Jun

16

JavaScripherTution in{j|f}ection

Filed Under security research, technology, websense | Leave a Comment

This is a cross-post from my company’s blog that I posted today.

The injection of malicious <script src="malicious.js”> JavaScript tags on a massive scale into everyday popular and reputable Web sites, commonly visited by the casual surfer at home (and at work), has been the trend. Today, as my team and I here at Security Labs made our routine rounds around the block to spy on what the bad guys are up to next, we discovered a somewhat weak but interesting piece of malicious code, whose techniques date back to the early days of encryption - the substitution cipher.

Wikipedia has a good introduction on this topic:

In cryptography, a substitution cipher is a method of encryption by which units of plaintext are substituted with ciphertext according to a regular system; the “units” may be single letters (the most common), pairs of letters, triplets of letters, mixtures of the above, and so forth. The receiver deciphers the text by performing an inverse substitution.

Doing a character for character substitution, using a keyword of “MALCODE“, we get:

Plaintext:  ABCDEFGHIJKLMNOPQRSTUVWXYZ
Ciphertext: MALCODEHIJKFBNGPQRSTUVWXYZ

Using that mapping, we can encrypt a message from a hypothetical botnet master to his/her herd of bots from this:

LAUNCH THE DDOS ATTACK NOW

to this:

FMUNLH THO CCGS MTTMLK NGW

It’s a very trivial algorithm, and extremely weak in terms of the protection it provides (by today’s standards), but it is definitely good enough to conceal the true message from casual prying eyes. This was certainly as good as bulletproof during the days of Julius Caesar (wow, we’ve come a long way!).
Read more

Feb

21

Volatile memory hacks circumvents encryption filesystem!

Filed Under security research, technology | Leave a Comment

This is pretty darn cool. I never thought of immediately taking RAM out and freezing it. The fading picture of the graphic as the capacitors lose their charge is also pretty cool. You read the theory of why RAM is volatile memory but you don’t actually get to see it in action (or at least, I didn’t!)

Coverage from news.com

Feb

14

Google IE toolbar 404 “hijacking”

Filed Under security research, websense | Leave a Comment

Here is what I did for Valentine’s day at work.

Happy Valentine’s, and don’t let the Google IE toolbar 404 hijackers bite :)

Jan

25

WSL: Parking Page Poker Face

Filed Under security research, websense | Leave a Comment

Yeah, so I’ve been busy and haven’t posted for a while here. But today, I posted a blog for work, so I’m cross-posting it here. Read: recycling information because I am lazy. That’s right, I’ve said it.

What’s in a domain parking?

Wikipedia defines this practice as “an advertising practice used primarily by domain name registrars and internet advertising publishers to monetize type-in traffic visiting an under-developed domain name. The domain name will usually resolve to a page containing relevant advertising listings and links. These links will be targeted to the predicted interests of the visitor and may change dynamically based on the results that visitors click on.”

Or in normal people jargon, random marketing material that is mostly pointless for most people. Typically, our readers immediately navigate away from such pages upon visiting them by accident.

Continue here.

Jan

25

Infecting malware with malware

Filed Under ideas, security research | Leave a Comment

This story on \. today reminds me of a “what if” thought that I’ve had once before.

Wired story about scientists who plan to use genetically modified mosquitoes to reduce the population of Dengue-carrying insects. The altered genes cause newly born mosquitoes to die before they are able to breed if they are not supplied with a crucial antibiotic. This is a more aggressive approach than the anti-Malaria work we discussed last year

In the security arms race against black-hat hackers, it’s common for them to copy our security measures and use it against us. Perhaps it’s time we did the same. What if we made malware to infect their malware? I mean, they make malicious stuff to infect victims, so how about us infecting their malware with our payload (malware for malware? If the two terms cancel out, does that make it goodware?) — just like the genetically modified mosquitoes?
Read more

Nov

28

Aquarium of viruses and malware goodness

Filed Under geeky, humor, ideas, security research, websense | Leave a Comment

I love pets but am too busy to tend to one. I could take care of a plant, but I can’t take a cactus for a walk. This, seems to be right within my realm! I do security research for Websense, I don’t know why I didn’t think of this earlier!

(click for bigger)
xkcd-network

xkcd is my kinda comic. It’s funny and nerdy. Hmm.. I wonder how I can implement this.

The flatscreen LCD would be the most expensive. Then I’d need a pretty beefy machine (as host) to run that many virtual machines. For visualization, I guess I need to translate their actions into a network graph; for instance, if one machine DDoS’s another machine, the graphic would show one node firing small bullets at another machine rapidly. This sounds pretty cool, actually! MMmmmmm …………..

Update: I liked it so much I stuck up a print out of it on my cube wall:

IMG_2227

Sep

13

MySpace Phast Phlux Phishing!

Filed Under security research, websense | Leave a Comment

I blogged at work tuh-day. MySpacitizens should check it out .. it’s a short read.

Aug

24

The most dangerous animal to hunt of all

Filed Under security research | Leave a Comment

An interesting thought by Paul Vixie that I stumbled upon while I was incident handling yesterday.

Basically he compares the botnet problem to the human health virus/bacteria problem. Medical antibiotics are great but viruses eventually develop an immunity towards it. Then we are forced to come up with something better. He says that minor incremental stopgap measures against botnet herders cause more trouble in the long run:

Annoying botnet handlers educates them. Don’t do that! Let them succeed at what they try, but watch their every move. Learn to predict what they will do next. Learn how they did whatever they’ve done. Learn who they are. Learn where they live, and where their money comes from. Let them have a wonderful, annoyance-free life, right up to the instant that the front door of their apartment is kicked in and the handcuffs go on. Don’t create more antibiotic-resistant superbugs. Don’t teach them how to be more careful next time, on a painless incremental basis.

Botnet herders are humans just like us, who can think and problem-solve. It’s true that the most dangerous animal to hunt of all, is ourselves.

Full post is here.

Jun

14

eBay merchant rating hack

Filed Under did you know, security research, websense | Leave a Comment

If you shop on eBay, did you know that their merchant rating system can be gamed to artificially inflate its positive feedback number? This happened on eBay.co.uk, I learned about this and wrote a short blog post for the Security Labs.

Buyers beware. Read more about it here:
http://www.websense.com/securitylabs/blog/blog.php?BlogID=130

Jun

9

Youtube deception malware

Filed Under security research, websense | Leave a Comment

My VP of Security Research just posted a demo of a dodgy piece of code, riding on the Youtube popularity wave. Kind of funny to me, to hear his voice over a Youtube stream. LOL

May

24

Bugs galore!

Filed Under security research, websense | Leave a Comment

I’ve just written another blog post for my company Websense Security Labs, about the recent Month of Bugs trend. You may read about it here:

http://www.websense.com/securitylabs/blog/blog.php?BlogID=126.

Feb

14

Being selfish about your information is a good thing

Filed Under security research, things to ponder about, websense | Leave a Comment

I’ve written a post for my company’s blog. Just some food for thought when it comes to managing your identity information. It is available here:
http://www.websense.com/securitylabs/blog/blog.php?BlogID=111