CCCure Group of Sites and EvilFingers Group of Sites - Technology Partners

We are glad to announce that CCCURE group of websites and EvilFingers group of websites are official technology partners.

Snapshot of CCCure.org:



CCCure[pronounced as "Sea Secure"] is one of the largest training providers for various certifications. They do training & services. They are also one of the largest free testing website for CISSP and certain other certs.




Check it out at your convenience. Thanks to CCCure for extending their technology relations with EvilFingers group of sites.

Thank you for choosing our blog.
EF

ZeusTracker Project & EvilFingers Group of Sites - Technology Partners

We are glad to announce the official technology partnership of ZeusTracker Project & EvilFingers Group of Sites. We have been researching in the same domain for a while and have shared data in the past through Malware Domains List. Since this was not officially declared until now, we thought that this is the right time to declare a Technology partnership.

Check this out: [ZeusTracker Project Site]



ZeusTracker project does the job of collecting and researching Zeus Botnet data, one of the largest Botnets in the history of mankind. ZeusTracker has done a great job in keeping their data up to date. It is quite hard to maintain records for fast-flux botnets, as they keep changing very frequently[highly volatile].

Thank you for choosing our blog.
EF

Do movie producers make their cut?

There are many English and Foreign language sites that link to videos loaded into Google Videos, You Tube, Yahoo Videos and other places for accessing copy protected videos ripped from DVD or video print from movie theaters. Some of them include:







Do DVD protection software's really protect the movies from being ripped? Does RIAA really do its job in protecting such music and movies from being downloaded? Despite all such measures why do this still happen and how much loss do the movie makers face because of such illegal activities?

Well, the answer is too long & this blog was intended to put you to think. If you want to really watch a movie, buy the DVD or go to a theater. Don't support such illegal acts by even viewing these videos online. This would not stop the bad guys, but it would at the least discourage them from uploading illegal copies of the movies.

DRM Analytics coming soon[not too soon], with Digital Rights Management solutions to entertainment & gaming industry. Stay put!

Thank you for choosing our blog.
EF

Eve Online: How do big MMO's secure themselves?

Eve Online is a cluster based MMO created primarily with Python.

The following statement is by Hilmar Veigar Petursson Chief Executive Officer of CCP games, on Python.org:

"Python enabled us to create EVE Online, a massive multiplayer game, in record time. The EVE Online server cluster runs over 50,000 simultaneous players in a shared space simulation, most of which is created in Python. The flexibilities of Python have enabled us to quickly improve the game experience based on player feedback" said Hilmar Veigar Petursson of CCP Games.

The following is a snapshot of the game:



We just added another snapshot because we thought that it looked nice :)



Python is known for its stability. Google utilizes Python for almost everything. That being the reason, the creator of Python is an employee @ Google.

What does it take to secure such MMO apps?

The main answer lies in the engines on which they are running. Python is known for its stability and highly structured with support to easy access/usage. Using Python does not mean that the software is secure, but that is just the first step towards "avoiding unstable development environment". The next thing is to ensure authenticity & authorization using access control techniques, integrity by using critificates, etc. But most of all MMO's main concern is to:

* Ensure that their model keeps changing, to avoid from someone cracking the software by applying Digital Rights Management solutions.
* Ensure that only authorized users get to access their tools.
* Prevent misuse by authorized users.
* Web application security - Prevent web based attacks.
* Load balance requests and have DoS/DDoS avoidances.

There are other things that MMO's do, to secure their apps. But these are the primary things I could think of. Beyond all this, Eve has done an awesome job and is the most popular MMO. Bravo Eve!

EF

Avast aswRdr.sys Kernel Pool Corruption and Local Privilege Escalation

---------------------------------------------------
Advisory: Avast aswRdr.sys Kernel Pool Corruption and Local Privilege Escalation.

Version Affected: Product: Avast antivirus 4.8.1356.0 (other versions could be affected)
Vulnerable Compoonent: aswRdr.sys 4.8.1356.0 (avast! TDI RDR Driver)
Category: Local Denial of Service due to kernel memory corruption (BSOD)
(untested) Local Privilege Escalation

PoC Code: porting C++ 26/09/2009 Vendor Notify: 26/09/2009
Vendor Reply: 15/09/2009 Vendor Fix: 15/10/2009

Vulnerability Details:
Avast's aswRdr.sys Driver does not sanitize user supplied input IOCTL and this lead to Kernel Heap Overflow that propagates on the system with a BSOD and potential risk of Privilege Escalation.

Credit:
Giuseppe 'Evilcry' Bonfa' (Project Manager, www.EvilFingers.com)
E-Mail: evilcry {AT} GMAIL {DOT} COM
Additional credit: AbdulAziz Hariri from http://www.insight-tech.org
Website: http://evilcry.netsons.org, http://evilcodecave.blogspot.com
http://evilcodecave.wordpress.com

Disclaimer:
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There is no representation or warranties, either express or implied by or with respect to anything in this document, and shall not be liable for a ny implied warranties of merchantability or fitness for a particular purpose or for any indirect special or consequential damages.
---------------------------------------------------

FOR MORE INFO CLICK HERE.

- EF

Compendio mensual de información. Octubre 2009

Pistus Malware Intelligence Blog
27.10.09 Una recorrida por los últimos scareware XVII
24.10.09 ZeuS Botnet y su poder de reclutamiento zombi
19.10.09 Pornografía. Excusa perfecta para la propagación de malware II
19.10.09 Malware Intelligence Linkedin Group
18.10.09 Panorama actual del negocio originado por crimeware
17.10.09 ZeuS, spam y certificados SSL
14.10.09 DDBot. Más gestión de botnets vía web
13.10.09 Una recorrida por los últimos scareware XVI
08.10.09 Nivel de (in)madurez en materia de prevención
04.10.09 Automatización en la creación de exploits
01.10.09 Rompiendo el esquema convencional de infección

Evil Fingers Blog
27.10.09 ZeuS and power Botnet zombie recruitment
18.10.09 Current business outlook caused by crimeware
17.10.09 A recent tour of scareware XVI
10.10.09 Level of (im)maturity in prevention
09.10.09 Automation in creating exploits
05.10.09 Breaking the conventional scheme of infection

ESET Latinoamérica Blog
31.10.09 Reporte de amenazas de octubre
28.10.09 Propagación de ZeuS a través de falsa actualización de Microsoft
26.10.09 Gira Seguridad Antivirus. Ahora, en Venezuela
21.10.09 Constructores de exploits. Más actividades for dummies
15.10.09 Nueva edición de nuestro Curso de Seguridad Antivirus
13.10.09 Nueva variante de Adware pide recompensa

Open Source Development Botnets. "My last words?

Those who read the post about the project called crimeware Quad System, recall that between paragraphs said not knowing the cost of private version of this application for the control of botnets, for Windows platforms to GNU/Linux platforms.

The thing is ... for things of life itself ... the developer of these particular projects designed in Perl, called cross, was finished with his exploits reproaching himself with the closure of its website; expressing, through it, the motivations that led to his "violent" decision, and which show in the following screen:

However, after several days (perhapsmeditation), it was decided to return to your old tricks again making provision for teaching an array of applications for the control of botnets, or what is now synonymous, crimeware.

The new interface in their web is:

A curious fact, that like the rest of the post is unrelated technical aspects of information security is the introduction to the concept of "irony" that arises in the index is it ironic that feels its proposals in collaborative crime area?

Anyway, the guy still seems angry ... "with security professionals?... new interface as follows writes:

"... This site is dedicated to my projects and only my projects. Long time ago here you could find some more information, but currently, I do not give a shit about Providing any kind of information.

Besides, well, WTF? xD Something about me: I am the only one who is somehow keeping this site online and alive, taking care of it well, not much to take care of. What you can find here: some useless shit - my small projects. Well, I know no one gives a fuck, me neither - I place them here and here they are to stay, you like it or not. So, no fun in here: D

Fuck ... and who is that idiot found this fucked up god forsaken piece of shit? LULZ xD and LOL xD As you can see I keep my head up and travel through life with a smile on my face and damn bitching is not giving a fuck, man.

So you'll ask what a damn pepper should be of me, starting with such introduction? Well, I'm the man, say, cross is in the house babe xD Anyways, just fuck it. You got here my projects, I will put some new here too. Like once in a year. Some new papers Blah ... maybe if I will have some good mood for writing or I will be drunk as hell to believe in it. Hah ... Whatevah ... "

Despite that, this "subtle" character, apparently hardened Perl programmer, has some interesting things like a GUI for Nikto :-)

Related information
QuadNT System. Zombies Management System I (Windows)
Botnet Hybrid Control System. Http Development bot in perl
Open Source Development crimeware to manage botnets (...)
TRIAD Botnet III. Remote administration of multi zombies ...
TRIAD Botnet II. Remote administration of multi zombies ...
TRIAD Botnet. Remote administration of Linux zombies

Jorge Mieres
Pistus Malware Intelligence