Dennis Ritchie, creator of the C programming language dead at 70

Rumors that Dennis Ritchie had passed have been confirmed. Dennis was known for developing the C programming language and being a key developer of the UNIX operating system. He was 70 years old. <Dennis Ritchie (wiki)>

Payload Anatomy of InMotion Hosting Defacements

The Attack

<InMotion Hosting> was hacked leaving more than 70,000 websites compromised on the weekend of September 23, 2011. One of many news articles that covered the attack:

(Article by Jack Phillips Sep 29, 2011)
<The Epoch Times: Hosting Firm InMotion Hacked, Thousands of Websites Defaced>

The Defacement

This attack appears to be a host-wide defacement. The defaced websites had hacked-by pages added to their site which credited "TiGER-M@TE":

(This is a screen shot of the defacement page, index.php )

From the perspective of the customer, there were no access, web, or ftp log entries. A file named hacked_page was dropped in to the root www directory and was propagated to all the immediate sub-directories as index.php.

<index.php contents>(pastebin.org)

Encoding

This PHP page contains only HTML and JavaScript. A close look at its contents shows that it uses some cleaver encoding in an attempt to avoid security fingerprinting, which could later allow for easy automated detection.

A common technique is to represent malicious JavaScript code in escaped hexadecimal character format, then pass that through JavaScript's unescape function at run time. First, this obscures the malicious code. With some small adjustments, the same encoded contents can be generated in many copies all uniquely different. But, with a little time one can decode the page's contents.

The unescape function decodes the URL escape character syntax as well as the JavaScript escape character syntax. The defacement page used both, one over top of the other:

found in index.php
(JavaScript escaped hexadecimal characters)

\x25\x33\x43\x25\x37\x33\x25\x36\x33\x25\x37\x32\x25\x36\x39\x25\x37\x30\x25\x37\x34

unescape's to...
(URL escaped hexadecimal characters)

%3C%73%63%72%69%70%74

unescape's to...
(The start of an HTML tag that will contain the malicious JavaScript)

<script

This is not a new technique and is easily decoded after the fact. After coding up a quick tool I was able to decode the page:

<index.php decoded>(pastebin.org)
(The decoded contents are noted in JavaScript comments.)

I've created an open source tool for decoding escaped hex, <Unescape>, so you can follow along.

Analyzing this shows that this page has five parts of interest:

• Connection to statistics tracking service
• Window animation and color cycling
• A base64 embedded GIF image (not hex-coded)
• "Hacked" image
• Playing of an embedded Flash file (apparently for auto playing audio)

Statistics tracking

Line #33 of the <decoded page> (line #11 originally) defines the function details. This function is set as an onclick event for the "TiGER-M@TE" text. The function open three web pages when triggered, two different statistics tracking service links at <zone-h> and one Google search of "Hacked by TiGER-M@TE" through <LMGTFY (Let Me Google That For You)> The statistics at zone-h can be viewed here:

<zone-h notifier: TIGER-M@TE>

<zone-h notifier: TIGER-M@TE special=1>

Window animation

Line #40 through #133 of the <decoded page> (also line #11 originally) defines a timed script of moving and resizing the browser window in some sort of animated show while cycling colors.

Embedded base64 GIF image

Line #148 of the <decoded page> (the end of line #11 originally) contains a GIF image embedded in the page using <base64(wiki)> encoding. This appears to merely be a faded line. As we'll seen next, maintaining image hosting seems like a challenge for the defacers.

"Hacked" image

Line #183 of the <decoded page> (then end of line #15 originally) is some encoded JavaScript to add an image tag to a small image of the word "Hacked". This <image is hosted on Fotonons.ru> but the tag is crafted to fall back on <the same image hosted at BayImg.com>. This seems to highlight the perceived difficulty of maintaining image hosting during the peak of the defacement activity.

Embedded flash audio

The code inside the "mp3 code starts from here" HTML comments turned out to be the most complicated. This part was encoded in multiple layers and revealed a custom character transformation function. First the contents had some key characters escaped with JavaScript hex characters, the entire resulting contents was escaped with URL escaped hexadecimal characters, then the resulting contents was additionally escaped with JavaScript hex characters. Pealing this away reveals a dF function which provided a custom transformation decoder for decoding the accompanying section of escaped data:

<index.php decoded dF function>(pastebin.org)

This decoder merely did some basic arithmetic to each character's value. The final results start at line 200 of the <decoded page>. This resulting code adds the following flash file to the page for auto-play:

http://77.247.69.68/.../By_TiGER-M@TE.swf

The host 77.247.69.68 <resolves> to <Rackhosting.com> in Denmark. The link, with its peculiar "..." directory, seemed dead as as soon as tested.

Variable Names

The "_0x9355" style of JavaScript variable names imply that many documents where intended to be generated with unique variable names. This technique would act as an obfustication while attempting to evade fingerprinting by security applications such as anti-virus and intrusion detection services.

Summary

The index.php defacement page propagated nearly one hundred thousand times in recently compromised <InMotion Hosting> web sites display a decorative brand promotion while loading a flash file that appeared to be for audio, but was unrecovered. A statistics tracking service was used and a couple of mostly common techniques where used to obfusticate the JavaScript code in an apparent attempt to evade filtering and detection by security services.

UPDATES:

10/2/2011 - Added decoded dF function pastebin
10/8/2011 - Added open source Unescape tool.

Zune Bug Source Code

A bug in 30GB Zunes caused them to freeze on December 31st became the <big news of the holidays> (Gizmodo Dec 31 2008). This was dubbed the 'Z2K9' bug while Zune users flooded <Zune support forums> with pleas for help.

It was quickly realized that by disconnecting both the battery and the hard drive that the time/date would be reset unfreezing your Zune. Microsoft's response to the bug was that it is a leap year handling bug and their official fix was to wait until New Years, for the bug to resolve it's self.

Source code of the bug has apparently been been released. A hardware component manufacturer, <Freescale Semiconductor, Inc.>, is apparently the manufacturer of the <RTC (Real Time Clock)> used in these Zunes. Source code for the Freescale RTC driver module has turned up online. This code has an obvious bug related to line #263, in the 'ConvertDays' function.

Multiple source code mirrors for rtc.c:

http://paste.exstatica.net/7 - (Line #'s + Highlighting)

http://pastie.org/349916 - (Line #'s)

http://tinypaste.com/pre.php?id=53c3996 - (Neither)

The problem appears to be with the date December 31st, on leap year, being day 366. You can see on line #263, an if statement testing 'days > 366' inside a while loop testing 'days > 365'. It seems apparent that if days was 366 this would be and endless loop, at least until the next day.

Update: <The official Zune workaround instructions>

Py3k: Python 3.0 Officially Released

Py3k

<Python 3.0 (a.k.a. Python 3000) was officially released> on Dec 2, 2008. You can find <a nice long rundown> describing the many changes. The lack of backwards capability caused by the changes has been noted in the news for quite awhile.

In case you your not aware, the home of Python is .ORG. If you accidentally go to .COM = Pr0n you will find High Def teen pr0n with explicit flash video playing on load as well as plenty of explicit pictures, nice! That would suck to load up at work while people are around!

Assembly Programming in Python!

CorePy

CorePy 1.0 Officially Released! (Nov 17, 2008)

  <CorePy> is a <Python> package that allows executing assembly instructions for x86, Cell BE, and PowerPC processors (32 and 64 bit) from within Python. It is an open source project available under a BSD license

  CorePy's usage is comparable to inline assembly in other languages, but provides much more control than most provide.

"high-performance applications that take advantage of advanced processor features, including multiple cores and vector instruction sets (SSE, VMX, SPU), usually inaccessible from high-level languages."

  CorePy works by using an ISA, a library of architecture instruction sets, to build a list of instructions in a InstructionStream. This is called a synthetic program and is converted to a stream of reusable processor instructions. These synthetic programs can be executed by the processor synchronously or asynchronously, passing parameters to and from other synthetic programs.

  A print function is built in that supports plugins for printing the instruction stream out to assembly. Nasm seems to be ready, but GAS-compatible output seems to be incomplete.

A simple example from the website:

  # Load the x86_64 instructions and environment
  >>> import corepy.arch.x86_64.isa as x86
  >>> import corepy.arch.x86_64.platform as x86_env
  Platform: linux.spre_linux_x86_64_64
 
  # Create a simple synthetic program
  >>> code = x86_env.InstructionStream()
  >>> code.add(x86.mov(code.gp_return, 12))
 
  # Execute the synthetic program 
  >>> proc = x86_env.Processor()
  >>> result = proc.execute(code, mode='int')
  >>> print result
  12

<CorePy>

<Download Page>

[Link] Microsoft programming contest hacked, defaced

iTWire [3 pages] (Oct 6, 2008)

<Microsoft programming contest hacked, defaced>

SoCo Software Releases C++ Yahoo Source Code

  <SoCo Software> has released <XLibrary>, a C++ repository of source code modules. Included are Windows sockets, Yahoo chat, and Yahoo captcha modules. This library is released under a custom license similar to the <OS-CPL> which doesn't force adoption of open source licenses.

  SoCo Software has provided free tools, scripts, and applications with source code, for a few years now. It is one of the few places where you can find a <free proxy tester> with source code. Most free proxy testers are released by proxy list sites, so you can help them find fast proxies, while getting the bottom of the barrel.

  The software site is using this library release as the beginning in a line of additions of source code libraries and snippets, including embedded (ASM and Dynamic C) and web application (JavaScript and PHP) source code.

New PHP Features Coming v5.3

<Skip to the run down>

  PHP(Wiki) is becoming a popular web development language with the recent boom of LAMP(Wiki) servers.

  In general, PHP is a script language with very similar syntax to C/C++. It uses type safe(Wiki) variables that support arrays and tuples(Wiki)(associative arrays), much like Perl and Python.

  PHP is typically embedded into HTML pages (with the .php extension) on a web server. When a PHP page is requested, the PHP content is parsed server-side and only the resulting HTML is replied to the requesting browser.

  PHP 5.3 alpha <was released>(Aug 1, 2008). Version 5.2.6 was recently released in May and was the first release in a couple years. Version 5.2.6 was mostly security and bug fixes. Version 5.3 sports the most new features and improvements seen in a long time. The expected date for a stable PHP 5.3 is mid October 2008.



A quick rundown of some new features in PHP 5.3 Alpha:

 Namespaces(Wiki) - This should allow much shorter class names and grouping flexibility.

 Late Static Binding(Example) - For some more robust class inheritance.

 __callStatic(PHP.net) -  __call is a built in class member function that allows you to define behavior for calls to non-existent member functions. __callStatic extends this functionality to static member calls.

 Lambda Functions(PHP.net) - Quick, throw away, inline functions.

 Closures(PHP.net) - Associate a list of the parent scope's variables to be imported into a function. This also make Lambda functions much more useful.

 __DIR__ - This constant will replace the commonly used dirname(__FILE__) statement to retrieve the current script's directory.

 Phar - A PHAR file is a compressed archive and can contain a complete PHP application. Similar to a Java's JAR files, a Phar file could allow large multi-file PHP scripts to be distributed and used as one, compressed, file.

 PHP goes Windows 2000 and up only

<PHP.NET 5.3 Alpha1 Release announcement>(Aug 1, 2008)

Metasploit The Recent DNS Flaw

DNS
<Metasploit> plug-in that uses the <recent DNS poisoning flaw> to inject a malicious DNS entry.
<www.caughq.org/exploits/CAU-EX-2008-0002.txt>

Programming Salaries Compared

I came across a great post from <The Unix Geek - Blogspot>. He had grabbed average pay for different programming languages, operating systems, and API's from <Indeed> and listed them in order. I've used his findings and the same method to expand on them.

Programming Languages

$82,000 - Objective-C
$80,000 - C++
$80,000 - TCL
$79,000 - C#
$79,000 - Java
$78,000 - Python
$77,000 - Perl
$74,000 - Ruby
$72,000 - JavaScript
$64,000 - Delphi
$64,000 - PHP
$64,000 - Visual Basic
$60,000 - C
$54,000 - Smalltalk

Operating Systems (generic average)

$86,000 - GNU/Linux
$55,000 - Microsoft Windows
$51,000 - Mac OS X

API's

$86,000 - Win32
$81,000 - Tcl/Tk
$76,000 - Qt
$75,000 - GTK+
$71,000 - .NET ($75,000 for "Visual Studio")
$43,000 - Cocoa ($60,000 for "Mac Programming")

Embedded (Various)

$71,000 - AVR
$70,000 - RFID
$67,000 - PIC

BSD fixes 25 year old bug

The flaw for reading MS-DOS directories in all BSDs (including Mac OS X) tracked back to 1983 was recently fixed. SAMBA uses a special workaround in order to function properly on BSD systems. OpenBSD developers received an email from an OpenBSD user which led to unraveling the bug.

Source with quotes from <Marshall Kirk McKusick>, the original developer of the *dir() library:

<OS News - The 25 year Old BSD Bug> (May 10, 2008)

there was this one time I was wanking to porn...

[captcha]Visual Basic Fags

Visual Basic kiddies are Fags!