ACATTAG

Fixed!

joe — Mon, 09 Aug 2010 14:33:04 +0000

So rather than take my wrecked bike to the body shop to fix the dented gas tank and bent handlebars, I decided to fix it on my own, with nothing more than body filler, spray paint, new emblems and a lot of banging and bending. Not exactly a professional restoration job, but I don’t think it turned out so bad.

Operation Aurora: Clues in the Code

joe — Wed, 20 Jan 2010 18:19:58 +0000

With the recently disclosed hacking incident inside Google and other major companies, much of the world has begun to wake up to what the infosec community has known for some time – there is a persistent campaign of “espionage-by-malware” emanating from the People’s Republic of China (PRC). Corporate and state secrets both have been shanghaied over a period of five or more years, and the activity becomes bolder over time with little public acknowledgement or response from the U.S. government.

Virut, FFSearcher, Twitter

joe — Fri, 26 Jun 2009 19:42:40 +0000

Just finished a couple of back-to-back research pieces. First, a rundown on the C&C protocol encryption in the latest Virut, then a look at a new Firefox browser hijacker that carries out a clever scheme to defraud Google’s Adsense for Search program.

Also, I’m now posting my new research to Twitter as soon as it is available for public consumption. Follow joestewart71 to get these links as soon as they are posted.

On The New Cybersecurity Bill

joe — Fri, 22 May 2009 18:52:47 +0000

On April 1, 2009, while the rest of the cybersecurity world was largely focused on the Conficker worm, Senators John (Jay) Rockefeller and Olympia Snowe introduced the Cybersecurity Act of 2009. Since the hype over Conficker has died down now, I’ve had a chance to review the text of this somewhat controversial bill and add my two cents to the discussion. There are 23 sections to the bill, a few of which have raised some alarm in the infosec community.
Read more…

Wrecked!

joe — Thu, 21 May 2009 18:43:10 +0000

Last Wednesday, just after leaving work, a minivan travelling in the opposite direction turned left in front of me. The short stopping distance required, compounded with being on a curve at the time equalled me skidding sideways, tipping over and landing on the pavement. No broken bones, just some road rash, a sprained foot and ankle, and a nasty-looking bruise on my inner thigh that looks strangely like the Kawasaki logo in reverse.

Although I don’t believe in mandatory helmet laws, I wear mine pretty much all the time - also my motorcycle boots and gloves. Together, these left me a lot better off than I would have been without them.

Speaking at RSA

joe — Fri, 17 Apr 2009 17:27:55 +0000

The 2009 RSA conference kicks off next week in San Francisco. It looks like a busy week for me - I’ll be presenting first on Tuesday, April 21st at the SecureWorks booth on the showfloor at 1:00 PM PDT. This will be a “Conficker Q&A” session. I’ll be answering questions with the knowledge I’ve gained from reverse-engineering Conficker and also from my participation in the Conficker Working Group. So, if you have any burning questions about the threat posed by the Conficker worm, drop by the booth at that time and I’ll try to answer them.

Conficker Eye Chart

joe — Thu, 02 Apr 2009 12:39:22 +0000

I’ve been working on a few different ways to detect Conficker via a web page load. I originally came up with a javascript method but I decided to go with a simpler approach using only images. Thus, the Conficker Eye Chart was born. It’s a simple visual test you can use to evaluate a Windows PC just by surfing to that page and looking at the images. It doesn’t work if you’re behind a web proxy (since the proxy will resolve the remote sites for you, bypassing Conficker’s blocking ability). But if you are behind a proxy, you should already be getting your Windows updates (including the MSRT tool) on time and updates from your anti-virus company as normal, so you shouldn’t be infected, right?

Conficker April Fools Hype

joe — Fri, 27 Mar 2009 12:49:27 +0000

If you’ve been reading any news at all on the Internet in the past week, you’ve probably heard that Conficker Armageddon is approaching, and it’s scheduled for April 1st, only a few days from now. The SecureWorks Counter Threat Unit has been receiving an increasing number of inquiries asking what one needs to do to prepare for the impending April 1st outbreak.

The truth is, there will be no April 1st outbreak, despite what some of the press stories have said so far. The only thing that will happen with Conficker on April 1st is that already-infected systems will begin to use a new algorithm to locate potential update servers. There, that’s not so scary, is it?

Clever Hack, or Carders-at-Work?

joe — Thu, 12 Mar 2009 17:00:59 +0000

Earlier this week, reports began to circulate in the media about Chinese hackers selling $200 USD iTunes gift cards online for 17.90 RMB (about $2.60 USD). It was explained that these hackers were able to acheive the remarkable feat of cracking Apple’s algorithm for generating the gift voucher codes, and were thus able to generate as many cards as they liked, all of which would be redeemable in the iTunes store.

Ozdok: Watching the Watchers

joe — Tue, 20 Jan 2009 20:44:06 +0000

Recently, with the help of Spamhaus, we were given access to files collected from yet another Ozdok/Mega-D command-and-control server. Although we have seen the controller code before, it was surprising to learn that this variant was collecting screenshots from its victims’ computers, and that thousands of them were stored on the control server. Grabbing screenshots isn’t new for backdoor trojans, but it’s the first time we’ve seen this functionality in a spambot.