Pwning a Spammer's Keylogger • Hacker News Board

Re: Pwning a Spammer's Keylogger

#51

Post by jiggy2011 » Tue, Apr 24, 2012, 10:27 PM UTC

chas wrote: post #23

jiggy2011 wrote: post #7

Reverse engineering stuff like this can be fun. I remember trying to reverse engineer some random .exe that got emailed to me once. I disassembled it but all I found was some basic initialization code and then a jmp to an address that didn't seem to exist. However when I ran it (in a VM) with a debugger it seemed to go through all kinds of Win32 Calls. Very odd

It's very common for malware (or other code that doesn't want to be reverse engineered) to be decrypting itself in the that initialization loop to generate the code that is jumped to. It is also very common for malware to use exception handling as control flow, which could also explain a nonsense jump.

That certainly makes sense, I wonder if it is encrypted using any proper scheme or something simple like XOR?

If it is strong encryption I suppose the thing to do would be to capture the key in memory, but that would require more patience than I have.

Re: Pwning a Spammer's Keylogger

#52

Post by coldarchon » Tue, Apr 24, 2012, 10:29 PM UTC

jiggy2011 wrote: post #12

farmdawgnation wrote: post #10

I would have replaced all the existing keylogger files with pictures of Rick Astley and Rebecca Black, but that's just me.

You're getting into dangerous legal territory there (technically you are by just connecting to the FTP I guess). Bear in mind that many of the servers used by these guys do not belong to them and are probably a neglected server somewhere that was setup by an innocent party for other purposes but was subsequently pwned by the malware people.

Technically most of his post is illegally and providing evidence is the worst thing he can do. There is no way he can prove the owner of the license was in fact the acting guy, so providing his name is calumny.

Re: Pwning a Spammer's Keylogger

#53

Post by jiggy2011 » Tue, Apr 24, 2012, 10:35 PM UTC

Karunamon wrote: post #45

jiggy2011 wrote: post #12

Earlier quoted context omitted.

You're getting into dangerous legal territory there (technically you are by just connecting to the FTP I guess). Bear in mind that many of the servers used by these guys do not belong to them and are probably a neglected server somewhere that was setup by an innocent party for other purposes but was subsequently pwned by the malware people.

>You're getting into dangerous legal territory there (technically you are by just connecting to the FTP I guess). How would you be? The software which was unsolicitedly installed on your computer is already going to be making that connection whether you want it to or not.

True, but "intentionally or knowingly" will probably be a key part of the relevant legislation.

Re: Pwning a Spammer's Keylogger

#54

Post by jiggy2011 » Tue, Apr 24, 2012, 10:46 PM UTC

Chico75 wrote: post #41

jiggy2011 wrote: post #38

Earlier quoted context omitted.

Still arguably breaking the law. You'd also most likely need more access than just FTP to do that so that so that would involve having to break into a shell or something. It would difficult to know what to do in these situations because your choices are going to be limited to doing nothing and letting them get away with it or going vigilante and possibly exposing yourself to legal risk. You could inform law enforceme…

When did the "DOS Hacking" happen ? I did the same thing in middle-school (launched tracert from DOS) and was caught by a professor but didn't get reported to police luckily.

Around 1999-2001 during the dotcom boom when "hackers" were the new tabloid menace.

Re: Pwning a Spammer's Keylogger

#55

Post by Sapient » Tue, Apr 24, 2012, 10:52 PM UTC

jiggy2011 wrote: post #51

chas wrote: post #23

Earlier quoted context omitted.

It's very common for malware (or other code that doesn't want to be reverse engineered) to be decrypting itself in the that initialization loop to generate the code that is jumped to. It is also very common for malware to use exception handling as control flow, which could also explain a nonsense jump.

That certainly makes sense, I wonder if it is encrypted using any proper scheme or something simple like XOR? If it is strong encryption I suppose the thing to do would be to capture the key in memory, but that would require more patience than I have.

Usually it doesn't matter, you just let the exe decrypt itself, then grab the decrypted code and rebuild the PE with it.

Re: Pwning a Spammer's Keylogger

#56

Post by Sapient » Tue, Apr 24, 2012, 10:56 PM UTC

Magnin wrote: post #32

jiggy2011 wrote: post #12

Earlier quoted context omitted.

You're getting into dangerous legal territory there (technically you are by just connecting to the FTP I guess). Bear in mind that many of the servers used by these guys do not belong to them and are probably a neglected server somewhere that was setup by an innocent party for other purposes but was subsequently pwned by the malware people.

Yes, but I was disappointed that he didn't at least change the password so that future FTP connections from the bots were refused.

You cant change an FTP password from a client...

Re: Pwning a Spammer's Keylogger

#57

Post by dkersten » Tue, Apr 24, 2012, 11:34 PM UTC

I remember coming across a malicious piece of javascript that found its way onto some websites a few years back. Just for fun, I traced it through the various stages to find out what it did. I decoded the js to find out that it downloaded an executable. I used objdump to look at the executable and through some tinkering and google searching found out it was packed with upx. So I unpacked it and I think I went through one or two more stages (with the help of people on various forums) before we got to the raw binary. Someone on the forums also ran it in a VM and we found out it connected to one of a handful of ip addresses. After some tinkering and looking through the code, someone on the forums figured out that it stole WoW account passwords.

It was a lot of fun and felt a bit like being a detective of some kind.

Re: Pwning a Spammer's Keylogger

#58

Post by hwatson » Tue, Apr 24, 2012, 11:36 PM UTC

pavel_lishin wrote: post #39

martingordon wrote: post #6

Correct me if I'm wrong, but one of the additional benefits of using a password manager such as 1Password is that it thwarts keyloggers. They may only get your master password (which shouldn't be your password on any site) but your site specific user name and password are never actually typed.

They may also get your 1Password username, since it's your e-mail address. Then all they have to do is download 1Password, try your master password combination with various e-mails you may have typed (signing up for a website, etc.) and suddenly, it's much, much, much worse.

Your 1Password keychain is stored locally and is never uploaded to Agile's servers. The attacker would have to upload the keychain first (or break into your Dropbox, if you have it stored in there)

Re: Pwning a Spammer's Keylogger

#59

Post by hobbyist » Wed, Apr 25, 2012, 12:36 AM UTC

Why didnt the attacker directly use the details in his code, rather than creating a configuration file and decrypting it from the code?

Re: Pwning a Spammer's Keylogger

#60

Post by infinitivium » Wed, Apr 25, 2012, 1:23 AM UTC

This is an awesome post! I want to see more of this on HN. There is a mac program called Private Eye that monitors netstat and shows if programs connect to remote addresses. I always run it after downloading a new app so I can see where it's phoning home too