How I Cracked a Keylogger and Ended Up in Someone's Inbox

https://www.trustwave.com/Resources/SpiderLabs-Blog/How-I-Cracked-a-Keylogger-and-Ended-Up-in-Someone-s-Inbox/

by Spydar007 • 10 years ago

468 103 10 years ago

trustwave.com

popey456963• 10 years ago

Is the header sticky for anyone else? It seems to take up ~30% of my screen (Windows 7, Chrome Stable) [0].

[0] http://puu.sh/pNYUH/d42d8395fc.jpg

thesimon• 10 years ago

Same on Chrome & Safari on Mac, but didn't notice it while reading, only when I read your comment :)

miahi• 10 years ago

Exactly the same. I had to open the page again to see that there's a huge header.

alexpetralia• 10 years ago

Same here, just noticed upon rechecking

ipp• 10 years ago

It leaves just a little over half of a laptop screen for actual article content.

stephengillie• 10 years ago

Try disabling JavaScript. Without that, other than some iframe code up top, everything seems to display correctly on mobile Chrome.

wlesieutre2• 10 years ago

This bookmarklet was well received last time I mentioned it, so I'll link it again: https://alisdair.mcdiarmid.org/kill-sticky-headers/

Finds anything with position:fixed and deletes it. Reload the page to get the elements back if needed.

ivanca2• 10 years ago

A more sensible solution would be to convert all fixed elements into "position: absolute" ones. That is less prone to cause errors and avoids impeding navigation.

nchelluri5• 10 years ago

It bothered me as well so I unchecked the width rule on the col-sm-7 CSS class (in the browser inspector) and then saw more text per screen which helped.

krallja• 10 years ago

Yes. Firefox Reader View fixed that problem for me.

kalleboo• 10 years ago

Safari Reader Mode worked a treat over here

rmsaksida• 10 years ago

Yep. Had to right click, inspect element, delete the header element. Article is unreadable otherwise.

jacquesm2• 10 years ago

Scary that a vulnerability that old is still worth exploiting.

wila• 10 years ago

In spam runs a success factor of one in thousand still can pay off. I'm afraid their results are better as that.

im3w1l• 10 years ago

It doesn't have to be the case that it actually paid off. All we know is the spammer thought it would.

piqufoh• 10 years ago

That's a great little story, interesting to read how these sorts of scams are carried out, but I also found the code analysis and decompilation tale fun!

skraelingjar• 10 years ago

I agree, it's amazing how stupid criminals can be, even online. It's scary to think what someone as smart as these security researchers could do if they went black hat...

matt_wulfeck2• 10 years ago

I actually get the feeling that some of these engineers put on their "gray" hats at night.

ufmace2• 10 years ago

I'm thinking that's who's working on stuff like Stuxnet, Flame, etc. I wonder what color hat we would consider Government-sponsored malware to be?

intern4tional• 10 years ago

I don't think criminals are stupid; they're simply lazy. They put the minimum amount of effort is into a scam like this in order to make it profitable.

An off the shelf key logger is used; a couple of stolen email accounts, and a spammer is used for delivery. There are automated tools that will pack the key logger executable in a word document also.

As for the part of the security researcher; reversing .net code isn't challenging. This is by design - the framework does not obfuscate or make it challenging to look at the code. The author of the key logger could have built in protections or obfuscated his executable but for one reason or another has not.

Most likely all of the reversing or analysis was also done with automated tools, and the analyst simply had to run them. OfficeMalScanner can be used to locate packed executables in MS documents and extract them, and then it is simply a matter of dumping the binary in the .NET decompiler of your choice (the author uses ILSpy, I personally prefer RedGate Reflector) and looking at the code.

IMO this is a marketing piece that happens to have an interesting story attached to it.

BrainInAJar• 10 years ago

These sorts of things are common for malware reports :)

libeclipse2• 10 years ago

Aha I love those little messages at the end telling users to update their software to the latest version. It's a cry to the void.

zyx321• 10 years ago

On one hand, the average user will never update his software unless you literally force them to.

On the other hand, your free upgrade to Windows 10 is ready. Would you like to install it right now or later tonight?

libeclipse2• 10 years ago

Damn it, even Linux wants me to get windows 10 now?

matt_wulfeck2• 10 years ago

It also attempts to steal password manager credentials and Windows keys.

Ugh I hate reading this. I keep everything in my password manager. If I lose that I'm hosed. I wish more sites supported 2FA.

LoSboccacc2• 10 years ago

or had no authentication at all, just authorization. imagine having only a openid password to memorize... one can dream right

bobsoap• 10 years ago

Wouldn't that just consolidate the attackable footprint? What if openid, or your openid account, got hacked?

gruez• 10 years ago

I'm surprised the .net executable wasn't obfuscated (as they usually are)

lossolo• 10 years ago

Website that we were running was under DDOS couple of years ago, what we did is we took ips of servers that made ddos. Then we scanned the ports, found vulnerability in the application that was running on it then get into the server using this vulnerability. We checked open connections and found one used for command and control server (irc server) then we listened to irc channel. DDOSers were talking private things on that channel... Then we entered their channel and disabled all their bots using their own software that we got source from link pasted on their channel. Then we confronted them, period of silence after they have read what we wrote was priceless. They never ddosed us again.

themartorana• 10 years ago

This is brilliant. Hack the hackers! Heheh.

kowdermeister• 10 years ago

Nicely done! This would make a great scene in Mr. Robot :)

kuschku• 10 years ago

I’ve had a very similar experience – I’m surprised I’m not the only one who did that.

I’d have expected the DDoSers to have better security

nyolfen• 10 years ago

Pretty much everyone is very bad at security

nv-vn• 10 years ago

Why? DDOSers are mostly dumb skids who rent botnets.

meowface2• 10 years ago

Serial DDoSers tend to have about the same level of computer knowledge as your parents. They just buy/rent botnets or pre-made software and templates to spread botnets.

And that's for the people actually hosting the botnet or "booter" (which seems to be what the parent poster found). Most of the time, it's one more layer down: just some kids paying for the right to enter an IP to DDoS temporarily.

sp0rk• 10 years ago

Botnets have notoriously bad security. Many of the people running them have no technical knowledge and/or are using "cracked" versions of paid botnet software that are backdoored or intentionally left unsecured. A lot of the software is heavily modified or even left incomplete by the person that leaked it, leading to vulnerabilities open to anybody with some technical competence and the time to poke around a little.

cosarara97• 10 years ago

found vulnerability in the application that was running on it

Could you give more a more detailed explanation on how you did that?

13of40• 10 years ago

Go to http://sectools.org and look under "vuln scanners" on the left side menu.

seanp2k2• 10 years ago

These days I'd be worried about CFAA or otherwise getting V& for this. In the "good old days", it was possible to get away with and laugh about this type of vigilante justice. These days though, you're more likely to wind up in prison. No longer worth it for lulz. Sad times now, but good memories.

meowface2• 10 years ago

What they did at the time would still have definitely been illegal. Probably not any more illegal than it is now. I doubt they'd be prosecuted, but breaking into any system is illegal.

jcrawfordor• 10 years ago

Honestly, my bigger concern would be motivating a retaliatory attack. A lot of the people who run botnets have big egos and respond poorly to this kind of challenge, especially when it can mean serious lost money for them. I've caused a retaliatory attack against a system I was responsible for once (thankfully not an important one) and I know at least one other security professional with a similar story - and in his case it was an important network and it stayed down due to retaliatory DDoS for long enough to generate a lot of upset people.

Any kind of active and specific pushback to malicious actors is poking a hornet's nest, and if done on the behalf of an employer, there should be serious discussion and acceptance of the risk of retaliation. Particularly with people running DDoS operations who, in my experience, tend to be a little immature.

andai• 10 years ago

are you Steve? I read a similar story a while back!

armandososa• 10 years ago

I wish HN had a `save` feature so I don't lose gems like these.

eddyg• 10 years ago

Just up-vote the stories and comments you want to save. When you view your profile on HN, you can see a list of your up-votes.

gryphonshafer2• 10 years ago

When I use a desktop browser, I just right-click on the post age data and select "Save link as..." or "Bookmark This Link" or whatever.

GFK_of_xmaspast• 10 years ago

Most modern browsers still have bookmarking ability.

reitanqild2• 10 years ago

Use bookmarks feature. At least Chrome and FF allows you to sync it between different instances.

(Personally I use pinboard.in and would happily recommend it but I don't think everyone need it.)

unknown2374• 10 years ago

I just hope someday the general public realize what a poor job Microsoft has done regarding security on Windows operating systems and embrace other (and more promising) alternatives

nchelluri5• 10 years ago

broadly speaking, how would you design things? All I can think of doing is putting explicit permission grants on everything, requiring everyone to click a million times as was done with the first version of Vista's UAC, IIRC, which is no solution IMO.

digler9992• 10 years ago

ever heard of code signing ? Maybe MSFT could use some of its 23 BILLION dollars of yearly profit to test some of the programs and conditionally approve them if they pass muster, also based on the historical reputation of the signer (like ebay feedback). Then if they contain sleeper code or other exploits, the keys are pulled, updates are pushed to ALL users of the program that revokes the key, thereby preventing mass exploits

Come on, you're talking about the biggest and one of the oldest technological conglomerates on earth. They could fix the ecosystem if they wanted. But since they dont care about users, they'll wait till google does it for them and then sue over IP rights

Sylos• 10 years ago

Well, broadly speaking, more Unix-like.

I fully agree that putting administrator permissions on everything is not a solution, as users will start clicking it away without thought, but there's a good number of things in this article where I could not believe that it does not require administrator permissions.

So, simply a clearer separation would be necessary.

tensor• 10 years ago

Mac and Unix do this right. Yes, there is a lot more permission granting, but it seems to work just fine without people raging at it.

nchelluri5• 10 years ago

a few questions I'm wondering about, if anyone can help:

- how do those PW stealers work? are they similar to the Steam one, where it'd delete existing creds and then sniff newly entered ones?

- can this thing detect certain apps like FileZilla and then say "user entered <FTP site creds>" and send individual fields, and is that what is meant by supporting say FTP and FileZilla?

- what does PHP support mean? maybe looks for common stuff like php.ini, various other conf files like FPM, and tries to find DB/cache connection creds?

there's one other thing I'm wondering about, which is the light/easily crackable encryption of the keylogger's internals, and I vaguely remember reading about Google's encryption on the new recaptcha and people talking about all this stuff like complicated encryption routines baked into the client side JS that I really didn't understand except at a handwavy level, and wonder if that's the kind of thing some, say, intelligence/espionage outfit could use.

very interesting/engaging (fun) article, all in all, for me. and I appreciated the understatement of the (well-deserved) plug at the end.

jacquesm2• 10 years ago

Keyloggers simply record all key presses so if you delete the credentials for a game and someone then tries to run that game the first thing you catch is the credentials to log in again.

The most obvious way is to hook the message stream from the window manager to the applications, windows provides some convenient hooks for this.

nchelluri5• 10 years ago

as for the first point, yup, I understood that from the article; I probably should have used "similar to Steam" rather than "like Steam". I mostly meant, you'd get a long stream of characters and you'd have to manually try to dejumble them.

Whereas, I believe if you go by your second point, you can see "Ok, the user put username <x> in the username textfield, password <y> in the password field, address <a> in the address textfield, port <p> in the port textfield" and so on, which would make for a more structured data dump. Maybe not possible or feasible for every single application, but if you could get the highest usage targets, like the most common FTP clients, or Steam as they have apparently done, and the browser password storage stuff (or fields for say, most common banking sites, PayPal, etc.) then you could save yourself a lot of time.

ufmace2• 10 years ago

can this thing detect certain apps like FileZilla and then say "user entered <FTP site creds>" and send individual fields, and is that what is meant by supporting say FTP and FileZilla?

Could well be. I haven't messed with Win32 in a while, but I'm pretty sure that you can sniff the contents of other applications' windows and dialogs. With a little work, you should be able to take a common app and work out how to detect it's login windows, find the username and password and other relevant fields, and pull out the contents.

I know if I was writing a hostile keylogger, I'd go to a lot of trouble to know exactly what was entered where, instead of having to see a long stream of keyboard input and figure out what the usernames and passwords are, and what services they go with.

sb8244• 10 years ago

Winspy++ offered the ability to look at the content of password fields in native applications IIRC. It's been a few years since I've done anything on Windows.

sidarape• 10 years ago

- can this thing detect certain apps like FileZilla and then say "user entered <FTP site creds>" and send individual fields, and is that what is meant by supporting say FTP and FileZilla?

FileZilla simply use a file in your personnal directory to store passwords exactly like your browser too.

huj123• 10 years ago

Steam used to have password crackers out there, not sure about now

gesman2• 10 years ago

Thanks to domaintools.com - I also found that the guy (seemaexports3@gmail.com) used to own domain: bdmtsteel.com

I also find similarities between above domain and these: transitoin-asia.com seabunker.net

See this: http://imgur.com/tsxqwiQ

If someone wants to do more research - would be fun to dig deeper.

55555• 10 years ago

Good research. Can I ask what you used to make that graphic?

shocks• 10 years ago

I'd also like to know the answer to this question! :)

Koahku• 10 years ago

Using Volafile to host the keylogger executable seems like a pretty bad choice considering that this website will delete your files after only 2 days. Or maybe this shouldn't surprise me so much considering the "skills" of the attacker.

wtracy• 10 years ago

They probably expect to upload a new build every few days, anyway. Note the login credentials hard-coded into the executable.

Presumably, people who take more than 48 hours to open their email were deemed an edge case not worth worrying about.

darekdk• 10 years ago

Fantastic write up! Good work.

Zhycrin2• 10 years ago

10/10 brilliant. If only i was smart enough to do this...

Zhycrin2• 10 years ago

Actually, this is interesting.

ascotan• 10 years ago

Nice writeup.

vmp• 10 years ago

I've done this a few times for fun, simply search YouTube for a "game code generator" or something like that, take your pick, download their magic "tool" from the link in the video description and get disassembling with ILSpy [1]. A ton of these "account stealers" are written in VB.NET and seem to be generated from a template. Remember to stay safe and use a sandbox or virtual machine when dealing with malicious code.

[1] http://ilspy.net/

yowmamasita• 10 years ago

Anyone knows a better decompiler for .net other than ilspy? It's a hit or miss for me with ilspy, would like to try something better even if it's paid.

Sir_Cmpwn• 10 years ago

Try dotPeek: https://www.jetbrains.com/decompiler/

slipstream-• 10 years ago

I like dnspy, which is a fork of ilspy.

heisenburgzero• 10 years ago

where did ).exe came from? I thought you need to use VBscript of some sort to download a file from command line.

How I Cracked a Keylogger and Ended Up in Someone's Inbox

Related Stories