Bypassing Antivirus with a Sharp Syringe

Bypassing antiviruses is not a big deal now a days, the point is how creative you can get to do that. So here is the technique documented by me (inf0g33k) in a research paper on exploit-db and explained in a video on Securitytube. This technique works by generating a shellcode and executing it directly on the target machine instead of compiling it in an exe file. Backdoor created using this technique was getting caught by some antiviruses because i tested it on virustotal and they send samples to antivirus vendors so now Bruno Cardenas Cyberoff (Luzzell) made a little tweak that can make this technique bypass all the antiviruses again.

Read More

Your Internet connection may drop on 8th March

Did you know that that your Internet connection can be dropped on 8th March? The cause: a new type of malware (DNSChanger) that modifies your internet connection settings and changes your DNS Servers. Don’t worry, you can easily prevent and fix that.

Some background info

So…why is having the right DNS servers setup on your PC important? Well, this service/server converts those user-friendly web domains (ex: www.bullguard.com) into an IP (217.72.253.133). Basically, the computers are communicating with each other using those numbers. The domain names have been invented for the human mind, to be more easily memorized. If a DNS server is down, when entering the domain name into the browser, the page will not load. Of course, you can use the IP (http://217.72.253.133/) but who can remember that?!

Confused? Check out this cartoon:

About DNS Changer malware

Unfortunately, cybercriminals have figured out that if they control the DNS servers, they control the websites you want to connect to. In this particular case, they created a new type of malware, called DNSChanger, which has the mission to replace your DNS servers (usually provided by your Internet Service Provider) with rogue ones created by the criminals.

This virus has been around since 2007, infected millions of computers worldwide and stealing around $14 million from the infected users. The mechanism: using the bad DNS, they redirect you to phishing websites, adware etc.

The good news if that, at the end of the last year, FBI succeeded in finding and arresting all the gang members behind this and found the location of the rogue servers. They had the good sense to not simply shut down the servers (and break the Internet Connection for millions of users) but instead replaced them with legitimate ones.

Unfortunately, these will not be online indefinitely. According to the court permission, FBI can keep the servers online until 8^th March. (The Bureau has applied to extend this safety net until 9 July).

What to do?

First of all, check if your DNS servers are among the rogue ones:

• 85.255.112.0 through 85.255.127.255
• 67.210.0.0 through 67.210.15.255
• 93.188.160.0 through 93.188.167.255
• 77.67.83.0 through 77.67.83.255
• 213.109.64.0 through 213.109.79.255
• 64.28.176.0 through 64.28.191.255

To do that, follow these steps:

1. Click on START | RUN and type CMD in the Open: field, then click OK.  This will open a black command prompt window.
2.  At the prompt type: ipconfig /all and press Enter
3.  This will show you lots of information about your network connection.  Find the line that says “DNS Servers . . . “.  If that line contains any address from above you will need to change your DNS servers.

Also, you can use this quicker way provided by FBI: https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS 

After doing that, please make sure you regularly scan your computer with a trusted antivirus product.

Read More

Citadel banking malware is evolving and spreading rapidly

IDG News Service - A computer Trojan that targets online banking users is evolving and spreading rapidly because its creators have adopted an open-source development model, according to researchers from cyberthreat management firm Seculert.

Called Citadel, the new piece of malware is based on ZeuS, one of the oldest and most popular online banking Trojans. ZeuS was abandoned by its creator in late 2010 and its source code leaked online a few months later.
Since its public release, the ZeuS source code has served as base for the development other Trojans, including Ice IX and now Citadel.
"Seculert's Research Lab discovered the first indication of a Citadel botnet on December 17th, 2011," the security company said Wednesday in a blog post. "The level of adoption and development of Citadel is rapidly growing."
Seculert has identified over 20 botnets that use different versions of this Trojan. "Each version added new modules and features, some of which were submitted by the Citadel customers themselves," the company said.
The most interesting aspect of Citadel is its development process, which is similar to the ones behind community-supported open source projects. "Similar to legitimate software companies, the Citadel authors provide their customers with a User Manual, Release Notes and a License Agreement," Seculert said.
Like its parent, Citadel is sold as a crimeware toolkit on the underground market. The tookit allows fraudsters to customize the Trojan according to their needs and command and control infrastructure.
However, the Citadel authors went even further and developed an online platform where customers can request features, report bugs and even contribute modules.
While analyzing different Citadel versions that were released in rapid succession, Seculert's researchers spotted improvements like the use of AES encryption for configuration files, the blocking of antivirus websites on infected computers, the blocking of automated botnet tracking services and the addition of remote screen video recording capability.
The security company believes that the success of this Trojan could drive other malware writers to adopt the open-source model. "This recent development may be an indication of a trend in malware evolution," Seculert said.

Read More