11/2010 (36) PRACTICAL PROTECTION IT SECURITY MAGAZINE Dear Readers, team First of all, Hakin9 team would like to wish you Merry Christmas and Happy New Year! Maybe it is a bit too early Editor in Chief: Karolina Lesińska but we will „see” each other in January next time and it will be [email protected] too late:) Since 2010 is coming to an end it is time for new Editorial Advisory Board: Matt Jonkman, Rebecca Wynn, resolutions. We have one – make Hakin9 magazine better Steve Lape, Shyaam Sundhar, Donald Iverson, Michael Munt – more popular and more reliable source for our readers. That DTP: Ireneusz Pogroszewski is why we are constantly in touch with our team of authors and Art Director: Ireneusz Pogroszewski [email protected] betatesters to get the most fresh and valuable opinions on each issue. So at this point we would like to thank all people Proofreaders: Henry Henderson aka L4mer, Michael Munt, Jonathan Edwards, Barry McClain who are helping us every day getting in return just a simple thanks. Without your support Hakin9 wouldn’t be as it is now Top Betatesters: Rebecca Wynn, Bob Folden, Carlos Ayala, Steve – not only a magazine but a community of great people. Hodge, Nick Baronian, Matthew Sabin, Laszlo Acs, Jac van den Goor, Matthew Dumas, Andy Alvarado I hope we will be working together Special Thanks to the Beta testers and Proofreaders who helped next year as good as we did this us with this issue. Without their assistance there would not be a year! Hakin9 magazine. Once again – Merry Senior Consultant/Publisher: Paweł Marciniak Christmas and Happy New CEO: Ewa Łozowicka Year! I hope all your wishes [email protected] and hopes for the future will Production Director: Andrzej Kuca come true. [email protected] Marketing Director: Karolina Lesińska Warm regards [email protected] Enjoy your reading Subscription: Iwona Brzezik Karolina Lesińska Email: [email protected] Editor-in-Chief Publisher: Software Press Sp. z o.o. SK 02-682 Warszawa, ul. Bokserska 1 Phone: 1 917 338 3631 www.hakin9.org/en Whilst every effort has been made to ensure the high quality of the magazine, the editors make no warranty, express or implied, concerning the results of content usage. All trade marks presented in the magazine were used only for informative purposes. All rights to trade marks presented in the magazine are REGULARS reserved by the companies which own them. To create graphs and diagrams we used program 6 in Brief by Latest news from the IT security world Armando Romeo, eLearnSecurity The editors use automatic DTP system ID Theft Protect Mathematical formulas created by Design Science MathType™ 8 Tools DISCLAIMER! Flexcrypt The techniques described in our articles may only by Shyaam Sundhar be used in private, local networks. The editors hold no responsibility for misuse of the presented techniques or consequent data loss. 46 ID fraud expert says... A brief analysis of the cyber security threat by Julian Evans 50 Emerging Threats Cyber State-Bullying by Matthew Jonkman 4 11/2010 www.hakin9.org/en 5 CONTENTS BASICS 10 The Spyware Within You by Rajat Khare Yes, today’s spyware though resides in your computer or mobile but it’s pretty much inside you. Whatever we do, wherever we go it’s stored in a computer or an embedded device like mobile phone. 12 The Ear of Sauron by John Aycock In The Lord of the Rings, Sauron wiles away the time peering out over Middle Earth with the Eye – lacking Internet access, Sauron couldn’t occupy himself flaming hobbits online.Sauron’s Eye has been realized, in a small way, by the webcams perched atop our monitors and embedded into our laptops and mobile devices. 14 dasbot: controlling IRC via bash by Israel Torres dasbot is an intuitive bash file driven IRC bot. It was created on a Mac and runs in a progressive environment where it can be updated with ease at a moments notice. It doesn’t require a compiler, sudo permissions or static path. You can run it until you decide to restart your uptime. 20 Knowing VoIP Part II – Getting deeper to the settings by Winston Santos In the last chapter we talked about what is VoIP, its advantages and disadvantages etc. But this time I will take you to the inside of the process when people place/receive a call. I will take the opportunity to explain what is required to properly configure a device to work + some tips to help people in taking the best of the service. ATTACK 24 TDSS botnet – full disclosure. Part II Andrey Rassokhin and Dmitry Oleksyuk After breaking into the world’s biggest botnet, which was covered in the previous issue of Hakin9, we performed thorough analysis of the botnet’s undercover logic. In this final article of the series the following details are revealed: The C&C server general configuration; Bots accounting system; Distribution partners accounting system; The C&C protocol layout: bot requests and commands; Available control commands and payload modules; Detailed botnet statistics by countries, distribution partners, operating systems and bot versions. DEFENSE 40 Search Engine Security and Privacy – Part 2 by Rebecca Wynn It is always surprising to see how much information is available to anyone with an Internet connection and little tenacity. Since Part 1 was published in the July 2010 Hakin9 magazine, there have been huge changes within the search engine world. I will name a few key changes here. 4 11/2010 www.hakin9.org/en 5 In brief In brief WEB BROWSER DRIVEBY EXPLOITS ON NEWS FROM THE ANTIVIRUS INDUSTRY THE WILD Windows users can enjoy free AV protection since the Client side exploits are the real concern of security early days when Avira released its antivirus AntiVir for staffs of every company worldwide. As reported by free and AVG provided free protection from spyware Neil Daswani, CTO and founder of Dasient, in OWASP and worms. Then Comodo joined the panel pushing its AppSec DC conference, an incredible growth in the Internet Security suite comprising of the award winning number of exploits against client applications versus firewall and a performing AntiVirus, free for home use. server daemons demonstrates that the weakest link Now Sophos has just released a free version of its is still the end-user. Moreover, it proves to be hard to Antivirus for Mac users, becoming the first firm providing deploy a corporate wide policy to mitigate the use of, malware protection on this platform. or apply patches for vulnerable applications, when a The need for more malware protection under Mac is 0-day is released every other week against common real and supported by an increasing number of infection applications such as Adobe Reader, Flash Player or on this platform. Mozilla Firefox. The most targeted among these client The same Sophos has announced a decline in the applications are web browsers and their plugins. rate of growth of the company with the immediate effect By means of drive by download exploits, botnets, of firing 80 of its employees, for a total of 8% of the easily recruit new zombies, by silently downloading workforce. and installing malware without ever rising any suspicion AVG, firm specialized in Windows malware protection, in the victim. These drive by exploits have become has announced the buy out of DroidSecurity, an Israeli more and more complex in terms of distribution and startup company producing security software for Android obfuscation. Most of them involve Javascript and smartphones. iFrame injection. Others involve exploitation of the latest The deal will bring AVG in the growing, although still Flash player vulnerabilities. completely green, market of anti malware solutions for smartphones. Source: Armando Romeo, www.elearnsecurity.com Source: Armando Romeo, www.elearnsecurity.com WILL CLOUD BE EVIL? Cloud computing, beside the other thousand of GOOGLE BUG LETS MALICIOUS WEBSITES other meanings, refers to the possibility of running HARVEST YOUR EMAIL applications, or websites, on different virtualized hosts, A bug in the Google Apps Script API could have allowed with the benefit of scaling the need for CPU and memory for emails to be sent to Gmail users without their instantly. The business model is in use now is a pay per permission according to Google. cycle. Cost depends on the number of CPU cycles and The bug in Google had been demonstrated by a the CPU-time consumed. web page hosted on Google Blogger. This web page Thomas Roth, is a german guy who has cracked gathered the Google account email address of the user SHA-1 password with rented distributed CUDA visiting the web page and send an email to it. Google, computing. Although SHA-1 160bit is thought to has released a fix to this issue after an article exposing be,relatively, insecure, it is still used for SSL and other the privacy threat appeared on Techcrunch written by important implementations. This sounds even more Michael Arrington who, in turn, had given voice to the ironic if we consider that most of the SSL CA using author of the exploit complaining of the lack of interest MD5 when Sotirov et al, in 2009, managed to crack from Google security response team. SSL through MD5 collisions, switched over to SHA-1 few days later. Source: Armando Romeo, www.elearnsecurity.com New cloud cracking services are coming up. The most notorious is Moxie Marlinspike’s wpacracker.com, DHS MIGHT FINE COMPANIES FOUND offering the rental of 400 CPU’s cluster to crack WPA NONCOMPLIANT passwords. English and German dictionaries are The U.S. Department of Homeland Security, thanks to a available or, in general, the digits dictionary can be new law proposed by democrats, might be able to fine used, which contains all 100 million permutations of noncompliant tech firms with a fine of $100,000 a day.