Video: Hacking a botnet

It's illegal under certain circumstances, but hacking hackers is always an interesting subject.

And what better than to watch someone (else) doing it?

"Hacking Zeus was never so easy," writes Xylitol, a French security researcher who published a video demonstrating an attack on a Zeus botnet command and control (C&C) server.

The video above shows Xylitol using information from his CyberCrime Tracker Zeus-tracking website to access a botnet's control webpage.

Video: Cyber gang member arrested

The suspect, dressed

The arrest of a member of the Carberp cyber gang has been televised on NTV.

The footage shows dark figures abseiling down a multi-storey building before beating their way through a window using a crowbar.

A whimpering suspect is heard and then appears, sitting on the ground in y-front underpants.

As law enforcement officers pack up evidence the suspect is seen in a variety of poses, with facial expressions ranging from sick to bored.

The good computer virus

Is it possible or even advisable to create a good computer virus?

Let's take Wikipedia's current definition of a computer virus is of "a computer program that can replicate itself and spread from one computer to another."

There is no "malicious intent" in that definition, so it sounds like creating an automatic, self-distributing security program could work. Certainly Dr Cyrus Peikari thinks so.

I first heard Dr Peikari's argument in favour of creating good viruses, the presence of which would increase a host's immune system, at the Defcon conference in 2001. He wrote a paper on the subject three years later.

One significant problem with this approach is that once a viral program starts spreading there is no telling how it might affect systems. The creator may not be able to maintain control of the virus either, which means that they could initiate a potentially catastrophic sequence of events.

Let's say that someone wrote a worm that sought out and destroyed a (fictional) malware threat called Hercules. And let's say that this malware exists not only on home PCs but also on some smart TVs, mobile phones, ATMs and prison door control systems.

Our imaginary Hercules-killing worm might spread between all of these systems and attempt to deactivate the threats that it finds. It might work with 100 per cent effectiveness, or not. When it fails, or even when it succeeds, it might have unexpected side-effects.

As our benevolent worm interacts with Windows XP PCs running no anti-virus software, it does exactly as was intended. However, in other cases, where security software is in place, its unexpected presence is noted and blocked. As we all know, anti-virus software is not without its faults so maybe the worm makes some changes to the system before it is stopped.

We now have a damaged Windows XP PC.

The case becomes even more complex when you consider the other platforms in use (Android, Chromium OS, iOS, OS X, Linux etc.). The smart TVs might crash, mobile phones might be unaffected and hopefully any life-support systems or prison doors remain operational. But there is no guarantee.

There is also a legal issue. This worm, no matter how beneficial its intentions, and how effective its execution, is running on systems without authority. This falls foul of many laws, including the UK's Computer Misuse Act.

Some facts worth remembering, when thinking about well-intentioned viruses:

1. One person's good intentions are not necessarily someone else's.
2. The Morris Worm was allegedly written to discover the size of the internet, rather than to cause denial of service (DoS) problems. However, DoS it did.
3. The Code Blue worm, when released in 2001, appeared to be designed to remove a prevalent threat at the time called the Code Red worm. It even patched infected systems to prevent re-infection. However, it reduced system stability (presumably unintentionally) and also launched DoS attacks (presumably intentionally).

In January 2012 Rig Ferguson wrote about a Japanese project to create a defensive virus. This supposed "cyberweapon" appears to have a benign, healing component. Let's hope that it works with the telly.

Video: Microsoft raids hosting company

The first 45 seconds are the most interesting to my mind, mainly because you see the raid, albeit one without much physical resistance.


The rest of the footage is only interesting if the idea of internet crime is news to you.

Apple unable to vet all apps

Charlie Miller sends a remote
command to vibrate his iPhone

A researcher has found a security hole that could allow unauthorised access to Apple iPhones.

The embarrassing part of this news, for Apple, is that someone was able to sneak a potentially malicious application through its code auditing process.

iPhone users rely on Apple to check through all third-party programs for security issues. Once Apple has verified that an app is malware-free, and only then, it is allowed into the iPhone Apps Store.

Charlie Miller, a well-known security researcher, wrote a stock ticker app that contained a nasty surprise. Once installed it was able to download further code. This was software that Apple had not had a chance to check.

In a video demonstration, Miller shows how the Trojan would allow an attacker remote access to an iPhone. He downloads the address book and issues a command to make the unit vibrate from a reverse shell.

Reports suggest that Apple has retaliated by banning Miller from its iOS development program. Apparently he planned to present his findings, including a live exploitation of a phone, at the SysCan conference in Taiwan.

UPDATE (08/11/2011): SecurityWeek reports that the vulnerability is due to iOS not enforcing code signing for the Nitro JIT compiler.

Lottery funds WWII codebreaker base

Bletchley Park, wartime home of the Government Code and Cypher School, has received £4.6m from the Heritage Lottery Fund.

The site, which is not too far from where I live, has been decaying for some time but it receives no external funding. Earlier this year Google provided some cash when it bought some of Alan Turing's papers.

Bletchley Park is also home to The National Museum of Computing.

The gift shop sells all sorts of interesting things, but my favourite is the Engima mug (see above), which is my regular drinking vessel of choice.

Break phone encryption by watching its power consumption

It is possible to obtain secret keys to hardware-aided encryption by monitoring the power consumption of the device. The attack is called Differential Power Analysis (DPA).

A security firm called Cryptography Research has just licensed its anti-DPA technology to an as-yet undisclosed mobile phone manufacturer. The company's website hosts an interesting video that demonstrates the principles behind the type of attack that it claims to protect against. This video does not require you to be a cryptography expert to understand the basic idea.

To go straight to the relevant part visit the link above and then click on the menu item labelled 'Technology' and then 'DPA Process'.

The countermeasures include reducing the signal (so that changes are less obvious); using randomness; and a range of other less-easily understood (by me) methods.

Massive botnet take-down

A botnet comprising nearly 13 million infected PCs has been taken down. Three 'hackers' suspected of running the enterprise have been arrested and each face up to six years in jail. A report by The Associated Press said that, "the 'botnet' of infected computers included PCs inside more than half of the Fortune 1,000 companies and more than 40 major banks," but quote police as claiming that the brains behind the operation were not computer experts.

Instead, they were individuals with contacts to the criminal online underground. "They're not like these people from the Russian mafia or Eastern European mafia who like to have sports cars and good watches and good suits - the most frightening thing is they are normal people who are earning a lot of money with cybercrime," Cesar Lorenza, a captain with Spain's Guardia Civil, said."

More from the report: "The Mariposa botnet, which has been dismantled, was easily one of the world's biggest. It spread to more than 190 countries, according to researchers. It also appears to be far more sophisticated than the botnet that was used to hack into Google Inc. and other companies in the attack that led Google to threaten to pull out of China."

Lifecycle of a hacker, in poetry

Felix Dennis, the owner of Dennis Publishing (the company I work for), has written a poem about hacking and computer viruses. In his book Nursery Rhymes for Modern Times the poem entitled 'Hacker-boy, hacker-boy' tells the tale of a young lad who writes a computer virus to prove that he is better than others assume. As his virus successfully probes and vandalises systems across the globe the programmer smiles with glee but is swiftly jailed once the US government becomes involved.

You can hear Felix himself read the poem* on his website.

These days, of course, the hacker-boy would likely be selling information stolen by his virus on the black market, rather than breaking the law for kicks.

* 14/10/2011 Updated link

Interfering proxies

I've been playing with Fiddler as part of my work testing anti-virus software. This morning I noticed an interesting add-on called Image-Flipper. In short, this turns images upside down before sending them to the client. It reminded me of a Pete Stevens article that I noted earlier.

Max Vision Pleads Guilty

The prime target of an online FBI sting operation has plead guilty to wire fraud.

Max Vision (previously known as Max Butler) was caught following FBI agent J. Keith Mularski's infiltration of a cybercrime ring.

Vision is accused of trafficking 1.8 million credit card numbers and running a clearing house that enabled other cybercriminals to trade with each other illegally.

More details:

• San Francisco man pleads guilty in Pennsylvania to credit card scam
• Max Vision pleads guilty to running cybercrime bazaar

Phone Hacker Jailed for 11 Years

What happens when you make prank calls that send SWAT teams to people's houses? You get sent to jail - for ages.

The Register reports on the downfall of Matthew Weigman (19), who made hoax phone calls to emergency services, resulting in armed teams of police raiding the homes of his victims. He's just been sentences to 11 years in jail.

More details about the case are available on Wired, which covers Weigman's guilty plea and provides a dramatic rundown of events.

A network being disconnected (video)

Last month hosting company McColo was disconnected from the internet. This was because some of its customers were believed to be sending vast amounts of spam. Computer Shopper has covered the story, so go and read that if you want to find out why this was an important step in the battle against spam. However, I want to illustrate what it actually looks like when a network is disconnected from the internet and when it continually tries to reconnect.

The video below was generated by HostExploit.com, using software called BGPlay. BGPlay "is a Java application which displays animated graphs of the routing activity of a certain prefix within a specified time interval." In other words, it creates a visual representation of internet connections. The video below shows McColo struggling to reconnect to the internet during Saturday 15th and Sunday 16th November 2008.

Hacker forum run by FBI

It's the online fraudster's favourite conspiracy theory. A website dedicated to the theft and exchange of stolen information and criminally-oriented software has turned out to be an FBI sting. According to The Register, the recently defunct DarkMarket.ws carder forum has been exposed as having been run by law enforcement officials.

The news first surfaced when Southwest Germany public radio obtained police reports that detailed the operation behind the arrest of a German credit card forger. This was reported on Wired, which claims that the sting was started in November 2006.

The site's operator, who used the alias Master Splyntr, last month wrote, "It is apparent that this forum… is attracting too much attention from a lot of the world services (agents of FBI, SS, and Interpol). I guess it was only time before this would happen. It is very unfortunate that we have come to this situation, because... we have established DM as the premier English speaking forum for conducting business. Such is life. When you are on top, people try to bring you down."

Master Splyntr was, it turns out, FBI agent J. Keith Mularski.

Protect the spammers

A recent wave of spam contains an advert for spamming services. An email signed 'Jodi Parker' offers to provide access to an email list of 630 million addresses. These are "the freshest gathered of email addresses" and come as part of a service that includes a "fully licensed bulk email sender". Unusually, the spammer has included his own email address in the message.

A price list is also included, with one million Algerian addresses costs just $5,999 - a bargain.

Mikko Hypponen from Security company F-Secure reported on the spammer spamming his own spamming services on Friday 19th September 2008. He noted that the spammer's email address was info@bulk-mail.org and that the spammer had written this address in the form: info [at] bulk-mail [dot] org. This is a technique used to avoid attracting spam. I'm sure we can all appreciate the irony.

Mikko acted very responsibly in his posting by requesting that no-one makes copies of the spammer's email address (info@bulk-mail.org) to their blogs and to other parts of the internet. Imagine his disappointment, then, when he discovered that people had ignored his plea and have started copying the address to different websites. It's almost as if they *want* a spammer to receive spam.

Vulnerability scanning and IPS

I had a recent (private) discussion with a leading security expert about the comparative benefits of intrusion protection systems versus, and in combination with, vulnerability scanning. He asked for my opinion and I wrote an essay. Here it is:

HOW TO KEEP EXPLOITS AT BAY

An intrusion prevention system (IPS) detects threats coming into or leaving a system - and blocks them. These threats will consist of code designed to exploit a vulnerable application or some more integral part of the operating system. Vulnerability scanning is a protection measure that searches for programs containing known security holes and either prompts the user to update these programs or helps to update them automatically or semi-automatically.

If a completely effective vulnerability scanner existed, which was able to patch all of the software on a user's system automatically, there would be no need for an IPS because there would be no vulnerable targets for an attack. However, sometimes an application will not have an update available that plugs its security hole(s). Vulnerability scanning on its own is not enough.

If a completely effective IPS existed, there would be no need for vulnerability scanning at all. If every exploit was denied access to the system at the start of an attack then it wouldn't really matter whether or not vulnerable applications existed on the system. The system as a whole would not be vulnerable. Of course, IPSes are not flawless and in practice some exploits will be able to enter the system. Reducing the number of vulnerable applications will reduce the risk of a compromise when the IPS misses an exploit.

The obligatory analogy

You could say that the difference between an IPS and a vulnerability scanner is comparable to the difference between having security guards on the doors of a building and running a regular security audit to locate weak locks, CCTV blind spots and other possible avenues of attack. You'll want the guards in place at all times, but carrying out occasional audits is still sensible - not least because you might one day discover that there is an unguarded door somewhere in the building.

But if you had to choose one or the other, you'd go for the guards every time.

The guards in the above analogy (where they represent an IPS) have to be able to recognise good and bad players accurately. The way a player tries to enter the guarded building may give a clue as to their intentions. A legitimate, authorised entrant will most likely use the front door and not a broken window in the back alley. The player's appearance, security credentials and maybe even the time of day that they choose to attempt entry will all count for or against them in the guard's eyes. An IPS may be able to determine the legitimacy of incoming packets using similar patterns.

Vulnerability scanning is more passive in this regard, but that's not always a bad thing. To further labour the building analogy, vulnerability scanning might result in that alley window being bricked up, blocking attempts to enter regardless of any ID held by the player. There aren't many reasons why the CEO would need to enter the building this way.

When a product scans for vulnerable applications, its actions may help tighten security. This will be true particularly if the user is helped to patch the vulnerable apps, rather than just being informed that problems exist. This would be like the security auditor coming equipped with new locks, CCTV cameras and bricks, rather than just writing a report that could sit unread in the COO's inbox for a month.

Permission to update?

Is there a danger of overloading the user with requests to update? The average customer is inundated with requests to make updates to modern applications and operating systems. Older software often lacks automatic updating features but is at least as likely to harbour vulnerabilities than newer programs. Prompts to update are generally very annoying, though. Both technical and non-technical users become irritated by requests to restart their PCs when they are trying to work or play.

There is a risk that vulnerability scanning, followed by a request for an update (or a request for a restart, following an automatic update), will add to the irritation. This state of affairs is more likely to annoy a user than an IPS alert, particularly if the alert is made silently to a log file. A successful security implementation that combines IPS and vulnerability scanning will have minimum impact on the user in terms of that user's interaction with the system.

A balancing act

As usual, defence in depth has got to be the safest course of action, but it might not be the best. Users' requirements and behaviour is a critical consideration with consumer products and the less they have to interact with security measures, the better. Vulnerability scanning on its own is not sufficient because not every product can be updated and, even when updates are available, not every user will install them. Constant requests to restart the system, due to automatic updates, will result in the vulnerability scanner being uninstalled.

Allowing an IPS to download new definitions automatically, so that it can detect new threats on the wire, has much less impact on the user. Because of this, an IPS stands a greater chance of success than a vulnerability scanner in the consumer space.

Playing with Storm

This video shows an anti-virus researcher playing with a website infected with the Storm worm. Security firm F-Secure published it on YouTube around a year ago, so it's certainly not new. However, it's still an interesting look at how server-side malware can change itself every time someone downloads it. In this case it is changing the padding to avoid detection by anti-virus software.

The researcher uses different web browsers (or at least pretends to) to demonstrate how the site reacts. For example, when the visitor uses Internet Explorer 6.0 (IE6) it serves a page containing exploit code designed to attack this browser. It serves different code when the visitor uses Firefox.

Turn Their World Upside-Down

Someone stealing bandwidth wirelessly from your internet connection? Don't get mad (or encrypted) - get even. This article has been available for some time, but it still amuses me and almost makes me wish someone would crack into my wireless network. Almost.

Pete Stevens documented how he handled his thieving neighbours, proxying their web traffic and making changes to it. Favourite countermeasures include turning images upside down or blurring them automatically. It shouldn't be too hard to run pages through The Dialectizer to produce Cockney, Jive or Swedish Chef versions.

Hacking the hackers

Security researcher Joel Eriksson has given a talk at the 2008 RSA conference, where he discussed counter-attacking hackers.

According to Wired, Eriksson (who works for Swedish security firm Bitsec) suggested that the best defense might be offense. He then described reverse-engineering some malware, the result of which enabled him to attack a computer that was being used to control victim systems. Theoretically the same techniques could be used to infiltrate botnets, the large networks of compromised computers used by attackers to send spam, issue denial of service attacks and perform other crimes.

Aside from the legal implications of attacking a computer, and the moral obstacle of 'two wrongs don't make a right', there is another problem with this approach. How can the counter-attacker be sure that the system he attacks is owned and run by a bad guy?

Attackers are well-known for using zombies, bots, stooges or whatever you want to call them. Can you be sure that you've identified the correct target and that the control system belongs to the attacker himself? And what do you do with a root shell or Administrator command line on a C&C server? If you find you've broken into an 'innocent' zombie/bot, what then - install Norton AntiVirus?