Month: May 2010

At the tail end of last year, Botnets controlled by Twitter accounts started to make the news. They’ve kind of faded from view a little since then, but one enterprising coder is hoping they’ll make a comeback with a tool designed to make botting simple for script kiddies the world over.

This is the builder we’ll be looking at today:

Firing the program up gives the most basic of interfaces – all you can do is enter a Twitter Username and hit the “Build” button:

Once done, an executable file is created that will keep an eye on the named Twitter account for a series of commands used to infect, download, attack with DDoS and even kill the connection between Bot and Command channel. This is the file that’s created:

Of course, the attacker will change the name and the icon before attempting to send it to a victim. Should an end-user infect themselves, the attacker simply posts one of the following commands to their Twitter feed and the Bot will happily oblige:

.VISIT*link.com* (The attacker can add a 0 at the end to repeatedly open a weblink in an “invisible” manner, or a 1 if they want to pop open a website for giggles on the infected PC. Above, you can see a Twitter account telling all bots to open up Google.com in a visible web browser).

.DDOS*IP*PORT (This is a UDP attack).

.SAY* (This one takes advantage of the text to speech feature on a Windows machine, babbling a phrase of choice at the confused victim).

.DOWNLOAD*link.com/file.exe* (The attacker can add a 0 at the end to download, or a 1 if they want to download and execute a file).

.STOP (This will tell the Bots to cease their activities, regardless of whether that’s a DDoS attack or a world record attempt for the amount of times they can open up a Rickroll).

.REMOVEALL (This cuts the connection between bot and Twitter account).

Here’s a screenshot of Youtube popped open on an infected PC courtesy of a .VISIT command – note the shot of the Wireshark traffic indicating the bot / Twitter connection just before the browser opens:

All in all, a very slick tool and no doubt script kiddies everywhere are salivating over the prospect of hitting a website with a DDoS from their mobile phones. However, something to keep in mind: anyone using this as an attack method is horribly exposed.

For one thing, this doesn’t work if the person controlling the bots attempts to hide their commands with a private Twitter page; the bots will just flail aimlessly as they wonder where their master has gone. There are two side effects of “being public” as a result:

1) In theory it should be easy for Twitter to track / filter / block anyone issuing these commands – and security researchers on Twitter who go hunting for these things will probably ensure offending accounts are reported and banned.

2) It only takes a quick Twitter Search to reveal who is using this Bot method at the moment:

Even better, things get extremely complicated if you’re apparently posting Bot commands from a Twitter feed that contains your full name, your geographic location and a link to your homepage that gives up your home address & phone number from a Whois search.

Whoops.

We’ve notified Twitter about this bot creation system, and they’re looking into it. I’d also like to point out that they took exactly thirteen minutes to respond to my email, which is rather impressive by any standards.

We detect the infection file as Hacktool.win32.Twebot.A.

Christopher Boyd

Diaspora

Four students at the NYU Courant Institute have raised more than enough money to spend the summer writing the code for a “privacy aware, personally controlled, do-it-all distributed open source social network” that they are calling “Diaspora.”

As of mid-afternoon today their web site said they’d raised $33,179 from 1027 backers. They had been seeking $10,000 to support themselves over the summer while they finished the project.

Their web site describes the project: “Enter your Diaspora ‘seed,’ a personal web server that stores all of your information and shares it with your friends. Diaspora knows how to securely share (using GPG) your pictures, videos, and more. When you have a Diaspora seed of your own, you own your social graph, you have access to your information however you want, whenever you want, and you have full control of your online identity. Once we have built a solid foundation, we will make Diaspora easy to extend to facilitate any type of communication, and the possibilities will be endless.”

Diaspora site here.

There’s a word I love: “Quixotic.” It was derived from great novel “The Ingenious Hidalgo Don Quixote of La Mancha.” I think it applies here. It’s great.

Tom Kelchner

Diaspora

Four students at the NYU Courant Institute have raised more than enough money to spend the summer writing the code for a “privacy aware, personally controlled, do-it-all distributed open source social network” that they are calling “Diaspora.”

As of mid-afternoon today their web site said they’d raised $33,179 from 1027 backers. They had been seeking $10,000 to support themselves over the summer while they finished the project.

Their web site describes the project: “Enter your Diaspora ‘seed,’ a personal web server that stores all of your information and shares it with your friends. Diaspora knows how to securely share (using GPG) your pictures, videos, and more. When you have a Diaspora seed of your own, you own your social graph, you have access to your information however you want, whenever you want, and you have full control of your online identity. Once we have built a solid foundation, we will make Diaspora easy to extend to facilitate any type of communication, and the possibilities will be endless.”

Diaspora site here.

There’s a word I love: “Quixotic.” It was derived from great novel “The Ingenious Hidalgo Don Quixote of La Mancha.” I think it applies here. It’s great.

Tom Kelchner

The head of the FBI’s cyber crime section said that the bureau in planning to prosecute money mules – people who send funds stolen by online banking fraud to criminal organizations outside the U.S.

Patrick Carney, the acting chief of the FBI Cyber Crime section made the announcement at a Federal Deposit Insurance Corporation symposium in Arlington, Va., according to the Wall Street Journal and security blogger Brian Krebs, who writes the Krebs On Security blog.

Krebs piece here: “FBI Promises Action Against Money Mules”

WSJ piece here: “FBI Targets Cyber ‘Mules'”

Money mules are usually recruited through on-line employment sites and work-at-home schemes. It is believed that most know they are participating in illegal actions, although some are dupes.

The mules are an essential link in bank fraud schemes. They receive fund transfers from hacked accounts and transfer the money to organized crime groups that often operate in Eastern Europe, Ukraine and Russia.

Last fall, the FBI said such bank fraud was responsible for $40 million in losses just to small to mid-sized companies in the last six years. They said of the 205 cases they had investigated, the thieves had attempted to steal $85 million but security measures stopped the transfer of all but the $40 million. The thefts boomed in 2009.

In the UK, losses for all categories of enterprises totaled £59.7 million ($103 million USD) in 2009, according to the UK Cards Association.

Tom Kelchner

The head of the FBI’s cyber crime section said that the bureau in planning to prosecute money mules – people who send funds stolen by online banking fraud to criminal organizations outside the U.S.

Patrick Carney, the acting chief of the FBI Cyber Crime section made the announcement at a Federal Deposit Insurance Corporation symposium in Arlington, Va., according to the Wall Street Journal and security blogger Brian Krebs, who writes the Krebs On Security blog.

Krebs piece here: “FBI Promises Action Against Money Mules”

WSJ piece here: “FBI Targets Cyber ‘Mules'”

Money mules are usually recruited through on-line employment sites and work-at-home schemes. It is believed that most know they are participating in illegal actions, although some are dupes.

The mules are an essential link in bank fraud schemes. They receive fund transfers from hacked accounts and transfer the money to organized crime groups that often operate in Eastern Europe, Ukraine and Russia.

Last fall, the FBI said such bank fraud was responsible for $40 million in losses just to small to mid-sized companies in the last six years. They said of the 205 cases they had investigated, the thieves had attempted to steal $85 million but security measures stopped the transfer of all but the $40 million. The thefts boomed in 2009.

In the UK, losses for all categories of enterprises totaled £59.7 million ($103 million USD) in 2009, according to the UK Cards Association.

Tom Kelchner

As much as five percent of the world’s supply of electronic parts could be counterfeit, putting data at risk and causing machine failures, according to an investigation by Engineering & Technology magazine and reported by TheInquirer.net

“Not only are they spreading like viruses, but many of the dodgy parts even include viruses themselves. In fact trading standards experts spoken with by E&T warned that viruses or malware have been found in all kinds of gadgets, from simple gizmos like digital photo frames to USB keys,” they said.

The counterfeit parts come from the “grey market,” components which were not approved by the original manufacturer, or through the “green market,” refurbished and second-hand goods. The parts often pass as new in Internet brokerages, E&T said.

The Inquirer story here: “Counterfeit electronics trade is killing the industry”

Tom Kelchner

As much as five percent of the world’s supply of electronic parts could be counterfeit, putting data at risk and causing machine failures, according to an investigation by Engineering & Technology magazine and reported by TheInquirer.net

“Not only are they spreading like viruses, but many of the dodgy parts even include viruses themselves. In fact trading standards experts spoken with by E&T warned that viruses or malware have been found in all kinds of gadgets, from simple gizmos like digital photo frames to USB keys,” they said.

The counterfeit parts come from the “grey market,” components which were not approved by the original manufacturer, or through the “green market,” refurbished and second-hand goods. The parts often pass as new in Internet brokerages, E&T said.

The Inquirer story here: “Counterfeit electronics trade is killing the industry”

Tom Kelchner

Adobe has released two updates this month:

APSB10-12 (Security update available for Shockwave Player)

Rated: Critical

“Vulnerabilities have been identified in Adobe Shockwave Player 11.5.6.606 and earlier versions on the Windows and Macintosh operating systems. The vulnerabilities could allow an attacker, who successfully exploits these vulnerabilities, to run malicious code on the affected system. Adobe recommends users of Adobe Shockwave Player 11.5.6.606 and earlier versions update to Adobe Shockwave Player 11.5.7.609…”

APSB10-11 (Security update: Hotfixes available for ColdFusion)

Rated: Important

“Vulnerabilities have been identified in ColdFusion 8.0, 8.0.1, 9.0 and earlier versions for Windows, Macintosh and UNIX. The vulnerabilities could lead to cross-site scripting and information disclosure. Adobe has provided a solution to the reported vulnerabilities. It is recommended that users update their product installation…”

Bulletins and links to patches here: http://www.adobe.com/support/security/

Tom Kelchner

Adobe has released two updates this month:

APSB10-12 (Security update available for Shockwave Player)

Rated: Critical

“Vulnerabilities have been identified in Adobe Shockwave Player 11.5.6.606 and earlier versions on the Windows and Macintosh operating systems. The vulnerabilities could allow an attacker, who successfully exploits these vulnerabilities, to run malicious code on the affected system. Adobe recommends users of Adobe Shockwave Player 11.5.6.606 and earlier versions update to Adobe Shockwave Player 11.5.7.609…”

APSB10-11 (Security update: Hotfixes available for ColdFusion)

Rated: Important

“Vulnerabilities have been identified in ColdFusion 8.0, 8.0.1, 9.0 and earlier versions for Windows, Macintosh and UNIX. The vulnerabilities could lead to cross-site scripting and information disclosure. Adobe has provided a solution to the reported vulnerabilities. It is recommended that users update their product installation…”

Bulletins and links to patches here: http://www.adobe.com/support/security/

Tom Kelchner

Two bulletins, both considered critical:

MS10-30:Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542)

MS10-31: Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213)

Info here: http://www.microsoft.com/technet/security/bulletin/ms10-may.mspx

Tom Kelchner

Two bulletins, both considered critical:

MS10-30:Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542)

MS10-31: Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213)

Info here: http://www.microsoft.com/technet/security/bulletin/ms10-may.mspx

Tom Kelchner

A variety of sources are reporting that blog hosting sites with WordPress-created sites and php-based management systems such as Zen Care eCommerce are being infected with malicious scripts.

Websites hosted by ISP DreamHost, GoDaddy, Bluehost and Media Temple have been found with the malcode, according to H-Online.com.

The malicious scripts download malcode and block Google’s Safe Browsing API from alerting users.

Story here: “Large-scale attack on WordPress”

The Sucuri Security blog has offered clean-up instructions for those with infected pages here.

Tom Kelchner

A variety of sources are reporting that blog hosting sites with WordPress-created sites and php-based management systems such as Zen Care eCommerce are being infected with malicious scripts.

Websites hosted by ISP DreamHost, GoDaddy, Bluehost and Media Temple have been found with the malcode, according to H-Online.com.

The malicious scripts download malcode and block Google’s Safe Browsing API from alerting users.

Story here: “Large-scale attack on WordPress”

The Sucuri Security blog has offered clean-up instructions for those with infected pages here.

Tom Kelchner

Twitter, which along with the rest of the social media world continues to add strange constructs to the English language, has fixed a bug (feature?) that allowed a Twitter user to force another user to follow him. The command “accept@their_name_here,” was discovered and publicized by a number of blogs, according to CNET.com.

The command only worked in the Twitter interface and not in third-party software.

Story here: “Twitter confirms awkward ‘auto-follow’ bug”

Twitter noted on its Status blog that the feature was eliminated and any changes from it in users’ accounts were rolled back They said that if Twitter users find themselves following someone they don’t choose to follow they can block them with Twitter’s “unfollow” tools.

Blog here: “Follow bug discovered, remedied”

Tom Kelchner

Twitter, which along with the rest of the social media world continues to add strange constructs to the English language, has fixed a bug (feature?) that allowed a Twitter user to force another user to follow him. The command “accept@their_name_here,” was discovered and publicized by a number of blogs, according to CNET.com.

The command only worked in the Twitter interface and not in third-party software.

Story here: “Twitter confirms awkward ‘auto-follow’ bug”

Twitter noted on its Status blog that the feature was eliminated and any changes from it in users’ accounts were rolled back They said that if Twitter users find themselves following someone they don’t choose to follow they can block them with Twitter’s “unfollow” tools.

Blog here: “Follow bug discovered, remedied”

Tom Kelchner

Researchers at matousec.com have reported a bait-and-switch vulnerability in the 30 leading anti-malware products on the market today including VIPRE. The vulnerability exploits Windows driver hooks in anti-virus programs, sending them a piece of non-malicious code to bypass security checks then exchanging it for malicious executables.

Although their report has resulted in screaming headlines worldwide, researchers have pointed out that the vulnerability has existed for years without anyone exploiting it. Also, to be successful, an attacker would need the ability to run code on a computer (in which case a victim has much larger problems than this) and the exploit code is very large.

Sunbelt Software Chief Technology Officer Eric Sites said: “The matousec.com blog published a possible attack method that could be used for researching actual vulnerabilities. All of the security products he listed may or may not be vulnerable to this method of attack. VIPRE uses SSDT hooks only for older version of Windows and then only sparingly where APIs provided by Microsoft don’t exist or are too buggy to use. VIPRE does not use SSDT hooks for 64-bit versions of Windows because of Microsoft’s PatchGuard technology and Microsoft new APIs for security software. That said we are reviewing our drivers to make sure our products are not vulnerable to the method of attack.

“If any of the vendors’ security products do have an actual vulnerabilities to this attack method it is very sad that matousec.com did not use responsible disclosure and give the security vendors time to review their products before publicly disclosing this information and putting everyone at risk. matousec.com notified us about the attack method and possible vulnerability on April 20th and then promptly released this information on May 5th which does not give any vendor time to review tens or hundreds of thousands lines of code to hunt for possible vulnerabilities. And no time at all to fix, test and deploy updated versions of security products. This is very sad and very irresponsible.”

The Register put the vulnerability in perspective in the eighth paragraph of their story:

“Still, the exploit has its limitations. It requires a large amount of code to be loaded onto the targeted machine, making it impractical for shellcode-based attacks or attacks that rely on speed and stealth. It can also be carried out only when an attacker already has the ability to run a binary on the targeted PC.”

Story here: “New attack bypasses virtually all AV protection”

Dwight Silverman on the Houston Chronicle’s TechBlog puts the vulnerability in further perspective. He quotes Lucian Constantin of Softpedia: “There is still a debate about the impact of this vulnerability, especially since the underlying problem has been known for years, yet no practical attack has been detected in the wild. On the other hand, it is also true that multi-core processors, which drastically increase the success rate of this attack, have since become widespread in desktop computers. Nevertheless, from information we received in confidence, some antivirus vendors were already planning to stop using SSDT hooks in the next version of their products, since before this research came out.”

Blog here: “In theory, your antivirus software is worthless”

Tom Kelchner

Researchers at matousec.com have reported a bait-and-switch vulnerability in the 30 leading anti-malware products on the market today including VIPRE. The vulnerability exploits Windows driver hooks in anti-virus programs, sending them a piece of non-malicious code to bypass security checks then exchanging it for malicious executables.

Although their report has resulted in screaming headlines worldwide, researchers have pointed out that the vulnerability has existed for years without anyone exploiting it. Also, to be successful, an attacker would need the ability to run code on a computer (in which case a victim has much larger problems than this) and the exploit code is very large.

Sunbelt Software Chief Technology Officer Eric Sites said: “The matousec.com blog published a possible attack method that could be used for researching actual vulnerabilities. All of the security products he listed may or may not be vulnerable to this method of attack. VIPRE uses SSDT hooks only for older version of Windows and then only sparingly where APIs provided by Microsoft don’t exist or are too buggy to use. VIPRE does not use SSDT hooks for 64-bit versions of Windows because of Microsoft’s PatchGuard technology and Microsoft new APIs for security software. That said we are reviewing our drivers to make sure our products are not vulnerable to the method of attack.

“If any of the vendors’ security products do have an actual vulnerabilities to this attack method it is very sad that matousec.com did not use responsible disclosure and give the security vendors time to review their products before publicly disclosing this information and putting everyone at risk. matousec.com notified us about the attack method and possible vulnerability on April 20th and then promptly released this information on May 5th which does not give any vendor time to review tens or hundreds of thousands lines of code to hunt for possible vulnerabilities. And no time at all to fix, test and deploy updated versions of security products. This is very sad and very irresponsible.”

The Register put the vulnerability in perspective in the eighth paragraph of their story:

“Still, the exploit has its limitations. It requires a large amount of code to be loaded onto the targeted machine, making it impractical for shellcode-based attacks or attacks that rely on speed and stealth. It can also be carried out only when an attacker already has the ability to run a binary on the targeted PC.”

Story here: “New attack bypasses virtually all AV protection”

Dwight Silverman on the Houston Chronicle’s TechBlog puts the vulnerability in further perspective. He quotes Lucian Constantin of Softpedia: “There is still a debate about the impact of this vulnerability, especially since the underlying problem has been known for years, yet no practical attack has been detected in the wild. On the other hand, it is also true that multi-core processors, which drastically increase the success rate of this attack, have since become widespread in desktop computers. Nevertheless, from information we received in confidence, some antivirus vendors were already planning to stop using SSDT hooks in the next version of their products, since before this research came out.”

Blog here: “In theory, your antivirus software is worthless”

Tom Kelchner

Operation Network Raider and Operation Cisco Raider

The U.S. Department of Justice has announced that federal agencies have made 700 seizures of counterfeit Cisco hardware worth more than $143 million in the last five years. The investigations resulted in the conviction of 30 people in an initiative targeting the illegal distribution of counterfeit network hardware manufactured in China. Nine other individuals are awaiting trial and eight are awaiting sentencing.

The agencies involved in the investigations include the FBI’s Cyber Division U.S. Immigration and Customs Enforcement (ICE) and the U.S. Customs and Border Protection.

Customs and Border Protections said they’ve seen a 75 percent decrease in seizures of counterfeit equipment at U.S. borders from 2008 to 2009.

International investigations have resulted in five convictions — one in Canada and four in China — and $17 million in counterfeit networking equipment being seized in France, China and Canada. The U.S. agencies are continuing to work with China’s Ministry of Public Security to fight the manufacture and export of counterfeit network hardware from there.

John Morton, Assistant Secretary of Homeland Security for ICE said: “These cases involve greedy businessmen hocking counterfeit and substandard hardware to any buyer—whether it could affect the health and safety of others in a hospital setting or the security of our troops on the battlefield. They pose a triple threat to our nation by stealing from our economy, threatening U.S. jobs and potentially putting the safety of our citizens at risk.”

News release here.

Tom Kelchner

Operation Network Raider and Operation Cisco Raider

The U.S. Department of Justice has announced that federal agencies have made 700 seizures of counterfeit Cisco hardware worth more than $143 million in the last five years. The investigations resulted in the conviction of 30 people in an initiative targeting the illegal distribution of counterfeit network hardware manufactured in China. Nine other individuals are awaiting trial and eight are awaiting sentencing.

The agencies involved in the investigations include the FBI’s Cyber Division U.S. Immigration and Customs Enforcement (ICE) and the U.S. Customs and Border Protection.

Customs and Border Protections said they’ve seen a 75 percent decrease in seizures of counterfeit equipment at U.S. borders from 2008 to 2009.

International investigations have resulted in five convictions — one in Canada and four in China — and $17 million in counterfeit networking equipment being seized in France, China and Canada. The U.S. agencies are continuing to work with China’s Ministry of Public Security to fight the manufacture and export of counterfeit network hardware from there.

John Morton, Assistant Secretary of Homeland Security for ICE said: “These cases involve greedy businessmen hocking counterfeit and substandard hardware to any buyer—whether it could affect the health and safety of others in a hospital setting or the security of our troops on the battlefield. They pose a triple threat to our nation by stealing from our economy, threatening U.S. jobs and potentially putting the safety of our citizens at risk.”

News release here.

Tom Kelchner

The University of California, Berkeley, has found that more than half young adults have become more aware of Internet privacy issues than they were five years ago. That number is similar to Internet users their parents’ age or older.

“In its telephone survey of 1,000 people, the Berkeley Center for Law and Technology at the University of California found that 88 percent of the 18- to 24-year-olds it surveyed last July said there should be a law that requires Web sites to delete stored information. And 62 percent said they wanted a law that gave people the right to know everything a Web site knows about them.”

The Pew Internet Project is set to release the results of a survey soon that will show Internet users in their late teens and 20s work harder to control their privacy than older people.

“In the Pew study, to be released shortly, researchers interviewed 2,253 adults late last summer and found that people ages 18 to 29 were more apt to monitor privacy settings than older adults are, and they more often delete comments or remove their names from photos so they cannot be identified. Younger teenagers were not included in these studies, and they may not have the same privacy concerns. But anecdotal evidence suggests that many of them have not had enough experience to understand the downside to oversharing.”

Story here: “Tell-All Generation Learns to Keep Things Offline”

Tom Kelchner

.