Not the smartest...

I was looking at a bot the other day I received though email. The "botmaster" (and I use that term loosely) was using mIRC-based bot, something I haven't seen in a long time. It wasn't packed, didn't perform any tricks to get installed, etc. Everything screamed amateur.

So, I ran it through my honeynet and just sat there and watched. Since it was mIRC I could open it up and just watch the channel. To my complete amazement, after confirming I was a bot (by asking me to echo some text back to him) the "botmaster" gave me admin access to the IRC channel. Huh!?!

(In the picture below the botmaster is @Gigi, my infection is @Childse.)


So, what is a self-respecting malware analyst like myself to do? Oh, I don't know. :)

Olympic Travelers Return...Bearing Gifts?

Now that the Olympics are over everyone who was lucky enough to go will be traveling back to home and coming back in to work. Surely they'll be bringing the souvenirs they bought in Beijing - buttons, pins, T-shirts. But what about electronics?

China knows trade and knows an opportunity to increase sales in their country so they obviously did everything they could to ensure tourists could access Chinese markets and purchase their (cheap) goods. Did these include electronics? Absolutely!

While I have no first hand accounts of this and am speculating, I'm sure many of the recent Olympic visitors toured the Chinese markets and saw great deals on USB watches, digital frames, laptops and other computer accessories and picked them up. Soon these same people will be bringing in their newly-obtained items into their homes and hooking them up to their personal (or work) computers or, if administrators as lucky, they'll be bringing them to work to display (and use) on their desktops.

Anything to worry about? Naw, I'm sure we'll be fine. There's never been any instance of malware coming from Chinese hardware.

If anyone hears about anything like this, let me know please.

Hotel Lobby Security

I'm not a physical security guy, but I am learning. I found some pictures that I took at the hotel for a conference I was at earlier this year.

Some background: The hotel is a resort hotel where the main building contains the registration desk, some restaurants/bars and meeting rooms. That leads to a large outside pool. Surrounding the pool are three large towers which contain all of the rooms. The towers have two entrances - one from the pool area and one from the parking lot. The picture below is taken as if you were coming in from the parking area. (Notice the computer used for theme park reservations - this was left unattented, but turned on, after 5PM.)

Can you spot the security flaw?


What about now?



While I'm glad they have cameras in the lobbies, I find it very pointless to have the plug about 6 inches away. BTW, the ceilings were maybe 7 feet high so its not like someone couldn't teach up to unplug it. While I never unplugged it to see how fast security would respond, if at all, I found this very interesting and have been noticing physical security flaws like this much more.

Is Free Better?

I'm a geek at heart so I take part in alot of geek-related activities. One of the ones I've gotten into within the last few years is boardgaming. Not your typical games like Monopoly, Scene-It or Risk (although I love Risk), but euro-games which, IMO, have a lot more strategy in them. It is because of this hobby I was at a LFGS the other night playing games with the local boardgaming group.

We were playing a game of Arkham Horror and in between turns one of my fellow gamers and I were talking about the laptop he had just brought and was playing with. He said it was mostly set up, but he had to go out and buy the latest AV suite to make sure it was protected. I mentioned that there were free AV software available which, IMO, were just as good as the commercial software. His response was that he had used them before, had liked them, but wanted the assurance he felt when he purchased the AV software. I was a little dumbfounded by his comment.

From his perspective, he felt safer paying $50+ for an AV suite of software than using free AV software which, to his own admission, would protect him just as well. I've seen this mentality in the corporate world as well. Corporations would rather shell out large amount o' cash for security suites or devices than use, just as good or better, free software because they felt safer paying for it. After all, if they are paying for it and it fails, they have someone to sue.

This post isn't meant to start a fight on commercial vs free software. I'm just confused by the perception out there in the corporate, or in the first case, the user world that paying for something will get you more protection that using free software. I guess I'm just surprised that this point of view is taken by end-users as well.

Has anyone else seen examples of this? Any good stories to share?

Another update...

Unfortunately, I'm not at BlackHat/Defcon this week so I don't have any really cool stories about 0-day attacks, vendor parties or Vegas. However, its been a week since my last post so I thought I'd put something on. (In reality I'm avoiding writing a report.)

Khallenge has come and gone. I was able to get through the first level in 36 minutes. Not bad, but I should have been able to do better than that so I'm personally disappointed. The level 1 password was XOR's encoded so it was pretty easy to find once you found the right section of code. I got level 2, but due to other pressing issues (ie. work) I was unable to finish it. I'm pretty sure the password was RC4 encrypted, but I'm not 100% sure. I'll have to wait for F-Secure to post the results.

One funny thing did happen during the contest. At one point something happened to the Khallenge website and the directory index came up instead of the page. Using that I was able to download all of the contest binaries. F-Secure fixed it pretty quickly and changed the directories the binaries were in.

Because of agent0x0, who is living it up in Vegas as we speak, I've become addicted to Twitter. I have to admit I was skeptical at first, but it is a great tool for information sharing and meeting others in the field, as well as just fooling around. Whats worse is that I have my phone hooked up to it now. :) If you're on it, follow me.

Misc MA Stuff

Been busy but I still wanted to post something quick.

If you didn't know, F-Secure's yearly reverse engineering challenge, Khallenge, is about to start. It works by using levels - you download a binary, figure out how to reverse it and get the password to the next level. I've done it in years past and have gotten to the last level but not beyond. Maybe I'll try this year. It starts August 1, 2008 at midnight (EEST) which should be about 5PM July 31, 2008 EST. It lasts only two days so get out there and reversing! http://www.khallenge.com/

There are many excellent blogs out there which have alot of great information on reverse engineering and malware analysis. However, I want to call out one which I consistently find excellent information on new threats and how to perform malware analysys: The Websense Security Labs Blog.

I'll be the first to admit that when I think of Websense I think of content filtering and not malware analysis. (Actually I think of some poor fool who has to visit every site that gets submitted to categorize it.) However, they have some really smart people working for them who do alot of great malware analysis work. They constantly publish excellent blog entries about different aspects of malware. This is one of the blogs which I will ensure I read whenever they publish something new. Their RSS feed is here and I highly recommend it.

Anyone have any good resources they'd like to mention?

Sharing Passwords

Security professionals have always beaten into our heads that we should NEVER share our passwords with anyone. For any reason. At any time.

But take the following situation.

Last night my wife got a call from an old neighbor of ours. Her aunt had died suddenly in an operation and she got a call from her frustrated uncle. Apparently, her aunt did all of the finances on the computer and did not know the password to get onto it! She called us to see if I knew how to get around the password problem.

But this got me thinking. What would happen in a situation like this with my wife and I? She doesn't know any of my passwords and I'm pretty sure I don't know hers. If something happened to us, would we be able to get into the sites the other pays things on?

The obvious solution is that we either use the same passwords or share the ones we need to know. But, sharing passwords is bad, remember? Unless you can do it securely.

While I was looking around, I found a blog post at insomnic.wordpress.com talking about this. IMO, its a pretty decent solution - use a secure password keeper program that both you and your spouse have access to. By keeping the passwords in there which you both need to know, then you are covered in the event something happens to one of you.

Yes, there is now the problem of having the "keys to the kingdom" in one spot covered by one password...but that happens anyways when you use a password keeper program. I believe as long as you are careful in the password you create for that, you should be good.

Does anyone do this now? Does anyone have any other solutions? I'm honestly curious how others do this.