background preloader

Reverse Engineering

Facebook Twitter

Malware tracker blog: New malware document scanner tool released. We've recently released our malware document scanner tool called Cryptam (which stands for cryptanalysis of malware) .

malware tracker blog: New malware document scanner tool released

This system scans document files such as MS Office (.doc/.ppt/.xls), PDF and other document formats for embedded executables whether encrypted or not. As most embedded malware executables use varying lengths of XOR and ROL/ROR obfuscation to evade traditional A/V detection, we focus on the detection of the embedded executable rather than the exploit itself. A typical Cryptam report visually shows three critical pieces of the cryptanalysis done. The first graph shows the count for each ascii character in the file, obvious single byte XOR keys can be seen here. The second graph is the entropy of the file, most documents other than PDFs are very light entropy on legitimate content, and only images or the embedded executables showing as red high entropy sections. Malware tracker: cryptam malware analysis. Bernardo Damele A. G.: Dump Windows password hashes efficiently - Part 1. Windows Security Account Manager Slightly modified definition from Wikipedia: The Security Accounts Manager (SAM) is a registry file in Windows NT and later versions until the most recent Windows 7.

Bernardo Damele A. G.: Dump Windows password hashes efficiently - Part 1

It stores users' passwords in a hashed format (in LM hash and NTLM hash). Since a hash function is one-way, this provides some measure of security for the storage of the passwords. Generally, dumping operating system users' password hashes is a common action following a compromise of a machine: getting access to the password hashes might open the doors to a variety of attacks including, but not limited to, authenticate with the hash over SMB to other systems where passwords are reused, password policy analysis and pattern recognition, password cracking, etc. Depending on the type of access that you have got to the target, you can retrieve the password hashes from SAM in different ways.

Physical access These tools are generally included in many GNU/Linux live distributions. Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 3 : Xeno Kovah. <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!

Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 3 : Xeno Kovah

--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 4 : Xeno Kovah. <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!

Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 4 : Xeno Kovah

--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. </div> Embedding Examples and Help. Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 5 : Xeno Kovah. <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!

Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 5 : Xeno Kovah

--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 1 : Xeno Kovah. <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!

Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 1 : Xeno Kovah

--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. </div> Embedding Examples and Help PR IntroX86 Day2 Part1 More information about this class material is available at OpenSecurityTraining.info Intel processors have been a major force in personal computing for more than 20 years. 25% of the time will be spent bootstrapping knowledge of fully OS-independent aspects of Intel architecture. 50% will be spent learning Windows tools and analysis of simple programs. This class serves as a foundation for the follow on Intermediate level x86 class. Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 2 : Xeno Kovah.

<div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!

Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 2 : Xeno Kovah

--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. </div> Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 3 : Xeno Kovah. <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!

Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 3 : Xeno Kovah

--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 4 : Xeno Kovah. <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!

Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 4 : Xeno Kovah

--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 5 : Xeno Kovah. <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!

Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 5 : Xeno Kovah

--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. </div> Embedding Examples and Help PR IntroX86 Day2 Part5 More information about this class material is available at OpenSecurityTraining.info Intel processors have been a major force in personal computing for more than 20 years. 25% of the time will be spent bootstrapping knowledge of fully OS-independent aspects of Intel architecture. 50% will be spent learning Windows tools and analysis of simple programs.

This class serves as a foundation for the follow on Intermediate level x86 class. Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 6 : Xeno Kovah. IntroX86. Creator: Xeno Kovah @XenoKovah License: Creative Commons: Attribution, Share-Alike ( Class Prerequisites: Must have a basic understanding of the C programming language, as this class will show how C code corresponds to assembly code. Lab Requirements: Requires a Windows system with Visual C++ Express Edition. Requires a Linux system with gcc and gdb, and the CMU binary bomb installed.

Into the Darkness: Dissecting Targeted Attacks. The current threat landscape around cyber attacks is complex and hard to understand even for IT pros. The media coverage on recent events increases the challenge by putting fundamentally different attacks into the same category, often labeled as advanced persistent threats (APTs). The resulting mix of attacks includes everything from broadly used, exploit-kit driven campaigns driven by cyber criminals, to targeted attacks that use 0-day vulnerabilities and are hard to fend off - blurring the threat landscape, causing confusion where clarity is most needed.

This article analyzes a specific incident - last March’s RSA breach, explaining the techniques used by the attackers and detailing the vulnerability used to gain access to the network. It further explores the possible mitigation techniques available in current software on the OS and application level to prevent such attacks from reoccurring. Crimes Cibernéticos: Análise do Malware Intimação-MPF. Já está circulando há um tempo mensagens de phishing que utilizam o nome do Ministério Público Federal e do Departamento de Polícia Federal falando de uma suposta intimação para comparecer em uma audiência.

Hoje recebi mais uma desse tipo e resolvi analisar, vamos ver o que conseguimos. Identificação do Artefato. Introduction to Malware Analysis - Free Recorded Webcast by Lenny Zeltser. This webcast introduces you to practical approaches of reverse-engineering malicious software on a Windows system. I cover behavioral and code analysis phases, to make this topic accessible even to individuals with a limited exposure to programming concepts. You'll learn the fundamentals and associated tools to get started with malware analysis. Reverse-Engineering Malware Cheat Sheet by Lenny Zeltser. Analyzing Malicious Documents Cheat Sheet by Lenny Zeltser.

This cheat sheet outlines tips and tools for reverse-engineering malicious documents, such as Microsoft Office (DOC, XLS, PPT) and Adobe Acrobat (PDF) files. General Approach Locate potentially malicious embedded code, such as shellcode, VBA macros, or JavaScript. Extract suspicious code segments from the file. 5 Steps to Building a Malware Analysis Toolkit Using Free Tools by Lenny Zeltser.

Examining the capabilities of malicious software allows your IT team to better assess the nature of a security incident, and may help prevent further infections. Here's how to set up a controlled malware analysis lab—for free. A large number of computer intrusions involve some form of malicious software (malware), which finds its way to the victim's workstation or to a server.

When investigating the incident, the IT responder typically seeks to answer questions such as: What actions can the malware specimen perform on the system? How does it spread? How, if at all, does it maintain contact with the attacker? A simple analysis toolkit, built from free and readily available software, can help you and your IT team develop the skills critical to responding to today's security incidents.

Step 1: Allocate physical or virtual systems for the analysis lab Another useful feature of many virtualization tools is the ability to take instantaneous snapshots of the laboratory system. Next Steps. REMnux 1.0: the malware analyst's playground. OllyDbg v1.10. Homepage. Advanced Persistent Tweets: Zero-Day in 140 Characters. The unceasing barrage of targeted email attacks that leverage zero-day software flaws to steal sensitive information from businesses and the U.S. government often are described as being ultra-sophisticated, almost ninja-like in stealth and anonymity.

But according to expert analysis of several recent zero-day attacks – including the much publicized break-in at security giant RSA — the Chinese developers of those attack tools left clues aplenty about their identities and locations, with one apparent contender even Tweeting about having newly discovered a vulnerability days in advance of its use in the wild. Netifera. BitBlaze: Binary Analysis for Computer Security. Anubis: Analyzing Unknown Binaries. Segurança da Informação. Projeto Malwares-BR - Início. O projeto malwares-br é uma idéia para criação de assinaturas para projetos opensources (especialmente regras do Snort e num futuro Clamav. Talvez correlacionamento/regras pro OSSEC quando possivel) para uso em especial de empresas nacionais contras as ameaças "Made In Brazil".

O foco inicial será baseado em poucos samples que colhemos durante a semana de onde faremos a análise básica , com uma pequena explicação e assinaturas para Snort inicialmente. Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code (9780470613030): Michael Ligh, Steven Adair, Blake Hartstein, Matthew Richard. Reversing: Secrets of Reverse Engineering (9780764574818): Eldad Eilam. Hacking: The Art of Exploitation, 2nd Edition (9781593271442): Jon Erickson.

Yashira.org. Software - CERT.at. Bytehist A tool for generating byte-usage-histograms for all types of files with a special focus on binary executables in PE-format (Windows). ... DensityScout This tool calculates density (like entropy) for files of a any file-system-path to finally output an accordingly descending ordered list. This makes it possible to quickly find (even unknown) malware on a potentially infected Microsoft Windows driven machine. ... Minibis Software and tips to easily build up an automated malware analysis station based on a concept introduced in the paper "Mass Malware Analysis: A Do-It-Yourself Kit". ...

ProcDOT This tool processes Sysinternals Process Monitor (Procmon) logfiles and PCAP-logs (Windump, Tcpdump) to generate a graph via the GraphViz suite. Phrack Magazine. What is heap and stack? The stack is a place in the computer memory where all the variables that are declared and initialized before runtime are stored. Heap: Pleasures and Pains. Heap spraying. Operation[edit] A heap spray does not actually exploit any security issues but it can be used to make a vulnerability easier to exploit. A heap spray by itself cannot be used to break any security boundaries: a separate security issue is needed. Exploiting security issues is often hard because various factors can influence this process. Chance alignments of memory and timing introduce a lot of randomness (from the attacker's point of view). A heap spray can be used to introduce a large amount of order to compensate for this and increase the chances of successful exploitation.

Exploits often use specific bytes to spray the heap, as the data stored on the heap serves multiple roles. History[edit] Implementation[edit] JavaScript[edit] VBScript[edit] Occasionally, VBScript is used in Internet Explorer to create strings by using the String function. ActionScript[edit] In July 2009, exploits were found to be using ActionScript to spray the heap in Adobe Flash.[9][10] Images[edit] HTML5[edit] Heap (data structure) Example of a complete binary max-heap with node keys being integers from 1 to 100 1. the min-heap property: the value of each node is greater than or equal to the value of its parent, with the minimum-value element at the root.

ERESI – Trac. Reverse-Engineering Malware: Malware Analysis Tools and Techniques Course - Malware Analysis Training by Lenny Zeltser. Zerowine.sourceforge. Vulnerability Research Blog ( Vulnerabilities, Exploits, Threats, 0-Days) NirSoft - freeware utilities: password recovery, system utilities, desktop utilities. Malware Analysis, Virus Sandbox - CWSandbox an Automated Malware Analysis Tool. Mwanalysis. Free Malicious PDF Analysis E-book.