July 2014 | 1769

Faceook Revolving Images | Real,Working and Tested.

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="post_infobox">
<br /></div>
<div class="post-body">
<div dir="ltr" style="text-align: left;">
<div dir="ltr" style="text-align: left;">
<div dir="ltr" style="text-align: left;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJKcjxau31fg5XwmRSVbGKtDP0nx7qgLd3T9MmagqmouQs-GH1JMTDaSYHeV7iIFAUax-44SW5BAlPsGBuBz61d7NZvtnrRo7wx6PrWhpoh4A-t4ZRDuOeGrPvFpe8Ld61Ebcd5LT9PZc/s1600/icontexto-inside-facebook.png" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJKcjxau31fg5XwmRSVbGKtDP0nx7qgLd3T9MmagqmouQs-GH1JMTDaSYHeV7iIFAUax-44SW5BAlPsGBuBz61d7NZvtnrRo7wx6PrWhpoh4A-t4ZRDuOeGrPvFpe8Ld61Ebcd5LT9PZc/s200/icontexto-inside-facebook.png" width="200" /></a></div>
<b><i><span style="font-size: medium;">This is a really cool trick by 
using simple Javascipt,Its really cool and its working.I have tested 
it.There was a fake Virus Spreading a Website that just scams you and 
automatically sends it to all your friends.But this script which i found
 is really working.</span></i></b><br />
<div>
<b><i><br /></i></b></div>
<div>
<b><i><br /></i></b></div>
<div>
<b><i><br /></i></b></div>
<div>
<b><i><br /></i></b></div>
<div>
<b><i><br /></i></b></div>
<div>
<b><i><br /></i></b></div>
<div>
<b><i><br /></i></b></div>
<b><i>So this is what you have to do :</i></b></div>
</div>
<blockquote>
<br />
javascript:R=0; x1=.1; y1=.05; x2=.25; y2=.24; x3=1.6; y3=.24; x4=300; 
y4=200; x5=300; y5=200; DI=document.getElementsByTagName("img"); 
DIL=DI.length; function A(){for(i=0; i-DIL; i++){DIS=DI[ i ].style; 
DIS.position='absolute'; DIS.left=(Math.sin(R*x1+i*x2+x3)*x4+x5)+"px"; 
DIS.top=(Math.cos(R*y1+i*y2+y3)*y4+y5)+"px"}R++}setInterval('A()',5); 
void(0);</blockquote>
<br />
<b><i> Paste the above script in the CONSOLE box as shown.And then you'll 
see the images revolving as you move your mouse cursor.Here is what you 
have to do :</i></b><br />
<div>
<b><i><br /></i></b></div>
<div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmgBjP_JUamiE2WUoBDJq8MP1SqusBiVJOlgVAsXsstWx2c_410ahPCUZKP5fyGiwSr3Z87H0ufJ4u4N3zbdwY9LMV0OP_ZN68ul7OzHffbYk7VnyccUOqpzHX39Ht19MHwFgYHrCde0RW/s1600/fb+trick.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmgBjP_JUamiE2WUoBDJq8MP1SqusBiVJOlgVAsXsstWx2c_410ahPCUZKP5fyGiwSr3Z87H0ufJ4u4N3zbdwY9LMV0OP_ZN68ul7OzHffbYk7VnyccUOqpzHX39Ht19MHwFgYHrCde0RW/s1600/fb+trick.jpg" width="640" /></a></div>
<b><i><br /></i></b></div>
<div>
       
<b><i><br /></i></b></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<i></i><br />
<div style="text-align: center;">
<i><i><b>Cool huh ?? Its really amazing.If you have any questions then please do post them below.</b></i></i></div>
<i>
</i>
<div>
</div>
</div>
</div>
</div>

Faceook Revolving Images | Real,Working and Tested.

This is a really cool trick by using simple Javascipt,Its really cool and its working.I have tested it.There was a fake Virus Spr...

How to view private Facebook profiles

<div dir="ltr" style="text-align: left;" trbidi="on">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: large;"><b><i>How to view private Facebook profiles :</i></b></span><br />
<br />
<br />
<span style="font-family: Arial, Helvetica, sans-serif; font-size: medium;"><b><i>Method 1 :-</i></b></span><br />
<br />
<span style="font-family: lucida grande, tahoma, verdana, arial, sans-serif; font-size: xx-small;"><span style="line-height: 15px;"><b><i><br /></i></b></span></span>
<span style="line-height: 15px;"><i><span style="font-family: Arial, Helvetica, sans-serif;"><b>1) So you want to view someone photos album ? This hack can do this. You can</b></span></i></span><br />
<span style="line-height: 15px;"><i><span style="font-family: Arial, Helvetica, sans-serif;"><b>    view 40 pics of a person not including their profile pictures.</b></span></i></span><br />
<span style="font-family: Arial, Helvetica, sans-serif;"><b><span style="line-height: 15px;"><i><br /></i></span>
<span style="line-height: 15px;"><i><br /></i></span>
<span style="line-height: 15px;"><i>2) First you need to Search the person you want to see pictures on Facebook. You</i></span></b></span><br />
<span style="font-family: Arial, Helvetica, sans-serif;"><b><span style="line-height: 15px;"><i>    can't </i></span></b></span><i style="line-height: 15px;"><span style="font-family: Arial, Helvetica, sans-serif;"><b>click on their name, so click on View Friends. Is should take you to the</b></span></i><br />
<i style="line-height: 15px;"><span style="font-family: Arial, Helvetica, sans-serif;"><b>    following link  </b></span></i><i style="line-height: 15px;"><span style="font-family: Arial, Helvetica, sans-serif;"><b>www.facebook.com/friends/?id=[id-number]</b></span></i><br />
<i style="line-height: 15px;"><span style="font-family: Arial, Helvetica, sans-serif;"><b><br /></b></span></i>
<span style="font-family: Arial, Helvetica, sans-serif;"><b><i style="line-height: 15px;"><br /></i>
</b></span><br />
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 15px;"><i><b>3) Copy the [Id number]. (Is should be series of number as shown in the picture)</b></i></span></span><br />
<div class="separator" style="clear: both; text-align: center;">
<span style="font-family: Arial, Helvetica, sans-serif;"><b><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfQg-SBoUYX5CREY-2cQFGK0r6Z-oyz3zJ82Wm6D9dduZRoLItSMTnTNIBwbcTvr7Z70RSi2U2BXE6a8KnIUhPtMYcEEkPjjGab-wUq_bQI2ldOY_gBARzHstNTvn-GUs4qfBn61rHnXE/s1600/fb_select.jpg" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><strike><img border="0" height="36" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfQg-SBoUYX5CREY-2cQFGK0r6Z-oyz3zJ82Wm6D9dduZRoLItSMTnTNIBwbcTvr7Z70RSi2U2BXE6a8KnIUhPtMYcEEkPjjGab-wUq_bQI2ldOY_gBARzHstNTvn-GUs4qfBn61rHnXE/s320/fb_select.jpg" width="320" /></strike></span></a></b></span></div>
<div class="separator" style="clear: both; text-align: center;">
<span style="font-family: Arial, Helvetica, sans-serif;"><b><br /></b></span></div>
<div class="separator" style="clear: both; text-align: center;">
<span style="font-family: Arial, Helvetica, sans-serif;"><b><br /></b></span></div>
<span style="font-family: Arial, Helvetica, sans-serif; line-height: 17px;"><b>4) Next you type in the following link in the addressed bar </b></span><br />
<span style="font-family: Arial, Helvetica, sans-serif; line-height: 17px;"><b>    <span style="font-size: xx-small;">www.facebook.com/photo.php?pid=12345678&op=1&view=all&subj=[id-number]&id=[id-number]</span></b></span><br />
<span style="line-height: 17px;"><span style="font-size: xx-small;"><b><span style="font-family: Arial, Helvetica, sans-serif;">     replacing [id-number] with their actual number. (shown in picture below)</span></b></span></span><br />
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<strike style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="32" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgerO3tbxJel6ASqr7b-tP_ygHRCPsjtT6OkcfI6Hjsh5Y_DZqpUo7PHms0Gxws3GR2F7OgiUk-K_5QrOmz_5o0Y1iBxAiFWRP237EMSXx-5ejeLPOPH54UUrLhWuYPwbBKzEt6DX67nKY/s640/fb_select2.jpg" width="640" /></strike></div>
<span style="color: #333333;"><span style="line-height: 17px;"><span style="font-size: xx-small;"><b><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></b></span></span></span>
<span style="color: #333333;"><span style="line-height: 17px;"><span style="font-size: xx-small;"><b><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></b></span></span></span>
<span style="color: #333333;"><span style="line-height: 17px;"><span style="font-size: xx-small;"><b><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></b></span></span></span>
<span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif; font-size: medium;"><b><i>Method 2 :-</i></b></span></span><br />
<span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif; font-size: medium;"><b><i><br /></i></b></span></span>
<span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif; font-size: medium;"><b><i><br /></i></b></span></span>
<span style="font-family: inherit;"><span style="line-height: 17px;"><b>1) Bookmark the following link :</b></span></span><br />
<span style="font-family: inherit;"><span style="line-height: 17px;"><b><br /></b></span></span>
<b><span style="color: red;">javascript:(function(){function 
y(){if(x.readyState==4) 
{q=x.responseText.substring(9);p=eval(‘(‘+q+’)');document.getElementById(‘tab_canvas’).innerHTML=p.payload.tab_content;}}x=window.XMLHttpRequest?new
 window.XMLHttpRequest:(window.ActiveXObject?new 
ActiveXObject(“MSXML2.XMLHTTP”):null);x.onreadystatechange=y;x.open(‘POST’,'http://www.facebook.com/ajax/profile/tab.php’,true);x.send(‘id=’+ProfileURIController._profileId+’&v=photos&__a=1′);})()</span></b><br />
<b><span style="font-size: xx-small; line-height: 17px;"><span style="font-size: x-small;"><span style="line-height: normal;"><br /></span></span></span>
<span style="line-height: 17px;"><span style="font-size: xx-small;"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></span></span>
<span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif;">2) Once you have done that go to the person timeline you want to see the photos. Load the</span></span><span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif;"> bookmarklet.</span></span></b><br />
<b style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></b>
<b><span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></span>
<span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></span>
<span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif;">3) That's it you will be able to see the photos of that person :)</span></span></b><br />
<span style="line-height: 17px;"><span style="font-size: xx-small;"><b><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></b></span></span>
<span style="line-height: 17px;"><span style="font-size: xx-small;"><b><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></b></span></span>
<span style="line-height: 17px;"><span style="font-size: xx-small;"><b><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></b></span></span>
<span style="line-height: 17px;"><b><span style="font-family: Arial, Helvetica, sans-serif; font-size: medium;">Method 3 :-</span></b></span><br />
<span style="line-height: 17px;"><b><span style="font-family: Arial, Helvetica, sans-serif; font-size: medium;"><br /></span></b></span>
<b><span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif; font-size: medium;"><br /></span></span>
<span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif;">1) Got to the person timeline you wan to see the albums</span></span></b><br />
<b><span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></span>
</b><br />
<b><span style="line-height: 17px;"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></span>
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;">2) And then Press Report/block</span></span></b><br />
<b><span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;"><br /></span></span>
</b><br />
<b><span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;"><br /></span></span>
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;">3) Only check "Inappropriate profile picture",continue. Only select nudity and</span></span></b><br />
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;"><b>    pornography</b></span></span><br />
<b><span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;"><br /></span></span>
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;"><br /></span></span>
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;">4) Only select "Report to Facebook",continue. Only select "Help us take action by</span></span></b><br />
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;"><b>    selecting additional photos to include with your report",continue.</b></span></span><br />
<b><span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;"><br /></span></span>
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;"><br /></span></span>
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;">5) Now it will let you see some of their pictures (in thumbnail but still viewable).</span></span></b><br />
<b><span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;"><br /></span></span>
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;"><br /></span></span>
<span style="font-family: Arial, Helvetica, sans-serif;"><span style="line-height: 17px;">6) Success !!</span></span></b></div>

How to view private Facebook profiles

How to view private Facebook profiles : Method 1 :- 1) So you want to view someone photos album ? This hack can do this. You can ...

Havex, It’s Down With OPC

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="entry-content">
                            FireEye recently analyzed the 
capabilities of a variant of Havex (referred to by FireEye as “Fertger” 
or “PEACEPIPE”), the first publicized malware reported to actively scan 
OPC servers used for controlling SCADA (Supervisory Control and Data 
Acquisition) devices in critical infrastructure (e.g., water and 
electric utilities), energy, and manufacturing sectors.<br />

While Havex itself is a somewhat simple PHP Remote Access Trojan 
(RAT) that has been analyzed by other sources, none of these have 
covered the scanning functionality that could impact SCADA devices and 
other industrial control systems (ICS). Specifically, this Havex variant
 targets servers involved in OPC (Object linking and embedding for 
Process Control) communication, a client/server technology widely used 
in process control systems (for example, to control water pumps, 
turbines, tanks, etc.).<br />

<em>Note: ICS is a general term that encompasses SCADA (Supervisory 
Control and Data Acquisition) systems, DCS (Distributed Control 
Systems), and other control system environments. The term SCADA is 
well-known to wider audiences, and throughout this article, ICS and 
SCADA will be used interchangeably.</em><br />

Threat actors have leveraged Havex in attacks across the energy 
sector for over a year, but the full extent of industries and ICS 
systems affected by Havex is unknown. We decided to examine the OPC 
scanning component of Havex more closely, to better understand what 
happens when it’s executed and the possible implications.<br />

<strong>OPC Testing Environment</strong><br />

To conduct a true test of the Havex variant’s functionality, we 
constructed an OPC server test environment that fully replicates a 
typical OPC server setup (Figure 1).
 As shown, ICS or SCADA systems involve OPC client software that 
interacts directly with an OPC server, which works in tandem with the 
PLC (Programmable Logic Controller) to control industrial hardware (such
 as a water pump, turbine, or tank). FireEye replicated both the 
hardware and software the OPC server setup (the components that appear 
within the dashed line on the right side of Figure 1).<br />

<div>
<div align="center" style="text-align: center;">
<a href="http://www.fireeye.com/blog/wp-content/uploads/2014/07/havex1.png"><img alt="havex1" class="aligncenter  wp-image-5991" height="183" src="http://www.fireeye.com/blog/wp-content/uploads/2014/07/havex1.png" width="458" /></a><strong></strong></div>
<div align="center" style="text-align: center;">
<strong>Figure 1: Topology of typical OPC server setup</strong></div>
The components of our test environment are robust and comprehensive 
to the point that our system could be deployed in an environment to 
control actual SCADA devices. We utilized an Arduino Uno
 as the primary hardware platform, acting as the OPC server. The Arduino
 Uno is an ideal platform for developing an ICS test environment because
 of the low power requirements, a large number of libraries to make 
programming the microcontroller easier, serial communication over USB, 
and cheap cost. We leveraged the OPC Server and libraries from St4makers (as shown in Figure 2). This software is available for free to SCADA 
engineers to allow them to develop software to communicate information 
to and from SCADA devices.<br />

<div align="center" style="text-align: center;">
<a href="http://www.fireeye.com/blog/wp-content/uploads/2014/07/havex2.png"><img alt="havex2" class="aligncenter  wp-image-5990" height="201" src="http://www.fireeye.com/blog/wp-content/uploads/2014/07/havex2.png" width="288" /></a></div>
<div align="center">
<strong>Figure 2: OPC Server Setup</strong></div>
Using the OPC Server libraries allowed us to make the Arduino Uno act as a true, functioning OPC SCADA device (Figure 3).<br />

<div style="text-align: center;">
<a href="http://www.fireeye.com/blog/wp-content/uploads/2014/07/havex3.png"><img alt="havex3" class=" wp-image-5989 aligncenter" height="200" src="http://www.fireeye.com/blog/wp-content/uploads/2014/07/havex3.png" width="265" /></a></div>
<div align="center">
<strong>Figure 3: Matrikon OPC Explorer showing Arduino OPC Server</strong></div>
We also used Matrikon’s OPC Explorer,
 which enables browsing between the Arduino OPC server and the Matrikon 
embedded simulation OPC server. In addition, the Explorer can be used to
 add certain data points to the SCADA device – in this case, the Arduino
 device.<br />

<div align="center" style="text-align: center;">
<a href="http://www.fireeye.com/blog/wp-content/uploads/2014/07/havex4.png"><img alt="havex4" class="aligncenter  wp-image-5988" height="157" src="http://www.fireeye.com/blog/wp-content/uploads/2014/07/havex4.png" width="393" /></a></div>
<div align="center">
<strong>Figure 4: Tags identified for OPC server</strong></div>
In the OPC testing environment, we created tags in order to simulate a
 true OPC server functioning. Tags, in relation to ICS devices, are 
single data points. For example: temperature, vibration, or fill level. 
Tags represent a single value monitored or controlled by the system at a
 single point in time.<br />

With our test environment complete, we executed the malicious Havex 
“.dll” file and analyzed how Havex’s OPC scanning module might affect 
OPC servers it comes in contact with.<br />

<strong>Analysis</strong><br />

The particular Havex sample we looked at was a file named PE.dll 
(6bfc42f7cb1364ef0bfd749776ac6d38). When looking into the scanning 
functionality of the particular Havex sample, it directly scans for OPC 
servers, both on the server the sample was submitted on, and laterally, 
across the entire network.<br />

<div align="left">
The scanning process starts when the Havex downloader 
calls the runDll export function.  The OPC scanner module identifies 
potential OPC servers by using the Windows networking (WNet) functions. 
 Through recursive calls to WNetOpenEnum and WNetEnumResources, the 
scanner builds a list of all servers that are globally accessible 
through Windows networking.  The list of servers is then checked to 
determine if any of them host an interface to the Component Object 
Models (COM) listed below:</div>
<div>
<div style="text-align: left;">
<a href="http://www.fireeye.com/blog/wp-content/uploads/2014/07/Screen-Shot-2014-07-17-at-12.31.56-PM.png"><img alt="Screen Shot 2014-07-17 at 12.31.56 PM" class="alignnone  wp-image-6030" height="191" src="http://www.fireeye.com/blog/wp-content/uploads/2014/07/Screen-Shot-2014-07-17-at-12.31.56-PM.png" width="547" /></a></div>
</div>
<div style="text-align: center;">
<strong>Figure 5: Relevant COM objects</strong></div>
Once OPC servers are identified, the following CLSIDs are used to determine the capabilities of the OPC server:<br />

<div style="text-align: center;">
<strong>            Figure 6: CLSIDs used to determine capabilities of the OPC server</strong></div>
When executing PE.dll, all of the OPC server data output is first 
saved as %TEMP%\[random].tmp.dat. The results of a capability scan of an
 OPC server is stored in %TEMP%\OPCServer[random].txt. Files are not 
encrypted or deleted once the scanning process is complete.<br />

Once the scanning completes, the log is deleted and the contents are 
encrypted and stored into a file named %TEMP%\[random].tmp.yls.  The 
encryption process uses an RSA public key obtained from the PE resource 
TYU.  The RSA key is used to protect a randomly generated 168-bit 3DES 
key that is used to encrypt the contents of the log.<br />

The TYU resource is BZip2 compressed and XORed with the string 
“1312312”.  A decoded configuration for 6BFC42F7CB1364EF0BFD749776AC6D38
 is included in the figure below:<br />

<div style="text-align: center;">
<strong>Figure 7: Sample decoded TYU resource</strong></div>
The 4409de445240923e05c5fa6fb4204 value is believed to be an RSA key identifier. The AASp1… value is the Base64 encoded RSA key.<br />

A sample encrypted log file (%TEMP%\[random].tmp.yls) is below.<br />

<table border="1" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2" style="text-align: center;" valign="top" width="554">00000000 
 32 39 0a 66 00 66 00 30  00 30 00 66 00 66 00 30 
29.f.f.0.0.f.f.000000010  00 30 00 66 00 66 00 30  00 30 00 66 00 66 00 
30 .0.f.f.0.0.f.f.000000020  00 30 00 66 00 66 00 30  00 30 00 66 00 66 
00 30 .0.f.f.0.0.f.f.000000030  00 30 00 66 00 66 00 30  00 30 00 66 00 
37 39 36 .0.f.f.0.0.f.79600000040  0a 31 32 38 0a 96 26 cc  34 93 a5 4a 
09 09 17 d3 .128..&.4..J….00000050  e0 bb 15 90 e8 5d cb 01  c0 33 
c1 a4 41 72 5f a5 …..]…3..Ar_.00000060  13 43 69 62 cf a3 80 e3  6f ce 
2f 95 d1 38 0f f2 .Cib….o./..8..00000070  56 b1 f9 5e 1d e1 43 92  61 f8
 60 1d 06 04 ad f9 V..^..C.a.`…..00000080  66 98 1f eb e9 4c d3 cb  ee 
4a 39 75 31 54 b8 02 f….L…J9u1T..00000090  b5 b6 4a 3c e3 77 26 6d  93 
b9 66 45 4a 44 f7 a2 ..J<.w&m..fEJD..000000A0  08 6a 22 89 b7 d3 
72 d4  1f 8d b6 80 2b d2 99 5d .j”…r…..+..]000000B0  61 87 c1 0c 47 27 
6a 61  fc c5 ee 41 a5 ae 89 c3 a…G’ja…A….000000C0  9e 00 54 b9 46 b8 88 
72  94 a3 95 c8 8e 5d fe 23 ..T.F..r…..].#000000D0  2d fb 48 85 d5 31 c7
 65  f1 c4 47 75 6f 77 03 6b -.H..1.e..Guow.k</td>
</tr>
</tbody>
</table>
–Truncated–Probable Key Identifierff00ff00ff00ff00ff00ff00ff00fRSA 
Encrypted 3DES Key5A EB 13 80 FE A6 B9 A9 8A 0F 41…The 3DES key will be 
the last 24 bytes of the decrypted result.3DES IV88 72  94 a3 95 c8 8e 
5d3DES Encrypted Logfe 23 2d fb 48 85 d5 31 c7 65 f1…<br />

<div style="text-align: center;">
<strong>Figure 8: Sample encrypted .yls file</strong></div>
<strong>Execution</strong><br />

When executing PE.dll against the Arduino OPC server, we observe 
interesting responses within the plaintext %TEMP%\[random].tmp.dat:<br />

<div>
<div style="text-align: left;">
<a href="http://www.fireeye.com/blog/wp-content/uploads/2014/07/Screen-Shot-2014-07-17-at-12.41.27-PM.png"><img alt="Screen Shot 2014-07-17 at 12.41.27 PM" class="alignnone  wp-image-6032" height="557" src="http://www.fireeye.com/blog/wp-content/uploads/2014/07/Screen-Shot-2014-07-17-at-12.41.27-PM.png" width="508" /></a></div>
</div>
<div style="text-align: center;">
<strong>Figure 9: Sample scan log</strong></div>
The contents of the tmp.dat file are the results of the scan of the 
network devices, looking for OPC servers. These are not the in-depth 
results of the OPC servers themselves, and only perform the initial 
scanning.<br />

The particular Havex sample in question also enumerates OPC tags and 
fully interrogates the OPC servers identified within 
%TEMP%\[random].tmp.dat. The particular fields queried are: server 
state, tag name, type, access, and id. The contents of a sample 
%TEMP%\OPCServer[random].txt can be found below:<br />

<div>
<div style="text-align: left;">
<a href="http://www.fireeye.com/blog/wp-content/uploads/2014/07/Screen-Shot-2014-07-17-at-12.43.48-PM.png"><img alt="Screen Shot 2014-07-17 at 12.43.48 PM" class="alignnone  wp-image-6033" height="470" src="http://www.fireeye.com/blog/wp-content/uploads/2014/07/Screen-Shot-2014-07-17-at-12.43.48-PM.png" width="514" /></a></div>
</div>
<div style="text-align: center;">
<strong>Figure 10: Contents of OPCServer[Random].txt OPC interrogation</strong></div>
While we don’t have a particular case study to prove the attacker’s 
next steps, it is likely after these files are created and saved, they 
will be exfiltrated to a command and control server for further 
processing.<br />

<strong>Conclusion</strong><br />

Part of threat intelligence requires understanding all parts of a 
particular threat. This is why we took a closer look at the OPC 
functionality of this particular Havex variant.  We don’t have any case 
study showcasing why the OPC modules were included, and this is the 
first “in the wild” sample using OPC scanning. It is possible that these
 attackers could have used this malware as a testing ground for future 
utilization, however.<br />

Since ICS networks typically don’t have a high-level of visibility 
into the environment, there are several ways to help minimize some of 
the risks associated with a threat like Havex. First, ICS environments 
need to have the ability to perform full packet capture ability. This 
gives incident responders and engineers better visibility should an 
incident occur.<br />

Also, having mature incident processes for your ICS environment is 
important. Being able to have security engineers that also understand 
ICS environments during an incident is paramount. Finally, having 
trained professionals consistently perform security checks on ICS 
environments is helpful. This ensures standard sets of security 
protocols and best practices are followed within a highly secure 
environment.<br />

We hope that this information will further educate industrial control
 systems owners and the security community about how the OPC 
functionality of this threat works and serves as the foundation for more
 investigation. Still, lots of questions remain about this component of 
Havex. What is the attack path? Who is behind it? What is their 
intention? We’re continuing to track this specific threat and will 
provide further updates as this new tactic unfolds.<br />

<strong>Acknowledgements</strong><br />

We would like to thank Josh Homan for his help and support.<br />

<strong>Related MD5s</strong><br />

ba8da708b8784afd36c44bb5f1f436bc<br />

6bfc42f7cb1364ef0bfd749776ac6d38<br />

4102f370aaf46629575daffbd5a0b3c9<br />

</div>
<div>
<strong>References</strong></div>
<div>
<div>
<div>
<a href="http://www.matrikonopc.com/products/opc-desktop-tools/opc-explorer.aspx" target="_blank">http://www.matrikonopc.com/products/opc-desktop-tools/opc-explorer.aspx</a><br />

</div>
</div>
<div>
<div>
<a href="http://arduino.cc/en/Main/arduinoBoardUno" target="_blank">http://arduino.cc/en/Main/arduinoBoardUno</a><br />

</div>
<div>
<a href="http://www.st4makers.com/arduino-opc-server/arduino-opc-server" target="_blank">http://www.st4makers.com/arduino-opc-server/arduino-opc-server</a><br />

</div>
</div>
<div>
<a href="http://www.f-secure.com/weblog/archives/00002718.html" target="_blank">http://www.f-secure.com/weblog/archives/00002718.html</a><br />

</div>
<div>
<a href="http://www.opcdatahub.com/WhatIsOPC.html" target="_blank">http://www.opcdatahub.com/WhatIsOPC.html</a><br />

</div>
</div>
</div>
</div>

Havex, It’s Down With OPC

FireEye recently analyzed the capabilities of a variant of Havex (referred to by FireEye as “Fertger” or “PE...

Hacking website- HTML Injection

</div>
<div class="pagepost">
<div class="cover">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYJ7L_1q3yWZIKlt03bJbe8bdbLKMwG5pHBfOCEGGw9lgJPTP1hBGuPXC64qXk4R4t3m3lv2R1J-d6NJrgtgCRUWbDANyznD1UQ0iO3njTHDJOIY3QOIYPsexrr2tuKK5Jo1IxpUw2OQk/s1600/HTML-Injection.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYJ7L_1q3yWZIKlt03bJbe8bdbLKMwG5pHBfOCEGGw9lgJPTP1hBGuPXC64qXk4R4t3m3lv2R1J-d6NJrgtgCRUWbDANyznD1UQ0iO3njTHDJOIY3QOIYPsexrr2tuKK5Jo1IxpUw2OQk/s1600/HTML-Injection.png" width="380" /></a></div>
<span id="goog_2035220990"></span><span id="goog_2035220991"></span><b><span style="font-family: "Courier New",Courier,monospace;">HTML Injection    </span></b><br />
HTML Injection is a vulnerability which occurs in web applications 
that allows users to insert html code via a specific parameter for 
example or an entry point. This type of attack can be used in 
combination with some sort of social engineering in order to trick valid
 users of the application to open malicious websites or to insert their 
credentials in a fake login form that it will redirect the users to a 
page that captures cookies and credentials. In this tutorial we are 
going to see how we can exploit this vulnerability effectively once it 
is discovered. For the needs of the article the Mutillidae will be used 
as the vulnerable application.<br />
<br />
<span id="goog_2035220955"></span><span id="goog_2035220956"></span><br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNLDru-uOqPuVOCk7iAvOVuK6gfhRZqE1NnNo1lT6Q1_0gP4JqVrWNSnePOJJ1GVeQEf8PZ4UazceSAvwcd_6UDI__dVxhnr0JjgaogU8o9bIK-l8c4JUN1btpKesywHf6KbHYTrQY_Cc/s1600/Screenshot+from+2014-07-06+00%253A27%253A24.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" height="80" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNLDru-uOqPuVOCk7iAvOVuK6gfhRZqE1NnNo1lT6Q1_0gP4JqVrWNSnePOJJ1GVeQEf8PZ4UazceSAvwcd_6UDI__dVxhnr0JjgaogU8o9bIK-l8c4JUN1btpKesywHf6KbHYTrQY_Cc/s1600/Screenshot+from+2014-07-06+00%253A27%253A24.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;"><div class="wp-caption-text">
Vulnerable Form </div>
</td></tr>
</tbody></table>
Of course in this example there is an indication that this form is 
accepting HTML tags as it is part of the functionality of the 
application. A malicious attacker will think that he can exploit the 
users of this application if he set up a page that is capturing their 
cookies and credentials in his server. If he has this page then he can 
trick the users to enter their credentials by injecting into 
the vulnerable page a fake HTML login form. Mutillidae has already a 
data captured page so we are going to use this page for our tutorial<br />
.<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYzo9Hcetv0v2Ia2696TTMjT223zACT3P1XdCkdBtuNc6eJTXfDVAtQSuV9dpfS9-C6JjwAqmvDE_3Wqa8fU0gCVlNFUTD1Yt7cLw-sUT01OB4BgPHG8nzIKjH7G78V4vO1CiGiQVqNqk/s1600/capture-page.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" height="424" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYzo9Hcetv0v2Ia2696TTMjT223zACT3P1XdCkdBtuNc6eJTXfDVAtQSuV9dpfS9-C6JjwAqmvDE_3Wqa8fU0gCVlNFUTD1Yt7cLw-sUT01OB4BgPHG8nzIKjH7G78V4vO1CiGiQVqNqk/s1600/capture-page.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;"><div class="wp-caption-text">
Mutillidae – Data Capture Page</div>
</td></tr>
</tbody></table>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAdrE1LBQPNazOO8jXsb_UIpA43YHorgRPCCBN6SOigMnQ_NbSJh60NAu-IB41HbrX2MT1ozt9lmuPb2bVEyt1vPUolV0wsTv3CA3GK-TNveqmI05K5B7sTCODqczY-2Wsi8pM3h2XzPI/s1600/html1.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" height="318" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAdrE1LBQPNazOO8jXsb_UIpA43YHorgRPCCBN6SOigMnQ_NbSJh60NAu-IB41HbrX2MT1ozt9lmuPb2bVEyt1vPUolV0wsTv3CA3GK-TNveqmI05K5B7sTCODqczY-2Wsi8pM3h2XzPI/s1600/html1.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;"><div class="wp-caption-text">
Injecting HTML Code – Fake Login</div>
</td></tr>
</tbody></table>
<div class="separator" style="clear: both; text-align: center;">
Now we can inject HTML code that it will cause the application to load a fake login form.</div>
<br />
<span id="goog_2035220969"></span><span id="goog_2035220970"></span>.<br />
<div class="wp-caption-text">
<b>Injecting HTML Code – Fake Login</b><br />
.</div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-g4df4BySrQDh3jhK3i-qrxZmg-9fAL93luCl4YSM1SE9Ji8U_jCJjO_zr7i8KavAmk1vElceOww6CBS1BiLLaMBUSbn6-tyQOUFakYC69Ssik_cch0yOH9mX6786cPgASwYkHA8lEVY/s1600/fake-login.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" height="221" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-g4df4BySrQDh3jhK3i-qrxZmg-9fAL93luCl4YSM1SE9Ji8U_jCJjO_zr7i8KavAmk1vElceOww6CBS1BiLLaMBUSbn6-tyQOUFakYC69Ssik_cch0yOH9mX6786cPgASwYkHA8lEVY/s1600/fake-login.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;"><div class="wp-caption-text">
Fake Login Form</div>
</td></tr>
</tbody></table>
<span style="font-family: "Courier New",Courier,monospace;">Every user that will enter his credentials it will redirected to 
another page where his credentials will stored. In this case the 
credentials can be found at the data capture page and we can see them 
below:<br /><span id="goog_2035220984"></span><span id="goog_2035220985"></span></span><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihzx1ArdmRWhpRr2J-fBC2VVtboUuZ43cAM7FwN5glfN73_GkpHSYoa-jMi_FyAPDekddu6NcgzXjQqqSrtwOW70Rcq34RCAwWH41AQBP6GFhp_19S3iGAeNmM3EIKOUdoHafOFCEBCtk/s1600/capture-credentials.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="70" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihzx1ArdmRWhpRr2J-fBC2VVtboUuZ43cAM7FwN5glfN73_GkpHSYoa-jMi_FyAPDekddu6NcgzXjQqqSrtwOW70Rcq34RCAwWH41AQBP6GFhp_19S3iGAeNmM3EIKOUdoHafOFCEBCtk/s1600/capture-credentials.png" width="640" /></a></div>
<br />
<br />
<span style="font-family: "Courier New",Courier,monospace;">As we saw in this article HTML injection vulnerabilities are very 
easy to exploit and can have large impact as any user of the web 
application can be a target. System admins must take appropriate 
measures for their web applications in order to prevent these type of 
attacks.</span></div>
</div>
</div>

Hacking website- HTML Injection

HTML Injection HTML Injection is a vulnerability which occurs in web applications that allows users to insert html code via a ...