DEFCON featured a number of talks about the Zeus trojan and for good reason. I think it's the most sophisticated mass-use malware ever written. It can keylog, hoard your credit card numbers and even join you to a global botnet. Fun stuff huh?
It's current known variants are Zbot, PRG, Wsnpoem, Gorhax and Kneber.
It can be very difficult to detect and remove because, every time you infect a machine, the signature changes. It's mass customization for malware! The full package comes with a command and control php and sql webcenter for managing your unruly botnet as well as software for generating your very own custom malware. How much would you pay for this crystal-clear wonder? $4999? $3999? Nope it can be yours for the low,low price of $500-$700 on the software black-market. (It should be noted that the latest version may cost you a few thousand).
So why do we care as forensic analysts?
There are a couple pieces here:
1. It steals credentials and credit card data. Steal enough credit card data and the Feds will be hunting for you. This may lead to a forensic analysis of a host and Zeus is being found in the wild at credit card breaches. (I have it from an excellent source....)
2. Most commercial antivirus scanners will not detect or remove Zeus from an infected machine. These scanners are signature based (for the most part) and as I said before "every time you infect a machine, the signature changes".
So now what?
Forensic tools to the rescue!
There are a number of ways to detect Zeus using a fairly common suite of forensic tools. I am not going to rehash someone elses work here. Kevin Stevens and Don Jackson have a fantastic write up on Zeus and its variants at the SecureWorks website.
There is also a forensic breakdown of infected keys and tool usage here. Really nice job Tyler. Most of this paper is based on results from memory analysis using volatility.
And what blog would be complete without mentioning regripper? There is a third-party plugin called userinit that was written to find "urlzone" trojans. As a side effect it parses the same hive that the sdra64 binary attaches itself to (userinit).
That's it for me. I'm spending a lot of time studying for the CISSP exam.
Exciting news next post......
Good Luck.
Thursday, September 9, 2010
Thursday, August 12, 2010
DEFCON 18
I went to DEFCON 18 (Barely Legal) 2 weeks ago. It was a great con and I can't wait for next year. The sheer brainpower on display in that hotel was impressive.
I saw some great presentations on everything from forensic methodology to custom malware, met some feds, and watched ReL1K pwn him some Windows 7 boxes with powershell (seriously nice work on the Social Engineering Toolkit).
I even got to see Hope Dworaczyk (Playmate of the Year) get awarded "Best Reason To Get Malware" by the guys from Barracuda labs. Friggin' sweet!
If you've never been, GO! It's an educational experience to say the least. Seriously, who knew you could get a mohawk to stand up over two feet tall?
There are some very cool things on the horizon for the internet:
Dan Kaminsky demo'd DNSSEC. Finally, a way to actually prove that an email, website or any other electronic communication actually came from who it said it did! Dan is a stinkin' genius by the way. I look forward to his next project, whatever it is.
Anybody heard about this whole "smart grid" thing? It's going to suck. Every single "smart" device out there is going to be a hackers dream. One guy put up a presentation called "iBurglar". It's a webscript that will parse the power usage data that people post on twitter, facebook, etc... It will turn around and produce a calendar of the best times to rob that person. Dude was not a burglar, he was just trying to make a point about how dumb it is to put that kind of personal information out there. It worked! Smart grid + dumb people = problems.
There were several talks about SCADA systems and their importance in the future of cyberwarfare. SCADA systems are web-enabled controls for our public infrastructure that can be tampered with to create"weapons of mass distraction". I doubt that they could ever be used to do any catastrophic damage, but they could be used to throw the general public into a tizzy.
Spiderlabs says "All your droid are belong to us" Thanks for letting me think that my droid was secure for the first 6 weeks I had it anyway......jerks.
More on DEFCON next week.
Did you know that the Zeus trojan has a web command center and a GUI for creating new versions? Ridiculously easy to own your own botnet!
I saw some great presentations on everything from forensic methodology to custom malware, met some feds, and watched ReL1K pwn him some Windows 7 boxes with powershell (seriously nice work on the Social Engineering Toolkit).
I even got to see Hope Dworaczyk (Playmate of the Year) get awarded "Best Reason To Get Malware" by the guys from Barracuda labs. Friggin' sweet!
If you've never been, GO! It's an educational experience to say the least. Seriously, who knew you could get a mohawk to stand up over two feet tall?
There are some very cool things on the horizon for the internet:
Dan Kaminsky demo'd DNSSEC. Finally, a way to actually prove that an email, website or any other electronic communication actually came from who it said it did! Dan is a stinkin' genius by the way. I look forward to his next project, whatever it is.
Anybody heard about this whole "smart grid" thing? It's going to suck. Every single "smart" device out there is going to be a hackers dream. One guy put up a presentation called "iBurglar". It's a webscript that will parse the power usage data that people post on twitter, facebook, etc... It will turn around and produce a calendar of the best times to rob that person. Dude was not a burglar, he was just trying to make a point about how dumb it is to put that kind of personal information out there. It worked! Smart grid + dumb people = problems.
There were several talks about SCADA systems and their importance in the future of cyberwarfare. SCADA systems are web-enabled controls for our public infrastructure that can be tampered with to create"weapons of mass distraction". I doubt that they could ever be used to do any catastrophic damage, but they could be used to throw the general public into a tizzy.
Spiderlabs says "All your droid are belong to us" Thanks for letting me think that my droid was secure for the first 6 weeks I had it anyway......jerks.
More on DEFCON next week.
Did you know that the Zeus trojan has a web command center and a GUI for creating new versions? Ridiculously easy to own your own botnet!
Sunday, July 18, 2010
Ghosts!
I haven't posted in a while so I asked my 6 year old boy what he thought I should write about.
"Ghosts!" was his immediate and emphatic answer. I don't know how to explain to him that my blog is about digital forensics and related topics, so here I am writing about ghosts. A ghost , as I understand it, is a physical manifestation of a person's soul after their body has died. I myself have never witnessed said manifestations, but I have had some pretty damn weird stuff happen to me in one of my homes and in the cave I worked at when I was a teenager. For the record, ghosts don't exist.
Neither do entry-level jobs for forensic analysts without a bachelor's degree.
I may have more luck looking for a forensics job if I ever decide to leave Montana. That's not a decision I ever want to have to make. Simply put, this place rocks! So what's a guy do to try to make himself more marketable? Certification and Education are a good place to start.
I have been studying for the CISSP exam for the last several weeks and plan to take the exam in September. CISSP also counts for several credits towards a Bachelor's degree in Information Assurance and Security.
Bonus!
I Hated (yes, capital H) high school but I tried to go to community college right afterward, anyway. I wound up feeling like it was just an even more miserable extension of the former so I withdrew (dropped out) midway through my second semester and joined the Navy. I got lots of training in the Navy that I actually enjoyed, like math, science, electronics, computers, etc. After I got out, I took some Microsoft courses and took all the MCSE tests. I enjoyed those classes as well. Now I have 12 years of experience and a fistful of certificates from formal training as well as the GCFA cert and my MCSE.
It's time to go back and rectify the whole "dropped out" thing. I'm looking at a couple of the online colleges and gearing up to knock out a degree as fast as I can. I look at the curriculum and it causes me pain to have to take "Windows Server Networking" since I could likely teach the course. But it has to be done. I'm no longer running into job postings that state "or equivalent experience".
Wish me luck.
I'll need it to stay awake for "Introduction to Unix"
P.S. I'm going to get back to some more technical posts in the near future. I have a few system images to run through and post about.
"Ghosts!" was his immediate and emphatic answer. I don't know how to explain to him that my blog is about digital forensics and related topics, so here I am writing about ghosts. A ghost , as I understand it, is a physical manifestation of a person's soul after their body has died. I myself have never witnessed said manifestations, but I have had some pretty damn weird stuff happen to me in one of my homes and in the cave I worked at when I was a teenager. For the record, ghosts don't exist.
Neither do entry-level jobs for forensic analysts without a bachelor's degree.
I may have more luck looking for a forensics job if I ever decide to leave Montana. That's not a decision I ever want to have to make. Simply put, this place rocks! So what's a guy do to try to make himself more marketable? Certification and Education are a good place to start.
I have been studying for the CISSP exam for the last several weeks and plan to take the exam in September. CISSP also counts for several credits towards a Bachelor's degree in Information Assurance and Security.
Bonus!
I Hated (yes, capital H) high school but I tried to go to community college right afterward, anyway. I wound up feeling like it was just an even more miserable extension of the former so I withdrew (dropped out) midway through my second semester and joined the Navy. I got lots of training in the Navy that I actually enjoyed, like math, science, electronics, computers, etc. After I got out, I took some Microsoft courses and took all the MCSE tests. I enjoyed those classes as well. Now I have 12 years of experience and a fistful of certificates from formal training as well as the GCFA cert and my MCSE.
It's time to go back and rectify the whole "dropped out" thing. I'm looking at a couple of the online colleges and gearing up to knock out a degree as fast as I can. I look at the curriculum and it causes me pain to have to take "Windows Server Networking" since I could likely teach the course. But it has to be done. I'm no longer running into job postings that state "or equivalent experience".
Wish me luck.
I'll need it to stay awake for "Introduction to Unix"
P.S. I'm going to get back to some more technical posts in the near future. I have a few system images to run through and post about.
Monday, June 7, 2010
CDAC Cybersecurity: Incident Handling and Response
So, what's a guy with lots of computer skillz and a shiny new GCFA certificate do for fun? He goes to FEMA Cybersecurity training! I know you're all jealous, admit it.
These classes are free if you can catch one in your area, but I can honestly say that I didn't learn anything new in this class. It did reinforce a lot of prior learned techniques and I got another certificate for my "I Love Me" wall.
Here it is in a nutshell:
Day 1:
We covered the basics of Network Security. Access Control, Physical Security and Biometrics, Social Engineering.
Risk Assesment and Business Continuity Planning, Information Classifications, Privileges and Auditing.
Lab on setting Password complexity and length. (Yah, pretty weak stuff)
Device Hardening, Firewalls, Secure Protocols.
Lab on Packet capture and Network Monitoring. (not bad, but not in-depth enough to teach what you're actually looking at. I already know the how-to's)
These classes are free if you can catch one in your area, but I can honestly say that I didn't learn anything new in this class. It did reinforce a lot of prior learned techniques and I got another certificate for my "I Love Me" wall.
Here it is in a nutshell:
Day 1:
We covered the basics of Network Security. Access Control, Physical Security and Biometrics, Social Engineering.
Risk Assesment and Business Continuity Planning, Information Classifications, Privileges and Auditing.
Lab on setting Password complexity and length. (Yah, pretty weak stuff)
Device Hardening, Firewalls, Secure Protocols.
Lab on Packet capture and Network Monitoring. (not bad, but not in-depth enough to teach what you're actually looking at. I already know the how-to's)
Tuesday, May 25, 2010
Training, conferences and contacts. Oh My!
Professional development: The process of increasing the professional capabilities of one's self by attending training or meetings of like-minded professionals who are willing to share information and techniques.
This week I'm attending a FEMA course called "Cybersecurity: Incident Handling and Response". So far it has been review but it looks promising for the next 3 days. It is a free course if one is in your area but seating is limited. I recommend checking it out. I'll provide a full review after the course is over.
If you've been following the blog you know that I am a major proponent of professional networking. It's a great way to meet people that you may be able to employ or gain employment from, there are also lots of people that just know a lot about security, forensics, hacking, etc. that are willing to share ideas and tips. I had no idea that there was already a group of these people that meet regularly here in Helena and have for some time. 2 hours into class and I had an invite to the local DEFCON group. First Friday of the month at the best sandwich shop in town? Done. It simply can't hurt to get yourself known inside local circles.
Speaking of DEFCON, I'll be attending in Las Vegas this year. It will be the first time I've ever attended any kind of hacking conference and I'm pretty stoked to check it out.
This week I'm attending a FEMA course called "Cybersecurity: Incident Handling and Response". So far it has been review but it looks promising for the next 3 days. It is a free course if one is in your area but seating is limited. I recommend checking it out. I'll provide a full review after the course is over.
If you've been following the blog you know that I am a major proponent of professional networking. It's a great way to meet people that you may be able to employ or gain employment from, there are also lots of people that just know a lot about security, forensics, hacking, etc. that are willing to share ideas and tips. I had no idea that there was already a group of these people that meet regularly here in Helena and have for some time. 2 hours into class and I had an invite to the local DEFCON group. First Friday of the month at the best sandwich shop in town? Done. It simply can't hurt to get yourself known inside local circles.
Speaking of DEFCON, I'll be attending in Las Vegas this year. It will be the first time I've ever attended any kind of hacking conference and I'm pretty stoked to check it out.
Thursday, May 6, 2010
Baby Steps
Getting into digital forensics is a tough job. Writing about it regularly is even tougher. Since passing the exam, I have been working on a marketing package to pass out around town, had meetings with my bosses trying to convince them that "Yah. Really. We can charge $225/hr and up for these services", landed my first official retainer fee, set up a proposal for e-discovery work and performed my regular myriad of break-fix, server upgrade and auditing work. I've also helped produce an outline for a book idea with my good friend and forensic-y mentor Chris and sent in a column idea to Into the Boxes. It's been a bit of a whirlwind, but never you mind. I live to serve.
I was contacted by a civil defense lawyer about the feasibility of admitting all the content of a Yahoo user group into court. I mulled it over a bit and tried out a few techniques I've learned over the years for dumping websites, did a little proof-of-concept and turned in an estimate for work. This could turn into a significant amount of work sorting, searching and carving usable info for the defense. I accomplished my proof of concept using a combination of freebie web tools and some yellow-belt linux kung-fu. If I land it and wind up doing all the work I'll be sure to post a more in depth analysis.
I updated my resume, wrote a Curriculum Vitae, created a sheet of services my company can offer and turned it all over to our technical writers and marketing people. I hope I don't get a pile of useless mush with pretty colors back.
Tuesday, April 20, 2010
It can be done!
91.3% Well above the passing grade. It feels good to earn a certification like GCFA. Especially when there are only ~2000 in the entire world.
So what's next?
I've been in study mode for several months so I've decided to just keep on going and start studying for the CISSP exam. I was studying for the exam about 3 years ago when I changed jobs. At the time there was no need for me to carry a certification like that and my company wasn't really interested so I dropped it. I wish I had just forged ahead alone and done it. At any rate, I still have the "All-in-One" CISSP study guide and I'll be ready for the test in a few more months.
I'm also going to start working my local contacts for some forensics work and push towards "Expert Witness" status. It will be a big deal to get a few cases on my Curriculum Vitae and be able to help out some of the area lawyers with cases involving computers, media and any other digital devices. Mobile forensics seems like a niche worth exploring although I can't imagine a lot of steady work coming from it.
I was invited to contribute to "Into the Boxes" which is pretty exciting. I would love to contribute but I'm having a hard time coming up with a topic that won't make me seem like the village idiot compared to the rest of the guys writing for it. I'm open to suggestions on that front.
Chris has started a new blog series on command line vs. GUI tools. I may play devils advocate just for fun. We'll see what he posts later in the week.
Keep studying, keep practicing, I'm still here to help.
Grayson
So what's next?
I've been in study mode for several months so I've decided to just keep on going and start studying for the CISSP exam. I was studying for the exam about 3 years ago when I changed jobs. At the time there was no need for me to carry a certification like that and my company wasn't really interested so I dropped it. I wish I had just forged ahead alone and done it. At any rate, I still have the "All-in-One" CISSP study guide and I'll be ready for the test in a few more months.
I'm also going to start working my local contacts for some forensics work and push towards "Expert Witness" status. It will be a big deal to get a few cases on my Curriculum Vitae and be able to help out some of the area lawyers with cases involving computers, media and any other digital devices. Mobile forensics seems like a niche worth exploring although I can't imagine a lot of steady work coming from it.
I was invited to contribute to "Into the Boxes" which is pretty exciting. I would love to contribute but I'm having a hard time coming up with a topic that won't make me seem like the village idiot compared to the rest of the guys writing for it. I'm open to suggestions on that front.
Chris has started a new blog series on command line vs. GUI tools. I may play devils advocate just for fun. We'll see what he posts later in the week.
Keep studying, keep practicing, I'm still here to help.
Grayson
Subscribe to:
Posts (Atom)