Circumventing Antivirus via Transmutation

Researchers at Kumatori Accelerator-driven Reactor Test Facility (KART) (Economist article, if you subscribe) have discovered a way to forcibly decay radioactive waste (neptunium, plutonium, americium, curium, etc.) into less-lethal isotopes of elements that are only radioactive for years, instead of tens of thousands or tens of million years. Essentially, they slam radioactive waste with a neutron beam that adds mass to the radioactive waste, causing it to transmutate into another element, which in turn causes it to decay faster. This got me thinking, if you can slam an element with with a neutron beam to create a new element, well, maybe you can do the same thing to a file in order to avoid "pesky Anti-Virus"?read more


Well, it seems you can. A good example of this is Holy Father's Morphine. Morphine works by including its own PE loader. This enables it to put whole source image to the .text section of new PE file. It also contains a polymorphic engine which always creates absolutely different decryptor for the new PE file each time Morphine is run. Morphine was released in March of 2004, and the major Antivirus companies did not have a method of generically detecting "Morphined" executables until Q4 2005. The private version of Morphine still creates verisons of binaries that are undetectable to every Antivirus maker on the market.

Other ideas are simply to rearrange the executable so that it does essentally "the same thing", but modify the underlying instructions of the binary. An example would be to move the value in the edx register into the eax register. Typically, the program would do a mov edx, eax instruction to accomplish this. Well, a push eax followed by a pop edx will do effectively the same thing as a mov edx,eax --- take the value in edx and put it into eax. You see where I am going here, we can totally modify the static signature of the binary in this process. But, does it work....

....Well, not really. If I take a 3 byte instruction (mov edx, eax) and replace it with two 2 byte instructions (push eax and pop edx), I have changed the offset within the program by one byte. This means that every jump, every call in the program will be off by one byte, meaning the program will no longer work. Three possible solutions to this problem:

1. Only substitute equal size instructions
2. Recalculate all jumps and calls after the insertion or deletion of the total number of bytes.
3. Write our own trojan/virus, or whatever we are trying to accomplish (not the focus of this article though)

Ok, well if we do some googling, someone has already attempted #1. A guy named z0mbie already wrote a program called code pervertor that did this. Unfortunately, it didnt work very well as the heueristic engine in most AVs can catch these simple modifications. For #3, go ahead a create your own trojan or virus. But this is not an option if you aren't a trojan writer or programmer, or dont have the time to learn.

For #2, we actually find that another guy, tibbar, has created a very cool program to do just this. He calls his program CodeCrypter. He was nice enough to email me a verision with source to play with. You can see the result of tibbar's CodeCrypter here. You can see in the first column the address of the instruction, in the next, is the original instruction, and in the last is the new instruction(s) . Well, how does it work? Pretty well, most AV will be defeated by it. If you take a standard program you know AV will freak out out (Hacker Defender) and send it over to one of many sites that will check a binary against all 20 AV companies (I use virustotal.com), you will get a report similar to this:

This is a report processed by VirusTotal on 04/05/2006 at 00:03:33 (CET) after scanning the file "hxdef100.exe" file.
Antivirus Version Update Result
AntiVir 6.34.0.14 04.04.2006 BDS/HacDef.073.B.1
Avast 4.6.695.0 04.03.2006 Win32:Hacdef-G
AVG 386 04.04.2006 BackDoor.Generic.XPG
Avira 6.34.0.54 04.04.2006 BDS/HacDef.073.B.1
BitDefender 7.2 04.04.2006 Backdoor.Hacdef.AE
CAT-QuickHeal 8.00 04.04.2006 Backdoor.HacDef.ae
ClamAV devel-20060202 04.04.2006 Trojan.HacDef.073.B
DrWeb 4.33 04.04.2006 BackDoor.HackDef.134
eTrust-InoculateIT 23.71.119 04.04.2006 no virus found
eTrust-Vet 12.4.2148 04.04.2006 Win32/HacDef.E
Ewido 3.5 04.04.2006 Backdoor.HacDef.ae
Fortinet 2.71.0.0 04.04.2006 W32/HacDef.AE!tr
F-Prot 3.16c 04.04.2006 security risk named W32/Hackdef.FI
Ikarus 0.2.59.0 04.04.2006 Backdoor.Win32.HacDef.084
Kaspersky 4.0.2.24 04.04.2006 Backdoor.Win32.HacDef.073.b
McAfee 4733 04.04.2006 HackerDefender.gen.c
NOD32v2 1.1471 04.04.2006 Win32/HacDef
Norman 5.90.15 04.04.2006 W32/Hacdef.CM
Panda 9.0.0.4 04.04.2006 Bck/Hacdef.ED
Sophos 4.04.0 04.04.2006 Troj/HacDef-Fam
Symantec 8.0 04.04.2006 Backdoor.HackDefender
TheHacker 5.9.7.124 04.03.2006 Trojan/hackdef.d3
UNA 1.83 04.04.2006 Backdoor.Hacdef
VBA32 3.10.5 04.04.2006 Backdoor.Win32.HacDef.ae


Note: The only Antivirus that doesnt find Hacker Defender is CA's eTrust. I can't believe anyone would attempt selling something even called "Antivirus" if it didnt at least find Hacker Defender. If you have eTrust installed, it is just wasting processor cycles, you are better off virtually folding protiens or something.

Anyway, if we run the binary through tibbar's code cryptor, we get much better results:

This is a report processed by VirusTotal on 04/05/2006 at 00:20:29 (CET) after scanning the file "hxdef100.exe" file.
Antivirus Version Update Result
AntiVir 6.34.0.14 04.04.2006 no virus found
Avast 4.6.695.0 04.03.2006 no virus found
AVG 386 04.04.2006 no virus found
Avira 6.34.0.54 04.04.2006 no virus found
BitDefender 7.2 04.04.2006 MemScan:Backdoor.Hacdef.AE
CAT-QuickHeal 8.00 04.04.2006 (Suspicious) - DNAScan
ClamAV devel-20060202 04.04.2006 no virus found
DrWeb 4.33 04.04.2006 no virus found
eTrust-InoculateIT 23.71.119 04.04.2006 no virus found
eTrust-Vet 12.4.2148 04.04.2006 no virus found
Ewido 3.5 04.04.2006 no virus found
Fortinet 2.71.0.0 04.04.2006 suspicious
F-Prot 3.16c 04.04.2006 no virus found
Ikarus 0.2.59.0 04.04.2006 Backdoor.Win32.HacDef.084
Kaspersky 4.0.2.24 04.04.2006 Backdoor.Win32.HacDef.073.b
McAfee 4733 04.04.2006 no virus found
NOD32v2 1.1471 04.04.2006 a variant of Win32/HacDef
Norman 5.90.15 04.04.2006 no virus found
Panda 9.0.0.4 04.04.2006 Suspicious file
Sophos 4.04.0 04.04.2006 no virus found
Symantec 8.0 04.04.2006 no virus found
TheHacker 5.9.7.124 04.03.2006 no virus found
UNA 1.83 04.04.2006 no virus found
VBA32 3.10.5 04.04.2006 Backdoor.Win32.HacDef.ae


The only "big name" Antivirus to discover the modified program is Kaspersky. All of the big guns, Symantec, McAfee, Sophos, Clam-AV are circumvented! Of course eTrust likely thinks this new version of the binary is winword.exe or something. ;)

So, why is it detected at all? Well, the version of CodeCrypter that I used retained the same OEP (original entry point). I suspect if this was randomized, all AV would be circumvented.

Space camera streams data during flight

Take the risk of not recovering your hardware out of a near-space camera launch by streaming the data during flight. [Tim Zaman] is part of a team that developed the rig seen above. It sent 119 image back during the recent balloon launch. This included transmissions from as high as 36 kilometers.

The main hardware included a BeagleBoard with connected Webcam housed in a Styrofoam cooler for thermal protection. Pair that with a GPS module for location tracking, and a GPRS module for data transmission and you’re in business.

But that’s not all that went up. The team built a backup hardware module in case the primary failed. This one also had a GPS and GPRS radio, but was driven by an Arduino.

The radio connection made it easy to recover the hardware. GPS data led the team directly to the landing site. The package came to rest on the roof of a building, but we guess that’s more convenient than getting snagged at the top of a huge tree.

Don’t miss the hardware detail video that we’ve embedded after the breakread more

Activation Code For 3G In Different Mobile Operators

Here is the Code

 MTNL 3G:    sms ACT 3G to 444

 DOCOMO:    sms ACT 3G to 53333 

 AIRCEL:       sms START 3G to 121

VODAFONE: sms ACT 3G  to 111

 AIRTEL:       Call 12134 to activate 3G or sms  3G to 121

 IDEA:           sms ACT 3G to 12345

Idea Call Reduction Trick 2011

Now you can activate idea local calls at 1ps/2sec for free to
 3 months

 Activate this offer by dialing *369*21# (tollfree)

 Note: Working in Some States. 
           Try Only in Low Balance

Learn Hacker's Language (l337)

Hello!
         The language in which hackers communicate between themselves is known as LEET(l337) also known as ELEET or LEETSPEAK. Its an alternative alphabet for the English language that is used primarily on the internet. It's a combination of alphabets, numbers and symbols and is very famous in Hacking world...
leet was made by hackers in 1990s to hide their web pages from search engines.
Here's a chart  which can help you learning leet language.

A = 4    @    /-\    /\    ^    aye    ∂    ci    λ    Z

B = 8    |3    6    13    |3    ß    ]3

C = (    <    ¢    {    ©    sea    see

D = |)    [)    ∂    ])    I>    |>    0    ð    cl

E = 3    £    &    €    [-    ə

F = |=    ]=    }    ph    (=    ʃ

G = 6    9    &    (_+    C-    gee    jee    (γ,    cj

H = |-|    #    ]-[    [-]    )-(    (-)    :-:    }{    }-{    aych

I = !    1    |    eye    3y3    ai    ¡

J = _|    _/    ]    ¿    

K = X    |<    |X    |{    ɮ

L = 1    7    |_    £    |    |_    lJ    ¬

M = 44    /\/\    |\/|    em    |v|    IYI    IVI    [V]    ^^    nn    //\\//\\    (V)    (\/)    /|\ /|/|    .\\    /^^\    /V\    |^^|    AA

N = |\|    /\/    //\\//    И    [\]    <\>    {\}    //    ₪    []\[]    ]\[    ~

O = 0    ()    oh    []    ¤    Ω

P = |*    |o    |º    |>    |"    ?    9    []D    |7    q    þ    ¶    ℗    |D

Q = 0_    0,    (,)    <|    cue    9    ¶

R = |2    2    /2    I2    |^ |~    lz    ®    |2    [z |`    l2    Я    .-    ʁ

S = 5    $    z    §    es

T = 7    +    -|-    1    ']['    †

U = |_|    (_)    Y3W    M    µ    [_]    \_/    \_\    /_/

V = \/    √    \\//

W = \/\/    vv    '// \\'    \^/    (n)    \X/    \|/    \_|_/    \\//\\//    \_:_/    ]I[    UU    Ш    ɰ    ￦    JL

X = %    ><    Ж    }{    ecks    ×    *    )(    ex

Y = j    `/    `(    -/    '/    Ψ    φ    λ    Ч    ¥
Z = 2    ≥    ~/_    %    ʒ   7_

Please note this table is to be used as a guide and not a full translation tool. Leet is ever-changing and not all replacements will, or can, be included.

Vocabulary
Although l33t speak is just a corrupted form of the English language, there are many phrases and words (spellings) that are unique to it.

0w|\| or 0wn3d - One of the most popular l33t words it is very loosely defined as beaten or can simply be an expression of awe, for example, 'I 0wn3d you' means 'I have beaten you in a very humiliating fashion', or '0wn4ge!' which means 'That was (or is) very nifty'.

w00t - Derived from 'hoot', this is defined as 'yay', it can be used, for example, upon victory or, possibly, the release and procurement of a new video card.
13wt - Treasure, good merchandise, possessions, a misspelling of loot. Most commonly referring to pirated software, items in a game or promotional giveaways.
h4x0r - Hacker, can be used for a real hacker or simply a very skillful person. This is the most common occurrence of the -0r clause.
ph33r - Fear, most commonly used in such phrases as, 'Ph33r m3!' or 'Ph33r |\/|y 1337 sk1llz!' It can also be written as, 'ph34r'.
sk1llz - Obviously derived from 'skill', referring to skill in some type of online game, programming or hacking. Many times used in conjunction with 'm4d'. As a general rule, if one has sk1llz, one is to be ph33r3d.
m4d - Mad, mostly used as a descriptive term meaning great, for example, 'h3s g0t m4d sk1llz'.
j00 - You, commonly used in such phrases as, 'j00 d34d f00'.
f00 - Fool, one who isn't very bright or skillful.
j0 - Yo, as in the greeting.
d00d - Dude; an expression of comrade, or just used to address a random person online.
sux0r - Sucks, as in '7h1s sux0r', one of the few common examples of the -0r clause.
l4m3r - Lamer, someone who is lame, someone who uses an unfair tactic or generally makes the things around him or her less fun.
n00b - Short for noobie, misspelling of newbie; someone who is new to something, or just not very good at it.
GOOGLE IN LEET LANGUAGE:

There's also google in Hacker's language(l337) click HERE to go to that page.

This language is actualy slower to 7¥℗3 4|\||) 50/\/\3 h4xorz }{4v3 4nn()¥in6 h48175 0ph ℗u77i|\|9 l33t at r4nd0m oppps ax well.... :)

Trick To Secure Your Windows With Start Up Password Protection

Configure Windows System Key Protection

To Configure Windows System Key Protection, follow these steps:

1. At a command prompt, type syskey, and then press ENTER.
2. In the Securing the Windows Account Database dialog box, note that the Encryption Enabled option is selected and is the only option available. When this option is selected, Windows will always encrypt the SAM database.
3. Click Update.
4. Click Password Startup if you want to require a password to start Windows. Use a complex password that contains a combination of upper case and lower case letters, numbers, and symbols. The startup password must be at least 12 characters long and can be up to 128 characters long.
   
   Note If you must remotely restart a computer that requires a password (if you use the Password Startup option), a person must be at the local console during the restart. Use this option only if a trusted security administrator will be available to type the Startup password.
5. Click System Generated Password if you do not want to require a startup password.
   
   Select either of the following options:
   • Click Store Startup Key on Floppy Disk to store the system startup password on a floppy disk. This requires that someone insert the floppy disk to start the operating system.
   • Click Store Startup Key Locally to store the encryption key on the hard disk of the local computer. This is the default option.
   Click OK two times to complete the procedure.
   
   Remove the SAM encryption key from the local hard disk by using the Store Startup Key on Floppy Disk option for optimum security. This provides the highest level of protection for the SAM database.
   
   Always create a back-up floppy disk if you use the Store Startup Key on Floppy Disk option. You can restart the system remotely if someone is available to insert the floppy disk into the computer when it restarts.

Note The Microsoft Windows NT 4.0 SAM database was not encrypted by default. You can encrypt the Windows NT 4.0 SAM database by using the SysKey utility.

How To Fool A Keylogger

Hello!
         Do you think that someone has sent a keylogger in your PC which keylogs your password and mails it to someone else? If you think you are been logged, then you must know how to fool a keylogger. Fooling a keylogger is as easy as 1 2 3.


FOOL A KEYLOGGER:

Whenever you type a password, never type it in one go, for example if your password is wannahackit you should type naha then move cursor to start of the password field using the mouse ONLY, then type wan then move cursor to end using the mouse and type ckit. This way the logger will send your password as nahawanckit instead of wannahackit. :)