HB Blog 92: ProRAT - Remote Administration Tool.

ProRat is a Remote Administration Tool made by PRO Group. It was written in C programming language and its capable to work with all windows operating systems. It is made for remoting your own computers from other computers. It is a Microsoft Windows based backdoor trojan horse, more commonly known as a RAT (Remote Administration Tool). As with other trojan horses it uses a client and server. It opens a port on the computer which allows the client to perform numerous operations on the server (the machine being controlled).

Features of ProRAT:-
ProRat allows many malicious actions on the victim's machine. Some of its abilities include:
    Logging keystrokes
    Full control over files
    Drive formatting
    Open/close CD tray
    Hide taskbar, desktop, and start button
    Writing on-screen
    Movement of cursor
    Feed the cat
    Take screenshots
    View system information
    View webcam
    Download & run files
    Password Protect your bound server from being used by anyone else
It also has a server creator which features that allow it to be undetected by antivirus and firewall software, and also allow it to stealthily run in the background.

How to remotely control computers using ProRAT: -

1. Download ProRat. Once it is downloaded right click on the folder and choose to extract it, antivirus will detect it as trojan but it is a false positive detection. Open up the program.
2. Next create the actual Trojan file. Click on Create and choose Create ProRat Server.
3. Next put in your IP address so the server could connect to you. If you don’t know your IP address click on the little arrow to have it filled in for you automatically. Next put in your e-mail so that when and if a victim gets infected it will send you a message.
4. Click on the General Settings button to continue. Choose the server port the program will connect through, the password you will be asked to enter when the victim is infected and you wish to connect with them, and the victim name. You can see ProRat has the ability to disable the windows firewall and hide itself from being displayed in the task manager.
5. Click on the Bind with File button to continue. Here you will have the option to bind the trojan server file with another file. Remember a trojan can only be executed if a human runs it. So by binding it with a legitimate file like a text document or a game, the chances of someone clicking it go up. Check the bind option and select a file to bind it to.
6. Click on the Server Extensions button to continue. Choose what kind of server file togenerate. Mostly exe’s looks suspicious so it would be smart to change it. Click on Server Icon to continue. Here you will choose an icon for your server file to have. The icons help mask what the file actually is.
   
7. Finally click on Create Server to, you guessed it, create the server file.
8. Once the trojan runs on victims computer the attacker would then get a message telling him that victim was infected. He would then connect to computer by typing in my IP address, port and clicking Connect. He will be asked for the password that he made when he created the server. Once he types it in, he will be connected to victims computer and have full controlover it.

How to protect/secure computers from ProRAT:-

1. First thing you need do is reboot the computer in Safe Mode with Networking to avoid Trojan Prorat from loading at start-up.
2. Remove all media such as floppy drive, cd, dvd, and USB devices. Then, restart the computer.
3. Once Windows is running under Safe Mode with Networking, open your antivirus program and download the most recent update. This method ensures that your antivirus program can detect even newer variants of Trojan Prorat.
4. Once updating is finished, run a full system scan. After the scan, delete all infected items. If unable to clean or delete, better place the threat in quarantine.
5. In future, try not to click or open unknown files or links.

HB Blog 87: Android Root Equivalent Vulnerabilities Detected And Fixed.

In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance. Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness. In this frame, vulnerability is also known as the attack surface.

Many root equivalent vulnerabilities are found in Android which could exploit an application. This means vulnerabilities which allow an application (malicious or compromised) to either directly gain root or gain privileges which can then be used to obtain root. Below, I have listed few android vulnerabilities that are detected and fixed with there basic descriptions,

Name:- dhcpd buffer overrun.
Root Category:- Network.
Description:- The specific flaw exists within the parsing of the DHCP options in a DHCP ACK packet. The vulnerability is triggered when the LENGTH of an option, when added to the current read position, exceeds the actual length of the DHCP options buffer. An attacker can leverage this vulnerability to execute code on the device. This remote code execution vulnerability executes code as the dhcp user which limit's its severity.

Name:- TowelRoot.
Root Category:- Network.
Description:- The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

Name:- Defy republic init_runit.
Root Category:- Permissions.
Description:- A certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless uses init to create a /dev/socket/init_runit socket that listens for shell commands, which allows local users to gain privileges by interacting with a LocalSocket object. Stack-based buffer overflow in the sub_E110 function in init in a certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless allows local users to gain privileges or cause a denial of service (memory corruption) by writing a long string to the /dev/socket/init_runit socket that is inconsistent with a certain length value that was previously written to this socket.

Name:- Qualcomm chown init scripts.
Root Category:- Permissions.
Description:- Insecure owner/permission changes in init shell scripts: During the device start-up phase, several init shell scripts are executed with root privileges to configure various aspects of the system. During this process, standard toolchain commands such as chown or chmod are used to, e.g., change the owner of the sensor settings file to the system user. As these commands follow symbolic links (symlinks), an attacker with write access to these resources is able to conduct symlink attacks and thus change for example the owner of an arbitrary file to system. This flaw can be used to, e.g., elevate privileges.

Name:- APK duplicate file.
Root Category:- Signature.
Description:- Android does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature.

Name:- Fake ID.
Root Category:- Signature.
Description:- The software does not properly validate an application's certificate chain. An application can supply a specially crafted application identity certificate to impersonate a privileged application and gain access to vendor-specific device administration extensions. The vulnerability resides in the createChain() and findCert() functions of the Android JarUtils class.
Name:- RageAgainstTheCage adb.
Root Category:- System.
Description:- adb fails to check setuid return code and this can be caused to fail by the shell user already having RLIMIT_NPROC processes.

Name:- keystore buffer.
Root Category:- System.
Description:- Stack-based buffer overflow in the encode_key function in /system/bin/keystore in the KeyStore service in Android 4.3 allows attackers to execute arbitrary code, and consequently obtain sensitive key information or bypass intended restrictions on cryptographic operations, via a long key name.

Name:- Qualcomm Gandalf camera driver..
Root Category:- Kernel.
Description:- The camera driver provides several interfaces to user space clients. The user space clients communicate to the kernel via syscalls such as ioctl or mmap. The camera driver provides an uncontrolled mmap interface that allows an application with access to the device file to map physical memory exceeding the camera driver's memory into user space. A locally installed, unprivileged application can use this flaw to escalate privileges.

Name:- Qualcomm out of bounds camera.
Root Category:- Kernel.
Description:- The camera driver provides an ioctl system call interface to user space clients for communication. When processing this communication, the msm_ioctl_server, msm_server_send_ctrl, and msm_ctrl_cmd_done functions use a user-supplied value as an index to the server_queue array for read and write operations without any boundary checks. A local application with access to the camera device nodes can use this flaw to, e.g., elevate privileges.

HB Blog 57: Trojan Horse Invades.

Viruses, worms, Trojans, and bots are all part of a class of software called malware. Malware or malicious code (malcode) is short for malicious software. It is code or software that is specifically designed to damage, disrupt, steal, or in general inflict some other “bad” or illegitimate action on data, hosts, or networks.

Trojan horse malware is one of the most famous and deadly virus. It is named after the ancient story in which Greeks used horse ship build of wood to invade city of troy. Similarly this kind application is seen in this malware. A Trojan horse, or Trojan, in computing is a generally non-self-replicating type of malware program containing malicious code that, when executed, carries out actions determined by the nature of the Trojan, typically causing loss or theft of data, and possible system harm. A Trojan often acts as a backdoor, contacting a controller which can then have unauthorized access to the affected computer. A Trojan may give a hacker remote access to a targeted computer system. Operations that could be performed by a hacker, or be caused unintentionally by program operation, on a targeted computer system.The main difference amid a normal computer virus and a Trojan horse is that it is not specifically developed for spreading themselves. In its place Trojan horse virus is downloaded either as an infected file from internet, or as payload of some other virus. This virus is capable of stealing end-user information and downloading other malware to a computer too. To fight with this treacherous virus, your computer is equipped with firewall and you can also install antivirus software in your system. However, an antivirus is not always effective against Trojan horse, so at that instance the way out of the problem is to remove Trojan horse virus manually.After recognizing a file infected with Trojan horse, it becomes easy to remove it. Usually, your system will give you DLL error, which is associated with Trojan attack.

Few notable Trojan horses malware are as follows:
    Netbus Advance System Care(by Carl-Fredrik Neikter)
    Subseven or Sub7(by Mobman)
    Back Orifice (Sir Dystic)
    Beast
    Zeus
    Flashback Trojan (Trojan BackDoor.Flashback)
    ZeroAccess
    Koobface
    Vundo

HB Blog 52: Batch Scripting Coding Hacks!!!

In DOS, OS/2, and Windows, a batch file is a type of script file, a text file containing a series of commands to be executed by the command line interpreter. Now just open your notepad, copy the below sample codes and save notepad file with .bat extension, just don't forget to click them. Enjoy!!!

1)Matrix Effect :-

1 2 3 4 5

@echo off color 02 :start echo %random% %random% %random% %random% HACKING begins %random% %random% %random% %random% %random% %random% goto start

2)Unstoppable Popups :-

1 2 3 4

@echo off :BEGIN msg * HACKING begins goto BEGIN

3)Shutdown PC :-

1 2 3 4

@echo off cls msg * You Are Hacked shutdown -s -c "ERROR! YOU ARE HACKED"

4)Infinite Folders :-

1 2 3 4

@echo off :top md %random% goto top

5)Pc Hanger :-

1	:s<br />start %0<br />%0|%0<br />goto :s<br />

HB Blog 24: Android Virus/Antivirus - Exploring Android Limits.

    There is always a question in every developer's mind that, what is the limit of Information Technology. These question has resulted into various inventions and discoveries, few helpful as well as some deadly once. The below information shows how android can be used for destructive purpose.
    There are few mobile viruses out there like androRat (android remote access tool), dendroid, etc.But, at the same time we feel safe due to anti virus application by Norton, Quick Heal, Bit-defender, etc.

NOTE:- BELOW INFORMATION AND APPLICATION IS FOR EDUCATION AND SECURITY PURPOSE ONLY.IF YOU MISUSE OR MISTREAT THE INFORMATION, THEN IT CAN BRING UNLAWFUL CHARGES BY THE PERSON ON WHOM YOU USED THIS TRICK. THE AUTHOR WILL NOT BE RESPONSIBLE IN THE EVENT AND IF ANY UNLAWFUL CHARGES ARE BROUGHT TO YOU BY ANY INDIVIDUALS BY MISUSING THE ABOVE INFORMATION. WE WON'T TAKE RESPONSIBILITY FOR ANY OF YOUR ACTION RELATED TO ABOVE INFORMATION. 

Elite is an android virus and Hellboy is an anti-virus that has features as mentioned below.

Elite Android Virus Features:-

1. Send sms continuously from the device to all phone contacts randomly till mobile balance is nil.
2. Block sms messenger, etc apps.
3. Wipe out sd-card data completely.
4. Hide app icon from app launcher as well as recent category.
5. Cannot uninstalling this virus app from application manager.
6. Run in background continuously and gets restarted even after device is turned ON/OFF.
7. Track the user's interaction by retrieving the applications that user has started. 

Hellboy Android Anti-Virus Features:-

1. The only solution to uninstall Elite virus from infected mobile.
2. It forces to uninstall, so that it can be made one time use only.