Sunday, August 24, 2014
Tuesday, April 15, 2014
Update: A very insightful review of the book published in Network Security.
Introduction: Cyber-crime increasingly impacts both the online and offline world, and targeted attacks play a significant role in disrupting services in both. Targeted attacks are those that are aimed at a particular individual, group, or type of site or service. Unlike worms and viruses that usually attack indiscriminately, targeted attacks involve intelligence-gathering and planning to a degree that drastically changes its profile.
Individuals, corporations, and even governments are facing new threats from targeted attacks. Targeted Cyber Attacks examines real-world examples of directed attacks and provides insight into what techniques and resources are used to stage these attacks so that you can counter them more effectively.
The book is available to be ordered at following places:
- Amazon: http://www.amazon.com/Targeted-Cyber-Attacks-Multi-staged-Exploits/dp/0128006048
- Kindle Edition: http://www.amazon.com/Targeted-Cyber-Attacks-Multi-staged-Exploits-ebook/dp/B00JRVB3UY
- Elsevier: http://store.elsevier.com/Targeted-Cyber-Attacks/Aditya-Sood/isbn-9780128006047/
- Barnes and Noble: http://www.barnesandnoble.com/w/targeted-cyber-attacks-aditya-sood/1118602703?ean=9780128006047
Thursday, February 27, 2014
Update: 5th March, 2014
Note: I am concerned because it got delivered to my personal gmail inbox -:)
It looks like the phishing attack discussed earlier (a week ago) on gmail users is still underway. Although, the attack is public now, the endpoint security solutions deployed by Google still fails to mark the emails as phished. The latest snapshot of this attack is presented below:
The host has a malice history though : https://www.virustotal.com/en/ip-address/18.104.22.168/information/
It is not a reliable way to depend heavily on safe-browsing all the time for blacklisting the phishing websites rather the prevention has to be triggered at the time of origin. Let's see how long this continues.
A recent targeted phishing attack has been launched against gmail.com users. Interestingly, the email slipped through Google end point security solution which fails to detect the spam email and served it properly to the user's inbox.
Visiting the link results in the following webpage showing the same layout as of Gmail.
- The domain resolves to an IP address which has a history of being potential malice: https://www.virustotal.com/en/ip-address/22.214.171.124/information/. The virtual hosting server has been used for compromised WordPress websites.
Overall, basic steps:
- The user is redirected and served with a gmail.com webpage here: hxxp://www.nusurgix.com/virtusite/phpthumb/serv/Login.htm
- The form submission sends all the POST data to: hxxp://www.nusurgix.com/virtusite/phpthumb/serv/badu.php
- The user redirects successfully to legitimate gmail.com webpage: hxxps://accounts.google.com/
The website is hosted on a CMS hosting server as shown below:
Overall, it might not be that sophisticated attack, but a few inferences:
- Smart user would have detected that this is a trick even it is delivered to inbox.
- Big issue, the anti-spam solutions in Google's network fails to detect it and mark it as phished.
- There might be a possibility that a few users would have fallen to this trick but we cannot be sure.
- The attacker used a compromised network infrastructure to execute this attack. A healthcare provider hosting account is compromised.
- This type of attack if remains active for only few minutes could have already garnered a good set of accounts.
Do not fall for this trap !
Sunday, January 12, 2014
A couple of months earlier, we released a paper on the design of NiFramer, a bash tool to automate the Iframe injections on the compromised servers. It has been used widely by attackers. However, in coming time, we will be covering different variants of automated Iframe injection tools.
You can download the paper at: http://secniche.org/released/VB_CPANEL_IFRAME_INJECT.pdf
Tuesday, November 5, 2013
" In this paper, we discuss the details and design of the Styx exploit pack. According to the dictionary, Styx is a river in the underworld, over which Charon ferried the souls of the dead. According to the Styx service provider website, ‘Styx is a river in Greek mythology that formed the boundary between earth and the underworld... It circles the underworld nine times.’ So it seems that the origin of the name is as rigorous as the exploit pack itself."
Download the paper from here: http://secniche.org/released/VB_Styx_Exploit_Pack.pdf
Friday, September 13, 2013
Download paper : http://www.crosstalkonline.org/storage/issue-archives/2013/201309/201309-Sood.pdf
Monday, June 10, 2013
Just uploaded the deck of slides used in ha talk that I presented at ToorCon 14 Security conference in San Diego.
ToorCon 14 : Malandroid : The Crux of Android Infections
Abstract: The Android platform has been plagued by malware for the past several years. Despite all attempts to detect and mitigate malicious applications on Android, malware is still flying under our radar and getting on our devices and causing millions of users financial and data loss every year. Additionally, the malware analysis community is at a large disagreement on how Android malware should be classified. In this talk, we’ll dive into the tactics, tools and procedures used by Android malware today, including several case studies of exceptional malware samples. By analyzing real code used by malware in the wild, we’ll be able to show the advancements in Android malware from a design perspective.
Monday, May 20, 2013
"Microsoft recently warned about Man in the Browser (MitB) malware exploiting Facebook sessions. When a user is infected – often by drive-by downloads on infected or malicious sites – the malware uses authenticated sessions on Facebook to post messages, ‘like’ pages and get up to general mischief."
Listen to the podcast here: http://contrarisk.com/2013/05/19/csp-0011/
Tuesday, March 26, 2013
The malware domain was hosting an exploit for MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption. More details can be read here: MS12-043. Without any surprise, the IP address of that domain belonged to China as shown below:
The exploit for this vulnerability can be found in Metasploit here: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb.
A simple check on the one of the code snippet used in the malware domain and legitimate Metasploit repository is shown below:
The exploit code was used in conjunction with the JS code hosted here: http://js.users.51.la/15240615.js.
This code dynamically generates the information about the visitor and creates log details for statistical purposes.
We remember that a few traces have been detected earlier where Phoenix exploit kit used the one of the same exploit present in the Metasploit. Refer: Gangsterware.
The conclusive points are:
- Metasploit provides neat exploits which are easy to deploy and use.
- The evidence shows that malware authors are using Metasploit exploits.
Well, Reality bites !
Tuesday, March 5, 2013
"Blackhole has been the major player in the exploit kit market for a while now, but the Sweet Orange and ProPack kits have recently entered the market and are rapidly gaining in popularity. Aditya Sood and colleagues take a look at advancements in the design of the new kits on the block."