dailyinfosec.org

Blogs - Schneier On Security: A Security Assessment of the Internet Protocol

Wed, 20 Aug 2008 13:30:03 +0000

Interesting: Preface The TCP/IP protocols were conceived during a time that was quite different from the hostile environment they operate in now. Yet a direct result of their effectiveness and widespread early adoption is that much of today's global economy remains dependent upon them. While many textbooks and articles have created the myth that the Internet Protocols (IP) were designed...

Blogs - The Dark Visitor: Google hacking the Olympics

jumper — Wed, 20 Aug 2008 11:08:23 +0000

Johny Long, the well-known Google search hacker linked to a very interesting blog post about the controversy over Chinese gymnast He Kexin. In it, he uses some Google hacks on Baidu (the most popular Chinese search portal) to come up with two cached spreadsheets that show He’s birth year as 1994 which would make her ineligible for the Olympics.

The documents were apparently removed from the government website where they were originally found. Then again - it could have been that the original government documents were wrong and her birth year has been 1992 all along. I can’t say for certain.

If you are interested in Google hacking, take a look at this TDV article.

Research - DVLabs: ThreatLinQ: Spotlight on Filter 1401 (MS-SQL: Login Failure)

Wed, 20 Aug 2008 02:34:47 +0000

Posted by Mike Dausin
One of the cool things about the new ThreatLinQ tool, is we get to see TippingPoint Filters which have been shipping for years, still protecting customers.

Today, I'd like to point out one of those filters in particular.

Filter 1401 - MS-SQL: Login Failure

This filter does not ship enabled by default (generally speaking, login failures are entirely non-malicious), but if configured properly, this filter can be very useful for blocking brute force attacks.

To illustrate how filter 1401 might be used on your network, lets take a look at the graph for this filter taken from ThreatLinQ. As you can see below there are two major events which occured in the last 2 weeks. One on August 8th and another on August 14th. On both occasions we see a small number of attackers attempting to logon several thousand times to a small number of target MSSQL servers on the internet.

By further drilling down into the ThreatLinQ tool, it is obvious that both of these events were caused by a single attacker. And while an occasional MS-SQL login failure may be normal on your network, several thousand originating from a single host is almost certainly not.

Now, I'll be the first to admit that 'Brute force login attacks' are old news. However, it's important to point out that these attacks still occur all the time, and they are still often successful.

Thankfully, with the the 'quarantine' feature of the TippingPoint IPS, it is easy to setup a rule which will let the occasional login failures generated by your users pass by, while blocking attackers who generate hundreds of these failures per second.

To do this, here are some rough instructions on how to setup such a rule for this Filter 1401 on a TippingPoint IPS (please consult your documentation on how to do this via a TippingPoint SMS.) As always, please make sure to test any changes before implementing them in production.

Start by logging onto the IPS as an administrator.
Expand the 'IPS' tab on the left nav bar.
Click 'action sets' -> 'create action set'
You should now see the 'Create Action Set' Screen.
Type in the name for this new action set in the 'Action Set Name'
Now click the 'Block' radio button and Select 'quarantine'
Scroll down until you set the 'Thresholds' section.
Choose some values that you would consider an unreasonable number of failed login attempts. For this example, a value of 60 per minute should be good, but you should tailor these numbers to your environment.
Now select 'Create'
Now, we simply need assign filter 1401 to this new action-set we just created.
Click 'Security Profiles' on the left nav bar.
Select the security profile you wish to change (the default profile is called 'Default Security Profile'.)
Select 'Search Filters' and do a search for filter 1401
Click on Filter 1401 and change the 'Action/State' for the filter to use the action-set you just created
Click on Apply.

And that's it! You are now protected against most MS-SQL brute force attacks on your network. Easy huh?

Blogs - The Dark Visitor: China hacker gang issues diplomas…goes to jail

Heike — Wed, 20 Aug 2008 02:20:13 +0000

Via Dancho Danchev

If you needed a university certificate in China during the last couple of months, there’s a big chance that a group of ten people could have supplied with you such, going a step further and adding your details in more than ten government databases across different provinces in the country, making $300k in the process.

Shanghai Daily is reporting on this sophisticated group of local hackers who were selling “valid” educational certificates by modifying government databases.

Looking for higher education, read it here: China hacker gang busted

Blogs - Schneier On Security: Mental Illness and Murder

Tue, 19 Aug 2008 21:23:20 +0000

Contrary to popular belief, homicide due to mental illness is declining, at least in England and Wales: The rate of total homicide and the rate of homicide due to mental disorder rose steadily until the mid-1970s. From then there was a reversal in the rate of homicides attributed to mental disorder, which declined to historically low levels, while other homicides...

Blogs - Schneier On Security: Adi Shamir's Cube Attacks

Tue, 19 Aug 2008 19:15:35 +0000

At this moment, Adi Shamir is giving an invited talk at the Crypto 2008 conference about a new type of cryptanalytic attack called "cube attacks." He claims very broad applicability to block ciphers, stream ciphers, hash functions, etc. My personal joke -- at least I hope it's a joke -- is that he's going to break every NIST hash submission...

Blogs - Schneier On Security: The Continuing Cheapening of the Word "Terrorism"

Tue, 19 Aug 2008 12:09:17 +0000

Illegally diverting water is terrorism: South Australian Premier Mike Rann says the diversion of water from the Paroo River in Queensland is an act of terrorism during a water crisis. Anonymously threatening people with messages on playing cards, like the Joker in The Dark Knight, is terrorism: Giles County deputies arrest two county teenagers they say made terroristic threats to...

Blogs - The Dark Visitor: Chinese online human hunting! Something to watch…and I don’t have a clue why.

Heike — Tue, 19 Aug 2008 04:57:10 +0000

“Chinese online human hunting” has been a subject that has fascinated me ever since I first read the story of the “Bronze Mustache” in 2006. Somewhere in my gut, it left me with the impression that this was an important trend to watch. Why you ask? Why not I answer! Yep, got nothing.

Does this fascination stem from the demonstrated ability to cyber-mobilize, combined with cyber-vigilante justice? Okay, if that explanation works for you, it works for me. This really bugs me and I haven’t been able to put my finger on why this trend seems to be important to watch. It could very well be the catalyst that launched the category of “Chinese Hacker Hunting” on this blog…but that gets way too much into the realm of self-analysis and could leave me screaming into my pillow. Moving on.

So what is “online human hunting?” I could try and summarize the whole social mechanism but it would probably cross the line of “fair use.” China Supertrends gives an excellent explanation of “human flesh search engines.”

Finally, sciam.com provides a current report on how this trend is progressing:

China: “Human Search” Invades Privacy
Over the past year or more, a concept known as “human search” (also referred to as an “Internet mob”) has grown in popularity in China. Unlike the more constructive pursuit known as “crowdsourcing,” where people worldwide connect to lend their creativity to some academic, artistic or business endeavor, human search involves people connecting via the Internet to track down information for one another, often to search for someone perceived as having done something wrong. A prime example of this came last week, when Chinese Internet users began a nationwide search for the father of Olympic air pistol gold medalist Guo Wenjun, who abandoned her 10 years ago and left her to the care of her coach. According to an August 12 Reuters story, although the search has not yet pinpointed the missing parent, tens of thousands of Web surfers and numerous chat rooms have reportedly joined the effort.

Any…FREE…insightful explanation on why my views makes sense would be greatly appreciated.

Blogs - The Dark Visitor: CNN’s angry Chinese hacker Xiao Chen returns

Heike — Mon, 18 Aug 2008 23:56:59 +0000

In March of this year, CNN ran a story about Xiao Chen and his organization of hackers, reporting that the group had broken into the Pentagon and received payments from the Chinese government.

Xiao Chen, in a subsequent interview with the Shanghai Post, refuted all of CNN’s allegations and tearfully explained how all of this controversy had caused him to close his website hack4.com…he had struggled to create it…he had poured his heart and soul into it…and now was left with only had a handful of magic beans to show for his trouble.

I may be mixing my stories but he did elevate whining to an art form.

No need to worry, Xiao Chen pulled himself up, dusted himself off and managed to get back in the hacking game. Welcome to the new hack4.com , decorated in Olympic themed swirls guaranteed to never go out of style:

Blogs - Schneier On Security: Cyberattack Against Georgia Preceded Real Attack

Mon, 18 Aug 2008 19:11:09 +0000

This is interesting: Exactly who was behind the cyberattack is not known. The Georgian government blamed Russia for the attacks, but the Russian government said it was not involved. In the end, Georgia, with a population of just 4.6 million and a relative latecomer to the Internet, saw little effect beyond inaccessibility to many of its government Web sites, which...

WebApp - CGISecurity.com: Attacking PHP weak PRNGs: mt_srand and not so random numbers

Mon, 18 Aug 2008 17:59:19 +0000

Blogs - Darknet: OpenVAS - Open Vulnerability Assessment System (Nessus is Back!)

Darknet — Mon, 18 Aug 2008 15:57:40 +0000

As you all probably known since version 3 Nessus turned to a proprietary model and started charging for the latest plugins locking most of us out. Now we finally have a new, properly organised forked development with the name of OpenVAS - at last a decent and free Vulnerability Scanner! OpenVAS stands for Open Vulnerability Assessment...

Read the full post at darknet.org.uk

Blogs - Schneier On Security: Air Force Suspends Cyber-Command

Mon, 18 Aug 2008 12:46:07 +0000

Wow: The provisional, 8,000-man Cyber Command has been ordered to stop all activities, just weeks before it was supposed to be declared operational....

Blogs - Darknet: New MySpace and Facebook Worm Target Social Networks

Darknet — Sun, 17 Aug 2008 21:27:54 +0000

Well another reason for you guys (and gals) to avoid social networks, a new worm is spreading. Again they are using the same ploys that have been leveraged for years on e-mail and instant messaging. Trust is gained as the message or link/video/etc comes from a known source so people are more likely to click/open/play it [...] ShareThis

Read the full post at darknet.org.uk

Blogs - The Dark Visitor: Chinese hackers and India cyber forensics

Heike — Sat, 16 Aug 2008 16:05:40 +0000

India considers attacks on its information network by Chinese hackers a threat to national security:

(f) Cyber War and Cyber Terrorism in India

India is also suffering from the menaces of cyber war and cyber terrorism. Nobody cares about any these threats in India. Far more citizens were concerned of the Amarnath issue than by potential risks of nuclear conflict, or near-breakdowns in Net and mobile security.[2] China’s intensified cyber warfare against India is becoming a serious threat to national security. In October 2007, Chinese hackers defaced over 143 Indian websites. In April 2008, Indian intelligence agencies detected Chinese hackers breaking into the computer network of the Ministry of External Affairs forcing the government to think about devising a new strategy to fortify the system. As a countermeasure, the Indian armed forces are trying to enhance their C4ISR capabilities, so that the country can launch its own cyber offensive if the need arises.[3] Similarly, Pakistan is taking steps to intensify its cyber war propaganda against India with the help of its intelligence outfit, the ISI by carrying reports of alleged communal fissures taking place on the Indian side of Kashmir.[4] Issues like these have to be resolved as well.

Blogs - Schneier On Security: Friday Squid Blogging: Talking Squids in Outer Space

Fri, 15 Aug 2008 22:57:09 +0000

An index of fiction. The site was inspired by Margaret Atwood's infamous comment that Oryx and Crake isn't really science fiction, because science fiction is "talking squids in outer space." This prompted a hunt for science fiction which actually did feature talking squids in outer space....

Research - DVLabs: Mindshare: Arithmetic in Assembly

Fri, 15 Aug 2008 22:45:15 +0000

Posted by Cody Pierce
In a previous MindshaRE we looked at loops in assembly. I feel writing chunks of code in c and then disassembling them is an important bridge between higher level languages and assembly when you first start reversing. This allows you to quickly recognize patterns and translate those back into their higher level representation. Doing this is imperative to understanding a binary when reversing. So today we will do a short followup, and look at arithmetic in assembly. Covering the easy ones down to differences in optimization and a few, more complex, examples.

MindshaRE is our weekly look at some simple reverse engineering tips and tricks. The goal is to keep things small and discuss every day aspects of reversing. You can view previous entries here by going through our blog history.

Obviously basic arithmetic is an integral part of any program, and programming language. It should become second nature when looking at assembly to visualize the higher level tokens being used to produce the assembly you are looking at. Lets break them down. While some are obvious, optimizations can make things slightly more complex. The first group of examples will be compiled with the Microsoft Visual C++ Compiler cl.exe using the following command line.

cl /Fearith.exe /Fdarith.pdb /Zi arith.c

In the subsequent examples we will compile with the full optimization flags.

cl /Fearith_optimized.exe /Fdarith_optimized.pdb /Zi /Ox /Ot arith.c

When adding the compiler will use the "add" mnemonic.

int add1(int a)

    return(a + 1);

.text:00401090 add1            proc near

.text:00401090

.text:00401090 a               = dword ptr  8

.text:00401090

.text:00401090                 push    ebp

.text:00401091                 mov     ebp, esp

.text:00401093                 mov     eax, [ebp+a]

.text:00401096                 add     eax, 1

.text:00401099                 pop     ebp

.text:0040109A                 retn

.text:0040109A add1            endp


int add(int a, int b)

    return(a + b);


.text:004010A0 add             proc near

.text:004010A0

.text:004010A0 a               = dword ptr  8

.text:004010A0 b               = dword ptr  0Ch

.text:004010A0

.text:004010A0                 push    ebp

.text:004010A1                 mov     ebp, esp

.text:004010A3                 mov     eax, [ebp+a]

.text:004010A6                 add     eax, [ebp+b]

.text:004010A9                 pop     ebp

.text:004010AA                 retn

.text:004010AA add             endp

Seems simple enough. Keep in mind that this is unoptimized code.

Subtraction, as you could guess, is almost identical.

int sub1(int a)

    return(a - 1);


int sub(int a, int b)

    return(a - b);


.text:004010B0 sub1            proc near

.text:004010B0

.text:004010B0 a               = dword ptr  8

.text:004010B0

.text:004010B0                 push    ebp

.text:004010B1                 mov     ebp, esp

.text:004010B3                 mov     eax, [ebp+a]

.text:004010B6                 sub     eax, 1

.text:004010B9                 pop     ebp

.text:004010BA                 retn

.text:004010BA sub1            endp


.text:004010C0 sub             proc near

.text:004010C0

.text:004010C0 a               = dword ptr  8

.text:004010C0 b               = dword ptr  0Ch

.text:004010C0

.text:004010C0                 push    ebp

.text:004010C1                 mov     ebp, esp

.text:004010C3                 mov     eax, [ebp+a]

.text:004010C6                 sub     eax, [ebp+b]

.text:004010C9                 pop     ebp

.text:004010CA                 retn

.text:004010CA sub             endp

Alright, pretty self explainatory. How about multiplication?

int mult(int a, int b)

    return(a * b);


.text:004010E0 mult            proc near

.text:004010E0

.text:004010E0 a               = dword ptr  8

.text:004010E0 b               = dword ptr  0Ch

.text:004010E0

.text:004010E0                 push    ebp

.text:004010E1                 mov     ebp, esp

.text:004010E3                 mov     eax, [ebp+a]

.text:004010E6                 imul    eax, [ebp+b]

.text:004010EA                 pop     ebp

.text:004010EB                 retn

.text:004010EB mult            endp

"imul" is used as the "Signed Multiplication" instruction. It has a few variations but in general mutiplies the destination by the source ( eax * b ) and stores it in the destination. A shortened version, using only one operand, will multiply the accumulator

Division can be the most complicated.

uint udiv(uint a, uint b)

    return(a / b);


int sdiv(int a, int b)

    return(a / b);


.text:00401120 udiv            proc near

.text:00401120

.text:00401120 a               = dword ptr  8

.text:00401120 b               = dword ptr  0Ch

.text:00401120

.text:00401120                 push    ebp

.text:00401121                 mov     ebp, esp

.text:00401123                 mov     eax, [ebp+a]

.text:00401126                 xor     edx, edx

.text:00401128                 div     [ebp+b]

.text:0040112B                 pop     ebp

.text:0040112C                 retn

.text:0040112C udiv            endp


.text:00401130 sdiv            proc near

.text:00401130

.text:00401130 a               = dword ptr  8

.text:00401130 b               = dword ptr  0Ch

.text:00401130

.text:00401130                 push    ebp

.text:00401131                 mov     ebp, esp

.text:00401133                 mov     eax, [ebp+a]

.text:00401136                 cdq

.text:00401137                 idiv    [ebp+b]

.text:0040113A                 pop     ebp

.text:0040113B                 retn

.text:0040113B sdiv            endp

As you can see we have two versions. The first function udiv is the division of unsigned integers, and the second is the signed form. With unsigned division we can use the simple "div" mnemonic. It will divide eax by its source operand. In this case you see we move argument 1 to eax then issue the "div" instruction with argument 2 as its operand. This is faily straight forward except we have to remember that we may also have a remainder. The remainder for a 32 bit operation will be stored in EDX and the quotient in EAX like we stated. This often has a representation in assembly documentation of EDX:EAX.

Signed division requires an additional step, and a different instruction to handle the signed arithmetic. Before we can divide a signed dword we must convert it to a sign extended quad word using the cdq instruction. Then we can perform the division using the signed divide instruction "idiv". Just like our unsigned counterpart we will divide EAX by the first operand storing it back in EAX and the remainder in EDX. Keep in mind when working with 16-bit, and 8-bit numbers we must use their equivalent registers and they may use a single register for both the quotient and remainder.

The last one we will look at is modulo. I put this in here because it demonstrates using only the remainder in division.

uint umod(uint a, uint b)

    return(a % b);


int smod(int a, int b)

    return(a % b);


.text:00401140 umod            proc near               ; CODE XREF: j_umodj

.text:00401140

.text:00401140 a               = dword ptr  8

.text:00401140 b               = dword ptr  0Ch

.text:00401140

.text:00401140                 push    ebp

.text:00401141                 mov     ebp, esp

.text:00401143                 mov     eax, [ebp+a]    ;  (file arith.c line 59)

.text:00401146                 xor     edx, edx

.text:00401148                 div     [ebp+b]

.text:0040114B                 mov     eax, edx

.text:0040114D                 pop     ebp             ;  (file arith.c line 60)

.text:0040114E                 retn

.text:0040114E umod            endp


.text:00401150 smod            proc near               ; CODE XREF: j_smodj

.text:00401150

.text:00401150 a               = dword ptr  8

.text:00401150 b               = dword ptr  0Ch

.text:00401150

.text:00401150                 push    ebp

.text:00401151                 mov     ebp, esp

.text:00401153                 mov     eax, [ebp+a]    ;  (file arith.c line 64)

.text:00401156                 cdq

.text:00401157                 idiv    [ebp+b]

.text:0040115A                 mov     eax, edx

.text:0040115C                 pop     ebp             ;  (file arith.c line 65)

.text:0040115D                 retn

.text:0040115D smod            endp

Just like our unsigned and signed division except we only keep the remainder by moving EDX into the return register EAX.

Lets take this one step further and talk about optimization. I will cover a very very very tiny aspect of optimization as it relates to our examples above. First thing we must realize is a lot of the complex instruction like "imul", and "idiv" are very slow. In my documents, which only list 486 clock cycles, an "imul" instruction can take between 13 and 42 clock cycles. "idiv" with a 32-bit memory location can take a guaranteed 44 clock cycles. This is huge when you consider "inc" takes 1 in almost every case.

Turning on optimization makes the compiler try as hard as it can to reduce these costly instructions. You will notice our previous example of adding 1 to a argument. The unoptimized output was a sloppy.

.text:00401096                 add     eax, 1

When it should be.

.text:00401094                 inc     eax

Looking these up they both may be the same clock speed, but inc eax takes up fewer bytes, so optimization isnt *always* about speed :). We can also see the same thing for subtraction.

.text:004010B6                 sub     eax, 1

Becomes.

.text:004010B4                 dec     eax

Not bad. But the real savings happens in the more complex computations like multiplication and division. Take a look at multiplying by 2. Unoptimized we see something different from the "imul" instruction.

int mult2(int a)

    return(a * 2);


.text:004010B3                 mov     eax, [ebp+a]

.text:004010B6                 shl     eax, 1

Ahh well that makes since, a binary shift of 1 is just like multiplying by 2. But "shl" take a couple of clock cycles, so lets look at an optimized version.

.text:00416A60                 mov     eax, [esp+a]

.text:00416A64                 add     eax, eax

Well of course. When optimized, what was specified as multiplication by two, is simplified to the obvious addition of itself resulting in a gain of performance. Lets look at some other multiplication time savers.

.text:00416A70 mult10          proc near

.text:00416A70

.text:00416A70 a               = dword ptr  4

.text:00416A70 b               = dword ptr  8

.text:00416A70

.text:00416A70                 mov     eax, [esp+a]

.text:00416A74                 lea     eax, [eax+eax*4]

.text:00416A77                 add     eax, eax

.text:00416A79                 retn

.text:00416A79 mult10          endp

Multiplication by 10 can be sped up by saying (a + (a * 4)) * 2. Notice the use of "lea" for quick pointer aligned multiplication, this is used frequently since "lea" executes relatively fast.

.text:00416A90 mult12          proc near

.text:00416A90

.text:00416A90 a               = dword ptr  4

.text:00416A90 b               = dword ptr  8

.text:00416A90

.text:00416A90                 mov     eax, [esp+a]

.text:00416A94                 lea     eax, [eax+eax*2]

.text:00416A97                 add     eax, eax

.text:00416A99                 add     eax, eax

.text:00416A9B                 retn

.text:00416A9B mult12          endp

Ohh cool we do almost the equivalent of mult10 except half it and add twice. I see some patterns forming here.

.text:00416AB0 mult14          proc near

.text:00416AB0

.text:00416AB0 a               = dword ptr  4

.text:00416AB0 b               = dword ptr  8

.text:00416AB0

.text:00416AB0                 mov     ecx, [esp+a]

.text:00416AB4                 lea     eax, ds:0[ecx*8]

.text:00416ABB                 sub     eax, ecx

.text:00416ABD                 add     eax, eax

.text:00416ABF                 retn

.text:00416ABF mult14          endp

Again "lea" is used, then subtracting the original from the product, and multiplying by 2.

.text:00416AC0 mult15          proc near

.text:00416AC0

.text:00416AC0 a               = dword ptr  4

.text:00416AC0 b               = dword ptr  8

.text:00416AC0

.text:00416AC0                 mov     ecx, [esp+a]

.text:00416AC4                 mov     eax, ecx

.text:00416AC6                 shl     eax, 4

.text:00416AC9                 sub     eax, ecx

.text:00416ACB                 retn

.text:00416ACB mult15          endp


.text:00416AD0 mult16          proc near

.text:00416AD0

.text:00416AD0 a               = dword ptr  4

.text:00416AD0 b               = dword ptr  8

.text:00416AD0

.text:00416AD0                 mov     eax, [esp+a]

.text:00416AD4                 shl     eax, 4

.text:00416AD7                 retn

.text:00416AD7 mult16          endp

Here is the ubiquitous "shl" instruction being used for multiplication. We also see the optimization in the last example of getting the source to 16, then subtracting the original source to get 15.

The pattern we see here is to first use our fastest multiplication instruction "lea" then fix up the rest of the computation with slower instructions like "add" and "sub". This must be fun for the developers of compilers. But what about division?

.text:004010B0 div10           proc near

.text:004010B0

.text:004010B0 a               = dword ptr  4

.text:004010B0 b               = dword ptr  8

.text:004010B0

.text:004010B0                 mov     eax, 0CCCCCCCDh

.text:004010B5                 mul     [esp+a]

.text:004010B9                 shr     edx, 3

.text:004010BC                 mov     eax, edx

.text:004010BE                 retn

.text:004010BE div10           endp


.text:004010C0 div11           proc near

.text:004010C0

.text:004010C0 a               = dword ptr  4

.text:004010C0 b               = dword ptr  8

.text:004010C0

.text:004010C0                 mov     eax, 0BA2E8BA3h

.text:004010C5                 mul     [esp+a]

.text:004010C9                 shr     edx, 3

.text:004010CC                 mov     eax, edx

.text:004010CE                 retn

.text:004010CE div11           endp


.text:004010D0 div12           proc near

.text:004010D0

.text:004010D0 a               = dword ptr  4

.text:004010D0 b               = dword ptr  8

.text:004010D0

.text:004010D0                 mov     eax, 0AAAAAAABh

.text:004010D5                 mul     [esp+a]

.text:004010D9                 shr     edx, 3

.text:004010DC                 mov     eax, edx

.text:004010DE                 retn

.text:004010DE div12           endp


.text:004010E0 div13           proc near

.text:004010E0

.text:004010E0 a               = dword ptr  4

.text:004010E0 b               = dword ptr  8

.text:004010E0

.text:004010E0                 mov     eax, 4EC4EC4Fh

.text:004010E5                 mul     [esp+a]

.text:004010E9                 shr     edx, 2

.text:004010EC                 mov     eax, edx

.text:004010EE                 retn

.text:004010EE div13           endp


.text:004010F0 div14           proc near

.text:004010F0

.text:004010F0 a               = dword ptr  4

.text:004010F0 b               = dword ptr  8

.text:004010F0

.text:004010F0                 mov     ecx, [esp+a]

.text:004010F4                 mov     eax, 24924925h

.text:004010F9                 mul     ecx

.text:004010FB                 mov     eax, ecx

.text:004010FD                 sub     eax, edx

.text:004010FF                 shr     eax, 1

.text:00401101                 add     eax, edx

.text:00401103                 shr     eax, 3

.text:00401106                 retn

.text:00401106 div14           endp


.text:00401110 div15           proc near

.text:00401110

.text:00401110 a               = dword ptr  4

.text:00401110 b               = dword ptr  8

.text:00401110

.text:00401110                 mov     eax, 88888889h

.text:00401115                 mul     [esp+a]

.text:00401119                 shr     edx, 3

.text:0040111C                 mov     eax, edx

.text:0040111E                 retn

.text:0040111E div15           endp


.text:00401120 div16           proc near

.text:00401120

.text:00401120 a               = dword ptr  4

.text:00401120 b               = dword ptr  8

.text:00401120

.text:00401120                 mov     eax, [esp+a]

.text:00401124                 shr     eax, 4

.text:00401127                 retn

.text:00401127 div16           endp

Here is some examples of unsigned division being optimized. Whats confusing at first is we multiply then shift to get our result. The immediate values we see are considered "Magic numbers", or simply numbers you can multiply a constant by to make it mod 2**32. This lets us then shift the binary number the needed amount to arrive out our result. Lets see what happens when you do 30 / 15.

           0x0000001e

x          0x88888889

---------------------

0x00000010:0x0000000e


0x00000010 >> 2 = 0x2

Like we saw with our multiplication optimizations we see the same idea applied to division. See if you can understand the same functions using signed values.

.text:004010B0 div10           proc near

.text:004010B0

.text:004010B0 a               = dword ptr  4

.text:004010B0 b               = dword ptr  8

.text:004010B0

.text:004010B0                 mov     ecx, [esp+a]

.text:004010B4                 mov     eax, 66666667h

.text:004010B9                 imul    ecx

.text:004010BB                 sar     edx, 2

.text:004010BE                 mov     eax, edx

.text:004010C0                 shr     eax, 1Fh

.text:004010C3                 add     eax, edx

.text:004010C5                 retn

.text:004010C5 div10           endp


.text:004010D0 div11           proc near

.text:004010D0

.text:004010D0 a               = dword ptr  4

.text:004010D0 b               = dword ptr  8

.text:004010D0

.text:004010D0                 mov     ecx, [esp+a]

.text:004010D4                 mov     eax, 2E8BA2E9h

.text:004010D9                 imul    ecx

.text:004010DB                 sar     edx, 1

.text:004010DD                 mov     eax, edx

.text:004010DF                 shr     eax, 1Fh

.text:004010E2                 add     eax, edx

.text:004010E4                 retn

.text:004010E4 div11           endp


.text:004010F0 div12           proc near

.text:004010F0

.text:004010F0 a               = dword ptr  4

.text:004010F0 b               = dword ptr  8

.text:004010F0

.text:004010F0                 mov     ecx, [esp+a]

.text:004010F4                 mov     eax, 2AAAAAABh

.text:004010F9                 imul    ecx

.text:004010FB                 sar     edx, 1

.text:004010FD                 mov     eax, edx

.text:004010FF                 shr     eax, 1Fh

.text:00401102                 add     eax, edx

.text:00401104                 retn

.text:00401104 div12           endp


.text:00401110 div13           proc near

.text:00401110

.text:00401110 a               = dword ptr  4

.text:00401110 b               = dword ptr  8

.text:00401110

.text:00401110                 mov     ecx, [esp+a]

.text:00401114                 mov     eax, 4EC4EC4Fh

.text:00401119                 imul    ecx

.text:0040111B                 sar     edx, 2

.text:0040111E                 mov     eax, edx

.text:00401120                 shr     eax, 1Fh

.text:00401123                 add     eax, edx

.text:00401125                 retn

.text:00401125 div13           endp


.text:00401130 div14           proc near

.text:00401130

.text:00401130 a               = dword ptr  4

.text:00401130 b               = dword ptr  8

.text:00401130

.text:00401130                 mov     ecx, [esp+a]

.text:00401134                 mov     eax, 92492493h

.text:00401139                 imul    ecx

.text:0040113B                 add     edx, ecx

.text:0040113D                 sar     edx, 3

.text:00401140                 mov     eax, edx

.text:00401142                 shr     eax, 1Fh

.text:00401145                 add     eax, edx

.text:00401147                 retn

.text:00401147 div14           endp


.text:00401150 div15           proc near

.text:00401150

.text:00401150 a               = dword ptr  4

.text:00401150 b               = dword ptr  8

.text:00401150

.text:00401150                 mov     ecx, [esp+a]

.text:00401154                 mov     eax, 88888889h

.text:00401159                 imul    ecx

.text:0040115B                 add     edx, ecx

.text:0040115D                 sar     edx, 3

.text:00401160                 mov     eax, edx

.text:00401162                 shr     eax, 1Fh

.text:00401165                 add     eax, edx

.text:00401167                 retn

.text:00401167 div15           endp


.text:00401170 div16           proc near

.text:00401170

.text:00401170 a               = dword ptr  4

.text:00401170 b               = dword ptr  8

.text:00401170

.text:00401170                 mov     eax, [esp+a]

.text:00401174                 cdq

.text:00401175                 and     edx, 0Fh

.text:00401178                 add     eax, edx

.text:0040117A                 sar     eax, 4

.text:0040117D                 retn

.text:0040117D div16           endp

Pretty much the same thing just accounting for the signed bit.

Arithmetic in assembly can look daunting, especially when you get into signed division. I hope this has at least inspired you to dig deeper and try to truely grasp this topic. It comes in handy when you see a string of instructions that look complicated. Instead of getting frustrated, you can simply say "oh i know that, its just division by 15".

If you really want to get into this grab a copy of the book "Hackers Delight" by Henry S. Warren Jr. Be forewarned, that book is intense.

Hope you enjoyed another installment of MindshaRE (Even if I was a day late).

-Cody

Research - DVLabs: ThreatLinQ: Movers and Shakers

Fri, 15 Aug 2008 21:40:13 +0000

Posted by Marc Eisenbarth
Here we are looking at a filter that recently made the ThreatLinQ ???Movers and Shakers??? list, namely filter 1401 ???MS-SQL: Login Failure.??? We began watching this filter around 7-20-08 and it seems that it was just in time. On 7-21-08 we saw a sharp increase in filter hits and the majority of these hits are unique destination IP addressees, which is denoted by the blue bar. This pattern is often indicative of brute force attacks and distributed denial of service (DDoS) attacks. Drilling down into this data, we see that the top source IP address 82.165.180.111 is responsible for this spike in hits. Further investigation into this IP address shows that there are a number of source ports in the ephemeral range and each of these ports sees approximately the same number of hits. This even port distribution seems to corroborate our assumption that this is indeed a brute force attack. I did a bit more research on port patterns used by various SQL brute forcing tools and I found a number of matches in the ThreatLinQ dataset that could be attributed to the sqlping3 tool.

I hope this example shows how ThreatLinQ users can take a specific feature of interest in a top level graph, and by drilling down into the data, formulate a verifiable sequence of events in a matter of minutes.

Blogs - Schneier On Security: XKCD on Voting Machine Security

Fri, 15 Aug 2008 18:55:03 +0000

This comment is absolutely correct....

Blogs - Schneier On Security: UK Police Seize War on Terror Board Game

Fri, 15 Aug 2008 12:50:02 +0000

They said -- and it's almost too stupid to believe -- that: the balaclava "could be used to conceal someone's identity or could be used in the course of a criminal act". Don't they realize that balaclavas are for sale everywhere in the UK? Or that scarves, hoods, handkerchiefs, and dark glasses could also be used to conceal someone's identity?...

Blogs - The Dark Visitor: Up is down, right is left, dogs and cats living together…Chinese hackers on holiday

Heike — Fri, 15 Aug 2008 01:10:38 +0000

Yeah, the posts have been coming slow lately but some of you may have heard about a little event going on in China called the Olympics. Chinese hackers watching sporting events, worried about foreign hackers attacking them…my world is completely upside down.

The boys and girls from 3800hk.com, the largest Chinese hacker training site, take over 20 of their “employees” out to enjoy the games. Plus, they love them some Mr. Yao Ming:

More pictures of their adventure here if you are interested…but pretty much the same as these.

Blogs - Schneier On Security: Kids with Cell Phones in Emergencies

Thu, 14 Aug 2008 18:20:24 +0000

In the middle of a sensationalist article about risks to children and how giving them cell phones can help, there's at least one person who gets it. Since the 1999 Columbine High School shootings and the 9/11 terrorist attacks, many parents feel better having a way to contact their children. But hundreds of students on cell phones during an emergency...

Research - DVLabs: ThreatLinQ: Javascript Bad Juju

Thu, 14 Aug 2008 14:44:51 +0000

Posted by Rohit Dhamankar
The game of obfuscating especially JavaScript code has been going on for a while. The attackers are coming up with simple and ingenious ways to evade "string"-based detection. One of our sensors caught this clever technique for evading string-based detection of ActiveX CLSIDs. With hundreds of ActiveX vulnerabilities out there, it is very common to see a massive exploitation of them.

Here is a cool trick we saw in action:

<script>

start();

function z_sa(o,p,v){ o.setAttribute(p,v); }

function start(){

var z = document.createElement('object'); z_sa(z,'id','z');

z_sa(z,'classid',"cjlWsTiWdI:HBWDH9T6jCT5T5H6T-T6I5IAj3j-"

"W1W1IDH0I-W9H8W3HAT-I0T0WCH0W4jFICW2T9TEI3T6T".replace(/[WHjIT]/g, ''));

Let's look at:

"cjlWsTiWdI:HBWDH9T6jCT5T5H6T-T6I5IAj3j-"

"W1W1IDH0I-W9H8W3HAT-I0T0WCH0W4jFICW2T9TEI3T6T".replace(/[WHjIT]/g, '')

The JavaScript replace function replaces any instances of letter "W", "H", "j", "I", "T" with emptiness!

After replacement, the string reduces to: clsid:BD96C556-65A3-11D0-983A-00C04FC29E36

This CLSID is for RDS.Dataspace ActiveX control, and the exploit targets the vulnerability explained in the Microsoft Security Bulletin MS06-014.

Whoever is serving this exploit, can also create a layer that throws in random letters in the "replace" function to serve a new obfuscated CLSID string every time!

Credits: "Bad Juju" is a phrase I most often hear from the cowboy in the DV team - Wayne Blackard

Blogs - Schneier On Security: Data Mining to Detect Pump-and-Dump Scams

Thu, 14 Aug 2008 12:10:34 +0000

I don't know any of the details, but this seems like a good use of data mining: Mr Tancredi said Verisign's fraud detection kit would help "decrease the time between the attack being launched and the brokerage being able to respond". Before now, he said, brokerages relied on counter measures such as restrictive stock trading or analysis packages that only...

Blogs - Darknet: raWPacket HeX - Network Security Monitoring & Analysis LiveCD

Darknet — Wed, 13 Aug 2008 21:01:24 +0000

HeX is a project aimed at the NSM (Network Security Monitoring) community for use by network security analysts. The developers believe that simplicity and analysis work flow logic must be enhanced and emphasized through-out the process of designing this liveCD. Not only have they carefully chosen all the necessary applications and tools to be...

Read the full post at darknet.org.uk

Blogs - Schneier On Security: The Risk of Anthrax

Wed, 13 Aug 2008 20:29:10 +0000

Some reality to counter the hype. The Bottom Line While there has been much consternation and alarm-raising over the potential for widespread proliferation of biological weapons and the possible use of such weapons on a massive scale, there are significant constraints on such designs. The current dearth of substantial biological weapons programs and arsenals by governments worldwide, and the even...

Blogs - Schneier On Security: UK National Risk Register

Wed, 13 Aug 2008 17:05:09 +0000

The UK has made public its previously classified National Risk Register. The National Risk Register is intended to capture the range of emergencies that might have a major impact on all, or significant parts of, the UK. It provides a national picture of the risks we face, and is designed to complement Community Risk Registers, already produced and published locally...

Research - DVLabs: ThreatLinQ: Bad to the Bone

Wed, 13 Aug 2008 12:33:15 +0000

Posted by Mike Dausin
If you've gone to any security conference over the last year, you surely have heard that threats on the internet are moving from general purpose, noisy attacks, to highly targeted attacks designed to only attack YOU...personally. Now that the ThreatLinq program is up and running, it is satisfying to notice that many attackers are not only performing their attacks on multiple hosts, they commonly use many different attack vectors and payloads. Take this IP address for instance: 89.156.116.27. On 7-26-2008 this machine suddenly generated several thousand spread across no less than 6 separate filters...definitely not subtle.

Below are the TippingPoint filters, and the number of hits recorded for this particular IP address on 7-26-2008:

FILTER NAME:                                          # OF HITS:

SMB: Windows Logon Failure                            17,173

SMB: Null Session SetUp                               813

SMB: ASN.1 Bitstring Processing Heap Overflow         162

MS-RPC: DCOM ISystemActivator Overflow                32

MS-RPC: Windows PlugnPlay Request Anomaly             32

MS-RPC: LSASS Active Directory Interface Overflow     30