Infamous "OpenSC.WS" is back

    It would seem that the infamous "Security research" forum (trojan coding forum) called OpenSC.WS is back up. The admin "reine" claims he was traveling and missed the billing email, and claims that was the reason for this extended down time. There is no word on whether the constant DDOS attacks will continue now that this forum is back up, I suspect it won't be long before they start up again.

    So what does this mean for us, security wise? It means that there will now, once again be more viruses being used in the public. While many of OpenSC's users left for other forums, there are still others who waited patiently for it's return to start selling malware again. While this won't cause an increase in extremly hazardous malware like FLAME or StuxNet, you can expect to see more RATs (Remote Administration Tools) and small bitcoin mining malware (Bitcoin is an online currency frequently used for illicit business). So I suggest you all set up those anti-virus and firewalls, and tread carefully.

Please let me know if you are interested in a particular topic for my next post

Stuxnet, Duqu, Flame, and Gauss.

    Stuxnet, Duqu, Flame, and now, Gauss. These four malwares are some of the most dangerous out there. They are all coded fairly similarly, which brings up the question, are they coded by the same person? We can't really know for sure, but I believe that the answer is yes and no.

     As you may be aware, some time ago, HBGary Federal was experimenting with stuxnet decompiles, and suspected to be planning on using it for their own purposes. The hacker group Anonymous intercepted multiple emails and compromised one of their servers to find that they had most of the stuxnet source code. Anonymous then released this source to the public. A While after this, we see Duqu appear. While Duqu is very similar to Stuxnet, it is still quite different. This leads us to believe that while it was based on the source of Stuxnet, the version released by Anonymous, it was coded, or modified, by someone else.

    After that, we encounter Flame. This malware is very different, although many of its features are quite similar. Many thought Flame was an attack by a government, possibly the US. There is little to no evidence to support this, although it is entirely possible. This malware was also derived from the stuxnet source, although it was modified a great deal more than Duqu. So, once again, this is most likely from another coder entirely.

    Now, a newer malware was detected, and named "Gauss".While much of this malware is still unknown  as its main payload is fairly heavily encrypted, it seems to fall in with Stuxnet, Duqu, Flame, etc. There are also some who think this is another governmental espionage virus. While I do not know much about this malware, it does seem likely that governments are relying heavily on things like malware for infosec and things of that nature. Things like Flame could even be used to shut down power grids, take  over full control of a network, etc, which could be extremely useful.

As soon as I learn more about Gauss, or the relationship between all these trojans/malware I will let you know.

More on Gauss
http://www.crysys.hu/
Eset

Stuxnet source
github

Credits
Eset
Crowdleaks

Which Anti-Virus software should you use?

    Many people have Anti-Virus software, but is it the best one? I usually don't recommend to get an Anti-Virus/firewall bundle, as one company makes a better firewall, while another makes a better Anti-Virus. In this post, I will tell you which Anti-Virus/firewall software I recommend, and which ones to avoid.

   Let's start with free options. There are quite a few free Anti-Virus options out there, but most only work for a limited time, or have limited functionality. If you really don't want to spend money on this, then I recommend Malwarebytes Anti-Malware. I have used this, and so have many of my friends and family, and it works great. It is perfect for a short term solution while you try to figure out what software to purchase. This is both a fire wall and a anti virus, and The ones I recommend you avoid are Avast and AVG, both free and premium versions. These are considered a joke by the very people who code and spread malware. This is nothing personall, they just are not that great. A good free firewall is Comodo. Combinng these two is a fairly decent security solution. Now onto a great paid solution.

Note, these ads lead to paid or premium version of the product

    My favorite and, I think, best Anti-Virus is ESET's Nod32. It is one of the most up to date and fastest updating firewalls out there. This is the Anti-Virus that I use, and have for awhile. I recommend that you stay away from Norton products, the source of these have been leaked to the public, making it much easier for malware authors to avoid or bypass it. For firewall I recommend Kaspersky. It is one of the more "feared" firewalls for hackers and malware authors. These two togethor should be good enough to stop most attempted attacks. Always remember though, even the NSA gets hacked, so if you're not carefull, you can be another victim to a yet unkown zero day. so be sure to stay safe online.

Which Anti-Virus and/or Firewall software do you prefer and why?

ZeroAccess: How to remove the latest version

   In my previous 2 posts I have highlighted the changes in the newer version of ZeroAccess and how to tell if you are infected, and who is at most risk. This post will cover how to get rid of this infection, and what tools to use to protect against it.

    The easiest way is to download one of many anti-virus programs, or removal tools. I always recommend ESET as they have always gotten the job done for me and my family. ESET has made a tool specifically to remove the ZeroAccess bot, one that is easy and completely free.

1. Download the tool here
2. Start the tool by double clicking it.
3. Press "Y" when it asks you if you want to restore system services
4. Once the tool has finished working, restart your computer by pressing any key.
5. You may be prompted with a security window upon restarting, click yes or allow
6. Click "Yes" on the repair window
7. Once the repair is finished, you will be prompted to restart again, do so.
8. For best results and to ensure complete removal, purchase ESET Smart Security or ESET Nod32 and run a full scan.

    As you can see, it is fairly simple to remove this virus, if you have any trouble, comments, or questions, let me know in the comments section (Don't be embarrassed, I have to approve comments, if you think it is a stupid question, just ask that I do not post the comment, and I will contact you directly.)

    The main way this bot spreads is through exploits, most of which are patched in the latest versions of the software they are designed to exploit, so make sure you apply regular updates, and don't visit shady sites. Also, I know it may be hard to refrain from pirating things like games, so I encourage you to only download "cracks" if there have been many downloads, even then, make sure to read the comments and do not download if it is reported to be infected, or not working correctly. Also remember that I do not condone pirating or any form of illegal downloads.

ZeroAccess: 9 million infected, are you one of them?

    As I mentioned in my previous post, ZeroAccess is still around and is adapting. Over 9 million PCs are now infected with this bot. Most are located in the USA or Western Europe. 33% of super nodes are located in Germany, with the US coming in a close second with 32%. A super node is an infected machine that is not behind a system like NAT so that other bots, or peers, can access it. This post will be mainly directed at how to tell if you are infected, and who is at the most risk of infection.

    ZeroAccess uses multiple install locations, so you should check all of them. The main component drops at two locations, 1 in appdata, the other in windows/installer. if one is deleted, the other is still perfectly capable of functioning. The two locations are shown in figure 1.1.

Figure 1.1
Thanks to SophosLabs

 Both contain a dll file, named "n" (the main component), which are added to startup by hijacking a COM directive. These also contain a file named "@" which is a list of predetermined peers for the bot to connect to and retrieve updates, commands, etc. These folders also have 2 directories named "U" and "L" which contain plugins and temp files.


Also, if you have windows vista or up, ZeroAccess will try to patch services.exe fortunately, it is easy to restore by running the following command:

sfc.exe /scanfile=c:\windows\system32\services.exe

Simply check for these signs to see if you are infected. If you have been browsing the web without appying recent updates to internet explorer, adobe flash, or java, scan and fix, and apply all updates.
My next post will explain in detail how to remove and protect from this virus.

Credits:
SophosLabs

Open Source Malware: Is It Worse?

Lately alot of malware has been released "Open Source" meaning that it comes with the source. some bots that come this way are:

• µBOT
• Aldi Bot
• vnLoader
• osRat
• Darkflame
• Zeus 2.0.8.9

Now, why would these be more trouble, open source means easier to detect correct? While this is true, it also means that it can be easily modified without the need of s program called a "crypter." This means that any average joe can come along, download these sources, change the string names and it will be harder to detect. While this alone will not make the file FUD (fully un-detected), there are a few other tricks that more well-versed users can use. This also means that the "hacker" can create modifications to the code, and have a virus that is a lot "deadlier", if you will, than it originally was. Granted this requires that the "hacker" has at least some basic coding knowledge, but there are plenty of tutorials out there that can make most people into malware coders in no time (although don't expect to code the next Zeus anytime soon). 

So, you might ask yourself, what is a good Anti-Virus to protect us from these mods?

• ESET SMART SECURITY is a pretty good AV.
• Malwarebytes Anti-Malware is also pretty good.

I also mentioned some coding tutorials,

• Coding for Penetration Testers: Building Better Tools
• Malware, Rootkits & Botnets A Beginner's Guide

Those two are some very basic books for those who want to learn more.'

So, what do you think? Is Open Source worse for us? Why or why not?

also remember, tell me what you want to hear about next!

McAfee Labs Threat Report for Q1 2012

Here is just a brief overview of what is happening in the cyber underworld according to McAfee;

1. People are starting to use rootkits more
• almost 200,000 new rootkit samples in this quarter
• Koutodor is at about 50,000 new samples
• TDSS is falling (about 100,000, down from 120,000)
• ZeroAccess is still becoming more popular (about 170,000 new samples)
2. Fake AVs are still going strong (690,000 new samples)
3. Autorun samples are about the same as last quarter (480,000)
4. Password stealers are extremely popular it seems. (1mil new samples)
5. Signing malware is also becoming more of a habit for "Hackers" (about 325,000 total samples of signed binaries, about 200,000 new)
6. Mac malware is once again dwindling (280 new samples)
7. fake AV for Mac is a little higher than last quarter, but still fairly low (about 150 new samples)
8. Spam is Extremely low, and still falling (a little over a trillion messages per month)
9. Large botnets are on the rise again (about 5mil infections)
• Cutwail net is leading the rest by a fairly large margin
10. Bad rep URLs are down again (about 7,500 new URLs)
11. Drivebys and silent infection sites are up (about 800,000 malicious URLs)
12. phishing sites are still down, but quickly rising (about 4,100 new sites)
13. Hacktivism is also on the rise as many are taking up their cyber-arms to stick it to the man

Read the full report Here
Remeber to comment what I should post about next.

New variant of Zeus includes ransomware.

Ransomware is quickly becoming one of the more popular malware features. It encrypts all the users files, disabling them from doing anything unless a certain sum of money is sent to a specified account, usually via liberty reserve. A new Zeus variant has been discovered that also has this feature. Some of the code is shown below in Figure 1.

Figure 1

While this is dangerous, and probably still not yet fully implemented, it is very simple to unlock your computer. Once you make the payment, a new registry entry is created that prompts Zeus to un-encrypt your files. This makes it quite simple to remove the encryption. Here are steps to follow.


1. boot the system in safe mode
2. add a new key named syscheck under HKEY_CURRENT_USER
3. create a new DWORD value under the syscheck key
4. set the name of the new DWORD value to Checked
5. set the data for the Checked value to 1
6. reboot

This should cause Zeus to un-encrypt all your files and you can remove it from there (simply run a virus scan using something like: Norton AntiVirus 2012 or Malwarebytes Anti-Malware

thanks for reading, remember to comment on what I should post next.
credits to The Hacker News for images and un-encryption steps and research data

Adware is making a comback

Browser extensions are now being used by adware developers to inject ads into websites. Many Wikipedia users have been complaining of ads being displayed on its site, while Wikimedia has stated that they will not put up adds. Wikimedia is a non-profit and will never display ads on their site, so if you see them, you most likely have a bad browser extension.

Not only do these adware extensions cause annoying ads, some of them are even used for more sinister purposes. One extension mentioned by wikimedai called "IWantThis!" is spyware that is masquerading as adware. In its privacy policy it states:

Examples of the information we may collect and analyze when you use our website include the IP address used to connect your computer to the Internet; login; e-mail address; password; computer and connection information such as browser type, version, and time zone setting, browser plug-in types and versions, operating system, and platform; the full Uniform Resource Locator (URL) clickstream to, through, and from the Site, including date and time; cookie; web pages you viewed or searched for; and the phone number you used to call us.

Some of these extension may come bundled with freeware downloaded from other sites, and be installed involuntarily. Many of these extensions target Chrome as the go to browser, but are very capable of being installed on other browsers as well. Few antivirus software will actually scan or detect faulty or malicious browser extensions so it is up to you to keep yourself secure. Never install toolbars or extensions that promise "free cursors", "free games", etc. Regularly check through your extension/toolbars/addons and disable/remove those that you are not using or did not install. And, as always, do not download or install anything fishy.

Remember to post in the comments what you would like to see next.

Zeus continues to evolve.

Zeus, a popular banking bot, continues to evolve.  It now has a feature called "web-fakes", it mirrors a website. such as bank of america, and now, rather than just stealing your info, prompts the user to use a "secure mobile app". The app, nicknamed "Zitmo" acts as an official app but steals your info and is capable of hijacking your account. SpyEye, a competitor to Zeus, also has a feature like this now, nicknamed "Spitmo". The source for Zeus v2.0.8.9 is available on many sites, and will be linked at the conclusion of this blog for those interested in studying it. SpyEye, on the other hand, is more protected, and while there are tutorials on how to crack it, it is not as simple, and only works on windows XP as it exploits a faulty timer. Both of these bots have been modified many times into many different versions, and there are even rumors of a p2p version of these bots. A tutorial on how to crack SpyEye can be found on http://xylibox.blogspot.com/2011/08/cracking-spyeye-13x.html (A link to SpyEye will also be added to the end of this post for those who want to study it). Both of these bots have been used by huge banking and carding rings and are not to be used for any illegal purposes.

• Zeus (password: zeus)
• SpyEye

As always, post in the comments what you would like to see next.

Android malware spreads through bogus apps

Android is quickly becoming a very popular OS for malware developers. Android apps can be coded in java, a very simple language that can be picked up by anyone. Recently, many viruses have been created and put up for download on third party android app stores. These "apps" mimic there intended clone but add malware functionality such as connecting to a webpage and waiting for orders. This can cause high wireless web traffic causing your phone bill to go up drastically if you are not so fortunate as to have an unlimited data plan. Let's try to make this a little simpler. Lets say you don't want to pay for angry birds, so you go find someplace to download it free. What you don't know is that this is not only angry birds, but it also has a virus attached. The virus can be so small (under 100kb) that you don't even notice the difference in size. Once angry birds is initialized, your phone connects to a website and awaits further instruction.
Some ways that you can prevent this is by

• Get an Android antivirus (such as Symantec Mobile Security )
• Make sure you trust the source you are downloading from (if it seems too good to be true, it is)
• Download only from the legitimate source (Android marketplace)

As always, post a comment for what I should post about next

Source:

Bogus Facebook apps spreading Android malware : The Hacker News ~ http://thehackernews.com/2012/05/bogus-facebook-apps-spreading-android.html

New worm, spreads through IM

A new worm has been detected that spreads through things like facebook private messages. It is detected as WORM_STEKCT.EVL the malicious file name is "May09-Picture18.JPG_www.facebook.com" . The actual link to the malicious file is shortened using the popular shortening service called TinyURL. Once executed, the file disables all process associated with anti-virus. It then downloads another worm called WORM_EBOOM.AC. This worm monitors your internet usage and attaches itself to messages you post or send. Both these worms connect to a website and send/receive data from it.


How to prevent getting infected:

• Scan all files before running. Most viruses will be detected, I recommend Malware Bytes
• When you run a file downloaded, use a VM
• Regularly scan your system for viruses, and clean your cache, many viruses drop themselves here
• Don't download anything you don't fully trust, chances are, it's a virus.

That's all for now, be sure comment with other suggestions on how you keep yourself secure and what I should talk about next.