MalwareTech

https://malwaretech.com/2024/08/exploiting-CVE-2024-38063.html is very worthwhile reading as a write on up this - it's nothing inherent in IPv6 and was a bug in Windows's packet processing of reassembled packets. I'm not convinced it would be particularly exploitable with a firewall between the system and the rest of the internet blocking unsolicited incoming traffic -which is what most consumer routers etc are doing for IPv6.

He named his own blogpost of the incident "How to Accidentally Stop a Global Cyber Attacks". He thought it was trying to spread like a worm, and they followed standard procedure to register the domain and black hole the traffic. https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-…

The MalwareTech article that documents this best, https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-… , uses Necurs as an example of a trojan that uses randomly generated domain names, so probably not at technical reason.

Keep in mind that Hutchins had no idea what registering the domain would do at the time of registration. It was pure dumb luck that it turned out for the best, it could very well have been a disaster. In fact he even admits that he went through a panic phase after domain registration where he thought he'd triggered the malware [1]. Which makes all the "He's a hero" articles bogus if not amusing to say the least. "After about 5 minutes the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files (don’t worry, this was later proven to not be the case), but it still caused quite a bit of panic." This nytimes article is just terrible. Absolutely terrible. Sarah Jeong should be ashamed. After this and the way she treated Naomi Wu [2], I don't think I'm going to be giving her any journalistic credence. [1] https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-… [2] https://medium.com/@therealsexycyborg/shenzhen-tech-girl-naomi-wu-my-e…

IPv6 itself seems to provide a larger attack surface based on IPv6-specific CVEs. I don’t know if it’s the added complexity or that it’s treated as a second class citizen by devs, but I still see a solid number of these coming across the CVE feed. This one was particularly scary: https://malwaretech.com/2024/08/exploiting-CVE-2024-38063.html

This might be relevant: https://www.malwaretech.com/2022/11/everything-you-need-to-know-about-…

OOP and Boost also Templates has benefits when it comes to increasing barrier of static reverse engineering. For example, Security researcher "Marcus Hutchins" famously echoed that Boost is a cluster fuck of OOP sadness [0] Similarly, a close friend of mine "Omer Yair" mentioned [1], "A well written OOP malware might be harder to RE statically than a poorly written C code. Writing OOP malware badly though just makes it similar to C code so not sure of the benefits going that route." [0] https://www.malwaretech.com/2017/04/the-kelihos-botnet.html [1] https://twitter.com/yair_omer/status/1262020385203200000

Yup, and I've been telling my clients for years that it's just a checkbox exercise. No one really does key management well in the first place for self-encrypted drives, and when people started publishing things like [1], it was clear the game was up. For circumstances where the data is genuinely sensitive, we've pushed for physical destruction of the drive. Bonus: throwing pallets of old drives into the incredibly loud shredder our destruction partners use is a lot of fun. [1] https://www.malwaretech.com/2015/04/hard-disk-firmware-hacking-part-1.…

The "instruction hacking.." bit at the end seems a bit out of place given the rest of the page. What it feels like is that its a poorly written attempt to ban software cracking and the computerized version of the previous "Instructional theft" ban without giving people the mental strings to discover how to get free warez and bypass things like hotel keycards, free token cards for the arcade/etc. Frankly, I'm frequently surprised by what I stumble upon on youtube.. (better article with the TOS bits in question) https://www.malwaretech.com/2019/07/youtubes-new-policy-on-hacking-tut…

He's also posted a statement on his website admitting to the crime. https://www.malwaretech.com/public-statement

Statement from Markus: https://www.malwaretech.com/public-statement

This person got pretty far with the Marvell ARM WD drive controller in 2015: https://www.malwaretech.com/2015/04/hard-disk-firmware-hacking-part-1.… Also see: http://spritesmods.com/?art=hddhack&page=1

You could reformat the drives but what if someone has infected the firmware on the drive? Check out: https://www.malwaretech.com/2015/04/hard-disk-firmware-hacking-part-1.…

Apparently it's about this code: https://www.malwaretech.com/2015/01/inline-hooking-for-programmers-par… This is function hooking code. It's useful when you need to change the behaviour of an application, by redirecting a function call to your own function. Like any piece of code it has both legitimate and nefarious uses. However, function hooking is very basic stuff. Anyone who has ever tried to learn how things work under the hood will have written function hooking code before.

Here it is > For anyone still into IRC, MalwareTech has partnered with sigterm.no to launch a new IRC network. It’s still fairly new so don’t expect an instant response, but everyone is welcome (socializing or just asking for help). https://www.malwaretech.com/2014/10/new-irc-launc.html

"Petya Ransomware Attack – What’s Known" https://www.malwaretech.com/2017/06/petya-ransomware-attack-whats-know… Kill Switch Although some companies have claimed to have found a kill switch, this is nothing more than PR as the so called “kill switch” is only activated by modifying files on your own system (which can be done to stop most malware) and is not doable remotely like the WannaCry was. Furthermore, as stated above it’s unlikely the Perya ransomware is still spreading and the damage has already been done, thus a kill-switch would be futile.

Edit: just read this ... In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen). https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-… Does someone have more info on this? I didn't know VMs do this?

The point of the killswitch is to detect if the worm is running inside a sandbox. Some sandboxes will resolve any domain you try to ping, so an easy way to detect this is to ping a non-existent domain name. I'm not totally sure how pinging an existing domain would give you the same behavior, but doing something like checking a handful of random non-existent domains from a large list could do the trick. From the sounds of it, it seems like the researchers didn't expect the killswitch to disable the malware outside of the sandbox any more than the author of the malware did[0]. [0]: https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-…

He applied for GHCQ but while waiting for clearance, he was offered a better job offer. https://www.malwaretech.com/2016/05/infosec-without-degree.html

MalwareTech wrote a blog about it: https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-…

I found this explanation pretty convincing as to why there was such a dumb kill switch embedded in the malware: "I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis" From https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-…

> I don't recall any * nix OS's having automount and autorun enabled by default? But I recall * nix-like OS's that have telnet enabled by default with insecure default passwords: > https://www.malwaretech.com/2016/10/mapping-mirai-a-botnet-case-study.… "Mirai propagates by bruteforcing telnet servers with a list of 62 horribly insecure default passwords, starting with the infamous admin:admin."

Yes. This is very easy to install using PFsense inside a virtual machine. Here's a guide that is recent and I can confirm that it works: http://www.malwaretech.com/2015/08/creating-ultimate-tor-virtual-netwo…

Hell, what about hard disks? Those have firmware too; it's often updatable from the host, and can be modified to add surprising new behavior: http://www.malwaretech.com/2015/05/hard-disk-firmware-hacking-final-pa… But, oddly enough, I have yet to hear anyone calling for open-source hard drives...

Yup, from http://www.malwaretech.com/2014/12/darkode-ode-to-lizardsquad-rise-and… "I had noticed that lizardpatrol.com (the official LizardSquad website) was hidden behind cloudflare, so on a hunch I send a HTTP request to the darkode server, with the hostname set to "lizardpatrol.com".... That's right, the darkode server is also hosting the official LizardSquad website, oh dear." Why is CloudFlare protecting these sites, anyway?

MtGox is known for abusing the market and cancelling trades when the price falls significantly. It happened before [1]. One way to look at it is that they prevent a bank run. The other perspective is that they trick people into thinking the market price is higher than it really is, making unaware people lose even more money as they buy at the high price and the crash happens anyway, just over a longer time. [1] http://www.malwaretech.com/2013/11/mtgox-nearly-breaks-bitcoinagain.ht…

blah alot of yours are ai and javascript stuffs.. i love rss and i mainly use it to stay up to date on sysadmin stuff.. https://hnrss.org/frontpage https://news.ycombinator.com/showrss https://hnrss.org/ask https://hnrss.org/polls https://www.reddit.com/r/technology+SCCM+DNS+virtualization+talesfromt… http://decentsecurity.com/blog?format=RSS https://coffee-and-dreams.uk/feed.xml https://derflounder.wordpress.com/feed/ https://fedoramagazine.org/rss http://krebsonsecurity.com/feed/ https://krypted.com/feed https://www.malwaretech.com/feed https://managingosx.wordpress.com/feed/ https://matrix.org/blog/feed https://orowith2os.gitlab.io/feed.xml http://paradisefacade.com/?format=rss https://sinrega.org/index.xml http://eclecticlight.co/feed/ https://blog.vyos.io/rss.xml https://worldofmatthew.com/index.xml

> It says Windows, but is it x86 or x64? x64 > Can it make a binary that's both x86 and x64 for Windows? Seems to be a PE32+, so it won't run on 32-bit Windows. > Is that even possible? Yes, it should be. A 32-bit process on 64-bit Windows can run 64-bit code by changing the segment selector - make a far call or jump to 0x33:<address>. See [0] for more details. There are some caveats though. kernel32.dll refuses to be loaded as both the 32-bit and 64-bit versions in the same executable. So the executable can probably only import ntdll. One thing one might do is just compile both a 32-bit and 64-bit version of the actual program as dll's and embed them inside the launcher and then extract and load them using only api's in ntdll. In the case of APE it would probably just embed an x64-on-x86 emulator and run the executable in that in case it's being run on x86. Another solution might be to create a .NET AnyCPU executable which will run as 64-bit on 64-bit versions of Windows. [0]: https://www.malwaretech.com/2014/02/the-0x33-segment-selector-heavens-…

From https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-… posted earlier: <quote> In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen). I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis. This technique isn’t unprecedented and is actually used by the Necurs trojan (they will query 5 totally random domains and if they all return the same IP, it will exit); however, because WannaCrypt used a single hardcoded domain, my registration of it caused all infections globally to believe they were inside a sandbox and exit... thus we initially unintentionally prevented the spread and further ransoming of computers infected with this malware. Of course now that we are aware of this, we will continue to host the domain to prevent any further infections from this sample. </quote>