f-secure – Grey Panthers Savannah

Spam from the F-Secure forums

gpanther — Sat, 24 Jan 2009 09:28:00 +0000

It is no secret that I have less than stellar opinion about F-Secure (the short version is: in my opinion they are a reseller of the Kaspersky engine, but usually manage to get lower detection rates in tests and they like to talk about their research, even though all the hard work is done by the guys at Kaspersky, F-Secure being the marketing department lead by Mikko Hypponen), but this is funny: some spammer is using their forum to send messages to the registered users:

Hello Cd-MaN

You received the following message from :  Doudou1  ([email protected])

At:  http://forum.f-secure.com/

From Miss Sussana Boga.
Abidjan. Cote d'Ivoire
Email :( [email protected])
Hello dear,
With profound respect and humble submission, and I beg to state the following few lines for your kind consideration, I hope you will spare some of your valuable minutes to read the following appeal with sympathetic mind. I must confess that it is with great hopes, joy and enthusiasm that I write you this mail which I know and believe by the faith that it must surely find you in good condition of health. My name is Miss Sussana Boga, I am the only Daughter of my late parents Mr. and Mrs Boga Doudou My father was a highly reputable business magnet who operated in the capital of Ivory Coast during his days.
It is sad to say that he passed away mysteriously in France during one of his business trips abroad on the 20th May 2007. Though his sudden death was linked or rather suspected to have been masterminded by an uncle of mine who travelled with him at that time, but who knows the truth! My mother died when I was just 6yrs old, and since then my father took me so special.
Before the death of my father on May 2007, he called me and informed me that he has the sum of Nine Million, Five Hundred thousand United State Dollars.(USD$9,500,000.00) he deposited in a fix bond account in a private Bank here in Abidjan Cote D'Ivoire.. He told me that he deposited the money in my name, and also gave me all the necessary legal documents regarding to this deposit with the Bank
I am just 21 years old and a university undergraduate and really don't know what to do. Now I want an honest partner overseas who I can transfer this money with his assistance and after the transaction I will come and reside permanently in your country till such a time that it will be convenient for me to return back home if I so desire. This is because I have suffered a lot of set backs as a result of incessant political crisis here in Ivory coast. The death of my father actually brought sorrow to my life. I also want to invest the fund under your care because I am ignorant of business world.
I am in a sincere desire of your humble assistance in this regards. Your suggestions and ideas will be highly regarded. Now permit me to ask these few questions:
1. Can you honestly help me from your heart?
2. Can I completely trust you?
3. What percentage of the total amount in question will be good for you after the fund has being transferred to your account and I come over to meet you?

Please, consider this and get back to me as soon as possible in my private Email:
([email protected]). Immediately I confirm your willingness, I will send to you my Picture and also inform you more details involved in this matter.
Regards
Miss Sussana Boga.

How permissive is the Windows autorun.inf parsing?

gpanther — Fri, 09 Jan 2009 13:19:00 +0000

While reading the F-Secure blogpost titled When is AUTORUN.INF really an AUTORUN.INF?, I was reminded of this masking technique – putting extra data between the relevant lines.

But how tolerant is the autorun.inf parser (which I suppose in fact is the INI file parser) really? The example showed by F-Secure is quite mild, in the sense that each line is preceeded by “;” to clearly mark it as a comment. We can up the ante by just putting arbitrary garbage, without the “;” marker:


for (1..255) { print chr(rand(256)); }
print "n[autorun]n";
for (1..255) { print chr(rand(256)); }
print "nopen=C:\WINDOWS\NOTEPAD.EXEn";
for (1..255) { print chr(rand(256)); }

This works! I didn’t how large the binary blocks can be, but I imagine that you can go 32k-64k easily. Now to put an extra twist in there:


print "xFFxFE";
for (1..255) { print chr(rand(256)); }
print "n[autorun]n";
for (1..255) { print chr(rand(256)); }
print "nopen=C:\WINDOWS\NOTEPAD.EXEn";
for (1..255) { print chr(rand(256)); }

That FF FE is the Byte order mark(er) and tells text editors which recognize it that the file is UTF-16 little endian encoded, which of course it isn’t. The end result? You will see only garbage in Notepad (as it tries to “decode” the file) and also in my favorite file management app. And yet, it still works!

Have fun, stay safe and make sure that to disable your autorun.

Update: the commenter had a good idea. In response: strings extracts the strings correctly (I tried it under Linux, but I assume that the Windows version would behave the same). However, for example gedit can’t open it.

Living off of the hype

gpanther — Tue, 24 Jul 2007 05:44:00 +0000

Disclaimer: I work for a competitor, however this is my personal opinion and does not necessarily represent the views of any of my past or future employers.

So tell me, what does F-Secure exactly contribute to the malware fighting effort? Sure, they have a blog and a chief researcher who has an opinion about everything (including many things he hasn’t though trough very well – like the .bank top level domain or SMS authentication), but they are only a front for Kaspersky Labs. (To be fair, they mention it in one of their blog posts). They are 99.99% Kaspersky, so why do they need researchers in two locations? Stop the marketing guys and do something useful.

Again, in the spirit of fairness, I know that this blog contributed to raising the awareness about the malware issue, however I feel that they don’t give enough credit to the main force behind them (BTW, I’m not in any way affiliated with Kaspersky Labs).