Jun

16

JavaScripherTution in{j|f}ection

Filed Under security research, technology, websense | Leave a Comment

This is a cross-post from my company’s blog that I posted today.

The injection of malicious <script src="malicious.js”> JavaScript tags on a massive scale into everyday popular and reputable Web sites, commonly visited by the casual surfer at home (and at work), has been the trend. Today, as my team and I here at Security Labs made our routine rounds around the block to spy on what the bad guys are up to next, we discovered a somewhat weak but interesting piece of malicious code, whose techniques date back to the early days of encryption - the substitution cipher.

Wikipedia has a good introduction on this topic:

In cryptography, a substitution cipher is a method of encryption by which units of plaintext are substituted with ciphertext according to a regular system; the “units” may be single letters (the most common), pairs of letters, triplets of letters, mixtures of the above, and so forth. The receiver deciphers the text by performing an inverse substitution.

Doing a character for character substitution, using a keyword of “MALCODE“, we get:

Plaintext:  ABCDEFGHIJKLMNOPQRSTUVWXYZ
Ciphertext: MALCODEHIJKFBNGPQRSTUVWXYZ

Using that mapping, we can encrypt a message from a hypothetical botnet master to his/her herd of bots from this:

LAUNCH THE DDOS ATTACK NOW

to this:

FMUNLH THO CCGS MTTMLK NGW

It’s a very trivial algorithm, and extremely weak in terms of the protection it provides (by today’s standards), but it is definitely good enough to conceal the true message from casual prying eyes. This was certainly as good as bulletproof during the days of Julius Caesar (wow, we’ve come a long way!).
Read more

Feb

14

Google IE toolbar 404 “hijacking”

Filed Under security research, websense | Leave a Comment

Here is what I did for Valentine’s day at work.

Happy Valentine’s, and don’t let the Google IE toolbar 404 hijackers bite :)

Jan

25

WSL: Parking Page Poker Face

Filed Under security research, websense | Leave a Comment

Yeah, so I’ve been busy and haven’t posted for a while here. But today, I posted a blog for work, so I’m cross-posting it here. Read: recycling information because I am lazy. That’s right, I’ve said it.

What’s in a domain parking?

Wikipedia defines this practice as “an advertising practice used primarily by domain name registrars and internet advertising publishers to monetize type-in traffic visiting an under-developed domain name. The domain name will usually resolve to a page containing relevant advertising listings and links. These links will be targeted to the predicted interests of the visitor and may change dynamically based on the results that visitors click on.”

Or in normal people jargon, random marketing material that is mostly pointless for most people. Typically, our readers immediately navigate away from such pages upon visiting them by accident.

Continue here.

Nov

28

Aquarium of viruses and malware goodness

Filed Under geeky, humor, ideas, security research, websense | Leave a Comment

I love pets but am too busy to tend to one. I could take care of a plant, but I can’t take a cactus for a walk. This, seems to be right within my realm! I do security research for Websense, I don’t know why I didn’t think of this earlier!

(click for bigger)
xkcd-network

xkcd is my kinda comic. It’s funny and nerdy. Hmm.. I wonder how I can implement this.

The flatscreen LCD would be the most expensive. Then I’d need a pretty beefy machine (as host) to run that many virtual machines. For visualization, I guess I need to translate their actions into a network graph; for instance, if one machine DDoS’s another machine, the graphic would show one node firing small bullets at another machine rapidly. This sounds pretty cool, actually! MMmmmmm …………..

Update: I liked it so much I stuck up a print out of it on my cube wall:

IMG_2227

Sep

13

MySpace Phast Phlux Phishing!

Filed Under security research, websense | Leave a Comment

I blogged at work tuh-day. MySpacitizens should check it out .. it’s a short read.

Jun

14

eBay merchant rating hack

Filed Under did you know, security research, websense | Leave a Comment

If you shop on eBay, did you know that their merchant rating system can be gamed to artificially inflate its positive feedback number? This happened on eBay.co.uk, I learned about this and wrote a short blog post for the Security Labs.

Buyers beware. Read more about it here:
http://www.websense.com/securitylabs/blog/blog.php?BlogID=130

Jun

9

Youtube deception malware

Filed Under security research, websense | Leave a Comment

My VP of Security Research just posted a demo of a dodgy piece of code, riding on the Youtube popularity wave. Kind of funny to me, to hear his voice over a Youtube stream. LOL

May

24

Bugs galore!

Filed Under security research, websense | Leave a Comment

I’ve just written another blog post for my company Websense Security Labs, about the recent Month of Bugs trend. You may read about it here:

http://www.websense.com/securitylabs/blog/blog.php?BlogID=126.

Feb

14

Being selfish about your information is a good thing

Filed Under security research, things to ponder about, websense | Leave a Comment

I’ve written a post for my company’s blog. Just some food for thought when it comes to managing your identity information. It is available here:
http://www.websense.com/securitylabs/blog/blog.php?BlogID=111

Dec

10

Things you want to address before they happen

Filed Under strategy, things to ponder about, websense | Leave a Comment

IMG_0751

It rarely rains in San Diego, but it did last night. I guess my car’s brakes were still wet although it was sunny today. As I made a pretty tight corner, jamming my brakes a little hard, I felt the ABS go off and I thought to myself, “wow, am I glad I went with the ABS on this car”. I drive a Mitsubishi Eclipse ‘05 and I remember the day I was debating if I should go with the GTS or the GT trim, the latter not having the ABS and cheaper.

I generally dislike the “scare” tactic used by salesmen. It usually entails providing you reason why if you don’t buy whatever they are selling, then something bad will happen to you.

But if I am going to be like that, then logic follows that I should start thinking about the things I need before I need them. I needed my ABS to stop my car before I hit another car. Surely, I can opt to get the ABS after I hit the car, but then I’d have to pay the financial consequences. So why not take the pre-emptive measure of getting the ABS first? I’m already penalized plenty for car insurance (namely because I am under 25, single, no kids, and drive a 2 door car). I do have a clean driving record, so my preference would be to keep it that way for as long as I can.

The punchline for this post is: What are the things in life that you should address before something undesirable occurs that will affect you, your loved ones, and/or belongings?

The other extreme would be to buy everything a scare tactic tells you. Sure, I could be struck by a meteor the size of Saturn that crashes on my car while I am driving to my hockey game, but what are the odds of that happening? (That was a jab at the insurance telemarketers that try to sell me their load of crap).

Without even feeling a *little* bit guilty for being biased (heh), another thing that comes to mind is my company’s flagship product. You can read all about it from the marketers, but one of the things we do is prevent people from accidentally visiting malicious websites that will silently install malware (trojan horses, viruses, spyware) on your PC. Did you know, just by visiting a link from your e-mail, you could get infected? That’s all it takes. Yes, that was a shameless plug for my company. I work for the Websense Security Labs. You could get a product as such AFTER you have been hit by piece of malware silenty running on your PC, harvesting all your credit card information from all that online shopping, but you’ve just paid the price. And if your Big Corp, Inc. — the damage to your reputation because you lost your customer information will be hard to undo.

There are plenty of examples like these in life, I guess I just need to list them all, and address them as they come. Do share in the comments below. I’ve just enabled Akismet, to combat comment spam. We’ll see how well this thing works!

On another note, I haven’t written anything for 1+ weeks because I was on a trip to Louisiana. Might post some hideous pictures up later. Cheers!