Uncategorized

Methbot: Russian Cyber Fraud Targeting U.S. Advertisers

/ Miguel Antonio Bigueur / Leave a comment
WhatIsMethbot

7 Minutes

The biggest names in U.S. media and brand name advertising are losing millions in advertising dollars on a dally basis due to a Russian underground of cyber criminals. This operation in particular targets video ads by producing massive volumes of fraudulent video ads through the misappropriation of various parts of critical Internet infrastructure then targeting premium-advertising space. As revealed by security experts, a new and very successful click fraud, as perpetrated by Russian cyber miscreants, has resulted in the loss of millions of dollars on a day-to-day basis.

Although the lone group of Russian misfits operate out of Russia, they controls that extends far beyond their borders and oceans by controlling malicious web browsers installed on web servers harbored within legitimate data centers located mainly in the U.S. and Netherlands. This global botnet farm tricks advertising networks into believing that real human beings are viewing hundreds upon millions of video ads daily. Methbot’s Russian cyber syndicate controls these data centers by acquiring troves of legitimately owned Internet service provider IP addresses then creating fake documents claiming the rights to using them at which point they given the authority to access video ads through the use of a custom web browser.

Continue reading →

Malware Analysis & Reverse Engineering (Case Study)

/ Miguel Antonio Bigueur / Leave a comment

 

malware.png

Summary of Findings 

  • Testbook3.xlsm.mlw: 64f129da1ab476723f147ec9ad92ad0d
  • Malware creation Date: 2017-04-24 01:53:22Z
  • Malware Type: Downloader Trojan

VirusTotal resulted in 27/ 57 detections as malicious. This dropper steals username and password information from the SAM database of the victim. This is evidenced by API calls made using SAMSRV.DLL. The stolen data is then sent across an encrypted communications link using  SSLv2 encryption.

The malware begins to enumerate SAM hashes from the SAM database and encrypts them before transmitting the stolen data. The malware makes use of several APIs in this process including: crypt32.dll, bcrypt.dll, ncrypt.dll, cryptdll.dll, secure32.dll.  Continue reading →

Identifying Prosium Bot Files with Yara Rules for Malware Detection

/ Miguel Antonio Bigueur / Leave a comment

5 Minutes

In an effort to help identify and classify malware samples, Yara rules have been specifically written to help identify if a computer or system is infected, and if so, uncover the location of potentially infected files.

The first Yara rule, as seen below, was written to identify any files and their location on disk that could potentially be infected with the Prosium Bot. The following strings have been optimized to help minimize false positives while providing the most effective file identification possible.

Continue reading →

Python Security Scripting

/ Miguel Antonio Bigueur / Leave a comment

O05Pwjy

Introduction: (Problem description)

There are a large number of reasons why it’s a good idea to keep apprised of when, where, why, and how a computer is used on a frequent basis. There could be critical indicators of compromise “IOCs” and/or indicators of attacks “IOAs” that could possibly help network defenders protect against such activities or perform remediation them after the fact. The proper logging of all user and computer activities is crucial to any network defense program and should be carefully implemented in addition to password policy enforcement.

All scripts in this post can be found at:

https://github.com/SmokeDog88/InfoSec_Ops

Continue reading →

Wireless Forensics

/ Miguel Antonio Bigueur / 2 Comments

Internet-de-las-cosas-900x630

Abstract

New directions in research have led to fundamental design changes in Wi-Fi technologies, networks, and services. These innovative advances have led to a prolific growth in wireless network computer crimes. As a result, forensic investigators are faced with future challenges associated with consumer’s hunger for high energy consumption, in addition to, issues regarding limited spectrum bandwidth. Continue reading →

(Volatility) Computer Memory Forensics

/ Miguel Antonio Bigueur / 2 Comments

TVP_VolatilityBlack.png

Memory forensics is the science of analyzing computer memory, both volatile and non-volatile that reveals a vast array of analytical points in regards to the state of which the machine was in during memory image acquisition. Memory forensics is paramount to the analyses of volatile memory of a computer system, which contains numerous artifacts that may prove to be useful during a digital forensics investigation.

Continue reading →

USB Forensics: Basic Examination Process and Artifact Analysis

/ Miguel Antonio Bigueur / Leave a comment
usbForensics_GBHackers

6 Minutes

The proliferation of USB devices not only is an added convenience to users but also a hindrance to network and information security and as a result can be used for nefarious purposes. This is why having the ability to examine USB device history and files are critical to digital forensic investigations. This assignment will walk through the basic forensic examination process of how to examine USB drive artifacts.  

This assignment was performed using Windows 10 running as a virtual machine inside of VMware Fusion 8 hypervisor on macOS Sierra as the host operating system. The first step is to wipe the hard drive clean in order to achieve uncontaminated results during our experiment. After a short search, I decided to use a freeware program called “Disk Wipe v1.7”. For the sake of time, I decided to wipe the USB drive using the one pass zero option, which basically write a pattern of zeroes across the entire drive’s files system ensuring that no remnants of any prior data remains.

Continue reading →