Robsec

So a few weeks back after a class I'd taken with them,  a number of my students told me of a particular malware that was affecting students' computers, in particular, computers running Windows OS. According to them, if you tried to open a folder that was residing on the USB stick with the malware, the malware would delete some of your files and convert folders into executable files. Granted, the likelihood of a random folder miraculously transforming into a single executable file was kinda "out there" but I figured I'd check it out and use that as a teaching moment for those interested in venturing into malware analysis. So I tasked them to bring me a sample of the malware so I could take a look at it and maybe figure it out. I advised one of them to download DumpIt  and then extract the memory dump from an infected computer using a clean flash disk and then bring it to me. How do you do this exactly? here's how: Download DumpIt . It's a portable...

So now everyone knows Zimbabwe is currently holding the number one spot in the global rankings of countries that are the most vulnerable to attacks on the Internet, but what does that mean exactly? The point of this article is to shed light on what this means from a layman’s perspective and why that report was effectively a clarion call to all, expert and inexperienced hackers, security researchers and script kiddies across the globe that the public IP addresses of Zimbabwe are the place to test your hacking skills and tools. Hopefully, at the end of this piece the private and the public sector will realize there is a need to come up with a way to join forces and resolve this crisis we are facing. As a matter of fact, it is very possible for us as a nation to get out of this dire situation we are in, take Belgium for example. In 2016, Belgium was the number one most vulnerable country on the internet but they successfully managed to not only get themselves out of the top 10 in th...

There has been a great deal of uproar from many corners in our local society regarding the structure of the new Primary and Secondary school curriculum, but in this article I will not delve into my support for one side or the other as a whole.  What I would like to focus on though, is the Computer Science subject (which I believe is very impressive to say the least) and how it ties into the bigger picture that is cyber security. This is with respect to the growth of what are known as threat actors in cyber security and the need for everyone to take their personal and organizational security seriously. By definition, a threat actor is basically any individual who may possibly cause harm to you or your organization, be it physically or in our case, digitally.  You see, contrary to popular belief, or maybe I should refer to it as “media-based” belief, the people who can compromise your digital security, are not only just teenage hackers on the other side of the world wh...

A number of studies have shown that the benefits that come along with a Bring Your Own Device (BYOD) policy are multiple when it comes to improving efficiency of employees. On the basis of these studies, many organizations across the globe proceeded to implement this policy but not all of them managed to carefully consider the impact such a policy would have on the cybersecurity of the organization itself.  With BYOD, you basically allow employees to bring their own devices (such as laptops) to work and connect to the company’s internal network so they can access organizational resources. It also tends to allow said employees to take the devices home and in some cases, get remote access tools installed on the personal devices to allow them to connect to the same internal organizational resources while they are not on site. As you can imagine, the benefits are quite numerous, but as cybersecurity experts, what we naturally tend to look for are weak spots in such policies and h...

Okay, so this article isn’t going to focus much on the WannaCry Ransomware that’s wreaking havoc across the globe at the moment. It’ll be more focused on trying to highlight potential cyber-security related events linked to the root of this particular deadly malware, the Equation Group. So, a little bit of backstory, the first time I ever came across the name Equation Group was some years back when I was doing research for my Master’s degree on malware development and an article was making the rounds about how they had developed a way to exploit the firmware of a hard drive! That exploit truly was a thing of beauty. Of course, they were said to be linked to the US’s NSA but that link is not exactly what this article is about as well. Moving on, I ended up keeping an eye out for any discoveries or articles to do with exploits related to the Equation Group. But then 2016 came and the world of infosec got even more exciting. A group known as Shadowbrokers apparently hacked the E...

So the most popular question I got asked by people in the past week was “what on earth is Ransomware?” So let me put it this way, imagine you wake up in the morning and you turn on the data on your phone so you can see the WhatsApp messages that came in while you were asleep. You are then greeted by a screen on your phone with a message written across the whole screen saying, “Your phone has been encrypted. To regain access to it, send 10 BTC to Bitcoin account XYZ”. You are puzzled because not only have you never seen this message before, but you don’t even know what “encrypted” means or what BTC or a Bitcoin is. Now you, assuming this is a typical “gadget” error, restart the phone (like you would any PC) and the same message pops up again. You think of Googling the problem on your phone, but then you can’t access the Google app. Then realization slowly sets in that you can no longer access your WhatsApp, your contacts list, your music or even the Date/Time app itself! That is basic...

So, a little back story. I have a 2 Terabyte external hard drive that's split into 3 partitions for backup; one for entertainment, one for work and one for personal projects. A friend of mine had a Lenovo laptop that was having challenges with installing WLAN drivers (you'd install the drivers and they'd keep giving an error that drivers aren't working. If you tried to uninstall them, they'd just reappear...but that's a whole different story). Anyway, my friend decided to roll-back from Windows 10 to Windows 8 and wanted to copy one of the test builds from my 2TB HDD so I lent it to him. Little did I know that that Lenovo laptop had other plans for me. Upon connecting the external hard drive to the Lenovo laptop, it immediately read it as a FAT32 formatted drive (it was actually NTFS formatted) and had 1.82 TB free space of the "actual" size 1.82 TB. Where panic would have ensued for many, I managed to keep in the growing irritation at such a thing ...

I had to do this demo after one of my students asked for my assistance regarding how to use this tool. Usually, I just assign different tools to them individually depending on the aspect of penetration testing we are covering (session hijacking, vulnerability scanning, etc) and then tell them to submit a report and a video demo of how the tool is used. Anyway, after a brief one-to-one discussion I realized the student had actually done the research on how rainbow tables operate (above and beyond the material in the lecture slides) so I figured that if he was here asking for assistance, he genuinely needed it. The tool is available at the RainbowCrack site.  A detailed description of this nifty tool can also be found here . So, firstly I had to generate the rainbow tables. The command line syntax is: rtgen hash_algorithm charset plaintext_len_min plaintext_len_max table_index chain_len chain_num part_index where: hash_algorithm  Rainbow table is hash algorithm sp...

This is the second episode in the Recovery of Files series.  Episode 1  has a little more background on the whole aspect of file recovery. The video below shows a demo of how to recover lost/deleted files using the proprietary tool commonly known as  Data Rescue PC3 . As in episode 1, in the video, we format the USB drive, add stuff to it, and then format it again in order to recover the deleted files. Again, just like in episode 1, you will also note that not only the files we lost upon formatting are the ones that are recovered, but this will also include the files from previous drive formats too.

This is the third episode in the Recovery of Files series. Episode 1 has a little more background on the whole aspect of file recovery. The video below shows a demo of how to recover lost/deleted files using the tool commonly known as  PC Inspector File Recovery . In the video, we format the USB drive, add stuff to it, and then format it again in order to recover the deleted files. Also, you will also note that not only the files we lost upon formatting are the ones that are recovered, but this will also include the files from previous drive formats too.

The video below shows a demo of how to recover lost/deleted files using the tool commonly known as Recuva . In the video, we format the USB drive, add stuff to it, and then format it again in order to recover the deleted files. A key point to note when it comes to dealing with FAT32 or NTFS systems is that if you write more content to the drive after formatting, in all likelihood it may end up overwriting the sections where the data to be recovered is. You see, when we do a quick format  as shown in the video, we're not wiping the drive per se. We're just stating in the respective file tables that the areas/sectors of disk space that were previously occupied by the data we have deleted are now available for reuse. That's what makes it possible for us to recover deleted files. You will also note that not only the files we lost upon formatting are the ones that are recovered, but this will also include the files from "formats past" as well.

So if you haven't ever heard of the Shellshock vulnerability check this out before you proceed. Oddly enough, there are obviously a bunch of servers and hosts around the world that are still vulnerable to this vulnerability simply because they choose not to update/patch their respective operating systems accordingly. Anyway, while I was hanging around that section of the internet where Kitploit  stays, I came across an interesting tool they mentioned. It's called Shocker  which is basically a tool to "find and exploit servers vulnerable to shellshock". It's available here on github. So what you do is you clone it onto your kali, move into the directory and launch the program shocker.py. The arguments you include may vary (check the help menu) but just include the IP address of the host you're scanning. In this case we used the Shellshock vulnerable VM from vulnhub.com . It then shows us the possible options we can use and then we can finally selec...

The video below shows a demo of how to exploit the Metasploitable Linux using a backdoor. After the gaining of access, we then show a few commands in Linux that a hacker can run. In addition to that, we also check the permissions associated with the user profile we have accessed and surprise, surprise, it's Amy Acker (read Root). After that, we then show u the contents of /etc/passwd and /etc/shadow- which when brought together give u the passwords file. However, we won't be getting the passwords file that way. There is a much simpler way I call "Post-exploit exploits". Among these, is one nifty one called gather/hashdump used to gather/get a hashdump of the passwords file. We then take this hashdump to john (also known as john-the-ripper to others) who then proceeds to crack the passwords. In our case, the passwords used are quite simple so the process of cracking won't take much time. However, the more difficult to guess the password is, the harder it is to...

The video at the end of this post is a demo of a solution to a forensic challenge from this site .   The goal of the challenge is to extract necessary information for an investigation from a pcap file. the site, forensicscontest.com, has a number of similar challenges that you can try out as well. Obviously, there is more than one way to skin a pcap (the other methods can be found among the solutions/walkthroughs on the site itself) and in this case 2 tools were used: Wireshark NetworkMiner Just to cover a few "mysterious" sections of the video, there is a point where I sorted the packets in wireshark in alphabetical order then looked for the first SMTP packet. The reason is that since we are investigating email evidence, the common protocols we should search for include IMAP, SMTP etc. In this case, the criminal used SMTP. Next, there is a point where we highlight the stream index in the detailed section of the packet. This is because each stream refers ...

NowSecure  has a nifty Community edition tool VM that can be used to extract lots of data from Android devices and iPhones too. All that is required is register for the Community edition where you then receive an activation key that you use to activate the NowSecure forensics tool. You will also get the download link for the VM which contains the said tool among other forensic tools. The tools returns browser history, accounts on the device, wifi history, contacts and a host of other information that you may have or may not have been aware of. It also has an option to download media files such as videos, images and audio files though including them will definitely take more time. You should also ensure that the phone has USB debugging enabled. However, for some Android flavors, the lock-screen can also be unlocked from within the tool itself. This is strictly for Educational Purposes only. Video Demo

This is very similar to the previous post on generation of RATs for Windows with the main difference being the platform and what you can do.  This demo basically highlights the risks of downloading third party apps from untrusted websites. The apps you download may actually contain malicious payloads that can potentially download your contacts, messages, call logs, take videos with your phone camera as well as photos without your knowledge. In addition to that, you must be vigilant when checking the permissions apps require from you upon installation (though this mainly applies to pre-Marshmallow flavors of Android). The knowledge imparted here is strictly for educational purposes only.

Now we delve into the world of Malware analysis, This can be either Basic static, basic dynamic, advanced static or advanced dynamic malware analysis. By static we just mean we do not execute the malicious program but simply analyse it by looking at the headers, the linked libraries it calls, its resources, etc. When it is advanced, this would mean breaking it down and analysing it with tools such as IDA Pro. Dynamic means we run it in a safe environment and see what it does. Basic tools include Regshot which simply takes a snapshot of the registry before and after the malware was executed. It then returns only the changes made in between those two points in time. Advanced would involve the use of a sandbox that monitors all the calls the malware makes as well as the connection attempts it tries to make to outside terminals or C&C servers. The video below illustrates Basic Static and Dynamic malware analysis.

Considering the threats that have been highlighted in the previous posts, there definitely have to be ways for users to stay or keep themselves safe besides: keeping their antivirus software updated,  first checking whether a program is malicious via Virustotal before installing it or  submitting it to malwr.com  which uses the cuckoo sandbox The operation of cuckoo sandbox was demonstrated in one of the earlier posts on this blog as part of a tool that extracts malware embedded within pictures and scans it. The video below shows how to use the Volatility framework which is actually a memory forensics tool. It is used in partnership with a "RAM dumping" tool or basically a tool that takes a snapshot of the RAM in a targeted computer.  For our case, we used DumpIt in the video below. A forensic investigator could have this on a USB drive, connect it to the evidence workstation and then download the RAM dump onto the USB. DumpIt saves the...

Typically after a malware developer has created his malicious payload (for example using the steps mentioned in the post about generating a RAT with MSFVenom) they test whether that malicious program can be detected by antivirus software.  Enter Virustotal . This is a website that can be used for both positive and negative means (as is the case with all forms of education). With Virustotal, bad actors can use it to test their payloads to see if it can be detected by antivirus software that is the most popular on the market. Regular actors/uses can use it to check if a tool or software they want to run on their computer is malicious or not. How to do this is also illustrated in the video below. In most cases malware analysts use it for static analysis of potentially malicious programs.  So typically there are a number of ways that antivirus software works but the one method that bad actors try to combat in this scenario is signature based analysis. By this, a hash...

In the past there was msfpayload and msfencode that served the purpose of creating a malicious payload under the metasploit framework. However, like all good things, they needed an upgrade and ended up being combined into msfvenom (feisty sounding name). So basically msfvenom allows pentesters to create a payload and then encode it with their selected encoder without having to port the generated msfpayload to msfencode. This makes for a more compact framework with the integration of these modules. The video below shows a demonstration of how to create a remote access trojan (RAT) that is attached to a functional calculator.exe program. In most cases, when we do not have our own executable to attach the malicious code to, we end up using the metasploit templates which are known to most antiviruses. It's quite simple to download the calculator.exe program from the internet (or any specific executable file the pentester wishes to use. Please note that this tutorial a...