why a System/domain needs a firewall?????????????
A firewall protects your computer by blocking unauthorized information. If a firewall blocked all the incoming and outgoing data, the computer would be unable to access the Internet. When you want some data to go through your firewall, and you want it sent to a specific location, you can set up port forwarding. Port forwarding gives the firewall instructions about which types of data are allowed and how they should be directed.
Thursday, December 9, 2010
PORT FORWARDING
Port forwarding is the process that your router or firewall uses to sort the right kind of network data to the right port. Computers and routers use ports as a way to organize network data. Different types of data, such as web sites, file downloads, and online games, are each assigned a port number. By using port forwarding, the router or firewall sends the correct data to the correct place.
Port forwarding, also known as tunneling, is basically forwarding a network port from one node to the other. This forwarding technique allows an outside user to access a certain port (in a LAN) through a NAT (network address translation) enabled router.
Advantages of Port Forwarding
Port forwarding basically allows an outside computer to connect to a computer in a private local area network. Some commonly done port forwarding includes forwarding port 21 for FTP access, and forwarding port 80 for web servers. To achieve such results, operating systems like the Mac OS X and the BSD (Berkeley Software Distribution) will use the pre-installed in the kernel, ipfirewall (ipfw), to conduct port forwarding. Linux on the other hand would add iptables to do port forwarding.
Downsides of Port Forwarding
There are a few downsides or precautions to take with port forwarding.
* Only one port can be used at a time by one machine.
* Port forwarding also allows any machine in the world to connect to the forwarded port at will, and thus making the network slightly insecure.
* The port forwarding technology itself is built in a way so that the destination machine will see the incoming packets as coming from the router rather than the original machine sending out the packets.
Port forwarding, also known as tunneling, is basically forwarding a network port from one node to the other. This forwarding technique allows an outside user to access a certain port (in a LAN) through a NAT (network address translation) enabled router.
Advantages of Port Forwarding
Port forwarding basically allows an outside computer to connect to a computer in a private local area network. Some commonly done port forwarding includes forwarding port 21 for FTP access, and forwarding port 80 for web servers. To achieve such results, operating systems like the Mac OS X and the BSD (Berkeley Software Distribution) will use the pre-installed in the kernel, ipfirewall (ipfw), to conduct port forwarding. Linux on the other hand would add iptables to do port forwarding.
Downsides of Port Forwarding
There are a few downsides or precautions to take with port forwarding.
* Only one port can be used at a time by one machine.
* Port forwarding also allows any machine in the world to connect to the forwarded port at will, and thus making the network slightly insecure.
* The port forwarding technology itself is built in a way so that the destination machine will see the incoming packets as coming from the router rather than the original machine sending out the packets.
Friday, November 19, 2010
Port scanning
Port scanning can uncover a number of holes that a hacker could use against you, we cover how to scan ports and more below.
TIP: To Scan your ports online (fast and free), take our free Firewall Test
Port Scanning is one of the most popular reconnaissance techniques attackers use to discover services they can break into. All machines connected to a Local Area Network (LAN) or Internet run many services that listen at well-known and not so well known ports. A port scan helps the attacker find which ports are available (i.e., what service might be listing to a port). Essentially, a port scan consists of sending a message to each port, one at a time. The kind of response received indicates whether the port is used and can therefore be probed further for weakness.
Can I take legal action against port scanning?
A Port scan is like ringing the doorbell to see whether someone’s at home. The police usually can’t do anything about it. They have to wait until a crime is committed. The police might give it more consideration if the doorbell is repeatedly rung causing the homeowner to complain of harassment. Sometimes, if a computer system is affected too much by a port scan, one can argue that the port scan was, in fact, a denial-of-service (DoS) attack, which is usually an offense.
The various techniques used in a port scan are summarized below.
Port Scan – Port Numbers
As you know, public IP addresses are controlled by worldwide registrars, and are unique globally. Port numbers are not so controlled, but over the decades certain ports have become standard for certain services. The port numbers are unique only within a computer system. Port numbers are 16-bit unsigned numbers.The port numbers are divided into three ranges:
* Well Known Ports (0 – 1023)
* Registered Ports (1024 – 49151)
* Dynamic and/or Private Ports (49152 – 65535)
Well-Known Ports
Ports numbered 0 to 1023 are considered well known (also called standard ports) and are assigned to services by the IANA (Internet Assigned Numbers Authority). Here are a few samples:
* echo – 7/tcp – Echo
* ftp-data – 20/udp – File Transfer [Default Data]
* ftp – 21/tcp – File Transfer [Control]
* ssh – 22/tcp – SSH Remote Login Protocol
* telnet – 23/tcp – Telnet
* domain – 53/udp – Domain Name Server
* www-http – 80/tcp – World Wide Web HTTP
Non-Standard Ports
By a non-standard port, we simply mean a port whose number is higher than 1023. In this range also, several services are “standard.” For example:
* wins – 1512/tcp # Microsoft Windows Internet Name Service
* radius 1812/udp # RADIUS authentication protocol
Some malicious programs such as Trojans and Viruses have spread so wide that there are a number of ports that if found open, usually indicate that a system may have a virus.
Port Scanning Basic Techniques
The simplest port scan tries (i.e., sends a carefully constructed packet with a chosen destination port number) each of the ports from 0 to 65535 on the victim to see which ones are open.
TCP connect():- The connect() system call provided by an OS is used to open a connection to every interesting port on the machine. If the port is listening, connect() will succeed, otherwise the port isn’t reachable.
Strobe -A strobe does a narrower scan, only looking for those services the attacker knows how to exploit. The name comes from one of the original TCP scanning programs, though now virtually all scanning tools include this feature.
The ident protocol allows for the disclosure of the username of the owner of any process connected via TCP, even if that process didn’t initiate the connection. So, e.g., one can connect to port 80 and then use identd to find out whether the HTTP server is running as root.
Port Scanning Advanced Techniques
One problem, from the perspective of the attacker attempting to scan a port, is that services listening on these ports log scans. They see an incoming connection, but no data, so an error is logged. There exist a number of stealth scan techniques to avoid this. A stealth scan is a kind of scan that is designed to go undetected by auditing tools. Obviously, this is a race between the hacker and firewall vendors – what are considered stealth scans now may not be so in a few months once the firewall vendor becomes aware of such techniques.
Port scanners scan a host rapidly by firing off packets at different ports. So, scanning very slowly (taking a day or more) becomes a stealth technique. Another stealth scanning technique is “inverse mapping”, where you try to find out all hosts on a network by generating “host unreachable” ICMP-messages for those IPs that do not exist. Since these messages may be generated by any TCP/IP packet one may send meaningless packets (e.g. RST packets sent without any previous packet).
Fragmented packet Port Scan
The scanner splits the TCP header into several IP fragments. This bypasses some packet filter firewalls because they cannot see a complete TCP header that can match their filter rules. Some packet filters and firewalls do queue all IP fragments, but many networks cannot afford the performance loss caused by the queuing.
SYN scan
This technique is also called half-open scanning, because a TCP connection is not completed. A SYN packet is sent (as if we are going to open a connection), and the target host responds with a SYN+ACK, this indicates the port is listening, and an RST indicates a non- listener. The server process is never informed by the TCP layer because the connection did not complete.
FIN scan
The typical TCP scan attempts to open connections (at least part way). Another technique sends erroneous packets at a port, expecting that open listening ports will send back different error messages than closed ports. The scanner sends a FIN packet, which should close a connection that is open. Closed ports reply to a FIN packet with a RST. Open ports, on the other hand, ignore the packet in question. This is required TCP behavior.
If no service is listening at the target port, the operating system will generate an error message. If a service is listening, the operating system will silently drop the incoming packet. Therefore, silence indicates the presence of a service at the port. However, since packets can be dropped accidentally on the wire or blocked by firewalls, this isn’t a very effective scan.
Other techniques that have been used consist of XMAS scans where all flags in the TCP packet are set, or NULL scans where none of the bits are set. However, different operating systems respond differently to these scans, and it becomes important to identify the OS and even its version and patch level.
Bounce Scan
The ability to hide their tracks is important to attackers. Therefore, attackers scour the Internet looking for systems they can bounce their attacks through.
FTP bounce scanning takes advantage of a vulnerability of the FTP protocol itself. It requires support for proxy ftp connections. This bouncing through an FTP server hides where the attacker comes from. This technique is similar to IP spoofing in that it hides where the attacker comes from. For example, badwebsitexyz.com establishes a control connection to the FTP server-PI (protocol interpreter) of say, badspiderbites.com, then requests that the server-PI initiate an active server-DTP (data transfer process) to send a file anywhere on the Internet.
A port scanner can exploit this to scan TCP ports from a proxy ftp server. Thus you could connect to an FTP server behind a firewall, and then scan ports that are more likely to be blocked (e.g., port 139). If the ftp server allows reading from and writing to a directory (such as /incoming), you can send arbitrary data to ports that you do find open.
The advantages to this approach are obvious (harder to trace, potential to bypass firewalls). The main disadvantages are that it is slow, and that many FTP server implementations have finally disabled the proxy “feature”.
Finger
Most finger servers allow commands to be forwarded through them. Finger supports recursive queries. A query such as “rob@foo@bar” will ask “bar” to resolve “rob@foo”, causing “bar” to query “foo”. This technique can be used to hide the original source of the request.
E-mail: Spammers try to relay their spam through SMTP servers. As a result, probes for SMTP are commonly seen by machines on the Internet.
SOCKS Allows almost any protocol to be tunneled through the intermediate machine. As a result, attackers probing for SOCKS is common scan seen on the Internet.
HTTP proxy: Most web servers support proxying so that all web traffic can be directed to a single server for filtering as well as caching to improve performance. A lot of these servers are misconfigured to allow proxying of any request from the Internet, allowing attackers to relay attacks against web sites through a third party. Probes for HTTP proxies are one of the more common scans seen today.
IRC BNC: Attackers love to hide their IRC identities by bouncing their connections through other machines. A particular program called “BNC” is used for this purpose on compromised machines.
UDP Scanning
Port scanning usually means scanning for TCP ports, which are connection-oriented and therefore give good feedback to the attacker. UDP responds in a different manner. In order to find UDP ports, the attacker generally sends empty UDP datagrams. If the port is listening, the service should send back an error message or ignore the incoming datagram. If the port is closed, then most operating systems send back an “ICMP Port Unreachable” message. Thus, you can find out if a port is NOT open, and by exclusion determine which ports are open. Neither UDP packets, nor the ICMP errors are guaranteed to arrive, so UDP scanners of this sort must also implement retransmission of packets that appear to be lost (or you will get a bunch of false positives).
Also, this scanning technique is slow because of compensation for machines that implement the suggestions of RFC 1812 and limit ICMP error message rate. For example, a kernal may limit destination unreachable message generation to 80 per 4 seconds, with a 1/4 second penalty if that is exceeded.
Some people think UDP scanning is pointless – not so. Sometimes for example, Rpcbind can be found hiding on an undocumented UDP port somewhere above 32770. So it doesn’t matter that port 111 is blocked by the firewall. But can you find which of the more than 30,000 high ports it is listening on? With a UDP scanner you can.
ICMP Scan
This isn’t really port scanning, since ICMP does not have a port abstraction. But it is sometimes useful to determine what hosts in a network are up by pinging them all. ICMP scanning can be done in parallel, so it can be quite fast.
Fingerprinting an OS:
The last scanning method is called Fingerprinting. Fingerprinting is the technique of interpreting the responses of a system in order to figure out what it is. Unusual combination’s of data are sent to the system in order to trigger these responses. Systems respond the same with correct data, but they rarely respond the same way for wrong data.
TIP: To Scan your ports online (fast and free), take our free Firewall Test
Port Scanning is one of the most popular reconnaissance techniques attackers use to discover services they can break into. All machines connected to a Local Area Network (LAN) or Internet run many services that listen at well-known and not so well known ports. A port scan helps the attacker find which ports are available (i.e., what service might be listing to a port). Essentially, a port scan consists of sending a message to each port, one at a time. The kind of response received indicates whether the port is used and can therefore be probed further for weakness.
Can I take legal action against port scanning?
A Port scan is like ringing the doorbell to see whether someone’s at home. The police usually can’t do anything about it. They have to wait until a crime is committed. The police might give it more consideration if the doorbell is repeatedly rung causing the homeowner to complain of harassment. Sometimes, if a computer system is affected too much by a port scan, one can argue that the port scan was, in fact, a denial-of-service (DoS) attack, which is usually an offense.
The various techniques used in a port scan are summarized below.
Port Scan – Port Numbers
As you know, public IP addresses are controlled by worldwide registrars, and are unique globally. Port numbers are not so controlled, but over the decades certain ports have become standard for certain services. The port numbers are unique only within a computer system. Port numbers are 16-bit unsigned numbers.The port numbers are divided into three ranges:
* Well Known Ports (0 – 1023)
* Registered Ports (1024 – 49151)
* Dynamic and/or Private Ports (49152 – 65535)
Well-Known Ports
Ports numbered 0 to 1023 are considered well known (also called standard ports) and are assigned to services by the IANA (Internet Assigned Numbers Authority). Here are a few samples:
* echo – 7/tcp – Echo
* ftp-data – 20/udp – File Transfer [Default Data]
* ftp – 21/tcp – File Transfer [Control]
* ssh – 22/tcp – SSH Remote Login Protocol
* telnet – 23/tcp – Telnet
* domain – 53/udp – Domain Name Server
* www-http – 80/tcp – World Wide Web HTTP
Non-Standard Ports
By a non-standard port, we simply mean a port whose number is higher than 1023. In this range also, several services are “standard.” For example:
* wins – 1512/tcp # Microsoft Windows Internet Name Service
* radius 1812/udp # RADIUS authentication protocol
Some malicious programs such as Trojans and Viruses have spread so wide that there are a number of ports that if found open, usually indicate that a system may have a virus.
Port Scanning Basic Techniques
The simplest port scan tries (i.e., sends a carefully constructed packet with a chosen destination port number) each of the ports from 0 to 65535 on the victim to see which ones are open.
TCP connect():- The connect() system call provided by an OS is used to open a connection to every interesting port on the machine. If the port is listening, connect() will succeed, otherwise the port isn’t reachable.
Strobe -A strobe does a narrower scan, only looking for those services the attacker knows how to exploit. The name comes from one of the original TCP scanning programs, though now virtually all scanning tools include this feature.
The ident protocol allows for the disclosure of the username of the owner of any process connected via TCP, even if that process didn’t initiate the connection. So, e.g., one can connect to port 80 and then use identd to find out whether the HTTP server is running as root.
Port Scanning Advanced Techniques
One problem, from the perspective of the attacker attempting to scan a port, is that services listening on these ports log scans. They see an incoming connection, but no data, so an error is logged. There exist a number of stealth scan techniques to avoid this. A stealth scan is a kind of scan that is designed to go undetected by auditing tools. Obviously, this is a race between the hacker and firewall vendors – what are considered stealth scans now may not be so in a few months once the firewall vendor becomes aware of such techniques.
Port scanners scan a host rapidly by firing off packets at different ports. So, scanning very slowly (taking a day or more) becomes a stealth technique. Another stealth scanning technique is “inverse mapping”, where you try to find out all hosts on a network by generating “host unreachable” ICMP-messages for those IPs that do not exist. Since these messages may be generated by any TCP/IP packet one may send meaningless packets (e.g. RST packets sent without any previous packet).
Fragmented packet Port Scan
The scanner splits the TCP header into several IP fragments. This bypasses some packet filter firewalls because they cannot see a complete TCP header that can match their filter rules. Some packet filters and firewalls do queue all IP fragments, but many networks cannot afford the performance loss caused by the queuing.
SYN scan
This technique is also called half-open scanning, because a TCP connection is not completed. A SYN packet is sent (as if we are going to open a connection), and the target host responds with a SYN+ACK, this indicates the port is listening, and an RST indicates a non- listener. The server process is never informed by the TCP layer because the connection did not complete.
FIN scan
The typical TCP scan attempts to open connections (at least part way). Another technique sends erroneous packets at a port, expecting that open listening ports will send back different error messages than closed ports. The scanner sends a FIN packet, which should close a connection that is open. Closed ports reply to a FIN packet with a RST. Open ports, on the other hand, ignore the packet in question. This is required TCP behavior.
If no service is listening at the target port, the operating system will generate an error message. If a service is listening, the operating system will silently drop the incoming packet. Therefore, silence indicates the presence of a service at the port. However, since packets can be dropped accidentally on the wire or blocked by firewalls, this isn’t a very effective scan.
Other techniques that have been used consist of XMAS scans where all flags in the TCP packet are set, or NULL scans where none of the bits are set. However, different operating systems respond differently to these scans, and it becomes important to identify the OS and even its version and patch level.
Bounce Scan
The ability to hide their tracks is important to attackers. Therefore, attackers scour the Internet looking for systems they can bounce their attacks through.
FTP bounce scanning takes advantage of a vulnerability of the FTP protocol itself. It requires support for proxy ftp connections. This bouncing through an FTP server hides where the attacker comes from. This technique is similar to IP spoofing in that it hides where the attacker comes from. For example, badwebsitexyz.com establishes a control connection to the FTP server-PI (protocol interpreter) of say, badspiderbites.com, then requests that the server-PI initiate an active server-DTP (data transfer process) to send a file anywhere on the Internet.
A port scanner can exploit this to scan TCP ports from a proxy ftp server. Thus you could connect to an FTP server behind a firewall, and then scan ports that are more likely to be blocked (e.g., port 139). If the ftp server allows reading from and writing to a directory (such as /incoming), you can send arbitrary data to ports that you do find open.
The advantages to this approach are obvious (harder to trace, potential to bypass firewalls). The main disadvantages are that it is slow, and that many FTP server implementations have finally disabled the proxy “feature”.
Finger
Most finger servers allow commands to be forwarded through them. Finger supports recursive queries. A query such as “rob@foo@bar” will ask “bar” to resolve “rob@foo”, causing “bar” to query “foo”. This technique can be used to hide the original source of the request.
E-mail: Spammers try to relay their spam through SMTP servers. As a result, probes for SMTP are commonly seen by machines on the Internet.
SOCKS Allows almost any protocol to be tunneled through the intermediate machine. As a result, attackers probing for SOCKS is common scan seen on the Internet.
HTTP proxy: Most web servers support proxying so that all web traffic can be directed to a single server for filtering as well as caching to improve performance. A lot of these servers are misconfigured to allow proxying of any request from the Internet, allowing attackers to relay attacks against web sites through a third party. Probes for HTTP proxies are one of the more common scans seen today.
IRC BNC: Attackers love to hide their IRC identities by bouncing their connections through other machines. A particular program called “BNC” is used for this purpose on compromised machines.
UDP Scanning
Port scanning usually means scanning for TCP ports, which are connection-oriented and therefore give good feedback to the attacker. UDP responds in a different manner. In order to find UDP ports, the attacker generally sends empty UDP datagrams. If the port is listening, the service should send back an error message or ignore the incoming datagram. If the port is closed, then most operating systems send back an “ICMP Port Unreachable” message. Thus, you can find out if a port is NOT open, and by exclusion determine which ports are open. Neither UDP packets, nor the ICMP errors are guaranteed to arrive, so UDP scanners of this sort must also implement retransmission of packets that appear to be lost (or you will get a bunch of false positives).
Also, this scanning technique is slow because of compensation for machines that implement the suggestions of RFC 1812 and limit ICMP error message rate. For example, a kernal may limit destination unreachable message generation to 80 per 4 seconds, with a 1/4 second penalty if that is exceeded.
Some people think UDP scanning is pointless – not so. Sometimes for example, Rpcbind can be found hiding on an undocumented UDP port somewhere above 32770. So it doesn’t matter that port 111 is blocked by the firewall. But can you find which of the more than 30,000 high ports it is listening on? With a UDP scanner you can.
ICMP Scan
This isn’t really port scanning, since ICMP does not have a port abstraction. But it is sometimes useful to determine what hosts in a network are up by pinging them all. ICMP scanning can be done in parallel, so it can be quite fast.
Fingerprinting an OS:
The last scanning method is called Fingerprinting. Fingerprinting is the technique of interpreting the responses of a system in order to figure out what it is. Unusual combination’s of data are sent to the system in order to trigger these responses. Systems respond the same with correct data, but they rarely respond the same way for wrong data.
Thursday, November 18, 2010
Firewall, Intrusion Detection System (IDS), Intrusion Protection System (IPS)
Firewall/VPN is a perimeter-defense device, typically deployed where the enterprise’s internal network meets the open Internet. The main purpose of the firewall is to stop unwanted traffic from entering or leaving the internal enterprise network. The purpose of the IPSec VPN is to provide secure communication between two sites through the open Internet.
The Intrusion System (IDS) is traditionally deployed to monitor traffic in vital segments in the network, generating alerts when an intrusion is detected. The importance of the IDS has grown significantly as the industry recognizes that 90 percent of attacks in recent years have exploited application vulnerabilities. The traditional stateful inspection firewall, based largely on matching packet header information against Access Control Lists (ACLs), is ineffective to fend off such attacks. A good IDS, on the other hand, can expose these application layer attacks.
But detection alone is insufficient—it is also important to terminate the attack upon detection. Hence, the trend is to evolve the IDS into an Intrusion Prevention System (IPS), which takes detection to the next level and stops the detected attacks, including application attacks.
In addition to the IDS/IPS, application content security arsenal in an enterprise may also include antivirus, anti-spam and content filtering devices.
Sunday, November 14, 2010
SSH (a prolonged SSL)
SSH Connection Methods
Several things can happen when using SSH to
connect from your machine (client) to another
machine (server):
Server's public host key is passed back to the client
and verified against known_hosts
Password prompt is used if public key is accepted,
or already on client, or
RSA/DSA key exchange takes place and you must
enter in your private key passphrase to
authenticate (assuming you have one).
SSH Quick Tips
You have a choice of authentication keys - RSA
is the default (dsa is fine as well).
The files you care about are:
/etc/ssh/ssh_config
/etc/ssh/sshd_config
~/.ssh/identity and identity.pub (deprecated)
~/.ssh/id_dsa and id_dsa.pub
~/.ssh/id_rsa and id_rsa.pub
~/.ssh/known_hosts
~/.ssh/authorized_keys
And, note the rsa/dsa host-wide key files in /etc/ssh
Be sure that you do “man ssh” and “man sshd”
and read the entire descriptions for both the
ssh client and ssh server (sshd).
SSH Authentication
Private key can be protected by a passphrase
So you have to give it each time you log in
Or use "ssh-agent" which holds a copy of your
passphrase in RAM
No need to change passwords across dozens of
machines
Disable passwords entirely!
/etc/ssh/sshd_config
Annoyingly, for historical reasons there are
*three* different types of SSH keys
SSH1 RSA, SSH2 DSA, SSH2 RSA
Man in the Middle Attacks
The first time you connect to a remote host,
remember its public key
Stored in ~/.ssh/known_hosts
The next time you connect, if the remote key is
different, then maybe an attacker is
intercepting the connection!
Or maybe the remote host has just got a new
key, e.g. after a reinstall. But it's up to you to
resolve the problem
You will be warned if the key changes.
Exchanging Host Keys
First time connecting with ssh:
ssh t1@pc1.t1.ws.sanog.org
The authenticity of host 'pc1.t1.ws.sanog.org (84.201.31.11)' can't be
established.
DSA key fingerprint is 91:ba:bf:e4:36:cd:e3:9e:8e:92:26:e4:57:c4:cb:da.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'pc1.t1.ws.sanog.org,84.201.31.11' (DSA) to
the list of known hosts.
t1@pc1.t1.ws.sanog.org's password:
At this point the client has in the file ~/.ssh/known_hosts the contents
of pc1.t1.ws.sanog.org's /etc/ssh/ssh_host_dsa_key.pub.
Next connection:
[hallen@hallen-lt .ssh]$ ssh t1@pc1.t1.ws.sanog.org
t1@pc1.t1.ws.sanog.org's password:
Now trusted - Not necessarily a good thing...
Exchanging Host Keys Cont.
Command Key Type Generated Public File
ssh-keygen -t rsa RSA (SSH protocol 2) id_rsa.pub
ssh-keygen -t dsa DSA (SSH protocol 2) id_dsa.pub
- Default key size is 1024 bits
- Public files are text
- Private files are encrypted if you use a
passphrase (still text)
Corresponding file on the host for host key
exchange is known_hosts
How does SSH decide what files to compare?
Look in /etc/ssh/sshd_config. For OpenSSH
version 2 and 3 the server defaults to protocol 2
then 1. Recommend turning of version 1.
By default OpenSSH version 2 client connects
in this order:
RSA version 2 key
DSA version 2 key
Password based authentication (even if RSA
version 1 key is present)
Pay attention to the “HostKeyAlgorithms” setting in /etc/ssh/ssh_config to
help determine this order - or use ssh command line switches to override
these settings.
Several things can happen when using SSH to
connect from your machine (client) to another
machine (server):
Server's public host key is passed back to the client
and verified against known_hosts
Password prompt is used if public key is accepted,
or already on client, or
RSA/DSA key exchange takes place and you must
enter in your private key passphrase to
authenticate (assuming you have one).
SSH Quick Tips
You have a choice of authentication keys - RSA
is the default (dsa is fine as well).
The files you care about are:
/etc/ssh/ssh_config
/etc/ssh/sshd_config
~/.ssh/identity and identity.pub (deprecated)
~/.ssh/id_dsa and id_dsa.pub
~/.ssh/id_rsa and id_rsa.pub
~/.ssh/known_hosts
~/.ssh/authorized_keys
And, note the rsa/dsa host-wide key files in /etc/ssh
Be sure that you do “man ssh” and “man sshd”
and read the entire descriptions for both the
ssh client and ssh server (sshd).
SSH Authentication
Private key can be protected by a passphrase
So you have to give it each time you log in
Or use "ssh-agent" which holds a copy of your
passphrase in RAM
No need to change passwords across dozens of
machines
Disable passwords entirely!
/etc/ssh/sshd_config
Annoyingly, for historical reasons there are
*three* different types of SSH keys
SSH1 RSA, SSH2 DSA, SSH2 RSA
Man in the Middle Attacks
The first time you connect to a remote host,
remember its public key
Stored in ~/.ssh/known_hosts
The next time you connect, if the remote key is
different, then maybe an attacker is
intercepting the connection!
Or maybe the remote host has just got a new
key, e.g. after a reinstall. But it's up to you to
resolve the problem
You will be warned if the key changes.
Exchanging Host Keys
First time connecting with ssh:
ssh t1@pc1.t1.ws.sanog.org
The authenticity of host 'pc1.t1.ws.sanog.org (84.201.31.11)' can't be
established.
DSA key fingerprint is 91:ba:bf:e4:36:cd:e3:9e:8e:92:26:e4:57:c4:cb:da.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'pc1.t1.ws.sanog.org,84.201.31.11' (DSA) to
the list of known hosts.
t1@pc1.t1.ws.sanog.org's password:
At this point the client has in the file ~/.ssh/known_hosts the contents
of pc1.t1.ws.sanog.org's /etc/ssh/ssh_host_dsa_key.pub.
Next connection:
[hallen@hallen-lt .ssh]$ ssh t1@pc1.t1.ws.sanog.org
t1@pc1.t1.ws.sanog.org's password:
Now trusted - Not necessarily a good thing...
Exchanging Host Keys Cont.
Command Key Type Generated Public File
ssh-keygen -t rsa RSA (SSH protocol 2) id_rsa.pub
ssh-keygen -t dsa DSA (SSH protocol 2) id_dsa.pub
- Default key size is 1024 bits
- Public files are text
- Private files are encrypted if you use a
passphrase (still text)
Corresponding file on the host for host key
exchange is known_hosts
How does SSH decide what files to compare?
Look in /etc/ssh/sshd_config. For OpenSSH
version 2 and 3 the server defaults to protocol 2
then 1. Recommend turning of version 1.
By default OpenSSH version 2 client connects
in this order:
RSA version 2 key
DSA version 2 key
Password based authentication (even if RSA
version 1 key is present)
Pay attention to the “HostKeyAlgorithms” setting in /etc/ssh/ssh_config to
help determine this order - or use ssh command line switches to override
these settings.
Saturday, September 11, 2010
NETWORK SECURITY ALGORITHM
DSA
This digital signature algorithm (DSA) is used for generating digital signatures in digital certificates. Only someone who has a public-private key pair can generate a digital signature.
A digital signature consists of two integers, called ‘s’ (signature) and ‘r’ (verification), which are sent to the client for authentication. These integers are generated from several random integers.
First two prime integer numbers ‘p’ and ‘q’ are taken. Then two random integers ‘h’ and ‘k’ are selected from these. Here ‘h’ is in the range of 1 and p-1, while ‘k’ is a value greater than 0 and less than ‘q’. Subsequently, another value ‘g’ is calculated using ‘h’, ‘p’ and ‘q’. Finally, ‘r’ is calculated using ‘g’, ‘p’ and ‘q’.
For generating ‘s’, first a random message ‘m’ is created. Then its hash is calculated using a hashing algorithm like MD5. Finally, ‘s’ is generated using ‘k’, the hashed message, private key, ‘r’ and ‘q’.
The digital signature along with ‘p’, ‘q’ and ‘g’ is sent to the client for verifying its identity. The hashing algorithm used, the message ‘m’ and the public key are also sent. On the client side the message ‘m’ is first subjected to the hashing algorithm. Then a value ‘v’ (called verifier) is calculated from this hashed message, ‘s’, ‘p’, ‘q’, and the public key. Now if ‘v’ is equal to ‘r’, then the digital signature is verified.
MD5
MD5 (Message Digest) is a hashing algorithm used in generating digital signatures. The output of MD5 is a message digest, which can be used to authenticate the owner of a private key.
The MD5 algorithm takes a message and checks whether it’s size is 448-bits. If it’s not, then it pads it with extra bits. Then it again takes the original message and converts it to 64 bits. These are then added to the 448 bits to give a block of 512 bits. This block is then broken into 32, 16-bit message blocks. A loop is started in which each of the 32 blocks are processed. Outside this loop, four separate 32-bit variables—A, B, C, and D—of standard values are taken. Then the values of these four variables—A, B, C, D—are copied to four different variables say a, b, c, and d. Next, within the loop new values are calculated for a, b, c, and d using the 16-bit blocks and the a, b, c, and d values themselves. A different equation is used for each of these four variables. Now A, B, C, and D are incremented with the new values of a, b, c, and d.
Finally A, B, C, and D totaling to 128 bits (32x4) is the hash calculated, which is also called a message digest.
Encryption
Broadly speaking there are two encryption techniques—symmetric and asymmetric—used for secure communication. In symmetric encryption, the same key is used for both encryption as well as decryption. This is known as the private key. Consider two parties, A and B, wanting to engage in an encrypted communication. Party A generates a private key and sends its copy to party B. Hence both parties use this key to encrypt as well as decrypt messages.
In asymmetric encryption, party A generates a public-private key pair, and sends just the public key to party B. When B wants to send a secret message to A, it encrypts the message using A’s public key. When A receives this encrypted message, it can only decrypt it with its corresponding private key. Similarly, the reverse can also happen. This procedure is also known as PKI or Public Key Infrastructure.
RSA
RSA, which is named after its developers (Rivest, Shamir, Adleman), is an asymmetric or public key algorithm. In this, the public-private key pair has a fixed length in bits, which can be decided at the time of their generation like 512, 768, 1,024, 2,096, with higher numbers corresponding to stronger encryption. When the public key is generated, it consists of the key size and a positive integer called public exponent, which has some typical standard values. The private key when generated includes these two along with a private exponent and two prime numbers. The two prime numbers are derived such that their product is equal to the key size. In RSA, key size is the same for both keys. The private exponent in the private key is calculated from the public exponent and the two prime numbers.
Once the keys have been generated, they are ready for encrypting or decrypting data or message. The number of bits in the message being encrypted must be less than or equal to the key size. If not, the message is broken into separate blocks and then encrypted. If the message size is smaller than the key size then some extra bits are padded to the message.
The encrypted message is created using the original message itself, public exponent, and the key size information in the public key. When the encrypted message is received on the other end, the private exponent and the key size is used to decrypt it. Since the private exponent is calculated using the public exponent, only the correct private key can decrypt the message. The encryption and decryption of the message requires a lot of exponential calculations. So RSA or as such public key encryption is slow.
DES
The Data Encryption Standard (DES) is a block cipher (a form of shared secret encryption) that was selected by the National Bureau of Standards as an official Federal Information Processing Standard (FIPS) for the United States in 1976 and which has subsequently enjoyed widespread use internationally. It is based on a symmetric-key algorithm that uses a 56-bit key. The algorithm was initially controversial with classified design elements, a relatively short key length, and suspicions about a National Security Agency (NSA) backdoor. DES consequently came under intense academic scrutiny which motivated the modern understanding of block ciphers and their cryptanalysis.
This digital signature algorithm (DSA) is used for generating digital signatures in digital certificates. Only someone who has a public-private key pair can generate a digital signature.
A digital signature consists of two integers, called ‘s’ (signature) and ‘r’ (verification), which are sent to the client for authentication. These integers are generated from several random integers.
First two prime integer numbers ‘p’ and ‘q’ are taken. Then two random integers ‘h’ and ‘k’ are selected from these. Here ‘h’ is in the range of 1 and p-1, while ‘k’ is a value greater than 0 and less than ‘q’. Subsequently, another value ‘g’ is calculated using ‘h’, ‘p’ and ‘q’. Finally, ‘r’ is calculated using ‘g’, ‘p’ and ‘q’.
For generating ‘s’, first a random message ‘m’ is created. Then its hash is calculated using a hashing algorithm like MD5. Finally, ‘s’ is generated using ‘k’, the hashed message, private key, ‘r’ and ‘q’.
The digital signature along with ‘p’, ‘q’ and ‘g’ is sent to the client for verifying its identity. The hashing algorithm used, the message ‘m’ and the public key are also sent. On the client side the message ‘m’ is first subjected to the hashing algorithm. Then a value ‘v’ (called verifier) is calculated from this hashed message, ‘s’, ‘p’, ‘q’, and the public key. Now if ‘v’ is equal to ‘r’, then the digital signature is verified.
MD5
MD5 (Message Digest) is a hashing algorithm used in generating digital signatures. The output of MD5 is a message digest, which can be used to authenticate the owner of a private key.
The MD5 algorithm takes a message and checks whether it’s size is 448-bits. If it’s not, then it pads it with extra bits. Then it again takes the original message and converts it to 64 bits. These are then added to the 448 bits to give a block of 512 bits. This block is then broken into 32, 16-bit message blocks. A loop is started in which each of the 32 blocks are processed. Outside this loop, four separate 32-bit variables—A, B, C, and D—of standard values are taken. Then the values of these four variables—A, B, C, D—are copied to four different variables say a, b, c, and d. Next, within the loop new values are calculated for a, b, c, and d using the 16-bit blocks and the a, b, c, and d values themselves. A different equation is used for each of these four variables. Now A, B, C, and D are incremented with the new values of a, b, c, and d.
Finally A, B, C, and D totaling to 128 bits (32x4) is the hash calculated, which is also called a message digest.
Encryption
Broadly speaking there are two encryption techniques—symmetric and asymmetric—used for secure communication. In symmetric encryption, the same key is used for both encryption as well as decryption. This is known as the private key. Consider two parties, A and B, wanting to engage in an encrypted communication. Party A generates a private key and sends its copy to party B. Hence both parties use this key to encrypt as well as decrypt messages.
In asymmetric encryption, party A generates a public-private key pair, and sends just the public key to party B. When B wants to send a secret message to A, it encrypts the message using A’s public key. When A receives this encrypted message, it can only decrypt it with its corresponding private key. Similarly, the reverse can also happen. This procedure is also known as PKI or Public Key Infrastructure.
RSA
RSA, which is named after its developers (Rivest, Shamir, Adleman), is an asymmetric or public key algorithm. In this, the public-private key pair has a fixed length in bits, which can be decided at the time of their generation like 512, 768, 1,024, 2,096, with higher numbers corresponding to stronger encryption. When the public key is generated, it consists of the key size and a positive integer called public exponent, which has some typical standard values. The private key when generated includes these two along with a private exponent and two prime numbers. The two prime numbers are derived such that their product is equal to the key size. In RSA, key size is the same for both keys. The private exponent in the private key is calculated from the public exponent and the two prime numbers.
Once the keys have been generated, they are ready for encrypting or decrypting data or message. The number of bits in the message being encrypted must be less than or equal to the key size. If not, the message is broken into separate blocks and then encrypted. If the message size is smaller than the key size then some extra bits are padded to the message.
The encrypted message is created using the original message itself, public exponent, and the key size information in the public key. When the encrypted message is received on the other end, the private exponent and the key size is used to decrypt it. Since the private exponent is calculated using the public exponent, only the correct private key can decrypt the message. The encryption and decryption of the message requires a lot of exponential calculations. So RSA or as such public key encryption is slow.
DES
The Data Encryption Standard (DES) is a block cipher (a form of shared secret encryption) that was selected by the National Bureau of Standards as an official Federal Information Processing Standard (FIPS) for the United States in 1976 and which has subsequently enjoyed widespread use internationally. It is based on a symmetric-key algorithm that uses a 56-bit key. The algorithm was initially controversial with classified design elements, a relatively short key length, and suspicions about a National Security Agency (NSA) backdoor. DES consequently came under intense academic scrutiny which motivated the modern understanding of block ciphers and their cryptanalysis.
Tuesday, August 24, 2010
URL Shortening Services
Spammers Abusing URL Shortening Services
We've previously warned about the dangers of following "Tiny URLs" on Twitter. With only 140 characters to use in your message, many Twitterers use URL shortening services to save their precious characters. Unfortunately, for most people you have no idea where that click is going to take you until you click on it and get forwarded by the URL shortening service. Its a bit like playing Russian roulette. Click the shortened URLs, and you may get informative news stories, insightful blog articles, pornography, or a new virus!
At the UAB Spam Data Mine we've seen a few of these Tiny URLs used in spam, but now we have our first major campaign that is exploiting them in a highly organized way.
aafter.us
bit.ly
is.gd
jh.to
jtty.com
myurl.in
o.ly
phaze.me
sturly.com
tcbp.net
tlink.me
urltwitter.com
So far we've seen almost a thousand of these spam messages, and have encountered 453 unique URLs at this point. Here are the subjects that are being used in this spam campaign:
Subject: $10 free deposit
Subject: $5000 Jackpot waiting for you!
Subject: 200% bonus on every deposit
Subject: 75 and 90 Ball Bingo
Subject: Become A Bingo Hustler
Subject: Become A Winner Today
Subject: Become A Winner With Bingo
Subject: b-i-n-g-o for you!
Subject: Bingo has never been easier.
Subject: Bing-o Was Her Name-o
Subject: Do you like to play bingo online?
Subject: Enjoy Bingo Online
Subject: Ever wanted to play Bingo for Cash ?
Subject: Gamble online? Read me!
Subject: Gamble With Bingo
Subject: Gamble? Like to play online?
Subject: Hot 9-Real SLot Machines! $25,000 Jackpot
Subject: Hustle Online. Play Bingo.
Subject: Like Bingo? Win $
Subject: Nickel, Dime, Quarter, & High Roller Games!
Subject: Nightly Events for CASH Prizes
Subject: Online diplomas here.
Subject: Play Bing0 Online
Subject: Play Bingo Now
Subject: Play Bingo Today
Subject: play online
Subject: Play Online Now
Subject: Play Online, Win Today
Subject: Someone has invited you to a game of Bingo
Subject: Something For You. Play Online.
Subject: Vehicle Warranty - 60% off
Subject: Want to play bingo online and win CASH ?
Subject: Win With Bingo
Subject: You have been invited to a Bingo game!
We see this campaign as a dangerous precedence which could be followed by other spammers to make our efforts to block their spam more difficult. As one would expect, the spammer, in addition to cheating the affiliate program, and offering "probably illegal" gambling to his email recipients, is delivering his spam message through a world-wide botnet of compromised computers. Just in our spam samples, we have spam for this campaign sent from 698 different computers in 43 different countries around the world.
Afrinic countries of CI, MA, SD, ZA
APNIC countries of BD, HK, ID, IN, JP, KR, PK, TH, TW, VN
ARIN countries of US (only 6 machines)
LACNIC countries of AR, BR, CL, CO, MX, SV, VE
RIPENCC countries of AM, AZ, BY, DE, EU, GR, HR, HU, IL, IQ, IR, IT, KZ, MD, PL, PT, RO, RS, RU, UA, UZ
Despite a broad smattering of countries, 43% of our spam came from Brazil, 20% from Russia, 13% from the Ukraine, 7% from India, and 2% from Italy. No other country represented more than 1% of the spam we received in this campaign.
Here are the URLs that we have seen so far in this campaign:
http://aafter.us/0oysiA
http://aafter.us/15Exas
http://aafter.us/3d3V9e
http://aafter.us/459UeB
http://aafter.us/4fOecg
http://aafter.us/4R2udg
http://aafter.us/4YzvqA
http://aafter.us/6DvEsN
http://aafter.us/78Lj60
http://aafter.us/9GQEkZ
http://aafter.us/9TOYVb
http://aafter.us/A4Oc0S
http://aafter.us/AxwsYK
http://aafter.us/b9rkEe
http://aafter.us/bezEO3
http://aafter.us/BIyffd
http://aafter.us/ckqW55
http://aafter.us/cyHq06
http://aafter.us/D8kzvt
http://aafter.us/DBYJNk
http://aafter.us/dpJxBc
http://aafter.us/ew7332
http://aafter.us/FIDLQs
http://aafter.us/FJLPyM
http://aafter.us/fTJDW4
http://aafter.us/jptgOx
http://aafter.us/JwmKyP
http://aafter.us/jYg3j6
http://aafter.us/kdOH1o
http://aafter.us/knACii
http://aafter.us/motFQJ
http://aafter.us/n8quI5
http://aafter.us/N8U0Bq
http://aafter.us/P8o6Kn
http://aafter.us/PI3BvT
http://aafter.us/qDDkB6
http://aafter.us/QfSfkf
http://aafter.us/RH3z2F
http://aafter.us/rNqm6H
http://aafter.us/sEwQMU
http://aafter.us/siykT5
http://aafter.us/sY6RN1
http://aafter.us/TXgsXd
http://aafter.us/UxbBYV
http://aafter.us/vcmHnv
http://aafter.us/XwUWd3
http://aafter.us/YP4zHn
http://aafter.us/YUXbB4
http://aafter.us/ZjUAOw
http://bit.ly/10VJRX
http://bit.ly/11oYQ8
http://bit.ly/14egZi
http://bit.ly/15piKn
http://bit.ly/16aOsd
http://bit.ly/16iqi3
http://bit.ly/16temb
http://bit.ly/19AQlF
http://bit.ly/37LQeX
http://bit.ly/4mrqW9
http://bit.ly/8Tbvz
http://bit.ly/9K5r5
http://bit.ly/B0S1U
http://bit.ly/b3JyJ
http://bit.ly/E7hiD
http://bit.ly/eBlww
http://bit.ly/Ex5GL
http://bit.ly/EzZV4
http://bit.ly/FIolK
http://bit.ly/gj9Py
http://bit.ly/gQxNZ
http://bit.ly/ih7Di
http://bit.ly/iwdpY
http://bit.ly/joj8y
http://bit.ly/lhPp7
http://bit.ly/MOXP7
http://bit.ly/N3iVs
http://bit.ly/Q4XY0
http://bit.ly/q7EwA
http://bit.ly/RWnFc
http://bit.ly/tdLyV
http://bit.ly/TEXC4
http://bit.ly/tSW62
http://bit.ly/ttrZ5
http://bit.ly/tvZ0h
http://bit.ly/V2q7R
http://bit.ly/Ve1jJ
http://bit.ly/VI7n6
http://bit.ly/Vs7Tb
http://bit.ly/xiUSr
http://bit.ly/xJEcE
http://bit.ly/xjIii
http://bit.ly/YdVa5
http://is.gd/1xL2e
http://is.gd/1xL2f
http://is.gd/1xL2g
http://is.gd/1xL2h
http://is.gd/1xL2i
http://is.gd/1xL2k
http://is.gd/1xL4B
http://is.gd/1xL4E
http://is.gd/1xL4F
http://is.gd/1xL4G
http://is.gd/1xL4L
http://is.gd/1xL6e
http://is.gd/1xL6m
http://is.gd/1xL6o
http://is.gd/1xL6r
http://is.gd/1xL6u
http://is.gd/1xL6z
http://is.gd/1xL8H
http://is.gd/1xL8t
http://is.gd/1xLaB
http://is.gd/1xLaE
http://is.gd/1xLaK
http://is.gd/1xLaO
http://is.gd/1xLaP
http://is.gd/1xLaW
http://is.gd/1xLcS
http://is.gd/1xLdc
http://is.gd/1xLdg
http://is.gd/1xLdh
http://is.gd/1xLdi
http://is.gd/1xLeX
http://is.gd/1xLff
http://is.gd/1xLfG
http://is.gd/1xLfx
http://jh.to/1obuti
http://jh.to/3ulofu
http://jh.to/4alo9u
http://jh.to/4u0axo
http://jh.to/4u9o8u
http://jh.to/5ayoja
http://jh.to/9eyisi
http://jh.to/9i8ika
http://jh.to/do0eba
http://jh.to/do9ihu
http://jh.to/ha6e0u
http://jh.to/je2a9e
http://jh.to/le8iha
http://jh.to/li3iju
http://jh.to/lozi1i
http://jh.to/rokoye
http://jh.to/vetagi
http://jh.to/xu5onu
http://jh.to/yekife
http://jh.to/yilizo
http://jh.to/zeximo
http://jtty.com/05i
http://jtty.com/0g8k
http://jtty.com/640z
http://jtty.com/6g0
http://jtty.com/90jm
http://jtty.com/aeuw
http://jtty.com/afn2
http://jtty.com/alr9
http://jtty.com/bhsv
http://jtty.com/cgt2
http://jtty.com/clx8
http://jtty.com/cn69
http://jtty.com/dhs9
http://jtty.com/dqr6
http://jtty.com/e2b0
http://jtty.com/e589
http://jtty.com/ehlm
http://jtty.com/ejn3
http://jtty.com/ely7
http://jtty.com/eu27
http://jtty.com/fruy
http://jtty.com/gkot
http://jtty.com/hklq
http://jtty.com/htx3
http://jtty.com/ilq3
http://jtty.com/ilw4
http://jtty.com/ix12
http://jtty.com/ixz6
http://jtty.com/jk17
http://jtty.com/knwz
http://jtty.com/lw56
http://jtty.com/lwz2
http://jtty.com/nrz1
http://jtty.com/ouxz
http://jtty.com/rsv9
http://jtty.com/tyz6
http://jtty.com/tz68
http://jtty.com/vyz2
http://jtty.com/wpz0
http://jtty.com/wt0h
http://jtty.com/y0q3
http://myurl.in/2SA9A
http://myurl.in/3Kgq3
http://myurl.in/3txkM
http://myurl.in/50WTX
http://myurl.in/6MUXd
http://myurl.in/6rP1t
http://myurl.in/8m00V
http://myurl.in/8QnMd
http://myurl.in/9ml8L
http://myurl.in/AhDeA
http://myurl.in/AKF1g
http://myurl.in/AMJBY
http://myurl.in/BCD7U
http://myurl.in/BM1RA
http://myurl.in/CcSAD
http://myurl.in/cooWR
http://myurl.in/drm2U
http://myurl.in/e0LIu
http://myurl.in/EcZlr
http://myurl.in/Ezbrh
http://myurl.in/Fk2Qs
http://myurl.in/H6xsv
http://myurl.in/HbY51
http://myurl.in/HiUfB
http://myurl.in/ivqVE
http://myurl.in/kr0Xn
http://myurl.in/L62hH
http://myurl.in/LUk5g
http://myurl.in/NWsMe
http://myurl.in/oa5Zo
http://myurl.in/Oq8Jj
http://myurl.in/pWVr8
http://myurl.in/q6qsq
http://myurl.in/rhChK
http://myurl.in/th2Gr
http://myurl.in/TSR8k
http://myurl.in/u8jyb
http://myurl.in/UzmYY
http://myurl.in/vppYC
http://myurl.in/wZoeF
http://myurl.in/XAj2y
http://myurl.in/xIIll
http://myurl.in/Y2Dc7
http://myurl.in/YbCtF
http://myurl.in/YG2Ny
http://myurl.in/yl4s2
http://myurl.in/yxj2l
http://o.ly/qT1
http://o.ly/qT3
http://o.ly/qT4
http://o.ly/qT5
http://o.ly/qT6
http://o.ly/qT7
http://o.ly/qT8
http://o.ly/qT9
http://o.ly/qTA
http://o.ly/qTb
http://o.ly/qTC
http://o.ly/qTH
http://o.ly/qTJ
http://o.ly/qTK
http://o.ly/qTm
http://o.ly/qTn
http://o.ly/qTO
http://o.ly/qTR
http://o.ly/qTS
http://o.ly/qTU
http://o.ly/qTV
http://o.ly/qTW
http://o.ly/qTX
http://o.ly/qYF
http://o.ly/qYh
http://o.ly/qYi
http://o.ly/qYm
http://o.ly/qYn
http://o.ly/qYo
http://o.ly/qYp
http://o.ly/qYq
http://o.ly/qYS
http://o.ly/qYt
http://o.ly/qYv
http://o.ly/qYw
http://o.ly/qYx
http://o.ly/qYy
http://phaze.me/0994
http://phaze.me/0cjw
http://phaze.me/0r08
http://phaze.me/11c7
http://phaze.me/1j84
http://phaze.me/1jy4
http://phaze.me/2dsc
http://phaze.me/2s08
http://phaze.me/2tq6
http://phaze.me/2xzx
http://phaze.me/3k5z
http://phaze.me/3r3k
http://phaze.me/3trj
http://phaze.me/3v4x
http://phaze.me/4kdb
http://phaze.me/4q59
http://phaze.me/5314
http://phaze.me/5jb1
http://phaze.me/6gjq
http://phaze.me/6n6p
http://phaze.me/836x
http://phaze.me/ckyd
http://phaze.me/d4nf
http://phaze.me/dj19
http://phaze.me/ffrn
http://phaze.me/fn86
http://phaze.me/g30w
http://phaze.me/g68v
http://phaze.me/gm36
http://phaze.me/hwjf
http://phaze.me/jh88
http://phaze.me/jrny
http://phaze.me/k12t
http://phaze.me/m9b6
http://phaze.me/nq7c
http://phaze.me/nt1x
http://phaze.me/nz1b
http://phaze.me/p0q0
http://phaze.me/pkkt
http://phaze.me/rm2y
http://phaze.me/t4wq
http://phaze.me/tqn0
http://phaze.me/v1b0
http://phaze.me/vm98
http://phaze.me/vmtm
http://phaze.me/vqqw
http://phaze.me/w736
http://phaze.me/xptc
http://phaze.me/yqnd
http://phaze.me/zh2v
http://sturly.com/aal0
http://sturly.com/aal1
http://sturly.com/aal2
http://sturly.com/aal5
http://sturly.com/aal6
http://sturly.com/aalm
http://sturly.com/aalq
http://sturly.com/aalr
http://sturly.com/aals
http://sturly.com/aalv
http://sturly.com/aalw
http://sturly.com/aalx
http://sturly.com/aaly
http://sturly.com/aalz
http://sturly.com/aama
http://sturly.com/aamb
http://sturly.com/aamc
http://sturly.com/aame
http://sturly.com/aamf
http://sturly.com/aamg
http://sturly.com/aamh
http://sturly.com/aami
http://sturly.com/aamk
http://sturly.com/aaml
http://sturly.com/aams
http://sturly.com/aamu
http://tcbp.net/s9
http://tcbp.net/sa
http://tcbp.net/sB
http://tcbp.net/sc
http://tcbp.net/sd
http://tcbp.net/sE
http://tcbp.net/sF
http://tcbp.net/sg
http://tcbp.net/sh
http://tcbp.net/sI
http://tcbp.net/sj
http://tcbp.net/sk
http://tcbp.net/sl
http://tcbp.net/sN
http://tcbp.net/sQ
http://tcbp.net/sS
http://tcbp.net/st
http://tcbp.net/sW
http://tcbp.net/sX
http://tcbp.net/sY
http://tcbp.net/t0
http://tcbp.net/t2
http://tcbp.net/t3
http://tcbp.net/t5
http://tcbp.net/t7
http://tcbp.net/t8
http://tcbp.net/t9
http://tcbp.net/ta
http://tcbp.net/tb
http://tcbp.net/tc
http://tcbp.net/te
http://tcbp.net/ti
http://tcbp.net/tj
http://tcbp.net/tk
http://tlink.me/1499
http://tlink.me/1500
http://tlink.me/1501
http://tlink.me/1502
http://tlink.me/1503
http://tlink.me/1504
http://tlink.me/1505
http://tlink.me/1507
http://tlink.me/1508
http://tlink.me/1510
http://tlink.me/1514
http://tlink.me/1515
http://tlink.me/1516
http://tlink.me/1517
http://tlink.me/1518
http://tlink.me/1519
http://tlink.me/1520
http://tlink.me/1525
http://tlink.me/1526
http://tlink.me/1527
http://tlink.me/1529
http://tlink.me/1530
http://tlink.me/1532
http://tlink.me/1533
http://tlink.me/1534
http://tlink.me/1537
http://tlink.me/1538
http://tlink.me/1540
http://tlink.me/1542
http://tlink.me/1543
http://tlink.me/1545
http://tlink.me/1549
http://tlink.me/1550
http://tlink.me/1554
http://tlink.me/1555
http://tlink.me/1557
http://tlink.me/1560
http://tlink.me/1563
http://tlink.me/1564
http://tlink.me/1565
http://tlink.me/1566
http://tlink.me/1567
http://tlink.me/1569
http://tlink.me/1570
http://tlink.me/1571
http://tlink.me/1572
http://tlink.me/1573
http://tlink.me/1574
http://tlink.me/1575
http://tlink.me/1576
http://urltwitter.com/1ipevu
http://urltwitter.com/2i7isa
http://urltwitter.com/4aza2o
http://urltwitter.com/4otifu
http://urltwitter.com/5ireri
http://urltwitter.com/6eyoco
http://urltwitter.com/6i3eko
http://urltwitter.com/bi3e7o
http://urltwitter.com/bixaso
http://urltwitter.com/fale2e
http://urltwitter.com/gu3eto
http://urltwitter.com/jafabu
http://urltwitter.com/jarewa
http://urltwitter.com/kedopu
http://urltwitter.com/kuno6o
http://urltwitter.com/me3ajo
http://urltwitter.com/nasozi
http://urltwitter.com/so3afi
http://urltwitter.com/vido6a
http://urltwitter.com/wulule
http://urltwitter.com/yucazo
We've previously warned about the dangers of following "Tiny URLs" on Twitter. With only 140 characters to use in your message, many Twitterers use URL shortening services to save their precious characters. Unfortunately, for most people you have no idea where that click is going to take you until you click on it and get forwarded by the URL shortening service. Its a bit like playing Russian roulette. Click the shortened URLs, and you may get informative news stories, insightful blog articles, pornography, or a new virus!
At the UAB Spam Data Mine we've seen a few of these Tiny URLs used in spam, but now we have our first major campaign that is exploiting them in a highly organized way.
aafter.us
bit.ly
is.gd
jh.to
jtty.com
myurl.in
o.ly
phaze.me
sturly.com
tcbp.net
tlink.me
urltwitter.com
So far we've seen almost a thousand of these spam messages, and have encountered 453 unique URLs at this point. Here are the subjects that are being used in this spam campaign:
Subject: $10 free deposit
Subject: $5000 Jackpot waiting for you!
Subject: 200% bonus on every deposit
Subject: 75 and 90 Ball Bingo
Subject: Become A Bingo Hustler
Subject: Become A Winner Today
Subject: Become A Winner With Bingo
Subject: b-i-n-g-o for you!
Subject: Bingo has never been easier.
Subject: Bing-o Was Her Name-o
Subject: Do you like to play bingo online?
Subject: Enjoy Bingo Online
Subject: Ever wanted to play Bingo for Cash ?
Subject: Gamble online? Read me!
Subject: Gamble With Bingo
Subject: Gamble? Like to play online?
Subject: Hot 9-Real SLot Machines! $25,000 Jackpot
Subject: Hustle Online. Play Bingo.
Subject: Like Bingo? Win $
Subject: Nickel, Dime, Quarter, & High Roller Games!
Subject: Nightly Events for CASH Prizes
Subject: Online diplomas here.
Subject: Play Bing0 Online
Subject: Play Bingo Now
Subject: Play Bingo Today
Subject: play online
Subject: Play Online Now
Subject: Play Online, Win Today
Subject: Someone has invited you to a game of Bingo
Subject: Something For You. Play Online.
Subject: Vehicle Warranty - 60% off
Subject: Want to play bingo online and win CASH ?
Subject: Win With Bingo
Subject: You have been invited to a Bingo game!
We see this campaign as a dangerous precedence which could be followed by other spammers to make our efforts to block their spam more difficult. As one would expect, the spammer, in addition to cheating the affiliate program, and offering "probably illegal" gambling to his email recipients, is delivering his spam message through a world-wide botnet of compromised computers. Just in our spam samples, we have spam for this campaign sent from 698 different computers in 43 different countries around the world.
Afrinic countries of CI, MA, SD, ZA
APNIC countries of BD, HK, ID, IN, JP, KR, PK, TH, TW, VN
ARIN countries of US (only 6 machines)
LACNIC countries of AR, BR, CL, CO, MX, SV, VE
RIPENCC countries of AM, AZ, BY, DE, EU, GR, HR, HU, IL, IQ, IR, IT, KZ, MD, PL, PT, RO, RS, RU, UA, UZ
Despite a broad smattering of countries, 43% of our spam came from Brazil, 20% from Russia, 13% from the Ukraine, 7% from India, and 2% from Italy. No other country represented more than 1% of the spam we received in this campaign.
Here are the URLs that we have seen so far in this campaign:
http://aafter.us/0oysiA
http://aafter.us/15Exas
http://aafter.us/3d3V9e
http://aafter.us/459UeB
http://aafter.us/4fOecg
http://aafter.us/4R2udg
http://aafter.us/4YzvqA
http://aafter.us/6DvEsN
http://aafter.us/78Lj60
http://aafter.us/9GQEkZ
http://aafter.us/9TOYVb
http://aafter.us/A4Oc0S
http://aafter.us/AxwsYK
http://aafter.us/b9rkEe
http://aafter.us/bezEO3
http://aafter.us/BIyffd
http://aafter.us/ckqW55
http://aafter.us/cyHq06
http://aafter.us/D8kzvt
http://aafter.us/DBYJNk
http://aafter.us/dpJxBc
http://aafter.us/ew7332
http://aafter.us/FIDLQs
http://aafter.us/FJLPyM
http://aafter.us/fTJDW4
http://aafter.us/jptgOx
http://aafter.us/JwmKyP
http://aafter.us/jYg3j6
http://aafter.us/kdOH1o
http://aafter.us/knACii
http://aafter.us/motFQJ
http://aafter.us/n8quI5
http://aafter.us/N8U0Bq
http://aafter.us/P8o6Kn
http://aafter.us/PI3BvT
http://aafter.us/qDDkB6
http://aafter.us/QfSfkf
http://aafter.us/RH3z2F
http://aafter.us/rNqm6H
http://aafter.us/sEwQMU
http://aafter.us/siykT5
http://aafter.us/sY6RN1
http://aafter.us/TXgsXd
http://aafter.us/UxbBYV
http://aafter.us/vcmHnv
http://aafter.us/XwUWd3
http://aafter.us/YP4zHn
http://aafter.us/YUXbB4
http://aafter.us/ZjUAOw
http://bit.ly/10VJRX
http://bit.ly/11oYQ8
http://bit.ly/14egZi
http://bit.ly/15piKn
http://bit.ly/16aOsd
http://bit.ly/16iqi3
http://bit.ly/16temb
http://bit.ly/19AQlF
http://bit.ly/37LQeX
http://bit.ly/4mrqW9
http://bit.ly/8Tbvz
http://bit.ly/9K5r5
http://bit.ly/B0S1U
http://bit.ly/b3JyJ
http://bit.ly/E7hiD
http://bit.ly/eBlww
http://bit.ly/Ex5GL
http://bit.ly/EzZV4
http://bit.ly/FIolK
http://bit.ly/gj9Py
http://bit.ly/gQxNZ
http://bit.ly/ih7Di
http://bit.ly/iwdpY
http://bit.ly/joj8y
http://bit.ly/lhPp7
http://bit.ly/MOXP7
http://bit.ly/N3iVs
http://bit.ly/Q4XY0
http://bit.ly/q7EwA
http://bit.ly/RWnFc
http://bit.ly/tdLyV
http://bit.ly/TEXC4
http://bit.ly/tSW62
http://bit.ly/ttrZ5
http://bit.ly/tvZ0h
http://bit.ly/V2q7R
http://bit.ly/Ve1jJ
http://bit.ly/VI7n6
http://bit.ly/Vs7Tb
http://bit.ly/xiUSr
http://bit.ly/xJEcE
http://bit.ly/xjIii
http://bit.ly/YdVa5
http://is.gd/1xL2e
http://is.gd/1xL2f
http://is.gd/1xL2g
http://is.gd/1xL2h
http://is.gd/1xL2i
http://is.gd/1xL2k
http://is.gd/1xL4B
http://is.gd/1xL4E
http://is.gd/1xL4F
http://is.gd/1xL4G
http://is.gd/1xL4L
http://is.gd/1xL6e
http://is.gd/1xL6m
http://is.gd/1xL6o
http://is.gd/1xL6r
http://is.gd/1xL6u
http://is.gd/1xL6z
http://is.gd/1xL8H
http://is.gd/1xL8t
http://is.gd/1xLaB
http://is.gd/1xLaE
http://is.gd/1xLaK
http://is.gd/1xLaO
http://is.gd/1xLaP
http://is.gd/1xLaW
http://is.gd/1xLcS
http://is.gd/1xLdc
http://is.gd/1xLdg
http://is.gd/1xLdh
http://is.gd/1xLdi
http://is.gd/1xLeX
http://is.gd/1xLff
http://is.gd/1xLfG
http://is.gd/1xLfx
http://jh.to/1obuti
http://jh.to/3ulofu
http://jh.to/4alo9u
http://jh.to/4u0axo
http://jh.to/4u9o8u
http://jh.to/5ayoja
http://jh.to/9eyisi
http://jh.to/9i8ika
http://jh.to/do0eba
http://jh.to/do9ihu
http://jh.to/ha6e0u
http://jh.to/je2a9e
http://jh.to/le8iha
http://jh.to/li3iju
http://jh.to/lozi1i
http://jh.to/rokoye
http://jh.to/vetagi
http://jh.to/xu5onu
http://jh.to/yekife
http://jh.to/yilizo
http://jh.to/zeximo
http://jtty.com/05i
http://jtty.com/0g8k
http://jtty.com/640z
http://jtty.com/6g0
http://jtty.com/90jm
http://jtty.com/aeuw
http://jtty.com/afn2
http://jtty.com/alr9
http://jtty.com/bhsv
http://jtty.com/cgt2
http://jtty.com/clx8
http://jtty.com/cn69
http://jtty.com/dhs9
http://jtty.com/dqr6
http://jtty.com/e2b0
http://jtty.com/e589
http://jtty.com/ehlm
http://jtty.com/ejn3
http://jtty.com/ely7
http://jtty.com/eu27
http://jtty.com/fruy
http://jtty.com/gkot
http://jtty.com/hklq
http://jtty.com/htx3
http://jtty.com/ilq3
http://jtty.com/ilw4
http://jtty.com/ix12
http://jtty.com/ixz6
http://jtty.com/jk17
http://jtty.com/knwz
http://jtty.com/lw56
http://jtty.com/lwz2
http://jtty.com/nrz1
http://jtty.com/ouxz
http://jtty.com/rsv9
http://jtty.com/tyz6
http://jtty.com/tz68
http://jtty.com/vyz2
http://jtty.com/wpz0
http://jtty.com/wt0h
http://jtty.com/y0q3
http://myurl.in/2SA9A
http://myurl.in/3Kgq3
http://myurl.in/3txkM
http://myurl.in/50WTX
http://myurl.in/6MUXd
http://myurl.in/6rP1t
http://myurl.in/8m00V
http://myurl.in/8QnMd
http://myurl.in/9ml8L
http://myurl.in/AhDeA
http://myurl.in/AKF1g
http://myurl.in/AMJBY
http://myurl.in/BCD7U
http://myurl.in/BM1RA
http://myurl.in/CcSAD
http://myurl.in/cooWR
http://myurl.in/drm2U
http://myurl.in/e0LIu
http://myurl.in/EcZlr
http://myurl.in/Ezbrh
http://myurl.in/Fk2Qs
http://myurl.in/H6xsv
http://myurl.in/HbY51
http://myurl.in/HiUfB
http://myurl.in/ivqVE
http://myurl.in/kr0Xn
http://myurl.in/L62hH
http://myurl.in/LUk5g
http://myurl.in/NWsMe
http://myurl.in/oa5Zo
http://myurl.in/Oq8Jj
http://myurl.in/pWVr8
http://myurl.in/q6qsq
http://myurl.in/rhChK
http://myurl.in/th2Gr
http://myurl.in/TSR8k
http://myurl.in/u8jyb
http://myurl.in/UzmYY
http://myurl.in/vppYC
http://myurl.in/wZoeF
http://myurl.in/XAj2y
http://myurl.in/xIIll
http://myurl.in/Y2Dc7
http://myurl.in/YbCtF
http://myurl.in/YG2Ny
http://myurl.in/yl4s2
http://myurl.in/yxj2l
http://o.ly/qT1
http://o.ly/qT3
http://o.ly/qT4
http://o.ly/qT5
http://o.ly/qT6
http://o.ly/qT7
http://o.ly/qT8
http://o.ly/qT9
http://o.ly/qTA
http://o.ly/qTb
http://o.ly/qTC
http://o.ly/qTH
http://o.ly/qTJ
http://o.ly/qTK
http://o.ly/qTm
http://o.ly/qTn
http://o.ly/qTO
http://o.ly/qTR
http://o.ly/qTS
http://o.ly/qTU
http://o.ly/qTV
http://o.ly/qTW
http://o.ly/qTX
http://o.ly/qYF
http://o.ly/qYh
http://o.ly/qYi
http://o.ly/qYm
http://o.ly/qYn
http://o.ly/qYo
http://o.ly/qYp
http://o.ly/qYq
http://o.ly/qYS
http://o.ly/qYt
http://o.ly/qYv
http://o.ly/qYw
http://o.ly/qYx
http://o.ly/qYy
http://phaze.me/0994
http://phaze.me/0cjw
http://phaze.me/0r08
http://phaze.me/11c7
http://phaze.me/1j84
http://phaze.me/1jy4
http://phaze.me/2dsc
http://phaze.me/2s08
http://phaze.me/2tq6
http://phaze.me/2xzx
http://phaze.me/3k5z
http://phaze.me/3r3k
http://phaze.me/3trj
http://phaze.me/3v4x
http://phaze.me/4kdb
http://phaze.me/4q59
http://phaze.me/5314
http://phaze.me/5jb1
http://phaze.me/6gjq
http://phaze.me/6n6p
http://phaze.me/836x
http://phaze.me/ckyd
http://phaze.me/d4nf
http://phaze.me/dj19
http://phaze.me/ffrn
http://phaze.me/fn86
http://phaze.me/g30w
http://phaze.me/g68v
http://phaze.me/gm36
http://phaze.me/hwjf
http://phaze.me/jh88
http://phaze.me/jrny
http://phaze.me/k12t
http://phaze.me/m9b6
http://phaze.me/nq7c
http://phaze.me/nt1x
http://phaze.me/nz1b
http://phaze.me/p0q0
http://phaze.me/pkkt
http://phaze.me/rm2y
http://phaze.me/t4wq
http://phaze.me/tqn0
http://phaze.me/v1b0
http://phaze.me/vm98
http://phaze.me/vmtm
http://phaze.me/vqqw
http://phaze.me/w736
http://phaze.me/xptc
http://phaze.me/yqnd
http://phaze.me/zh2v
http://sturly.com/aal0
http://sturly.com/aal1
http://sturly.com/aal2
http://sturly.com/aal5
http://sturly.com/aal6
http://sturly.com/aalm
http://sturly.com/aalq
http://sturly.com/aalr
http://sturly.com/aals
http://sturly.com/aalv
http://sturly.com/aalw
http://sturly.com/aalx
http://sturly.com/aaly
http://sturly.com/aalz
http://sturly.com/aama
http://sturly.com/aamb
http://sturly.com/aamc
http://sturly.com/aame
http://sturly.com/aamf
http://sturly.com/aamg
http://sturly.com/aamh
http://sturly.com/aami
http://sturly.com/aamk
http://sturly.com/aaml
http://sturly.com/aams
http://sturly.com/aamu
http://tcbp.net/s9
http://tcbp.net/sa
http://tcbp.net/sB
http://tcbp.net/sc
http://tcbp.net/sd
http://tcbp.net/sE
http://tcbp.net/sF
http://tcbp.net/sg
http://tcbp.net/sh
http://tcbp.net/sI
http://tcbp.net/sj
http://tcbp.net/sk
http://tcbp.net/sl
http://tcbp.net/sN
http://tcbp.net/sQ
http://tcbp.net/sS
http://tcbp.net/st
http://tcbp.net/sW
http://tcbp.net/sX
http://tcbp.net/sY
http://tcbp.net/t0
http://tcbp.net/t2
http://tcbp.net/t3
http://tcbp.net/t5
http://tcbp.net/t7
http://tcbp.net/t8
http://tcbp.net/t9
http://tcbp.net/ta
http://tcbp.net/tb
http://tcbp.net/tc
http://tcbp.net/te
http://tcbp.net/ti
http://tcbp.net/tj
http://tcbp.net/tk
http://tlink.me/1499
http://tlink.me/1500
http://tlink.me/1501
http://tlink.me/1502
http://tlink.me/1503
http://tlink.me/1504
http://tlink.me/1505
http://tlink.me/1507
http://tlink.me/1508
http://tlink.me/1510
http://tlink.me/1514
http://tlink.me/1515
http://tlink.me/1516
http://tlink.me/1517
http://tlink.me/1518
http://tlink.me/1519
http://tlink.me/1520
http://tlink.me/1525
http://tlink.me/1526
http://tlink.me/1527
http://tlink.me/1529
http://tlink.me/1530
http://tlink.me/1532
http://tlink.me/1533
http://tlink.me/1534
http://tlink.me/1537
http://tlink.me/1538
http://tlink.me/1540
http://tlink.me/1542
http://tlink.me/1543
http://tlink.me/1545
http://tlink.me/1549
http://tlink.me/1550
http://tlink.me/1554
http://tlink.me/1555
http://tlink.me/1557
http://tlink.me/1560
http://tlink.me/1563
http://tlink.me/1564
http://tlink.me/1565
http://tlink.me/1566
http://tlink.me/1567
http://tlink.me/1569
http://tlink.me/1570
http://tlink.me/1571
http://tlink.me/1572
http://tlink.me/1573
http://tlink.me/1574
http://tlink.me/1575
http://tlink.me/1576
http://urltwitter.com/1ipevu
http://urltwitter.com/2i7isa
http://urltwitter.com/4aza2o
http://urltwitter.com/4otifu
http://urltwitter.com/5ireri
http://urltwitter.com/6eyoco
http://urltwitter.com/6i3eko
http://urltwitter.com/bi3e7o
http://urltwitter.com/bixaso
http://urltwitter.com/fale2e
http://urltwitter.com/gu3eto
http://urltwitter.com/jafabu
http://urltwitter.com/jarewa
http://urltwitter.com/kedopu
http://urltwitter.com/kuno6o
http://urltwitter.com/me3ajo
http://urltwitter.com/nasozi
http://urltwitter.com/so3afi
http://urltwitter.com/vido6a
http://urltwitter.com/wulule
http://urltwitter.com/yucazo
Subscribe to:
Posts (Atom)