Ethan Frome macro virus at Disney

 malware  4 Responses »
Feb 022009
 

Hopefully I won’t be asked to take this one down:

I was just looking for hours of operation for the Picabu buffet/cafeteria here at Disney’s Dolphin resort while I’m here for the SANS SCADA Summit.  I just can’t do anything anymore without stumbling across something security related, I guess.

If you haven’t spotted what’s “wrong” in the above image, don’t feel bad.  It’s an oldie but goodie:

This is a Word 97 (yeah, the nineties) macro virus that will randomly change the names of documents you create to “Ethan Frome”.  The computer used to create the document is infected with it.  Don’t panic though, because:

  • The document above has been exported to PDF, so it‘s safe isn’t spreading the Ethan Frome macro virus.
  • There only seems to be one malicious variant of this macro virus, and it modifies your autoexec.bat (lol) to format your C: drive…

Not much more than a curiosity :) .  I have a friend who had the misfortune of having his resume retitled “Ethan Frome” from this same macro virus several years ago.  He didn’t realize it till I pointed it out.  Funny stuff.

I met some great people at the Summit today (or rather, yesterday.  It’s late.), and I’m looking forward to attending some more talks in the morning.

 Posted by wesley at 11:39 pm

Sorry for those trying to get at the slides

 Uncategorized  No Responses »
Feb 022009
 

I’ve had to (at least temporarily) remove the slides from my previous post.  

Hopefully they’ll be back in at least some form at some point.

Edit: A few folks have asked: SANS did not ask for the slides to be removed.  They’re totally cool, and have been great to me and the other speakers during this conference.

 Posted by wesley at 1:53 pm

SCADA/HMI Security: Vulnerabilities in GE Fanuc iFIX

 SANS, SCADA  4 Responses »
Feb 012009
 

I’m all settled in at the Walt Disney Dolphin resort hotel, registered for the SANS SCADA Summit, and just finished up going over my slides one more time.

I’m going to go ahead and make the slides available now, so anyone interested in attending the talk tomorrow can go ahead and get them.  If you’re not at the Summit, then here’s your little slice of it:

  • Sorry, not here anymore (right-click, save as)

It’s about 3 megs (pictures :) , and they compressed ugly when I tried).

<redacted>

Edit: A few folks have asked: SANS did not ask for the slides to be removed.  They’re totally cool, and have been great to me and the other speakers during this conference.

 Posted by wesley at 10:47 pm

Gustavo Duarte's Great Internals Series

 hardware, links  4 Responses »
Jan 272009
 

I’ve spent some time looking at these posts over on Gustavo Duarte’s blog today, and I am very impressed.  Gustavo has taken the time to write an entire series of posts on x86 internals, focusing on how memory works and the boot-up process.  He uses Linux and, to a lesser extent, Windows in his examples, and has really great illustrations and diagrams of all the concepts.  Combine that with an excellent writing style and links to good reference material, and you have one of the most accessible and readable introductions to these topics that I’ve ever seen.  

Here are links to the topics from his “Internals” series, although his other writings are worth checking out too:

These are core concepts for those in the areas of vulnerability analysis, exploit development, and (good) penetration testing to know, so read up :) .

I ran across this blog from a link to the most recent post earlier this morning, and unfortunately I spent enough time at the site that I can’t even remember now where I found it.  Otherwise I would give some credit to person I’m following on twitter or RSS that linked it.  If that person happens to be you, leave a comment to claim your fame :) .

 Posted by wesley at 4:24 pm

HMI Vulnerabilities at SANS SCADA Summit 2009

 SCADA  7 Responses »
Jan 262009
 

The agenda for the SANS Process Control & SCADA Security Summit 2009 has changed a bit and it’s definitely for the better.  I am now scheduled for a session at 1:40 PM, on Monday, February 2nd: In-Depth Discussion: SCADA HMI Software Security Threats with Wesley McGrew.

I plan on using this session to present a talk entitled “Vulnerabilities in SCADA Human-Machine Interface Software”:

In this presentation, I will discuss the attack surface of HMI software, why it might be an attractive target for attackers (and penetration testers!), and how these risks might be mitigated, both by software vendors and end users.  

As an example during this presentation, I will be going through the details of a specific set of vulnerabilities in a widely-used HMI software product.  These vulnerabilities were disclosed to the vendor about 6 months ago, and this will be the first time that they will see public disclosure.  The problems are fundamental to the architecture of this product, easy to understand and follow, and serve as an excellent illustration of the points we’ll be discussing in this session :-) .

If you’re interested in how HMI software fits into SCADA security, a user or developer of HMI software looking for mitigation strategies, or a penetration tester looking for new ways of testing target systems, then I think this would be an interesting talk for you to attend at the Summit.  I’m going to try to keep things interactive with the attendees, and I think we’re going to have a lot of fun.

Get in touch with me if you plan on attending this talk!  I’d love to hear from you.  I’ll also have the slides posted here on my blog once the talk is over.

 Posted by wesley at 5:20 pm

Santa Claus is Hacking to Town Challenge Results

 exploitation, fun, links, vulnerabilities, web  1 Response »
Jan 212009
 

Over at the excellent ethicalhacker.net site, the results of the Santa Claus is Hacking to Town Skillz Challenge have been posted:

These challenges are a lot of fun, and educational as well.  Ed Skoudis puts a lot of effort into writing and judging them.  There’s a whole archive of previous challenges available here, and I highly recommend at least reading through, if not working through, some of the previous challenges.  

This time around, I managed to get an honorable mention for my entry!  I’m very happy with this.  I was unable to test the Windows-centric parts of my solution before I had to submit it and move on to real work, so that part wasn’t %100, but I did have a really solid way of getting netcat onto the web server via the command-injection-vulnerable script, and some nice netcat pivoting.  

Oh, and apparently I’m a security stud! :

We had entries from notable security studs like Wesley McGrew, Raul Siles, Ryan Linn, Mark Baggett, Zoher Anis, Paul Tartar, and others.

I might put “notable security stud” on some business cards, or maybe a button, now.

 Posted by wesley at 8:58 am

Dale Beauchamp on RAM forensics for incident handlers

 forensics  No Responses »
Jan 132009
 

Marcus J. Carey has uploaded videos from January 8th’s DojoSec event to his Vimeo account here.  I just watched Dale Beauchamp’s talk, “Practitioner’s Guide to Capturing and Analysis of RAM”, and enjoyed it.  It’s definitely worth watching, especially if you’re coming at this from the perspective of an incident handler.  He presents a few Windows memory imaging tools that can be run on a live-and-logged-in system, but a lot of the analysis also applies if you’re dealing with images created by msramdmp in a cold boot attack.


Dale Beauchamp – DojoSec January 2009 from Marcus J. Carey on Vimeo.

 Posted by wesley at 2:36 pm

Wesley at the SANS SCADA Summit 2009

 SANS, SCADA  2 Responses »
Jan 122009
 

I will be in attendance and talking at the SANS Process Control and SCADA Security Summit 2009, at the Walt Disney World Dolphin hotel.  I have been invited to take part in the keynote discussion panel on the topic of security issues surrounding the smart grid and Automated Metering Systems.  I’m in very good company on this panel, with three top-tier co-panelists:

I’m looking forward to discussing control system security with these guys, and I’ll try to keep up!.  I’m also going to be involved in an interactive workshop on the topic of wireless threats with Matt Carpenter later on in the first day.  If you’re looking for me outside of my talks, I’ll be attending as many other talks as possible, and trying to network with other penetration testers :) .

If any of my readers are going to be attending the summit, please get in touch with me!  I’d love to meet you, and would be happy to talk to you at length about my current SCADA security research interest: vulnerabilities in Human Machine Interface (HMI) products.

 Posted by wesley at 3:31 pm

Looking at the Crackpal.com Phishing-For-Hire Scheme

 email, phishing, web  9 Responses »
Jan 082009
 

Yesterday, I took a lighthearted look at some of the Google searches people have used to arrive at this site.  I saved one of them for today, however, because it was enough fun to warrant its own post.  That search query is:

  • crackpal.com review

Well, I suppose I can give that a try.

What is crackpal.com?  It’s a service that promises to hack yahoo, hotmail, rediff, and google Email accounts.  Here’s what their website looks like, if it’s down by the time you read this:

You might remember that I’ve looked at a site similar to this in a previous post.  Here’s how things are supposed to go down, according to their site:

The proof takes the form of screenshots of inboxes, sample emails, contacts, or other personal information.

I decided to see how this would play out, assuming (correctly) that it would work much like the yourhackers.net scheme described in a previous post.  So, yesterday I filled out their order form, using my own yahoo email account as a target, from another account that I had created that is posing as someone who doesn’t like me very much:

This morning, in the wesleymcgrew@yahoo.com account I had a “surprise”!  Yay!

“Helo”?  What am I, an SMTP server?  As you might be able to imagine, I don’t know anyone named Jonathan Regon, and certainly not well enough to warrant “Luv and Regards”.  Let’s take a look at the link to the phishing site:

So, obviously the single “?wesleymcgrew” parameter sets the username.  If you punch in anything and Submit, you get forwarded along to a real 123greetings card:

Cute.

Back to the phishing site, what happens if we take the php filename out of the URL, going straight to the directory?

Neat, no directory protection or index.html/php, but not much of interest.  What if we go up a directory?

Now this looks more interesting.  What’s in Y.txt?

The phishing URL sent to me contained the directory name ending in “1003″.  That corresponds with the “1003″ line in Y.txt with the name “Jonathan Reagan”.  Sounds like the Jonathan “Regon” that emailed me.  These are the names being used in the phishing emails, and  each of the above directories contains links to greeting cards from these names.

The “/Y/” here stands for Yahoo.  There are similar directory structures on this site for “/H/” (Hotmail) and “/R/” (Rediff).  There is no “/G/” for Gmail, surprisingly, and no other single-letter directories (tried them all).

Who is 123newgreetings.com?  WHOIS shows all contacts as:

Registrant:

    123Greetings.com, Inc.

    Kajaria, Sharad        (greetings123name@yahoo.com)

    1674 Broadway

    Suite 403

    10019

    New York,10019

    US

    Tel. +001.9176036425

This is the exact same contact information as on the real 123greetings.com, with a different email and phone number.

Crackpal.com’s WHOIS information is set to its registrant’s (dynadot.com) private registration-by-proxy name and address.

I have fired off an abuse email to 123newgreetings.com’s host, eukhost.com, so it may be down soon.  Crackpal.com itself appears to be hosted in China, so I don’t hold out much hope for that going down. 

In conclusion:

 Posted by wesley at 3:50 pm

Poking around my Google search referrals

 fun, web  3 Responses »
Jan 072009
 

Every night, Analog generates a summary of this site’s logs from the past seven days, and when I bother to check it, it’s an entertaining read.  My favorite part is the “Search Query Report”, which scrapes through my logs, pulling out the search terms people are using on Google (and other search engines) to get to my site.  I think it’s an interesting form of “pre-viewing feedback”, or, more clearly, a reflection of what people are expecting to see when they click a link to go to my site.

Today, I’ve decided to have a bit of fun, share a few of the funnier/more-interesting recent queries, and respond to them.  After all, it is my place to please my new readers ;) :

  • 0×000000 the hacker webzine dead
    • Is it?  It is down.  That’s a shame, I enjoyed reading the articles there, and hadn’t noticed that my RSS reader hasn’t picked up new posts since September.
  • script kiddies haven
    • That is exactly what you have found here at McGrewSecurity.com ;-)
  • personal password management
    • In an early post to this site, I discussed using Pwman3 with a hack I described to make it use pwgen as a password generator.  Nowadays, however, I highly recommend KeePassX.  It works great on OS X, Windows, and Linux.
  • describe ram images
    • Well, I’ll give it a shot:  A RAM image would be a byte-for-byte copy of the contents of RAM at some point in time.  A snapshot in time, if you will.  It’s likely to contain code and data (such as text, images, and even passwords) that were in memory at the time of the image-taking.  You can make one yourself with one of my tools, msramdmp, now that you understand what you are creating.
  • trend micro boycott
  • sans security training rapidshare links, (among other searches for pirated SANS materials)
    • Oooh naughty naughty.  I know it must be expensive to travel to SANS conferences from Saudi Arabia, but perhaps you could do the @Home options.
  • how can i dig up root fs on runescape
  • how to make a runescape phisher
    • I get a lot of search hits from people who are looking for phishing kits. Are these things really that hard to make?  I don’t think so.  A lot of the ones that are out there and available to download also secretly shuffle off the passwords to hurr_ima_hacker@yahoo.com as well.  Phishers phishing phishers.
  • yousif yalda docs
    • A lot of searches like this.  There’s no shortage of people out there mad at this guy.  If you’re new here, you can have some laughs here, here, and here.

This was fun to put together, so I’ll do it again sometime when I gather up more of these interesting search terms.

 Posted by wesley at 3:39 pm
 Older Entries  Newer Entries
© 2012 McGrew Security Suffusion theme by Sayontan Sinha