-
Using Procmon for finding malware
The scenario is: you know you are infected, because you’ve identified a process associate with a malware, but you can’t figure out how that given process is getting launched. A variation of this is: you kill the process, remove the executable but it reappears after a given amount of time / after reboot / etc.…
-
Social engineering for malware – a bright future
Some time ago I wrote a post in which I pondered the deficiencies of the “executable file” definition and the implications for whitelisting products. The problem is that “data” files can also result in actions being taken (and we don’t even need arbitrary code execution type of vulnerabilities for that). The particular example given the…
-
User input, by any other name
A friend of mine posed me an interesting question: how is it possible that a CMS software, which displayed the IP addresses for comments made anonymously (instead of the username) showed a private IP (like 172.16.63.15)? Before I get to the actual explanation, here are some specific clarifications which should be made: IP addresses are…
-
The state of web security
If you are a busy (wo)man, I save you the time it would take to read this blogpost: it is deplorable. Now to elaborate on it: Yesterday I was putting together some new templates for the webhoneypot project with a focus on PHP shells. Things like r57, c99 and their derivatives. Then I looked at…
-
Gh0stNet
The latest security news (hype?) is the discovery of Gh0stNet. Links: Original papare: Tracking GhostNet: Investigating a Cyber Espionage Network F-Secure blogpost about it The paper from Cambridge: The snooping dragon: social-malware surveillance of the Tibetan movement My take on it? There is no proof that China is behind this. There are alternative explanations (as…
-
Build a botnet – without infecting end-users
The idea is not new: get a lot of users to view a given webpage, to DDoS the webserver / backend (depending where the bottlenecks are). If I recall correctly, some student asked the visitors of his website to continuously refresh the page of his university and got charged for it. As many have remarked…
-
BadwareBuster.org goes live
Via StopBadware.org: BadwareBuster.org removes the beta label and goes live. It is a forum that tries to help people who are struggling with a malware problem, either on their home computer or on their website. What I liked: Full RSS feed to the site (so that it can be mined for malicious URL’s for research…
-
Secure erase
Fun (curious) fact: all recent (newer than 2006) have ATA commands in them specifically for wiping the data off of them. There are at least two advantages to this method: It wipes all sectors (including sectors marked as bad by the internal tables) It is faster You can get the program which initiates such a…
-
WPA2 is still hard
Some time ago I found out that you have to install some not-so-well-documented updates (which are not delivered automatically by Windows Update) to use WPA2 to encrypt the traffic of your wireless network (and it is advised to use WPA2, since all the prior standards have known weaknesses). However I was unpleasantly surprised that support…
-
Walking with objects
Some time ago I’ve read David Wheeler’s blogpost about using the OBJECT tag to embed HTML in your HTML :-). One of the things which peaked my interest was the question: what are the security implications of using this method? Specifically I was interested if the same cross-domain / same-policy rules applied to interaction between…