Do not trust Chinese routers, especially D-LINK – As they contain backdoor!

A group of researchers found a backdoor in a set of D-LINK routers. Well, not a news but expected and good to be uncovered. Does it call for a deeper inspection of other brand routers? Better of with the open firmware like DD-WRT or OpenWRT or TOMATO! At least you know what you are loading on to the device.

The discovered backdoor can bypass the authentication step and land directly to the admin interface!

Pretty nifty isn’t? That’s what a backdoor is for.

Method to access: Just change the User Agent string of your browser to “xmlset_roodkcableoj28840ybtide” which is actually a reverse of “editby04882joelbackdoor_teslmx”.

Nice huh?

“edit by 04882 joel backdoor _teslmx”

One of the very few backdoors which actually spelt backdoor! :)

How to change the User Agent? It is very simple for non-IE browsers. Check in the configuration settings for Agent by typing about:config in the address bar.

If there is an option, you could change it and restart the browser for the new string to take effect. To check if it changes, use Netcat, start a listener on the local interface using “nc –vvns 127.0.0.1 –Lp 888” at the DOS prompt and type “http://localhost:888” and you can see the request on the command prompt window. You can check the User Agent string value and see if it has been changed according to the above setting.

Else check for some plug-in which can be used to change the User Agent string of the browser to what you want text!

More info about the backdoor and affected devices from http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/

More and more of such news is actually taking away the trust on device manufacturer whether they are Chinese or not!

Well, like wise Intel who have a embedded SIM enabled on the processor for remote access, software manufacturers having hidden backdoors, etc,.

It is nice to see some researchers burning mid night oil to uncover snake oil products (what else to call ‘em?) and legitimate products which such nonsensical backdoors. But when it comes to hardware it is pretty much out of reach for any one to have a look at it to understand what it does when a specially crafter instruction / packet or a command is sent. It is actually scary to know what lies between the multi layered PCBs and components and what they are capable of. One could still argue, being a layman we might not have to worry about such things because of the information value we hold, but think about a top secret facility or a government or some one having a high value research data, it is pretty scary on what to trust. Ultimately, mate, anything electrical / electronical should not be trusted. No matter if it is a connected or disconnected device, powered on or in off state. Just don’t trust it!

I may be paranoid, but it goes with the saying of you know who:

“A computer switched off, unplugged, buried under ground in an unknown location on earth cannot remain safe! Then how our devices can be???”

And I don’t want to open another can of worms with the recent PRISM happenings as some things are better left not discussed. Beware!! it is not being promiscuous!! But just like that! Many more to go before the EOW!

Diving into windows registry for forensic data

As a forensic examiner, looking at a cloned system for possible timestamps of a drive-by-download attack, windows registry has some small foot holes to gather evidence (real or not). Atleast, will surely give an idea about how, when the attack has happened. Trusting the system time was intact and all the sole purpose for this exercise was to learn, having a look at registry keys armed with some freeware tools provide some data. Correlation plays a key role in identifying how and when the devices were connected to the system.

Freeware tools used to achieve the above are:
USB Device Viewer - A tool which provides a complete history of all removable devices connected to a Windows based host.
http://www.nirsoft.net/utils/usbdeview.zip

Direct Registry Browser from
http://www.sysdevsoftware.com/soft/dreg.php which can be used to browse the registry in case of offline image based forensic analysis.

Registry Browser from SoftSpot Software.
http://www.softspotsoftware.com/pages/downloads/RegBrowser.zip which can be used to view the timestamps on the registry key. There is a Nirsoft tool to view the same, but I prefer using this software.

And lastly, the infamous ProcMon from Microsoft Sysinternals Lab.
The latest version can be downloaded from http://live.sysinternals.com/Procmon.exe
It can used to get knowledge about the registry keys being accessed during the use of the above tools.
Tip: Set a filter on the process names to reduce the output while using the above tools.

The rest is left as an exercise to the readers (??!!!) as how find out the usb devices connection time and et all!

Happy forensics!

Truecrypt 7.0 gets Hardware Acceleration and more

Truecrypt - The free open source encryption tool which gives many commercial encryption tool providers to run for their money has once again proved it's worthiness! Just released Version 7.0 has got some really commendable features such as Hardware-accelerated AES, Auto Mounting of the encrypted volumes and partition/device-hosted volumes to utilise different sectors sizes. Though hardware-accelerated AES is currently applicable only for Intel Core i5 and Intel Core i7 processors, it is worthwhile to enable it because it provides up to 4-8 times faster performance compared to the normal open source version of the AES implementation.
It uses the embedded AES-NI (aka "AES New Instructions") instruction set for performing the crypto operations, but it is clear that the key generation does not use the AES-NI Instructions. (Thank god! :))
Check out more from http://www.truecrypt.org/
Use this amazing tool to safe guard your data be it confidential or not! You'll agree with me if you have the habit of carrying your portable Operating systems, Tools sets, Working data and Documents on multiple USB thumb drives wherever you go/roam! :)

Opera browser does not erase all the tracks while clearing history

People who use opera, just be(a)ware!

Clearing the history completely does not erase all the readily available tracks. Opera caches the site icons from almost every visited site and it remains on the system forever!

Clearing the history and deleting all the cookies does not clear these files.

Check it out yourselves if using opera.

In a normal desktop installation of the opera browser, the favicon files cache is available at "C:\Documents and Settings\\Local Settings\Application Data\Opera\Opera\icons" folder. This is applicable for Windows XP Operating systems and for Windows 7 this folder location will be different. The folder can be easily accessed using "%HOMEFOLDER%\Local Settings\Application Data\Opera\Opera\icons\" string typed at the RUN dialog box. If the folder cannot be located, type, opera:config#UserPrefs

OperaDirectory which will contain the location of the User Preferences directory for the opera installation.
 
The folder contains the http location and favicon files of almost all the sites ever visited by a user. If not to get a glimpse of the history or for forensic purposes, the folder can be looked at to know when the user has visited a particular website. Though there is no way of telling if the user has visited a site more than once, but at least one can clearly get a list of visited websites. This is of great help while performing forensics.

The above is applicable to Opera browser v9.x and above.