Malware Persistence without the Windows Registry

For an attacker to maintain a foothold inside your network they will typically install a piece of backdoor malware on at least one of your systems. The malware needs to be installed persistently, meaning that it will remain active in the event of a reboot. Most persistence techniques on a Microsoft Windows platform involve the use of the Registry. Notable exceptions include the Startup Folder and trojanizing system binaries. Examining malware persistence locations in the Windows Registry and startup locations is a common technique employed by forensic investigators to identify malware on a host. Each persistence technique commonly seen today leaves a forensic footprint which can be easily collected using most forensic software on the market. - Nick Harbour

M-unition

Owning The Client

Thanks to Jhaddix of http://www.securityaegis.com/ I just now found out about this slick tool called SET(Social Engineering ToolKit). According to the creators, the social-engineer toolkit is a robust python open-source tool to aid security professionals in testing social-engineering attacks. The latest version 0.4, is the biggest release yet incorporating a universal java applet attack as well as many other great features.

Jhaddix does a pretty job of summarizing what the tool does. So I won't recreate the wheel. Suffice to say that after watching the Shmoocon presentation and a couple other videos, the tool is simply awesome. I will definitely be taking a keen interest in its development and progress.

For more information check the creator's(David Kennedy aka ReL1K aka Sac Man) website over at Secmaniac.com. Keep up the GREAT work guys.

The Week That Was(Fri,Feb 19)

The following represent,in no particular order, the stories I found interesting during the past week:

Infrastructure vs Application Security Spending

Abusing WCF to Perform Remote Port Scans

New Russian Botnet tries to kill its larger rival

What's the right IT/Information security certification for me?

How to render SSL useless

Botnet War - No honor among thieves

This I found very interesting. The story is about an upstart Trojan horse program deciding to take on its much-larger rival by stealing data and then removing the malicious program from infected computers.

These guys seem to be in the business of protecting their turf as something similar happened back in 2004.

The Y-Approach

I have been grappling with which IT Security Certification path to take for the past few months now. So when I came across this article I had to take a minute and read it. Incidentally I found this article while reading one of my favorite boards. I am what you would call a newbie to the world of IT Security. And so far I have done the following CEH(Certified Ethical Hacker), OSCP(Offensive Security Certified Professional) and the GPEN - Network Penetration testing.

Having completed the above courses, I now find myself at a cross roads and am uncertain which way to go. What I do know however is that I want to go further down the IT Security rabbit hole. So given my current state of affairs, that of being indecisive, I turned to a few friends for advice. These guys are seasoned IT Security professionals and I hold them in high esteem. Sure enough as the author mentions, they recommended that I do the CISSP, CISA and CISM. Nothing wrong with that, however I don't think I want to tackle those just yet. My inclination is more towards the technical side. I would really love to delve more into the hands on stuff. I am simply fascinated by the work of people like Jerimiah Grossman, Robert Hansen aka @Rsnake to name a few. And would would greatly love to pursue a path along those lines. Eventually starting my own consulting business.

The Y approach seems like something worth looking into given my intentions. As in the end, I want to achieve the best of both worlds i.e. managerial and technical certifications. For now though I will be trying to get some more technical certifications under my belt. I am currently eying the Sans GWAPT - Web Application Penetration Testing. Having come from a developer background this has definitely peeked my interest. The OSCE(Offensive Security Certified Expert) also looks interesting. I must admit that I am leaning towards the Sans certifications track, maybe ending up with the GSE. Sans has some great offerings. But they cost an arm and a leg and would probably require me selling my soul.

Heartland Lessons

The Heartland Payment Systems data breach that resulted in the theft of more than 130 million credit and debit card numbers dominated the news during the past couple of weeks. The company is the world's ninth largest credit processing company. So you would think that they would have taken the necessary precautions to prevent breaches of this nature from occurring. I say this against the backdrop of the breach being due to a sql injection vulnerability. The vulnerability is well understood, and security analysts have warned retailers about it from time immemorial. Sql injection is in fact so popular that it is the most common form of attack against Web sites.

I often felt that hackers employed techniques found only in rocket science manuals. However since becoming a part of the infosec world I have come to the realization that it is in fact not so. Now don't get me wrong some exploits can be looked at as a work of art. And therefore will require some doing. However the majority of attacks do not fall into that category.

This latest incident is testament to that fact. Sql injection is at the script kiddie level of attacks. As there are several tools available that simply require you to point, click and viola you're done.

So when a company like Heartland falls prey to attacks like this it is just unbelievable. Recall that sql injection attacks seek to exploit one of the basic tenets of web application development. And that is you should not trust ANY input from the user.

This article over at Dark Reading should serve as a timely reminder of the impact such vulnerabilities can have and some steps you can take to mitigate against such attacks.

Infiltrating A Botnet

I have always had an interest in Botnets. So when I came upon this article posted by awesec on Ethicalhacker it immediately piqued my interest. Incidentally if you have not already checked out the folks over at ethicalhacker you should go say hello.

So back to the article at hand. A Cisco research team while on an assignment recently, noticed a tremendous number of alerts including IRC activity, far larger than anything that could be benign, were occurring on the customer’s network. It turned out that the machines had been compromised and had become a part of a botnet.

The article explains how they got rid of the Botnet but more interestingly gives some insights into the mind and motives of a botmaster. It really is an interesting read.