9/24: lecture videos/links

JPHide/Seek
Invisible Secrets
Steghide
Outguess/Stegdetect
Neil Johnson's list of tools


Articles about steganography:

Steganography: Hiding Data Within Data
Wikipedia Article
Steganography Revealed
History and Steganography
Stegoarchive




Netcat

Networks

We learned about networks in the last class and we learned about the following terms:

IP (internet protocol) address
NIC (network interface card)
MAC (Media Access Control) address
Port
DNS (Domain Name System)
Packet
netstat
ipconfig/ifconfig
ping
traceroute

We also learned about different internet protocols:
IP (Internet Protocol)
TCP (Transmission Control Protocol)
HTTP (HyperText Transfer Protocol)
HTTPS (The secure HyperText Transfer Protocol)
ICMP (Internet Control Message Protocol
UDP (User Datagram Protocol)
As well as a few others.

We also talked about a few applications that can be used to watch the network:

Etherape, shown below can allow you to see the traffic on your network. Unfortunately for most of you, it only installs under Linux and Mac OS/X:



Etherape Fullscreen


Wireshark is a packet analyzer that you can use to see the packets of information coming in and out of your computer. It easily installs under Windows and Linux. Here we are using it to get the password and username from a fake myspace account:



Wireshark Fullscreen


Here is a video of ping and traceroute commands:



Ping/Traceroute Fullscreen

Talk on 9/24: Visual Forensic Analysis

There's an interesting talk coming up at John Jay College that might interest some of you:

The Center for Cybercrime Studies
The John Jay College of Criminal Justice
Presents

Visual Forensic Analysis

Speaker: Greg Conti

Computer Science Department
United States Military Academy

For decades hex was the common tongue of reverse engineers and forensic analysts, but we can do better. Hex editors are the Swiss Army knives of low level analysis and have evolved significantly, but are now at a local maximum. With the tiny textual window hex provides, it is difficult, if not impossible to understand the big picture context and inner workings of binary objects - files, file systems, process memory, and network traffic. While there are helpful tools to analyze the special case of executable files, little work exists to help address the general case of all types of binary objects. This talk presents visual approaches to improve the art and science of forensic analysis, diffing, and reverse engineering, both in the context independent case where little is known about the raw structure of the binary data and at the semantic level where external knowledge can be used to inform analysis. If you are faced with low level analysis tasks, you should attend this talk.

Greg Conti is an Assistant Professor of Computer Science at the United States Military Academy. His research includes security data visualization and web-based information disclosure. He is the author of Security Data Visualization (No Starch Press) and the forthcoming Googling Security (Addison-Wesley). His work can be found at www.gregconti.com and www.rumint.org.

Date:        September 24, 2008
Time:        3:30 PM
Location:    Mathematics Conference Room - 4238N
             445 West 59th Street, New York City 10019

RSVP: Nicole Daniels at 212-237-8920 or email ndaniels@jjay.cuny.edu.
For additional information please contact Professor Doug Salane, Director of the Center for Cybercrime Studies, at 212-237-8836 or email dsalane@jjay.cuny.edu.

Secret messages

After we learned about hexadecimal and ASCII in the last class: What does the picture behind this blog say? Hint: every character is represented by two hexadecimal characters. For example: the letter `A' has a value of 41 Hex.

Good luck!

Palin's Yahoo account compromised

It's almost as if we had foreshadowed this event. We spoke on Monday about how insecure Yahoo! accounts could be if you know the person well enough. Sarah Palin has just learned this the hard way.

For someone who has such a high profile she should have at least thought of using some fake information for her user questions and better passwords.

More articles:

wikileaks
Wired

The upcoming aftermath:

Wired update
TheRegister


Let's see if this doesn't get blown out of proportion...

Viruses (or virii) - Part 2

As you may or may not know (until now), you can write executable code in Windows Office Documents using Macros. Viruses can use this as a way to spread and infect computers. The Melissa virus is a good example of this. Melissa used the Document_Open() subroutine of a word document (circulating via email) to execute its code and deleted several system critical files.

Popular subroutines used are:

• Document_Open()
and
• Document_Close()

So we could write code in these subroutines that will execute when either the document is opened or closed.

We will create a word document and open the Visual Basic Editor:



Right click on the word document shown and click ``View Code'':



Choose ``Document'' on the right hand side and ``Open'' on the left:



We'll have a message box come out when the document is opened and we'll delete a file called ``test.txt''. Another message box will come out when the document is closed. The resulting code is shown below:



If macros are enabled on for MS Word, then the code will execute. An execution is shown below:





You should disable most macros to make sure that you are safe and to avoid viruses that use this method of transportation. You can do that by going to Tools->Options->Security->Macros and setting the setting to either High or Very High:





If you have your setting to Medium you will be prompted as to whether or not you want to execute macros:

Viruses (or virii) - Part 1

Today we will discuss viruses (or virii if you are pretentious enough to keep with true Latin grammar).

Viruses are not complete programs. They must reside in a host program in order to function and need human intervention in order to execute. Viruses can reside in any file, but are only affective if they are within a file that can be executed.

There are two types of executable files on Windows systems:

• COM
  files that end in the COM extension which are relics of the old CP/M OS
• EXE
  files ending in EXE extension. Also includes PE (Portable Extendable) format (.SYS, .DLL, .OCX, .CPL, .SCR)

Companion Infection Technique

The virus may masquerade as a known program such as cmd or notepad and may use a different extension than the traditional program or may use a misspelled variation of the traditional program name. Since the virus needs to be executed in order to be affective, a program masquerading as a legitimate one could fool the user into executing it.

As we know we can run programs by going to Start->Run and typing the name of the program we want to run without the extension:



So if there is a program that contains the name written in the Run box above in the Windows path, it will execute. So we could see how easy it would be for a program with a name like notpad.exe (notice that the e is missing) to execute when the user mistakenly mistypes notepad in the Run box.

Another interesting thing about Windows is that .COM files are executed before .EXE files. It may be because the files come first alphabetically, or it may be due to the configuration of Windows. Either way, an attacker can use this to his/her advantage by creating an executable with a .COM extension and placing it in the same folder as the original executable. We will do that now.

In this example a program will be written in Visual Basic which you can get for free here. All it will do is flash a couple of message boxes and then run the real application. Here is the code:



After we compile the code and obtain the executable, we will set the property to ``hidden'' and rename the extension to .com:





The new program is then copied into the C:\Windows\System32 folder. Since it is a hidden file, it will not show up when you do a directory listing:



Now if we try to run notepad by using Start->Run we will get the following execution before notepad launches for real:





Now we see just how close we were to potential catastrophe. Most viruses will run without you knowing that they have executed and will run the program that was requested so that the user will not suspect anything. Viruses often multiply by writing themselves into other files that will be sent to other potential victims or executed later.

Other Virus Methods

A virus can also completely overwrite the host file, thereby replacing the original file with itself. Obviously this could alert the user, since previously working programs will no longer work.

A virus may also prepend (put itself at the beginning of the file) or append itself to a host file.

Viruses can also infect document files (Word Documents, Excel Documents etc) to activate when opening, closing or doing various other tasks. We will look at a document example later.