New Fileless Ransomware with Code Injection Ability Detected in the Wild

New Fileless Ransomware with Code Injection Ability Detected in the Wild

Security researchers have recently discovered a new fileless ransomware, dubbed "Sorebrect," which injects malicious code into a legitimate system process (svchost.exe) on a targeted system and then self-destruct itself in order to evade detection.

Unlike traditional ransomware, Sorebrect has been designed to target enterprise's servers and endpoint. The injected code then initiates the file encryption process on the local machine and connected network shares.

This fileless ransomware first compromises administrator credentials by brute forcing or some other means and then uses Microsoft’s Sysinternals PsExec command-line utility to encrypt files.

"PsExec can enable attackers to run remotely executed commands, instead of providing and using an entire interactive login session, or manually transferring the malware into a remote machine, like in RDPs," Trend Micro says.

WHAT WAS THE BADLOCK

Since march 2016 there were rumors that windows & samba has a very dangerous vulnerability and advised system admins to ready to patch as soon as possible on 12^th april when Microsoft & SAMBA has scheduled to release their security patches .

SPECULATIONS:

Badlock was vulnerability in the SMB & DCERPC protocol used by the SAMBA & Windows which is overhyped by the http://badlock.org/ and compared with the Heartbleed (http://heartbleed.com/) bug found in the openssl in terms of the impact by using a very similar template. some people predicted that it could be as bad as MS08-067, the vulnerability that the Conficker worm exploited.

REALITY OF THE BADLOCK:

Microsoft & Samba release their security patches on 12th October for Badlock (CVE-2016-0128/CVE-2016-2118).

As per Microsoft Bulletin, the vulnerability is “caused by the way the SAM and LSAD remote protocols establish the Remote Procedure Call (RPC) channel.”

As per Samba advisory “A man in the middle can intercept any DCERPC traffic between a client and a server in order to impersonate the client and get the same privileges as the authenticated user account. This is most problematic against active directory domain controllers.”

Microsoft rated this vulnerability important not critical. As it is an Elevation of privilege and require MITM capability.

SHOULD ATTACKER EXPLOIT BADLOCK

Exploitation of this vulnerability is not simple and will not give the ROI due to following reasons

Attacker needs MITM (Middle in the man) Capability.

-        To achieve it attacker has to already compromise the victim network /System by other ways.

-        Attacker would be able to compromise single system at a time.

-        Attacker foot prints would be very large and easy to capture.

-        If Attcker already has MITM capability attacker can use it to accomplish to achieve more simple and valuable task rather than exploiting this bug .

CONCLUSION:

Practice followed by the peoples behind disclosure of the Badlock has been criticized heavily by the community since beginning & after it turnout to be a mute vulnerability everyone felt like cheated and trolled it with Sadlock https://sadlock.org/. It’s always a good choice to patch as soon as possible but decision cannot be driven by crating the hype and panic. Such incidence de-focus from the real issues like more critical & Remote Code execution vulnerabilities

HOW TO GET TRANSCRIPT FROM RGPV BHOPAL: SMART WAY

WHAT IS TRANSCRIPT

A transcript is a copy of a student's permanent academic record, which usually means all courses taken, all grades received, all honors received and degrees conferred to a student. Basically receiving all of your records from the first day of college till the college year now

WHY TRANSCRIPT REQUIRES

          If you are looking for higher studies specially in abroad or planning to migrate then Foreign universities/immigration authority/employer will ask you to submit the your original transcript in order to verify the equivalency of your education with the host country  education.

          In my case I needed transcript to get verification of my education credential via WES.

PROCESS TO APPLY FOR  TRANSCRIPT

In general you would expect to have a similar process to be followed by the universities to provide the transcript to student in a country and in this edge of technology they should have capability to do it online.

Unfortunately this is not true and every university has different process and different requirements of the documents.

MY JOURNEY

Being outside of india , I started to look how to get transcript from RGPV on Google and didn’t found much help only one thing was sure that I cannot apply it online. So as next step I contacted to university and got a very prompt response

“Dear Student,

You can download the Form of Transcript from the RGPV Portal (www.rgpv.ac.in) from the option "Downloads Forms" available on the Home Page. Read the inside  instructions carefully and submit the form and if any further issue regarding the process for applying then you can contact RGPV Student Helpline number 0755-4004747. 

Regards

 Technical Support Team””

          So I got the form but no details on the documents require fees require ? so RGPV is expecting that every student should call to get this detail . why not just add it with the form ?

REQUIRE DOCUMENTS

After some research I found that with the form you need original mark sheet of the semesters and any one  with original mark sheet can apply for transcript on your behalf. That was relief if you are outside of India/Bhopal.

But filling up the form was a challenge on it’s own as I have read student experience of making many mistakes in the form and going bake to amend themwhich wasted time & money.

 So after some more search I get to know that RGPV has a cyber café named cyber city https://www.facebook.com/cyber00786/timeline which makes life much easier for student.

THE PROCESS

1.    So First you get a 1 copy of the filled form and original mark sheets and take it to the RGPV. Staff is very helpful and they will guide you to the right room number.

2.    You have to submit the form & your original marksheet for verification which take 2 -3 hours depend on the crowd .

3.    Once verification get done  you will get back the form & your mark sheets  with all the details on the changes require in the form.

4.    Then you go back to café get done all the require changes. Get the required number of copies of your forms and envelops

5.    Go to the UTI bank ( it’s in the campus) get Challan ( it was 500 rs for 10 copies) please check with the university about the fees.

6.    Submit the all forms and challan on same windows and keep the student copy of your challan in secure place you will need it to get back your transcript which usually take two days.

TIPS

1.    Reach early morning about 9 AM if you want cyber café to fill up your form as if there is crowd then it could took you whole day to get fill up your form .

                                                  

                                                                         OR

2.    Call the café owner from the Facebook link  he will provide you his email id on which you can send the scan copy of your mark sheets. And they will keep your form ready by the time you will reach University.

3.    Remember that university accept the form for verification till 2.30 PM and bank will close by 4PM you have to manage your timing for form submission & issuance of the challan. I was having head to head with the time else I would have to spend another day in university.

4.    If you are not living in Bhopal and want to take your transcript with you make sure you have  two to three working days arrangement to stay in Bhopal.

DEATH AND RESURRECTION OF BYOB: HOW INDIAN MIDDLE CLASS HACKED TO BUY CARRY BAGS

Carry bag is a require instrument to carry items from shop to home. For every shopper carry bag is a necessity. Shoppes used to take them as granted and shopkeepers were more than happy to provide such begs as convenience and help to promote their business. Most of the big shops provided bags which have their shop name and serve as visiting card. It was a win –win situation for both parties. But now this situation has been changed as old saying there is no free lunch so no free shopping bags any more.  Long time ago before the popularity of the polybags /convenient bags, even before the start of the big Mall era shoppers used to carry their own bags to buy the groceries from the neighbors’ shopkeeper. With the help of the multinational companies and effective advertisement this situation has been changed and now all big malls are selling shopping bags as side product. Let’s see how this all came in to picture.

EVOLUTION PERIOD (BEFORE 2000)

 I belong to a middleclass family and I have spent my childhood from small to large scale city thanks to my father’s frequent transferable job. During my child hood I have observerd that every place had very similar infrastructure. We had multiple small shops for grocery, cloths and other requirements and one or two one stop big shops. We used to do most of the shopping from the small shops and went to big shops only for some big occasions. Though big shops had cheaper options but going there for everyday stuffs wasn’t feasible.

We always carried multiple cloth bags to shop and even we used to carry our utensils to get liquid items e.g oil, Ghee, milk etc. As open items were cheaper then buying packed items and we could see what quality we were getting.

Slowly big shops introduced concept of the thin polybags so you don’t need to carry multiple begs they can stuffs small items in to thin polybags and you just need to stuffs them in to your carry begs. This concept quickly adopted by the small shopkeepers as well. As this facility was free (no visible extra charge) shoppers stop carrying multiple bags and utensils as getting liquid items in the polybags was very convenient. I believe extra cost of the polybags somehow shifted to the shoppers in other forms e.g. with weight of the items.

END OF BYOB 

 On start of the 21^st century when world was facing great recession .Various countries open there gate for multinational companies and globalization of consumers become a new trend. Developing countries like India got big buildings and big malls in its big cities. These malls restricted carrying your own bags inside the mall. If you bring your own bag (BYOB) you have to submit it and keep the token. They provide you there on shopping bags. Once you finish your shopping they stuff your items into big polybags so you don’t have to stuffs them into your carry beg.  Again it was a great convenience and off course cost was invisible to the consumer. Cost of these begs were absorbed by the malls as this practice was a win-win situation for them.

-        These big polybags works as instrument of the malls advertisement. More people will carry their bags more advertisement for the malls

-        It helps curving the theft of the items from the mall.

-        Consumer don’t have to plan their shopping then can enter any time without worry about how they will carry the items

These bags were so lucrative many people started frequent visits to these mall and started more and more shopping from there rather than small neighbor shop. Young generation stop carrying any carry bag with them. Even if some would carry their own bag they would be tagged as old generation.

WHY SELLING OF SHOPPING BAGS STARTED 

As use of polybags increased World health organizations & researcher started realizing the side effect of this phenomenon.  They have noticed following prominent issues

-        These beg were not recyclable.

-        Polybags are hazardous for animal.

-        Burning them harms environment and ozone layer.

There were many protests to ban use of the polybags. Many movements started with no polybags sign. Group has been formed activist started promoting to say no to polybags and not to shop from the shops those provide polybags.

But people already became habitual of not bringing their own bags and it wasn’t feasible for shopkeeper to provide other type of carry beg. It was a catch 22 situation and solution came as the recyclable bags.

Due the government pressures big shops and malls started providing recyclable bag to consumer but soon realized that cost of these bags is much higher and due to inflation they have to pass this cost to the consumer.

And a new business of selling of carry bags has been started. 

WHY WE BUY CARRY BAGS

Now a days most of the shops & malls charges extra for  carry bag from 2 rs to 50 rs  depends on the shop.  It is not guaranteed if these bags are rally recyclable. We are end paying this extra money every time I wonder why ?

-        They charge

-        We don’t carry our own bag

-        We do impulse shopping

The real answer is our shopping habit. We entered into shop to check out some stuffs and end up buying some other items. We don’t plan our shopping so we don’t carry bags. We are spoiled buy choices we spend hours in the mall to get right cloth/shoes/grocery for us and when cashier ask extra for carry bag we couldn’t say no as we wouldn’t have any other option by that time. We don’t do accounting how much money we are spending on buying these bags which we through away.  Ask yourself when you have carried same bag on your next shopping?

WHAT GOES COMES BACK

I had multiple discussions with intellectual people and some of them give a very strong reason on extra charge of taking carry bag by the shops. As carry bags are hazardous to environment extra charge would reduce the usage of these bags and there is some rule and regulations enforce by the government to reduce the countries carbon footprints. And it’s business so shops should earn the profit.

I wonder what government was doing when multinational companies were spoiling the Indian middle class with free carry bag. Wasn’t they were creating new market to sell the unrequired bag. If government and malls are really worried about the environment they should provide extra discount of not taking the bag from the mall instead of charging extra or should reward in some other manner.

Shops and mall should increase the awareness of benefit of carrying your own bag. In current scenario we don’t see any efforts by the shops or the government.

As responsible citizen we should bring back the BYOB (bring your own bag) trend and say no to malls carry bag and strong no to buy them and save money & save environment else we will be spending at least 2% of our shopping money in these extra bags. In my opinion It will take one complete generation to change its habit.

Valentine Day: Not about love its all about Courage

I never understand why Valentine day has been associated with love while act of saint Valentine was courageous & charismatic (once in his life time). To proof my point i search in historical document  and found following points

Courage of Saint valentine:  “Saint Valentine was imprisoned for performing weddings for soldiers who were forbidden to marry and for ministering to Christians”. To go against the Rome emperor needs courage. what happen to those soldiers after marriage is unknown perhaps they have been punished or may be absconded from Rome but Priest paid the price . Note its not about Helping Couples who were in love  but to help people to start there families ( Love don’t need marriage to be proved). 

Charisma of  Saint valentine: “He is said to have healed the daughter of his jailer Asterius when he was imprisoned”. Legend states that before his execution he wrote "from your Valentine" ( this is the form of expression every one write it with in letters)  as a farewell to her. I don't see any romantic love between these two as there ages are not known  and a healer always get lot of respect from the persons.

Heart symbol for Valentine:  I become curious how the Heart comes in picture and voila! found the answer as  Saint Valentine is said to have cut hearts from parchment, giving them to the soldiers ( note not to the girl or couple it’s soldiers may be as symbol of his blessings)

What about 14th Feb: Saint Valentine was buried on the Via Flaminia on February 14. In Ancient Rome, Lupercalia, observed February 13–15, was an archaic rite connected to fertility. Lupercalia was a festival local to the city of Rome. The more general Festival of Juno Februa, meaning "Juno the purifier "or "the chaste Juno", was celebrated on February 13–14.

Note: The celebration of Saint Valentine did not have any romantic connotations until Chaucer's poetry about "Valentines" in the 14th century.

Valentine's letters: In Middle Ages, men drawing the names of girls at random to couple with them and  around 1600, this has been  replaced with a religious custom of girls drawing the names of apostles from the altar.

So why Valentines day Became so famous: That’s very difficult to answers but seems it has been famous  by the Poet Chaucer's by following poem  “Parlement of Foules” (it has almost 700 lines)

For this was on seynt Volantynys day
Whan euery bryd comyth there to chese his make.

["For this was on Saint Valentine's Day, when every bird cometh there to choose his mate."]

But here is the catch This poem was written to honor the first anniversary of the engagement of King Richard II of England to Anne of Bohemia.A treaty providing for a marriage was signed on May 2, 1381 and  mid-February is an unlikely time for birds to be mating in England.

So what one should do: Ok i gave up now history is very confusing and we celebrate many ritual for wrong reasons also. We need special day for every thing due to social,Economy & marketing reasons and if some Famous/powerful  persons declare a day special people start believing in. so we have a day dedicated for Love if you believe in it Celebrate it if you don't then enjoy the life & dedicate any other day ( may be every day) for your dear and love once . – Enjoy

 

Hayle Bishop Valentine whose day this is
All the Ayre is thy Diocese
And all the chirping Queristers
And other birds ar thy parishioners
Thou marryest every yeare
The Lyrick Lark, and the graue whispering Doue,
The Sparrow that neglects his life for loue,
The houshold bird with the redd stomacher
Thou makst the Blackbird speede as soone,
As doth the Goldfinch, or the Halcyon
The Husband Cock lookes out and soone is spedd
And meets his wife, which brings her feather-bed.
This day more cheerfully than ever shine
This day which might inflame thy selfe old Valentine.

—John Donne, Epithalamion Vpon Frederick Count Palatine and the Lady Elizabeth marryed on St. Valentines day

 

 

Reference : Various sources on internet specially Wikipedia

Pathar ka hraday (heart of stone)

Parhar ka hraday liye baitha hoon.
Apne hi sayon se ghire baitha hoon.
Na doodhna na janne ki koshish karna
Kaisa hoon kahan hoon kya piye baitha hoon.
Pathar ka ....................

poochne ka haq nahi deta kisko na aitbar karta hoon
kyon kia kaise kia, kya kiye baitha hoon.
kuch na samjhao, kuch na batlao, sab janta hoon
na samajh hoon, sab kuch samajh ke baitha hoon

Mulakat nahi karta

Shikayat hai ke vo mulakat nahi karta

Muskurata hai magar bat nahi karta

Shabdo ko rakhat hai motyon ki tarah

kanjoos hai kabhi istemal nahi karta

 

manta nahi kahna mera bas yunhin

Apne main magan hai kuch khayal nahi karta

har sur ko janta hai pahchanta hai har kala ko

phir bhi adhura sa hai koi pura kam nahi karta