IE7 update is now Paris Hilton video

The fake IE7 who actively circulated a couple of weeks ago is back. This time, it disguises as video of no other than the favorite celebrity by malware authors - Paris Hilton.

hexdump codes for python

http://hex-dump.blogspot.com/2006/02/hex-dump-tools-written-in-python.html

Sandbox & Virtualization & Lockdown Technologies

http://www.offensivecomputing.net/?q=node/569

good read

http://bitblaze.cs.berkeley.edu/

Traditional sig-based AV is dead

Maybe not (yet)..but its worth to mention that some AVs are starting to give up the traditional way of virus scanning and moving towards "cloud-based" threat scanning:

First, TMI's Smart Protection:
- http://trendmicro.mediaroom.com/index.php?s=43&item=642

Then, Panda has the so called Collective Intelligence approach:
- http://research.pandasecurity.com/blogs/images/wp_pb_collective_intelligence.pdf

And just recently, even academic sector also believes to the "in-the-cloud" strategy:
- http://blogs.zdnet.com/emergingtech/?p=1008

I wont be surprised if other vendors would follow the steps :-)

Latest IE7 version is nothing but a malware

The message body runs as below:

-----------------------------------------------------------------------------------------------
Download the latest version Internet Explorer 7.0! About this mailing:
You are receiving this e-mail because you subscribed to MSN Featured Offers. Microsoft respects your privacy. If you do not wish to receive this MSN Featured Offers e-mail, please click the "Unsubscribe" link below. This will not unsubscribe you from e-mail communications from third-party advertisers that may appear in MSN Feature Offers. This shall not constitute an offer by MSN. MSN shall not be responsible or liable for the advertisers' content nor any of the goods or service advertised. Prices and item availability subject to change without notice.

�2008 Microsoft | Unsubscribe | More Newsletters | Privacy

Microsoft Corporation, One Microsoft Way, Redmond, WA 98052
-----------------------------------------------------------------------------------------------


Warning: Dont click the link above; it will download a malware, that even AV vendors are confused how they gonna name it :) See: http://www.virustotal.com/analisis/18b97fb3bc30251051a8542a90401b6f

AV's have good coverage though for this piece of malware :-)

Christina Aguilera Interesting video

Video of Christina Aguilera is currently being spammed by some malware.
Dont temp to download if you dont like to be infected :-)

The mail looks like below:


When you click the link, it will go to a website that will download the file videoXXX67h8.exe (72,704 bytes). Virustotal shows several AV vendors detecting it as malicious: http://www.virustotal.com/analisis/fa5924ec4f51bc1c16a83b280756b3da

You can ofcourse check the header to manually search and download the malware from the link in the screenshot:

Canadian Pharmacy scam has resurfaced, and shifted its spam strategy. The Canadian Pharmacy had been very active in the past. Its new strategy, though not new in spam world, is to compose emails with long message body, then inserts a hyperlink somewhere in any part of the email content. I've observed some spam emails from this botnet-operated pharmacy that slips from the spam filtering software, but it wont take that lonf for sure.

Figure 1 is an example of the spam mail. The message may look legit, but when you read it's content, its nothing but random words or phrases.The link to the canadian pharmacy wbsite is inserted as a small hyperlink, and when you view the included image, Figure 2 will be revealed. Familiar?

Figure 1. Canadian Pharmacy Spam mail

Figure 2. Loaded image

If you're still in doubt, try to click the image area which will redirect you to the actual canadian pharmacy website (See Figure 3)

Figure 3. Canadian Pharmacy website

OpenPacket.org

This looks pretty helpful when you deal with network/packet research:
Check: https://www.openpacket.org/

Angelina is in your (Spam) mailbox!

While most of us simply ignoring the spam mailbox, sometimes its a good idea to check them once in a while. But be ready as viruses mostly are lurking in your spammed mails.
So always wear some protection - use sandboxie while browser. It's not 100% malware proof but most of the time its enough layer of protection against web based exploits and malware.

I will be using my gmail account for demonstration.

1. Browse the Spam folder and slect anything cathces your interest.
2. Spams range from medicines, watches, and of course porn.

3. Hmmm..look at that subject above (highlighted in red):
"Angelina Jolie naked - WATCH". Isnt it interesting??

4. Google is so security conscious. By default, the objects that may contain malicious code, eg. graphics files, are not displayed by default. OK lets open it! Woaah!
5. As you can see, there is a watch link thats waiting for you to click if you wanna see more of Angelina!

6. But be cautious! This is the most common strategy of malware author spamming their malicious programs (or virus) to unsoliciting recipients.

Tip. You can check the SMTP header and the html code to see any malicious objects, like links to executable files or other javascripts. You can do it by clicking the small rectangular button in the picture below:

Clicking the "Show original" will show you the SMTP header and the HTML inside the mail as similar below:

7. Gotcha! You next step now is to manually download the exe file and send it to AV vendors if you can't analyze it by yourself. Or send it to online sandboxing services like Anubis (my favorite), Norman, CWsandbox, and free virus scanning Virustotal or virusscan.

Tamarin

http://hecker.org/mozilla/adobe-mozilla-and-tamarin

Security tools/RCE tools

Thanks to people for maintaining the ff links. Very helpful in our field.

Security Tools:
http://securitytools.wikidot.com/

RCE Tools:
http://www.woodmann.com/collaborative/tools/index.php/Category:RCE_Tools

Google hacking could lead to Zlob infection!

Link:http://www.fortiguardcenter.com/analysis/googlehackzlob.html

Hello World v0.2!

Its time to facelift this blogsite and be more active =P
This was my previous personal online notepad, but thanks to Google for its online notepad so I wont need this anymore. Instead, I will convert this into MALWARE, SECURITY and REVERSE ENGINEERING blogsite!!!
Stay tuned! lolz!!

How to detect version of MS Visual Studio or compiler in compilation time?

To do this you should use _MSC_VER define like in this code:
#if _MSC_VER >= 1400 // this is Visual C++ 2005
#elif _MSC_VER >= 1310 // this is Visual C++ .NET 2003
#elif _MSC_VER > 1300 // this is Visual C++ .NET 2002

KDE4 Problem ?

I experienced a problem with Kubuntu.

I couldn't login to the X window, and even manually starting the X window after logging in via console, sometimes doesn't work. Well, (un)fortunately, I'm not the only one experiencing this problem. Thanks to this link and it solves my problem: http://ubuntuforums.org/showthread.php?p=4320584

So if you think we have the same problem, open the file 'xsession-errors' at your home directory with any text editor (vi/vim/etc) or commands like tail,less,etc:

~$ tail -20 ~/.xsession-errors

And look at the end of the file for something similar below:
:
kdecore (KLocale): WARNING: Definition of PluralForm is none of NoPlural/TwoForms/French/OneTwoRest/Russian/Polish/ Slovenian/Lithuanian/Czech/Slovak/Arabic/Balcan/Ma cedonian/Gaeilge/Maltese: Definition of PluralForm - to be set by the translator of kdelibs.po
:

This is a language pack problem. So removing the following will fix the problem (atleast for me).

~$ sudo aptitude remove language-pack-kde-en
~$ sudo aptitude remove language-pack-kde-en-base

PHP/Obfu.A

http://pastebin.com/fbccb9f2
http://www.ecks90.com/?id=42

Obfuscated python

http://www.p-nand-q.com/python/obfuscated_python.html

portbunny is out!

another port scanner, written in C, wrapped in python
check this out! http://www.recurity-labs.com/portbunny/portbunny.html

ClamAV setup

Download location (HTTP):

http://www.clamav.net/

Installation of Clamav

First is to add a dedicated group and user for the clamav daemons and
environment.

groupadd -g 40 clamav
useradd -c "CLAMAV Owner" -m -d /var/lib/clamav -g clamav -u 40 -s
/bin/bash clamav

Notes
. all the others daemons (clamsmtpd and freshclam) and scripts will be
running under the same account: clamav.
This account needs a valid shell and home directory for executing a
shell-script when a virus is found.
. the number 40 for the groupidnr and useridnr is arbitraty. You can
choose one suitable for you.

With the new account create an environment:

cd /var/lib/clamav
mkdir {bin,db,log,run,template,tmp}
chown -R clamav:clamav /var/lib/clamav
chmod 700 /var/lib/clamav

Configuring, compiling and installing the software. Note I use a one
directory: /var/lib/clamav.

./configure --prefix=/usr \
--sysconfdir=/etc \
--localstatdir=/var \
--libexecdir=/usr/sbin \
--disable-clamuko \
--with-user=clamav \
--with-group=clamav \
--with-dbdir=/var/lib/clamav/db
make
make install

Clamd, clamscan, clamdscan and freshclam are all part of this package.
I only use clamd and freshclam.
The daemons clamd and freshclam are installed in /usr/sbin, and the
configurationfiles clamav.conf and freshclam.conf are in /etc.
A database with signatures of virusses is installed in
/var/lib/clamav/db, which is an old version. It will be updated as soon
as the freshclam daemon is running.

Configuration of Clamav

The configurationfile of the clamd-daemon is /etc/clamd.conf. The
settings I use are:
(only the most important are shown)

# Example
LogFile /var/lib/clamav/log/clamd.log
#LogFileUnlock
LogTime
LogSyslog
#PidFile

TemporaryDirectory /var/lib/clamav/tmp
DatabaseDirectory /var/lib/clamav/db
LocalSocket /var/lib/clamav/run/clamd.sock
FixStaleSocket
#TCPSocket

User Clamav

ScanPE
ScanOLE2
ScanMail
ScanHTML
#ScanArchive
ScanRAR