Chinese Hack 101

Let me introduce three basic terminologies as they are commonly used in various China hacking forums:

肉雞 (Chicken) - It means machine trojaned with malware and backdoor.

網頁掛馬/挂马 (Injected iframe) - it is about injected iframe with malicious code in web page.

免杀 (Prevented to be killed) - It means a software is with anti-debugging technique.

攻击 - Attack

I simply captured a piece of attack service advertisement from a Chinese blog (URL:http://tieba.baidu.com/f?z=650017145&ct=335544320&lm=0&sc=0&rn=30&tn=bai...). You could feel free to translate it via Google translator:

免杀制作,网马挂马 入侵挂马 QQ空间挂马 视频传播木马

-> Anti-debugging, inject malicious iframe, trojans for QQ messenger, spreading trojan via video media.

US Investigators Pinpoint Author Of Google Attack Code

The big news over the past few months were the Aurora attacks and how they seemed to originate from China, last month Microsoft took the unusual step and released an Out-Of-Band patch for the IE6 0-Day vulnerability used in the attacks.

Within the last few days the origin of the code was traced to 2 Chinese schools which both claimed they had no knowledge of the exploit.

It was always thought the exploit originated from China due to parts of the code only being discovered on Chinese language sites, the latest news is that the actual origin of the code has been discovered by US investigators.

US investigators have pinpointed the author of a key piece of code used in the alleged cyber attacks on Google and at least 33 other companies last year, according to a new report.

Citing a researcher working for the US government, The Financial Times reports that a Chinese freelance security consultant in his 30s wrote the code that exploited a hole in Microsoft’s Internet Explorer browser. The report also says that Chinese authorities had “special access” to this consultant’s work and that he posted at least a portion of the code to a hacking forum.

The story follows another report from The New York Times that traced the attacks to a pair of Chinese schools – Shanghai Jiaotong University and Lanxiang Vocational School – claiming that the latter had ties to the Chinese military. A day later, representatives of both schools denied involvement to the Chinese state news agency, and the Lanxiang representative denied ties to the military.

It all sounds like a conspiracy from the TV show 24 with schools tied to the Chinese military and ’special’ access to underground forums.

It’ll be interesting to watch which direction it heads after this and if it’s going to increase the tension between the US and China governments. The whole cyberwar has been going on for quite a while now with both sides trying to covertly steal information from each other.

So far the author of the code has not been named and his real identity or purpose is also a little vague.

If I understand correctly what is being implied above, the author of the code posted a PoC (proof of concept) type exploit to a hacking forum.

Someone took this PoC, turned it into a working exploit and attacked 33 US based companies. If the conspiracists are right this ’someone’ would be the Chinese government and they used to the exploit to steal commercially valuable data from some big US players.

European credit and debit card security broken

Seems like the problem with this system is that the problem is that the PIN is stored on the chip... and that's just as stupid as writing it on the card! The attacks are simple... either a card that always agrees the PIN given is correct, or a terminal that tries to authenticate all 10000 PINS and then learns the right one.

Payment processors have for years been wanting to have an offline secure system, but it just doesn't work. With cheap enough data systems available everywhere, it's not hard for every Wal-Mart most rural gas stations to see a satellite. Get a $20/mo. dial-up account if you have to... there's no reason for anything that does money to be off the grid.

If the PIN is stored online like traditional ATM cards, then there would be a quick way to be sure there's honest checking of the pin and alarms if somebody fails too many times. The American "contact" systems are actually reasons to not require a signature or a PIN... but those are also designed for small-dollar transactions and keeping the fast food line moving. Sure, they're open to cloning risk, but they're willing to take that downside because there's enough upside to using the system.

Real-time hackers beating two-factor security

An incident in which a US construction firm lost $447 000 in a matter of minutes - despite using two-factor authentication when accessing the company bank account - has highlighted the dangers of `piggy-back' malware which can run in parallel, stealing data and using it alongside the legitimate user.

Previous incarnations of piggy-back malware have simply harvested user credentials for later access by hackers, but the fact that financial services are increasingly using two-factor authentication means that hackers are now being attracted to real-time parallel hacking of legitimate data sessions.
According to the

MIT Technology Review newswire

, an account manager at Ferma, a Californian construction firm, accessed his firm's bank account online using a one-time transaction authentication number.
Unknown to the manager, his data session was hacked in real time and - despite the security of the session - the hackers piggy-backed their session on his, and siphoned off $447 000.
The interception of the data session using a trojan infection has potentially severe repercussions for the use of two-factor authentication devices by a growing number of electronic banking service users, as despite the data session being authenticated, it is still hackable in real time.
MIT Technology Review newswire quotes Sam Curry, vice president of product marketing with RSA Security - which produces the SecurID two-factor authentication device used by many third-party companies - as saying that, whilst one-time password technology and other additional security measures can raise the bar against attackers, it will not keep them out forever.
"Companies should be very leery of both prophecies of doom, like the death of a technology, and rosy visions of security", he said.
"Everything is breakable", Curry concluded.