Virus Analysis; Code Evolution Techniques

One of the most important requirements of malicious code analysis is the understand of advanced code evolution techniques.There are common techniques used by malicious code developers and writers to evade detection and destruction: 

 

Common Techniques:

 1. Self-Encryption and Self-Decryption

Malicious code may encrypt the virus body. Even using several layers of encryption and decryption and/or using random keys (Oligomorphic Viruses) in encryption and decryption. This makes them harder to examine directly.

2. Binders and Packers

Most virus signature files are created based on the checksum value which makes use of the file properties and first few bytes of the malicious code binaries. The binders technique is to bind the virus and malicious code file on to another file, which changes its form. The packers technique is to compress the virus code before it is embedded.

3. Polymorphism

Malicious code can change its default encryption settings as well as the decryption code during self-encryption. These make it much more difficult to detect.

4. Metamorphic Viruses
These do not have a decryptor or a constant virus body but are able to create new generations that look different. Malicious code change its form by, for instance, rearranging its code fragments or/and by adding useless lines of code into its source, and recompiling itself into a new form.

5. Stealth

The technique is designed to evade anti-virus software detection by hiding the code itself.

Let's have a talk about virus infection techniques in future post.

CurrPorts Port Scanner (Ethical Hacking Toolz)

Port Scanners are important to network security technicians because they can reveal possible security vulnerabilities on the targeted system.

CurrPorts is a portable executable that list down all currently opened TCP/IP and UDP ports on local computer. And also it displays  information about the process that ports are opened for, including the process name, full path of the process, version information of the process, the time that the process was created, and the user that created it.


And also you can close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file, XML file, or to tab-delimited text file.

CurrPorts also automatically mark with pink color suspicious TCP/UDP ports owned by unidentified applications(Applications without version information and icons).

Download CurrPorts
Download CurrPorts for 64bit

Please let me know if anything is not working properly. See you all in next post. Good Luck. ;)

Track Your Stolen Laptop, Smart Phone

What would you do if someone steals your notebook or smart phone with its precious or sensitive data that comprises your digital, personal and work life?

Prey is a lightweight tracking software that helps you find, lock and recover your device when stolen or missing. It is open-source and available for Windows, Mac OS X, Linux and Android.

How Prey works:

Prey tracking software runs in the background processes of your notebook. It "wakes" at a specified interval, goes online (if your laptop isn't already connected to the Internet, Prey tries to connect to the nearest open Wi-Fi access point) and checks in with a specified Web address to see what you have ordered it to do. If said address doesn't issue a command to the laptop (such as telling your computer that it is considered stolen), the Prey software returns to sleep and will wake up again at the next time interval.

If your laptop is stolen, you can use another computer to sign in to the Prey Web site, mark the laptop as missing, and follow the whereabouts of your purloined system through a control panel -- assuming the thief takes your notebook online or the software manages to connect to a Wi-Fi access point. 

(Read More: preyproject.com)

Video Guide: vimeo.com/18728980
Download Prey: Official Site

Hide Files Inside of Image Files

1. Create a new folder on your HDD,
   Example: I create a folder in my D: drive and rename it as "Lesson". ( D:\Lesson )
* It better you follow my blue colored examples if you are a n00b.

2. Then drop the file(s) that you need to hide, into that folder. And also, place the image that you'll be using to hide the files in. In my case I have want to hide a text file ( Test.txt ) file inside a image file( Image.jpg ). So I put both files into D:\Lesson folder.

3. Now select the file(s) that you want to hide. Only select the files you want to hide, not the picture. (In my case I select only the Text.txt file.) Right-click on them; and choose the option to add them to a compressed RAR file. In order to accomplish this task, you will need to have either archiving or compression program such as WinRAR installed on your computer.

Name this RAR file whatever you want. I renamed it as “Secret.rar”.

4. Now click on Start, and then click on Run ( or press Windows Key + "r" ). It will open-up the run dialog box. In there type “CMD” without the quotes and press Enter.
It will pop-up the command prompt window.
Use "cd" command on command prompt to change the current working directory of the CMD in to your folder that contain the secret files. As my example I type cd D:\Lesson to get to the "Lesson" directory in D: drive.

5. If you successfully move to your folder on CMD, then type the following line:
"copy /b NameOfTheImage.JPG + NameOfZIPorRAR.rar NameOfNewSecretImage.jpg" ( without "s ) and press Enter.

In my example;

copy /b Image.JPG + Secret.rar SecretImage.jpg

If you success it will say "1file(s) copied.".

And that’s it! The image file will have been updated with the compressed archive inside! You can actually check the file size of the picture and see that it has increased by the same amount as the size of the archive. Now You can delete all other files except the SecretImage.jpg ( Newly build secret image. ).

You can access your hidden file(s) by simply change the extension to .RAR and open the file using WinRAR.
Then your hidden files show up and you can extract them out.
It may sound like a lot of work, but it's a pretty simple. That is all it takes to hide files inside JPG picture files! It’s a great way simply because not many people know it’s possible and no one even thinks about a picture as having to the ability to “hide” files. This is only a tiny trick. A kind of a foolproof method. But if you want to get really serious about encryption, you'll want to encrypt your data with TrueCrypt.

Good luck and keep exploring..!! ;)

Anonymous Browsing - An Introuduction to Tor

Surfing the internet securely through VPN or web proxy might do the tactic for some individuals who concern about the online privacy. Tor is a tool bundle for organizations and individuals that want to improve their safety & security on the web. It is enable online anonymity. You can perform anonymous web surfing,  publishing, instant msging, and any other utility that use the TCP protocol.

Tor design to maintain safeguard against traffic analysis, a form of network surveillance that threatens personal anonymity and privacy, confidential business activities and relationships, and state security. Tor short for The Onion Router. It is free and open source for Windows, Mac, Linux/Unix, and Android. Download Tor from Tor official web site and assure your privacy.

Activate Hidden Admin in Win 7

Windows 7 has a built-in administrator account but its disabled by default for security purposes.This built-in administrator account is an account that has full unrestricted access and permission on the computer, and will not be prompted by UAC. You might want to enable it for troubleshooting or to get rid of the annoying UAC prompts while tweaking your system. It can be made activate by another activated  administrator. It is not recommended to leave the built-in Administrator account always enabled, or use it all the time for just everyday purposes. This post will show you how to enable or disable this account.

1. Go to Start-> All Programs -> Accessories.

2. Type "cmd" in start menu search box and press “Ctrl+Shift+Enter“ to
run the command prompt as administrator. If you are prompted to enter password, enter the password and continue.

3. Type following command in command prompt and hit Enter.
net user administrator /active:yes 

4. You should see a message that the command completed successfully. The Administrator account will be enabled. Log out, and you'll now see the Administrator account. There's no password for this account. So setup a strong password if you hope to make enable hereafter.

5. If you want to disable it again, this is the command:
net user administrator /active:no (simply replace "yes" with "no" in previous command)

I hope this will help you and  please leave a comment. 

What does a malicious Hacker do?

Hackers typically approach an attack using five common phases. Reconnaissance, Scanning, Gaining Access, Maintaining Access and Clearing Tracks. After erasing tracks the hacker terminates the connection. This information is useful for network administrators, and essential for network security consultants.






Reconnaissance(rattling the door knobs" to see if someone is watching and responce)
This is the Preparatory Phase. Attacker seeks to gather as much information about the target before launching the attack. They perform routine and detailed reconnaissance.

There are two types of reconnaissance; Passive reconnaissance are Active reconnaissance

Passive reconnaissance: Acquiring information without directly interacting with the target
Example:  Google Searching, Searching Public Records

Active reconnaissance: Acquiring information interacting with the target directly.
Example: Telephone call to the help desk or technical department (Social Engineering), Dumpster Diving

Scanning
This is the Pre-attack Phase. Hackers want to learn more about network mapping, phone system structure, and internal informational architecture of the target. Using gathered information during reconnaissance, the hacker scans the network for more specific information.
In this phase they use some tools for scan vulnerabilities of the system.

Gaining Access
This is the Penetration Phase. This phase of attack is the most important and the most dangerous. The hacker exploits the vulnerabilities in the system. Open ports can lead to a hacker gaining direct access to services and possibly to internal network connections.

Maintaining Access
Hackers may choose to continue attacking and exploiting the target system, or to explore deeper into the target network and look for more systems and services. In this phase the hacker tries to retain his ownership of the system. The hacker has compromised the system. Hacker may harden the system from other hackers as well by securing their exclusive access with Backdoors, Rootkits, or Trojans.


Clearing Tracks
In this phase the hacker clears his footprints and tracks. He undertakes to remove evidence for hide his misdeeds.

The more the hacker learns about your internal operations means the more likely he will be intrude and exploit. So be Secure.

I hope this post will help you and please leave a comment.

TrueCrypt

TrueCript is a free open-source disk encryption software for Windows 7/Vista/XP, Mac OS X, and Linux. It is a ultimate freeware encryption program, TrueCrypt is loaded with powerful features that users concerned with protecting data from prying eyes will find robust and comprehensive. It has 11 algorithms for encrypting your private files in a password-protected volume. You can store your encrypted data in files (containers) or partitions (devices).
Encryption is automatic, real-time (on-the-fly) and transparent. Parallelization and pipelining allow data to be read and written as fast as if the drive was not encrypted. Newer features include hardware acceleration for some Intel chips, auto-mounting, and convenience improvements for when you "favorite" an encrypted volume have improved both performance and usability. Users can even create a hidden operating system.

Download TrueCrypt

Cryptography

Cryptography is a method of transmitting or storing secret messages where only intended recipient can read and process them. It is the science of writing in secret code and is an ancient art. It can be used to ensure Confidentiality, Integrity and Authenticity. The readable data(Clear Text/ Plain Text) converts into unreadable format(Cipher Text) using Encryption/Enciphering Algorithm. Encryption/Enciphering Algorithm is a set of rules dictating how enciphering and deciphering takes place. There are many types of algorithms. Blowfish, Des, Enigma, Gost, Loki97, ReipleDes, Xtea, etc.. There is a random variable called Crypto Variable/Key(a sequence of bits) which gives secrecy to the whole process. Only sender and the intended receiver should have the key. The intended recipient can Decrypt/Decipher using that Crypto Variable/Key.


Example:

Plane Text: The Technical Avenue
Algorithm: BlowFish
Key: 3

Cipher Text: 5T3jLYKbWglAp1S2cYGuVdTR1iMREeWt

The first documented use of cryptography in writing dates back to circa 1900 B.C. Julius Caesar developed a method of sending secret messages by substituting each letter in the message by a letter which is three positions ahead in the alphabet. (Rotation-3 or ROT-3 cipher)

Example:
Cipher Text: wkh whfkqlfdo dyhqxh
Key: 3
Plane Text: The Technical Avenue

 There are many more types of Cryptosystems available.
Vigenere Cipher, Vernam Cipher(One-Time Pad), Running Key Cipher, etc..

Encrypted messages can sometimes be broken by cryptanalysis, also called codebreaking, although modern cryptography techniques are virtually unbreakable.

Why Information Security?

Some years ago information security is not a hot topic. Because in that time organizations did not heavily depend on computer based system. Internet was not there and few people had the technical knowledge. But nowadays, the situation got changed. organizations, government and all other individuals depend heavily on computer based systems. Internet provides a large medium for malicious activities. Well organizes computer crimes have become common.

When information is not adequately secured, it may be compromised and this is known as a security breach. For businesses, a breach usually entails decrease in productivity, release of unauthorized sensitive data and loss of reputation, trust & business. For individuals, a breach can lead to identity theft and damage to financial history or credit rating. Recovering from information breaches can take years and the costs are huge.

So.., stay secure..!!