[Re-link] Malicous PDF analysis e-book

Well done Didier Stevens for producing this small chapters for public. I really make use of this book and hopefully i can share with others here..

it can be download here

i cant wait the full version of the book that you contribute..

Discover image details online

How to check shutter count? how to check aperture size of image taken? how to check bla.. bla..? how to check itu? how to check ini?

Just upload your image at http://regex.info/exif.cgi/exif.cgi .. and all your questions regarding image details will be answered.. But i dont know and not so sure how far they protect the privacy and ownership of your image.. so far, i just upload unimportant image and quite paranoid to upload beautiful image..

For example here I uploaded an image:


and i got full complete details on that image:

and a lot more details...

and more.. dont have space to upload here..

dulu 120kmph, kini..

kene snaman pipi sket lagi.. duhh

Aurora oh Aurora

aurora oh aurora
pentingkah kamu itu
kenapa aku terpegun?
aurora oh aurora
selalu disanjungi
pernah ditanya mengapa?
ku tatap, berseri, berwarna hijau
yang menawan sanubari

walaupun jauh
kamu dekat di hati
pandanganku menanti mu
aurora
kamu memberi
kembali mencari

aurora oh aurora
dari manakah kamu
kekal kamu sungguh jauh
aurora oh aurora
tidak ada bunyi mu
sanggup aku tetap menunggu
terdiam kerana berwarna ungu
ku putuskan biar bisu

walaupun jauh
kamu dekat di hati
pandanganku menanti mu
aurora
kamu memberi
kembali mencari

malam ini
aku sendiri
menumpu langit sambil berkata
gembira kamu disana
ku lihat, tersenyum, berwarna merah
ku tau kau kan tamat

Policy, Standards, Practices, Guidelines, Procedures, blablabla

sometimes, thinking for higher level is good for me.. management of information security skill is an adding advantage with my little security technical skill.. with sunday laziness and some boredness i start here.. and end with example..

Policies..
deliberate plan of action to guide decisions and achieve rational outcomes..
some call a short and concise what is expected. This thing stand at he higest level.. no step by step "how to". (that is standards)

Standards..
more detailed statement of what must be done to comply with policy.. including more specific details on how to comply with policy..

Practice,Guidelines, Procedures
sharing quite same definitions.. actual process of doing things.. correct or usual way of doing something or usual order followed when doing something..
this is how it looks like.. (some lazy photoshoping)

examples
for a simple example, a company policy is each employee must have strong password.. just want strong password but how? here we have standards (come with practices, guidelines and procedures) which describe what is strong password and what are the criteria and how to make it.. for example must contains at least 8 characters with combination of letters, symbols,numbers, lower and upper case letter and yada..yada..

references
M.E Whitman, H.J. Mattord, Management of Information Security, Course Technology , 978-1-4239-0130-3
Advance English Dictionary
and some web references..

BackTrack 4 Final akhirnya.

"BackTrack is a Linux-based penetration testing arsenal that aids security professionals in the ability to perform assessments in a purely native environment dedicated to hacking.

Regardless if you’re making BackTrack your primary operating system, booting from a LiveDVD, or using your favorite thumbdrive, BackTrack has been customized down to every package, kernel configuration, script and patch solely for the purpose of the penetration tester."

Versi final ni guna kernel baru, ada tools yg lebih banyak dan jugak custom tools yg hanya boleh didapati di dalam BackTrack dan fixed kepada beberapa bugs yg sedia maklum..

boleh download kat sini: http://www.backtrack-linux.org/downloads/

flaws in our email service? be careful..

just now i just playing around with a mail after capek tell a story about his friend's email had been compromised..

what i had founded was quite shocking.. it was very easy to change others password just by having their ID..

it starts here.. I just click on I can't access my account link..

Then choose My account may have been compromised.. And click next..

complete some easy captcha n email id..

complete easy form..

finally i got an email..

maybe i miss something that make this system secure in other way.. because this is just my simple lazy experiments..(thats why my English is bad also) please add any if there are any, my friends..

Earthquake can be everywhere!!

There're lot of earthquake cases recently and the latest one is in Haiti.. I think government should have a syllabus in school on what to do when there are disaster especially earthquake.. (sorry if this one already implemented) ..If we cannot prevent earthquake, at least we can prevent lot of fatal death because of lack of education on how to protect ourselves during earthquake..

here i copy paste some procedure what to do during earthquake from FEMA dedicated for me as a reference in the future (who knows)..

If indoors

• DROP to the ground; take COVER by getting under a sturdy table or other piece of furniture; and HOLD ON on until the shaking stops. If there isn’t a table or desk near you, cover your face and head with your arms and crouch in an inside corner of the building.
• Stay away from glass, windows, outside doors and walls, and anything that could fall, such as lighting fixtures or furniture.
• Stay in bed if you are there when the earthquake strikes. Hold on and protect your head with a pillow, unless you are under a heavy light fixture that could fall. In that case, move to the nearest safe place.
• Use a doorway for shelter only if it is in close proximity to you and if you know it is a strongly supported, loadbearing doorway.
• Stay inside until shaking stops and it is safe to go outside. Research has shown that most injuries occur when people inside buildings attempt to move to a different location inside the building or try to leave.
• Be aware that the electricity may go out or the sprinkler systems or fire alarms may turn on.
• DO NOT use the elevators.

If outdoors

• Stay there.
• Move away from buildings, streetlights, and utility wires.
• Once in the open, stay there until the shaking stops. The greatest danger exists directly outside buildings, at exits, and alongside exterior walls. Many of the 120 fatalities from the 1933 Long Beach earthquake occurred when people ran outside of buildings only to be killed by falling debris from collapsing walls. Ground movement during an earthquake is seldom the direct cause of death or injury. Most earthquake-related casualties result from collapsing walls, flying glass, and falling objects.

If in a moving vehicle

• Stop as quickly as safety permits and stay in the vehicle. Avoid stopping near or under buildings, trees, overpasses, and utility wires.
• Proceed cautiously once the earthquake has stopped. Avoid roads, bridges, or ramps that might have been damaged by the earthquake.

If trapped under debris

• Do not light a match.
• Do not move about or kick up dust.
• Cover your mouth with a handkerchief or clothing.
• Tap on a pipe or wall so rescuers can locate you. Use a whistle if one is available. Shout only as a last resort. Shouting can cause you to inhale dangerous amounts of dust.

eatable SPAM

yummy.. SPAM with honey grail..

[Paper] Companion worms on UNIX systems.

http://c-skills.blogspot.com/2009/12/thoughts-on-companion-worms.html

paper by: Sebastian Krahmer

anti-shouldersurfer

Google Chrome for Linux..

Finally, after waiting and waiting.. and after reading the comics in the website i realize why..
It can be seen here

And can be downloaded here


support for Debian/Ubuntu/Fedora/openSUSE

Nepenthes + PHARM - SurfIDS = Test Dulu

PHARM or nepenthes pharm is a client/server tool to manage, report and analyze all your distributed nepenthes instances from one interface. Sounds interesting. Before this I developed nepenthes and OpenVPN plugin for Webmin, looking foward for nepenthes client and integrate them with SurfIDS, but I think it is the end of it :-(

(click image for larger visual)

PHARM has 3 main components:

• Server
• Client (Implement on nepenthe honeypot)
  
• Web Portal (View data collected from sensor)

More info and screenshot are here: http://www.nepenthespharm.com

WINWORD.EXE malware

Some malware become famous because of their behaviour and now I found a malware that hide all your word documents and replace it with their copy of .exe files with the same name and icon as each of the hidden word documents before. It become dangerous when you did not set for not "hiding extensions for known file types" in folder options. It is because you cannot distinguish the changes made by the malware and it become worse when you attach the file in email and spread the malware to other computers by email. So please be aware of this malware by view the properties of the file before executing it. The malware will appear as "Application" rather than as "word documents". I'll post more on the detail of the analysis of this malware later and for this post just how to recover your file back.

First, open your command prompt by start>run and type cmd and press enter. In the command prompt, type your drive letter with double colon. (eg. if your pendrive labeled as I: in your "My Computer", just typed I: and press enter)

Then type:

dir /A:H

This command will view all the hidden files in your drive including the files that been hidden by the malware (if working properly)

Then to remove the hidden attribute of the files just type:

attrib -S -H -R *.doc

This command will remove the System Files (-S), Hidden (-H) and Read Only (-R) attributes for all .doc files int the drive. Please take note that the hidden attribute cannot be remove using properties.

Thats all for now and dont hesititate to ask if having any problems.

Conficker Eye Chart

Quite lame, but still practical maybe..huhu..

"Joe Stewart from SecureWorks has put together an effective "eye chart" that sources its graphics from sites that Conficker would block. If you can't see one or more of the images, you're either infected, or image loading in your browser has been disabled.

Firefox users can check if image loading has been disabled under Tools/Options and the Content tab. Load Images Automatically should be checked. Internet Explorer users will find it under Tools/Internet Options, then the Advanced tab. Scroll down to Multimedia, and Show Pictures should be checked.

It's a test based on the fact that Conficker blocks legitimate security Web sites. The logos are sourced remotely, so if they can't load, the sites are also likely to be blocked. If you're seeing blocked images, you should check out the CNET guide to removing Conficker--just because the botnet hasn't done much that's demonstrably malicious yet doesn't mean it can't or won't in the future."

original post: http://www.nsaneforums.com/?showtopic=18612

Eye Chart: http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

How To Cyberstalk Potential Employers

Zaman pencarian kerja untuk para graduan telah bermula... rasanya inilah masanya untuk implement tutorial dari irongeek.com ni..

How To Cyberstalk Potential Employers

Add new Partitions to Virtualbox OSE Ubuntu

1. Create new Virtual Hard Disk

Open Virtualbox OSE, go to File > Virtual Media Manager(VMM) or just Ctrl + D. Click New button on the Hard Disk Tab. Follow the instructions, until finish. Make sure this time take care about the size of the partition. And finish the procedure (choose the right partition type, name and size. Now we have created a new Virtual Hard Disk (VHD).

2. Add the new VHD to the VCO

Exit the VMM by clicking OK button. On the Virtualbox OSE, Right Click the targeted VCO, go to setting.. (Make sure the VCO is Powered Off) Go to Hard Disks. Click the Add Attachment Button (Button with + ) and your newly created VHD will be inserted automatically and finish it with OK button.

3. Start targeted VCO

The VCO will detect and install the new VHD when startup and wait until it finish and the Right Click on My Computer, choose Manage. Computer Management will be opened and go to Storage > Disk Management. Your new VHD will be in the list but labeled as Unknown. At the time you click the Disk Management, there will be a popup for Disk Initialize and go through the procedure until finish. The new VHD will be detected as Unallocated.

4. Format the new VHD

Right click the Unallocated drive and choose New Volume. Go through the Procedure until finish depends on your requirement. And now you already have new disk partition on you VCO.

Vitualbox + maltrap == pure wonders..

DLLPath: C:\Documents and Settings\Administrator\Desktop\maltrap_v0.2a\maltrap.dll
Process injected! PID: 3660
PID: 3660, All hooks are now in place!
PID: 3660, 0x00406D6E: RegOpenKeyExA(key: HKEY_LOCAL_MACHINE, subkey: SYSTEM\CurrentControlSet\Services\ferst) -> FAIL
PID: 3660, 0x00406ECB: CopyFileA(existing: C:\Documents and Settings\Administrator\Desktop\G001.exe, new: C:\WINDOWS\system32\qokqe.exe, overwrite: 00000000)
PID: 3660, 0x00406F2F: OpenSCManagerA(machName: (null), dbName: (null), access: 000F003F) -> h:0025EB58
PID: 3660, 0x00406F64: CreateServiceA(ServiceName: ferst, DisplayName: ces, Type: 00000010, StartType: 00000002, StartName: (null), Path: C:\WINDOWS\system32\qokqe.exe, Password: (null)) -> h:0025E8A0
PID: 3660, --- Service runs in its own process
PID: 3660, --- Is started automatically by the SCM during system startup
PID: 3660, 0x00406FB0: StartServiceA(hService: 0025E8A0, serviceArgs: (null)) -> SUCCESS
PID: 3660, 0x00407027: RegOpenKeyA(key: HKEY_LOCAL_MACHINE, subkey: SYSTEM\CurrentControlSet\Services\ferst) -> SUCCESS
PID: 3660, --- handle: 00000754
PID: 3660, 0x00407049: RegSetValueExA(keyHandle: 00000754, valueName: Description, data: fsr) -> SUCCESS
PID: 3660, 0x7C81F2AE: GetFileAttributesW(C:\Documents and Settings\Administrator\Desktop\G001.exe)
PID: 3660, 0x7C910A16: CreateProcessA(appName: (null), cmdLine: C:\WINDOWS\system32\cmd.exe /c del C:\DOCUME~1\ADMINI~1\Desktop\G001.exe > nul)
PID: 3660, --- Creating the process in suspended state...
PID: 3660, --- Resulting PID: 3692
PID: 3660, --- Escalating privileges so the process can be opened...
PID: 3660, --- Opening the process...
PID: 3660, --- Allocating memory in the process...
PID: 3660, --- Writing the DLL into memory...
PID: 3660, --- Resuming the suspended process...
PID: 3660, 0x00407548: ExitProcess(exitcode: 0)
[Termination] PID 3660 has terminated!

MalTrap is a research utility that monitors malware behavior by intercepting API calls on Windows and logging results. Though still in it's Alpha release and sparse on features, its a very interesting and useful tool.

Features

* Over 200 API’s are intercepted. Better results and little noise.
* Only relevant API parameters are displayed (highly descriptive).
* Only relevant API return values are displayed (highly descriptive).
* Created processes are monitored
* PID separation – API calls are logged based on the process
* PC shutdown attempts are prevented
* Anti-Debugging attempts are logged (SoftICE, RegMon, FileMon, Generic)
* Key-logging attempts are logged
* Internet traffic is logged and highly detailed (Winsock, FTP, HTTP, IRC, …)

a very cool tools..

download here: http://www.maltrap.com/main/download/

Video Tutorial:

video

Olly SocketTrace 1.0 [OllyDbg Plugin]

Dah banyak review pasal plugin ni dalam bahasa inggeris, jadi ape salahnya kalau ade review versi melayu. Baru terpikir nak tulis pasal plugin ni..

About

OllySocketTrace ni adalah plugin yg digunakan dalam Ollydbg untuk memudahkan analyst atau reverse engineer untuk mengesan aktiviti berkaitan socket di dalam sesebuah process. Aktiviti socket akan dirakam dan kemudian di"highlight" dengan warna2 unik.

Boleh kesan "socket operation":

WSASocket, WSAAccept, WSAConnect, WSARecv, WSARecvFrom, WSASend, WSASendTo, WSAAsyncSelect, WSAEventSelect, WSACloseEvent, listen, ioctlsocket, connect, bind, accept, socket, closesocket, shutdown, recv, recvfrom, send and sendto.

Cara Install n Guna

Mudah sahaja, copy n paste dll file plugin ni ke dalam folder "plugin" di folder ollydbg, dan run ollydbg.. Ia akan ada di menu plugin. Plugin ni akan buatkan "breakpoint" di mana2 socket function call yg berkaitan dan akan record sgala data yg berkaitan.. Untuk melihat hasilnya, hanya klik di menu Plugin > SocketTrace > Log..

Download: http://www.tuts4you.com/download.php?view.2442

p/s: malas nak capture screenshot la.. try la, snang je nak guna..

Latest Artwork

Sambil wat java image processing, layan gambar lame dlm hd n main photoshop jap.. ni lah hasil yg ntah ape2 dariku..

jam kat dinding umah sewa lama

dan ini...

batu kat dataran seremban

dan penjara pudu pun jadi mangsa....