Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pwning a Spammer's Keylogger

blog.spiderlabs.com

Post reply on HN
Print view View original

31–40 of 68 posts

Re: Pwning a Spammer's Keylogger

#31

Post by [deleted] »

bockris wrote: post #15
qeorge wrote: post #13

Earlier quoted context omitted.

Its been a while (AOL ;), but IIRC the Windows API lets you SET_TEXT directly by window handle. Assuming that's how 1Password works, it should be safe. I think that's a fair assumption because using the clipboard or SendKeys to an input box is all kinds of trouble in practice, and the API is easy.

But isn't that in itself another vector to 'hook' and redirect (just like the keystokes and clipboard)? I'm going to agree with jiggy2011. Once you are compromised at that level then it's pretty much game over.

[deleted]

Re: Pwning a Spammer's Keylogger

#32

Post by Magnin »

jiggy2011 wrote: post #12
farmdawgnation wrote: post #10

I would have replaced all the existing keylogger files with pictures of Rick Astley and Rebecca Black, but that's just me.

You're getting into dangerous legal territory there (technically you are by just connecting to the FTP I guess). Bear in mind that many of the servers used by these guys do not belong to them and are probably a neglected server somewhere that was setup by an innocent party for other purposes but was subsequently pwned by the malware people.

Yes, but I was disappointed that he didn't at least change the password so that future FTP connections from the bots were refused.

Re: Pwning a Spammer's Keylogger

#33

Post by infinity »

drtse4 wrote: post #5
ertdfgcb wrote: post #3

I wonder how he just happened to notice the keylogger connecting to FTP? Did he have a monitor in the background or something? Seems like that would be a good practice for doing things like this, and this guy obviously knows his stuff.

I guess he simply had a firewall that monitors active connections on his workstation (when an unregistered program tried to access the network an alert showed up).

It looks like the author of the article was using Wireshark to intercept network traffic. In the article there is a screenshot of a window with the title "follow TCP stream" and a headline "Stream content", exactly like in Wireshark.

I have used the same trick sometimes when nobody could remember the FTP credentials, but they were stored in the FTP program and a connection to the FTP server was still possible. Sometimes the guy with access to the admin panel is just not available, so a possible solution is to use Wireshark to retrieve the password, which is usually transmitted without encryption.

Re: Pwning a Spammer's Keylogger

#34

Post by emillon »

yread wrote: post #14

Ah good old HIEW. It's the simplest and nicest disassembler - open a file switch to disassembly with one keypress. Move one line or one byte at a time for defeating code that jumps in the middle of instructions, edit the assembly (ok code bytes) in place with live preview what instructions you're writing. All in 130KB of code :) http://www.hiew.ru/ EDIT: I wonder why is the author using a version from 2004 though...…

There's also hte, which is free :)

http://hte.sourceforge.net/screenshots.html

Re: Pwning a Spammer's Keylogger

#36

Post by underwater »

TazeTSchnitzel wrote: post #18
underwater wrote: post #9

Earlier quoted context omitted.

I'm hoping that "emailed the ISP" means "deleted the contents of the server and emailed the ISP".

Deleting the contents is illegal, heck, even accessing the server is illegal. Furthermore, it destroys evidence the ISP needs to shut it down.

That's why I hoped it was code. He wouldn't want to acknowledge illegal activity on his blog; though technically logging into the FTP server is probably illegal in itself.

Re: Pwning a Spammer's Keylogger

#37

Post by jiggy2011 »

sequoia wrote: post #20
datagramm wrote: post #19

"This keylogger program can be legitimately purchased and used, ostensibly for monitoring your kids’ or employees’ browsing habits, etc. As you can imagine, PK can also be used for badness." Is this person suggesting that using a keylogger to spy on your employees/children without their knowledge is not 'badness'?!

Recording your employees' use of company computers, given proper disclosure, is an employers prerogative. It's also legal (in some locales) for parents to do this to their children. I find it immoral, personally (the latter), but this is not the point of the story at all and the story was interesting and highly relevant, so I'm really disappointed to see this is the top comment.

Yes, although usually a keylogger is not necessary. A few places I have worked the IT dept/Management had a VNC server running on every desktop (it showed up in the process list, I wasn't working in IT at the time).

I pointed this out to a few people who would use IM programs to 'flirt' with each other all day.

Re: Pwning a Spammer's Keylogger

#38

Post by jiggy2011 »

Magnin wrote: post #32
jiggy2011 wrote: post #12

Earlier quoted context omitted.

You're getting into dangerous legal territory there (technically you are by just connecting to the FTP I guess). Bear in mind that many of the servers used by these guys do not belong to them and are probably a neglected server somewhere that was setup by an innocent party for other purposes but was subsequently pwned by the malware people.

Yes, but I was disappointed that he didn't at least change the password so that future FTP connections from the bots were refused.

Still arguably breaking the law. You'd also most likely need more access than just FTP to do that so that so that would involve having to break into a shell or something.

It would difficult to know what to do in these situations because your choices are going to be limited to doing nothing and letting them get away with it or going vigilante and possibly exposing yourself to legal risk.

You could inform law enforcement but they are likely to either do nothing or decide to arrest you instead (I knew someone who had the police come to his house and confiscate his computer for over a year because a fellow student saw him using DOS prompt on a school computer and decided to report him for "hacking").

Re: Pwning a Spammer's Keylogger

#39

Post by pavel_lishin »

martingordon wrote: post #6

Correct me if I'm wrong, but one of the additional benefits of using a password manager such as 1Password is that it thwarts keyloggers. They may only get your master password (which shouldn't be your password on any site) but your site specific user name and password are never actually typed.

They may also get your 1Password username, since it's your e-mail address. Then all they have to do is download 1Password, try your master password combination with various e-mails you may have typed (signing up for a website, etc.) and suddenly, it's much, much, much worse.

Re: Pwning a Spammer's Keylogger

#40

Post by martingordon »

vaksel wrote: post #21
martingordon wrote: post #6

Correct me if I'm wrong, but one of the additional benefits of using a password manager such as 1Password is that it thwarts keyloggers. They may only get your master password (which shouldn't be your password on any site) but your site specific user name and password are never actually typed.

yeah but then all you have to do is get hit by a virus specifically designed for that one password manager and you lose everything

I'm not saying 1Password is a perfect solution, but that it appears to at least provide resistance against keyloggers.
Post reply on HN