Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Cracked a Keylogger and Ended Up in Someone's Inbox

trustwave.com

Post reply on HN
Print view View original

21–30 of 108 posts

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#21

Post by nchelluri »

a few questions I'm wondering about, if anyone can help:

- how do those PW stealers work? are they similar to the Steam one, where it'd delete existing creds and then sniff newly entered ones?

- can this thing detect certain apps like FileZilla and then say "user entered " and send individual fields, and is that what is meant by supporting say FTP and FileZilla?

- what does PHP support mean? maybe looks for common stuff like php.ini, various other conf files like FPM, and tries to find DB/cache connection creds?

there's one other thing I'm wondering about, which is the light/easily crackable encryption of the keylogger's internals, and I vaguely remember reading about Google's encryption on the new recaptcha and people talking about all this stuff like complicated encryption routines baked into the client side JS that I really didn't understand except at a handwavy level, and wonder if that's the kind of thing some, say, intelligence/espionage outfit could use.

very interesting/engaging (fun) article, all in all, for me. and I appreciated the understatement of the (well-deserved) plug at the end.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#22

Post by [deleted] »

stephengillie wrote: post #14
popey456963 wrote: post #2

Is the header sticky for anyone else? It seems to take up ~30% of my screen (Windows 7, Chrome Stable) [0]. [0] http://puu.sh/pNYUH/d42d8395fc.jpg

Try disabling JavaScript. Without that, other than some iframe code up top, everything seems to display correctly on mobile Chrome.

[deleted]

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#23

Post by jacquesm »

nchelluri wrote: post #21

a few questions I'm wondering about, if anyone can help: - how do those PW stealers work? are they similar to the Steam one, where it'd delete existing creds and then sniff newly entered ones? - can this thing detect certain apps like FileZilla and then say "user entered " and send individual fields, and is that what is meant by supporting say FTP and FileZilla? - what does PHP support mean? maybe looks for common st…

Keyloggers simply record all key presses so if you delete the credentials for a game and someone then tries to run that game the first thing you catch is the credentials to log in again.

The most obvious way is to hook the message stream from the window manager to the applications, windows provides some convenient hooks for this.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#24

Post by nchelluri »

popey456963 wrote: post #2

Is the header sticky for anyone else? It seems to take up ~30% of my screen (Windows 7, Chrome Stable) [0]. [0] http://puu.sh/pNYUH/d42d8395fc.jpg

It bothered me as well so I unchecked the width rule on the col-sm-7 CSS class (in the browser inspector) and then saw more text per screen which helped.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#25

Post by kowdermeister »

lossolo wrote: post #16

Website that we were running was under DDOS couple of years ago, what we did is we took ips of servers that made ddos. Then we scanned the ports, found vulnerability in the application that was running on it then get into the server using this vulnerability. We checked open connections and found one used for command and control server (irc server) then we listened to irc channel. DDOSers were talking private things o…

Nicely done! This would make a great scene in Mr. Robot :)

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#26

Post by ufmace »

skraelingjar wrote: post #10
piqufoh wrote: post #7

That's a great little story, interesting to read how these sorts of scams are carried out, but I also found the code analysis and decompilation tale fun!

I agree, it's amazing how stupid criminals can be, even online. It's scary to think what someone as smart as these security researchers could do if they went black hat...

I'm thinking that's who's working on stuff like Stuxnet, Flame, etc. I wonder what color hat we would consider Government-sponsored malware to be?

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#27

Post by nchelluri »

jacquesm wrote: post #23
nchelluri wrote: post #21

a few questions I'm wondering about, if anyone can help: - how do those PW stealers work? are they similar to the Steam one, where it'd delete existing creds and then sniff newly entered ones? - can this thing detect certain apps like FileZilla and then say "user entered " and send individual fields, and is that what is meant by supporting say FTP and FileZilla? - what does PHP support mean? maybe looks for common st…

Keyloggers simply record all key presses so if you delete the credentials for a game and someone then tries to run that game the first thing you catch is the credentials to log in again. The most obvious way is to hook the message stream from the window manager to the applications, windows provides some convenient hooks for this.

as for the first point, yup, I understood that from the article; I probably should have used "similar to Steam" rather than "like Steam". I mostly meant, you'd get a long stream of characters and you'd have to manually try to dejumble them.

Whereas, I believe if you go by your second point, you can see "Ok, the user put username in the username textfield, password in the password field, address in the address textfield, port

in the port textfield" and so on, which would make for a more structured data dump. Maybe not possible or feasible for every single application, but if you could get the highest usage targets, like the most common FTP clients, or Steam as they have apparently done, and the browser password storage stuff (or fields for say, most common banking sites, PayPal, etc.) then you could save yourself a lot of time.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#28

Post by kuschku »

lossolo wrote: post #16

Website that we were running was under DDOS couple of years ago, what we did is we took ips of servers that made ddos. Then we scanned the ports, found vulnerability in the application that was running on it then get into the server using this vulnerability. We checked open connections and found one used for command and control server (irc server) then we listened to irc channel. DDOSers were talking private things o…

I’ve had a very similar experience – I’m surprised I’m not the only one who did that.

I’d have expected the DDoSers to have better security

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#29

Post by ufmace »

nchelluri wrote: post #21

a few questions I'm wondering about, if anyone can help: - how do those PW stealers work? are they similar to the Steam one, where it'd delete existing creds and then sniff newly entered ones? - can this thing detect certain apps like FileZilla and then say "user entered " and send individual fields, and is that what is meant by supporting say FTP and FileZilla? - what does PHP support mean? maybe looks for common st…

> can this thing detect certain apps like FileZilla and then say "user entered " and send individual fields, and is that what is meant by supporting say FTP and FileZilla?

Could well be. I haven't messed with Win32 in a while, but I'm pretty sure that you can sniff the contents of other applications' windows and dialogs. With a little work, you should be able to take a common app and work out how to detect it's login windows, find the username and password and other relevant fields, and pull out the contents.

I know if I was writing a hostile keylogger, I'd go to a lot of trouble to know exactly what was entered where, instead of having to see a long stream of keyboard input and figure out what the usernames and passwords are, and what services they go with.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#30

Post by gesman »

Thanks to domaintools.com - I also found that the guy (seemaexports3@gmail.com) used to own domain: bdmtsteel.com

I also find similarities between above domain and these: transitoin-asia.com seabunker.net

See this: http://imgur.com/tsxqwiQ

If someone wants to do more research - would be fun to dig deeper.

Post reply on HN