61–70 of 96 posts
Curious how the author knew to seed the backdoor'ed Notepad++ before Bill clicked the link? I suppose you could just serve up a fake backdoor program for every *.exe\msi download, and remove the honeypot on the second download? The first download would execute and maybe do nothing (or error) - prompting a second download which led to the real thing.
Curious how the author knew to seed the backdoor'ed Notepad++ before Bill clicked the link? I suppose you could just serve up a fake backdoor program for every *.exe\msi download, and remove the honeypot on the second download? The first download would execute and maybe do nothing (or error) - prompting a second download which led to the real thing.
Everything is feasible except the faked linkedin email - it wouldn't pass SPF and so I'm pretty sure gmail would junk it.
>Aaron says:
>April 5, 2014 at 3:52 pm
>So how’d you sucker Bill into clicking your exploit link? Since you hadn’t yet hijacked his DNS, I presume the link didn’t (couldn’t) actually point to linkedin.>com — shouldn’t his mail client have warned him? (Mine would.)
>>Reply
>>Phikshun says:
>>April 5, 2014 at 5:35 pm
>>See this video by Raphael Mudge[1]. He does a much better job of explaining it than I would. I also had another advantage — Bill and I worked for the same company at the >>time, so I could send the phish to myself to make sure it passed all the filters. This isn't so unrealistic though. An advanced adversary will scour RFPs, public records and >>job postings to learn what protection technologies a company has and attempt to duplicate their environment for testing.
[0]http://disconnected.io/2014/03/18/how-i-hacked-your-router/c... [1]http://www.youtube.com/watch?v=OO_A8NHNBj8
Even if the target set his computer to auto-update (or something that did not require admin authentication), wouldn't he have some type of notion that something went wrong during his update?
With the target being an InfoSec guy, I would've imagined he would at least be running some type of network monitoring, like wireshark or little snitch, ESP on his personal computer. Wouldn't he have to authorize the outgoing packets?
Sorry, if I come off analytical to the story...it's a great read...I just want to make sure my networks are locked down. I've even went as far as dedicated networks for my server and home usage, and preventing internal ip addresses from communicating to each other (sucks for airplay).
Maybe some NetSec guys could answer this please. What would happen with his update to Notepad++? Would it still update the package? Even if the target set his computer to auto-update (or something that did not require admin authentication), wouldn't he have some type of notion that something went wrong during his update? With the target being an InfoSec guy, I would've imagined he would at least be running some type…
There is a way of injecting your code into an existing executable so that the executable still works like it did before. Basically your code gets called first and than the original program entry point gets called.
Wouldn't he have to authorize the outgoing packets?
He might have updated this Notepad++ on purpose? He obviously did not know his router was compromised.
Maybe some NetSec guys could answer this please. What would happen with his update to Notepad++? Would it still update the package? Even if the target set his computer to auto-update (or something that did not require admin authentication), wouldn't he have some type of notion that something went wrong during his update? With the target being an InfoSec guy, I would've imagined he would at least be running some type…
Wouldn't he have some type of notion that something went wrong during his update? There is a way of injecting your code into an existing executable so that the executable still works like it did before. Basically your code gets called first and than the original program entry point gets called. Wouldn't he have to authorize the outgoing packets? He might have updated this Notepad++ on purpose? He obviously did not kn…
I was trying to figure out how he had the key logger sending out it's packets.
Maybe some NetSec guys could answer this please. What would happen with his update to Notepad++? Would it still update the package? Even if the target set his computer to auto-update (or something that did not require admin authentication), wouldn't he have some type of notion that something went wrong during his update? With the target being an InfoSec guy, I would've imagined he would at least be running some type…
Wouldn't he have some type of notion that something went wrong during his update? There is a way of injecting your code into an existing executable so that the executable still works like it did before. Basically your code gets called first and than the original program entry point gets called. Wouldn't he have to authorize the outgoing packets? He might have updated this Notepad++ on purpose? He obviously did not kn…
Only if it's unsigned (or someone doesn't check the signatures) and it's over HTTP. I can't seem to find it, but someone complained about just how hard it is to get a version of putty that you can at least be sure came from the right domain.
Curious how the author knew to seed the backdoor'ed Notepad++ before Bill clicked the link? I suppose you could just serve up a fake backdoor program for every *.exe\msi download, and remove the honeypot on the second download? The first download would execute and maybe do nothing (or error) - prompting a second download which led to the real thing.
He likely just enabled them all, or at least enabled several which are likely candidates for his target to download.
One more reason to use NoScript - it would have made the CSRF significantly harder to pull off. And a reason to use an OS with a proper package manager, of course ;)
Not really. Depending on the protocol CSRFs are often an easy 1-click exploit on noscript-enabled browsers. Something like this: " /> Is the corresponding 1-click that works on noscript.