Tutorial: Rootkit Virus: Part 1

Tutorial Rootkits: Part-1

What are rootkits?

As the name specifies it’s a combination of two words root and kit. Root defines administrative name onUNIX and Linux operating system and in windows its administrative access and kit refers to a bunch of programs.

So Rootkit is a collection of tools that enables Administrative level access to a computer or computer network. Tools may be key logger, spyware, Backdoor, downloader etc. it can be anything which can take benefit of the vulnerability and exploit the user (victim).

A rootkit is a type of malicious software that is activated every time your system boots up and penetrates Windows API’s.

Behavior of Rootkits

A rootkit allows hacker to establish a command and control server on the victim’s machine without the user knowing about it. Once it is installed the hacker can remotely access user’s machine and change system configuration on the user’s machine and do anything on the victim’s machine.

     Basic Analysis of Root kits

 This kind of virus is not easily be removed as it sneaks in the deepest of computer system and inserts the hidden malcode in certain folders that can't be detected by Anti Virus tools. It can even disable applications like malware bytes, tdsskiller etc.

There are several kind of rootkits here we are going to analyze a type which hides its functionality and all the hidden files are stored in the system. To view we need to first change settings in Folder and Search options as follows:

Now you will find any hidden folder here the sample having folder name Installer C:\Windows\Installer

There is one other hidden folder which seems interesting and is a root kit.

Even if you try to delete this file you will not be able to do it even you can see that date modified is also old and even if you want to rename it you can’t do it.

This folder contains some folders and system files as

What this folder contains and what it’s basically doing

·                       It’s disabling all the antivirus and anti malware programs.

·                       Inability to access registry Editor.

·                       Inability to access application.

·                       Creates a”backdoor” to steal your personal information, including banking passwords Etc.

Now go to location C:\Users\Default\AppData\Local you will find the same hidden folder which is a rootkit and having only one sys file which is stopping us to running anything.

This is all about where it actually resides and what its doing as we seen that I already explained that we were not able to delete that file.

So now question is How to remove this virus?

                                        Removal of Rootkit Malware

There are several ways of removing it Here we are using here is Puppy Linux which is a free ware you can download it easily and now first

1.      We will restart our system and we will boot puppy linux and will mount our Windows sytem as follows

               Here you can see the Windows folder which is the same where the hidden Installer folder resides.

2.      Now will go to same folder and same file we have seen their where actually the virus resides

3.      Now we are going to delete this file just right click on that you will find Dir and folder name just move the cursor on it you will get a delete option.

4.      Click on delete and remember one thing while deleting you have to check the force checkbox which will come once you click on delete.

5.      Now go to the users path and delete folder from there as well.

6.      Now your rootkit has been deleted.

For more like what that rootkit doing what registry entries that is changing wait for Part 2

Update[Be Cautious]:Google, Facebook May be Leaking your Data

We are aware about the fact that most websites are tracking our location and saving our data and may be selling them that to third party. But the Question is that two top Brands

Google Facebook are also doing that???

Let focus on research done by top Researcher Tim Libert, a privacy researcher at the University of Pennsylvania, reveals how serious this problem actually is.

According to Libert's research, 9 out of 10 websites leak users' data to a third party, usually without the knowledge and the consent of the user.

In Research it has been shown that Google is the "worst perpetrator" for tracking 80% of the websites globally and don't respect DNT(Do Not Track) signals.

For the study, Libert used webXray, his own open source software creation and has been used to analyze trackers on health and porn websites. He found that most websites were not only leaking user data, but also sharing it on the internet.

About his latest findings, Libert wrote, "Sites that leak user data contact an average of nine external domains, indicating that users may be tracked by multiple entities in tandem."

Libert told Motherboard website that if when one visits any of the top one million websites there is a 90% chance that largely hidden parties will get information about his/her browsing. "Most troubling is that if you use your browser setting to say 'Do Not Track' me, the explicitly stated policy of nearly all the companies is to flat-out ignore you," he further told the website.

Interestingly, Libert called search giant Google as the 'worst perpetrator' for tracking 80% of the websites globally and not respecting the DNT (Do Not Track) signals.

On being contacted by Motherboard on the issue, Google's representative pointed to their 'terms of service', which the report says state "it is against company policy for Google Analytics to send personally identifiable information to third-parties. Google also offers extended privacy controls, data sharing settings and an opt-out browser extension for Chrome."

Libert says, this however is misleading. As he told motherboard, "The company acts as though users have a choice to follow special instructions to opt-out of Analytics, but this is absurdly disingenuous as all Google needs to do is check a simple, and universally available, browser setting," he said. "It is even more comical when you consider most people never get any notification Google is tracking them. Of course this goes for Facebook and pretty much all other Internet companies as well."

Facebook appears more forthcoming in its policy which clearly warns its users -- in its Terms of Services -- that they can and will be tracked on and off the website.

However, microblogging website Twitter seems to have a different approach here. According to Libert, "...the positive takeaway is that Twitter is taking a real lead in the industry by respecting DNT and deserves some serious credit,"

Share to Twitte

iPhone 6S and 6S plus has new WhatsApp Update 2.12.9 with 3D touch technology

WhatsApp has increased their users from millions to billions due to their multi feature facility in their application.

One application with lots of features which stolen their users heart now comes up with new feature for there iPhone Customers with new 3D touch Technology for iPhone 6S and 6 Splus Users 

iPhone 6S and 6S plus users get ready for new 3D touch Technology in your new WhatsApp Update 2.12.9.

As other applications Facebook Messenger, Google Plus, Dropbox etc providing so many features for iPhone Users corresponding to that WhatsApp Comes with a brilliant idea as always with 3D Touch Technology.

How Does this Technology Beneficial?

“3D touch is the ability to experience the virtual world in much the same way the real world is experienced --- intuitively, interactively, and with a full complement of complex tactile sensations

3D Touch brings a new dimension to iOS with “Peek” and “Pop,” making it easier for users to get information at a glance at navigation between applications. And developers will have free reign over how they want to implement the new technology into their apps. For Detail”

Use of peek and pop gestures on WhatsApp is now possible

What the new update brings to iPhone 6S and 6S Plus is the ability to use Peek and Pop gestures that are heavily dependent on the amount of pressure applied on the phone’s screen. According to the Apple Store listing, the app’s change log points out that users will now be able to “quickly Peek and Pop photos, links, videos, locations and contact cards” that they send and receive when chatting with friends.

Just to jog your memory, the new 3D Touch technology that made its debut with this year’s iPhone models allows the smartphones to detect and differentiate between long pressing and quick-tapping the screen and the results will be different options on the user interface.

Use More bug fixes in WhatsApp 2.12.9 for iOS

Other than the newly added support for 3D Touch, the new version of WhatsApp 2.12.9 also comes in with minor improvements in performance as well as fixes to bugs that affected the previous versions, among them issues with a viewing of media on older iOS versions. Also, the new app’s UI can now be quickly mirrored as well as optimized for languages that are written from right to left, for instance, Arabic.

From the app’s change log in the iTunes App Store, the developers also shed some light on the Starred messages feature that was introduced in the previous version. This feature allowed users of WhatsApp to press and hold on a chat to star it, making the process of finding this message later easier.

On a separate note, there are some users of iOS 9.1 beta who are claiming that WhatsApp has received an update that allows them to access a Quick Reply option.

Hackers has now eye On Ubuntu Touch Store

 

First Malware App hits Ubuntu Touch Store

If you the having Ubuntu OS on your phone then “Be aware of the Hackers”.

They are now targetting Ubuntu Touch Store with the App Name “test” .

"The Ubuntu Touch platform is still very young, and it doesn't have millions of apps in the store, but someone has just uploaded a malicious application that managed to get past the automated testing."

This application is uploaded which was uploaded on the store with name “test” and was able to change bootsplash for the phone.

"This application is doing something dangerous which may harm your phone badly so Ubuntu developers are advising to uninstall this application as soon as possible."

At this point of time it is not clear that how many users has downloaded it as it has a  generic name as well. A much more important problem is the fact that it passed through the regular security filters, and that such important modifications were possible.

Canonical responded immediately

Ubuntu developers will have to reassess the security measures they have in place for Ubuntu Touch, and they need to make sure that the problems will be quickly fixed.

It has come to our attention via our community that a potentially malicious application has been submitted to the Ubuntu Store. We have identified that you are one of the users who downloaded the application. We have removed the application from the store as soon as we were made aware and are taking steps to ensure this does not happen again. The application is called 'test' published by developer mmrow, version 0.1 and only affects armhf based mobile devices," reads the email sent by Canonical.

Users have been advised to uninstall it as soon as possible, so hopefully whatever the problem was, it will soon be fixed. We'll probably see something in the change log for the next OTA update in this regard. We also have a video via one of the Ubuntu community members (many thanks to Szymon Waliczek for taking the time to do this).

Update of Ubuntu Touch Store

You can now enjoy the first update by Ubuntu Community Team Manager David Planella.

Not much users are affected a handful of users are only affected as it was informed at the initial stage and is been fixed.

"If any user gets this type of application please don’t install it. If already been installed please uninstall it."

Updation will help you to get rid from this app.

Threat Buckler: Another New Zero Day exploit Hits Adobe Flash Play...

Threat Buckler: Another New Zero Day exploit Hits Adobe Flash Play...: After so much efforts of Adobe Flash Player attackers find a way New Zero-Day exploit Hits Adobe Flash Player.  Flash, attackers fro...

Another New Zero Day exploit Hits Adobe Flash Player Vulnerability

After so much efforts of Adobe Flash Player attackers find a way New Zero-Day exploit Hits Adobe Flash Player.  Flash, attackers from the Pawn Storm cyber-espionage campaign are exploiting yet another new zero-day in flash so they can surreptitiously install malware on victim computer.

It is advised to uninstall or disable the adobe Flash Player immediately before you will be in trap of hunter.

Fortunately, for the time being, this exploit is only being used against Government agencies and several foreign affairs ministries as part of a long-running espionage campaign carried out by a group known as Pawn Storm.

 Although Adobe has released a new patch yesterday which was having 69 Vulnerabilities out of which 13 was patched in their new Monthly Patch Release. Attackers come up with a new zero-day exploit that leave fully patched Flash Player Vulnerable.

“Based on researcher analysis, the Flash zero-day affects at least Adobe Flash Player versions 19.0.0.185 and 19.0.0.207”.

Flash Zero Day Exploit Flow:

                              

Trend Micro reported:

In this most recent campaign, Pawn Storm targeted several foreign affairs ministries from around the globe. The targets received spear phishing e-mails that contained links leading to the exploit. The emails and URLs were crafted to appear like they lead to information about current events, with the email subjects containing the following topics:

“Suicide car bomb targets NATO troop convoy Kabul”

“Syrian troops make gains as Putin defends air strikes”

“Israel launches airstrikes on targets in Gaza”

“Russia warns of response to reported US nuke buildup in Turkey, Europe”

“US military reports 75 US-trained rebels return Syria”

It’s worth noting that the URLs hosting the new Flash zero-day exploit are similar to the URLs seen in attacks that targeted North Atlantic Treaty Organization (NATO) members and the White House in April this year.

Patch Not Available For Latest  Zero Day Exploit 

As of now no patch available for these Latest Exploit even with latest up-to date installation.

Adobe is working on this latest Flaw to patch.

Till the time being please Uninstall or disable Adobe Flash Player for being safe.

As of now  Google Chrome has also begun blocking auto-playing Flash ads by default.

Classes of IP Addresses

Basics of Networking-IP Address

IP Addresses:

It is an address in a network which is used for communication between two computer. In Laymen terms as we need an address to send postcard or Letters from one destination to another similarly in network while sending mails or whenever we need communication computer uses unique identifiers to send information to specific computers on a Network.

TCP/IP is standard for how to communicate on the network.

Two Versions of IP Addresses are there:

IPV4:  IP’s displayed in dotted Decimal Notation. It uses 32 binary bits to create a secure unique address separated on the Network.

Expressed by four numbers separated by dots.

For ex: 192.168.10.1

IPV6: It uses 128 binary bits to create a single unique address on the Network.

Expressed in eight groups of hexadecimal digits (base-0). Numbers are separated by colons.

For ex: 2001:dcab::3257:9652

Classes of IP Addresses:

Five classes are defined on the base of IP Hierarchy.

In these classes of IP Addresses:

0: Reserved and represents all IP addresses.

127: Loop back IP Address. Generally used for testing.

255: Reserved for Broadcasting Purposes

IP Address Class	No. of bits for NID/HID	No. of N/w Id bits	Possible number of N/w per Id	No. of Host IP per N/W Id
Class A	8/24	8-1=7	27 -2=126	224-2 = 166,277,274
Class B	16/16	16-2=14	214 =16,384	216-2= 65,534
Class C	24/8	24-3=21	221 = 2,09,752	28-2=254

                                IP Address based on Class Networks

No. of Networks = 2^networkbits

No. of Hosts/Network = 2^hostbits -2

Note: All classes are identified by their first octet of IP addresses:

Class A Addresses

The first bit of first octet is always set to 0(zero).

As defined above it lies in b/w 1-126

            00000000-011111111

                            1-126

 Default Subnet Mask of Class A Address: 255.0.0.0

 127.x.x.x reserved for loop back IP Address.

Class B Addresses

The first two bits of first octet are always set to 10.

It lies b/w 128-191

              100000000-10111111

                           128-191

     Default Subnet Mask of Class A Address: 255.255.0.0     

Class C Addresses

 The first three bits of first octet always set to 110

  It lies in b/w 192-223

                    11000000-11011111

                                192-223

     Default Subnet Mask of Class C Address: 255.255.255.0

Class D Addresses

 The first two bits of first octet are always set to 1110

 It lies in b/w 224-239

            11100000-11101111

                        224-239

Reserved for Multi-casting. No Need to extract the host address from the IP address as there is data not designed for particular host as we are using it for broadcasting purposes.

Don’t have any Subnet Mask.

Class E Addresses

  Only using it for Experimental purposes.

  It lies in b/w 240-254.