Hot answers tagged

81

A malicious hosting provider can do a lot more than simply steal your code. They can modify it to introduce backdoors, they can steal your clients' data, and ruin your whole business. Trust must exist between you and the host. About the source code. If the attacker is trying to gain access to your source code, they will gain access to your source code, ...


64

Short Answer It's absolutely possible, but the accuracy and readability is a completely different matter. One clarification to be made: Reverse Engineering is not Decompiling. Long Answer Reverse Engineering is generally the process by which you take something (anything really) apart to see how it works. Disassembling is when you take a binary ...


61

Most likely, it's just trying to check if there's a working internet connection. The malware authors assume that: Google (or other Alexa Top-1M sites) will be up 99.999% of the time. Traffic going to common productivity sites like Google will not be flagged as unusual. You (or your network administrator) will be unlikely to have blocked these sites at the ...


50

Much of the work on passwords and keys is related to controlling where they are stored and copied. A password is stored in the mind of a human user. It is entered on a keyboard (or equivalent) and goes through the registers of a CPU and the RAM of the computer, while it is processed. Unless some awful blunder is done, the password never reaches a permanent ...


47

There are a number of different techniques, depending on the skill level of the malware author: Embedded metadata - compiled programs can contain details about their authors. This is most commonly seen in legitimate programs, and shows in the details screen if you look in Windows properties. Attackers who are out for fame might well put identifying details ...


37

Well, this calls for three comments: You cannot protect secrets with code obfuscation. Not really. Code obfuscation somehow works against unmotivated attackers, but it is not strong. If there is commercial value in breaking through it, then it will happen. If you don't trust your hosting service then look for another hosting service. If the secrecy of your ...


32

There is two explanations as I see it. Fight over the box The different malware types want to single-handedly own the box and not share it with others. It will therefore try to patch the system and remove other malware and leave a backdoor for the creator. Ethical worms Malware that spreads only to patch and remove other malware is often referred to as ...


29

No, it isn’t worth it. Nobody wants to steal your code. A thousand million SaaS products have been launched by individuals and companies using third-party hosting of some description or another, and roughly none of them have found themselves to be competing against themselves after having the code for their products stolen by their hosts. So, should you ...


26

Extending Karrax's answer: Because the more infections a box has, the higher the chanches (at least one of) the infection gets caught are, and if the box is wiped / cleaned up, it's game over for the malware. So, by cleaning up other infections and/or patching the system the malware is trying to preserve its own existence.


26

Matthew's answer was excellent. There are a few other ways as well. Not a whole lot of malware authors are all that bright. For example, you can open a lot of executables in notepad and look for string data. I've seen countless authors who simply put their email address/server name, username, and passwords inside the programs in a string, and it literally ...


16

You are correct. App secret should be secret and should not be easily obtained by reverse engineering your client code. Facebook uses OAuth so everything I say here also applies to all the applications that use OAuth to authorize and authenticate. The app secret authenticates your client to facebook. Just like a username/password authenticates a user to a ...


15

It is possible to automatically re-create something that looks like C-code from assembly, but the amount of guess-work that the decomplier would have to do is monumental. Compilers are very complicated things that do complicated transformation on the source code. Optimizations, macro/pre-compiler substitutions, code in-lining, type and error checking, ...


14

For studying malware, you will be doing a lot of reverse engineering to understand what it does as well as a lot of analyzing systems for weaknesses to try to predict which ways malware development might go. A Computer Science degree will be critical and you will want to focus on decompiling and low level development (assembly and C/C++). Understanding ...


14

Testing for ECB / CBC / OFB / CTR mode is fairly straightforward. It's also straightforward to see if the mode has authenticated encryption like EAX / GCM (though it isn't straightforward to see which mode of AE). ECB: have a file with many similar blocks in the plaintext. Do you see identical blocks in the ciphertext? (Yes this is similar to Dan's ...


13

Obfuscation might look as the first obvious step, but obfuscation has to protect something in the code and that something cannot be webservice functionality because that is reverse engineered by intercepting the traffic even if it is SSL encrypted. Certificate pinning can prevent simple SSL interception by trusting a predefined certificate. You can ...


12

The basic path for exploiting an overflow-related vulnerability is to find a crash (often by fuzzing), evaluate the crash and whether it presents an attack path, and then build something to exploit it. Sometimes where one looks can involve knowledge of the architecture, such as when Charlie Miller noted that iOS 4.3 has a section of memory which will run ...


12

Obfuscation is ineffective against a determined attacker, it only makes it slightly more difficult. If you have a particular reason to distrust your hosting provider, get another. If you just want to be safe, get a non-disclosure agreement and other legal assurances that allow you to go after your host if they abuse things. If you still don't trust ...


12

Simple connection testing is one reason why malware might connect to Google, Yahoo and other search engines, but I would like to present a different explanation. One frequent application for botnets is search engine spam optimization. As you might notice, the result page of Google (and most other search engines) doesn't lead to the results directly, but ...


11

Some malware authors are part of groups that don't like other malware authors. It's kind of like one football team which doesn't like another football team; they both want to see furtherance of football, but they don't want that other team to be there when it happens.


11

Yes, Java class files are easy to reverse engineer. The format is very regular, and very constrained: the VM must be able to verify that the code complies to the strong typing rules of Java code. This is like the output of a C compiler with all optimizations deactivated: the program structure is plainly visible. (In the Java model, optimization happens in ...


11

SHA-256 is a digest algorithm, not an encryption algorithm. There is no encryption key: there is no secret that can help you go back from SHA256(message) to message. If you only know the SHA-256 value (256 bits, which may be presented as 32 bytes or as 64 hexadecimal digits), the only way to find the original message is by brute force: try all possible ...


10

I wouldn't bother. Two reasons: Runtime interpreted languages really cannot be fully protected that way. To completely obfuscate it you would have to obfuscate it from the runtime as well, then there would be no way to execute it. Obfuscation just makes the task slightly more annoying. It can also make debugging and deployment more time consuming for ...


10

In many programming languages, initialization of local variables is forced, or the engine will flatly refuse to read uninitialized data. Even in languages where you can read uninitialized variables and thus get a copy of what remained in RAM at that emplacement, you cannot count on it to be "random"; it will have a tendency to contain always the same value, ...


10

Short: Is exploit researching different from penetration testing? Yes. Is exploit researching part of pentesting? Usually not. Good summary of what penetration testing is is here: Wikipedia definition of penetration testing. Simple penetration testing A lot of penetration testing work is actually just running pre-existing, well-known attacks or ...


10

What you are trying to do will be... difficult. The main point is that at the end of the handshake, client and server send each other Finished messages, under the protection of the just-negotiated algorithms and keys; and the contents of these messages are hash values computed over all the previous handshake messages, including the ClientHello and ...


9

Here's an example in x86 assembly: MOV AX, 4Ch MOV [someaddr], AX MOV AH, 30h INT 21 CMP AL, 5 This will take advantage of the instruction pipelining of the processor and the failure of debuggers (as they single step through the code) and can as well be an example of an anti-debug measure. This is so because int 21(DOS interrupt) along with an 30h in AH ...


9

To look at your assumptions: many attack groups have resources vastly bigger than that of companies in a typical company security is a cost centre, so they never have enough staff or money in the black hat world, finding security flaws is a revenue stream fuzzing is done by security engineers and black hats fuzzing is by its very nature fallible. So ...


9

Some good answers here, I hope I can add to them. To understand why, you have to realise that your infected web server has a monetary value to the person that infected it. It may be rented out for all manner of activity from routing traffic, hosting other sites, distributing spam, DDoS, etc. If the server has multiple infections it means it is being ...



Only top voted, non community-wiki answers of a minimum length are eligible