machine might be bugged. And what if a policeman helps a friend's business? After all, if there is no warrant, that trojan could be installed on the competitors's computers and report possible contracts or opportunities ...
Also, what happens if the police computers are hacked into? This would be a free-for-all of bank information, PII and that sort of things, centralized in a single location. And yes, what about the police responsibility in this case? Would the government refund the potential losses for the citizens?
There is a need there for the governments to think these through, and instead of finding technical means to circumvent the consequences - and the legal means of justifying these work-arounds - address the real causes of all those issues.
Last October the well-known hacking group Chaos Computer Club revealed that the German state police had been monitoring the computers of ordinary citizens using specially designed surveillance software. This spyware could peek into users’ files, record keystrokes, take screenshots of Web pages users happened to be visiting, and even commandeer Web cams and microphones, giving the cops an open window into the home. The revelations invited comparisons to the Stasi, the infamous police force that operated in the former East Germany.
[More]Wednesday, January 11, 2012
Police system compromised due to parental spying
A bizarre chain of events unrolls to "Police system compromised due to parental spying".
The police officer should have known better than (a) install a trojan on her daughter's computer and (b) use his personal computer for his official activities.
Tuesday, January 10, 2012
Mac OS X, VLANs and MAC addresses
Recently, I had to investigate an issue of machines not able to connect to a network. The machines would send frames - or supposedly do so - but received nothing.
One of the machines was actually working. But moving the connection to a different machine was not, so I suspected some form of association between the port and the mac address.
To prove it, I decided to change the MAC address of my Mac Book Pro and copy the MAC address of the working machine.
At the shell:
All these commands need to be executed as root.
One of the machines was actually working. But moving the connection to a different machine was not, so I suspected some form of association between the port and the mac address.
To prove it, I decided to change the MAC address of my Mac Book Pro and copy the MAC address of the working machine.
At the shell:
sudo ifconfig en0 link aa:bb:cc:dd:ee:ffContinuing with the layer 2, Mac OS X allows one to create virtual VLAN subinterfaces.
- Create the interface
ifconfig vlan<nn> create
- Associate the interface with the vlan tag and physical interface
ifconfig vlan<nn> vlan 2 vlandev en0
- Add an IP address to the interface
ifconfig vlan<nn> inet <IP> netmask <MASK>
- Bring the interface up
ifconfig vlan<nn> up
All these commands need to be executed as root.
Subscribe to:
Posts (Atom)