| Author |
Thread Statistics | Show CCP posts - 11 post(s) |
Daald
Celestial Fleet
Ascendant Frontier
   |
Posted - 2006.10.09 16:03:00 -
[1]
Edited by: Daald on 09/10/2006 16:02:53
Look for a file in you C: drive called autoexec.exe
That is what the website tries to install by creating an adodb.stream object. It tries to instantiate that object twice. I'm still looking at the second portion of the infecting code.
___________________________________________
Logic is a systematic method of coming to the wrong conclusion with confidence.
-Murphy |
Daald
Celestial Fleet
Ascendant Frontier
|
Posted - 2006.10.09 16:10:00 -
[2]
The code is obfuscated. I'm deobfuscating by hand and trying to insert meaning as I see it.
I'll let you know as I learn more.
___________________________________________
Logic is a systematic method of coming to the wrong conclusion with confidence.
-Murphy |
Daald
Celestial Fleet
Ascendant Frontier
|
Posted - 2006.10.09 16:17:00 -
[3]
I would block anything going to advertology.net
That is where one of the attack vectors is coming from.
___________________________________________
Logic is a systematic method of coming to the wrong conclusion with confidence.
-Murphy |
Daald
Celestial Fleet
Ascendant Frontier
|
Posted - 2006.10.09 17:01:00 -
[4]
 Originally by: Jenny Spitfire
Edited by: Jenny Spitfire on 09/10/2006 16:42:08
Originally by: Mortok Tristan
Originally by: Daald
Edited by: Daald on 09/10/2006 16:02:53
Look for a file in you C: drive called autoexec.exe
That is what the website tries to install by creating an adodb.stream object. It tries to instantiate that object twice. I'm still looking at the second portion of the infecting code.
The second part is c:\windows\csrss.exe crss.exe
get rid of it, and references to it in the registry
Fixed.
I didn't see that. It seems that the second portion sets up autoexec.exe to gain elevated privileges. I guess there was another attack vector that I didn't follow?
The second portion of that code seems to do this:
http://www.snort.org/pub-bin/sigs.cgi?sid=7988
___________________________________________
Logic is a systematic method of coming to the wrong conclusion with confidence.
-Murphy |
Daald
Celestial Fleet
Ascendant Frontier
|
Posted - 2006.10.11 16:57:00 -
[5]
Quote:
what is safe/secure/ and works better definitely doesn't come from redmond washington.
I agree but your scope is too narrow. I would say that most of the programs out there are not safe/secure. Every application that has been written can be *****ed. There just has to be enough cofee and desire to sit through tons of assembly code. You will notice that as Firefox gets more and more popular, more and more people will start attacking it.
There is no such thing as the fastest/best/safe/will brush my teeth when I wake up programs out there.
___________________________________________
Logic is a systematic method of coming to the wrong conclusion with confidence.
-Murphy |
Daald
Celestial Fleet
Ascendant Frontier
|
Posted - 2006.10.13 03:55:00 -
[6]
Quote:
The myth that as linux/mac get more widespread they will be attacked with as much success as MS windows does is perpetuated by people who do not know the underlying methodology and architecture of the platforms...or they are spreading FUD to purposely denigrate the non-MS world.
You really underestimate the veracity of the virus writers. But what do I know anyway. I'm a FUD spreading MS lover that doesn't know the methodology and architecture of the non-MS world.
___________________________________________
Logic is a systematic method of coming to the wrong conclusion with confidence.
-Murphy |
Daald
Celestial Fleet
Ascendant Frontier
|
Posted - 2006.10.13 13:49:00 -
[7]
Quote:
The fact that this has NOT occurred should say something.
Of course it does. I'm not disputing that. I just disagree with you on what you think it says.
___________________________________________
Logic is a systematic method of coming to the wrong conclusion with confidence.
-Murphy |
Daald
Celestial Fleet
Ascendant Frontier
|
Posted - 2006.10.13 16:31:00 -
[8]
Quote:
Daald, what you seem to miss is that on a *nix operating system, an administrator has to give that shell script permission to run before it can do anything at all.
Windows OS just days "duh...yup, yup, yup" when a virus wants to run.
I'm not quite as far up the food chain in my position, but I support the UNIX boxes in a large corporation. Never had a virus on Sun, HP, or SGI, but our MS Exchange servers get crushed relatively often.
I understand that. I really do. I'm not being thick about it. I have administered *nix servers. The exploits always go through paths that the administrator thought were bulletproof and 100% safe.
After all you have to run code on that machine otherwise it is just a paper weight. Windows in its infinite wisdom decided to make scripting easy on its OS opening the door for script kiddies.
If you read that book I quoted they show you how to exploit a C printf function. So any code that actually prints anything and is not designed to look for the overflow is exploitable. That's the point I am making. Any code written in C that prints to the screen and is callable by the user in anyway shape or form is vulnerable. You can believe that it is impossible for a hacker to get there or infinitely harder, but it is not the system that makes it that way. It is the user. The average person using a *nix system is much much more technical than a windows user.
For example. The exploit that triggered this thread uses an adodb object to download the virus on your computer. This virus is then executed. It has as much rights as the user accout it is running in. Most people run as admin so therefore it has complete rights.
The second portion tries a buffer overflow attack on another activex object, that I guess the executable uses to gain priviledged rights if it didn't have them already.
So where does the blame lie.
1- Microsoft for not differentiating between COM objects and allowing them to be instantiated that way from a script coming from a foreign website.
2- The user, for clicking a suspicious link, for running as admin and for not having their system patches up to date.
The first portion is only 1 attack vector. The second portion contains many attack vectors that will basically never be fixed because no matter how secure/safe the OS is, the user will find a way to mess it up for conveniance.
As long as there are users out there that don't understand how a hacker operates they will always succeed no matter what OS the user is running on top of hence my point. Don't think that the software you are running on top of will save you from your own ignorance.
___________________________________________
Logic is a systematic method of coming to the wrong conclusion with confidence.
-Murphy |
| |
|