Today as usual I booted in windows 2000 and inspected this "strange" piece of malware [a trojan].

I must really compliment the author of this malware, since he does a good job by deleting important files like mp3,mpeg,pr0n and other illegal stuff that people download off p2p software ;))

Credits fly to you, whoever you are !!

Read more here ...

/Quit

Santa gave me a lot of gifts for christmas of which two were very good,
so Iam sharing with you people ;))

Trust me, he gave me an oppurtunity to see the power of RainbowTables [ >>Here << ]

Ofcourse, he gave me toys to play too ... Check this out ...

Cheers :)

I was doing a bit of wifi-hacking recently... playing with toys ;-)

Recommended reading => Blackhat Slides [Laurent Butti and Franck Veysett]

/me (Quit :)

I've not been with my computer for the last few days ... went out shopping, spotting and doing stuff that I don't do regularly ;)

The surprising thing is I couldn't withstand touching my laptop everyday for emails. . .

I just signed off the internet 8 days ago, and here Iam, back ... Back with a bang ?! Probably.

I just re-energized myself and feels good to be ranting here :)

/Pull D' Plug

Muscles & Fitness - Training system library is worth every penny you invest in it ...

I just bought the 5 DVDs for 40 US Dollars, I think it's an incredible source for body building.

I'll write more about this dvd shortly ...

On a side note, weight that we gain is reversible ... Lots of things are "reversible" in life, and reversing comes naturally ;)

GPS is having it's gcc toolkit ready. I have been examining the board for a while now, and coding the processor module for nintendo with the opcodes.

If someone needs the opcodes for v831 processor, let me know through email.

Cheers :)

http://www.videojug.com/film/how-to-fold-a-t-shirt-in-2-seconds

Amazing piece of "work" ... I saw the comments section, and many people complaining about the video's speed. Use the pause button around 10-12 times in the 2 seconds when they show the folding ;)

100% working, try it

Couple of neat pen-tests were done in the last month. This month I have a mighty big cake in my hand with over a thousand desktops and a few servers, from an organization. ;)

Now about the new reverse-engg project at hand, the GPS unit. It runs on Nintendo processor.

Manufacturer : NEC Corporation
Processor Model : v831
Addn Info: 32 bit Microprocessor



Iam still working on the details of this circuit's datasheet, as of now Iam building a GCC kit for this thingy.

/Ale vide

Today , thoughts that traverse through my mind almost daily has come to a stop.
Seems there is something I failed to realize ... Yes, I have realized "an important" thing
about life. I slept the whole day and Iam blogging now. The SL33P factor has been missing
for the past few years of my life ... which I think has bothered me enough. So Iam planning
to compensate for my misdoings now ;) ...

/part

News... warezov variants are making a lot of headlines in AV blogs.

Today being Diwali, here is a traditional way of saying happy diwali to all my friends here.

जलते जगमगाते रहे, हम आपको आप हमको याद आते रहे जब तक जिन्दगी है, दुआ है हमारी "आप चाँद की तरह जगमगाते रहे" दीपों के पर्व दीपावली की हार्दीक शुभकामनाएँ !!!

Ofcourse, I've got my English version too ... ;))

I wish you all a very Happy Diwali and an even prosperous New Year

Then I've got new toys coming my way for a fresh reverse-engineering challenge.

GPS - Global Positioning system , this time is my target. Seems there is some kinda DVD unit that won't play regular DVDs. After the car ecu and tv hacks, I've started to get a firm grasp on embedded stuff and hardware hacking.

I think this project will go well ;)

I will keep you all posted.

Cheers :D

http://www.gizmodo.com/gadgets/gadgets/mcdonalds-im-lovin-malware-207639.php

Story from Gizmodo on McDonald's malware ;))

Iam loving it !!

/Quit

This picture was done by Antony Zboralski (for his talk in HackInTheBox 2006.

The people at HITBSec2006 were kind enough to provide Live webcast ;)

I heard the second day's keynote and some talks which interested me in the 2 day conference.

VML Exploit from milw0rm receives a lot of attention as vendor patch hasn't come up yet

The unofficial patch from ZERT is the temporary solution, and I think that team consists of the most elite and respected researchers in security industry.

That's all I got in stock now, actually I have been staying away from my box for a while now ... Since I thought life has more to give / take except this machine ;)

Update: Official patch released out of the microsoft patch cycle, available at update website.

Cheers

Pshisssssss ... the hell out !
Long time , no blog ... bah, I have been lazy, tht's one reason
Second reason is I haven't done much except reporting and getting keen on phishing.
Here is the report from APWG (Anti-Phishing Working group) for June06.

Oh, we can't forget Patch Tuesday's advance bulletin
Here is an interesting thread a new set of API's for Java
That's it for now

/quit :)

Hierarchy of Piracy

The above diagram shows how software is pirated schematically ...


Cheers :)

Things I can think of now ...
Microsoft Bulletin (came out 4 days before ... already ppl will be diff'ing patches)
Post on browser bugs from hdm
Then the Anti-Malware Team at Microsoft releasing a whitepaper
Picture of the Anti-Malware Team

Ahh... I almost forgot Italy's World Cup victory over France and about the
"disgusting" words spoken by Materazzi. Zidane's head butt had a lot of press
attention. According to French Coach Raymond Domenech "To me
Materazzi is the man.... He not only uttered those words and sent
our best player packing, but also scored an extra goal and helped
Italy win the world cup"

Ye, we can understand why he said he scored the "extra-goal".
At the near end of the match in the second period of extra-time the french
players were really pushing it hard and almost scored a goal ...
suddenly zidane's head butt and the rest is history ... it went to
penalties and the italians won on penalties. For me this world cup was
less convincing than the 2002 world cup for the sheer fact of the dives
(all hail van bommel)/unfair play (do u remember a banner called "My play is fair play ??")
/inconsistent referees(Portugal v Holland) and ofcourse the materazzi-zidane issue.

I bought a new laptop with very nice specs. That's some good news :)

/quit for now

Iam NOT the only one who cries over spilt milk.... ;'-(

I have got over what has been troubling me for almost a month or two.... I got over the fact that Iam not the only one who looks back at a good friend who is no more mine and I deserved it for sure.

Okay what's new in the scene ... Let's see ...

First off we've got the FBI raiding underground servers
Next we've got the usual punkz at school doing their grades away !
Microsoft are releasing what seems to be like "12 ?!" patches

I guess the folks at nCircle wouldn't be sad this time ;-))
Just looking ahead to a busy patch tuesday for him and his team ... so...so day for the sys-admins as well

/quit

Antivirus vendor Sophos has cracked the password for the Ransomware Archivieus.

Read the full story at Vnunet

The Da Vinci code "mobile-virus" ? Still unsure of what's going on because I haven't seen anyone in Chennai report anything or maybe they do...If someone is infected, consider sending me a sample because I'd like to have it :-))

Courtesy: MiDDAY magazine.

"Hardcore" Body building is what Iam going to be concentrating for a change side-tracking my security saga which has been going on for 5 yrs.

I want a break and Iam finally working out and eating like a beast ...to be precise
Iam trying to become a HUNK :-))

6 meals a day and 3 protein shakes ... Am I crazy ?? No ... Iam serious abt building myself like a beast.

Iam planning to gain say around 10 kilos in 3 months, ofcourse all this can't be done without a good protein intake. Iam using Creatine Monohydrate, and another supplement with L-Glutamine.

Oh, I almost forgot about WHEY ... hehe, I use that too... Hope I'd not die of renal failiure...lol

Cheers :)

http://blog.ncircle.com/archives/2006/05/certifications.htm

nCircle team's blog had this post and an e-week news-brief based on which this was written and it's makes for a good read if you're having ur tea in hand like me at midnight... lol

Cheers :-)

TV cards people ... It's time for new action as I have gone chasing the card model from Nagra systems for TV.

The card model is ST19XL18... I have figured out a new way of dumping the eprom. The card's memory is having several roms. (3 ROMs and 1 EEPROM) The whole thing is about DSS hacking. Sadly there's no DSS in Chennai, only cable TV

I got lucky when I met a 24 yr old from Portugal who asked me for help and it's really cool to know that weak crypto algos like DES are still used in TV cards. The whole aim to do all this to see more/all channels for FREE

We have finally made it ... he was happy and so am I... I learned something new and new hardware to play with.
The best part was all this was done remotely with me just supervising about the hardware/cables/connectors and the binaries were sent to me by email. He co-operated with me a lot and Iam proud that we did all this within 1 week. Hehe ;-))

Given below is a small working of our old 64-bit algo.
>> A short write up on DES by the Matthew Fischer <<
Courtesy: Zone-H.org

Cheers

Update: If anybody wants the ST-7 opcodes email me

Rediff website has introduced a service/page for searching the approximate air fare for cities inside India only. The service is still beta and it's named Faresearch.

You can check out >> the service here <<

I found this while checking my mails in my almost extinct rediff a/c :))

Cheers

Car engines are amazing and they can be more fun sometimes, but paining as well.

To know their details can be fun, but to draw maps of their connections can really be a pain in the ... well , it's happening now and I accidentally sleep these days just too much unusually. So time is still one step ahead of me.

Car and computers are inter-related and I knew how only from ... some kind ppl who told me the things written below :-)

As technology advanced, so did the electronics that go into cars. The ECU in a modern automobile, together with advanced engine technology, makes it possible to control many aspects of the engine's operation, such as spark timing and fuel injection. The ECU may also control valve timing, boost control (in turbocharged engines), ABS, the automatic transmission, and the electronic stability control system. All western cars like Nissan/Volvo/BMW/Skoda/Renault that have been manufactured after 1996 have ECU in them. The first ECU was seen in early 1970 as per Wikipedia. ECU means Electronic control unit or sometimes, called Engine control unit.

My Embedded RE project has something do with the ECU only :-))

Twenty dont's for ASP developers
The article is precise and exactly to the point , making it more easier to read and understand.
It's a must read for all developers who use ASP.

Courtesy of Security Focus

Regards

Okay, it's been almost a week or more since I blogged.

Iam now in kolkata and Iam here for a kewl project.I like the city, I have been here for 3 days and to be very frank I like this place ;)

I have mapped several ideas for working on the project and I have temporarily stopped analyzing malware because this project is really sophisticated than the former. It's an embedded RE project.

I'll update what Iam doing periodically ... if I have time.

Regards

MS Malicious code removal tool update for march includes W32/Atak, W32/Zlob and W32/Torvil

Get it here
(note: this tool is not a continual defense product like anti-virus or firewall product,it can be run on-demand)

Regards

The VM Rootkits : Next big threat to security ??

MS Research team has come up with a rootkit which can defeat virtual machine technologies like vmware/ms-virtual pc. They seem to have tested the PoC code on a linux/vmware and a windows/ms-virtual pc. Get the full story here

Regards

Is Google the next Big Brother ??

The above mentioned article makes for an interesting read and it spits out the facts of why/how Google could be potentially dangerous in the future not only for Microsoft but also to the common internet user like me or you.

The invasion of email privacy is one key point to be noted by all Gmail fans out there.

I have no comments regarding this Gmail issue because I use Yahoo mail.

Regards

Regarding the OS X 86 Maxxuss has successfully ported the system long time back and is now producing patches in a race with Apple, I spotted that the issue of dual booting OS X / Win XP will soon be accomplished.
More info about this can be had from this website

Meanwhile we must not forget that still some computers in the world are infected with Nyxem.e which will activate its payload on the 3rd of every month. I heard from some sources near me indicating a meagre rate of infection still existing here.

/quit

An Auditor from Deloitte & Touche,USA has lost an unencrypted CD beleived to be containing important information of current and former McAfee Employees. Around 9000 employees' social security numbers, information of stock holdings and other important info has been lost.

A Deloitte representative confirmed this incident had taken place on Dec.15 and McAfee were informed on Jan.11 almost a month after the incident had occured.

Read the full story here

Feels good to have gone bug-hunting after a long time. I found a couple of buffer overflows in a prominent software in just a matter of 2 hrs !!. The POC Code will not be released. I have contacted the vendor and prefer not to elaborate on the details of the same as malware authors are waiting to prey in such situations ;-))

Life seems to be fast these days and time alwayz is one-step ahead of me ... I hope to change this situation soon.

Regards

Apple proxy ?? Apple's site mac.com has a redirection facility which attackers "can" use to their advantage.

Check this out : http://www.mac.com//redirect/http://www.hotmail.com

The above crafted URL is just a example,instead of hotmail it could be "any" dangerous URL perhaps a scam.

Regards

OS/X Leap.a - First power pc malware found in the wild.

Read more from the source

You can get F-Secure's analysis here.

Does this mean Mac is becoming more popular with the latest collaboration between Apple and Intel ???
Yes,it's becoming prominent and malware authors are targetting it for a change ;-))

Regards

The muslims have once again started defacing websites, and posting political messages against denmark... More news on the issue can be had from here . It's strange why denmark had to say anything ...and why this new wave of cyberwar against the two had to arise..??

It's just in it's budding stages, and more attacks are likely to be seen in the future. These things remind me of the all-famous Yaha worm and their variants which wreaked havoc in Pakistani ISP(s). Indians and pakistanis were dueling each other a while ago from 2001 or so and still it is continuiing ...for a reason called "Kashmir"

IMHO a Cyberwar between any two countries on political grounds is un-necessary. This is not any good because true patriots know how to fight by conducting, campaigns / speeches etc instead of trying to attack one's digital possesion.

Why try to mess with one's digital privacy when there are governments and other departments under them trying to bridge these issues smoothly.

Regards

---[Disclaimer]---
This post is just my view and it's not meant to be Indian's view or pakistan's view or whatever. Iam against racial /communal feelings. Everybody is a human and they deserve what they actually do ... Neither me nor my host (blogger.com) can be held liable for any misconception of what is expressed in this post.

We need to compete for knowledge and wisdom, not for grades. Knowledge is piling up facts, wisdom is simplifying it. One could have good grades and a degree without learning much. The most important thing one can learn is to "learn to learn." People confuse education with the ability to memorize facts. Education of the mind without morals creates a menace to society.

Who is really educated ??

In a nutshell, educated persons are those who can choose wisely and courageously under any circumstances. If they have the ability to choose between wisdom and foolishness, between good and bad, between virtuousness and vulgarities, regardless of the academic degrees they have, then they are educated.

Expert ?? An expert is someone who knows all the answers if you ask the right questions.

Taken from Shiv Khera's book = You can win :-)

Still reading the book ... More to come ...

Regards

To give you an example of selective listening, let me share with you a story I heard about a medical doctor who was invited as a guest speaker to address a group of alcoholics. He wanted to make a demonstration that would be powerful enough to make people realize that alcohol was injurious to their health. He had two containers, one with pure distilled water and one with pure alcohol. He put an earthworm into the distilled water and it swam beautifully and came up to the top. He put another earthworm into the alcohol and it disintegrated in front of everyone's eyes. He wanted to prove that this was what alcohol did to the insides of our body. He asked the group what the moral of the story ??

And one person from behind said, "If you drink alcohol you won't have worms in your stomach."

Was that the message? Of course not. That was selective listening--we hear what we want to hear and not what is being said. Many of our blessings are hidden treasures--count your blessings and not your troubles.

Taken from Shiv Khera's book = You can win :-)

Iam still glued to this piece of plethoric values ...

Regards

There was a man who made a living selling balloons at a fair.
He had all colors of balloons, including red, yellow, blue, and green. Whenever business was slow, he would release a helium-filled balloon into the air and when the children saw it go up, they all wanted to buy one. They would come up to him, buy a balloon, and his sales would go up again. He continued this process all day. One day, he felt someone tugging at his jacket. He turned around and saw a little boy who asked, "If you release a black balloon, would that also fly?" Moved by the boy's concern, the man replied with empathy, "Son, it is not the color of the balloon, it is what is inside that makes it go up."

The author's insight: What's inside us matters,"the attitude" that makes the difference between losers and winners...

Taken from Shiv Khera's Book = You can Win(best selling title) :)

It also brings to mind the saying "IT'S THE ATTITUDE,NOT THE APTITUDE THAT DETERMINES ONE'S ALTITUDE"

Regards

According to Security Focus news Nyxem.e/Blackmal.e/MyWife.e is spreading rapidly in India,Turkey,Italy ...
Read more about the news article here

This came up shortly after I posted my views/rough analysis of the worm.

Update: F-Secure has released a disinfection utility called F-Force for Nyxem.e

Regards

Nyxem.e is a mass mailing worm, it sends the attachment, with filetype bhx(which actually is the worm). I was not surprised when a institute where I had studied was infected with the worm. (No anti-virus installed either) So the possibility of infection was very high. I won't be wondering if the worm spread to all their students' email and inturn their friends / contacts.

Some behavioral details

1)Coded in Microsoft Visual Basic, it uses remote shares to spread itself
2)Nasty payload: Deletes the file of the following filetype *.doc/*.xls/*.mdb/*.mde/*.ppt/*.pps/*.zip/*.rar/*.pdf/*.psd/*.dmp
3)It poses to be a winzip file (which is more threatening)
4)It escapes from anti-virus vendors as it's kinda mydoom's design by avoiding sending the emails to their domains.
5)It also kills the following services(anti-viruses)
SYMANTEC/SCAN/KASPERSKY/VIRUS/MCAFEE/TREND MICRO/NORTON/REMOVAL/FIX

So even if the institute I mentioned had a Anti-virus, it might have only one of the leading av's and this makes the installation of anti-viruses futile.

I was particularly interested in this one because it's payload was to delete almost all essential files on the harddisk on Feb 3 or 3rd day of any month.This is aided by the running of a exe called update.exe is loaded into memory.(update.exe is created by the worm)I haven't fully analysed the worm.

I have just outlined some of the key features which make it deadly.

Regards

Yo... I have been playing with some old samples recently.. Iam also linked with a upcoming security firm in my city,where I might secure a job for myself for good ;-)

That's all I have in stock for now :-)

Regards

My primary 40gig hdd crashed and it was declared unusable by me as soon as I got a couple of Data Read/Write errors.(also accompanying these two was the CRC Error for the hdd). I still wanted to try to make it re-usable instead of throwing it ... Hoping to make something happen I installed Win2000 SP4 and a Vmware image. As soon as I started working ... I again get these bsod(errors as mentioned above). I finally format it again fully and I won't throw it ... but I will have it as a souvenir/my memoir or whatever I feel like calling it ... Iam planning to buy a 10-20gig hdd to get back the setup for working on vulns/malware.

Pray for my new hdd's health...

Regards