Malware Devil

Saturday, November 14, 2020

DEF CON 28 Safe Mode Voting Village Village – Amélie Koran’s ‘Hacking Democracy II: On Securing An Election’

Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization’s DEFCON 28 SAFE MODE Conference, and on the DEF CON YouTube channel. Enjoy!

Permalink

The post DEF CON 28 Safe Mode Voting Village Village – Amélie Koran’s ‘Hacking Democracy II: On Securing An Election’ appeared first on Security Boulevard.

Read More

The post DEF CON 28 Safe Mode Voting Village Village – Amélie Koran’s ‘Hacking Democracy II: On Securing An Election’ appeared first on Malware Devil.



https://malwaredevil.com/2020/11/14/def-con-28-safe-mode-voting-village-village-amelie-korans-hacking-democracy-ii-on-securing-an-election/?utm_source=rss&utm_medium=rss&utm_campaign=def-con-28-safe-mode-voting-village-village-amelie-korans-hacking-democracy-ii-on-securing-an-election

Weekly News Roundup — November 8 to November 14

Hello and welcome to Sec Soup, where the weekly newsletter has a collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

Threat Research 

Tools and Tips

Breaches, Government, and Law Enforcement 

Vulnerabilities and Exploits

Read More

The post Weekly News Roundup — November 8 to November 14 appeared first on Malware Devil.



https://malwaredevil.com/2020/11/14/weekly-news-roundup-november-8-to-november-14/?utm_source=rss&utm_medium=rss&utm_campaign=weekly-news-roundup-november-8-to-november-14

XKCD ‘Set In The Present’

via the comic delivery system monikered Randall Munroe resident at XKCD !

via the comic delivery system monikered Randall Munroe resident at XKCD!

Permalink

The post XKCD ‘Set In The Present’ appeared first on Security Boulevard.

Read More

The post XKCD ‘Set In The Present’ appeared first on Malware Devil.



https://malwaredevil.com/2020/11/14/xkcd-set-in-the-present/?utm_source=rss&utm_medium=rss&utm_campaign=xkcd-set-in-the-present

Memory buffers for… initiated, part 3 – Frida(y) edition

Okay, we can dump heap buffers. What’s next? What about a sandbox-like, IOC generator & payload dumper? In its most basic version we will run a sample and our handlers […]
Read More

The post Memory buffers for… initiated, part 3 – Frida(y) edition appeared first on Malware Devil.



https://malwaredevil.com/2020/11/14/memory-buffers-for-initiated-part-3-friday-edition-3/?utm_source=rss&utm_medium=rss&utm_campaign=memory-buffers-for-initiated-part-3-friday-edition-3

Where all the Cyber Tooth Fairies go?

One of my favorite TV Series is Dexter. Early seasons were so-so, focused on a cheap thrill, lame TV that you can see all over the place. As the series […]
Read More

The post Where all the Cyber Tooth Fairies go? appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/where-all-the-cyber-tooth-fairies-go-3/?utm_source=rss&utm_medium=rss&utm_campaign=where-all-the-cyber-tooth-fairies-go-3

2020-11-13 – Traffic Analysis Exercise – Quiethub.net

Read More

The post 2020-11-13 – Traffic Analysis Exercise – Quiethub.net appeared first on Malware Devil.



https://malwaredevil.com/2020/11/14/2020-11-13-traffic-analysis-exercise-quiethub-net/?utm_source=rss&utm_medium=rss&utm_campaign=2020-11-13-traffic-analysis-exercise-quiethub-net

Memory buffers for… initiated, part 3 – Frida(y) edition

Okay, we can dump heap buffers. What’s next? What about a sandbox-like, IOC generator & payload dumper? In its most basic version we will run a sample and our handlers […]
Read More

The post Memory buffers for… initiated, part 3 – Frida(y) edition appeared first on Malware Devil.



https://malwaredevil.com/2020/11/14/memory-buffers-for-initiated-part-3-friday-edition-2/?utm_source=rss&utm_medium=rss&utm_campaign=memory-buffers-for-initiated-part-3-friday-edition-2

Memory buffers for… initiated, part 3 – Frida(y) edition

Okay, we can dump heap buffers. What’s next?

What about a sandbox-like, IOC generator & payload dumper? In its most basic version we will run a sample and our handlers will spit out all the file names of files being opened by the analyzed program. They will also dump file buffers read to and written from. And for a good measure, we will try to convert some of the file creation flags/arguments passed to the APIs so we can get a more readable log.

To dump a list of files being opened by APIs I will focus on handling CreateFileA, and CreateFileW APIs. I chose these APIs for a couple of reasons:

  • They are very commonly used and are easy to test
  • CreateFileA & CreateFileW exist inside kernel32.dll
  • CreateFileA & CreateFileW exist inside kernelbase.dll
  • you may hook them all, and you may also want to choose either of them; of course, too many hooks is not good, hence there are challenges introduced by this duplication

Same as with buffers, we will store file handles in a table at the time file is created / opened. We will then lookup these handles at the time of file reading and writing so we can log actual file names in our logs, as opposed to just file handles. In my old sandbox I used a code inject that was relying on NtQueryObject executed in a context of a target process, but then again – I had to inject my code into that process, hook APIs before the malicious implant took over. Pretty complicated.

Anyway… since we can map file handles to file names we can now output the content of buffers/arguments to appropriate files (one file will store list of files/objects and the other one – actual file buffers). And for the fun of it, we will file buffers in hex + will include PID and TID, and of course a file name in our log:

The list of objects (and file handle to file name mapping) created using CreateFile APIs will be stored inside objects_list.txt file:

You may notice that some of them are 0xFFFFFFFF — these failed to open. It’s an interesting result – you will not only see existing files being accessed, but also these that don’t. Let me reiterate — these are calls to CreateFile API to access _some_ files or directories that may not be present on the system. Pretty much like Procmon, but a bit easier to read and far easier to mod the output to our needs. Such log’s value in security research cannot be overstated — it can help finding references to non-existing files, phantom libraries, anti-debugging strings e.g. device names, etc..

Finally, our attribute/flags resolution code works as well:

The screenshot below shows how this works in practice – the dwDesiredAccess’s value of 0x80000000 is translated to ‘GENERIC_READ’:

Now, before we get too excited about our ‘building our own sandbox experience’… let me mention that there are caveats. One of them is that Frida doesn’t work all the time. For the benefit of this article, I tried to run my handlers over pafish.exe executable and… it just got stuck:

I wanted to test pafish, because it refers to a number of devices associated with guest OS devices that help to detect a virtualization:

and

– so I thought I can output all these referenced device names and show how cool the handlers can be. Then the main pafish.exe process got stuck and that’s about it. So, you have been warned.

Still, I have never worked with such rapid prototyping & hooking engine in one. It’s amazing what you can do with a few lines of JavaScript.

You can download my testhandlers from here.

Read More

The post Memory buffers for… initiated, part 3 – Frida(y) edition appeared first on Malware Devil.



https://malwaredevil.com/2020/11/14/memory-buffers-for-initiated-part-3-friday-edition/?utm_source=rss&utm_medium=rss&utm_campaign=memory-buffers-for-initiated-part-3-friday-edition

Friday, November 13, 2020

Where all the Cyber Tooth Fairies go?

One of my favorite TV Series is Dexter. Early seasons were so-so, focused on a cheap thrill, lame TV that you can see all over the place. As the series […]
Read More

The post Where all the Cyber Tooth Fairies go? appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/where-all-the-cyber-tooth-fairies-go-2/?utm_source=rss&utm_medium=rss&utm_campaign=where-all-the-cyber-tooth-fairies-go-2

Where all the Cyber Tooth Fairies go?

One of my favorite TV Series is Dexter. Early seasons were so-so, focused on a cheap thrill, lame TV that you can see all over the place. As the series progress though we observe a shift in the narrative and we witness a true character of the main protagonist developing in front of our eyes. Dexter’s inner thoughts are full of curiosity, inquisitive reflections on life and it’s hard not to relate. We all try to fit in and be a part of it, whatever that ‘IT’ is.

So far I watched the series twice and I know I will come back to it.

One of my fav parts of the series is the history of the Tooth Fairy Killer. Walter Kenny is in his 70s when he is introduced to the audience, and due to his serial killing activities he becomes one of Dexter’s targets. Tooth Fairy Killer’s character is very interesting, because… he is way past his prime, he never got caught and … he is a somehow lonely, yet still arrogant individual.

When we swap ‘killer’ with ‘cyber’ we bring this post back to our infosec world.

What happens or will happen to us, aging ‘serial cybers’?

I don’t know. We don’t hear much from people who already retired and are either enjoying their Autumn years, or became wealthy quickly enough that working is no longer necessary. Then there are these not so happily-ever after retired – these who we end up hearing about on the news or through a grapevine. And it is not surprising to find out that many of these we hear of commit suicide, end up imprisoned, or live bigger life than themselves.

How many of us will end up there?

Putting difficult, and somehow inevitable mental health and medical issues associated with aging aside, what is that we want to do at the age of 70? Will we still work thinking we are saving the world from the cyber crime? What if futuristic laws and protocols make the cybercrime almost obsolete? And if not, will we still care? Will we still hold true and honest the ideals from our 20s? Or, worse, will we become victims of some sophisticated future social engineering tricks that will target us – the elderly? Again, I don’t know the answer. I am not that old yet, yet the questions like this start popping up in my head as I am getting older.

Our industry expanded so quickly that it’s impossible to keep up. It’s now mandatory to specialize. The good ol’ corporate entered the game and we are being institutionalized like any other company department. Is the anniversary watch we get as we retire the only prize for all these efforts, all-nighters and opinions we so eagerly shared with others over these early cyber years?

Maybe it is a price of being in the industry that very quickly goes through stages of maturity. From random, opportunistic to systematic, managed. Very rapidly. There is a final stage of cyber process already emerging today. I expect that in the next few years most of the ‘really’ technical jobs will move and gravitate around specialized vendors – these providing classification, automation, orchestration or whatever you call it, and… working frameworks.

Forget manually crafted super-timelines, inspections of systems, bit to bit imaging, and file format analysis. Forget manual malware analysis. Not only OS/Cloud telemetry and forensic/sandboxing capabilities will be provided out of the box, but they will be easy to use, already built-in and the DFIR/RCE hacking as we know will be over.

So, where do we land? Working for vendors is an easy answer. Client-side IT Security efforts coordinators aka security vendor managers is another. Security advisors? Security consultants? Table Top exercise coordinators? Teachers at uni?

Or.. perhaps cyber is here to stay for another 100 years ? And maybe, hopefully… Cyber Tooth Fairies is only the problem of the bad guys? Because… there is always something ‘for the benefit of good’ to do?

Read More

The post Where all the Cyber Tooth Fairies go? appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/where-all-the-cyber-tooth-fairies-go/?utm_source=rss&utm_medium=rss&utm_campaign=where-all-the-cyber-tooth-fairies-go

Apple Issues Security Updates

Vulnerabilities found in three most recent versions of macOS.

The post Apple Issues Security Updates appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/apple-issues-security-updates/?utm_source=rss&utm_medium=rss&utm_campaign=apple-issues-security-updates

Inrupt’s Solid Announcement

Earlier this year, I announced that I had joined Inrupt, the company commercializing Tim Berners-Lee’s Solid specification:

The idea behind Solid is both simple and extraordinarily powerful. Your data lives in a pod that is controlled by you. Data generated by your things — your computer, your phone, your IoT whatever — is written to your pod. You authorize granular access to that pod to whoever you want for whatever reason you want. Your data is no longer in a bazillion places on the Internet, controlled by you-have-no-idea-who. It’s yours. If you want your insurance company to have access to your fitness data, you grant it through your pod. If you want your friends to have access to your vacation photos, you grant it through your pod. If you want your thermostat to share data with your air conditioner, you give both of them access through your pod. …

The post Inrupt’s Solid Announcement appeared first on Security Boulevard.

Read More

The post Inrupt’s Solid Announcement appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/inrupts-solid-announcement/?utm_source=rss&utm_medium=rss&utm_campaign=inrupts-solid-announcement

Financial Fraud Investigation Tools: Tips and Techniques Handbook Now Available

The handbook compiles guidance from financial crime and AML experts plus practical advice on navigating the dark web for financial fraud investigations

The post Financial Fraud Investigation Tools: Tips and Techniques Handbook Now Available appeared first on Security Boulevard.

Read More

The post Financial Fraud Investigation Tools: Tips and Techniques Handbook Now Available appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/financial-fraud-investigation-tools-tips-and-techniques-handbook-now-available/?utm_source=rss&utm_medium=rss&utm_campaign=financial-fraud-investigation-tools-tips-and-techniques-handbook-now-available

CISA Director Expects to Be Fired Following Secure Election

Meanwhile, key legislators and former DHS officials are speaking out in support of CISA director Chris Krebs, who has led the agency’s efforts in election security.

The post CISA Director Expects to Be Fired Following Secure Election appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/cisa-director-expects-to-be-fired-following-secure-election/?utm_source=rss&utm_medium=rss&utm_campaign=cisa-director-expects-to-be-fired-following-secure-election

Amazon Sues Instagram, TikTok Influencers Over Knockoff Scam

‘Order This, Get This’: Social-media influencers are in Amazon’s legal crosshairs for promoting generic Amazon listings with the promise to get prohibited counterfeit luxury items instead.
Read More

The post Amazon Sues Instagram, TikTok Influencers Over Knockoff Scam appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/amazon-sues-instagram-tiktok-influencers-over-knockoff-scam/?utm_source=rss&utm_medium=rss&utm_campaign=amazon-sues-instagram-tiktok-influencers-over-knockoff-scam

Tianfu, Ghimob, Scalper Bots, Animal Jam, & Pay2Key – Wrap Up – SWN #82

This week, Doug talks Tianfu, Ghimob, Scalper bots, Animal Jam, Pay2Key, the Sad State Of 2FA, all this and Doug’s Threat of the Week on the Security Weekly News Wrap Up!

Timestamps:

8:03 – “Favorite Threat of the Week”
12:53- “The Sad State of Two-Factor in US banking”
14:01 – “Animal Jam compromised by exposed AWS Private Key”
15:12 – “Google patches two more zero days”
16:16 – “Scalper bots strike against PS5 and XBox X debuts”
19:22 – “TianFu Cup 2020 was held in Chengdu”
21:00 – “Ghimob is a new banking trojan targeting 112 financials in South America and others on Android”
22:03 – “Fake Microsoft Teams update targets k-12 schools with Cobalt Strike driven frameworks”
23:35 – “Pay2Key is a hot new ransomware that is using RDP attacks and psexec.exe”
24:52 – “CISA and DHS state the Election was the most secure in US History”

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn82

The post Tianfu, Ghimob, Scalper Bots, Animal Jam, & Pay2Key – Wrap Up – SWN #82 appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/tianfu-ghimob-scalper-bots-animal-jam-pay2key-wrap-up-swn-82-3/?utm_source=rss&utm_medium=rss&utm_campaign=tianfu-ghimob-scalper-bots-animal-jam-pay2key-wrap-up-swn-82-3

Tianfu, Ghimob, Scalper Bots, Animal Jam, & Pay2Key – Wrap Up – SWN #82

This week, Doug talks Tianfu, Ghimob, Scalper bots, Animal Jam, Pay2Key, the Sad State Of 2FA, all this and Doug’s Threat of the Week on the Security Weekly News Wrap Up!

Timestamps:

8:03 – “Favorite Threat of the Week”
12:53- “The Sad State of Two-Factor in US banking”
14:01 – “Animal Jam compromised by exposed AWS Private Key”
15:12 – “Google patches two more zero days”
16:16 – “Scalper bots strike against PS5 and XBox X debuts”
19:22 – “TianFu Cup 2020 was held in Chengdu”
21:00 – “Ghimob is a new banking trojan targeting 112 financials in South America and others on Android”
22:03 – “Fake Microsoft Teams update targets k-12 schools with Cobalt Strike driven frameworks”
23:35 – “Pay2Key is a hot new ransomware that is using RDP attacks and psexec.exe”
24:52 – “CISA and DHS state the Election was the most secure in US History”

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn82

The post Tianfu, Ghimob, Scalper Bots, Animal Jam, & Pay2Key – Wrap Up – SWN #82 appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/tianfu-ghimob-scalper-bots-animal-jam-pay2key-wrap-up-swn-82-2/?utm_source=rss&utm_medium=rss&utm_campaign=tianfu-ghimob-scalper-bots-animal-jam-pay2key-wrap-up-swn-82-2

Tianfu, Ghimob, Scalper Bots, Animal Jam, & Pay2Key – Wrap Up – SWN #82

This week, Doug talks Tianfu, Ghimob, Scalper bots, Animal Jam, Pay2Key, the Sad State Of 2FA, all this and Doug’s Threat of the Week on the Security Weekly News Wrap Up!

Timestamps:

8:03 – “Favorite Threat of the Week”
12:53- “The Sad State of Two-Factor in US banking”
14:01 – “Animal Jam compromised by exposed AWS Private Key”
15:12 – “Google patches two more zero days”
16:16 – “Scalper bots strike against PS5 and XBox X debuts”
19:22 – “TianFu Cup 2020 was held in Chengdu”
21:00 – “Ghimob is a new banking trojan targeting 112 financials in South America and others on Android”
22:03 – “Fake Microsoft Teams update targets k-12 schools with Cobalt Strike driven frameworks”
23:35 – “Pay2Key is a hot new ransomware that is using RDP attacks and psexec.exe”
24:52 – “CISA and DHS state the Election was the most secure in US History”

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn82

The post Tianfu, Ghimob, Scalper Bots, Animal Jam, & Pay2Key – Wrap Up – SWN #82 appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/tianfu-ghimob-scalper-bots-animal-jam-pay2key-wrap-up-swn-82/?utm_source=rss&utm_medium=rss&utm_campaign=tianfu-ghimob-scalper-bots-animal-jam-pay2key-wrap-up-swn-82

Disconnect Your TCL Smart TV From the Internet—NOW

smart TV

Researchers are sounding the alarm about Android TVs from TCL. A pair of bugs make them serious targets for hackers, and the TVs have a Chinese backdoor.

The post Disconnect Your TCL Smart TV From the Internet—NOW appeared first on Security Boulevard.

Read More

The post Disconnect Your TCL Smart TV From the Internet—NOW appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/disconnect-your-tcl-smart-tv-from-the-internet-now/?utm_source=rss&utm_medium=rss&utm_campaign=disconnect-your-tcl-smart-tv-from-the-internet-now

DEF CON 28 Safe Mode Ham Radio Village – Aaron Hulett’s (K8AMH) ‘Ham Radio Snail Mail NTS (National Traffic System) And The Radiogram Format’

Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization’s DEFCON 28 SAFE MODE Conference, and on the DEF CON YouTube channel. Enjoy!

Permalink

The post DEF CON 28 Safe Mode Ham Radio Village – Aaron Hulett’s (K8AMH) ‘Ham Radio Snail Mail NTS (National Traffic System) And The Radiogram Format’ appeared first on Security Boulevard.

Read More

The post DEF CON 28 Safe Mode Ham Radio Village – Aaron Hulett’s (K8AMH) ‘Ham Radio Snail Mail NTS (National Traffic System) And The Radiogram Format’ appeared first on Malware Devil.



https://malwaredevil.com/2020/11/13/def-con-28-safe-mode-ham-radio-village-aaron-huletts-k8amh-ham-radio-snail-mail-nts-national-traffic-system-and-the-radiogram-format/?utm_source=rss&utm_medium=rss&utm_campaign=def-con-28-safe-mode-ham-radio-village-aaron-huletts-k8amh-ham-radio-snail-mail-nts-national-traffic-system-and-the-radiogram-format

Barbary Pirates and Russian Cybercrime

In 1801, the United States had a small Navy. Thomas Jefferson deployed almost half that Navy—three frigates and a schooner—to the Barbary C...