Monthly Archives: August 2015

CVE-2015-5560 (Flash up to and Exploit Kits

Patched with flash version, CVE-2015-5560 is now being exploited by Angler EK.

Angler EK :
[Edit : 2015-09-01] Exploit candidated by by Anton Ivanov ( Kaspersky ) as CVE-2015-5560 [/edit]
The exploit has been added the 28th. It's not being sent to Flash
It uses the same Diffie-Hellman Key Exchange technique described by FireEye as in their CVE-2015-2419 implementation making a default fiddler unreplayable.

Angler EK pushing Bedep to Win7 IE11 Flash - CVE-2015-5560

Sample in that pass : 9fbb043f63bb965a48582aa522cb1fd0
Fiddler sent to VT (password is malware)
Note: with help from G Data, a replayable fiddler is available. No public share (you know how to get it).

Nuclear Pack :
Additional post spotted on the 2015-09-10

Nuclear Pack additionnal post on 2015-09-10 showing integration of CVE-2015-5560 was on the road
and got a first payload  the day after :

Nuclear Pack successfully exploiting Flash with CVE-2015-5560 (rip from Angler)
Out of topic payload : 91b76aaf6f7b93c667f685a86a7d68de  Smokebot C&C  hostnamessimply1.effers .com: )
Files : Fiddler here (Password is malware)

Read More :
Adobe Flash: Overflow in ID3 Tag Parsing - 2015-06-12 Google Security Research
Three bypasses and a fix for one of Flash's Vector.<*> mitigations - 2015-08-19 - Chris Evans - Google Project Zero
CVE-2015-2419 – Internet Explorer Double-Free in Angler EK  - 2015-08-10 - FireEye
Bedep’s DGA: Trading Foreign Exchange for Malware Domains - 2015-04-21 - Dennis Schartz - Arbor Sert
Post publication reading :
Attacking Diffie-Hellman protocol implementation in the Angler Exploit Kit - 2015-09-08 Kaspersky
Analysis of Adobe Flash Player ID3 Tag Parsing Integer Overflow Vulnerability (CVE-2015-5560) - 2016-01-12 - Nahuel Riva - CoreSecurity

What’s next for StopBadware in Tulsa

We asked Tyler Moore, StopBadware's research advisor and the boffin who's taking over our core operations, to expand on his plans for the organization in Tulsa and to throw in some 90s references. He obliged. 

Dr. Tyler Moore on the new version of StopBadware

Recently we announced that StopBadware is transferring operations to the University of Tulsa. In today's blog post I will fill in some more details on this exciting new chapter of the organization. Some things will change as a result, but our non-profit mission to make the web safer will remain.

First, let me tell you a bit about myself and my history with StopBadware, which I hope will go a long way to help solve the mystery of how StopBadware has ended up in Tulsa. (Hint: it's not because of Hanson. And I promise the circumstances are happier than when Chandler was transferred there after sleeping in a meeting on Friends.)

I first began interacting with StopBadware in 2008 while I was a postdoctoral fellow at Harvard's Center for Research on Computation and Society. I wanted to engage with StopBadware due to my research interests in cybercrime measurement. We collaborated on several projects, one of which culminated in a 2012 paper describing an experiment that demonstrated the impact of transmitting detailed notices in cleaning up websites distributing malware. The paper was co-authored by Marie Vasek, who is now my Ph.D student and Research Scientist at StopBadware.

Since 2013, StopBadware has been closely collaborating with my research team under Marie's supervision. The website testing intern has regularly been an undergraduate student I have recruited from my courses. Last year, I became StopBadware's research advisor, further formalizing my long-term involvement with the organization.

When StopBadware's board of directors decided earlier this year to move away from being a stand-alone 501c3 non-profit organization, I volunteered to bring StopBadware back to its roots in academia. StopBadware will become a program operating within the Security Economics Laboratory at the Tandy School of Computer Science at the University of Tulsa, where I cut my teeth as an undergraduate security researcher and where I recently joined the faculty.

This change in organization will bring several benefits. One is that it should greatly reduce operating costs, as I will be serving as Director pro bono, and we can share other overheads with an existing institution. Another is that we will be able to continue to serve as a true non-profit—something that in the eyes of staff and community is both unique and essential in this space.

The new StopBadware will concentrate on the core competencies that we offer. First, we will continue the testing and review program, in which anyone can request independent review of URLs blacklisted for malware by StopBadware's data providers. Second, we will continue the Data Sharing Program (DSP), in which StopBadware serves as a trusted broker for community-contributed feeds of security datasets. Third, StopBadware's research mission will be expanded. We plan to more extensively mine the data contributed to the DSP and other sources. Finally, we intend to greatly expand the publication of data related to web-based badware. Our aim is to provide even greater transparency into the fight against web-based malware, so that we might more accurately track progress, highlight accomplishments and encourage improvements on part of the community.

We still need your help, in terms of contributing data, services and financial assistance. Donations will still be required in order for StopBadware to continue thriving in the years ahead. If you are interested in supporting StopBadware as we move onto the next chapter, please get in touch by emailing me at

- Tyler

Should one fret over the leaked Ashley Madison data?

Several news sites have reported that 15 GB of identity data stolen last month from online has been made available on the darknet. Three sites have since sprung up with allows interested parties to query the site to ascertain the identity of Ashley Madison users. allowed married people to have short extramarital affairs. While the morality of the services provided may be questionable, and is perhaps best left to judgment of individuals, there is a serious risk of reputation damage if the data is fake.
There are several reasons why it may be. Firstly this is not the first leak to appear online; there have been several in the span of the last month. Then, there is the question of the validity of the email address and other details which were never verified. There is always a probability that a prominent person or an associate’s identity was used to create a profile. From one analysis, it seems that 90% of the users were male and most of the female profiles were fake. If this is true than users subscribed but may not have been able to use the site. Many users may have subscribed due to curiosity or for fun. Some articles seem to suggest that once subscribed removing a personal profile from the site was not easy. Finally, there is a strong suspicion that some of this data may have been amalgamated from other breaches.

On the flip side there seems to be several reports of individuals claiming to verify that they were users of the site and confirming their email ids in the released data.
Whatever, may be the truth, I would like cybercitizens to know that though it seems to be a sordid affair not to disrupt your personal lives purely by data that cannot be verified put out on the net. 

How to secure your home against "Internet of Things" and FUD

TL;DR most of the security news about IoT are full of FUD. Always put the risks in context - who can exploit this and what can the attacker do with it. Most news only cover the latter.


There is rarely a day without news that another "Internet of Things" got hacked. "Smart" safes, "smart" rifles, "smart" cars, "smart" fridges, "smart" TVs, "smart" alarm systems, "smart" meters, "smart" bulbs, NAS devices, routers. These devices are getting hacked every day. Because most of these devices were never designed with security as a goal, and some of them have been never tested by security professionals, it is no surprise that these things are full of vulnerabilities.

Independent security researchers find these vulnerabilities, write a cool blog post or give a presentation about the vulnerability and the exploit, and the media forgets the constraints just for the sake of more clicks. "We are all doomed" we can read in the news, but sometimes the risks are buried deeply in technical jargon. Please note I blame the news sites here, not the researchers.

There are huge differences between the following risks:

  • Attackers can directly communicate with the router (or camera) from the Internet without authentication and exploit the vulnerability. This is the worst case scenario. For example an automated ransomware attack against your NAS is pretty bad.
  • Attackers have to position themselves in the same WAN network (e.g. Sprint mobile network in the case of Jeep hacking) to exploit the vulnerability. This is still pretty bad.
  • The vulnerable code can not be triggered directly from the Internet, but tricks like CSRF can be used to exploit it (details later in this post). 
  • The vulnerable code can not be triggered directly from the Internet, and it uses a protocol/port which prevents Cross Protocol Scripting. Attackers have to access the local network before exploiting this vulnerability.
As it is the case with the worst scenario, one can find a lot of devices connected to the internet. You can always find funny stuff at , or use the nmap screenshot script to find your own stuff :)

Network exposure

Most devices are behind an IPv4 NAT device (e.g. home router), thus can not be reached from the Internet side by default. Except when the device configures the firewall via UPNP. Or the device has a persistence cloud connection, and the cloud can send commands to the device. Or the device uses IPv6 tunneling (e.g. Teredo), thus it is reachable from the Internet. But not every vulnerability on your home network is accessible directly from the Internet. As more and more devices and networks will support IPv6, this scenario might change, but I hope most home routers will come with a default deny configuration in their IPv6 firewall module. On the other hand, scanning for IPv6 devices blindly is not feasible due to the large number of IPv6 addresses, but some tricks might work

If attackers can not access the device directly, there is a way to hack it through the user's browser. Just convince the victim user to visit a website, and via CSRF (Cross Site Request Forgery) and brute-forcing the device IP, it is possible to hack some devices (mostly through HTTP - if the exploit can fit into simple GET or POST commands.

If attackers can not attack the device vulnerability through the Internet directly, or via CSRF, but  have connect to the same network - the network exposure shrinks significantly. And when attackers are on the same network as you, I bet you have bigger problems than the security of the IoT devices ...

Recommendations for home users

Don't buy **** you don't need

Disable cloud connectivity if it is not necessary. For example I have a NAS device which can be reached through the "cloud", but I have disabled it by not configuring any default gateway for the device. I prefer connecting to my network via VPN and reach all my stuff through that.

Prevent CSRF attacks. I use two tricks. Don't use the 192.168.0.x - 192.168.10.x network at home - use an uncommon IP range instead (e.g. 192.168.156.x is better). The second trick is I configured my Adblock plugin in my primary browser to block access to my internal network. And I use another browser whenever I want to access my internal devices. Update: On Firefox you can use NoScript ABE to block access to internal resources.

Check your router configuration:

  • disable UPNP
  • check the firewall settings and disable unnecessary port forwards
  • check for IPv6 settings, and configure the firewall as default deny for incoming IPv6 TCP/UDP.

Change default passwords, especially for services connected to the Internet. Follow password best practices.

Run Nmap to locate new IoT in your home network :) 

Run WiFi scan to locate new WiFi access points. Let me share a personal experience with you. I moved to a new house, and brought my own WiFi router with me. I plugged it in, and forget about WiFi. Months later it turned out I had two other WiFi devices in my house - the cable modem had it's own integrated WiFi with default passwords printed on the bottom, and the Set-top-box was the same - default WiFi passwords printed on the bottom. And don't forget to scan for ZigBee, Bluetooth, IrDA, FM, ...

Update your devices - in case you have a lot of free time in your hand.

Don't allow your guests to connect to your home network. Set up a separated AP for them. Imagine your nephew stealing your private photos or videos from your NAS or DNLA server.

With great power, it comes great responsibility. The less device you own in your house, the less time you need to maintain those.

Read the manuals of your devices. Be aware of the different interfaces. Configure it in a secure way.

Stop being amazed by junk hacking.

Update: Disable WebRTC: , in Chrome you can use this extension:

Update: Prevent against DNS rebind attacks via configuring a DNS server which can block internal IP addresses. OpenDNS can block internal IP, but this is not a default option, you have to configure it.

Recommendations for vendors

For vendors, I recommend at least the followings:

  • Implement security during Software Development LifeCycle
  • Continuous security testing and bug bounties
  • Seamless auto-update
  • Opt-in cloud connectivity

Recommendations for journalists

Stop FUD. Pretty please.

The questions to ask before losing your head

  • who can exploit the vulnerability?
  • what prerequisites do we have about the attack to successfully exploit the vulnerability? Is the attacker already in your home network? If yes, you have probably bigger problems.
  • what can the attacker do when the exploit is successful?

And last but not least don't forget that in the case of IoT devices sometimes users are the product, not the customer. IoT is about collecting data for marketing purposes.

8 steps to prevent a stolen phone from ruining you digital life

Smart phones are lost because they were accidental forgotten at public places or stolen. A phone today, is a cybercitizens gateway to their digital life. It allows use of apps for services such as for banking, social networking and taxi booking, storage for personal pictures and videos, email, instant messaging and telephony.
Most phones have an Internet finder program which helps to locate phones connected to the Internet. The service works well, if the phone is forgotten at places which are likely to have a lost and found counter like airports and restaurants where the staff is unlikely to pocket it. More often, the key risk is the loss of battery life effectively shutting down the phone. Even when a phone is lost and picked up by a person wanting to return it, a study has shown that most of the people browse private data like contact and pictures, understandably to locate the owner.
Most thieves quickly switch off the phone and remove the SIM card to effectively disable the Internet finder applications. When a phone is stolen or lost there are three risks that the owner face.
Financial Loss
Typically, you lose the value of the phone and the additional cost of calls made from the phone which obviously, one has to pay for. While there may be insurance that can be bought to recover part of the cost of the phone; to prevent fraudulent calls the cellular provider needs to be quickly alerted to deactivate the number.  Ensuring that the phone is protected by a strong screen saver password will mitigate the risk of expensive calls.
Reputation Loss
Many personal applications like Facebook, twitter, email or such social media accounts are logged on and can be accessed without a password allowing personal information to be read or malicious comments to be written. Such comments may affect personal reputation or be defamatory which may results in soured relationships or legal action. Hereto a strong screen saver password can help. If the thief is unable to crack the password, the simplest action would be to format the phone, reload the operating system and sell it in the black market
Privacy Loss
Privacy can be lost in two ways. By viewing data stored directly on the phone memory or on memory cards such as personal pictures, by reading private posts, email and by looking up the browsing history. Private data such as sexting pictures of other individuals received and stored on the phone may compromise their privacy.
Four steps that cybercitizens should take to reduce the risks to themselves and the incentive a thief gets from a stolen phone:-
1.        Set a strong password and short lock screen timeout.  If your phone provides the option to erase data after several unsuccessful tries to enter a passcode, typically 10, activate it. New phones disallow the formatting of the operating system without a password thereby rendering the phone worthless and reducing the incentive to steal it. A strong password or passcode has at least 8 characters that include some combination of letters, numbers, and special characters
2.        Try to avoid using external memory cards unless they are encrypted
3.        Update the phone regularly, to ensure that  vulnerabilities which can be exploited to unlock password protected phones is patched
4.         Backup contacts and other data
Four steps that cybercitizens should take when the phone has been stolen or lost and returned.
1.        Use the Internet finder app to locate the phone and erase data
2.        Reset all passwords for apps and accounts even if the phone has been returned
3.        If returned, reformat and reload the operating system to avoid any malware being surreptitiously loaded. Malware can be used to spy, steal credentials and cause an even bigger financial loss
4.        Block you SIM card by calling up your cellular provider

Why DNS is awesome and why you should love it

It's no secret that I love DNS. It's an awesome protocol. It's easy to understand and easy to implement. It's also easy to get dangerously wrong, but that's a story for last weeka few weeks ago. :)

I want to talk about interesting implication of DNS's design decisions that benefit us, as penetration testers. It's difficult to describe these decisions as good or bad, it's just what we have to work with.

What I DON'T want to talk about today is DNS poisoning or spoofing, or similar vulnerabilities. While cool, it generally requires the attacker to take advantage of poorly configured or vulnerable DNS servers.

Technically, I'm also releasing a tool I wrote a couple weeks ago: dnslogger.rb that replaces an old tool I wrote a million years ago.

Recursive? Authoritative? Wut?

As always, I'll start with some introduction to how DNS works. If you already know DNS, you can go ahead and skip to the next section.

DNS is recursive. That means that if you ask a server about a domain it doesn't know about (that is, a domain that isn't cached or a domain that the server isn't the authority for), it'll either pass it upstream to another DNS server (recursive) or tell you where to go for the answer (non-recursive). As always, we'll focus on recursive DNS servers - they're the fun ones!

If no interim DNS server has the entry cached, the request will eventually make it all the way to the authoritative server for the domain. For example, the authoritative server for * is - my server (and hopefully the server you're reading this on :) ). That is, any request that ends with - and that isn't cached - will eventually go to my server. See the next section for information on how to set up your own authoritative DNS server.

Let's look at a typical setup. You're on your home network. Your router's ip address is probably the usual, and is plugged into a cable modem. When you connect your laptop to your network, DHCP (aka, magic) happens, and your DNS server probably gets set to (unless you've manually configured it to, which you should). When your router connects to your cable modem, more DHCP (aka, more magic) happens, and its DNS server set to the ISP's DNS server.

When you do a lookup, like "dig", your computer sends a DNS request to saying "who is"? Obviously, your router has no idea - he's just a stupid Linksys or whatever - so he has to forward the request to the ISP's DNS server.

The ISP's DNS server gets the request, and it has no idea what to do with it either. It certainly doesn't know who "" is, so it's gonna forward the request to its DNS server, whatever that happens to be. Or it might tell the router where to look for a non-recursive query. Since at this point it's out of our hands, it doesn't really matter.

Eventually, some DNS server along the way is going to say "hey, why don't we just go to the source?", and through a process that leading scientists believe is magic (there's a lot of magic in DNS :) ), it will look up the authoritative server for, discover it's, and send the request there.

My server will see the request, and, assuming something is listening on UDP port 53, have the opportunity to respond.

The response can be any IP address for an A (IP) or AAAA (IPv6) request; a name for a CNAME (alias) or MX (mail) request; or any ol' text for a TXT request. It can also be NXDomain - "domain not found" - or various error messages (like "servfail").

One of the cool things is that even if we return "domain not found", we still see that a request happened, even if the person doing the lookup sees that it failed! We'll see some examples of why that's cool shortly.

How do I get an authoritative server?

The sad part is, getting an authoritative server isn't free. You have to buy a domain, which is on the order of $10 / year, give or take.

Beyond that, it's just a configuration thing. I don't want to spend a ton of time talking about it here, so check out this guide, written by Irvin Zhan for instructions to do it on Namecheap.

I personally did it on Godaddy. It took some time to figure out, though, so prepare for a headache! But trust me: it's worth it.

The set up

We'll use - my test domain - for the remainder of this. Obviously, if you want to do this yourself, you'll need to replace that with whatever domain you registered. We'll also use dnslogger.rb, which you'll get if you clone dnscat2's repository.

Getting dnslogger.rb to work is mostly easy, but permissions can be a problem. To listen on UDP/53, it has to run as root. It also needs the "rubydns" gem installed in a place where it can be found. That can be a little annoying, so I apologize if it's a pain. "rvmsudo" may help.

If anybody out there is familiar with how to properly package Ruby programs, I'd love to chat! I'm making this up as I go along :)

What does DNS look like?

All right, let's mess around!

I'll start by having no DNS server running at all on - basically, the base state. From another host, if you try to ping it, you'll see this:

$ ping
Ping request could not find host Please check the name and try again.

Conclusion? It's down. If you were investigating an incident and you saw that message, you'd conclude that there's nothing there, right? Probably?

Let's fire up dnslogger.rb:

$ sudo ruby ./dnslogger.rb
dnslogger v1.0.0 is starting!

Starting dnslogger DNS server on

Then do the same ping (with a different domain, because caching can screw you up):

$ ping
Ping request could not find host Please check the name and try again.

It's the exact. Same. Response. The only difference is, on the DNS server, we see this:

$ sudo ruby ./dnslogger.rb
dnslogger v1.0.0 is starting!

Starting dnslogger DNS server on
Got a request for [type = A], responding with NXDomain

What's this? We saw the request! Even if the person doing the lookup thought it failed, it didn't: WE KNOW.

That's really cool, because it's a really, really stealthy way to find out if somebody is looking you up. If you do a reverse DNS lookup for, you'll see:

$ dig -x

And if you look up the forward record:

$ dig
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 57980
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

NXDOMAIN = "no such domain". Totally stealth!

Why is it so awesome?

Let's say you're testing for cross-site scripting on a site. Post <img src="" /> everywhere. If you later see a request like "" come in, then guess what? You found some stored XSS on their admin page!

Let's say you're looking for shell injection. Normally, you do something like "||ping -c5 localhost". If it takes 5 seconds, it's probably vulnerable to XSSshell command injection [thanks albinowax!]. That's lame. Instead, do a query for "myquery||nslookup". If you see the query, it's definitely vulnerable. If you don't, it's almost certainly not.

Let's say you're looking for XXE. Normally, you'd stick something like "<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>" into the XML. That works great - IF it returns the data. If it doesn't, you see nothing, and it probably failed. Probably. But if you change the "file:///" URL to "", you'll see the request in your DNS logs, and you can confirm it's vulnerable!

Let's say you're wondering if a system is executing a binary you're sending across the network. Create a binary that attempts to connect to You'll instantly know if anybody attempted to run it, and in their logs they'll see nothing more than a failed DNS lookup. As far as they know, nothing happened!

The coolest thing is, if you're responding with NXDomain, then as far as the client or IDS/IPS/Wireshark/etc. knows, the domain doesn't exist and the connection doesn't happen. Nothing even attempts to connect - it doesn't even send a SYN. How could it? It just looks at the domain and "NOPES" right outta there.

If some poor server admin has to figure out what's happening, what's s/he going to see? A request to a domain which, if they ping, doesn't exist. At that point, they give up and declare it a false positive. What else can they do, really?

There are so many applications. Looking for SQL injection? Use a command that does a DNS lookup (I don't know enough about SQL to do this). Looking for a RFI vuln? Try to include a file from your domain. Wondering if a company will try emailing you without risking getting an email (I'm sure I can come up with a scenario)? Give them "" as your email address. If I try to email that from gmail, it fails pretty much instantly:

Delivery to the following recipient failed permanently:

Technical details of permanent failure:
DNS Error: Address resolution of failed: Domain name not found

But I still see that they tried:

$ sudo ruby ./dnslogger.rb
dnslogger v1.0.0 is starting!

Starting dnslogger DNS server on
Got a request for [type = MX], responding with NXDomain
Got a request for [type = MX], responding with NXDomain
Got a request for [type = AAAA], responding with NXDomain
Got a request for [type = A], responding with NXDomain

I see the attempt, but neither gmail nor the original sender can tell that apart from a misspelled domain - because it's identical in every way!

(I'm mildly curious why it does a AAAA/A lookup - maybe somebody can look into that)

Returning addresses

dnslogger.rb can return more than just NXDomain - it can return actual domains! If you start dnslogger.rb with a --A argument:

$ sudo ruby ./dnslogger.rb --A ""

Then it'll return that ip address for every A request for any domain:

$ ping

Pinging [] with 32 bytes of data:
Reply from bytes=32 time=85ms TTL=44
Reply from bytes=32 time=80ms TTL=44
Reply from bytes=32 time=73ms TTL=44
Reply from bytes=32 time=90ms TTL=44

Ping statistics for
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 73ms, Maximum = 90ms, Average = 82ms

If you do a lookup directly to the server, you can use any domain:

$ dig @
;; ANSWER SECTION:             86400   IN      A

In the past, I've found a DNS server that always returns the same thing to be useful for analyzing malware (also database software, which can often be considered the same thing). In particular, setting a system's DNS server to the IP of a dnslogger.rb instance, then returning for all A records and ::1 for all AAAA records, can be a great way to analyze malware without letting it connect outbound to any domains (it will, of course, be able to connect outbound if it uses an ip address instead of a domain name):

$ sudo ruby ./dnslogger.rb --A "" --AAAA "::1"

What else can you do?

Well, I mean, if you have an authoritative DNS server, you can have a command-and-control channel over DNS. I'm not going to dwell on that, but I've written about it in the past :).


The entire point of this post is that: it's possible to tell if somebody is trying to connect to you (either as a TCP connection, sending an email, pinging you, etc) without them knowing that you know.

And the coolest part of all this? It's totally invisible. As far as anybody can tell, the connection fails and that's all they know.

Isn't DNS awesome?

I lost money because my petrol pump was hacked by attendants!

The neighborhood petrol pump which I occasional use, was in the news for allegedly tampering with the meter readings. Some of the staffers had hacked the circuitry to modify the pulser readings which converted the flow volume to the digital readout. As a consequence, 5% of the bill value was inflated. Hacking is typically associated with software and remote Internet connections, but all sort of meter readings can be tampered with to skim small sums of money or develop glitches that result in inflated bills.
The only way to tackle such misuse is by surprise calibration checks and stringent penalties. In the case of the above petrol pump, the ingenious system also had a switch to toggle back to normal values during a calibration inspection.

The police believes that this particular fraud may be widespread, which simply demonstrates the ease with which the perpetrator of the modified pulser is able to sell his invention without being caught.

Visualizing eight years of independent reviews

StopBadware has been performing independent reviews of websites blacklisted by our data providers for more than eight years. As we've explained in the past, a manual review done by our staff is not always necessary: if a webmaster requests a StopBadware review of a site on Google's Safe Browsing blacklist, the first step in our review process is an automated request for Google to rescan the site in search of malicious code. If Google's automated systems don't find anything suspicious, that site will come off Google's blacklist without our ever having to touch it. When Google still finds malware, or when one of our other data providers is the blacklisting party, one of our website testing team uses a variety of tools to scour the site for malicious code and other bad behavior.

As our home page proclaims in red, we've helped de-blacklist more than 171,000 websites since 2007. Before we shutter operations as an independent nonprofit next month, we want to give our community a better idea of what goes into that number. 

Since we started collaborating with Google, and later ThreatTrack Security and NSFocus, we've performed 53,167 manual reviews. We've also processed an additional 188,149 review requests that were resolved automatically thanks to our automated integration with Google. Those aren't all unique requests, so combining them doesn't yield an accurate number. Here's what all those review requests look like over time:

Why the decline? 

You'll undoubtedly notice that we received many more review requests early on than we do today. Better security awareness, wide availability of relatively low-cost security tools, and default use of things like Webmaster Tools all contribute to the decline we've experienced in review requests. We also have better ways of detecting and weeding out abusive requests than we used to. 

Unfortunately, something else that's contributed to the decline in review requests is malware distributors' widescale use of stealthier, more targeted methods like malvertising. When a resource is compromised only very briefly (e.g., through an infected ad network), even when blacklist operators are able to detect the infection and warn users away, the compromise is often resolved too quickly for StopBadware's Clearinghouse to reflect that the resource was ever blacklisted. Generally speaking, if something is blacklisted for fewer than six hours, we won't have a record of it in our Clearinghouse. On the one hand, this is good news, in that we want blacklists to operate as narrowly as possible to maximize user protection while minimizing penalty to site owners; on the other hand, this is bad news, in that malicious actors are able to effectively utilize powerful technologies to spread malware in ways that are difficult to detect and counter. 

What's not included in this data? 

What you don't see in this chart is the tens of thousands of URLs we've reviewed in bulk for web hosting providers, AS operators, and other network providers over the years. We've worked with everyone from dynamic DNS companies and bulk subdomain providers to small resellers and abuse departments at big companies to clean up malicious resources on their networks and help remove them from blacklists. The majority of this process is manual, and because it's initiated based on trust and human communication instead of by clicking a button, bulk review data isn't reflected in our public review data. 

StopBadware's review process will continue to operate normally during and after our operations transfer to our research team at the University of Tulsa. Thanks to our research scientist, Marie Vasek, for putting this data together!

Hacking SMART services in Cars, Homes, and Medical Devices – a cinch!

Businesses are reinventing themselves by transforming traditional services and service delivery into digital services. Digital services utilize smart products to provide enhanced service quality, additional features and to collect data that can be used to improve performance. Smart products can be remotely controlled using Wi-Fi or cellular connections, software, sensors that makes smart dumb devices, cloud infrastructure and mobiles.
Examples of digital products and services are network connected cars, home appliances, surveillance systems, wearables, medical devices, rifles and so on. Very recently ethical hackers exploited a software glitch that allowed them to take control of a Jeep Cherokee while on the road and drive it into a ditch. All this with the hapless driver at the wheel!

While the car hack made headlines and led to the recall of 1.4 m vehicles, it also signaled the beginning of an era where cyber-attacks or software glitches cause physically harm to cyber citizens, blurring the lines between safety and security. Cyber-attacks in the near future will do a lot more damage than destroy reputations, steal money or spy on intimate moments people would prefer to keep private, it may maim or kill in a targeted or random fashion and that too in the privacy of one’s own home.
The severity of some of the demonstrated exploits by ethical hackers were downplayed because the attacker required physical access to the vehicle to execute the attack. I for one, do not know what happens to my vehicle while it is serviced or valet parked, both ideal opportunities to fiddle with the electronic systems and even modify the firmware.

All smart devices will be connected and updatable over wireless networks. Wireless updates are ideal opportunities for hackers to obtain access or control over these devices. However, digital products or services must have built in defenses not only for over the air hacks but equally on risks from technicians, mechanics or others that have physical access to the smart infrastructure.
Startups with limited budgets may struggle to provide adequate security to their new incubations, allowing ample opportunity for maliciously minded individuals and cyber criminals to find ways to compromise the service. Investment in smart product security will be driven by liabilities around safety regulations, compliance and strict penal provisions.

Potao Express samples


2011- July 2015
  • Aka  Sapotao and node69
  • Group - Sandworm / Quedagh APT
  • Vectors - USB, exe as doc, xls
  • Victims - RU, BY, AM, GE 
  • Victims - MMM group, UA gov
  • has been serving modified versions of the encryption software (Win32/FakeTC) that included a backdoor to selected targets. 
  • Win32/FakeTC - data theft from encrypted drives
  • The Potao main DLL only takes care of its core functionality; the actual spying functions are implemented in the form of downloadable modules. The plugins are downloaded each time the malware starts, since they aren’t stored on the hard drive.
  • 1st Full Plugin and its export function is called Plug. Full plugins run continuously until the infected system is restarted
  • 2nd Light Plugin with an export function Scan. Light plugins terminate immediately after returning a buffer with the information they harvested off the victim’s machine.
  • Some of the plugins were signed with a certificate issued to “Grandtorg”:
  • Traffic 
  • Strong encryption. The data sent is encapsulated using the XML-RPC protocol.
  • MethodName value 10a7d030-1a61-11e3-beea-001c42e2a08b is always present in Potao traffic.
  • After receiving the request the C&C server generates an RSA-2048 public key and signs this generated key with another, static RSA-2048 private key .
  • In 2nd stage the malware generates a symmetric AES-256 key. This AES session key is encrypted with the newly received RSA-2048 public key and sent to the C&C server.
  • The actual data exchange after the key exchange is then encrypted using symmetric cryptography, which is faster, with the AES-256 key
  • The Potao malware sends an encrypted request to the server with computer ID, campaign ID, OS version, version of malware, computer name, current privileges, OS architecture (64 or 32bits) and also the name of the current process.
  • Potao USB - uses social engineering, exe in the root disguised as drive icon
  • Potao Anti RE -  uses the MurmurHash2 algorithm for computing the hashes of the API function names.
  • Potao Anti RE - encryption of strings
  • Russian TrueCrypt Win32/FakeTC - The malicious program code within the otherwise functional TrueCrypt software runs in its own thread. This thread, created at the end of the Mount function, enumerates files on the mounted encrypted drive, and if certain conditions are met, it connects to the C&C server, ready to execute commands from the attackers.
  • IOC


DEFCON 23 Badge Challenge

Authors: image Brett Buerhaus, image Jason Thor Hall

Brett, Jon, and I teamed up with Council of 9 and won this years badge challenge after having great success in the DEFCON 22 Badge Challenge. Over the last year we have studied a huge number of cryptographic methods and ancient languages to prepare for this. We also released our own crypto-challenge website for the community to follow along and have fun challenging themselves. With our new knowledge and a great team in tow we headed out to DEFCON.

Here is the entire adventure as we experienced it with all of the puzzles, their solutions, and the steps to solve them. Understand that this document contains MASSIVE spoilers so if you do not want to ruin it for yourself please stop reading now.

Still here?
Alright, lets go!


After the we met up with the rest of the Council of 9 members we all immediately began hunting for signs off 1o57’s work around the convention. One of the first things that caught our teams eye was this years room keys. Interestingly enough 1o57 had never included room keys in previous challenges so this was rather unexpected.

We talked to others and rotated our keys with the hotels until we were able to obtain photos of five different room keys. Each key having a different image and cryptic text and a small circle with a dot on it. This strange text turned out to be the language known as Telugu script which hails from southern India as far back as 400 BC and the circle was a representation of a clock face showing the order of the cards.

We originally tried to translate the text literally which came out to nothing but incoherent gibberish. At this point we knew that 1o57 had pulled another classic maneuver and was using the language in a more imaginative way. In this case the phonetic display of the text could be roughly compared to an english word. For instance the pictured card translates to “Latali” which we can then interpret as “Little”

The cards then translated out to the following:

Card 1Card 2Card 3Card 4Card 5

Without knowing what this was for we documented it and continued our hunt for additional information.


Once we got our DEFCON bags from the glory that is LINECON we obtained a few new sources of information. A vinyl record badge, a booklet, two CD’s, and a lanyard. ( A big thanks to @psifertex for lending us a booklet and the CD’s the night before ;D )

Having seen that in previous years the booklet contained an easy lead we immediately set to dig into it. On the bottom right corner of page 2 we found a block of cipher text in two different fonts.



1o57 has a tradition for each years badge challenge. Caesarian ROT13 must be used at least one time and most usually in the booklet. This year was no different and we can see this by rotating the first three lines with a tool from Rumkin.

This comes out to the following after rotation:


The writing style here is immediately noticeable and non-standard for 1o57, definitely a hint as to its true nature. Searching this on google we find that it refers to the movie L.A. Story in which Steve Martin frequently talks to a freeway sign. The sign is unable to write full sentences due to lack of space on his face so he writes them bunched up with numbers for words just like our text here.

During the movie the sign gives Steve Martin a riddle telling him he will know what to do when he unscrambles “How is daddy doing”. At the end of the movie his love interest, Victoria Tennant unscrambles the message to “Sing doo wah diddy”. Hilariously enough she spoke her solution steps out loud and they do not result in the correct answer.

We interpreted this as needing to perform an anagram and set to unscramble the letters as this was the most logical path considering our information. Unfortunately this couldn’t be farther from the truth and we fell down a rabbit hole for hours. We later found it was actually a Keyed Vignère cipher with the Alphabet and Passphrase set to LASTORY.

I cannot remember how we came about this answer but there were a lot of enraged words flying about when it was solved. The translation comes out to the following.


Without more information on what Oppenheimers big bang is we can move on to Step_3


The DEFCON 23 package had two CDs, one was a data CD and the other was a soundtrack. Similar to previous years badge challenges, we knew there was likely important information on one of these CD’s. We set upon ripping them to our machines and inspecting the files.

None of the audio files held any secrets, no interesting spectrograms or hidden messages there. We found an encrypted MysteryFolder.rar and a program called ChipSec. We dumped the strings of ChipSec to see if anything was hidden there and found nothing so we set upon the RAR file.

Here is the file path:


We popped open the RAR file in a hex editor just to confirm it was in fact a real RAR and not some sleight of hand. Thankfully it was but we didn’t have a password for it so we shuffled this to the side and branched out for more information.

Without a password we moved on to Step_4


This year the DEFCON badge was a playable record. One of our team members ran to FRY’s Electronics to obtain a record player that could dump audio to USB the moment we found out. Upon receiving this glorious machine we found that each record was exactly the same as the last. This was unlike previous years where each caste of badge would contain different information.

The audio from Side A:

Track 1A

Track 2A

Track 3A

The audio from Side B:

Track 1B

Track 1A
This is a reading from the Hackers Manifesto in a slow deep voice. It appears to only be the last three paragraphs and does not contain any cryptographic meaning. That being said, this is a fucking awesome touch and really put people in the right mindset during the challenge.

You can find the full writing here:

Track 2A
A young girl reads off a number station with a single date stated near the end.

-26-18-10-14-21-05-17-13-17-19-22-22-20-19-22-22-08-07-08-22-12-25-01-14-24-12-20-02-24-12-24-10-07-07-06-14-18-02-22-25-18-03-06-24-07-25-11-09-16-14-22-12-01-24-09-25-02-17-22-09-26-24-05-05-20-24-07-23-17-18-04-13-02-11-22-23-24-11-01-07-02-11-19-06-2 jun 18th 2024-13-12-26-09-18-13-16-24-14-12-18-05

Track 3A
DTMF is the tones produced when you hit a number on your phone. Each one is a dual tone sound one of which is high and the other low. The controller on the other end hears these tones and understands what button you pressed.

We pulled the audio into Audacity and viewed it was a spectrogram. This allowed us to easily split the tones based upon which frequencies were coupled together.

We then used a DTMF guidebook to determine which number on the dial pad was pressed. If both the upper and lower tone were the lowest Hz recorded then we knew the number pressed would be 1 for instance.

123697 Hz
456770 Hz
789852 Hz
*0#941 Hz
1209 Hz1336 Hz1477 Hz

This decrypted our message into the following information:


When we saw the 1057 come out we knew we were on the right path but the numbers were jumbled in a way that made no sense. After hours of searching we came across a system known as T9 that converts dialpad numbers into letters based on predictive text.

Description of T9

This then deciphers into the following:


With the red key in hand and a hint towards the blue key we were feeling pretty good at this point. None of the information we had could open the RAR file from earlier so we moved on to the lanyards.


For this part of the challenge 1o57 presented everyone with a number of keyboards

The lanyards detail two enciphering methods. The box-like Nyctograph and the symbol driven Gold Bug


Gold Bug:

The lanyards could be decoded directly using these enciphering methods. We decoded them as follows.

Decoded Goldbug Lanyards

Decoded Nyctograph Lanyards

This was just the first layer of our lanyard decoding so we then set to work on the output texts. We noticed that each line of decoded text was exactly the same length.

1o57 then tweeted the following image.

This led us to use a playfair cipher with our decoded text and a QWERTY keyboard as the playfair board. This worked by taking the first letter of each decoded line and using them against your keyboard. For instance GW on your keyboard drawn as a box gives you TS as the other two box corners. This is the basis of playfair.

This came to the following output


With our lanyards decoded we set off to Step_6


Reversing Engineer on the internet is a really clever way of pushing us towards a website. After a few attempts at mixing engineer around we came to the following URL by taking the reverse of engineer and adding .engineer to it.

This page is dominated by a single image

The first thing that stood out to us on this page was the reference to the word ‘file’. We have our RAR file from Step_3 so this seems to somehow contain the password for our RAR.

There are also a number of references to X-Files in the image content, name, and title.

The title of 'Star me kitten.’ is a reference to William S Burroughs song that is inspired by the X-Files.

The text can be linked to a number of characters from the X-Files as shown here.

Fox (Fox Mulder)
Skin’er (Walter Skinner)
a lone (Lone Gunmen)
red hair (Dana Scully)

The commas and apostrophes are lined up and can be converted to 1’s and 0’s and then into an ascii X.


The FBI warning points to either opening credits in a movie or just to that this deals with the FBI agents of the X-Files. Needless to say this page is drenched in X-Files references we just need to dig through them to understand the point.

At first we tried to take the text literally and build a password out of the actors and characters names. In last years challenge the password was exceedingly long so it stood to reason this one might be as well. None of these attempts worked and no combination seemed to yield any results.

When we were about to give up one of our team members who was unfamiliar with the show watched the opening credits. A few moments later he exlaimed THE TRUTH IS OUT THERE and went to try it.

There are few times where I feel like an absolute fool during these challenges, this was definitely one of them as we had overlooked the most obvious answer. The password to the RAR ended up being 'Thetruthisoutthere.’ which fit all of the clues on the page.

first at the capital
Capitalize the password on the first letter

even if they have no space
Remove all of the spaces from the password

End the password with a period

With our RAR open we can now move on to Step_7


Our RAR contained the following files.


Haunted Mansion.mp3


The first thing we set upon was the DigitalFun.jpg file which shows a circuit board schematic.

The hint of is pointing to this being a URL on the LostboY domain. You can follow each bit down it’s pipe to the end and add the resulting 1 to that box.

This takes a rudimentary understanding of electrical schematics and logic gates.

We built a quick simulation to beat this puzzle.

This comes out to the following output.

Resulting Bit Conversion

Ending URL

With a new URL in our hands we move on to Step_8.


This page has a number of images as shown here.

It also has a block of text, some text hidden in HTML comments, and an interesting title.

This Island Answer

Is the answer written on the stars?
Did you really think I'd put hints here? Don't be a knob...

It's moving to think of all of you
helping a
number of little girls
find their way...
I'll be sure to keep a
of your good deeds.

The text block seems to be referencing the little girl number station we found back in Step_4 so this may lead to the answer for that section.

Each of the images on the page is named as 'Item1.jpg’ and so on so that gives us nothing. All of them seem completely unrelated as well so we started to reverse image lookup each one. Here is a list of each item we found.

1. Alabaster Statue
2. Russian Samovar
3. Mary Shelly Hair
4. Venus Boticelli
5. Cigar Cutter
6. Crystal Glasses
7. Pistol
8. Old Lamp
9. Portrait of Rembrandt's Father
10. Laocoön by El Grecos
11. At the Cafe La Mice
12. Burke's Peerage
13. Pricess Bride
14. The Fishmongers Apprentice
15. An old IBM
16. Potting Business Book
17. Yachting Book
18. Atilla the Hun
19. Token
20. Treasure
21. Yesterday by The Beatles
22. Clock and Watch Repair
23. Silver Pitcher

At first glance this is a menagerie of unrelated items and gives us nothing in terms of coorelation. However, dropping a few of them into google reveals something rather incredible.

1o57 has turned the entire song of Portobello Road from Bedknobs and Broomsticks into images on the page.

This is absolutely brilliant and it is clear that we have the correct answer due to the previous hint of 'Don’t be a knob’. Now that we have our target we can apply the rest of our hints and try to figure it out. Searching for 'Bedknobs and Broomsticks star’ immediately brings us to the Great Star of Astoroth.


Now that we have our key we can use it against the target pointed to by the block of text at the bottom of the page. This brings us to Step_9


In Step_8 we got a hint that the solve would be related to a 'number of little girls’. The number station we collected in Step_4 was voiced by a little girl so we can now attempt to solve this. Here is the block from earlier.

-26-18-10-14-21-05-17-13-17-19-22-22-20-19-22-22-08-07-08-22-12-25-01-14-24-12-20-02-24-12-24-10-07-07-06-14-18-02-22-25-18-03-06-24-07-25-11-09-16-14-22-12-01-24-09-25-02-17-22-09-26-24-05-05-20-24-07-23-17-18-04-13-02-11-22-23-24-11-01-07-02-11-19-06-2 jun 18th 2024-13-12-26-09-18-13-16-24-14-12-18-05

Our first step was solving the room keys that gave us the hidden step for this number station.

Card 1Card 2Card 3Card 4Card 5

This then turns our number station into the following by adding 2 and 5 to the beginning.

25-26-18-10-14-21-05-17-13-17-19-22-22-20-19-22-22-08-07-08-22-12-25-01-14-24-12-20-02-24-12-24-10-07-07-06-14-18-02-22-25-18-03-06-24-07-25-11-09-16-14-22-12-01-24-09-25-02-17-22-09-26-24-05-05-20-24-07-23-17-18-04-13-02-11-22-23-24-11-01-07-02-11-19-06-2 jun 18th 2024-13-12-26-09-18-13-16-24-14-12-18-05

We can then crunch the date into 23 as all of the digits of june 18th 2024 add up to 23. (DEFCON 23)


None of these numbers are below 1 or above 26 so we can convert them directly over to the Alphabet as follows.


We can then use TREGUNAMEKOIDESTRECORUMSATISDEE as vignere key to decrypt our message.



Even though our decipherment wasn’t perfect we were able to get a proper hint out of this message. Find the eigen space determined by the scalar product of the ten zero fifty seven. Before trying any math we searched the given terminology to prevent falling down additional rabbit holes. Thankfully we found that a Scalar Product may also be called a Dot Product. This then allows us to create the URL of Eigen.Space as it is the Dot Product of Eigen Space!

With Eigen.Space in tow we move on to Step_10


At this point our outlook on reality had been warped to such a point that things such as were coming naturally. The cryptographic destroying machine was in full swing and sleep was at an all time low.

The domain is composed of an image in the background, multiple references to Feynman, a mathematical equation, a cigar, and an animated gif of Sheldon from the Big Bang Theory TV Show.

In the source for the page we also find a few HTML comments and hold on to them for later.

1. innovation is a very difficult thing in the real world
2. Why are things always the last place you look for them?

The cigar comes with a tagline of 'Sometimes…’ which refers to the quote by Sigmeund Freud stating that sometimes things are exactly as they appear and nothing more or less. Knowing this we must apply Occam’s Razor liberally to this page and make sure not to fall down any rabbit holes.

The equation in the center of the page is as follows.

1, 0, 16,
384, 23040, 2088960, 278323200,
50969640960, 12290021130240, 3774394191052800, 1438421245702963200,
666120016990568448000, 368420070161105761075200, 239869937154980747988172800

This equation describes 'The number of ways n couples can sit in rows of two seats with no person next to their partner.’ Hilariously the equations author is Stewart Herring… Red Herring… We threw it away immediately and never found a use for it.

The costume from the Big Bang Theory gif is in reference to the Doppler Effect as seen here.

It clicked immediately, a cigar is just a cigar, the equation on the page has no meaning the sound is just a sound under the Doppler effect. With this in mind we squished the image to remove the Doppler effect, rotated it, and inverted the color to be read by a tool called Coagula Light.

This came out to the following sound file.

When dealing with image to sound services black is most generally considered empty space and produces no sound so inverting the color allowed us to listen to this snippet. Coagula Light is one of my favorite tools although ancient and can be found here.

The sound file is 1o57 saying the following cryptic message


Considering Reverse Engineer was a URL previously we tried each of these as a URL and struck gold.

This led to and Step_11


This page shows a number of Elements and Atomic Masses in columns and the title of the page is 1120 bits.

1120 bits refers to Short Message Service or SMS so we know that this has somehting to dow with a phone. Further the rows come out to 10 so 3 area code, 7 for number.

There is also an HTML comment on the page that hints at the true nature of the elements.

1. Have you ever wondered why it's 1o57, and not 1057?

We tried all kinds of things with this list and 1o57 played with us quite a bit before revealing that the area code for the number we desired was 202. If we lay out the elements we have we can convert them as shown here.

He	106.42
O	144.24
He	10.811
N	208.9804
N	28.0855
O	65.39
O	102.9055
He	237.0
Be	30.9738
He	91.224

Turning each element on the left column into their atomic number barring the O’s due to 1o57’s hint we get the following.

2	106.42
0	144.24
2	10.811
7	208.9804
7	28.0855
0	65.39
0	102.9055
2	237.0
4	30.9738
2	91.224

This gives us the number (202) 7700-242 which we can then send a text to. A few moments later you receive an automated response.

¯\_(ツ)_/¯ Find 1o57. Tell him you would like to buy a custom key cap. He will tell you they cost a dollar. Pay him with a two dollar bill, and say keep the change.

This was meant to be a chase around Vegas to find a $2 bill, but someone on our team happened to have a “lucky” $2 bill in their wallet. Lucky indeed! We sprinted full speed down to the 1057 room, told LosT we were interested in buying a custom key cap and handed him a $2 bill.

When we handed him the bill he gave us a key cap and a small piece of wood with a skull on one side. I will not be revealing what information was on this skull as it leads to a message crafted specifically for those in the challenge.

After receiving that message it eventually leads us to the final domain and Step_11


The final URL is a page dominated by an image from National Lampoons Vacation and a video of Buckaroo Banzai’s End Credits. Both fantastic movies, watch them if you haven’t had the chance to.

This page also had two HTML comments embedded in it which were incorrectly formatted to have dashes connected to the comment. We found later that this was intentionally done to throw us off.



This page led us down a rabbit hole like no other puzzle in my experience. The image is from the movie National Lampoon’s Vacation where they visit a park known as Walley World. In the real world this park closed a ride known as Colossus last year as seen in the following URL:

The Colossus was the first large-scale electronic computer and was used in World War 2 at Bletchley Park (Park’s Closed) to break the Nazi’s Tunny messages. Tunny messages are composed of 5 bit baudot code under the effects of the Lorenz cipher.

After researching this we attempted to break the 1’s and -’s by converting them into 5 bit binary baudot and then use a colossus simulation to crack them… in dozens of different ways… This was all a rabbit hole, none of it had to do with the Colossus but we did learn a lot about World War 2, cryptography, and Baudot code.

The cipher used here is called Spirit DVD Code and can be found on in the Substitution section. The bottom message comes out to the following output.


Emailing that address completed the challenge with the following message in response.


Thank you Council of Nine for taking us in and believing in your newest members.
We make a fantastic team.

Council of Nine


CVE-2015-2419 (Internet Explorer) and Exploits Kits

As published by FireEye Angler EK is now exploiting CVE-2015-2419 fixed with MS15-065

Angler EK :

It seems they might have started to work on that exploit as early as 2015-07-24 where some instances briefly used code to gather ScriptEngineVersion from redirected visitors :

Angler EK gathering ScriptEngineVersion data the fast way.
Today first pass i made was showing a new POST call and was successfully exploiting a VM that used to be safe to Angler.

CVE-2015-2419 successfully exploiting IE11 in windows 7
(Here bedep grabbing Pony and TeslaCrypt then doing some AdFraud)

I spent (too much ;) ) time trying to decode that b value in the POST reply.
Here are some materials :

- The landing after first pass of decoding and with some comments :

The post call is handled by String['prototype']['jjd'] , ggg is sent to Post data as well as the ScriptEngineVersion (in the shared pass : 17728 )

- The l() function handling the post :
- The post data and reply after first pass of decoding :

Files : 2 Fiddlers (ScriptEngineVersion Gathering and successfull pass - use malware as password)

Thanks :
Horgh_RCE for his help

Magnitude :
( I am waiting for some strong confirmation on CVE-2015-2426 used as PrivEsc only here )

Magnitude successfully exploiting CVE-2015-2419 to push an elevated (CVE-2015-2426) Cryptowall on IE11 in Win7
As you can see the CVE-2015-2419 is a RIP of Angler EK's implementation (even containing their XTea key, despite payload is in clear)

Note : The CVE-2015-2426 seems to be used for privilege escalation only

Cryptowall dropped by Magnitude executed as NT Authority\system after CVE-2015-2426

and has been associated to flash Exploit as well.
Pass showing the privilege escalation has been associated to flash Exploit as well.

Files : CVE-2015-2419 pass (password: malware)
CVE-2015-5122 pass featuring CVE-2015-2426 (password : malware)

Thanks :
Horgh_RCE , EKWatcher and Will Metcalf for their help

Nuclear Pack:

Nuclear Pack exploiting IE11 in Win7 with CVE-2015-2419 to push TeslaCrypt
Files :  Fiddler (Password is malware)

Neutrino :
CVE Identification by Timo Hirvonen

Neutrino successfully exploiting CVE-2015-2419 on IE11 in Windows 7
(Out of topic payload : c7692ccd9e9984e23003bef3097f7746  Betabot)

Files: Fiddler (Password is malware)


RIG successfully exploiting CVE-2015-2419
(Out of topic payload : fe942226ea57054f1af01f2e78a2d306 Kelihos (kilo601)

Files : Fiddler (password is malware)

Hunter :
@hunter_exploit 2015-08-26

As spotted by Proofpoint Hunter EK has integrated CVE-2015-2419

Hunter Exploit Kit successfully exploiting CVE-2015-2419
Files : Fiddler (password is malware)

Kaixin :

Files: Fiddler here (password is malware)
( out of topic Payload : bb1fff88c3b86baa29176642dc5f278d firing PCRat/Gh0st ET rule 2016922 )

Sundown :
2016-07-06 - Thanks  Anton Ivanov (Kaspersky) for confirmation

Sundown successfully Exploiting CVE-2015-2419 - 2016-07-06
cmd into wscript into Neutrino-ish named / RC4ed Payload let think this is a Rip from Neutrino implementation

( Out of topic payload: bcb80b5925ead246729ca423b7dfb635 is a Netwire Rat )

Files : Sundown_CVE-2015-2419_2016-07-06 (password is malware)

Read More :
Hunter Exploit Kit Targets Brazilian Banking Customers - 2015-08-27 - Proofpoint
CVE-2015-2419 – Internet Explorer Double-Free in Angler EK - 2015-08-10 - Sudeep Singh, Dan Caselden - FireEye
2015-08-10 - ANGLER EK FROM SENDS BEDEP This pass shared by Brad from Malware-Traffic-Analysis is including the CVE-2015-2419
Generic bypass of next-gen intrusion / threat / breach detection systems - 2015-06-05 - Zoltan Balazs - Effitas
Post publication Reading :
Attacking Diffie-Hellman protocol implementation in the Angler Exploit Kit - 2015-09-08 Kaspersky

Defcon 23: Let’s End Clickjacking

So, my Defcon talk, ultimately about ending clickjacking by design.

TL:DR: The web is actually fantastic, and one of the cool things about it is the ability for mutually distrusting entities to share the same browser, or even the same web page. What’s not so cool is that embedded content has no idea what’s actually being presented to the user — Paypal could have a box that says “Want to spend $1000” and somebody could shove an icon on top of that saying “$1.00” and nobody could tell, least of all Paypal.

I want to fix that, and all other Clickjacking attacks. Generally the suggested solution involves pixel scraping, i.e. comparing what was supposed to be drawn to what actually was. But it’s way too slow to do that generically. Browsers don’t actually know what pixels are ultimately drawn normally; they just send a bunch of stuff to the GPU and say “you figure it out”.

But they do know what they send to the GPU. Web pages are like transparencies, one stacked over the next. So, I’ve made a little thing called IronFrame, that works sort of like Jenga: We take the layer from the bottom, and put it on top. Instead of auditing, we make it so the only thing that could be rendered, is what should be rendered. It works remarkably well, even just now. There’s a lot more work to do before web browsers can really use this, but let’s fix the web!

Oh, also, here’s a CPU monitor written in JavaScript that works cross domain.

Darknet, where child pornography is rampant

Child porn is rampant in what is known as the dark web or darknet. The part of Internet that cannot be reached by using a search engine like Google. It is that part which is accessed using a special browser (TOR) which is freely downloadable, and works to ensure the anonymity of the user online. It achieves this by use of encryption and bouncing encrypted communication across a network of nodes before it reaches the intended site. The information that the intended site possess is the IP address of the last node which makes the original destination anonymous. The downside of the TOR network is its slow speed.

Coupling an anonymous network with an anonymous currency like BITCOIN allows illegal activity such as the buying and selling of drugs, child porn, and counterfeits to flourish without the fear of tracking either information or financial flows. Cybercriminals, terrorists, drug peddlers and pedophiles among others, use the darknet to further their business as the darknet protects both them and their customer’s identities.

Criminal users on the darknet are savvy and sophisticated in covering their tracks and erasing the digital fingerprints they leave online. They conduct their business on secret password protected websites limited to trusted users (excluding undercover police), utilize sophisticated hard disk encryption (including some with multiple passwords, each opening up a different volume), distributed storage across multiple computers to ensure that each computer will not have a complete image and move sites frequently.  These tactics coupled with the volume of sites on the darknet makes it a formidable task for law enforcement to identify criminal rings and catch them.

Making the darknet safe requires detectives to impersonate criminals or their customers to infiltrate criminal rings. It is a tedious task with limitations in jurisdiction and prosecution. In the next few years this old fashioned method will be supplemented with technology to map and analyze darknet sites, contents and activity to profile criminal behavior.

For Governments wanting to crack down on child porn, like as in India, the only option is to set-up a team of specialized investigators to explore darknet activity originating from within the country and to partner with their counterparts from like thinking countries to nab criminals within their jurisdiction.

Can child porn be blocked by banning websites?

The Indian government is trying to block child porn by banning websites, an ineffective strategy, primarily due to the difficulty in the identification of child porn websites. Child porn is traded within closed rings of pedophiles using the dark internet. The dark internet are sites on the Internet not accessible through the search engines. Pornographic material are actively bought and sold between collectors who form these rings using peer to peer software and encrypted communications. Some reports estimate that there are over 100000 individuals who deal in pornography through secret chat rooms and other communication channels.
Child porn is broadly defined as the creation, distribution and collection of photographs, audio or video recordings of sexual activity involving a prepubescent person. The pornographic content may range in severity from posing while clothed, nakedness to explicit sexual activity, assault and bestiality.
Children who are victims of child pornographers suffer physical pain, somatic symptoms and physiological distress. Many do not complain out of loyalty to the offender (who could be a relative) and a sense of shame.
One of ways child porn is produced is through the malicious use social networks and the Internet to groom innocent children into sharing explicit images of themselves and then blackmail them into producing more content. The content is then sold to other collectors for a fee. With the widespread availability of webcams and Internet, the remote pornographer has direct video access to a groomed child, within the once secure confines of the child bedroom.
Reducing the amount of child porn on the Internet is a noble initiative and one that requires the co-operation of several stakeholders such as law enforcement, parents, victims, social groups, ISP’s, search engines and the community. Catching and shutting down rings has to be a priority and ISP’s hosting dark sites need to quickly detect and shutdown such child abuse sites.  The catch rate of child pornographers is quite low, at around 1000 a year with no mechanism to prevent repeat offenses.
In India, I would believe simply going by the increased spate of media reports on physical child abuse in prominent schools, that physical child abuse is a larger problem than tackling online pedophilia. All parents must be alert to the cues that their child provides to quickly identify abuse.

Shock News: Trusted Sites Serve Malware in Ads

Yes, I know. We shouldn't really be particularly surprised that a legitimate site -
even one the size of Yahoo - has ended up mistakenly serving some form of badware through their advertising networks. It’s not the first time. Yahoo hit the headlines for malware related problems in 2014, when an affiliate traffic pushing scheme targeted Yahoo users with malware served through adverts on the Yahoo website, and now it’s happened again. 

Ad revenue on the Internet is hard to live on at the best of times, and we can expect "lowest cost" behaviours, including, but not limited to, fairly rudimentary checks on the intentions of advertisers.

The obvious thing to do here is to bleat on about the efficacy of having a web filter in fighting some of those attacks - you've read that before, hey, you may have even read it before from me. Fill in this section on your own, as an exercise for the reader.

You probably also know how important HTTPS interception is - of course, this malware was served over HTTPS, wouldn't want any pesky insecure mixed content now, would we? Again, I’ve expounded at length on the subject. No HTTPS scanning = no security. Don't accept "blacklists" of sites that get MITM scanned: the delivery site won't be on that list, and your malware sails on through free and easy.

The thing I want to mention today is the other big secret of content filtering: some web filters only apply the full gamut of their filtering prowess to sites that are not already in their blocklists. This is wonderful for performance. It might even mean you only need a single web filter to provide for a huge organisation - but when a "trusted" site, that's already "known" to the web filter, bypasses some of the content filtering in order to save a few CPU cycles you may be getting a false economy.

Play some D!

Hi there. Long-time-no-blog 🙂 If you haven’t already, go read this: Note: this blog applies to Corporate networks. If you’re a coffee shop or a college, you’re on your own 🙂 I’ve been a network defender for many years. I currently work for a software company that builds network software which helps companies gain … Continue reading Play some D!

Sites you use online, may tarnish your reputation and relationships

Cybercitizens use sites on the Internet as resources that offer them services with scant thought as to how their data and activity information could be used by site owners and others who have access to it. The others are entities who are sold this information, cyber criminals who steal it, third parties who provide services to the site owners and also innocuous users who come across this data because the sites privacy protection or in some cases security is not adequate.

Cybercitizens should note that many sites provide services for free, supported by advertisement revenue. These sites collect and analyze profile and activity information which includes clicks, page visits, and transaction information to selectively display advertisements suited to the user’s demographic profile or searches. This helps advertisers obtain better returns on their advertisement dollar. Most of the larger and more popular sites make their users sign up to lengthy terms and conditions, which few read or understand, to enable them use personal data. Larger more established sites lay out well worded privacy statements on their websites which users can read. In all cases, information related to financial transactions are normally governed by strict regulations and compliances which regulates use and specifies standards for the security of card data.

But, there are many other firms with questionable credentials and whose ownership remain largely unknown. They may be popular sites too, but on the vast global highway, there is no way that one can truly ascertain where your data resides, who sees it and what use it is put too.  The case of the hack of the extramarital affair dating site Ashley Madison, clearly demonstrates the vulnerability of those users to reputational damage, blackmail and extortion. There are many sites, whose membership if disclosed could hurt the reputations of millions of people. Pornographic sites for instance.

The trail of personal data that one puts online remains. For example, curious users of the Ashley Madison site would have no way of proving to their spouse that they subscribed to the site out of curiosity and not for intended use. 

The effect of disclosure of personal data varies from tarnished reputation and financial losses to minor privacy intrusions. Cybercitizens should evaluate these risks and their potential consequences when they use certain sites.