Antisec Gives Christmas Present to the Public, Massivly Owning Stratfor's Servers

Stratfor, <(Wiki)Strategic Forecasting, Inc.>, is a global intelligence company founded in Texas in 1996. They are known for publishing security newsletters to the public. They also provide custom intelligence reports for clients such as major corporations, the U.S. military, and international government agencies.

The Antisec wing of Anonymous, revealed Saturday, on Christmas Eve, that they had compromised several("four") Stratfor servers and posted credit card details of a few Stratfor customers on IRC servers. Stratfor's site is still down with after being <(mirror)defaced>. The group claims plans to dump up to 200 gigabytes worth of data leading up to New Year’s Eve. Participants estimated they had already donated between $500,000 and $1,000,000 to charities fraudulently.

A Antisec participant explains motive for the attack, stating, “That there will be repercussions for when you choose to betray the people and side with the rich ruling classes.”

The biggest revelation seems to be how terribly insecure the security intelligence firm's servers were. Claims were made that Stratfor saved client data in clear text and even stored card security codes, a practice prohibited by credit card companies.

Stratfor, known for their secrecy and big name secret clients, has their proported client list posted (Although, some claim it may only be a subscriber list.)

<Proported client list (pastebin)>


Quinn Norton (December 26, 2011)
<Wired.com - Antisec Hits Private Intel Firm; Million of Docs Allegedly Lifted>

Payload Anatomy of InMotion Hosting Defacements

The Attack

<InMotion Hosting> was hacked leaving more than 70,000 websites compromised on the weekend of September 23, 2011. One of many news articles that covered the attack:

(Article by Jack Phillips Sep 29, 2011)
<The Epoch Times: Hosting Firm InMotion Hacked, Thousands of Websites Defaced>

The Defacement

This attack appears to be a host-wide defacement. The defaced websites had hacked-by pages added to their site which credited "TiGER-M@TE":

(This is a screen shot of the defacement page, index.php )

From the perspective of the customer, there were no access, web, or ftp log entries. A file named hacked_page was dropped in to the root www directory and was propagated to all the immediate sub-directories as index.php.

<index.php contents>(pastebin.org)

Encoding

This PHP page contains only HTML and JavaScript. A close look at its contents shows that it uses some cleaver encoding in an attempt to avoid security fingerprinting, which could later allow for easy automated detection.

A common technique is to represent malicious JavaScript code in escaped hexadecimal character format, then pass that through JavaScript's unescape function at run time. First, this obscures the malicious code. With some small adjustments, the same encoded contents can be generated in many copies all uniquely different. But, with a little time one can decode the page's contents.

The unescape function decodes the URL escape character syntax as well as the JavaScript escape character syntax. The defacement page used both, one over top of the other:

found in index.php
(JavaScript escaped hexadecimal characters)

\x25\x33\x43\x25\x37\x33\x25\x36\x33\x25\x37\x32\x25\x36\x39\x25\x37\x30\x25\x37\x34

unescape's to...
(URL escaped hexadecimal characters)

%3C%73%63%72%69%70%74

unescape's to...
(The start of an HTML tag that will contain the malicious JavaScript)

<script

This is not a new technique and is easily decoded after the fact. After coding up a quick tool I was able to decode the page:

<index.php decoded>(pastebin.org)
(The decoded contents are noted in JavaScript comments.)

I've created an open source tool for decoding escaped hex, <Unescape>, so you can follow along.

Analyzing this shows that this page has five parts of interest:

• Connection to statistics tracking service
• Window animation and color cycling
• A base64 embedded GIF image (not hex-coded)
• "Hacked" image
• Playing of an embedded Flash file (apparently for auto playing audio)

Statistics tracking

Line #33 of the <decoded page> (line #11 originally) defines the function details. This function is set as an onclick event for the "TiGER-M@TE" text. The function open three web pages when triggered, two different statistics tracking service links at <zone-h> and one Google search of "Hacked by TiGER-M@TE" through <LMGTFY (Let Me Google That For You)> The statistics at zone-h can be viewed here:

<zone-h notifier: TIGER-M@TE>

<zone-h notifier: TIGER-M@TE special=1>

Window animation

Line #40 through #133 of the <decoded page> (also line #11 originally) defines a timed script of moving and resizing the browser window in some sort of animated show while cycling colors.

Embedded base64 GIF image

Line #148 of the <decoded page> (the end of line #11 originally) contains a GIF image embedded in the page using <base64(wiki)> encoding. This appears to merely be a faded line. As we'll seen next, maintaining image hosting seems like a challenge for the defacers.

"Hacked" image

Line #183 of the <decoded page> (then end of line #15 originally) is some encoded JavaScript to add an image tag to a small image of the word "Hacked". This <image is hosted on Fotonons.ru> but the tag is crafted to fall back on <the same image hosted at BayImg.com>. This seems to highlight the perceived difficulty of maintaining image hosting during the peak of the defacement activity.

Embedded flash audio

The code inside the "mp3 code starts from here" HTML comments turned out to be the most complicated. This part was encoded in multiple layers and revealed a custom character transformation function. First the contents had some key characters escaped with JavaScript hex characters, the entire resulting contents was escaped with URL escaped hexadecimal characters, then the resulting contents was additionally escaped with JavaScript hex characters. Pealing this away reveals a dF function which provided a custom transformation decoder for decoding the accompanying section of escaped data:

<index.php decoded dF function>(pastebin.org)

This decoder merely did some basic arithmetic to each character's value. The final results start at line 200 of the <decoded page>. This resulting code adds the following flash file to the page for auto-play:

http://77.247.69.68/.../By_TiGER-M@TE.swf

The host 77.247.69.68 <resolves> to <Rackhosting.com> in Denmark. The link, with its peculiar "..." directory, seemed dead as as soon as tested.

Variable Names

The "_0x9355" style of JavaScript variable names imply that many documents where intended to be generated with unique variable names. This technique would act as an obfustication while attempting to evade fingerprinting by security applications such as anti-virus and intrusion detection services.

Summary

The index.php defacement page propagated nearly one hundred thousand times in recently compromised <InMotion Hosting> web sites display a decorative brand promotion while loading a flash file that appeared to be for audio, but was unrecovered. A statistics tracking service was used and a couple of mostly common techniques where used to obfusticate the JavaScript code in an apparent attempt to evade filtering and detection by security services.

UPDATES:

10/2/2011 - Added decoded dF function pastebin
10/8/2011 - Added open source Unescape tool.

Almost Every Music Video Now Availible Free

  Video giant <YouTube> has been making lots of music videos available among their other user submitted videos. Using <Fire Fox> browser <add-ons> like <Fast Video Download> and automated web sites like <VideoDownloadX.com> (formerly YouTubeX.com), you can download a nice video/music collection from YouTube.

  The once popular music video cable TV station <MTV> has replied to YouTube by opening it's own video site which is likely to host most every music video produced, <MTV Music>. YouTube does host remixed and modified videos, user posted music videos, and home made videos that you wouldn't expect to find on MTV Music, but MTV is likely to have a consistent quality collection. MTV doesn't appear to openly allow downloading, but like with YouTube; if there is a will, there is a way.

Programming Salaries Compared

I came across a great post from <The Unix Geek - Blogspot>. He had grabbed average pay for different programming languages, operating systems, and API's from <Indeed> and listed them in order. I've used his findings and the same method to expand on them.

Programming Languages

$82,000 - Objective-C
$80,000 - C++
$80,000 - TCL
$79,000 - C#
$79,000 - Java
$78,000 - Python
$77,000 - Perl
$74,000 - Ruby
$72,000 - JavaScript
$64,000 - Delphi
$64,000 - PHP
$64,000 - Visual Basic
$60,000 - C
$54,000 - Smalltalk

Operating Systems (generic average)

$86,000 - GNU/Linux
$55,000 - Microsoft Windows
$51,000 - Mac OS X

API's

$86,000 - Win32
$81,000 - Tcl/Tk
$76,000 - Qt
$75,000 - GTK+
$71,000 - .NET ($75,000 for "Visual Studio")
$43,000 - Cocoa ($60,000 for "Mac Programming")

Embedded (Various)

$71,000 - AVR
$70,000 - RFID
$67,000 - PIC

When Logo Design Goes Wrong

  The Office of Government Commerce, an office of the treasury in the United Kingdom, is commonly known as OGC. An investment of £14,000 was put into a logo design, which resulted in a nice formal image of the OGC acronym.



According to insiders, within seconds of unveiling employees spotted the problem with this proud logo. This despite it already being etched in mouse pads and pens. If you turn it on it's side, you should notice the problem.



<A hallarious animated version (gif) was posted here>

<The UK Telegraph - OGC unveils new logo to red faces> (4/25/2008)

Microsoft Works SE (Sponsored Edition) Marketing Trials

  Microsoft is silently trying it's hand at ad-funded software with Microsoft Works SE (Sponsored Edition). The trials are being kept secretive, but United States, France, Canada, Poland and the United Kingdom are said to be involved. It is available only through select computer makers and Microsoft won't say which computer makers those are. Some searching has showed <Sony offering it in the U.S.> and <Packard Bell offering it to the U.K.>, both bundled with notebooks.

Microsoft Vice President Chris Capossela, on this and the some subscription based announcements: "These are all experiments."

Read more at:
<CNET News - Microsoft quietly offering ad-funded Works> April 18, 2008

Microsoft Vista Users: Bend Over

  Didn't listen to all those Vista bashers? Chances are your already kicking yourself over issues your having with Vista. Since you're all waiting for some reassuring words from Microsoft, you've got it.
  Last Thursday, at an annual Seattle event Steve Ballmer, Microsoft CEO, called the Vista OS "a work in progress"! I hope they warned you about this when you dropped $200-300 or more on a copy.

You could petition:
<Info World's Save XP Petition>

You could jump on the Linux bandwagon:
<Ubuntu>

Or you could keep your hopes up waiting for the next Windows:
<Windows 7 (Wikipedia)>

Anyone think a Mac is an option? (comments are wide open, as always)

[BBC News] Microsoft offer to buy Yahoo

Microsoft has offered to buy the search engine
company Yahoo for $44.6bn (£22.4bn) in cash and shares.
...62% above Yahoo's closing share price...
There has not yet been any comment from Yahoo.

<http://news.bbc.co.uk/1/hi/business/7222114.stm>