Pwning a Spammer's Keylogger
blog.spiderlabs.com
Pwning a Spammer's Keylogger
1–10 of 68 posts
Re: Pwning a Spammer's Keylogger
#2Great post, really enjoyed following the trail along with the author. The sad part is, knowing how useless a lot of ISP's abuse@ emails are, the FTP might never be taken down this way.
Re: Pwning a Spammer's Keylogger
#3I wonder how he just happened to notice the keylogger connecting to FTP? Did he have a monitor in the background or something? Seems like that would be a good practice for doing things like this, and this guy obviously knows his stuff.
Re: Pwning a Spammer's Keylogger
#4I wonder how he just happened to notice the keylogger connecting to FTP? Did he have a monitor in the background or something? Seems like that would be a good practice for doing things like this, and this guy obviously knows his stuff.
A simple firewall should do the job, or failing that wireshark. I'm assuming the guy did this inside a VM and had the host machine monitoring what was happening.
Re: Pwning a Spammer's Keylogger
#5I wonder how he just happened to notice the keylogger connecting to FTP? Did he have a monitor in the background or something? Seems like that would be a good practice for doing things like this, and this guy obviously knows his stuff.
I guess he simply had a firewall that monitors active connections on his workstation (when an unregistered program tried to access the network an alert showed up).
Re: Pwning a Spammer's Keylogger
#6Correct me if I'm wrong, but one of the additional benefits of using a password manager such as 1Password is that it thwarts keyloggers. They may only get your master password (which shouldn't be your password on any site) but your site specific user name and password are never actually typed.
Re: Pwning a Spammer's Keylogger
#7Reverse engineering stuff like this can be fun.
I remember trying to reverse engineer some random .exe that got emailed to me once.
I disassembled it but all I found was some basic initialization code and then a jmp to an address that didn't seem to exist. However when I ran it (in a VM) with a debugger it seemed to go through all kinds of Win32 Calls.
Very odd
Re: Pwning a Spammer's Keylogger
#8Correct me if I'm wrong, but one of the additional benefits of using a password manager such as 1Password is that it thwarts keyloggers. They may only get your master password (which shouldn't be your password on any site) but your site specific user name and password are never actually typed.
I don't know if you're wrong but how do those password programs work? If they emulate a keyboard by sending keystokes to the appropriate input field they are most likely logged by programs like these. (not HW keyloggers tho).
If the password programs use the clipboard, then it is just another source for the keylogger to capture and trivial to add. (edit: a screenshot lower in the article of the 'Perfect Keylogger' options screen shows a clipboard option.)
Re: Pwning a Spammer's Keylogger
#9Great post, really enjoyed following the trail along with the author. The sad part is, knowing how useless a lot of ISP's abuse@ emails are, the FTP might never be taken down this way.
I'm hoping that "emailed the ISP" means "deleted the contents of the server and emailed the ISP".
Re: Pwning a Spammer's Keylogger
#10I would have replaced all the existing keylogger files with pictures of Rick Astley and Rebecca Black, but that's just me.