Trojans and Backdoors - 3 :Various Trojan Genre

Various Trojan Genre

• 
  
  Remote Access Trojans
• 
  
  Password Sending Trojans
• 
  
  Keyloggers
• 
  
  Destructive
• 
  
  Denial Of Service (DoS) Attack Trojans
• 
  
  Proxy/Wingate Trojans
• 
  
  FTP Trojans
• 
  
  Software Detection Killers

■ Remote Access Trojans

These are the Trojans usually seen referred to in the media and hence gain high visibility because of their ability to give the attackers the power to do more things on the victim's machine than the victim itself, while standing in front of the machine. Most of these Trojans are often a combination of the other variations discussed below.

■ Password Sending Trojans

These Trojans are directed towards extracting all the cached passwords and also capture other passwords entered by the victim and email them across to an attacker specified mail address, without the victim realizing it. The password harvest may include passwords for ICQ, IRC, FTP, HTTP or any other application that require a user to enter a login and password. Most of them do not restart when Windows is loaded, as the objective is to gather as much info about the victim's machine as passwords, mIRC logs, ICQ conversations and mail them to the attacker.

■ Keyloggers

These Trojans log the keystrokes of the victim and then let the attacker search for passwords or other sensitive data in the log file. They usually come with two functions such as online and offline recording. As with the previous group, these Trojans can be configured to send the log file to a specific e-mail address on a regular basis.

■ Destructive

The only function of these Trojans is to destroy and delete files. They can deliberately delete core system files (for example: .dll, .ini or .exe files, possibly others) on the target machine. The Trojan is activated by the attacker or sometimes works like a logic bomb and starts on a specific day and at specific hour.

■ Denial of Service (DoS) Attack Trojans

These Trojans used by attackers to issue a denial of service. A distributed denial of service may also be issued if the attacker has gathered enough victims. WinTrinoo is a DDoS tool that has become popular recently, and if the attacker has infected many ADSL users, major Internet sites could be shut down as a result.

Another variation of a DoS Trojan is the mail-bomb Trojan, whose main aim is to infect as many machines as possible and simultaneously attack specific e-mail address/addresses with random subjects and contents which cannot be filtered.

■ Proxy/Wingate Trojans

Underground sites are known to announce freely available proxy servers. These Trojans turn the victim's computer into a proxy/Wingate server available to the whole world or to the attacker only. It is used for anonymous Telnet, ICQ, IRC, etc., and also to register domains with stolen credit cards and for other illegal activities. This gives the attacker complete anonymity and the chance to do everything and point the trail to the victim.

■ FTP Trojans

These Trojans open port 21(the port for FTP transfers) and lets anybody or just the attacker connect to the machine. They may be password protected so only the attacker is able connect to the computer.

■ Software Detection Killers

There are such functionalities built into some Trojans, but there are also separate programs that will kill Zone Alarm, Norton Anti-Virus and many other (popular anti-virus/firewall) programs, that protect the target machine. When they are disabled, the attacker has full access to the machine to perform some illegal activity or use the computer to attack others and often disappear.

Read More

Trojans and Backdoors - 4 :Modes of Transmission

Modes of Transmission

• 
  
  ICQ
• 
  
  IRC
• 
  
  Attachments
• 
  
  Physical Access
• 
  
  Browser And E-mail Software Bugs
• 
  
  NetBIOS (File Sharing)
• 
  
  Fake Programs
• 
  
  Un-trusted Sites And Freeware Software

• 
  
  ICQ
  People can also get infected while chatting / talking / video messaging over ICQ or any other Instant Messenger Application. It is a risk that the user undertakes when it comes to receiving files no matter from whom or where it comes.
• 
  
  IRC
  Here also, the threat comes from exchange of files no matter what they claim to be or where they come from. It is possible that some of these are infected files or disguised files.
• 
  
  Attachments
  Any attachment, even if it is from a known source should be screened as it is possible that the source was infected earlier and is not aware of it.
• 
  
  Physical Access
  Physical access to a target machine is perhaps the easiest way for an attacker to infect a machine. The motive may be a prank or just plain curiosity.
• 
  
  Browser and E-mail Software Bugs
  Having outdated applications can expose the system to malicious programs such as Trojans without any other action on behalf of the attacker.
• 
  
  NetBIOS (File Sharing)
  If port 139 is opened, the attacker can install trojan .exe and modify some system file, so that it will run the next time the system is rebooted. To block file sharing in Windows version, go to: Start->Settings->Control Panel->Network->File and Print Sharing and uncheck the boxes there.

Read More

Trojans and Backdoors - 1

We will begin with:

• 
  
  Terms of reference for various malicious code
• 
  
  Defining Trojans and Backdoors
• 
  
  Understanding the various backdoor genre
• 
  
  Overview of various Trojan tools
• 
  
  Learning effective prevention methods and countermeasures
• 
  
  Overview of Anti-Trojan software
• 
  
  Learning to generate a Trojan program

Trojans and Backdoors

A Trojan horse is:

• 
  
  An unauthorized program contained within a legitimate program. This unauthorized program performs functions unknown (and probably unwanted) by the user.
• 
  
  A legitimate program that has been altered by the placement of unauthorized code within it; this code performs functions unknown (and probably unwanted) by the user.
• 
  
  Any program that appears to perform a desirable and necessary function but that (because of unauthorized code within it that is unknown to the user) performs functions unknown (and definitely unwanted) by the user.

Trojan horses can do anything that the user who executes the program on the remote machine can. This includes deleting files, transmitting to the intruder any files that can be read, changing any files that can be modified, installing other programs such as programs that provide unauthorized network access that the user is entitled to and executing privilege-elevation attacks; that is, the Trojan horse can attempt to exploit a vulnerability to increase the level of access beyond that of the user running the Trojan horse. If this is successful, the Trojan horse can operate with the increased privileges and go about installing other malicious code.

If the user has administrative access to the operating system, the Trojan horse can do anything that an administrator can.

A compromise of any system on a network may have consequences for the other systems on the network. Particularly vulnerable are systems that transmit authentication material, such as passwords, over shared networks in clear text or in a trivially encrypted form, which is very common.

If a system on such a network is compromised via a Trojan (or another method), the intruder may be able to record usernames and passwords or other sensitive information as it navigates the network.

Additionally, a Trojan, depending on the actions it performs, may falsely implicate the remote system as the source of an attack by spoofing and thereby cause the remote system to incur liability.

Read More

Trojans and Backdoors - 2 : Working of Trojans

Attacker gets access to the trojaned system as the system goes online

By way of the access provided by the trojan attacker can stage attacks of different types.

Trojans work similar to the client-server model. Trojans come in two parts, a Client part and a Server part. The attacker deploys the Client to connect to the Server, which runs on the remote machine when the remote user (unknowingly) executes the Trojan on the machine. The typical protocol used by most Trojans is the TCP/IP protocol, but some functions of the Trojans may make use of the UDP protocol as well.

When the Server is activated on the remote computer, it will usually try to remain in a stealth mode, or hidden on the computer. This is configurable - for example in the Back Orifice Trojan, the server can be configured to remain in stealth mode and hide its process. Once activated, the server starts listening on default or configured ports for incoming connections from the attacker. It is usual for Trojans to also modify the registry and/or use some other auto starting method.

To exploit a Trojan, attackers need to ascertain the remote IP address to connect to the machine. Many Trojans have configurable features like mailing the victim's IP, as well as messaging the attacker via ICQ or IRC. This is relevant when the remote machine is on a network with dynamically assigned IP address or when the remote machine uses a dial-up connection to connect to the Internet. DSL users on the other hand, have static IPs so the infected IP is always known to the attacker.

Most of the Trojans use auto-starting methods so that the servers are restarted every time the remote machine reboots / starts. This is also notified to the attacker. As these features are being countered, new auto-starting methods are evolving. The start up method ranges from associating the Trojan with some common executable files such as explorer.exe to the known methods like modifying the system files or the Windows Registry. Some of the popular system files targeted by Trojans are Autostart Folder, Win.ini, System.ini, Wininit.ini, Winstart.bat, Autoexec.bat Config.sys. Could also be used as an auto-starting method for Trojans.

Read More

Mars Bank Database 1.1Last (For Social Engineering)

Mars Bank Database 1.1 

---

Features

Banks database with search, filter and sorting possibilities. Contains 11 databases in one:
- US banks ABA numbers (25,871 records)
- US banks routing numbers (26,197 records)
- MasterCard bank identification numbers (17,297 records)
- VISA bank identification numbers (35,154 records)
- American Express bank identification numbers (1,215 records)
- US ZIP codes (70,884 records)
- US busy phones (11,784 records)
- Social Security Numbers regions (678 records)
- US Dial Area Codes (249 records)
- US states (65 records)
- UK states (114 records)
Bank Identification Number, BIN - first 6 digits from card number. You can identify any credit/debit card.

For ABA numbers, database has these kind of data:
ABA number, bank name, bank address, bank city, bank state, bank zip, bank phone.
For routing numbers:
routing number, bank name, bank city, bank state, bank phone.
For MasterCard BINs:
BIN, bank name, bank country, bank phone.
For VISA BINs:
BIN, bank name, bank country, card type 1, card type 2, bank phone.
For American Express BINs:
BIN, bank country (always USA), card type (gold, optima, platinum...), bank phone.
For US ZIP codes:
city, state, ZIP code, county.
For US busy phones:
state, city, phone.
For SSN regions:
first 3-digits of SSN, state.
For US Dial Area Codes:
3-digit code, states where this code used
For US states:
state (2 letters), state full name.
For UK states:
state name, country (England, Ireland, Scotland...).

It's possible to make search, filter or sort base by any of this field or some fields together.
Also you can add any notes with some text formatting and colors. This text will be auto saved.
Program supports skins and includes 24 themes. Also it's possible to use .msstyles themes.

Download

Code:

http://www.mars-soft.net/files/MarsBanksBase11.exe

Read More

Common Types of Social Engineering

Social Engineering can be broken into two types: human based and computer based

1. 
   
   Human-based Social Engineering refers to person to person interaction to retrieve the desired information.
2. 
   
   Computer based Social Engineering refers to having computer software that attempts to retrieve the desired information

Human based social engineering involves human interaction in one manner or the other. Computer based engineering depend on software to carry out the task at hand.

Gartner Group notes six human behaviors for positive response for social engineering. Corroborate this with the traits discussed in module one of the course.

Reciprocation	Someone is given a "token" and feels compelled to take action.	You buy the wheel of cheese when given a free sample.
Consistency	Certain behavior patterns are consistent from person to person.	If you ask a question and wait, people will be compelled to fill the pause.
Social Validation	Someone is compelled to do what everyone else is doing.	Stop in the middle of a busy street and look up; people will eventually stop and do the same.
Liking	People tend to say yes to those they like, and also to attractive people.	Attractive models are used in advertising.
Authority	People tend to listen and heed the advice of those in a position of authority.	"Four out of five doctors recommend...."
Scarcity	If someone is in low supply, it becomes more "precious" and, therefore, more appealing.	Furbees or Sony Playstation 2.
Source: Gartner Research

Read More

Social Engineering Techniques: Dumpster Diving

Information that companies consider sensitive is thrown out daily in the normal garbage cans. Attackers can successfully retrieve this data by literally climbing into the company dumpsters and pilfering through the garbage. Information such as names, Social Security numbers,

addresses, phone numbers, account numbers, balances, and so forth is thrown out every day somewhere. I personally know a nationally recognized movie rental company that still uses carbon paper in its fax machine. Once the roll is used up they simply throw the entire

roll in the dumpster. The information on that roll is priceless, including names, addresses, account numbers, phone numbers, how much they actually pay for their movies, and so forth.

Another social engineering attack that also proves to be very successful is when an attacker dresses in the uniform of those personnel considered “honest” and “important” or even “expensive.” For example; an attacker purchases/steals the uniform of a carrier, telephone, or gas or electric employee and appears carrying boxes and/or clipboards, pens, tools,

etc. and perhaps even an “official-looking” identification badge or a dolly carrying “equipment.” These attackers generally have unchallenged access throughout the building as employees tend to see “through” these types of people. When is the last time you challenged

one of these personnel to verify their credentials?

This attack is very risky as the attacker can now be personally identified should he or she get caught. Again, this attack is normally very successful so bear this in mind.

Read More