onHacks

OWASP 测试指南 V3 中文版 终于公开了！可以在 OWASP 中国主页下载。强力推荐有兴趣于网页安全研究的人去看看这份指南，肯定会有所收获。

OWASP中国研究小组（NEW)

为了更好的促进OWASP中国各区域的沙龙、活动能够持续、稳定的进行，OWASP中国特成立的各区域小组，主要为了促进小范围内的交流和分享。同 时，也非常欢迎大家自荐成为自己所在区域的负责人。OWASP中国项目研究组以目前OWASP的开源项目为基础，深入研究各类应用安全技术，并输出相关中 文资料、培训文档、安全工具等。同时，也会不定期的在各区域的活动上做相关培训。 OWASP中国QQ交流群 78238096

我希望能出一分力提高中国互联网的安全，從 Frank Fan 及 RIP 那邊接手了項目，所以之前十二月就是为了把这个完成，花费了相当多时间。

非常感谢以下的人，尤其 Microsoft 内的大家在圣诞节加班的大力技持！姓氏排名：

• Aaron (DBAPPSECURITY)
• 程琼(Microsoft)
• Frank Fan (DBAPPSECURITY)
• 贺佳琳(Microsoft)
• 李伟荣(Microsoft)
• RIP (OWASP China Chair)
• 沈巍(Microsoft)
• 王超(Microsoft)
• 韦炜(Microsoft)
• 张柏明(Microsoft)
• 趙嘉言(Microsoft)

希望大家都有所获益！

China, Testing OWASP, Paper

Hi guys this is Log0, not that I’m dead, but I’m very well alive.

For the whole December and some January, I’ve been working for OWASP China on some projects – thus taking my full attention. And I have been busy on picking up some bits of life and my side project – yes! Working on it! It’s coming in this January!

The 2009 is a fantastic year! I am aiming well for 2010 and will aim to advance fully into my interests. More to that next time… meanwhile, stay tooned. =)

Random Chatter

Brief note…

You might have noticed that I used md5 as filenames in the previous (old!) post. In most cases, it is fine.

However, what if the malware depends on a file called hgz.dll? You can calculate hgz.dll as md5, then find the filename out, now put that in the VM again – fine. But you see it is a troublesome process… that you can’t easily automate. There are other cases… of course.

Well, you get the point!

Malware

基于二进制的恶意软件分类能节省时间和工作量。作为个人兼职性安全研究人员，这种提高效率的方法很有用。日积月累，收集回来的恶意软件会越来越多。可能有 2000 多个。要全部分析它们颇为费时。若要节省时间和工作量，我们可以把类似甚至是一样的恶意软件滤掉。那麽可以怎样做呢？

我们假设所有要分析的档桉皆为恶意，因为蜜罐等方法收集回来的皆定义为恶意的。

其中一种分类方法便是用扫毒软件来分类。被检测到属同类的的病毒，我们可以抽其中一个或两个分析就可以。例如只抽一个 “Conficker.B” 的样本。因为 Conficker 家族是比较常见，这样就可以节省很多重覆的工作。这做法的坏处是，没能被检测出来的病毒都被放属同一组。

Clamscan 的一些節錄…

/tmp/4c71b97435a24ffb8fd7fedd1b1790e1: OK
/tmp/82dd3a3d386d4ea09870dcee4a75a531: OK
/tmp/72bdd3bd37a0b5d1dd5f1be80cb29639.bin: OK
/tmp/24bd1722b994f7daa193458348108bfc.bin: OK
/tmp/39960c5ff1922466ded71a4a2799c295: Trojan.VanBot-366 FOUND
/tmp/33f5f14c33bf2f71556204705407a885: W32.Virut-54 FOUND
/tmp/880ce6df69aaeb1d3c57e756f53dd158.bin: Trojan.Delf-911 FOUND
/tmp/7e0ce66bb299370010016f4522152969: Trojan.VanBot-366 FOUND
/tmp/4f2d9f8129e7d7fd9b37f700aacdc9aa.bin: Trojan.Hupigon-25647 FOUND
/tmp/5b69ff6f331ece36558516f66306f969: Trojan.Small-4287 FOUND
/tmp/078aedb8630339487cf39d028b0156bd.bin: OK
/tmp/417bdef0688996a845701da9dcf1b145: Trojan.VanBot-366 FOUND
/tmp/eda3b7766c23dfffc0b85d0ba546b0c1: W32.Virut-54 FOUND
/tmp/86f22ff53382dbb54e2c22560a3db373: Trojan.VanBot-366 FOUND
/tmp/a4a41d2122c4d3552e3d59315f42d4e3: W32.Virut-54 FOUND

看看上面的输出。若果没有扫毒软件的分类，何以判断4c71b97435a24ffb8fd7fedd1b1790e1 和 82dd3a3d386d4ea09870dcee4a75a531 是不是同类？如果在众多样本中找出独特罕有的病毒？若要你手动分析 600 多个，不多，但恐怕是很多工作量了。

另一种方法是用 ssdeep 了，是一个模煳 hashing 的工具。专门用来检测文件相似性，可能相差某些字节和内容。它是会计算出一个 hash 签名，但和 md5 不同，改一小个字节不会造成差异很大的 hash 签名。 ssdeep 的概念是把一个档桉分为多个小部分，并为每个部分计算 hash 签名。

以下是一个 exe 档安样本 (“file1.exe”)，并拷背了一份再加多了一个字元，并为此两档桉计算 md5 hash。

$ cp file1.exe file2.exe
$ echo 1 >> file2.exe

$ md5sum file1.exe file2.exe
72bdd3bd37a0b5d1dd5f1be80cb29639  file1.exe
a626b78fa6ba13fdd9cfddb9f55ee7c6  file2.exe

只是一字元的分别，这两个 md5 hash 基本上是不一样了。再看看这两档桉的 ssdeep 签名。

(为了清楚一点，分为数行)

$ ssdeep -b file1.exe file2.exe
ssdeep,1.0–blocksize:hash:hash,filename
768:my+qxlsz7yiV0+7YUaFhLFAtVI0xbM
LvzEg1B1Ki8nJ78:R+qxlsHvGhLFyI0l8tC5J78,”file1.exe”
768:my+qxlsz7yiV0+7YUaFhLFAtVI0xbM
LvzEg1B1Ki8nJ7V:R+qxlsHvGhLFyI0l8tC5J7V,”file2.exe”

以冒号分隔，第一个 (768) 是每块单元的大小，其后两个是档桉的 ssdeep hash 签名 (my+qxlsz7yiV0+7YUaFhLFAtVI0xbMLvzEg1B1Ki8nJ7V 和 R+qxlsHvGhLFyI0l8tC5J7V)，最后便是 档桉的位置 (“file2.exe”)。这裡要看的是那两个 ssdeep hash 签名 － 由两个很相似的档桉计算出来 ssdeep 签名是非常像，除了最后一个字元 ( “8″ 对 “V” )。

若果你有大量的未能被检测的恶意软件，虽然扫毒软件不能帮你，但 ssdeep 可以。以下是用 ssdeep 分析大量恶意软件的相似性关係。档名同时亦是该档的 md5 hash 签名。

$ ssdeep -dr .

…
/tmp/72bdd3bd37a0b5d1dd5f1be80cb29639.bin matches /tmp/fa7c91b738e763eccf69676bd393925e.bin (88)
/tmp/72bdd3bd37a0b5d1dd5f1be80cb29639.bin matches /tmp/ae142ce3b35cc04f5648a0c17c37ea30.bin (82)
/tmp/72bdd3bd37a0b5d1dd5f1be80cb29639.bin matches /tmp/794b74fc4e833d245eb005e078dc21da.bin (82)
/tmp/72bdd3bd37a0b5d1dd5f1be80cb29639.bin matches /tmp/46fb9678675df8dc83d38761a76c7950.bin (99)
/tmp/72bdd3bd37a0b5d1dd5f1be80cb29639.bin matches /tmp/f412d41aacb4b16ded7b158b89fd3552.bin (90)
/tmp/72bdd3bd37a0b5d1dd5f1be80cb29639.bin matches /tmp/4bfba885ed3dc4ba800446df49051af0.bin (82)
/tmp/72bdd3bd37a0b5d1dd5f1be80cb29639.bin matches /tmp/13776c2b604290906305a56c4e7c61e5.bin (99)
/tmp/72bdd3bd37a0b5d1dd5f1be80cb29639.bin matches /tmp/5a8424f4e1504b5823ca8742e2b1ce8d.bin (82)
…

从以上看得出来，每个档桉的 md5 很不同。但，ssdeep 是可以关联起来的。若果没有被关联起来，可以先假定为少数特别的恶意软件，并以后对它多加分析。此外，ssdeep 还能对 打包了 (packers) 的 exe 作分类，因为它们只是压缩软件，而类似的软件当然压出来也是相似的。

有几个要注意的地方。第一，ssdeep 是把一个档桉拆散作分析的，若果档桉在每100字元被修改一个字元的话，ssdeep 是认不出来的（某些混淆算法就是会加些垃圾，简单的如 no-ops。）。再者，若果用来分析恶意软件的登录资料，类似的档桉有可能是连去不同的僵尸网络控制台，若以被错误地滤掉。当然，你亦可以去分析当中的同通点并分析登录的算法。

以 ssdeep 作恶意软件分类应可以减轻个人的工作量，算是一种方法。

===

ssdeep – http://ssdeep.sourceforge.net/

UPX – http://upx.sourceforge.net/

Malware

This is a report more than discovery in spam collection. I was working on setting up a spampot using spampot.py which was written by Neale Pikett back to 2003. Although the result is not as my expectation, it does gives me more information about setting up a spampot.

Goal

The goal of running a spampot (honeypot which only care about spam) is to collect spam and analysis the trend of them, hopefully we can find some interesting techniques that spammers/ hackers use in junk and phishing emails.

Approach
So far, there are at least two types of spampot hosting method that I know. The names of them are designed by me, if there are formal names for them, please let me know.

Open Relay Spampot: This kind of honeypot is running as an open mail relay server. In case you are not familiar with, open relay means users can send message through the server anonymously.

Close Relay Spampot: The spampot is running as a close mail relay server. To expose the server to spammers, you need to have your own domain binding to this server with email address(es) exposing to spammers/ hackers. For example, we can have onhacks.org binding to a spampot and spam@onhacks.org is one of the email address we want to expose to spammers. However, about the methods to increase the exposure of an email addresses is out of scope, we can discuss more on it later.

In my setup, I decided to run spampot as open mail relay server.

Setup
I have VirtualBox installed on top of Windows 7. I am using Ubuntu as the guest OS, this is because it seems the implementation was done in *nix system. Since port 25 is the default port for SMTP service, we need to forward packets from host (Win7) to guest (Ubuntu) so that the spampot in guest OS can react to incoming connection at host port 25.

(Assuming that you are using NAT for VirtualBox)
To enable port forwarding, you need to set the HostPort 25 forwarding to GuestPort 25. For more detail around port forwarding in VirtualBox, please refer to this article.

However, you will soon discover that it is not possible to perform port forwarding if the port is reserved (< 1024). This can easily be resolved by running VirtualBox with admin credential (ie. Run As Administrator).

The spampot.py requires Sendmail being installed in Linux. Since sendmail actually is a service listening to port 25, I will do the follow to switch to spampot.py:

sudo /etc/init.d/sendmail stop
sudo spampot.py 0.0.0.0

Surely you can set this automatically run when the system is started.

The last thing is to add a DNS record pointing to my machine. I have smtp.onhacks.org. pointing to it. Since it is still under experiment, the machine is running at home and IP is dynamic, I need to change it often.

Result
Currently, I got 0 message after running the spampot for few days. I have google around and looks like open relay spampot is not that popular anymore because many server admins aware that spammers were abusing open mail relay servers, they don’t allow open relay anymore. As a result, submitting spams to open relay servers is not efficient anymore.

I will continue running the spampot these days and see if we can get more spam through open relay honeypot. Afterward, I will work on close relay spampot.

Reference

1. Open mail relay – Wikipedia
2. spampot.py – written by Neale Pickett
3. Configure Port Forwarding to a VirtualBox Guest OS – Tombuntu
4. SpamPots Project – Cert.org
5. Brazilian Honeypots Alliance

Email, Honeypot, Spampot

Last night, I was waken by a call that a server was not working. This server is hosting an online judging system (similar to uva.onlinejudge.org, which has algorithmic problems that users can solve). I took a quick look at the compilation process and web pages, everything looked good except it always return “Compilation Error” no matter what was the content in source code (even a HelloWorld!). By manually compiled the source code, the compilation error message gave more detail information about the root cause…Not enough space to link the object files! When I did a “df”, it said that the data partition was used 100%!!

After a deeper investigation, I discovered that one of the user was preparing questions on the machine, and generated a 12GB test data unexpectedly. Since this is a very old machine, it only has a 14GB hard disk for data storage and it already had 2GB data on it. This is kind of DoS attack since no one can submit sources to the judging system even though they can navigate to it.

Lesson learned: We should have restriction on storage usage of each user instead of unlimited.

Any other suggestion to prevent this happen again?

Random Chatter DoS

Details at Jose Nazario of Arbor Networks : http://asert.arbornetworks.com/2009/11/malicious-google-appengine-used-as-a-cnc/ .

Log0 is quite busy lately.

Botnet

Botherder 0.1 可以在这裡下载了，或在 Source 页面。Zip 包裡有 README。

本来不打算开放的，但发现又有一定用处。以后裡头还有很多可以加的功能如 监听任何的协议、更易用、更易自动化、及可以写脚本等。

Botnet Source

这次的演讲的 PPT 在这 :

我在写好用法之后再公开代码。若果你有我的卡片，欢迎电邮来找我 =)

Hac.ka 就是我在结尾时提到的朋友和另一位队员，他是搞电邮和 DNS 的。

Botnet Presentation

Microsoft Security Intelligence Report 7th is out! Interested individuals should check it out. =)

Botnet, Malware Report, SIR