Point and Click Cracking

An anonymous reader writes "Washingtonpost.com is running a story about a number of botnets and keylogger operations being controlled by Web-sites with point-and-click type front-end software interfaces. The sites mentioned in the story look like fairly slick PHP pages designed to sort through password data from keylog victims and update infected computers with new code or instructions. From the story: 'The hacking software also features automated tools that allow the fraudsters to make minute adjustments or sweeping changes to their networks of hacked PCs. With the click of a mouse or a drag on a pull-down menu, users can add or delete files on infected computers.'"

Comments

php?

[Anonymous Coward]

wouldn't happen with .net!

Most of the problem is the users

[solarbob]

Most of the reasons PC's get hacked now days is that end users are still clicking on the links in phising emails and then holes in the browser being exploited. Surely it wouldn't take much for the main browser makers to put in a user idiocy filter to just say aren't you being a bit silly? Of course user education would be best but there will always be a certian newbie segment who are on the internet for the first time and will keep doing this. That software though does look pretty comprehensive

Re:Most of the problem is the users

[G)-(ostly]

Actually, a lot of the time a browser hole isn't required at all. Users are actually still downloading applications that are just applications that function in a malicious way, with full rights actively given by the user to use the system resources for ill.

After all, once an OS is running something bound to a port, how is it supposed to know whether or not you're an idiot who just installed a keylogger or trojan, or a competent user running some sort of legitimate server software? It can only warn you so much before there's just nothing else that can patch the hole, except maybe some tape over your head.

At this point, browsers warn people, operating systems warn people, firewalls warn people and virus scanners worm people, and they still just have to run that trojan software for whatever pointless whizz-bang effect it adds to their mouse cursor or emails.

Re:Most of the problem is the users

[_xeno_]

At this point, browsers warn people, operating systems warn people, firewalls warn people and virus scanners worm people, and they still just have to run that trojan software for whatever pointless whizz-bang effect it adds to their mouse cursor or emails.

Was "virus scanners worm people" a reference to the recent McAfee problem or just a typo? :)

Er, anyway, my actual point was that people are now so used to be warned about installing just about everything that they just click "yes" without thinking. When you go to Windows Update or Microsoft Update for the first time, Microsoft has a nice little picture explaining how to say "yes" to the warning dialogs that come up when it tries to install the update ActiveX control.

People are just so used to be annoyed by their computer that they mindlessly click through all the warnings anyway. The warnings don't really help, people don't bother understanding what they mean, and websites frequently include instructions on how to bypass them without explaining what the warning means. (I'll fix that someday. No, really...)

The only real solution is user education. Failing that, the clue-stick (also known as a "clue-by-four") is a fun, but ultimately useless, alternative.

Re:Most of the problem is the users

[G)-(ostly]

It's not going to work. People don't know how to use warnings in the physical world properly. Look at warnings provided on the road. How many people ignore Yield signs and try to merge right into oncoming vehicles? How many people just blow right through a blinking yellow without thinking? How many people just blow out of parking lots or driveways? How many people actually look to see if a train is coming before they cross tracks with a warning light and bar?

It's a matter of risk/reward that's inherent in human nature. If 99 times out of a hundred you approach a crossing with a light and bar there's no train coming when there's no lights, you're going to get used to that. Of course, that one time you come along and the lights are broken, you're going to die, but that's the risk/reward. You're taking the 1% chance that you'll get killed by an unannounced train and comparing it to the fact that you'll have to do the extra work of slowing down, looking and speeding back up for nothing 99% of the time.

People just don't take serious warnings seriously unless there's a very good chance that they could be harmed by not following them. It doesn't matter how serious the consequences if they occur too infrequently to stay fresh in one's mind.

Re:Most of the problem is the users

[martinultima]

“And Linux is so hard to use it requires a ten year training course just to get to a login window!”

Actually, today's fully modern distributions have greatly improved – it only takes nine!

Re:Most of the problem is the users

[99BottlesOfBeerInMyF]

Most of the reasons PC's get hacked now days is that end users are still clicking on the links in phising emails and then holes in the browser being exploited.

Gee, that's great except it is not even close to being true. Most infections by number and most DDoS bandwidth is the result of automated worms that perform automatic remote exploits and require no human intervention.

Surely it wouldn't take much for the main browser makers to put in a user idiocy filter to just say aren't you being a bit silly? Of course user education would be best but there will always be a certian newbie segment who are on the internet for the first time and will keep doing this.

Step one, close the remote holes in the OS. Windows has gotten better with a default firewall, etc. but it still has too many services running by default and too many remote holes. Step two, close remote holes in the main internet applications. IE and Outlook need to be revamped with security as a primary component, not a add-on. Third, new applications need to be sandboxed by default and restricted from doing anything with a user's files, internet connection, address book, buddy list, other programs, OS files, and services unless the user is informed with a well made UI and presented with choices in the English language that explain what the program wants and lets the users choose the appropriate level of access. Fourth, then and only then can we successfully apply end-user education that can work to stop malware infections.

Please note the software mentioned here does not compromise machines. (Although such GUI software does exist.) This software is used to easily manage a botnet after it has been compromised. Since botnets are big business and are often run by less savvy users, it is advantageous to be able to sell time on a botnet to a Russian mafioso, a disgruntled, rich, arab kid, or a greedy american corporate. Since they are pretty clueless you can do better than the competition by giving them an easy to use GUI for it. I saw the logs of what appeared to be a Islamic activist using a botnet the other day to attack random IP blocks in the Netherlands. He attacked useless ports twice, making his attack very ineffective, and then took multiple tries in order to find the right command to stop the DoS attack. These are not experts anymore.

Sure, why wouldn't it?

[Enigma_Man]

I often migrate things to web-interfaces that were previously shell scripts. It's more convenient, 'cause I can do the things I need to do from any browser without having to ssh in (which isn't always a possibility, rare, but it does occur). Also, it's easier to show to other people without giving away a shell account. Also also, it's easier to show to people who aren't "in the know" because it looks like something.

-Jesse

Stupid Innuendo

[Bios_Hakr]

Here's what I hate about news. It's all about alluding to something powerful and blinding the users with innuendo.

Stop mincing your words and just say it. Stop telling people about "some website" where "evil hackers" can "point and click" to crack your passwords. Just fucking say Rainbow Crack.

It really fucking gets my goat when someone claims to have secret knowledge. What harm could have come from just saying Metasploit or Rainbow Crack? The evil doers already know. Give JoeUser actual knowledge and let him decide for himself.

Stop pretending that you know something and the public can't be trusted with it.

Re:Stupid Innuendo

[shmlco]

And now an extra 15,000 script-kiddie-wanna-be's also know. Thanks.

Re:Stupid Innuendo

[apt142]

I agree. As a web applications developer, I'm interested in making a web app as secure as possible. To do that, I must be aware of what's out there.

Fortunately, I've had the advantage knowing about these apps before now. But, I'm not the sort of person that goes looking for scripts to take out websites. I could make some good guesses on where to look for these things. But, I'm never going to have the time to be as aware of that area of knowledge as I could and should be. Especially if I have to rely on my own ability to find and desiminate knowledge.

Not talking about these things doesn't make them go away. Talking about them makes it easier for the people who are most effected by these things to stay educated. And that includes everyone from the developers to clients to the PHB's.

Re:Stupid Innuendo

[Bios_Hakr]

The point is that no one should be allowed to tease the public with knowledge contained in secret tomes only the few can access. If you are going to talk to someone on a subject, then talk to them as an equal. Don't tell them that the boogyman is around the corner. If they ask, show them the actual threat. Let them decide. Don't just try and instill fear.

Would you be satisfied if a neighbor was sent to prison without a public trial? If you ask, the police could just say, "If you only knew what we know, you'd want him in prison too."

That's what the WP is doing here. They tell people to be afraid without showing the full truth. The internet is a bad place, but don't try and scare people with secret knowledge.

Re:Stupid Innuendo

[Hoi Polloi]

"Would you be satisfied if a neighbor was sent to prison without a public trial? If you ask, the police could just say, "If you only knew what we know, you'd want him in prison too.""

Yah, he's in Guantanamo Bay now.

Re:Stupid Innuendo

[Inda]

I found out about Rainbow Crack after our website was cracked. I found out about SQL injections after our website was hacked. I found out that 'passwords are obsolete' after mine was posted on a forum [after we got hacked].

We started off over 7 years ago running a gaming site. I did the graphics, my mate used Front Page to get a few pages together. We pirated a verison of vBulletin... None of us knew much apart from a Hello World HTML.

3,000 members later and a dozen or so clued-up kiddies thought they'd take revenge after we caught them cheating our league.

These days we've all learned a few more skills and the whole site is a fully automatic gaming league, linked to a licenced vBulletin with other security measures throw in when we become aware of them.

We are still amatures though. Know of us are experts. We muddle along...

I always posted my findings after each hacking but I too wish there was a one-stop-shop for all things related to web security. Sometimes the hobby can be too stressful - it shouldn't be - it should be as enjoyable as it was in the begining.

It's about time

[$RANDOMLUSER]

We've had decent network admin tools for the enterprise for a long time now. It's about time we had the same thing for botnets. ;-)

point and click oblivion

[digitaldc]

Frost's data, along with information stolen from thousands of other victims, made its way to a Web site hosted by a Russian Internet service provider. The site is currently the home base of a network of sites designed to break into computers through a security hole in Microsoft's Internet Explorer Web browser.

So why aren't the police kicking down the doors and confiscating equipment from this ISP? Are they 'protected' or 'special?'
After reading stories like this Dutch hacker arrest,I am not sure why.
Aside from that, Microsoft needs to do something like pushing out mandatory security patches for all users of Windows and/or IE.
I am not sure why they don't do this either. I guess Microsoft thinks that all these lazy suckers deserve to be hacked.

offcourse not

[SmallFurryCreature]

Remember you write the code to exploit .Net in PHP.

Why if you used .net for the exploit then EVERYONE could just steal your keylog files!

This is basically a non-story. Someone at the washintingpost seems suprised that people do not print out their key logs and search them by hand. The only "new" element is that the tools are migrating to web based apps. Then again isn't that suppopsed to be the next big thing? Why should criminals ignore IT development? I am willing to bet the next one will be using AJAX.

The *real* killer distributed application?

[MoralHazard]

I'm sure someone has made this point already, but technological advances have a way of finding their maximum profitable use, regardless of how the original inventors intended their innovations to be used. I think these botnets are a similar phenomenon.

Case in point: Thomas Edison originally conceived of the phonograph as a tool for dictation, teaching children from recorded lessons, and a few other specific apps. You know what he never, ever thought of? Recorded music. And yet, that is the killer app that made his invention a common household object and birthed one of the most successful commercial fields of the 20th century--the whole music industry as we know it wouldn't exist without the phonograph.

We saw the same thing with the Internet, when a bunch or DARPA eggheads (no offense, I love you guys) built an academic network that turned into what may prove to be the newest and most effective mass media tool in the history of the human race. I seriously doubt that anyone involved in the original research, or even anyone engineering TCP/IP networks in the 70s and 80s, imagined what would happen after 1990.

In the same fashion, botnets manage to apply the same basic technologies pioneered by Seti@home, distributed folding, and all of the other "beneficial" distributed computing projects that have wrung work out of the combination of 1) the popularity of the Internet, and 2) the unharnessed cycles, disk, and network I/O bandwidth of all those overpowered word processors around the world. And it's arguable that the economic productivity (at least to a few criminal types) of the botnets is overwhelmingly more than the cash made by all the originators of the concepts (yeah, I know, they're nonprofits, sheesh).

It's kind of a shame that the killer app of distributed ad-hoc networks is so generally harmful, but that's the way the cookie crumbles. Get a firewall, install you patches, and hope to God that nobody targets you with a DoS attack.

Unpaid work

[Inverted Intellect]

Aren't script-kiddies basically just unpaid volunteer workers for the (presumably blackhat) writers of these click-and-point hacking tools?

Why go to the trouble of writing an easily-countered virus when you can just make cracking tools more convenient for the hordes of script-kiddies with nothing better to do, thus having a much more damaging effect?

Why do people write these?

[failure-man]

One thing I've always wondered about script kiddies: who writes their tools for them, and why? What does the actual black hat get out of the deal? It's not like script kiddies pay for things.

Is it for fame? Signal-to-noise manipulation? Are the little fuckers getting "0wn3d" by backdoors in their "1337 h4x0r t00lz"?

Or is it something else entirely?

Re:Why do people write these?

[Kjella]

One thing I've always wondered about script kiddies: who writes their tools for them, and why? What does the actual black hat get out of the deal? It's not like script kiddies pay for things.

Don't know, but these parts are more of a write-once and reuse code-type. I've seen tools like this, it's like a frigging plug-in system. "Insert exploit here" "Insert shellcode here". Which doesn't mean you'll actually write code - you'll just add some modules of what it's going to do. I imagine the botnet code is similar, it's just a generic management tool. You could probably lift most of the code out of completely legitimate programs.

I imagine the makers are "advanced script-kiddies" - they don't actually go out and make the hard parts - they just get their "whoas" by impressing other script kiddies. Lots of flash and little content, but well... it's like with DeCSS - it's the GUI guy that's famous.

Gulf Oil hacked ...

[Anonymous Coward]

"break into computers through a security hole in Microsoft's Internet Explorer Web browser"

The flaw is in the underlying Operating System.
A bug in a browser shouldn't lead to such massive breech.

"Graham Spinney, director of information technology at Gulf Oil, confirmed that sometime on March 10, hackers broke into the company's Web site and planted code that redirected visitors to another site.

The false site informed visitors that they needed to install a security update to continue logging in to their Gulfoil.com accounts"

Now this is news.
I don't see much mention of it elsewhere.
The same with the CitiBank ATM hack.

Spur for users to RTFM?

[dtsazza]

FTFA:

"This type of plug-and-play, click-and-hack software simply represents the commercialization of criminal activity, and in many respects lowers the technical knowledge barrier of entry to this type of crime."

Yes. Asides from the "but is it Open Source?" jokes, I'd imagine it's not difficult for anyone with the motivation to get hold of this software - and no matter what it costs, a 'customer' could easily make that amount back and more.

It just makes me think - how far do things have to go before people realise that computers are not inherently safe? I'm being careful not to imply that computers *can't* be safe, because of course they can and I'd imagine the vast majority of /. readers' are - but that it's not some whizzy technological environment where everything is great and snazzier is better.

I'm talking about end-user attitudes; for a long time, public perceptions of computers and the internet has lagged behind the realities. They've shown themselves unwilling to learn out of sheer curiousity or interest in using these new tools. They've shown themselves unwilling to learn when viruses and spyware corrupt files and destabilise operating systems. Now I wonder if they'll start to pay attention to the realities of networked devices when it hits a lot of people in the wallet.

I also wonder whether the commoditization of cracking tools will eventually shoot crackers in the foot, by making them so ubiquitous that people actually get a clue and stop falling for phishing emails. But then I remember that while crackers have the greater desire to learn and exploit, they'll always be able to stay one step ahead, and come up with some new exploit...

And no, Trusted Computing is not the answer.

System Admins

[Herkum01]

I don't get it. How can these Hackers get this tools that do all these great things, and as a system admin I cannot get a application bundle and installed without having to try and move the Rock of Gibraltar.

Considering as a system Admin, I would have more time and a higher budget, you would think some corporation would make some better tools to handle the more common tasks like managing and updating applications on workstations. Instead I get to read how a hacker can control thousands of machines through a configuration more complicated than Enron's accounting procedures all with a click of the button.

Life just ain't fair.

Re:System Admins

[Kjella]

I don't get it. How can these Hackers get this tools that do all these great things, and as a system admin I cannot get a application bundle and installed without having to try and move the Rock of Gibraltar.

Well, I imagine the hackers don't give a flying fuck if it fails on 10% of the machines or how much it breaks, since it's all about numbers and it hardly matters which ones that works. If on the other hands it is the fscking machine you're trying to upgrade and instead it hoses the box, I think you might be slightly more annoyed.

Real problem is philosophical

[CarpetShark]

No, the real problem is systems like Windows, which promote the idea that end-users can administrate computers. It simply doesn't work, any more than it works for every driver to be their own car mechanic.

human psychology: power is a drug

[circletimessquare]

if someone told me that there was a secret receiver on the back of your head that you had no knowledge of, and i had no idea who you were, and you had no idea who i was, and i could activate it just by pushing a button, and it would cause you to twitch and spasm and yell out words tourette's style, and i know it's not good for you, what would i do?

a part of me wants to push the button, just to laugh at your suffering

over time, i could probably could come to enjoy it, sadistic pleasure from your pain

even it required a lot more effort on my part to initiate the reaction

and if it came to define my identity, this dependence on this drug (as this behavior obviously has for some) i might even fetishistically involve myself in the tools i needed initiate your suffering. i might have the magic button encrusted with diamonds. if it really represented the source of so much of my pleasure

and before you sneer at me, recognize that this aspect of human behavior and this potential for asocial manipulation exists in all of us

just look at your average kindergarten class if you think this kind of cruelty and enjoyment of others suffering, impersonal or not, is not something unfortunately intrinsic to human nature

its a dark side, and its defeat comes in recognizing it, not ignoring it

Off topic:..*real* killer distributed application?

[sgtrock]

We saw the same thing with the Internet, when a bunch or DARPA eggheads (no offense, I love you guys) built an academic network that turned into what may prove to be the newest and most effective mass media tool in the history of the human race. I seriously doubt that anyone involved in the original research, or even anyone engineering TCP/IP networks in the 70s and 80s, imagined what would happen after 1990.

I've got to question that assumption at least a little bit. Many (most?) of the scientists working on computer science related projects have always been fans of science fiction. Are you trying to tell me that they wouldn't have been aware of stories by Asimov, Heinlein, Clarke, Sturgeon, and others who all envisioned ubiquitous communications networks? Many of those authors wrote stories where ubiquitous computer systems of varying degrees of complexity were a factor. And some of those stories included all kinds of fascinating elements revolving around hacking past security measures. Certainly Gibson developed the themes far more completely later, but the elements were already there in the '50s at the latest.

I will concede that the original design(s) were never intended to grow into the global network that we have today. They were merely prototypes. The second one based upon IPv4 was so outstandingly successful that it took off before anyone really understood what was going on.

Suggesting that the original developers never thought about security issues also does them a disservice. They were researching communications for the DoD, for Pete's sake! The original design goal was to come up with a communications systems that would be capable of surviving a nuclear war. While that particular scenario has never been tested (thank Ghu!), faulting them for not thinking through every implication of every design choice doesn't do them justice. They still designed and built a system that just runs (partial network meltdowns are always due to economic reasons, not design). This was a truly remarkable achievement. It's especially true since we see systems in place that are essentially immune to the bulk of the common attack vectors in use today. It's not the original designers' fault that so many implementations are so badly broken. It's especially not the designers' fault that the single most dominant OS in use today is also the most porous.

For thos interested....

[UnidentifiedCoward]

The >Washington Post is so kind as to hide the identity of website from which they took the screenshots from which they referenced in the article can be easily located with a simple google search...

The software -- viewed by a reporter on one of the sites, which washingtonpost.com is not naming because it remains active -- displays detailed graphs showing the distribution of victims by country. At time of this publication, the site harboring Frost's information was receiving a stream of illicit data from a network of roughly 3,000 infected PCs mostly located in Spain, Germany and Britain.

Oh and here is a feature breakdown from a Russian bulletin board:

In English...

- Invisibility in system
- Implementstion of software FireWalls leak
- Implementation of Polymorthic algorithm
- Implementation of AV Software vulnerability: AV Bases Update Breaker
- Socks5 Proxy Server
- FTP Server
- KeyLogger
- Clipboard Logger
- Implementation of WebMoney Keeper leak: WebMoney Grabber
- Implementation of E-gold security system leak
- Protected Storage Grabber
- Far FTP, TotalCommander FTP, The Bat Passwords Grabber
- Sends logs/files to http server
- Web-based Remote Control
- Implementation of IE leak: Form Grabber
- Implementation of UK banks security system leak: Memorable Info Grabber (at this moment released implementation of 6 most popular UK banks security system leak, no screenshots, only text) (List of vulnerable banks)
- Implementation of DE Banks TAN Security System leak (included security test for 4 DE Banks) (List of vulnerable banks)
- SMS warning if new TAN detected for clients of Russian BeeLine GSM Mobile Operator

For those that care.... here is the site.

If you have half a clue you will figure out where to go from there.

Fight fire with fire

[Hoi Polloi]

I wonder why someone doesn't use these tools against the crooks. You say that isn't 100% legal? Many of the things our government (or major companies) does today aren't 100% legal either. Take one of these botnet tools and use it to knock out their websites, spy on their irc channels, flood them with bogus data, disable the spammers, use it to spread worms that fix holes and knock out malicious code on the botnet pcs. Fight fire with fire. Obviously law enforcement isn't going to come after you since they barely lift a finger against the crooks and most of these sites are overseas anyway.

Screenshots

[MCron]

For those who are interested, I managed to get a couple more images of this interface here and here.

Bonus points if anybody can figure out where the shots came from and shut them down.

They should see the cracking tools for Yahoo, etc

[BlueStrat]

Seriously, websites abound with cracking/booting/keylogging programs for Yahoo chat, and many other protocols, but for some reason, it seems there are more written for Yahoo chat. I'm not including IRC tools, as it seems to me to be a different class, mostly CLI tools.

  I'll sit in a Yahoo chatroom using gyach and FreeBSD, and I'll watch my pflog monitor and see dozens of scans, boot attempts, etc within a couple hours. (I love the chatroom "tough guys" that come in and threaten to "boot" me and "bluescreen" my PC..they get *really* frustrated when their little VB booter programs fall flat against a BSD box with a PF firewall and *nix chat client :D)

There are numerous chat "crews" that trade in "cracked" accounts/screen names. I've never had my account cracked, but I follow proper practice regarding passwords, which most don't.

I've had chatrooms I'm in fill up with an entire "crew" all trying simultaneously to "boot" me after one of their members fail. They finally tire and drift off with vague threats about cracking my account and having their "1337" friend ("..my buddy is certified by Microsoft, he'll crash your hard drive!" :D) hack my PC.

Anyways, back on topic, there are hundreds of very slick-looking cracking and booting programs available for Yahoo/AIM/MSN, most free (as in beer).

If there are programs just for *chat* that are this slick GUI-wise, it doesn't shock me at all that there are similarly-polished underground tools for other tasks and protocols.

Strat