How To Detect Potentially Malicious PHP Files

How To Detect Potentially Malicious PHP Files ?

Here is the tool called PHP-malware-finder by nbs-system. 


What does it detect?

PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.

The following list of encoders/obfuscators/webshells are also detected:

• Best PHP Obfuscator
• Carbylamine
• Cipher Design
• Cyklodev
• Joes Web Tools Obfuscator
• Php Obfuscator Encode
• SpinObf
• Weevely3
• atomiku
• cobra obfuscator
• phpencode
• webtoolsvn

How does it work?

Detection is performed by crawling the filesystem and testing files against a set of YARA rules. Yes, it's that simple!

How to use it?

$ ./phpmalwarefinder -h
Usage phpmalwarefinder [-cfhw] <file|folder> ...
    -c  Optional path to a configuration file
    -f  Fast mode
    -h  Show this help message
    -v  Verbose mode

Or if you prefer to use yara:

$ yara -r ./malwares.yara /var/www

Download

Biggest Security Breach In Apple App Store Gets Malware Infected

Biggest Security Breach In Apple App Store Gets Malware Infected.

Hundred of Apple Apps gets Malware Infected. It's including the top apps like Angry Birds 2 and WeChat Chinese version. Hackers targeted on app developers and once infected app installed on victim iPhone device, they could steal all data including Logins and Passwords.

The Malware known as XcodeGhost, it also read and write information on the users clipboard. Mostly Asian countries were targeted.

According to report of Intercept,
Although XcodeGhost is the first malware to spread this way in the wild, the techniques it uses were previously developed and demonstrated by Central Intelligence Agency researchers at the CIA’s annual top-secret Jamboree conference in 2012. Using documents from NSA whistleblower Edward Snowden

According to U.S.-based cybersecurity firm Palo Alto Networks Inc.
The attack affected more than three dozen apps. "We believe XcodeGhost is a very harmful and dangerous malware that has bypassed Apple’s code review and made unprecedented attacks on the iOS ecosystem’"

Apple said in the statement,
We recently removed apps from the App Store that were built with a counterfeit version of Xcode which had the potential to cause harm to customers. You should always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software."

How can we protect?

Whether you downloaded Xcode from Apple or received Xcode from another source, such as a USB or Thunderbolt disk, or over a local network, you can easily verify the integrity of your copy of Xcode.

To verify the identity of your copy of Xcode run the following command in Terminal on a system with Gatekeeper enabled:
spctl --assess --verbose /Applications/Xcode.app

where /Applications/ is the directory where Xcode is installed. This tool performs the same checks that Gatekeeper uses to validate the code signatures of applications. The tool can take up to several minutes to complete the assessment for Xcode.

The tool should return the following result for a version of Xcode downloaded from the Mac App Store:
/Applications/Xcode.app: accepted
source=Mac App Store

and for a version downloaded from the Apple Developer web site, the result should read either
/Applications/Xcode.app: accepted
source=Apple

or

/Applications/Xcode.app: accepted
source=Apple System

Any result other than ‘accepted’ or any source other than ‘Mac App Store’, ‘Apple System’ or ‘Apple’ indicates that the application signature is not valid for Xcode. You should download a clean copy of Xcode and recompile your apps before submitting them for review.


What's new update?

The malicious version of apps removed from Apple App Store and developers update them with fixed all security flaws.

Anonymous Hacked Government of Philippines National Telecom Commission (NTC) Website

Anonymous Hacked Government of Philippines National Telecom Commission (NTC) Website. 

The reason behind to hack NTC website are charging and delivering of Internet Services.

Internet access in the Philippines costs $18/Mbps, as compared to the global average of $5/Mbps.

In the message posted on website, Anonymous Philippines said,

"Greetings Citizens of the world, We are Anonymous.

We, Anonymous Philippines, are sympathizing with our fellow Filipino netizens whose battle cries are the 
"OVER PROMISED, UNDER DELIVERED" system of our internet service providers; it is the neigh direct proportionality of our
internet speeds and bandwidths in relation to price. We, as a country, suffer on the bottom of the internet pyramid having
one of the lowest internet speeds while paying the same amount, or even higher, compared to other countries; adding
DATA CAPPING to our "UNLIMITED" data plans sums up to our great burden as an avid follower of the internet - for studies and such.

We are calling forth the attention of the NATIONAL TELECOMMUNICATIONS COMMISSION for this matter in hand; with this we
talk as a whole...as ONE, we are asking for fairness in charging and serving our data services; Unlimited should be patterned to
its name - "UNLIMITED"; not "UNLIMITED with 800MB cap". A 2MBPS speed should never be a 56kbps. A 98% service reliability should be
always on the 98% part, not the 2% one.

We are Anonymous
We are Legion
We do not Forgive
We do not Forget

EXPECT US!"

The website is Still down..

PEinjector - MITM Portable Executable (PE) File Infector

PEinjector - MITM Portable Executable (PE) File Infector

The executable file format on the Windows platform is PE COFF. The peinjector provides different ways to infect these files with custom payloads without changing the original functionality. 

It creates patches, which are then applied seamlessly during file transfer. It is very performant, lightweight, modular and can be operated on embedded hardware.

Features

• Full x86 and x64 PE file support.
• Open Source
• Fully working on Windows and Linux, including automated installation scripts.
• Can be operated on embedded hardware, tested on a Rasperberry Pi 2.
• On Linux, all servers will be automatically integrated as service, no manual configuration required.
• Plain C, no external libraries required (peinjector).
• MITM integration is available in C, Python and Java. A sample Python MITM implementation is included.
• Foolproof, mobile-ready web interface. Anyone who can configure a home router can configure the injector server.
• Easy to use integrated shellcode factory, including reverse shells, meterpreter, ... or own shellcode. Everything is available in 32 and 64 bit with optional automated encryption. Custom shellcode can be injected directly or as a new thread.

peinjector

Provides PE file patching as a service. Just send the raw header of your PE file and you’ll receive a custom-made patch for it. Can be remotely controlled via a command protocol.

peinjector-control

Web interface to configure and control a peinjector server. A small shellcode factory with some basic shellcodes, automatic encryptoin/obfuscation and thread generation is provided - alternatively, custom shellcode can be injected.

peinjector-interceptor

Sample MITM integration. Based on Python and libmproxy, supports SSL interception, can act as transparent Proxy, HTTP Proxy, ... . Provides seamless PE patching capabilities.

Download

Your Chrome Gets Crash By Using These String Code URL

Your Chrome Gets Crash By Using These String Code URL  

We have tested these 16 characters strings and it still works on Windows and Mac.

This security issue was found by Andris Atteka. By mouse over on link its enough for your chrome Crash.

Security Flaw Strings are:

http://a/%%30%30
file:///%%300
http://biome3d.com/%%30%30

He said in the blog,

"Recently I reported a crash bug in Google Chrome (issue #533361). This issue reminded me of the recent Skype vulnerability - both occur with simple URL strings. So how can you crash Google Chrome? By adding a NULL char in the URL string:

http://biome3d.com/%%30%30

Unfortunately no reward was awarded as this was deemed to be only a DOS vulnerability. Anyway, making secure software is much harder than finding issues in it. Thanks Google."

Hope Google will be fixed this issue soon.

NowSecure Developed Android Vulnerability Test Suite For Recent Devices

NowSecure Developed Android Vulnerability Test Suite For Recent Devices.

Android Vulnerability Test Suite - In the spirit of open data collection, and with the help of the community, let's take a pulse on the state of Android security. NowSecure presents an on-device app to test for recent device vulnerabilities.

This tool was meant to show the end user the attack surface that a given device is susceptible to. In implementing these checks we attempt to minimize or eliminate both false positives/false negatives without negatively affecting system stability.

Rationale for necessity

When a vulnerability is discovered, Google receives word and applies a patch to Android. The Nexus devices are usually the devices that receive these patches quickest as they deviate the least (read: not at all) from AOSP (Android Open Source Project - The core of Android, where Google commits to). The lag time between learning about a bug and the time when a patch is applied to a device can still be significant (for OEMs, it can be > 1 year or never). For example, the futex bug (CVE-2014-3153/Towelroot) was known about in late May, early June. This bug took multiple months to get patched on the flagship (at the time) Nexus 5. This leaves users extremely vulnerable to attack from applications. Users mostly do not know that their devices are vulnerable and this tool is meant to give visibility into the vulnerabilities a given device is susceptible to.

Lifecycle of a patch

Samsung, HTC, and every other OEM keep heavily customized versions of Android. The patch deployment infrastructure from OEMS -> carriers -> users is in disarray. The OEMs receive the patches from Google and spend weeks or months applying these to some devices and testing. Then they ship off the device updates to the carrier who is responsible for pushing them to the end user. They then go through another QA cycle from the carrier.

Implementation

Vulnerabilities in a device can exist at many layers inside of Android. For example, a bug can exist in the kernel (Towelroot, for example) or it can exist in the Android specific framework (Android Masterkeys/FakeID). Some of the kernel bugs can sometimes be difficult to check for without potentially causing system instability. This implementation takes care to not include checks that could cause instability problems for the end user and therefore may omit checks that could cause these types of issues. The framework is very thin at the current time and consists of a vector of vulnerability checks. Their concrete implementations vary wildly depending on the bug.

Download

WeChat For iOS Gets Hacked, 600 Million Users Are On Security Risk

WeChat For iOS Gets Hacked! 
600 Million Users Are On Security Risk. 

Wechat is the China's most popular messaging app. The app was hacked through security flaw and it to be affecting iOS users with WeChat version 6.2.5. But no data has been compromised yet.

The Security Flaw Have Been Fixed now.

According to Wechat Blog,

A security flaw, caused by an external malware, was recently discovered affecting iOS users only on WeChat version 6.2.5. This flaw has been repaired and will not affect users who install or upgrade WeChat version 6.2.6 or greater, currently available on the iOS App Store. Here are some important points about the situation.

1. The flaw, described in recent media reports, only affects WeChat v6.2.5 for iOS. Newer versions of WeChat (versions 6.2.6 or greater) are not affected.
2. A preliminary investigation into the flaw has revealed that there has been no theft and leakage of users’ information or money, but the WeChat team will continue to closely monitor the situation.
3. The WeChat tech team has extensive experience combating attempts to hack our systems. Once the security flaw was discovered, the team immediately took steps to secure against any theft of user information.
4. Users who encounter any issues can contact the team by leaving feedback in the “WeChat Team” WeChat account.

At last month CNBC report said,
Various mobile messaging apps including WeChat were being used for malicious purposes, and could be allowing hackers to “steal sensitive information and send it back to a remote server.”

What Can I Do?

The Security flaw has been fixed. WeChat Updated new Version 6.2.6

• · Easily migrate chat log from original phone to new device
• · Translate Moments into your language with a long press
• · Improved WeChat experience on Apple Watch