Mozilla Firefox 2 officially released
As announced, the Mozilla Foundation released version 2.0 of their popular browser. Besides new features, this version includes some security fixes as well.
Phishing Protection will probably be the most valuable for average users. This feature, which is turned on by default, has a local blocklist that is updated hourly. This looks like a more reasonable approach on saving the bandwidth, but for those living on the edge there is also the possibility of validating web sites through a third party service.
You can download new Mozilla Firefox off their web site, http://www.mozilla.com.
Phishing Protection will probably be the most valuable for average users. This feature, which is turned on by default, has a local blocklist that is updated hourly. This looks like a more reasonable approach on saving the bandwidth, but for those living on the edge there is also the possibility of validating web sites through a third party service.
You can download new Mozilla Firefox off their web site, http://www.mozilla.com.
Keywords:
0 comment(s)
False positive on sfc.dll
Bojan was the primary handler on this one... We received a report that Symantec Antivirus was detecting a virus on sfc.dll, which is a component of Windows File Protection. At first, we were a little worried that a trojan was disabling the protection features, which would be a bad thing. However, it looks like this was a false positive and new signatures released today seems to have fixed the problem. This was occuring on Windows 2000 SP4 machines without the Security Rollup applied.
UPDATE
Just a short update about this problem. As we already wrote, Symantec removed detection for this file from their definitions.
However, the main reason why they added this detection is pretty interesting, so we decided to write a bit more about this, as we received some useful information from Symantec's security response team.
Basically, the sfc.dll file provides Windows 2000 and XP operating systems with a feature called System File Checker (SFC), which is part of Windows File Protection. Windows File Protection prevents programs from replacing critical Windows system files (you can find more information about WFP at http://support.microsoft.com/kb/222193).
As you can see, WFP makes it a bit more difficult for malware to replace Windows system files. The bad guys, however, found a way to circumvent SFC ? all they have to do is to "patch" the sfc.dll file (the patch actually only modifies 2 bytes!) and add an undocumented registry key.
According to Symantec, a lot of Infostealer Trojans modify the sfc.dll file, so they added detection for it. However, it looks like there might be some other, legitimate, reasons for this, so some people might have been caught with this false positive detection (when the system actually wasn't infected).
Symantec posted a knowledge base article about this, so if you were affected visit http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2006102011570548.
UPDATE
Just a short update about this problem. As we already wrote, Symantec removed detection for this file from their definitions.
However, the main reason why they added this detection is pretty interesting, so we decided to write a bit more about this, as we received some useful information from Symantec's security response team.
Basically, the sfc.dll file provides Windows 2000 and XP operating systems with a feature called System File Checker (SFC), which is part of Windows File Protection. Windows File Protection prevents programs from replacing critical Windows system files (you can find more information about WFP at http://support.microsoft.com/kb/222193).
As you can see, WFP makes it a bit more difficult for malware to replace Windows system files. The bad guys, however, found a way to circumvent SFC ? all they have to do is to "patch" the sfc.dll file (the patch actually only modifies 2 bytes!) and add an undocumented registry key.
According to Symantec, a lot of Infostealer Trojans modify the sfc.dll file, so they added detection for it. However, it looks like there might be some other, legitimate, reasons for this, so some people might have been caught with this false positive detection (when the system actually wasn't infected).
Symantec posted a knowledge base article about this, so if you were affected visit http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2006102011570548.
Keywords:
0 comment(s)
Update: Malware Analysis: Tools of the Trade
First I want to thank everyone who sent in tools for this endeavor. I hope that this list of tools continues to grow and everyone can get good use out of it. If you look at the diary entry that launched this endeavor, you will find the information that I'm looking to obtain about the tools. If you have some that need would be good to list here, please pass them along and I'll update the list. Some folks sent in entries and checked the box not to have thier names mentioned, so there are no names by those submissions. If you want me to include your name, I'd love to, but you need to give me permission first when you submit the information. All information has been submitted as provided. If you have any additions, I'd be happy to add them!
Here are the tools that people have sent in thus far:
1. Malcode Analyst Pack
3. Windows 2000 RAM dump parsing tools: Submitted by Harlan Carvey
WEBSITE LINKS:
1. Pedram's site: http://pedram.redhive.com/ Submitted by Vince Maes
Here are the tools that people have sent in thus far:
1. Malcode Analyst Pack
a. Where you can get it (if known)- iDefense http://labs.idefense.com/labs-software.php?show=8
b. Shareware/Freeware- GPL/Freeware
c. What it does-
This install package contains a handful of small utility type applications that have proven useful while analyzing malicious code.
These are quick tools designed to meet specific needs while in a malcode testing lab environment. Functionality is tailored specifically to these ends, implementation may be crude at some points but all have proven utility.
This package includes:
? ShellExt - explorer shell extensions
? socketTool - manual TCP Client for probing functionality.
? MailPot - mail server capture pot
? fakeDNS - spoofs dns responses to controlled ip's
? sniff_hit - HTTP, IRC, and DNS sniffer
? sclog - Shellcode research and analysis application
? IDCDumpFix - aids in quick RE of packed applications
? Shellcode2Exe - embeds multiple shellcode formats in exe husk
? GdiProcs - used to detect hidden processes
? socketTool - manual TCP Client for probing functionality.
? MailPot - mail server capture pot
? fakeDNS - spoofs dns responses to controlled ip's
? sniff_hit - HTTP, IRC, and DNS sniffer
? sclog - Shellcode research and analysis application
? IDCDumpFix - aids in quick RE of packed applications
? Shellcode2Exe - embeds multiple shellcode formats in exe husk
? GdiProcs - used to detect hidden processes
d. Tips for using it or gotchas- N/A
e. Is the source of the tool considered trustworthy?- as trustworthy as iDefense is :)
f. Screen Shots of the tool in action (optional)- there is a wmv of the shellcode logger usage on the site (link at bottom of page)
g. Links to additional resource information about the tool- N/A
2. RegMon, FileMon, Ethereal: Submitted by Ronan Rosee. Is the source of the tool considered trustworthy?- as trustworthy as iDefense is :)
f. Screen Shots of the tool in action (optional)- there is a wmv of the shellcode logger usage on the site (link at bottom of page)
g. Links to additional resource information about the tool- N/A
a. Where you can get it (if known)-
RegMon, FileMon and TCPView at www.sysinternals.com
RegMon, FileMon and TCPView at www.sysinternals.com
Ethereal: Included with red hat many linux distros
MSVPC: microsoft.com (trial)
b. Shareware/Freeware- unknown - trial versions / freeware
c. What it does:
- RegMon: monitors processes accessing the registry.
- FileMon: monitors processes accessing file system.
- TCPview: lets you see in real time what applications are listening on your ports.
- Ethereal: will give you a good view of what is happening on the network at a packet level.
- MSVPC: will allow you to set up a network on your PC. I have a 2.4 ghz, 60GB HD and 750 mb ram which allows me to run 3 VMs simultaneously in a LAN - server2003 to provide dns, ftp, smtp etc,
- Win2k client as Malware host and to run filemon and reg mon on, and redhat 7.2 vm to use ethereal
d. Tips for using it or gotchas-
- In the case of malware with Regmon look for processes polling the "run" keys in the registry . You will need to exclude some processes from both tools (there is quiet alot happening under the bonnet in windows) to improve legability, but if you are still not finding your problem, remember that some malware can inject itself into legit processes, so drop any filters and start again.
- Filemon should show you any process that is systematically looking for information on your hard drive.
- TCPview lets you see in real time what applications are listening on your ports. Some of the newer malware claims to be able to defeat some of the file, registry, tcp view type apps with rootkits etc. When in doubt, check ethereal - if the network is still busy, then you are still infected!
e. Is the source of the tool considered trustworthy? All tools are trustworthy and come from a reliable source.
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
g. Links to additional resource information about the tool-
3. Windows 2000 RAM dump parsing tools: Submitted by Harlan Carvey
a. Where you can get it (if known)- http://sourceforge.net/project/showfiles.php?group_id=164158
b. Shareware/Freeware-
c. What it does-
d. Tips for using it or gotchas- The tools themselves should be platform-independant, and only require Perl. I've had previous versions tested on Linux, and even a Mac G5.
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
4. Wireshark, formerly Ethereale. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
a. Where you can get it (if known)- http://www.wireshark.org/
b. Shareware/Freeware- Free & Open source
c. What it does- Analyzes network traffic & packets. Useful for observing if and where malware is attempting to deliver/recieve payload(s) and via which protocol(s).
d. Tips for using it or gotchas-
e. Is the source of the tool considered trustworthy? Yes, trustworthy, would run it on primary systems if needed. Open source, can compile from source code if desired. Having access to the full source code for scrutiny adds to the level of trust.
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool- Numerous links available on the Wireshark home page, www.wireshark.org
5. OllyDbg: Submitted by Vince Maese. Is the source of the tool considered trustworthy? Yes, trustworthy, would run it on primary systems if needed. Open source, can compile from source code if desired. Having access to the full source code for scrutiny adds to the level of trust.
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool- Numerous links available on the Wireshark home page, www.wireshark.org
a. Where you can get it (if known)- http://www.ollydbg.de/
b. Shareware/Freeware- OllyDbg is a shareware, but you can download and use it for free.
c. What it does- Provides binary code analysis for Windows-based malware. Some of it's best features are:
-Attaches to running programs
-Analyzes complex code constructs such as call to jump to procedure
-Sets conditional, logging, memory and hardware breakpoints
-Traces execution and logs arguments of known functions.
-And lots more...
-Analyzes complex code constructs such as call to jump to procedure
-Sets conditional, logging, memory and hardware breakpoints
-Traces execution and logs arguments of known functions.
-And lots more...
d. Tips for using it or gotchas-
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
6. IDA Pro: Submitted by Vince Maes
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
a. Where you can get it (if known)- http://www.datarescue.com/
b. Shareware/Freeware- Cost of standard edition is $439 This tool is worth the cost.
c. What it does- Disassembler and debugger with an assortment of community developed plug-ins. Supports a multitude of processors. Use a graphic interface. It allows you to step through malicious code. Best to run in a virtual machine with no network access.
d. Tips for using it or gotchas-
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
7. Holodeck: Submitted by Vince Maes
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
a. Where you can get it (if known)- http://www.securityinnovation.com/holodeck/
b. Shareware/Freeware- Cost of single user license $1495.00
c. What it does- Basically a great fuzzing tool. Automated point-and-click fault scenarios, function call logging, operation intercepts, network packet logging, and a debugger just to name a few. There is a book by the developers that contains a light version of the product: How to Break Software Security.
d. Tips for using it or gotchas-
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
e. Is the source of the tool considered trustworthy?
f. Screen Shots of the tool in action (optional)-
g. Links to additional resource information about the tool-
1. Pedram's site: http://pedram.redhive.com/ Submitted by Vince Maes
Keywords:
0 comment(s)
×
![modal content]()
Diary Archives
© 2024 SANS™ Internet Storm Center
Developers: We have an API for you! 
Comments