Client-side validation

One of the rules of application security is to never implement client-side validation but rely on server-side validation.
I came across an e-card greeting on the "Uniquely Singapore" website and decided to try it out. Hmmmm... the form doesn't allow me to submit an e-card with the recipient and sender emails being the same. Did they implement client-side validation? I decided to disable Javascript in Firefox. I reload the webpage and resubmit. Viola!!! Email sent and received.

This confirms that Javascript is used to validate submissions on the client's machine. The secure way would be to validate on the server so that the client cannot manipulate requests to successfully bypass validation.

Zbot

Downloaded a sample of "Zbot" from Offensive Computing's site. I'm no reverse engineering guru but decided to give it a go at analysing this nasty piece of malware. Fired up "Regshot" to detect modifications made to my virtual machine.
The following registry keys were added.

HKLM\SOFTWARE\Classes\.exe HKLM\SOFTWARE\Classes\.exe \PersistentHandler HKLM\SOFTWARE\Microsoft\DownloadManager HKLM\SOFTWARE\XTB

Corresponding values that were added.

HKLM\SOFTWARE\Classes\.exe \PersistentHandler\: "{098f2470-bae0-11cd-b579-08002b30bfeb}"
HKLM\SOFTWARE\Classes\.exe \: "exefile"
HKLM\SOFTWARE\Classes\.exe \Content Type: "application/x-msdownload" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows: "C:\WINDOWS\explorer.exe "
HKLM\SOFTWARE\XTB\httpaddr: "http://server.xyz/drss,jpg"
HKLM\SOFTWARE\XTB\xintr: "1440"
HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\explorer.exe : "C:\WINDOWS\explorer.exe :*:Enabled:explorer"
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\explorer.exe : "C:\WINDOWS\explorer.exe :*:Enabled:explorer"
HKU\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\explorer.exe : "explorer"
HKU\S-1-5-21-299502267-448539723-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable: 0x00000000
HKU\S-1-5-21-299502267-448539723-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings: 3C 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 8A 55 3E 84 54 CA 01 01 00 00 00 C0 A8 DC 89 00 00 00 00 00 00 00 00
HKU\S-1-5-21-299502267-448539723-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings: 3C 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HKU\S-1-5-21-299502267-448539723-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\tester\Desktop\malware.exe: "malware"
HKU\S-1-5-21-299502267-448539723-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\explorer.exe : "explorer"
HKU\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\explorer.exe : "explorer"

The following files were added.

C:\WINDOWS\Prefetch\EXPLORER.EXE -2F6C44D8.pf
C:\WINDOWS\Prefetch\MALWARE.EXE-17DA0AE5.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-4912BB30.pf
C:\WINDOWS\system32\wbem\Logs\wmiprov.log
C:\WINDOWS\explorer.exe

Files were modified.

C:\Documents and Settings\tester\Cookies\index.dat
C:\Documents and Settings\tester\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\tester\Local Settings\Temporary Internet Files\Content.IE5\index.dat
C:\Documents and Settings\tester\ntuser.dat.LOG
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\software
C:\WINDOWS\system32\config\software.LOG
C:\WINDOWS\system32\config\system.LOG

As seen by the registry values added, the malware creates a backdoor into the victim's system. A pop-up was triggered by the malware and by clicking on "Unblock", the hacker has access to the system by adding a permit rule in "Windows Firewall". 2 Explorer processes can be seen from "Task Manager". The malware creates a file "explorer.exe " in "C:\Windows". Note that the fake Explorer does not replace the authentic one native in Windows because the hacker adds a space behind the extension. 2 Explorer processes are seen in "Task Manager" and one of them is the backdoor. "Active Ports" and "netstat" (with the -nab switch) confirm that the backdoor listens on TCP port 113 and UDP port 1025.

The malware requests a fake resource, drss,jpg, from a server presumably controlled by the hacker. This is not a typo as the hacker intentionally uses a comma instead of a fullstop. I hypothesize that the hacker uses this fake request to capture the victim's IP address so that he knows which IP address to connect to.

Besides "0wning" bots, I believe that the hacker is after the victim's surfing history and logs based on the files modified.
Launched "Capture BAT" to verify the findings from "Regshot". "Capture BAT" confirms that the same registry keys and values were added. It also confirms the spawning of the fake Explorer process. The packet capture by "Capture BAT" also confirms the HTTP request to "server.xyz".

Google warning

Google now warns its users of sites with malicious content. Google displayed a warning when I searched for the URL of my toy supplier. It also blocked my access to the suspect site.

Microsoft Security Essentials

M$ released a free AV called "Security Essentials" for home consumers. I gave it a test drive and found it intuitive to manage as well as use.

I tested it against the malicious MP3 file that I analysed previously and "Security Essentials" effortlessly detected the malware instantaneously. Avast! on the other hand needed me to manually trigger a scan before it warned me of the presence of malware. 27 AV engines hosted on VirusTotal missed it.

2FA no longer effective?

Malware patiently waits for victims to successfully log into their online banking account using their 2 factor authentication token before proceeding to steal their money.
I'm not surprised that most AV engines can't detect Zeus. I proved previously how ineffective AV engines are against malware.

Flash cookies

First, it was cookies residing on your system that could compromise your privacy. Now I read about the threat of Flash cookies??? WTH???
Windows users are safe thanks to the almight Ccleaner. It wipes Flash cookies on your computer.
Ubuntu users can add the following command to "ubuntuprivacy" if you have Flash Player installed on your system.

sudo srm -rllv .macromedia/Flash_Player/#SharedObjects/

For the paranoid

I wrote a new script for the paranoid. This script will wipe your memory, swap and free space on your Ubuntu system. Please note that this is a time consuming process.

#!/bin/sh
echo "\033[0;34mProceeding to wipe your memory, swap and free space. Please be warned that this is time consuming and may take hours.\033[0m"
echo
echo "\033[0;31mWiping memory.\033[0m"
sudo smem -lv
echo "\033[0;32mMemory wiped.\033[0m"
echo "\033[0;31mWiping swap.\033[0m"
#Please run "cat /proc/swaps" to determine your mounted swap devices and customise the following line for your machine.
sudo swapoff /dev/sda5
sudo sswap -llv /dev/sda5
sudo swapon /dev/sda5
echo "\033[0;32mSwap wiped.\033[0m"
echo "\033[0;31mWiping free space.\033[0m"
sudo sfill -llv /home/
echo "\033[0;32mFree space wiped.\033[0m"

#"ubuntuparanoia" written by commandrine.
#Please send comments and queries to commandrine[at]gmail[dot]com.
#Version 1.0 dated 16th Sept 2009.
#Pre-requisite is having "secure-delete" installed. Install it using "sudo apt-get install secure-delete".
#Save this script to your home folder. Run "sudo chmod +x ubuntuparanoia.sh" to make it executable.

Download it here.

v2.0

I have modified "ubuntuprivacy" for enhanced privacy.

#!/bin/sh
echo "\033[0;34mProceeding to clean your system to ensure your privacy.\033[0m"
echo
echo "\033[0;31mWiping Firefox history and cache.\033[0m"
sudo srm -rllv .mozilla/firefox/*.default/*.sqlite
sudo srm -rllv .mozilla/firefox/*.default/Cache/*
echo "\033[0;32mFirefox history and cache wiped.\033[0m"
echo "\033[0;31mWiping Trash.\033[0m"
sudo srm -rllv .local/share/Trash/
echo "\033[0;32mTrash wiped.\033[0m"
echo "\033[0;31mWiping Applications history and cache.\033[0m"
sudo srm -rllv .recently-used
sudo srm -rllv .recently-used.xbel
sudo srm -rllv .thumbnails
sudo srm -rllv .openoffice.org/*/user/temp
sudo srm -rllv .openoffice.org/*/user/backup
sudo srm -rllv .purple/logs/*/*
sudo srm -rllv .xsession-errors
sudo srm -rllv .gimp-*/tmp
echo "\033[0;32mApplications history wiped.\033[0m"

#"ubuntuprivacy" written by commandrine.
#Please send comments and queries to commandrine[at]gmail[dot]com.
#Version 2.0 dated 14th Sept 2009.
#Pre-requisite is having "secure-delete" installed. Install it using "sudo apt-get install secure-delete".
#Save this script to your home folder. Run "sudo chmod +x ubuntuprivacy.sh" to make it executable.

Download it here.

How it all started?

My passion for Information Security began when I took a module called "Internet Security" in university. It was in the lab sessions where I was first exposed to Linux, host-based firewalls, encryption, sniffing, spoofing and Trojans.
A flip was switched in my head and I realised my calling in life. I was hooked and the rest as they say is history.

ubuntuprivacy

Realised that "wipefox" was too limited as it only wiped files related to Firefox usage. I wrote a new script that I named "ubuntuprivacy" to include commands to clear other traces left behind as a result of activities performed on your system.
"ubuntuprivacy" currently wipes your Firefox history and cache, Ubuntu Trash and "Recent Documents" history.

#!/bin/sh
echo “Proceeding to clean your system to ensure your privacy.”
echo “Wiping Firefox history and cache.”
sudo srm -rllv .mozilla/firefox/*.default/*.sqlite
sudo srm -rllv .mozilla/firefox/*.default/Cache/*
sudo srm -rllv .mozilla/firefox/*.default/OfflineCache/*
echo “Wiping Ubuntu Trash.”
sudo srm -rllv .local/share/Trash/files
echo “Wiping Recent Documents history.”
sudo srm -rllv .recently-used.xbel

#"ubuntuprivacy" written by commandrine.
#Please send comments and queries to commandrine[at]gmail[dot]com.
#Version 1.0 dated 12th Sept 2009.
#Pre-requisite is having "secure-delete" installed. Install it using "sudo apt-get install secure-delete".

Lazy to create the script. Download it here. More items to be tackled by this script in the near future.

SSLScan

Need to assess your SSL/TLS-enabled webserver to ensure that it is configured securely? Use SSLScan.

commandrine@bridge:~$ sslscan 10.10.10.12

It is an accurate and fast scanner. As seen in the extracted output below, it determines that my test webserver supports the weak SSLv2.

Testing SSL server 10.10.10.12 on port 443

Supported Server Cipher(s):
Accepted SSLv2 168 bits DES-CBC3-MD5
Accepted SSLv2 56 bits DES-CBC-MD5
Accepted SSLv2 40 bits EXP-RC2-CBC-MD5
Accepted SSLv2 128 bits RC2-CBC-MD5
Accepted SSLv2 40 bits EXP-RC4-MD5
Accepted SSLv2 128 bits RC4-MD5