DNS Changer Malware

Hello readers,
Its difficult to juggle between academics, extracurricular, social life, learning stuff and still finding time to write article for my blog. I've got some nice advice today from one of the senior member on a hacker's forum. Nowonwards I'll be doing my best to keep this blog updated. So do check out!
This is an article I wrote for our college magazine which will be published tomorrow. There was a word limit and it's intended for general audience. Here we go...

These warnings splashed across the internet, facebook, google and newspapers, ‘you may lose your access to internet on 9^th of July.’ The reason behind it, the FBI was to take down around 100 rough DNS servers that infected over 4 million computers in over 100 countries. ‘Operation Ghost Click’ –as it was codenamed- is considered one of the biggest cybercrime takedowns in the history.

          Year 2007, a group of Estonian and Russian hackers released this DNS hijacking malware. This ‘DNS changer’ malware made its way into user’s computers by tricking them into downloading a video-codec (a piece of software required to play the video format)  when they visit certain websites.  This malware would then change the DNS server entries in the infected computer to point them to a rogue DNS set up by attackers. These servers redirected links of certain websites to advertising pages, thus pulling a revenue of whooping $14 million to its creators through fraudulent advertising. The malware also prevented any installed antivirus from receiving security updates. Within four years of presence of this malware all over the world, its botnet (zombie network) grew up to few million, a large part of which was in the USA.

          On 9 Nov 2011, FBI and the US authorities began the ‘operation ghost click’ to take down this multi million cybercrime racket. Six Estonian and one Russian national connected to the DNSchanger being charged and arrested, FBI seized the DNS servers connected to the malware. Plan was to immediately take down these rough DNS changer, although this would mean leaving millions of infected users without a way to connect to the internet. Hence the court ordered Internet Systems Consortium (ISC) to operate the replacement DNS servers and prompt the infected users about the presence of malware. The deadline of this court order was delayed up to 9^th July 2012 because of the concern that there were still many infected computers across the world. During this period, FBI began extensive media campaign to warn users about the DNS changer malware and they might lose access to internet on 9^th July.

          Impact of this shutdown is considered minimal, credits to the informational campaign surrounding the malware, ISPs providing temporary DNS to the affected customers, Antivirus companies doing their best along with facebook and google providing notifications to the visitors who were affected by the malware. It has been estimated that number of infections still present is dropped down to some ten thousands. A website http://www.dcwg.org is set up to provide information and help people scan and remove malware from their machines.

          While the damage done by DNSchanger is much under control now, many botnets consisting thousands of zombies, still exist in the world. At worst, sophisticated attacks against government and military systems can be launched from these infected computers, which may create trouble for the end user. It won’t hurt to follow simple security practices to combat the evergrowing hackers’ underground.

Web application attack: XSS

1.     Introduction:

The web has grown exponentially in last few years catering as the foremost platform for e-commerce, Social networking, Banking, Online shopping, Entertainment and much more. Web servers and web applications are being deployed to provide services and carry out operations where the medium World Wide Web is involved. Naturally web application security issues have surfaced, which have become a major cause of concern for organizations which depend on www for their functioning. The field of web application security has increased at great pace with new vulnerabilities and security flaws coming into picture. There will be hardly anyone reading this article, who has not heard of news related to website compromise, user account hacking or ethical hacking. The OWASP lists top 10 web application security risks. OWASP stands for open web application security project. It is a worldwide charitable organization focused on improving security of application software. XSS is a common vulnerability found in web applications which ranks 2^nd out of OWASP’s top 10. Nearly 39% of web application security flaws are related to XSS. In this article, I will try to explain how XSS works, its dangers and how these attacks can be prevented.

2.     What is XSS:

XSS stands for Cross site scripting. (Do not confuse XSS with CSS which stand for ‘Cascading Style Sheets’ and are nowhere related). XSS is basically, injecting malicious scripts into webpages or webapplications through an HTTP request which tampers with the expected output from web application. In this, the malicious scripts (precisely, Javascript) exploits the interpretation of scripts in web browser. The browser is fooled into executing scripts that appear to come from trusted website. These XSS attacks occur when web applications send user-supplied input to the browser without proper sanitization. The idea of XSS will get clearer when we discuss the first example in section ‘Finding XSS vulnerabilities’.

3.     Risks of XSS flaws:

Okay, so, what’s the deal when my web browser executes some strange scripts? What all damage it can possibly have? Well, if the website you’re accessing has XSS vulnerability, an attacker with good knowledge can hijack your session with server, steal cookies from your PC, deface webpages, redirect you to unintended webpages and introduce malware scripts into your browser. XSS also aids phishing-a common way of hacking social networking and bank accounts. XSS vulnerabilities are classified as very widespread and most prevalent web application security vulnerability by OWASP. Impacts of XSS are classified as ‘moderate’. Risks arising from XSS range from constantly popping annoying pop-ups to total user account compromise, installing malware, virus on victim’s PC.

4.     Types of XSS:

Reading theory about security stuff like this is always boring. I promise I’ll quickly introduce you to the 3 types of XSS and then we’ll move on to next topics which I hope, you’ll find interesting. Anyways, the 3 types of XSS attacks are called - stored, reflected and DOM based.

1)     Stored:

Stored XSS attacks are those when the malicious script permanently gets stored on the webpages, databases of victim website. Think of it like this- there is this news website which allows you to enter comments on their news articles. The comments stay on the page forever. Now instead of putting comment, you entered a javascript and sent it. Now this javascript will stay there forever and execute every time page is accessed. Here you just performed stored XSS attack. It is found in chatrooms, shoutboxes, bulletin boards, blogs etc.

2)     Reflected:

According to me, reflected XSS vulnerabilities are the most common of all vulnerabilities. For example, consider a situation where a website asks you to enter your name and then greets you by name. Like, “Good Morning !”. Now instead of putting your name, if you put a javascript, it will be echoed back from server and your browser will execute the script. Here we performed reflected XSS attack. It is called ‘reflected’ because the name entered by you doesn’t get stored on website. Error messages, search results, or any other response from server that includes atleast some of the user-supplied data maybe vulnerable to reflected XSS.

3)     DOM based:

Very rare. DOM based XSS are quite similar to the reflected XSS except that script doesn’t need to be echoed from server. Script is injected into the browser’s own DOM environment. The malicious code is passed as a parameter to the script residing on a webpage which unknowingly executes it.

5.     Finding XSS vulnerabilities:

In this section, we’re actually going to find a XSS vulnerability. XSS is basically injection of scripts into webpages. Consider the following simple PHP code which is vulnerable to XSS.

$query = $_POST['query'];

if (isset($_POST['query']))

{

echo "You searched for " . $query . "!";

}

echo "
Please type your search query below:

";

?>

If you have a web server installed, try running this PHP file. It asks you to enter a search query and simply prints “You searched for ”. Suppose if you type ‘PICT’, it will print, “You searched for PICT!”. The URL in this case will be:

http://www.example.com/search.php?query=PICT

Now, what if we replace “PICT” with following snippet of code?

URL will become:

http://www.example.com/search.php?query=

Here, the page will print upto “You searched for “ and then it will actually parse as any other HTML tag and execute the javascript code in between. The alert function is just used for demonstration and it can be replaced with any other javascript code-as we explore in next section. This is a reflected type of XSS attack.  Detection of XSS vulnerability is very easy by testing the input fields or manual analysis of web application code. If a webpage stores user supplied input as an attribute of an HTML tag, putting “> before the script tag will terminate the previous tag and hence browser will interpret script smoothly. Not only javascript, it is even possible to inject HTML code into XSS vulnerable webpage as follows:

http://www.example.com/search.php?query=

Great website!

As you can guess, this will print “You searched for “ and then ‘Great website’ in bigger font size. Similarly, all other HTML tags can be used here. Some mechanisms to thwart XSS attempts like magic quotes can be bypassed with String.fromCharCode() javascript function,  URL obfuscation, hex encoding etc but that is out of scope of this article.

6.     Exploiting XSS flaws:

1)     Injecting phishing page:

Phishing is basically, making the victim log in to a fake login page where the credentials entered by him are recorded by attacker. Their username and password is recorded in some database and they’re redirected back to original website. This is very very common hack these days and lots of people are attempting to ‘phish’ each other’s facebook accounts! If a webpage has XSS vulnerability, the contents of entire webpage can be modified to make it look like a login page where user can enter his credentials. The following example URL will demonstrate this:

http://www.example.com/search.php?query=

Username:
Password:

The above code is self-explanatory where write.php is a PHP file which records username and password sent to it through HTTP GET request.

2)     Iframe phishing:

This is similar to previous one. Instead of putting long html tags like

, etc, the attacker injects iframe in the target webpage as follows:

http://www.example.com/search.php?query=

notice that the 100% height and 100% width occupies the whole size of window and the victim won’t notice the difference if they’re foolish enough!

3)     Redirect phishing:

The injected javascript could be coded to redirect the user to another webpage where the attacker’s phishing page is hosted.

http://www.example.com/search.php?query=

where fakepage.htm is the page attacker wants victim to visit.

4)     Cookie stealing:

A user’s session with server can be hijacked once the attacker gets his cookie. The website should have XSS vulnerability for successful execution of this attack. The attacker can craft his link as follows:

http://www.example.com/search.php?query=

When the user opens such kind of link, the cookie stored by current session (i.e. by example.com) is passed as ‘cookie’ parameter to ‘write.php’ which is a PHP file hosted by attacker on his own domain. This php file records the cookie into database.

5)     Website defacement:

A website is prone to defacement if it has stored XSS vulnerability on it. The attacker can inject a script which can entirely modify the way a webpage looks. The injected script can make any changes to the page relying upon the power of Javascript. I’m sure you must have seen websites which say that they’re ‘hacked’ alongwith some message from hackers!

6)     Javascript events:

Javascript event triggers can be wisely used to perform XSS on websites which allow HTML tags but ban the usage of

When the error page is loaded, browser will parse

Hacking FAQ

Hello all, I’m writing this post with no background research. I am simply jumping off into this because I’ve been planning to write about this since long time but my heavy schedule has never permitted me to do it. So, being a hacker, I come across lot of people and friends who are interested to know what this hacking stuff is all about. Many times it turns out that whatever I explain to them is a total bouncer. They don’t really seem to understand the terms and jargon. Its even that I feel I’m terrible at explaining stuff. Here in this post I’ll try to magnify over answers to the questions that people generally ask about hacking. This post is meant for a complete layman in non-technical background and I’ll try to keep things as simple as possible just for the purpose of understanding.

So, what is exactly Hacking?

Probably you’ve heard of this term as analogous to robbery or taking over controls of something. That’s not wrong at all. According to me, Hacking –u can say- is:

Breaking into or gaining access to computers, networks, systems or accounts which allows the hacker to perform something he’s not supposed to do, or gain access to sensitive information he’s not supposed to have.

One more important thing, hacking is NOT magic. Actual hacking is much more complicated, it needs research about your target and exactly your purpose behind hacking. If you think you can just write some C++, Java program, run some software and can hack anybody’s facebook or email account within minutes, I’m afraid you’re terribly wrong.

This was all in a nutshell.

Isn’t this illegal to do so?

Yes, it is illegal to break into someone’s computer, web server or steal their passwords. There are two sides of the coin. There is malicious hacking, where a person illegally gains access to somebody’s PC, bank accounts, transfers money, steals passwords and does anything else which can land him in jail. On the other hand, there is something called as, Ethical hacking. Ethical hacking follows the same techniques and attacks as malicious hacking does, what makes the difference is the intent of doing it. Ethical hacking is hacking for gaining knowledge. Learning ethical hacking allows you to get into the shoes of hackers and perform hacking, but in such a way that it does not break the law. Ethical hacking is performed in lab environment or your own computers. Here you have permission from the owner whose systems or computers you are trying to hack. So, ethical hacking all about gaining knowledge and skills on hacking, and utilizing it for good purposes, like, improving security of an organization.

Can hackers be called as criminals?

No, no. This is a big misunderstanding in public, courtesy to media and movies. Hackers are not at all, like the way they’re depicted in movies. Hackers are actually good people, who are curious about working of technology. They enjoy exploring into software and hardware to understand the nitty gritty details of security and operation, and see if they could fix it or a better alternative could be employed. This leads us to the discussion of types of hackers.

There are broadly three types of hackers.

1.      Black hat hackers – Black hat hackers or crackers are the actual criminal guys you see in movies. They do malicious hacking for fun, profit, challenge or whatever. They try to break into web servers, computers in what we call illegal way. They generally misuse the sensitive information obtained from hacks. Sometime in their life, they may get arrested for doing wrong things and tried in court.

2.      White hat hackers – These are the good guys. They’re ethical hackers. They perform hacking with permission from owner. This ethical hacking is performed to test the security of computer networks. Ethical hackers need to be updated with latest threats and security flaws that hit the web. Ethical Hacker is actually a job role in IT sector. Ethical hackers are paid to carry out penetration testing and vulnerability assessment on computer networks and servers. They need to be aware of latest technologies emerging out as crackers may quickly employ them to target their organization. With the knowledge of methodology and principles used by crackers, these people can improve the security and mitigate the risk of hacking and stealing of sensitive data.

3.      Gray hat hackers – This is a fine line between white hat and black hat. Gray hat hackers have something from both the worlds. They maybe sharply skilled black hats who may help a company to analyze and mitigate security threats or they may help a government agency to track down a criminal black hat. Also gray hat may include some good white hat fellows who may have taken wrong path sometime and did some sort of malicious hacking he was not supposed to do.

What is the difference between legal hacking and illegal hacking?

The difference is all about the intent of doing it. If someone allows you to break into their computers sheer for you to gain knowledge and acquire skills, it is legal. If an organization hires you to perform penetration testing (it is basically finding security flaws and risks within an organization and fixing it), it is legal as well. If you happen to hack into web servers of some reputed e-commerce website and stole all their usernames, passwords and credit card numbers and start using it with bad intentions, it is illegal hacking. Hope you get my point.

What do I need to have to be a hacker?

One thing I’d like to clarify here. The way hacking is depicted in movies and media, is totally false.  There is this hacker guy, who opens up his laptop, types in some strange looking commands, his screen shows some ‘connecting target’ dialogue box and poof! Within minutes, a damn government agency is under his control! :P

Hacking is never like that. Hacking is never that simple. There is no single software which can do all kinds of hacking automatically for you. You see, there are lot of different techniques, tools and methods used in hacking. It is a vast field and it is expanding every day. The tools and techniques vary depending upon your target and exactly what is your purpose of hacking. There are different methods of hacking a social network account, a web server, a company’s internal network, a website, hacking a windows password, linux, viruses, Trojans and this list goes on… There are numerous different tools and exploits available depending upon the platform or OS your target is running, as well as softwares running over it.

To start off in hacking, you need to be fluent in atleast a couple of programming languages. C, C++, Java, Python, Ruby and many of them are out there. I’d recommend at least you should be able to program in C and Python if not any other language. Also HTML and JavaScript is a must-know. Although its not mandatory, learning a server side scripting language like PHP is always beneficial. Then, you should have a good understanding of networking, OSI layers and TCP/IP. Without the knowledge of these, you won’t really have the fun of understanding what goes on inside during a hack.

Last but not the least, your interest, patience, and ability to deal with challenges is what matters the most. If you’re really not curious to know hacking, but just want to learn it to hack someone’s facebook account or impress your girlfriend, better back off right now otherwise you’ll end up rounding the circle or will get scammed. If hacking fascinates you and you’re really eager to learn these things with enthusiasm, the world of hacking is waiting for you! Second most important thing to have is patience. It takes lot of time to get to know your target from a hacker’s perspective, analyzing its software, its services, identifying its weaknesses, figuring out how the exploitation can be done, how to gain more and deeper access to the systems and covering your tracks.

How do I learn hacking?

The internet is indeed a rich source of information. You can learn almost anything on internet for free. Lots of hacking and security ebooks are available on the net. One google search might reveal them. There are many different hacking forums where hackers from different parts of world interact. You should definitely join few of them and keep visiting and posting on them often. Many hard copy books are written on hacking and security. You can purchase them from amazon or ebay if not from your local bookstore. The internet is full of resources, the more you dig in, the more you get. If, at any point, you get a question about how to learn hacking, you can always use google. Google is always there to help you out in any situation you come across. Also you can post on any hacking forums. Spend some time in learning different tools. That practice helps a lot when you come across real world scenarios. If you’re ready to take up hacking and security as your profession, there are certifications like Certified Ethical Hacker you can take up. One last thing, don’t expect everything to be spoon fed and don’t give up early.

Comments and suggestions are welcomed!

YOU ARE ON TARGET - Common User.

"I just use my computer for checking my orkut, facebook. I use it for making transactions. I have no business with whatever cybercrimes occur out there." Common words by a common internet user. There seems no much awareness in the community about their safety online until their PCs turn damn slow or forced to format. The underground hackers community is increasing day by day and so the number of malicious programs like viruses. So, why cyber security a topic at stake? The answer lies in the title of this article. Your computer can be used as a platform from perpetrators to commit cyber crime. As I said, the underground world is increasing fastly. Any script kiddie (a person who doesn't know programming but downloads the tools and runs them without knowing the mechanism of it) is just a download away from taking access to your computer. Even these days there has been mechanisms to bypass the antiviruses and believe me, with plenty of readymade tutorials and tools available on the bay of internet, it is just a game of few hours for somebody to damage your computer unless you follow security measures.
Okay, what if anybody takes access to my system, whats the big deal he can do? There has been endless possibilities what an attacker can do with access to your system. For an instance, they can delete or modify your data. They can get your login credentials to your email or social networking accounts. They can install nasty programs on your computer, can even send them to all your contacts, making propagation. Slow down your system speed. Worst of all, can use your computer to attack other major government or military systems, and erase their evidences, which can land you behind bars. As it is said, the next world war is going to happen on cables of internet and like any other war, it will attack on common man because he is a soft target and others do know it will make great impact. Thats why we need our community ready to face these forthcoming challenges. There has been many campaigns on increasing the awareness in common people about cyber security. Taking into consideration all these security risks, I am explaining below how we can avoid getting into trouble. Here I will cover how to be secure for a common user and will discuss money frauds and scams into nitty-gritty in next article. I'll try not to make these guidelines cumbersome to follow. But at last, your security is in your hands.

1. Use strong passwords:
Okay, so what do u mean by a strong password. How many of you have your name, birth date, mobile number, your lover's name, parent's name, name of your area where you live, similar to your username, your company name, favorite colour, or simple numbers (1,2,3,4,5,6 etc), the word "password", "password123" as your password? This is what hackers exploit. If a close one knows the above details about you (many of them do know), then they have actually nothing to do, but with a couple of failed attempts, they can gain access to your account. Which even a person with 0 hacking knowledge can do. Moreever, how many of you have a word appearing in dictionary as your password? What hackers do, they actually try all the words in dictionary as your password credential with automated programs (plenty of them are out there). While scanning the internet, my friend came across some systems sitting naked on internet. As they were asking for password, he tried a simple username password combination "admin-admin" and it actually worked! We had whole access to that particular system. It was a wireless router. This is not the only case. There has been thousands of computers, routers, servers accessible from net which have weak or no passwords. So, what are good passwords to keep? Following are some guidelines in making your password:
1. It should NOT be very common as mentioned above, it should not be any word in dictionary.
2. It should be long one (but only in the limits of your memory!)
3. It SHOULD contain both letters and numbers in random manner, even special characters are recommended.
4. It should not make any meaning.
5. It should be uppercase as well as lowercase if possible.
So, according to these rules, the word "password12" stands a bad password. "54235" stands a bad password as it contains only numbers and very less number of characters. "nomenclature" stands a bad password as it appears in dictionary. "whskw36" also stands a bad password as it contains only 7 characters. "love143" is a bad password as it makes some meaning. "um6ogisC11bgF" is a strong password as it satisfies all the conditions and becomes very difficult to crack. Further, following are some tips for the safety of passwords:
1. Don't write your password anywhere as any experienced person looking that block of letters can conclude that this might be your password.
2. Don't share it with anyone. I guess no need to explain this!
3. Do not use same password at all the places. Also consider how many passwords you can remember at a time.
4. Change your password at least once in a month. I know its cumbersome to follow but it can be checked if you implement the next things...

2. ALWAYS HAVE A LICENSED AND UPDATED ANTIVIRUS:
Get a good and licensed antivirus. They automatically update themselves on connecting to internet. Purchase it from trusted dealer only. This is one investment which you have to do. Dont download it from torrents or from other sites which comes with cracks. From outside, they might seem running well, but from inside, any trojan virus must be planted behind them! So, get them running by purchasing only. Also if the validity expires, it is necessary to renew them as soon as possible because antiviruses can avoid most of the ways in which your security could be compromised. It is recommended to scan your computer once in a week. Having a firewall is also advised. Firewall is a software which blocks illegal connections or attempts a hacker makes from internet. I recommend quick heal antivirus which comes with firewall and further, it is one of the top antiviruses of the world.

3. CAREFUL ABOUT WHAT YOU DOWNLOAD:
On downloading something, get it scanned with antivirus and confirm that there are no viruses in that before running it. Confirm that it is from a trusted source. Be alert when you download something from warez or torrents. Same is the case with email attachments. Also beware of unknown ".exe" files. They are most likely to be having a virus. Just one mantra, Get them scanned first!

4. EMAILS:
There is nothing going to happen you if you don't forward any message! You must be getting many of such emails like, this is an image of god, the person who didn't forward this, died on the next day, the one who forwarded, got 10000$ in the next day. Believe me, all those are hoax. They are nonsense mails just to force the user in spreading the mail more and more. I recommend that you delete them without reading. Some of such hoax emails have some malicious programs even in the images inside them. These images actually track where the mail is being received and forwarded to their maker. So, do not fall prey to these traps.

5. PHISHING:
Phishing is an act of impersonating to be something legitimate and tricking the user into giving their credentials. Basically its a login page looking similar to original one but when you enter the credentials, it has gone to the hacker. Have you ever received any mail asking you to click on any link to verify your account? beware, it might be phishing attempt. What are the countermeasure to phishing?
1. Always check from where you got the mail. webmail@icicibank.com or mailinglist@icicibank.com are legitimate one but admin@icicbanks.com (note the spelling difference) or icicibank@gmail.com are not.
2. Whenever you are logging in to trusted websites, check the URL... If it is https://.... then you can be sure that it is secure (https stands for secure), but if it is http://.... then go on checking further...
3. Check if it is actual website address. i.e. www.icicibank.com/.... is correct, but 209.88.232.34/... or icicibank.110hosts.com/.... or www.bankicici.com/.... are not legitimate!!
One more example.. http://orkut.xp.com/ , http://new.0rkut.com/ are fake ones.
Generally legitimate websites will not ask you to click on any link (unless in case of registering your account). Mostly they will ask you to visit their websites directly. One more thing, avoid copy pasting codes in address bars and hitting enter. You might have seen this stuff on orkut. Actually those javascript codes will give the attacker access to your account. For more information about phishing, go through my phishing article.

6. SCAMS:
There is nothing free in this world. Have you ever got any lottery for which you never applied for? Actually these are scams to get money from you. These days, such sms have also started circulating. Once again, do not respond to emails which claim that you have won a lucky draw and asking you to follow the procedure. People falling prey to these have ended up in losing their money itself. I wont go in much details of this kind of fraud. I will cover money frauds in next article.

7. Never reveal your personal information to strangers:
Okay, this is little bit off topic. but for your personal safety.
Following can make up this:
1. don't give your phone number to any unknown person unless you are sure they are verified.
2. Same thing for address, avoid sharing it.
3. Be careful about sending your photos to ones whom you don't know well.
4. Not necessary that any person would be similar to the depiction done by their profile or photos. So, be cautious about meeting any online friend in personal.
5. Don't get forced into disputes or any offensive matter, just remove and ignore the person who has been offensive or asking you for help in any bad or personal matter. Misspells from offenders are their daily business but could hurt you a lot. So, learn to simply ignore them.

8. Get the softwares updated. There may have been some security risks with previous versions. So, it is necessary to update them whenever new update has been released. Also its advisable to use the latest operating system such as windows 7 over XP.

9. Always clear all sort of internet browsing history. You can use firefox for web browsing. After your work is finished, you can simply delete all the history by going under Tools menu. During browsing, many unwanted programs, malicious scripts and pieces of code gets downloaded to your computer. It is harmful if they are kept for long as they can eventually gain whole access to your computer. Clearing the history before shutting down the computer is a good habit to follow.

10. Always scan external drives before exploring them as they might possess a threat.

Okay, that's it for the user security. Hope you like it. Don't forget to comment. In next article, I will cover money frauds. Enjoy!