SecurityZone.org - Information Security Blog

Test Post - Ignore jjjjjx1p

Steven Adair — Wed, 16 Feb 2011 23:06:42 +0000

Test Post - Ignore jjjjjx1p

The IP Address 128.154.26.11 is NOT trying to hack you. :-)

Steven Adair — Sat, 29 Jan 2011 00:57:59 +0000

If you found this post from searching the IP address 128.154.26.11, then I likely have good news and bad news for you. Let’s start with the good news. The good news is that there is no one behind the IP address 128.154.26.11, which belongs to the National Aeronautics and Space Administration (NASA), trying to hack you. The bad news is that you are probably infected with malware.

If you’re seeing a window that looks like the image below, you have a fake anti-virus program installed on your system (possibly named My Security Wall).

This is a bogus message that has for whatever reason chose to say the IP 128.154.26.11, out of all the IP addresses on the Internet, is trying to steal your identity. This could just as easily be any IP address as it’s not real. If you need help removing this malware, try Googling for “removing my security wall” and good luck!

Malware Analysts Cookbook - Our Book is Out!

Steven Adair — Tue, 26 Oct 2010 03:36:37 +0000

I haven’t updated in ages but I do have something to tell all of you that still have me in your RSS feed readers and that end up stumbling upon my website. For a good part of this year I worked on a book called Malware Analyst’s Cookbook with Michael Ligh, Blake Harstein, and Matt Richard. We’ve also setup an accompanying website at www.malwarecookbook.com to post tools and updates related to the book as well. The book contains a ton of a recipes on how to accomplish various tasks and solve problems related to malware. It covers a massive array of topics and is great for anyone already into the security field or looking to join it.

To give you an idea of what’s covered here’s a list of chapters from the book:

I highly encourage you to take a look. I am sure you will not be disappointed.

Waledac July 4th Activity

Steven Adair — Sat, 04 Jul 2009 17:12:07 +0000

Just put up a new post on the Shadowserver page on July 4th/Independence day spam campaign activity.. it includes several new domains:

http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20090704

Domains:

4thfirework.com
biumer.com
entrank.com
fireholiday.com
fireworksholiday.com
fireworksnetwork.com
fireworkspoint.com
freeindependence.com
gemells.com
handyphoneworld.com
happyindependence.com
holidayfirework.com
holidaysfirework.com
holifireworks.com
interactiveindependence.com
miosmschat.com
movie4thjuly.com
moviefireworks.com
movieindependence.com
movies4thjuly.com
moviesfireworks.com
moviesindependence.com
outdoorindependence.com
smophi.com
superhandycap.com
thehandygal.com
video4thjuly.com
videoindependence.com
yourhandyhome.com
yusitymp.com

The page links to Jeremy @ sudosecure.net’s write-up as it already has good details on the campaign.

Steven

Long time no update - Some interesting links

Steven Adair — Wed, 17 Jun 2009 12:38:16 +0000

It has been a while since I have updated anything. I have been to busy and sometimes lazy to write stuff here or on the Shadowserver website. Since my last update I have been all over the states, to Moscow, Russia and Oslo, Norway. Very cool places! In any event I am still alive and have a few interesting links to post that are worth reading if you haven’t seen them already:

3FN Shut Down

Microsoft DirectX Vulnerability - Yikes

It seems my comment spam awaiting moderation has reached over 10,000. Quite impressive.. there is surely a lot of interesting data from that. Might make that into a feed one of these days. Keep an eye out and I’ll try and update more with better stuff soon.

Steven

bosee domains

More Waledac Domains from February 4, 2009

Steven Adair — Tue, 10 Feb 2009 05:15:43 +0000

Just a quick post on some of the newer Waledac domains. The following were registered on February 4, 2009:

adoresong.com
alldatanow.com
alldataworld.com
bestlovehelp.com
cantlosedata.com
chatloveonline.com
cherishletter.com
cherishpoems.com
freedoconline.com
losenowfast.com
lovecentralonline.com
lovelifeportal.com
mingwater.com
theworldpool.com
wagerpond.com
whocherish.com
worldlovelife.com
worshiplove.com
yourdatabank.com
yourteamdoc.com

These have been updated and added to the list on the Shadowserver site at:

http://www.shadowserver.org/wiki/uploads/Calendar/waledac_domains.txt

Steven

Full Waledac Domain Listing

Steven Adair — Sun, 25 Jan 2009 02:52:48 +0000

Got the full list also being updated and posted on the Shadowserver website at the following URL:

http://www.shadowserver.org/wiki/uploads/Calendar/waledac_domains.txt

However, just wanted to reiterate to people that you should block all of these domains:

Registered January 23, 2009:

adorelyric.com
adorepoem.com
adoresongs.com
bestadore.com
bestlovelong.com
funloveonline.com
youradore.com
yourgreatlove.com

Registered January 19, 2009:

bestgoodnews.com
goodnewsdigital.com
goodnewsreview.com
linkworldnews.com
reportradio.com
spacemynews.com
wapcitynews.com
worldnewsdot.com
worldnewseye.com
worldtracknews.com

Registered January 15, 2009:

bestbarack.com
bestbaracksite.com
bestobamadirect.com
expowale.com
greatbarackguide.com
greatobamaguide.com
greatobamaonline.com
jobarack.com
superobamadirect.com
superobamaonline.com
thebaracksite.com
topwale.com
waledirekt.com
waleonline.com
waleprojekt.com

Older:

bestchristmascard.com
bestmirabella.com
bestyearcard.com
blackchristmascard.com
cardnewyear.com
cheapdecember.com
christmaslightsnow.com
decemberchristmas.com
directchristmasgift.com
eternalgreetingcard.com
freechristmassite.com
freechristmasworld.com
freedecember.com
funnychristmasguide.com
greatmirabellasite.com
greetingcardcalendar.com
greetingcardgarb.com
greetingguide.com
greetingsupersite.com
holidayxmas.com
itsfatherchristmas.com
justchristmasgift.com
lifegreetingcard.com
livechristmascard.com
livechristmasgift.com
mirabellaclub.com
mirabellamotors.com
mirabellanews.com
mirabellaonline.com
newlifeyearsite.com
newmediayearguide.com
newyearcardcompany.com
newyearcardfree.com
newyearcardonline.com
newyearcardservice.com
smartcardgreeting.com
superchristmasday.com
superchristmaslights.com
superyearcard.com
themirabelladirect.com
themirabellaguide.com
themirabellahome.com
topgreetingsite.com
whitewhitechristmas.com
worldgreetingcard.com
yourchristmaslights.com
yourdecember.com
yourmirabelladirect.com
yourregards.com
youryearcard.com

Waledac Exploit Domain List:

googol-analisys.com
seocom.name
seocom.mobi
seofon.net

—-

Also, if you are interested in all things Waledac (omghi2u!), check our Jeremy’s Waledac tracker here:

http://sudosecure.net/waledac/

Google Chrome Browser: Hype & Vulnerabilities?

Steven Adair — Sun, 07 Sep 2008 16:14:53 +0000

Have you heard about the new Google Chrome browser lately? Chances are high that you have. However, are you or anyone you know actually using the browser? My guess is there’s a good chance the answer is NO. Sure, it’s just a beta version, but it’s been getting all kinds of hype.. seemingly out of no where. In fact I haven’t used it and don’t plan on even trying it out for some time. Why? Well, for starters I haven’t seen a real compelling reason to use it yet. Couple that with the horrendous privacy issues that have been raised and you’ve got a potential (as the article puts it) security nightmate. Oh did I mention there’s already been multiple public proof of concept exploits that can possibly result in a remote compromise?

It looks like Google Chrome is a pretty risky proposition right now. Yes, it is beta but some of these items are a bit alarming. I am not one of the people that calls Google evil, but I try not to let them near my data whenever possible. Using this browser definitely won’t further that cause. It is still a bit early with a few early adopters(testers), so we might see a lot of fixes and improvements across the board before its final release. I’ll post my two cents at a later date for anyone that might care.

I did a quick check and I can see that at least two visitors of the blog are trying out Google Chrome. Hopefully I’m not scaring anyone away from testing the browser, that certainly isn’t my intent. However, I just want people to know about the potential risks to privacy and security that presently exist. All browsers have security issues, however, that doesn’t mean we should ignore them. If you have any comments on this issue or the browser, feel free to submit them and I will post them.

In case there’s any interest, the Google Chrome User-Agent looks like this:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13

So I Installed PGP 9.8…

Steven Adair — Tue, 26 Aug 2008 21:16:48 +0000

…and well I am a bit disappointed. Note that I’ve added a new “category” in my blog called “whining” because that’s basically what I am doing now, so if you hate whining (read: b*tching) then you might want to skip this post.

In 2004 I got a copy of PGP 8.1 for Windows to use on an XP install at home. With this install came the standard PGP system tray icon that would let you control a sleuth of things to include clipboard and current window encryption/decryption as well as give you quick access to the PGP keys interface. This fine little install also had an Outlook (Express for me on that machine) plug-in for easy encryption/decryption of e-mail. It had its kinks and bugs but it worked pretty well. Now jump 4 years ahead to the present and on my Mac and Linux systems I use GnuGP (gpg) but that’s all done on the command line, so it’s kind of a pain. On an XP install with Office 2007 that I have at home — I do not have anything at all (no PGP or GPG).

Today I decided to put and end to that and paid for the upgrade for $29.99 (I was eligible from my old license) to PGP Home Desktop 9.8. Sure I feel like a sucker paying for software for which there are similar free options, but the GUI and a couple of other features are something I wanted to have. The new version also has some full disk encryption options as well as the creation of encrypted drives/storage spaces, which sounds nifty I suppose. Still consider checking out TrueCrypt anyway.

Anyway, the first thing I noticed was that the download of PGP Desktop was 72 MB .zip file, which seemed a little large. To my surprise they decided to pack both the 64-bit and 32-bit versions into the same .zip file. I really don’t see the logic in this. They could save bandwidth usage and time for both parties and I’ll take an absolutely wild stab in the dark that their 64-bit installs aren’t quite as numerous as their 32-bit installs (I could be wrong… it happened once). Great so I managed to install the correct version and am all fired up and good to go. Only I guess I suck at the whole RTFM thing because I didn’t realize there is no longer an Outlook plug-in. They went with the god awful proxy-detect-email-look-for-encryption-keys-we-suck method. All I can say is that I am very disappointed. I believe the plug-in was one of the best features of the old product. Now you’re stuck with some half-assed detection method that will send unencrypted messages if it messes up — super idea! I think I will pass on that.

Anyone else have some thoughts and opinions on the latest versions of PGP? I would love to hear them and I’ll approve/post the comments as long as they’re not overly vulgar (PG-13 at worst please).

Someone Hijacked My Baby?

Steven Adair — Tue, 26 Aug 2008 03:25:41 +0000

I just got a humorous Spam message that someone else told me about earlier. Apparently it’s supposed to have some sort of Virus attached to it. Only it seems my copy has been made a bit safer. The Spam message looks a little something like this:

Subject: We have hijacked your baby

Body:

Hey We have hijacked your baby but you must pay once to us $50 000. The details we will send later…

We has attached photo of your fume

Funny topic and bad grammar all make for a good virus/spam campaign. However, you might be wondering if I am nervous about receiving such an e-mail? Well, e-mail never really makes me nervous and then again I also don’t have a baby. Although I think I would be concerned if I had a baby and someone “hijacked” it. It seems my message got nibbled on by “MIMEDefang”, which was a bit disappointing since I wanted to see the attachment. I wanted to see if the trojan included a picture of a baby or not. I guess I’ll have to wait in suspense until someone shares a copy with me.

Feel free to drop me a line with a copy of this e-mail if you have it intact - steven [at] securityzone [dot] org

Update: 11:40 PM

Got a copy of the e-mail with the attachment in place. Sorry no picture but there is an attachment called “photo.zip” that has “photo.exe” inside of it. File MD5 for the .exe is 807efe034e50327234e83bc9e6a94b32.

This is a piece of malware which then downloads more malware from the known malicious website reddii.org. Stay away from these e-mails and that domain.