Welcome to duststar theory

Analysis on Global Maplestory (GMS) leaked accounts

Author duststar | 20.01.2010 | Category Cyber Security, MapleGlobal

Following this post.

I am posting a short analysis on the leaked accounts.

A total of 139 accounts were leaked. The attackers may have more because the “id”s were in running sequence (which seems to indicate it was “ripped” off from a database or any structured data source).

Findings

1. There were 3 accounts that uses same credentials for both login ID and password.

2. Shortest password length was 6.

Examples:
112991
kablam
dragon
123123
123321
hacker
abc123
123456
……

Examples:
narutoistheb
fataliity225
412173lesche
manquehue199
samsung770k1

4. There were 113 (81.29%) unique passwords and  26 (18.71%) duplicated passwords.

 Examples of duplicated passwords used:
pokemon = 2
112991 = 2
kablam = 3
pspds3 = 2
21coryt21 = 2
123123 = 2
annaviv1 = 2
i2345i = 2
pokemaniac = 3
stephanie = 2
google = 2
kiko052500 = 2

5. Passwords used by players are generally WEAK.

Weak = 107 (76.98%) e.g. yonatan
Medium = 32 (23.02%) e.g. samsung770k1

Conclusion

1. People are still using WEAK passwords.
2. If these passwords are stored in anywhere, they should be at least hashed with a industry recognised hashing algorithmn such as MD5, SHA1 etc and salted.
3. You should consider changing your account passwords to at least 12 characters with mixture of alphabets (big and small), and numbers. If possible, include in symbols such as !.$.? etc.

.duststar

Global Maplestory (GMS) leaked accounts

Author duststar | 20.01.2010 | Category Cyber Security, MapleGlobal

I saw this piece of news from: http://forums.asiasoftsea.net/showthread.php?t=753468

Then followed to: http://www.southperry.net/forums/showthread.php?t=22241

It seems like some people had posted a list of global Maplestory (GMS) accounts with password and pin in-clear online. At current point of writing, I can still find this list within 5 seconds on the Internet.

Just read the 20+ pages at southperry forum and someone did “try out” the listof ids and passwords and was able to login. This probably validates that its real data.

Let’s assume it is real.

Here is my ONE and ONLY question. Is the password and pin stored as clear-text in the database?

.duststar

Attack on Google Part 2: An insider coordinated attack?

Author duststar | 19.01.2010 | Category Cyber Security

Continuing from this post.

Google suspects it was an insider leak that provide the attackers their targets

Read more here. http://www.guardian.co.uk/technology/2010/jan/18/china-google-cyber-attack

And, we had more revealations on the trojan that was used in the recent attack.
The trojan was named Hydraq by the anti-virus vendors.

Symantec has released a summary and a technical detail on this.
http://www.symantec.com/connect/blogs/hydraq-attack-mythical-proportions
http://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99&tabid=2

ThreatExpert has analysed the binaries and the report (technical) is provided in 2 parts:
http://blog.threatexpert.com/2010/01/trojanhydraq-exposed.html
http://blog.threatexpert.com/2010/01/trojanhydraq-part-ii.html

Some interesting observations

Part 1 (http://blog.threatexpert.com/2010/01/trojanhydraq-exposed.html)

1. It runs as a service through svchost.exe. This method generally “hides” the trojan process from showing up on the tasklist.

Firstly, the trojan registers itself as a system service RaS[4 random characters] by creating registry entries under the newly created key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RaS[4 random characters]

The “ImagePath” value of its service registry key is set to start svchost.exe, as shown below:

“ImagePath” = %SystemRoot%\system32\svchost.exe -k netsvcs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RaS[4 random characters]

2. It make use of %TEMP% to copy itself to. Common place for malware to reside in because almost any other application also uses this system variable for file processing.

For instance, the trojan can create a copy of itself under a random filename in the %TEMP% directory, or it may create a copy of itself under the name %TEMP%\c_1758.nls.

Part 2 (http://blog.threatexpert.com/2010/01/trojanhydraq-part-ii.html)

1. Hinder reverse engineering efforts by increasing code complexity. Complexity equals more time required for tracing program execution flow.

It is also worth noting that the trojan’s code is very fragmented – it is deliberately split into small chunks with the size of a few instructions each, connected with the calls and jumps into a large maze: the code of Trojan.Hydraq contains 1,748 jumps and 922 calls – tracing it requires quite a bit of a patience.

2. Use of encryption to protect the C&C connection details. To defeat static analysis “String” search.

The trojan carries its C&C connection details (server, name, port, retry delay, etc.) inside the internal resource (name is 100, type is 243). The resource is 344 bytes in size, and it is encrypted.

3. Use of alternative DNS to resolve the C&C server IP addresses. To defeat DNS “sink-hole” defence.

It starts doing so by trying to resolve its host name first. If this attempt fails, the trojan makes a DNS query by crafting a TCP packet on port 53 of an alternative (legitimate) DNS server, also specified in its resource, in order to resolve the same host name. For example, the analysed sample has alternative DNS server 168.95.1.1 – this is dns.hinet.net server located in Taiwan.

4. Evade network detection by encoding its network packet through inverting its bytes.

If the connection to remote host on port 443 succeeds, the malware prepares a packet to send – it is 20 bytes in size:

00 00 00 00 00 00 FF FF 01 00 00 00 00 00 00 00 00 00 77 00

The packet is encoded by inverting its bytes:

FF FF FF FF FF FF 00 00 FE FF FF FF FF FF FF FF FF FF 88 FF

5. Evade network detection by encrypting response network packet from server using XOR. Network transport protection mechanism.

As soon as the packet is submitted to the live C&C server, it receives the response packet that is also 20 bytes in size. It is encrypted with the XOR 0xCC.

6. Self-updating to survive.

It may be assumed that upon successful connection to the remote C&C server (sl1.homelinux.org), the trojan was designed to be able to update itself. A new copy may have a different C&C server specified in its resource (e.g. yahooo.8866.org, 360.homeunix.com or as in the last seen sample – blog1.servebeer.com) in order to survive the shutdown of the old servers.

Recommended protection and detection strategy against such 0-day of similiar “style”

1. Sysem lock-down with minimal user privileges.
2. Deploy Host-based intrusion detection system that monitors for:
 - Changes to registry esp. services modification, startup entries etc
 - Creation of new services
 - Creation of new child process from Internet Explorer, parent process (For this incident, this trojan was installed due to a remote code execution vulnerability in Internet Explorer.)
3. Deploy firewall at network perimeter to prevent out-going DNS access from client networks.
4. Deploy desktop firewall for clients and implement tight control over network access provisioning.

.duststar

Chinese’s attack on Google, and IE 0-day is out.

Author duststar | 15.01.2010 | Category Cyber Security

In case you was not aware, Google got hacked from what is seems to be another series of “targeted attacks” by the Chinese.

Bojan Zdrnja from ISC wrote that “It appears that the initial attack vector on Google (and 20+ other companies!) was probably a malicious PDF document. Judging by attack dates posted by Google (middle of December), it was maybe even the very latest vulnerability”.

George Kurtz, CTO McAfee wrote that “McAfee Labs has been working around the clock, diving deep into the attack we are now calling Aurora that hit multiple companies and was publicly disclosed by Google on Tuesday.” Follow on, “In our investigation we discovered that one of the malware samples involved in this broad attack exploits a new, not publicly known vulnerability in Microsoft Internet Explorer. We informed Microsoft about this vulnerability and Microsoft is expected to publish an advisory on the matter soon.”

My personal thoughts on this hacking spree:

1. Seems to be using a combination of “Social Engineering” attack with “0-day” payloads. And I would not be surprised if a root-kit was used.

2. How individuals can protect themselves? Always patch your OS and applications, use limited rights account, configure firewall to limit outbound access, and use an anti-virus that relies on not only signatures to detect malware but behavioral  and heuristic detection capability as well. It was all described previous in this post.

3. If you wish to do more, for the more technical individuals:
- Catching an IE/Firefox running in your process list but you see no “windows” on the foreground? Probably a trojan horse is using it to bypass your personal desktop firewall since you would have allowed these web browsers to access the Internet.
- Monitor your network connections. Look out for those connections that are frequent and periodic to single address. It might be the trojan horse’s communication channel.

4. It is a good time for corporates to re-look at their cyber security defensive strategies.

.duststar

First Microsoft vulnerability (MS10-001) in 2010: Vulnerability in the Embedded OpenType Font Engine Could Allow Remote Code Execution (972270)

Author duststar | 14.01.2010 | Category Cyber Security

Official link to Microsoft: http://www.microsoft.com/technet/security/Bulletin/MS10-001.mspx

This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user viewed content rendered in a specially crafted Embedded OpenType (EOT) font in client applications that can render EOT fonts, such as Microsoft Internet Explorer, Microsoft Office PowerPoint, or Microsoft Office Word. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

There are 3 points worth mentioning here:

1. The vulnerability is privately reported.

What if this vulnerability was not reported, and kept for private use? It becomes a 0-day. That means undetectable by signatured-based anti-virus, undetectable by network intrusion detection systems. Host-based intrusion detection systems might works in this case if you configure it to detect any code execution attempt performed by these client applications. In case you are thinking that your host-based firewall will save you; no. they can be bypassed.

2. The vulnerability is delivered to users through “piggybacking” popular applications.

In short, any applications that can render EOT fonts will be affected. Therefore, the possibilities to get infected increased drastically. It is imperative to patch your system immediately.

3. Lockdown accounts on system does reduce the impact caused by the exploitation of the vulnerability.

In my previous post, I mentioned the importance of using lockdown accounts and it is applicable to this issue now.

.duststar