Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pwning a Spammer's Keylogger

blog.spiderlabs.com

Post reply on HN
Print view View original

41–50 of 68 posts

Re: Pwning a Spammer's Keylogger

#41

Post by Chico75 »

jiggy2011 wrote: post #38
Magnin wrote: post #32

Earlier quoted context omitted.

Yes, but I was disappointed that he didn't at least change the password so that future FTP connections from the bots were refused.

Still arguably breaking the law. You'd also most likely need more access than just FTP to do that so that so that would involve having to break into a shell or something. It would difficult to know what to do in these situations because your choices are going to be limited to doing nothing and letting them get away with it or going vigilante and possibly exposing yourself to legal risk. You could inform law enforceme…

When did the "DOS Hacking" happen ? I did the same thing in middle-school (launched tracert from DOS) and was caught by a professor but didn't get reported to police luckily.

Re: Pwning a Spammer's Keylogger

#42

Post by bkruse »

jiggy2011 wrote: post #38
Magnin wrote: post #32

Earlier quoted context omitted.

Yes, but I was disappointed that he didn't at least change the password so that future FTP connections from the bots were refused.

Still arguably breaking the law. You'd also most likely need more access than just FTP to do that so that so that would involve having to break into a shell or something. It would difficult to know what to do in these situations because your choices are going to be limited to doing nothing and letting them get away with it or going vigilante and possibly exposing yourself to legal risk. You could inform law enforceme…

I find this very hard to believe (the last part). With any confiscation, you can argue in court. 1 year without a computer was his fault. I'd slap that agency with a lawsuit.

Re: Pwning a Spammer's Keylogger

#43

Post by drostie »

Hey, let's use XOR-encrypt -- it works so well in the movies!

But seriously, it's nice to see this sort of post about breaking into the inbreakers' code.

I'm a little surprised that people are treating logging into the FTP server (if not deleting the keylogs) as a legal gray area. I understand the moral dilemma of vigilante justice, but in principle, just doing an FTP connect and LIST seems to be well within your right, given that they gave you software which logs in and makes a directory and sends your keylog. Is there a real concern that someone will take you to court for that?

Re: Pwning a Spammer's Keylogger

#44

Post by mjwalshe »

underwater wrote: post #36
TazeTSchnitzel wrote: post #18

Earlier quoted context omitted.

Deleting the contents is illegal, heck, even accessing the server is illegal. Furthermore, it destroys evidence the ISP needs to shut it down.

That's why I hoped it was code. He wouldn't want to acknowledge illegal activity on his blog; though technically logging into the FTP server is probably illegal in itself.

depends I didn't see any banner and one could argue that his posting was covered by hue and cry :-)

"In common law, a hue and cry is a process by which bystanders are summoned to assist in the apprehension of a criminal who has been witnessed in the act of committing a crime."

Re: Pwning a Spammer's Keylogger

#45

Post by Karunamon »

jiggy2011 wrote: post #12
farmdawgnation wrote: post #10

I would have replaced all the existing keylogger files with pictures of Rick Astley and Rebecca Black, but that's just me.

You're getting into dangerous legal territory there (technically you are by just connecting to the FTP I guess). Bear in mind that many of the servers used by these guys do not belong to them and are probably a neglected server somewhere that was setup by an innocent party for other purposes but was subsequently pwned by the malware people.

  >You're getting into dangerous legal territory there (technically you are by just connecting to the FTP I guess).
How would you be? The software which was unsolicitedly installed on your computer is already going to be making that connection whether you want it to or not.

Re: Pwning a Spammer's Keylogger

#46

Post by pilif »

ajross wrote: post #30
pilif wrote: post #28

> Well, for the dump file BPK.DAT, the XOR key partially worked, but to make it more readable I XORed it using two bytes 0xAA, 0x00 I'd say the older version that was analyzed before wasn't using unicode yet, whereas the later version was. Very cool how you see the effects of character encodings all over the place - even where you don't expect them. Also, if done right, the "encryption" should IMHO have been done aft…

Peeve: Not unicode, UTF16. Unicode apps aren't synonymous with wide characters (though on Windows you're pretty much stuck as that's what the API picked, sigh), and in fact UTF8 is an objectively better encoding for almost all users.

Yes. Probably even UCS2 - I stopped doing a lot of Windows API stuff before I was running into situation where I need characters outside of the basic multilingual plane, so I couldn't say how wcslen("💩") would behave.

But I was talking about the build of the software. The old was probably a build linking against the old ANSI API ("A" suffix), whereas the new one is using the wide version ("W" suffix), usually referred to as the Unicode variant of the API - hence my incorrect terminology.

Looking at the screenshots of that application, if I had to take a really wild guess, I would say that the application might have been built in delphi which moved to the Unicode API with Delphi 2010 IIRC.

That changed the byte-width of a the standard Delphi string (and the more basic PChar type) to 2 bytes and switched over to using the W-suffix API.

I guess all those years of doing Delphi work are rubbing off.

Re: Pwning a Spammer's Keylogger

#47

Post by DanBC »

drostie wrote: post #43

Hey, let's use XOR-encrypt -- it works so well in the movies! But seriously, it's nice to see this sort of post about breaking into the inbreakers' code. I'm a little surprised that people are treating logging into the FTP server (if not deleting the keylogs) as a legal gray area. I understand the moral dilemma of vigilante justice, but in principle, just doing an FTP connect and LIST seems to be well within your rig…

> Is there a real concern that someone will take you to court for that?

I think the concern is more along drawing a bright line between black hat and white hat.

Researchers have to do stuff which is borderline illegal; at least it's sometimes tricky to know if they're breaking any laws. Thus, they'll create a set of clear and easy to understand rules and work to those, which means that they reduce their risk of legal action.

"Don't fight abuse with abuse" is (at least was) very common phrase. That's pretty good idea, when some people aren't capable of knowing who the bad person is. We don't want denial of service attacks against innocent people.

Having said that, it's annoying as hell that ISPs don't do more to stop this kind of thing.

Re: Pwning a Spammer's Keylogger

#48

Post by nitrogen »

qeorge wrote: post #13
bockris wrote: post #8

Earlier quoted context omitted.

I don't know if you're wrong but how do those password programs work? If they emulate a keyboard by sending keystokes to the appropriate input field they are most likely logged by programs like these. (not HW keyloggers tho). If the password programs use the clipboard, then it is just another source for the keylogger to capture and trivial to add. (edit: a screenshot lower in the article of the 'Perfect Keylogger' op…

Its been a while (AOL ;), but IIRC the Windows API lets you SET_TEXT directly by window handle. Assuming that's how 1Password works, it should be safe. I think that's a fair assumption because using the clipboard or SendKeys to an input box is all kinds of trouble in practice, and the API is easy.

If you can SET_TEXT, you can probably also get text. I've heard stories of win32 "password stealers" that constantly loop through all the window handles on the system looking for password fields, and if one is found, they log the contents of all nearby text fields (to get the username) and the password field to a file.

Re: Pwning a Spammer's Keylogger

#49

Post by qeorge »

bockris wrote: post #15
qeorge wrote: post #13

Earlier quoted context omitted.

Its been a while (AOL ;), but IIRC the Windows API lets you SET_TEXT directly by window handle. Assuming that's how 1Password works, it should be safe. I think that's a fair assumption because using the clipboard or SendKeys to an input box is all kinds of trouble in practice, and the API is easy.

But isn't that in itself another vector to 'hook' and redirect (just like the keystokes and clipboard)? I'm going to agree with jiggy2011. Once you are compromised at that level then it's pretty much game over.

Definitely. I meant that it probably didn't use the clipboard or keyboard emulation, and so it would be safe from those particular attacks. Didn't mean to imply it would be safe from everything.

To nitrogen's point, there's definitely a corresponding GETTEXT message. There's even hooks[1].

But that's about all I know. Haven't written a desktop app in > 10 years.

[1] http://msdn.microsoft.com/en-us/library/ms644990%28v=vs.85%2...

Re: Pwning a Spammer's Keylogger

#50

Post by jiggy2011 »

bkruse wrote: post #42
jiggy2011 wrote: post #38

Earlier quoted context omitted.

Still arguably breaking the law. You'd also most likely need more access than just FTP to do that so that so that would involve having to break into a shell or something. It would difficult to know what to do in these situations because your choices are going to be limited to doing nothing and letting them get away with it or going vigilante and possibly exposing yourself to legal risk. You could inform law enforceme…

I find this very hard to believe (the last part). With any confiscation, you can argue in court. 1 year without a computer was his fault. I'd slap that agency with a lawsuit.

I'm sure he could have got his computer back much sooner if he was sensible but he was a dumb kid, I imagine he just waiting for the police to give it back to him (probably low on their list of things to do).

He had a habit of rubbing people up the wrong way, bragging about being having 'leet' computer skills (he didn't) and doing idiotic things like mass net sends at school so I'm sure it was in many ways his fault. Does show how paranoid the police can be about "hackers" though.

Post reply on HN