Danger! That USB Thumbdrive Keydisk thingy has a Virus.

Intro:
You may be able to remember a time when a floppy disk, those 1.44mb of storage, was your only way to get that masterpiece from work or school to home at night. A floppy disk could start a computer and make it go into MS-DOS, but not activate programs just from a simple insertion. Today Keydisks(also called Thumb Drives, and USB disks) are replacing floppies faster than companies can make them. Prices for a 1GB Keydisk can be as low as $20 and I have heard of organizations purchasing them by the bucket load -- literally.

The only problem with Keydisks is the fact that when inserted, they become a new Harddrive on the system, some, like U3 even create CD-Rom drive with a password protected start menu for portable access. This could allow someone to insert a Keydisk into a system, Autorun an invisible, no window launching virus, while they seem to type up that 30 page history report on why man didn't go to the moon and back... the reason I am writing this is because a while back some hackers in Australia left keydisks in public places containing viruses that would be activated as soon as they keydisk was inserted.

This tutorial will show you how to create a keydisk that has the ability to run a hidden program with just simply inserting it.

NEEDED:
- A U3 keydisk
- Internet connection
- works on all Win 98, Win 2000, XP, and Vista Machines.

HOW TO:

After briefly searching the Internet, I can find no program that compares to Sandisk's U3 software. It seems to work every time, no matter what the restrictions are on the PC. (Even limited users allow it to install with no problems)
So...

Setting up the U3 loader on the Keydisk:

If your key disk doesn't have the U3 loader installed, download the installer: http://www.sandisk.com/Retail/Default.aspx?CatID=1411
Run it, following the simple instructions.

Unfortunately there are only certain keydisks that work with the U3 software.
There is a small chip inside the U3 disks that allow it to trick the computer into thinking there is CD drive on the disk, this allows it to run the U3 start menu, which in turn can have a program auto started as soon as it is loaded up. The CD really is just an ISO file hidden on the disk. So when you download the installer it may say your disk is not compatible... which would be a bummer since this really is a neat hack.

Putting the Auto start to work:

Now the U3 firmware comes with some sample programs, the ability to lock the disk, and a bunch of other fancy stuff. You can access the "start button" for U3 by clicking the orange icon that appears by the clock.

U3 allows user to make their own software packages by following instructions and package here http://www.u3.com/developers/downloads/reference.aspx
but for the simplicity of this tutorial I am going to show you how to replace Firefox with any program you like and set it to automatically start when the disk is inserted.

1. Select the "Explore Keydisk" from the menu (top right)
   
2. In the explorer window that comes up, press Ctl + F (or View--> Search) and tell it to find the file "FirefoxForU3Start.exe"
3. Once you get the results, right click "FirefoxForU3Start.exe"and select "Open Containing Folder."
   
4. Rename "FirefoxForU3Start.exe" to something such as: "(BK)FirefoxForU3Start.exe"
   
5. Now take another exe file and copy it into the same folder as "FirefoxForU3Start.exe"
   
   (NOTE: If you can't see the .exe extention then, in explorer, click tools--> folder options, The "View" tab, and uncheck "Hide extensions for known file types"... this also helps you see viruses that disguise themselves as .PDF, .JPG files since now you can see the full ending of the file)
   
   If you don't have your own "exe" virus just use notepad.exe
   Click Start--> Run and then type:
   %systemroot%\system32
   (System root is a neat way of opening the folder windows lives in)
   scroll till you find "notepad.exe" and copy it to your keydisk.
   
6. Now rename "notepad.exe" to "FirefoxForU3Start.exe"
7. Click the U3 icon and select "Manage U3 Programs."
8. Click Mozilla Firefox and select the box that says "Start on Insertion"
   
9. Select OK and eject the Key disk, Now every time it is inserted "Notepad.exe" (which was renamed to FirefoxForU3Start.exe) will start...
   REMEMBER: Any exe file will work for this, most hackers will create a program that would set a rootkit embedded into the system, and then run the file "(BK)FirefoxU3Start.exe," that way no one will no the difference.

Other options:If you can't get the U3 Launcher on your Keydisk, then another option is to modify a file called "autorun.inf" which is in the root folder (the root is the first items you see when you double click on the drive).

Edit it in the form of:
Open="notepad.exe"
Action="notepad.exe
Shell="notepad.exe
where "notepad.exe" is a program in the root folder.

Protection:
The only way to prevent this--- and it isn't fully fool proof--- is to download Microsoft Powertool's TweakUI.exe (Mirror)
Open the Program from the Start Menu(All Programs--> Powertoys for Windows--> TweakUI)
Then click on My Computer -->Auto Play--> Drives
Uncheck the drives you wish to protect, and click OK.
(NOTE: This disables Auto Run, so any time you put in a CD you will have to go into My Computer to start it)


END NOTES:This particular attack is hard to execute, since it requires a physical access to someone else's Keydisk and PC. But there has been some talk about the idea that a virus could be implanted into a system and instead of using the Internet to travel, it travels by hopping onto a USB disk, Mobile phone/PDA, and even the USB flash disk in your Camera--- like one of the ways shown above (most likely the second example however).

So the next time some body says they want to plug their Keydisk into your PC think about what you are risking.


More Reading...
http://www.usbhacks.com/ made a post on how Sony installed Rootkits on they Keydisk, causing files to be hidden in the C:\windows folder
http://www.dailycupoftech.com/have-your-lost-usb-drive-ask-for-help/ As soon as your keydisk is inserted, a message shows up saying how to return it.

http://www.mydigitallife.info/2007/03/16/virus-infections-via-usb-drive/
The Virus doesn't need the Internet any more, it has your camera and USB drive!

Gmail making Spam tracking and Reporting just one step easier.

After checking my Email this weekend I noticed that Google has made a lot of changes.
One is the ability to easily view header by clicking the drop down arrow to the right of the "reply" button.

Many times when you receive spam and want to report it, the abuse department of the sender requests that you include full headers. This is what the the "show original" button lets you see:

(NOTE: This is a spam Email I received on Nov 3, the only thing that has been left out is my Email, everything else
is left as is. Highlighed are the sending IPs and Emails)
                                                                                                                                                                                                                                                   
Delivered-To: Anelite...@gmail.com
Received: by 10.142.114.1 with SMTP id m1cs413197wfc;
  Sat, 3 Nov 2007 09:46:11 -0700 (PDT)
Received: by 10.78.186.9 with SMTP id j9mr2269184huf.1194108369681;
  Sat, 03 Nov 2007 09:46:09 -0700 (PDT)
Return-Path: <cohen@pinkponk.com>
Received: from CSTLGA-COE-CIP525-01.coastalnow.net.216.166.216.in-addr.arpa ([216.166.216.138])
  by mx.google.com with ESMTP id 2si7442642nfv.2007.11.03.09.46.08;
  Sat, 03 Nov 2007 09:46:09 -0700 (PDT)
Received-SPF: neutral (google.com: 216.166.216.138 is neither permitted nor denied by domain of cohen@pinkponk.com) client-ip=216.166.216.138;
Authentication-Results: mx.google.com; spf=neutral (google.com: 216.166.216.138 is neither permitted nor denied by domain of cohen@pinkponk.com) smtp.mail=cohen@pinkponk.com
Received: from [216.166.216.138] by taurus-1.siol.net; Sat, 03 Nov 2007 16:49:32 +0000
Message-ID: <000401c81e39$0786d5d8$f9708d81@aengcxn>
From: "bjorne monty" <cohen@pinkponk.com>
To: 
Subject: Fw:
Date: Sat, 03 Nov 2007 15:02:09 +0000
MIME-Version: 1.0
Content-Type: text/plain;
 format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.2663
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757

Yahoo:

Hotmail:

To make MSN Hotmail display all header lines:

• Select Options from the top MSN Hotmail navigation bar.
• Make sure the Mail category is selected.
• Choose Mail Display Settings.
• Set Message Headers to Full.
• Click OK.

(source: about.com)

As can be seen by the highlighted parts, the IP Address is show in many places. Every user of the internet, whether they are a business, school, or home user is issued a individual IP Address that becomes specific to their router or PC. This IP normally will change after a given length of time called the license period or when ever the router/computer is disconnected or restarted.
When this email is reported to the parent company (in this case "pinkpoke.com") they can:

- simply delete the account and ban that IP Address from their site.

- report the IP Address to the ISP (which can be publicly found by going to nwtools.com) .... this could result in a shutdown of the offender's internet.

- Finally pinkpoke.com could request a court order for the ISP to tell them who abused the account and file a lawsuit against the abuser. The ISP would then have to turn over logs showing what time and address was using that IP Address at the time the spam was sent. One small Email service says they attempt to collect a $10/per spam Email when they prosecute offenders. (now if I could get that for all my Spam... hehehe)

Unfortunately ISPs don't always keep the logs for an extended time (an anonymous source told me only about 8 to 10 days, due to volume and space limits) and therefore if the parent company doesn't act fast, this option will not be available to them. Also spammers have many ways to keep from getting caught.

Spammers stay anonymous by hijacking computers and using them to send their "hate mail" or by using one of the many spoofers available on the internet. A spoofer is a program that allows you to send and Email that looks like someone else. (e.g. I could send an Email from admin.goog@gmail.com just by entering it into a text box.)

Many times the spoofed Emails don't have the same certificates as official Emails and therefore they can be picked up by the spam blocker. A certificate appears in every Email and issued by the domain (Gmail, yahoo, etc) and help programs validate Emails. (note above Email header shows a certificate of neutral)

Analysis:
I hate to break it to you, but "cohen@pinkponk.com" doesn't really exist and that oh-so-special product they advertised doesn't work much better. A check on http://www.nwtools.com came back with the following (check the "Email Validation" radio button for validating Emails):
[Contacting pinkponk.com [213.229.249.143]...]
[Timed out]
A Google searched turn up no other reports of this address either. (sometimes other people have will posted on a particular spammer, what they find out)

I also ran a check on the IP address, I believed it would be a valid home user (maybe hijacked) due to the fact that the full header the "X-Mailer: Microsoft Outlook Express 6.00.3790.2663" signature. Outlook is one of the oldest windows Email programs, and therefore is a breeze to hijack.
OrgName: Mebtel Communications
OrgID: MEBT
Address: 103 South Fifth Street
City: Mebane
StateProv: NC
PostalCode: 27302
Country: US
more.... click here
What do you know? Its valid... and if I sent an Email to abuse@madisonriver.net they might even look into shutting down this spammer, provided they care...

END Notes:
Yahoo has had a quick links to full headers for some time now, but Hotmail requires users to go through some steps to turn the full headers on, and has no quick On/off feature.

The previous way to get Gmail full headers was to click "basic html" at the very bottom of the page and then click option for "full headers" which would appear by the address box. This step by Google to make full headers easier to get at may reduce the time it takes to report spam. Which is good because Spam is one kind of "food" ad that I don't want in my inbox... I get enough "food" ads as it is in the regular mail.

Future post highlights:
I received requests for this post and I am still working on the next planned post: Keydisk security. I should be posting it in about a week or so. If you have ideas or something you want to know how to do that relates to protecting PC user safety let me know... Post on the blog or Email me at the address shown in contact info.

Where did TV-links go?

Acording to http://business.guardian.co.uk/story/0,,2195407,00.html
http://www.tv-links.co.uk/was taken offline Oct 19.

The arrest and the closure of the site - www.tv-links.co.uk - came during an operation by officers from Gloucestershire County Council trading standards in conjunction with investigators from Fact and Gloucestershire Police.

TV-links, until last week, was one of the largest internet movies, anime, TV show, and cartoon web video streaming portals. The 26 year old that set it up, used ads and paypal donations to gain income off of the illegal videos. The theory of the site was similar to that of Piratebay.org, which hosts none of the content, but simply provides links to it.

The difference between these two sites and their sustained uptime, lies in the location of their servers. thePirateBay.org hosts out of Switzerland, a neutral, piracy acceptant country. www.tv-links.co.uk, on the other hand, hosted in the UK where tolerance of piracy, though not as strict as the US, normally is frowned on.

Both sites have been shut down by the government at least once. Piratebay.org ended up reopening within days after their police raid. TV links also came back online after its first shutdown.

After this second shutdown a post on the TV-Links Forum reported:

Posted by: xxxx Oct 20 2007, 02:51 AM

http://business.guardian.co.uk/story/0,,2195407,00.html that happened! Were working on a way to save the links.

It will only be a matter of time before TV links comes back online again, or at least a spin off site. Detailed cache information of TV links can still be found on Google by doing site search of TV-links http://www.google.com/search?q=+site:tv-links.co.uk+tv+links
also the content sites:

54.com
youku.com
todou.com
and
http://videos.google.com
http://youtube.com

still host the videos untouchable content, that TV-links.co.uk linked to. (note: even though Google and Youtube remove content, a large amount of illegal videos are hidden within the site using code names)

If the movie industry was smart, they would see that they could profit by allowing more open access to their content. Many music artists such as, Radiohead, Prince, and others have released their albums for free via the internet. As I heard in an interview the other day, these artists are making more from the ringtones, clothing, and advertising they incorporate into their music. One artist has made 4 million dollars off ringtones alone.

But for now, tv-links.co.uk will remain hidden, buried underground, and as the government's attempted example to movie sharing sites that they will not be able to exist in free countries like the US and UK.

EDIT: Radiohead doesn't release their album for free, instead they allow the listener to choose how much they want to spend.

Phone Phreaking

Introduction
Phone phreaking is basically just hacking over a phone line. This could include phone line tapping, breaking into phone networks, gaining free long distance, and sometimes it is considered part of the realm of social engineering. Social engineering is gaining information by tricking people directly instead of hacking machines; you in other words "engineer using social tactics." In this post you will learn how to tap your own home phone line.


Tools needed:
Windows 95 dialer. exe ( RAR | EXE )
Free MP3 Recorder ( Main | Mirror)
A computer connected to a phone line... like what you did back in the days of Dialup.
Lets go back to the future using the Windows 95 Dialer.exe tool (It must be windows 95, NT/2000 will not work) Open it up and tell it to dial a letter. I normally put in "f".

This will bring up a new window that asks you to pick up the receiver. Just ignore that until you're done. You should hear the phone line in through your speakers.

The best time to listen in is to wait till someone starts dialing or after the parties have begun talking on the phone. If done too soon (like when you still have the tone) you will get a busy signal and it will hang up. Another practical use I have found for this program is when the answering machine picks up in another part of the house, I can hear the live recording by picking up just at the right moment.

I recommend getting a copy of Free MP3 Sound Recorder if you want to record the conversation. Any program will work that allows you to record windows internal sounds. (you could also use Audacity with a cable connecting your microphone to teh speaker, but unless you have a audio speaker you won't be able to here the conversation. This will record the sound of the phone line allowing you to save it to mp3/wav format. Another recorder that I found to be pretty good was: http://www.roemersoftware.com/sound-recorder-comparison.html (get the free version)

Instructions for "Free MP3 Sound Recorder":
Click file--> New
Then Select Record and stereo checkboxes.
Click Ok and select the file format you want... I normally choose mp3.
Click Ok and select where you want to save the file.
A new window will come up saying "Do you want to start recording now?"
Select yes if you have the call on the line, or no if you have yet to make the call.

End Notes:
I have found that with practice I can have the line recording in thirty seconds (that is including the time to start each program). In many US states it is illegal to record a phone call without the consent at least one party. But you can find a complete list here: http://www.rcfp.org/taping/states.html

Storm Worm - Now using youtube.

Some of you remember that I reported a while back that the Storm worm was using e-cards via Email to trick you into downloading. Now it has morphed to use a fake Youtube link.

http://www.youtube.com/watch?v=Ga4y9EQMuDe
(link text = http://www.youtube.com...., and the real link is http://XX.99.65.225/)

to get you to go to the Storm Worm website and download the worm. :-/

Full story:
SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

Password Cracking and Security: Part 2

Introduction:
This will show you how to break the encryption on a zip file, word document, and excel document. The tools and methods shown here are just some of the many ways to get a password. There are things called exploits which could allow an attacker to get in even faster... but for now lets take a look at Brute Force and Dictionary attacks. NOTE: This tutorial doesn't recommend you crack passwords that don't belong to you. It is meant be used for password recovery and password strength testing.

Tools needed:
Excel_crackers_setup.exe (mirror)
Zip Password Finder (mirror)
abc.doc (word doc I made with password... see if you can get access)

These programs have been tested and they work with not only the older versions of office, but also newer ones...

1. Microsoft Word / Microsoft Excel
   This method will work on either a word or excel file, it doesn't matter which you choose.
   First create(or open) a password protected Microsoft Word or Excel document; type some information into it so that you will be able verify you have unlocked the document.
   To enable password click tools--> options --> security, and enter password, click ok and save the document. (Visual here)
   
   
   
2. Next download and install excel_cracker_setup.exe
   
3. You should get a
   window that looks like:

   

4. In the name box type or click the icon and browse, to enter the password protected word/excel file you created.
5. You have 2 options: Brute Force attack! and Dictionary attack (see Password cracking part 1 for more info). If you do a dictionary attack you must select a word file... and it has to be text. For this demonstration select only Brute Force attack
   
   
6. Further options include:
   - All printable (meaning all characters able to be typed)
   - Latin small symbols [ a...z] (lowercase letter)
   - Latin capital symbols [A...Z] (UPPERCASE letters)
   - Digits [0...9] (numbers)
   - Special symbols [1@#$...] (can you guess this one?)
   - Space [ ] (its like outer space...)
   
   
7. You can set the Minimum Length and Maximum Length of the passwords you want try. But here is where things get a little sticky. See chart below to see what I mean. (click to see it larger)
   
   
   A ten character password with both symbols and letters (no caps) will take over 960000 years to crack.
   

ZIP Archives
In order to crack zip archives it is very similar but here are the step by step instructions.

1. Download: Zip Password Finder
2. Once you have opened the program (it installs to the start menu),
   
3. Click "Open File" and select the zip file you wish to crack.
4. Next, pick the "charType Property" which will be the character set that is used for the Brute Force. (you should understand from the other demonstrations, so I don't have to re-list the distinctions.)
5. You may also want to select "Max password Length:"
6. Go get a drink and find something productive to do while you wait :-)
   
   END NOTES:
   The best thing that you can use this for is to test how fast someone could crack your password or if you have forgotten the password to a word, excel, or zip file. Once you have cracked (or failed to crack) your password, you can make an assessment as to whether or not you need to change it. (If your password is over 10 charters, I expect you know better than to wait 100+ years to find out it is safe :-P )
   

MORE TOOLS:
IBIOS (http://www.11a.nu/)....... BIOS cracking
Cain and Able................................ OS PWD cracker /Net spoofer
007PeepPassword..........................view password under asterisks
Archpr.................................... rar, zip, pkzip, ARJ/ACE + more
http://www.password-crackers.com.... good resource for free and paid tools.

PDF Yesterday... Ecards today

I have found that this weeks Email spam Scam is E-cards...
the following "loving" ECards from my "friends" can be seen below:



It appears that this round of Spam is very Dangerous as can be seen in detail from a report by
SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

They said that it has been labeled "Storm worm"
and houses a collection of
-botnet malware
(allows virus master to control 100 or 1000s of machines at a time)
-a rootkit
(hides programs from antivirus and spyware detection software so no detection is even possible)
-NEW: Virtual Machine Detection
(harder to use a sandbox windows environment to test and understand the virus)
-Worming virus like activity
(allows program to hop from machine to machine uninvited)
-hiding behind a P2P style network
(uses its own network to spread)

This mix allows it to deal a perfected blow to any PC it is allowed to infect. What has changed the game for this virus/malware is the fact that when researches put it inside their Virtual Machines (the place they test the virus safely) nothing happened. The Virus didn't deploy and only rebooted the Virtual Machine.

Now I haven't personally tried these attachments, like I did with the PDF ones (see earlier post)
But I did notice that there are more attachments with these Emails and there volume is increased and not every Email has a attachment, it may have a link to a file to download.

Thats it for now... check back again to stay informed on more everyday security problems and to follow my security series.