Last night, I received a phishing email wanting my university email account information. Whenever I’m picking through email headers, or any other kind of network forensics, I find it useful to punch the IP addresses I find into Google. You can often build a good image of what that particular system or network is used for, by reading abuse reports, exposed log files, logs of Wiki edits, and all sorts of other situations where an IP address might be indexed by a search engine.
This particular bad-guy IP is a great example of an IP address that has really made its mark on Google, so I’ll link the results here:
* Google search results for “196.3.61.4″
Off the eastern coast of Madagascar, there’s an island called Mauritius. On this island there’s the city of Ebene. In this city, there’s this building, the “Cyber Tower”. According to Whois, on the third floor of this building, there’s a computer being used for all sorts of phishing and fraud.
It would be “just another scammer”, but this one has a great sense of humor. Check out this diff on an edit made from that IP address on the Wikipedia entry for Advance fee fraud:
Very nice.
They’ve finally been put online. It’s late and it’s a weekend so I don’t really have a whole lot to say about it, but if you read this blog there’s a good chance you’re the same kind of geek that’s been waiting for them to post these videos.
I just received these two pictures via email from my major professor, and thought I’d share. They’re from a series of mock trials that were held for this past fall semester’s computer forensics class. The students had the opportunity to take the stand and present expert witness testimony regarding the evidence that they had examined as part of a class project. We had a real courtroom, a real judge, real attorneys, and another university’s students sitting as a jury. I sat as the accused for a few cases, and also helped guide the defense attorneys through some of the more technical aspects of the forensics.
Thankfully, with the inexperience of the expert witnesses, and coaching my attorney a bit (he had an engineering background, which helped), I was found to be not guilty :) .
Edit: The real action’s going on down below here in the comments :) . Be sure to catch up on them after you read the post.
Jesse Varsalone, a computer forensics expert that happens to be a reader of this site, just emailed me a link to a cool video where he demonstrates a quick and easy way of obtaining SYSTEM privileges on a Vista system, given physical access to the machine. In the video, he uses BackTrack to replace Utilman.exe with a copy of cmd.exe . The nice thing about replacing Utilman.exe is that you can make it run before you’re even logged-in by pressing Windows-U. The video is available on the Offensive Security (maintainers of BackTrack) site:
If you’re into doing physical-presence penetration tests, you might want to roll your own custom CD or bootable USB drive that boots faster than BackTrack, and automatically swaps Utilman.exe out for the executable of your choice. Perhaps something that installs a nice rootkit or Core Impact agent, and then places the real Utilman.exe back into its rightful place.
Thanks Jesse! Excellent choice of soundtrack as well!
I haven’t posted in a while, mostly because I’ve been busy hacking away at SCADA equipment and software, but I did spot some new conference video online in my usual rounds (Shmoocon 2008 video? knock knock :) ). It looks to be deserving of a post.
I wasn’t aware of this conference before now, but the topics look very interesting. There’s some SCADA, some virtualization, some reversing, and several more that I hope to sit down long enough to watch soon. All of it’s hosted on the extraordinarily fast EasyNews mirror. If you’re not already familiar with this mirror, poke around a directory up from the link and you’ll find a lot more conference audio/video to keep you busy.
Enjoy!
