November 9th, 2009

CBS 60 Minutes tackles cyber-terrorism

Posted by Ryan Naraine @ 7:07 am

Categories: Arbitrary Code Execution, Black Hat, Botnets, Browsers, Data theft, Exploit code, Governments, Hackers, Malware, People's Republic of China, Russia, United States of America

Tags: Cyberterrorism, CBS Corp., Hacking, Security, Ryan Naraine

Could hackers get into the computer systems that run crucial elements of the world’s infrastructure, such as the power grids, water works or even a nation’s military arsenal?  Watch the CBS News 60 Minutes segment after the jump. Read the rest of this entry »

September 29th, 2009

Chinese hackers launch targeted attacks against foreign correspondents

Posted by Dancho Danchev @ 9:26 am

Categories: Adobe, Anti Virus, Botnets, Browsers, Complex Attacks, Exploit code, Governments, Hackers, Malware, Passwords, People's Republic of China, Spam and Phishing

Tags: China, Malware, Hacker, Attack, Spyware, Adware & Malware, Cyberthreats, Viruses And Worms, Security, Dancho Danchev

According to an assessment published by the Information Warfare Monitor, Chinese hacktivists (politically motivated hackers) have recently launched a targeted malware attack against foreign news correspondents attempting to trick them into executing a malware-embedded PDF attachment (Interview list.pdf), coming from a non-existent editor working for The Straits Times.

The attacks coincide with the upcoming nation-wide celebration of the 60th anniversary of the PRC, and appear to be directly connected to the GhostNet cyber espionage network exposed earlier this year.

Key findings of the assessment include:

Read the rest of this entry »

July 23rd, 2009

China's Green Dam and the cyberwar implications

Posted by Ryan Naraine @ 8:30 am

Categories: Anti Virus, Arbitrary Code Execution, Botnets, Browsers, Complex Attacks, Denial of Service (DoS), Exploit code, Governments, Malware, Pen testing, People's Republic of China, United States of America, Viruses and Worms, Vulnerability research, Zero-day attacks

Tags: Software, China, Vulnerability, Computer, Chinese Internet, Green Dam, Government, Productivity, Tools & Techniques, Internet

Guest editorial by Oliver Day

Chinese military leaders have always been aware of the military advantage the US has over the People’s Liberation Army.  Reading through their published assessments of Sino-US war possibilities confirm our belief that we would dominate them in the air, land and sea.  However the PLA was born of asymmetric warfare and this remains a core part of their strategies against any possible wars with the US.  Specifically the PLA writes about the use of cyberwarfare as a means of countering this imbalance.
Read the rest of this entry »

June 24th, 2009

Remote code execution exploit for Green Dam in the wild

Posted by Dancho Danchev @ 7:52 am

Categories: Anti Virus, Arbitrary Code Execution, Botnets, Browsers, Exploit code, Governments, Hackers, Malware, Metasploit, Patch Watch, People's Republic of China, Vulnerability research, Zero-day attacks

Tags: Web, Flaw, Buffer, Web Site, Security, Viruses And Worms, Marketing, Internet, Dancho Danchev

The recently exposed as vulnerable to trivial remotely exploitable flaws Chinese censorware Green Dam, has silently patched the security flaws (China confirms security flaws in Green Dam, rushes to release a patch) outlined in the original analysis detailing the vulnerabilities.

However, not only is the latest Green Dam v3.17 version still vulnerable to remotely exploitable flaws, but also, for over a week now a working zero day exploit (Exploit.GreenDam!IK; W32/GreenDam.A) has been circulating in the wild.

Here are more details on the remote code execution flaw in the latest version:

Read the rest of this entry »

June 15th, 2009

China confirms security flaws in Green Dam, rushes to release a patch

Posted by Dancho Danchev @ 2:09 am

Categories: Arbitrary Code Execution, Botnets, Governments, Hackers, Patch Watch, People's Republic of China, Privacy, Vulnerability research

Tags: Software, China, Tools & Techniques, Security, Management, Dancho Danchev

China’s Ministry of Industry and Information Technology has instructed the developers of the Green Dam censorware, to briefly release a patch in regard to last week’s published analysis detailing the possibility of remotely exploitable vulnerabilities within the software.

Jinhui Computer System Engineering Co, developer of Green Dam, insisted that the software is just a vulnerable as any other, and that their expertise is in coding Internet filtering software, and not necessarily one with security in mind — pretty interesting comment taking into consideration the fact that the developer earned millions in the process of coding it.

Read the rest of this entry »

May 13th, 2009

China's 'secure' OS Kylin - a threat to U.S offensive cyber capabilities?

Posted by Dancho Danchev @ 6:23 am

Categories: Browsers, Complex Attacks, Governments, Hackers, Kernel-level Exploits, Linux, Open source, Pen testing, People's Republic of China

Tags: China, Operating System, Operating Systems, Linux, Software, Dancho Danchev

Picture a cyber warfare arms race where the participating countries have spent years of building offensive cyber warfare capabilities by exploiting the monoculture on one another’s IT infrastructure.

Suddenly, one of the countries starts migrating to a hardened operating system of its own, and by integrating it on systems managing the critical infrastructure it successfully undermines the offensive cyber warfare capabilities developed by adversaries designed to be used primarily against Linux, UNIX and Windows.

That’s exactly what China is doing right now with their hardened OS Kylin according to Kevin G. Coleman, Senior Fellow and Strategic Management Consultant with the Technolytics Institute who presented his viewpoint in a hearing at the U.S. – China Economic and Security Review Commission.

Here’s an excerpt from the hearing:

Read the rest of this entry »

February 23rd, 2009

eBay solutions provider Auctiva.com infected with malware

Posted by Dancho Danchev @ 1:04 pm

Categories: Anti Virus, Botnets, Browsers, Exploit code, Hackers, Malware, Passwords, People's Republic of China

Tags: Security, Cybercrime, eBay, Auction, Auctiva, Chinese Hackers, Trojan Horse, Exploits, Dancho Danchev

eBay solutions provider Auctiva.com suffered a malware attack during the weekend, resulting in a “this site may harm your computer” badware warning which affected hundreds of thousands of customers and their eBay auctions.

Following the complaints of users who started receiving antivirus software warnings appearing upon visiting Auctiva.com, the company took measures to ensure the transparency of the clean-up process which they finalized yesterday.

According to Auctiva’s update log:

Read the rest of this entry »

February 23rd, 2009

Chinese hackers deface the Russian Consulate in Shanghai

Posted by Dancho Danchev @ 6:36 am

Categories: Browsers, Governments, Hackers, Passwords, People's Republic of China, Russia

Tags: Security, Web Site Defacement, Chinese Hackers, Russian Consulate, Hacktivism, Political Hacking, Dancho Danchev

That was fast. Chinese hackers collaborating with the Chinese Hacking Union, a two-years old training community for wannabe hackers, hacked and defaced the official web site of  the General Consulate of the Russian Federation in Shanghai, PRC in response to the recent accusations that a Russian navy vessel has sank a Chinese cargo ship.

The message left on the now “under maintenance” site translates as follows:

Read the rest of this entry »

February 20th, 2009

Adobe Reader 9 and Acrobat 9 zero day exploited in the wild

Posted by Dancho Danchev @ 2:43 pm

Categories: Adobe, Anti Virus, Arbitrary Code Execution, Botnets, Browsers, Exploit code, Hackers, Malware, Passwords, People's Republic of China, Zero-day attacks

Tags: Security, Buffer Overflow, Adobe Reader, Adobe Acrobat, Targeted Attack, Rogue Security Software, Dancho Danchev

Yesterday, Adobe confirmed the existence of a critical vulnerability affecting Adobe Reader and Acrobat versions 9.0 and earlier, originally detected by the Shadowserver Foundation last week.

The onging targeted attacks have since been confirmed by both, Symantec and McAfee urging users to disable JavaScript in Adobe Reader and Acrobat until Adobe issues a patch on the 11th of March in the following way - Click: Edit -> Preferences -> JavaScript and uncheck Enable Acrobat JavaScript.

Symantec’s comments on the potential for massive attacks using the exploit:

Read the rest of this entry »

December 17th, 2008

Thousands of legitimate sites SQL injected to serve IE exploit

Posted by Dancho Danchev @ 1:19 pm

Categories: Anti Virus, Arbitrary Code Execution, Botnets, Browsers, Exploit code, Governments, Hackers, Malware, Microsoft, Passwords, Patch Watch, Pen testing, People's Republic of China, Privacy, Spyware and Adware, Windows Vista

Tags: Security, SQL Injection, Passwords, Internet Explorer, XML, Windows XP, Windows Vista, Dancho Danchev

Once again confirming the trend of having more legitimate sites serving exploits and malware than purely malicious ones, Chinese hackers have been keeping themselves busy during the last couple of days, launching massive SQL injection attacks affecting over 100,000 web sites.

The SQL injection attacks serving the just patched Internet Explorer XML parsing exploit, are launched by several different Chinese hacking groups, and with several exceptions, are primarily targeting Asian countries which is a pretty logical move given the fact that it’s a password stealing malware for online games that is served at the bottom line.

Which is the most targeted country?

Read the rest of this entry »