All CERT.at downloads as a feed CERT.at 2009-09-24T10:13:22Z 2009-09-24T10:13:22Z

<h1>Downloads</h1> In this area of our homepage we offer you material for free download. Please read the related licence agreements. <p /> Downloads which are only available in German language will be shortly mentioned in the English area as well, but the full description and the download-link itself will only be found in the German area. <p /> These are the available categories for downloads: <h2>Data</h2> Here you'll find files that contain information for the purpose of being read by machines (i.e.: configuration files). <h2>Papers</h2> This area contains all papers that have been published by CERT.at so far. <h2>Press</h2> This is the place for all material that are of typical use for the public press (i.e.: CERT.at's logo). <h2>Software</h2> "Open" software with its root in CERT.at's daily work will be found here, including descriptions. <!--h2>Grouped by topic</h2> This special area bundles all the downloads being spread over the categories that are sharing the same topic as a list of links. The corresponding descriptions, though, will still be found under the detail-categories.-->

CERT.at 2009-09-24T10:13:22Z CERT.at 2010-03-08T13:12:20Z 2010-03-08T13:12:20Z

<h1>An Analysis of the Skype IMBot Logic and Functionality</h1> 2010/03/08 <p /> An Analysis of the Skype IMBot Logic and Functionality. <!--more--> <hr /> <div style="float:right;text-align:right;"> <a class="pdf" href="http://www.cert.at/static/downloads/papers/cert.at-an_analysis_of_the_skype_imbot_logic_and_functionality_1.2.pdf">Download</a> </div> <h2>Publication Date</h2> March, 08th 2010 <h2>Author</h2> Christian Wojner, L. Aaron Kaplan <h2>Language</h2> English <h2>History</h2> You can download the full document in pdf format <a href="http://www.cert.at/static/downloads/papers/cert.at-an_analysis_of_the_skype_imbot_logic_and_functionality_1.2.pdf">here</a>. <hr /> <h2>Content</h2> The following report analyzes the Skype Instant Messenger Bot ("Skype IMBot", a variation of the W32.Nytemare trojan) and reports our reverse engineering efforts. One peculiar aspect of Skype IMBot was the way it controlled Skype (and other Instant Messengers) - simulating user input and user keystrokes. This reminded us of a limited Turing Test: did the malware or a true user send the URL? The report covers the reverse engineering of the Skype IMbot, network logic and recommendations to CERTs, users and Skype. It closed with an outlook on further instant messenger bots.

CERT.at 2010-03-08T13:12:20Z CERT.at 2009-10-14T15:29:37Z 2009-10-14T15:29:37Z

<h1>Mass Malware Analysis: A Do-It-Yourself Kit</h1> 2009/10/14 <p /> Theory, practice and a construction manual for an automated analysis station for malware using trivial and free instruments. <!--more--> <hr /> <div style="float:right;text-align:right;"> <a class="pdf" href="http://www.cert.at/static/downloads/papers/cert.at-mass_malware_analysis_1.0.pdf">Download</a> </div> <h2>Publication Date</h2> October, 14th 2009 <h2>Author</h2> Christian Wojner <h2>Language</h2> English <h2>History</h2> You can download the full document in pdf format <a href="http://www.cert.at/static/downloads/papers/cert.at-mass_malware_analysis_1.0.pdf">here</a>. <hr /> <h2>Content</h2> This paper outlines the relevant steps to build up a customizable automated malware analysis station by using only freely available components with the exception of the target OS (Windows XP) itself. Further a special focus lies in handling a huge amount of malware samples and the actual implementation at CERT.at. As primary goal the reader of this paper should be able to build up her own specific installation and configuration while being free in her decision which components to use. <p /> The first part of this document will cover all the theoretical, strategic and methodological aspects. The second part is focusing on the practical aspects by diving into CERT.at's automated malware analysis station closing with an easy to follow step-by-step tutorial, how to build up CERT.at's implementation for your own use. So feel free to skip parts.

CERT.at 2009-10-14T15:29:37Z CERT.at 2009-09-17T13:18:01Z 2009-09-17T13:18:01Z

<h1>Detecting Conficker in your Network</h1> 2009/02/11 <p /> Description of a method to detect earlystate Conficker worm infections through blocklists fitting the needs of small and medium enterprises. <!--more--> <hr /> <div style="float:right;text-align:right;"> <a class="pdf" href="http://www.cert.at/static/downloads/papers/TR_Conficker_Detection.pdf">Download</a> </div> <h2>Publication Date</h2> 2009/02/11 <h2>Author</h2> Adi Kriegisch <h2>Language</h2> English <h2>Download</h2> You can download the full document in pdf format <a href="http://www.cert.at/static/downloads/papers/TR_Conficker_Detection.pdf">here</a>. <hr /> <h2>Content</h2> Conficker is a computer worm spreading on Windows operating system by mainly using a buffer overflow or the Windows Autorun feature. The worm itself does not contain malware functions but contains a routine to load such code after infection. The purpose of this article is to sketch a way to detect such a worm in a small to medium business network as early as possible so that the effects of the worm can be minimized.

CERT.at 2009-09-17T13:18:01Z CERT.at 2009-09-24T10:04:43Z 2009-09-24T10:04:43Z

<h1>Patching Nameservers: Austria reacts to VU#800113</h1> 2008/07/24 <p /> A report on the patch-rate of Austrian nameservers following announcement of the DNS cache poisoning vulnerabilty. <!--more--> <hr /> <div style="float:right;text-align:right;"> <a class="pdf" href="http://www.cert.at/static/downloads/papers/cert.at-0802-DNS-patchanalysis.pdf">Download Original</a> <p /> <a class="pdf" href="http://www.cert.at/static/downloads/papers/cert.at-0802bis-DNS-patchanalysis-update.pdf">Download Update</a> </div> <h2>Publication Date</h2> July, 24th 2008 <h2>Authors</h2> Otmar Lendl and L. Aaron Kaplan <h2>Language</h2> English <h2>History</h2> You can download the full document in pdf format <a href="http://www.cert.at/static/downloads/papers/cert.at-0802-DNS-patchanalysis.pdf">here</a>. <p> We also published a <a href="http://www.cert.at/static/downloads/papers/cert.at-0802bis-DNS-patchanalysis-update.pdf">short update</a> on July 28th. <hr /> <h2>Content</h2> This paper analyses the impact of the coordinated efforts to patch Austria's recursive DNS server infrastructure following the revealings of Dan Kaminsky (US-CERT VU#800113) which showed that almost all DNS servers on the Internet are vulnerable to DNS cache poisoning. CERT.at -- being run by nic.at, the Austrian domain registry -- is in a special position to be able to assess the reaction of the Austrian nameserver operators to the discovered DNS vulnerability. We analyzed the rate at which DNS servers were patched from an insecure to more secure state. The paper discusses a methodology to measure the patch level "score" of a recursive DNS server. We believe that this score methodology can be applied to cleanly discern patched from unpatched DNS servers. <p /> We describe a methodology how a TLD operator can use his query logs to check which operators have patched their DNS resolvers according to the published advisories. <p /> The conclusions are rather grim so far -- more than two thirds of the Austrian Internet's recursive DNS servers are unpatched while at the same time the upgrade adoption rate seems rather slow. Our findings are matched by the observations of Alexander Klink of Cynops GmbH who analyzed the results of the online vulnerability test on Dan Kaminsky's doxpara site. <p /> We hereby present the information to the concerned public in the hope that DNS -- a central and crucial part of the Internet -- remains secure. <p /> Our recommendation to IT system administrators is to update their recursive DNS servers immediately and check that their upgrades were successful. <p />

CERT.at 2009-09-24T10:04:43Z CERT.at 2009-10-12T10:22:43Z 2009-10-12T10:22:43Z

<h1>Bytehist</h1> A tool for generating byte-usage-histograms for all types of files with a special focus on binary executables in PE-format (Windows). <!--more--> <hr /> <div style="float:right;text-align:right;"> <a class="zip" href="http://www.cert.at/static/downloads/software/bytehist/windows/bytehist_beta_1.zip">Download latest Windows version</a> <p /> <a class="zip" href="http://www.cert.at/static/downloads/software/bytehist/linux/bytehist_beta_1.zip">Download latest Linux version</a> </div> <h2>Author</h2> Christian Wojner <h2>Language</h2> English <h2>License</h2> <a href="http://en.wikipedia.org/wiki/ISC_license">ISCL</a> <table cellpadding=0 cellspacing=0> <tr> <td><h2>Releases</h2></a></td> <td style="padding-left:20px;width:100%;"><h2>Changes</h2></a></td> <td style="padding-left:20px;text-align:center;"><img src="http://www.cert.at/static/icons/icon_windows_small.gif" /></td> <td style="padding-left:20px;text-align:center;"><img src="http://www.cert.at/static/icons/icon_linux_small.gif" /></td> <td style="padding-left:20px;text-align:center;"><img src="http://www.cert.at/static/icons/icon_apple_small.gif" /></td> </tr> <tr> <td nowrap>1.0 beta 1</td> <td style="padding-left:20px">-</td> <td style="padding-left:20px;text-align:center;"><a class="zip" href="http://www.cert.at/static/downloads/software/bytehist/windows/bytehist_beta_1.zip">&nbsp;</a></td> <td style="padding-left:20px;text-align:center;"><a class="zip" href="http://www.cert.at/static/downloads/software/bytehist/linux/bytehist_beta_1.zip">&nbsp;</a></td> <td style="padding-left:20px;text-align:center;">x</td> </tr> </table> <hr /> <h2>Features</h2> <ul> <li>Makes byte-usage-histograms of any file of any size</li> <li>Histograms are generated as sorted and unsorted diagrams</li> <li>Sub-histograms for each section of binary executables (PE)</li> <li>Quick overview with GUI navigation in case of sub-histograms</li> <li>Percentage for the share in the total filesize for sub-histograms</li> <li>Sourcerelated names for sub-histograms (= section-names in case of PEs)</li> <li>Results can be saved as .jpg, .bmp and .png files</li> <li>Works as GUI and also as commandline tool (for scripting purposes)</li> </ul> <h2>Syntax</h2> <tt>bytehist [<i>options</i> <i>file</i>]</tt> <p /> Executing <i>bytehist</i> without any parameters activates full GUI-mode.<p /> <table style="margin-left:-3px"> <tr><td><i>options</i>: </td><td>-nogui</td><td>... don't bring up any GUI</td><td></td></tr> <tr><td></td><td>-save file</td><td>... save histogram to given file (bmp, png or jpg)</td></tr> <tr><td></td><td>-h</td><td>... show a short help</td></tr> </table> <h2>Description</h2> Statistics can be a very good method if you want to detect encrypted or packed data. Data that has been manipulated in such a way usually comes up with a very even distribution of bytes being used. In contrast <i>normal</i> data typically has some bytes that are used constantly, which is caused by any kind of structures. So the byte-distribution of unencrypted and unpacked clear text, database-files, ... and even executable binaries differ massevily from the encrypted and/or packed ones. By putting this "phenomenon" into a picture this difference can be easily visualized by histograms. <p /> <span style="vertical-align:top">Examples:</span><br> <a href="http://www.cert.at/static/downloads/software/bytehist/example_unpacked_file.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/example_unpacked_file.jpg" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/example_packed_archive.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/example_packed_archive.jpg" style="width:50px" border=0 /> </a> <p /> The first example shows an unpacked file. In fact the source of this histogram was a log-file - so that's human readable information.<br> The second example roots in an usual ZIP-archive.<br> So as formerly said, to see the difference between them is an easy one. <p /> Let's take a closer look at these examples. Both of them have a green and a red section. In the green section every pixel-column complies to it's positional matching bytecode and visualizes the number of occurrences in a vertical bar. In other words, a tall green bar on the most left side tells us that the byte-code 0h had lots of occurrences. And on the most right side you'll find byte-code FFh.<br> The red section has the same roots like the green section but this time we got all the possible byte-codes in a descending order regarding their occurrences. This makes it much easier to see the evenness.<br> Besides that two sections you'll also find the filename being shown on the top right corner and a percentage.<br> <br> To get an understanding for what this percentage is trying to tell, let's take a look at what more <i>bytehist</i> can do for us. <i>bytehist</i> can split up histograms in sub-histograms. At the moment the most senseful situation of providing sub-histograms is when you have to deal with binary executables. Binary executables are usually internally split up in a number of sections. There are sections for containing data, code, and so on. It is a common approach that executables are being packed or/and even encrypted before they get publicly rolled out. Especially in the malware-sector encryption and packing is massively used as a kind of hurdle to hinder deep analysis through reversing (i.e.). So, in the case of a binary executable in PE format - that's the one Microsoft Windows uses - <i>bytehist</i> will come up with an overall-histogram as well as providing one histogram per section it found and even one for possible rest behind the last section. Regarding the percentage the overall-histogram will still say "100%" but all the others will tell the percentage of their specific share in the total filesize. <p /> <span style="vertical-align:top">Examples:</span><br> <a href="http://www.cert.at/static/downloads/software/bytehist/example_unpacked_executable.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/example_unpacked_executable.jpg" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/example_packed_executable.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/example_packed_executable.jpg" style="width:50px" border=0 /> </a> <p /> Both of the examples have a scrollarea on the right side showing thumbs of the relating (sub-)histogram. By clicking them with the left mouse-button they can be zoomed. Once again we have firstly an unpacked and secondly a packed file, but this time, binary executables. <p /> This feature gives a reverser the possibility to instantly find out the section that's containing (if so) packed/encrypted data. <p /> Full examples ... <p /> <span style="vertical-align:top">Packed data behind sections:</span><br> <a href="http://www.cert.at/static/downloads/software/bytehist/test.png"> <img src="http://www.cert.at/static/downloads/software/bytehist/test.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/test.sec01.CODE.png"> <img src="http://www.cert.at/static/downloads/software/bytehist/test.sec01.CODE.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/test.sec02.DATA.png"> <img src="http://www.cert.at/static/downloads/software/bytehist/test.sec02.DATA.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/test.sec03.BSS.png"> <img src="http://www.cert.at/static/downloads/software/bytehist/test.sec03.BSS.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/test.sec04..idata.png"> <img src="http://www.cert.at/static/downloads/software/bytehist/test.sec04..idata.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/test.sec05..tls.png"> <img src="http://www.cert.at/static/downloads/software/bytehist/test.sec05..tls.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/test.sec06..rdata.png"> <img src="http://www.cert.at/static/downloads/software/bytehist/test.sec06..rdata.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/test.sec07..reloc.png"> <img src="http://www.cert.at/static/downloads/software/bytehist/test.sec07..reloc.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/test.sec08..rsrc.png"> <img src="http://www.cert.at/static/downloads/software/bytehist/test.sec08..rsrc.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/test.Rest.png"> <img src="http://www.cert.at/static/downloads/software/bytehist/test.Rest.png" style="width:50px" border=0 /> </a> <p /> <span style="vertical-align:top">An UPX packed executable: </span><br> <a href="http://www.cert.at/static/downloads/software/bytehist/setup.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/setup.jpg" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/setup.sec01.UPX0.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/setup.sec01.UPX0.jpg" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/setup.sec02.UPX1.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/setup.sec02.UPX1.jpg" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/setup.sec03..rsrc.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/setup.sec03..rsrc.jpg" style="width:50px" border=0 /> </a> <p /> <span style="vertical-align:top"><i>bytehist</i> itself - unpacked: </span><br> <a href="http://www.cert.at/static/downloads/software/bytehist/bytehist.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/bytehist.jpg" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/bytehist.sec01..code.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/bytehist.sec01..code.jpg" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/bytehist.sec02..text.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/bytehist.sec02..text.jpg" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/bytehist.sec03..rdata.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/bytehist.sec03..rdata.jpg" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/bytehist.sec04..data.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/bytehist.sec04..data.jpg" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/bytehist/bytehist.sec05..rsrc.jpg"> <img src="http://www.cert.at/static/downloads/software/bytehist/bytehist.sec05..rsrc.jpg" style="width:50px" border=0 /> </a>

CERT.at 2009-10-12T10:22:43Z CERT.at 2010-08-17T21:02:30Z 2010-08-17T21:02:30Z

<h1>Minibis</h1> Software and tips to easily build up an automated malware analysis station based on a concept introduced in the paper <a href="../papers/mass_malware_analysis_en.html">"Mass Malware Analysis: A Do-It-Yourself Kit"</a>. <!--more--> <hr /> <div style="float:right;text-align:right;"> <a class="zip" href="http://www.cert.at/static/downloads/software/minibis/minibis_2_0_29_29.zip">Download latest version</a> </div> <h2>Author</h2> Christian Wojner <h2>Language</h2> English <h2>License</h2> <a href="http://en.wikipedia.org/wiki/ISC_license">ISCL</a> <table cellpadding=0 cellspacing=0> <tr> <td><h2>Releases</h2></a></td> <td style="padding-left:20px;width:100%;"><h2>Changes</h2></a></td> <td style="padding-left:20px;text-align:center;"><h2>Download</h2></td> </tr> <tr> <td nowrap>2.0 (29/29)</td> <td style="padding-left:20px">Release 2.0</td> <td style="padding-left:20px;text-align:center;"> <a class="zip" href="http://www.cert.at/static/downloads/software/minibis/minibis_2_0_29_29.zip">&nbsp;</a> </td> </tr> <tr> <td nowrap>2.0 beta (28/29)</td> <td style="padding-left:20px">Forceable quit / Recovers from crashes</td> <td style="padding-left:20px;text-align:center;"> <a class="zip" href="http://www.cert.at/static/downloads/software/minibis/minibis_2_0_beta_28_29.zip">&nbsp;</a> </td> </tr> <tr> <td nowrap>2.0 beta (27/29)</td> <td style="padding-left:20px">Check Internet connectivity / Exit only if analysis paused</td> <td style="padding-left:20px;text-align:center;"> <a class="zip" href="http://www.cert.at/static/downloads/software/minibis/minibis_2_0_beta_27_29.zip">&nbsp;</a> </td> </tr> <tr> <td nowrap>2.0 beta (25/29)</td> <td style="padding-left:20px">-</td> <td style="padding-left:20px;text-align:center;"> <a class="zip" href="http://www.cert.at/static/downloads/software/minibis/minibis_2_0_beta_25_29.zip">&nbsp;</a> </td> </tr> </table> <hr /> <h2>Stay Informed!</h2> If you are interested in the actual state and the progress of upcoming features you might want to take a look at Minibis' Twitter channel: <a href="https://twitter.com/CERTat_Minibis">https://twitter.com/CERTat_Minibis</a>. <hr /> <h2>Table of Contents</h2> <ul> <li><a href="#background">Background</a></li> <!--li><a href="#faq">FAQ - Frequently Asked Questions</a></li--> <li><a href="#installation">Installation Guide</a></li> <li><a href="#configuration">Configuration Guide</a></li> <li><a href="#oneloopcycle">One Loop-Cycle</a></li> <li><a href="#commontools">Scripting of Common Tools and Tasks</a></li> <li><a href="#screenshots">Screenshots</a></li> <!--li><a href="#future">Future</a></li--> </ul> <hr /> <a name="background"></a> <h2>Background</h2> For detailed information on the underlying concept we recommend you read our paper <a href="../papers/mass_malware_analysis_en.html">"Mass Malware Analysis: A Do-It-Yourself Kit"</a>. <!--a name="faq"></a> <h2>FAQ - Frequently Asked Questions</h2--> <a name="installation"></a> <h2>Installation Guide</h2> As a Minibis installations includes commercial software it is not possible for us to provide a complete installation-package. The following step-by-step guide will lead you through the configuration of a typical Minibis environment. <ol> <li>Select the (physical) machine you like to be the home of your Minibis environment.</li> <li>Install the latest version of Ubuntu (32 bit) on it.</li> <li>Install proftpd (via "apt-get install proftpd").</li> <li>Install zip (via "apt-get install zip").</li> <li>Create a user "minibis" and do not forget to give it a password.</li> <li>Give your own user (the one you will start "minibis-cpr" from) full permissions to the home of "minibis" and verify that you can write to it.</li> <li>Download Minibis and extract it to your desired folder.</li> <li>Install SUN's VirtualBox (via "apt-get install virtualbox").</li> <li>Create a new virtual machine (VM) in it using Windows XP as operating-system. All default settings for the machine and the OS are fine. Decline Autoupdate features when you get asked.</li> <li>Add "minibis" as entry to Windows' hosts-file resolving it to your FTP-server's IP address.</li> <li>Disconnect any (virtual) volumes from the VM (this is necessary to prevent eventual popups like autoplay, new hardware found etc.).</li> <li>Transfer "minibis-cpp.exe" to the VM's Windows desktop.</li> <li>Download your desired monitoring-tools to Linux. (Note: Download the ones that need "real" installation - so do not just copy - directly to Windows and install them.)</li> <li>Disconnect from the network, i.e. by unplugging the network cable!</li> <li>Check out if you can connect to the host ftp-daemon by using the Windows ftp-client.</li> <li>Execute "minibis-cpp.exe" in the VM and answer the firewall question to NOT BLOCK this application.</li> <li>You will be now asked to enter a password. This is the one of the user "minibis".</li> <li>Create a VM-snapshot of this state.</li> <li>Close the VM, using the option to revert to the last taken snapshot.</li> <li>Bring your samples into Linux's filesystem (i.e. by mounting a CD-Rom).</li> <li>Set "minibis-cpr" as executable (chmod +x minibis-cpr) and execute and configure it.</li> </ol> <a name="configuration"></a> <h2>Configuration Guide</h2> The download package includes an example configuration. To use this copy it to Minibis' folder and rename it to "minibis.pref". Note: Do never alter this file in an editor use Minibis for that. Just click on the "Config"-button in the lower left corner in the main-window. <h3>Buttons behind fields</h3> As usual a click on such a button brings up a tiny wizard that provides support in finding the proper value. <h3>The "check"-button</h3> By clicking this button the actual configuration is going to be checked for consistency. Note that in case of multiple errors each click will always come up with <b>just one</b> error. So make sure to re-check if you solved a problem. <h3>Area "Samples"</h3> By using the directory- or the file-entry you can configure a run for multiple samples or just one sample. In case of directory-mode sub-directories are included as well. <h3>Area "General"</h3> "FTP-Directory" is the path where the log-files will be transferred to. "Samplename" is the name that will be used for the sample at the proband. Some malware reacts to specific names, so this is the place where you can change it. Regarding "Virtual Machine" you can switch between the actually supported solutions (currently only VirtualBox) and choose the right virtual machine instance. <h3>Area "Timeouts"</h3> These are <b>the</b> timeouts from the underlying concept. The extra field for cpp, which holds "10" (seconds) by default specifies some additional time to wait before quitting monitoring if the sample exited on its own. This enables continuation of monitoring i.e. if the sample injects itself in another process before doing something evil. <h3>Area "Solutions for VBox bugs"</h3> These are settings that help to prevent processes of VirtualBox from getting stuck. If you already have other (VBox) virtual machines running you might want to uncheck those. The first checkbox addresses stopping and the second reverting the VM. <h3>Area "VM Management"</h3> Here you can specify the commands that will be used for the corresponding VM activities. The id of the VM is addressed by the replacement token %vmid%. Besides that, any of them has a timeout for hangup-prevention. <h3>Tab "Researcher Scripting"</h3> To let you customize the researcher side there are three events (therefore three editor-fields) that can be scripted using shell-scripting (Linux). Use the replacement token %md5% to specify the actual sample.<br /> <br /> For further details when those events exactly happen, see "One Loop-Cycle". <br /> You'll find tutorials and examples regarding scripting under "Scripting of Common Tools and Tasks". <h3>Tab "Proband Scripting"</h3> To let you customize the Proband's side there are two events (the two lower editor-fields) that can be scripted using batch-scripting (Windows).<br /> The actions scripted for these two events are tied to the two editor-fields above called "Tools to transfer" and "Results to transfer ([...] to ZIP)". The first ("Tools...") is used to define (name) the tools (files) that will be copied to the Proband for use in later activities. The second ("Results...") is used to define (name) the files that will be transferred back from the Proband. If the filename is enclosed in square brackets "[...]" the file will get ZIPped into an archive after it arrives on Researcher.<br /> <br /> For further details when those events exactly happen and how the "Tools..." and the "Results..." are handled see "One Loop-Cycle". <br /> More Tutorials and examples regarding scripting can be found under "Scripting of Common Tools and Tasks". <a name="oneloopcycle"></a> <h2>One Loop-Cycle</h2> Assuming that the sample can be executed, this is a chronological list of all actions that can (some of them are optional) happen. It is important to understand that in this list the two components of Minibis - CPR and CPP - are described as what they really are: one logical entity. The tags <i class="r">(R)</i> and <i class="p">(P)</i> specify the location (<i class="r">(R)</i>esearcher or <i class="p">(P)</i>roband) of the action:<br /> <ol> <li><i class="r">(R)</i> Copy sample to FTP-path (config) as samplename (config) with the apropriate suffix according to the result of Linux' "file"-command. </li> <li><i class="r">(R)</i> Execute the actions tied to event "Actions BEFORE Proband gets started" (config). </li> <li><i class="r">(R)</i> Execute the command declared under "VM Management Start" (config) and wait until the triggerfile "%md5%_start.rdy" exists or the timeout for "VM Management Start" occurs. In case of the latter do the steps 14, 15, 17, 19 and return to step 3. </li> <li><i class="p">(P)</i> Fetch the preference file "minibis.pref" via FTP. </li> <li><i class="p">(P)</i> Fetch all tools (files) according to "Tools to transfer" (config) via FTP. </li> <li><i class="p">(P)</i> Transfer back the triggerfile "%md5%_start.rdy" via FTP. </li> <li><i class="r">(R)</i> Wait until a triggerfile "%md5%_ready.rdy" exists or the timeout for "CPR" (config) occurs.<br /> Meanwhile (optionally) execute the actions tied to event "Actions WHILE Proband runs" and optionally repeat this every <i>N</i> seconds (see config field "every").<br /> If the timeout occurred then continue with step 14. </li> <li><i class="p">(P)</i> Execute the actions tied to event "Actions BEFORE sample gets executed" (config). </li> <li><i class="p">(P)</i> Execute the sample and wait until it exits or the timeout for "CPP" (config) occurs. If the sample exited wait until the timeout for "CPP +" occurs. </li> <li><i class="p">(P)</i> Execute the actions tied to event "Actions AFTER sample exited or time's up" (config). </li> <li><i class="p">(P)</i> Transfer back all files according to "Results to transfer ([...] to ZIP)" (config) via FTP. </li> <li><i class="p">(P)</i> Transfer back the triggerfile "%md5%_ready.rdy" via FTP. </li> <li><i class="p">(P)</i> Exit. </li> <li><i class="r">(R)</i> Execute the command declared under "VM Management Stop" (config) and wait until it exits or the timeout for "VM Management Stop" occurs. </li> <li><i class="r">(R)</i> Optionally execute "Solutions for VBox bugs" column 1 (config). </li> <li><i class="r">(R)</i> Execute the actions tied to event "Actions AFTER Proband got stopped" (config). </li> <li><i class="r">(R)</i> Execute the command declared under "VM Management Revert" (config) and wait until it exits or the timeout for "VM Management Revert" occurs. </li> <li><i class="r">(R)</i> ZIP all files surrounded with [...] according to "Results to transfer ([...] to ZIP)" (config) into the archive "%md5%.zip". </li> <li><i class="r">(R)</i> Optionally execute "Solutions for VBox bugs" column 2 (config). </li> <li><i class="r">(R)</i> Delete "minibis.pref" and the sample from FTP-folder. </li> </ol> <a name="commontools"></a> <h2>Scripting of Common Tools and Tasks</h2> This section gives you example configurations for the integration of widely used monitoring tools into Minibis. <h3>Sysinternals Process Monitor</h3> You can download the latest version of Process Monitor from <a href="http://download.sysinternals.com/Files/ProcessMonitor.zip">here</a>.<br /> Extract the ZIP-file and copy "Procmon.exe" to Minibis' FTP-folder (config).<br /> <ul> <li>Proband Scripting</li> <ul> <li>Tools to transfer:<br /> <div class="code"> Procmon.exe </div> </li> <li>Results to transfer ([...] to ZIP):<br /> <div class="code"> [procmon.pml]<br /> procmon.csv </div> </li> <li>Actions BEFORE sample gets executed:<br /> <div class="code"> start Procmon.exe /AcceptEula /quiet /minimized /Backingfile procmon.pml<br /> Procmon.exe /AcceptEula /WaitForIdle </div> </li> <li>Actions AFTER sample exited or time's up:<br /> <div class="code"> Procmon.exe /AcceptEula /terminate<br /> Procmon.exe /AcceptEula /saveas procmon.csv /openlog procmon.pml </div> </li> </ul> </ul> <h3>WinDump: tcpdump for Windows</h3> You can download the latest version of WinDump from <a href="http://www.mirrorservice.org/sites/ftp.wiretapped.net/pub/security/packet-capture/winpcap/windump/install/bin/windump_3_9_5/WinDump.exe">here</a>.<br /> You also need to install WinPcap in the Proband for WinDump to work properly. You can download the latest version of WinDump from <a href="http://www.winpcap.org/install/bin/WinPcap_4_1_1.exe">here</a>.<br /> Copy "WinDump.exe" to Minibis' FTP-folder (config).<br /> Copy "sleep.exe" (a tool of the Minibis download-package) to Minibis' FTP-folder (config).<br /> <ul> <li>Proband Scripting</li> <ul> <li>Tools to transfer:<br /> <div class="code"> WinDump.exe sleep.exe </div> </li> <li>Results to transfer ([...] to ZIP):<br /> <div class="code"> [windump.pcap]<br /> windump.txt </div> </li> <li>Actions BEFORE sample gets executed:<br /> <div class="code"> start WinDump.exe -i 1 -w windump.pcap -U -s 0<br /> sleep.exe 1 </div> </li> <li>Actions AFTER sample exited or time's up:<br /> <div class="code"> taskkill /f /im WinDump.exe<br /> WinDump.exe -n -p -r windump.pcap > windump.txt </div> </li> </ul> </ul> <h3>Creating a Screenshot</h3> Copy "screenshot.exe" (a tool of the Minibis download-package) to Minibis' FTP-folder (config).<br /> <ul> <li>Proband Scripting</li> <ul> <li>Tools to transfer:<br /> <div class="code"> screenshot.exe </div> </li> <li>Results to transfer ([...] to ZIP):<br /> <div class="code"> screenshot.png </div> </li> <li>Actions AFTER sample exited or time's up:<br /> <div class="code"> screenshot.exe screenshot.png </div> </li> </ul> </ul> <!--h3>Sysinternals Process Monitor</h3> You can download the latest version of Process Monitor from <a href="http://download.sysinternals.com/Files/ProcessMonitor.zip">here</a>.<br /> Extract the ZIP-file and copy "Procmon.exe" to Minibis' FTP-folder (config).<br /> <ul> <li>Researcher Scripting</li> <ul> <li>Actions BEFORE Proband gets started:<br /> <div class="code"> </div> </li> <li>Actions WHILE Proband runs:<br /> <div class="code"> </div> </li> <li>Actions AFTER Proband got stopped:<br /> <div class="code"> </div> </li> </ul> <li>Proband Scripting</li> <ul> <li>Tools to transfer:<br /> <div class="code"> </div> </li> <li>Results to transfer ([...] to ZIP):<br /> <div class="code"> </div> </li> <li>Actions BEFORE sample gets executed:<br /> <div class="code"> </div> </li> <li>Actions AFTER sample exited or time's up:<br /> <div class="code"> </div> </li> </ul> </ul--> <a name="screenshots"></a> <h2>Screenshots</h2> <a href="http://www.cert.at/static/downloads/software/minibis/MainWindow.png"> <img src="http://www.cert.at/static/downloads/software/minibis/MainWindow.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/minibis/ConfigResearcher.png"> <img src="http://www.cert.at/static/downloads/software/minibis/ConfigResearcher.png" style="width:50px" border=0 /> </a> <a href="http://www.cert.at/static/downloads/software/minibis/ConfigProband.png"> <img src="http://www.cert.at/static/downloads/software/minibis/ConfigProband.png" style="width:50px" border=0 /> </a> <!--a name="future"></a> <h2>Future</h2-->

CERT.at 2010-08-17T21:02:30Z CERT.at 2009-10-12T10:19:30Z 2009-10-12T10:19:30Z

<h1>Conficker Worm</h1> 2009/02/09 <p /> Various files regarding the worm "Conficker".<!--more--> <p /> <table style="padding-left:30px;"> <tr> <td><a class="zip" href="http://www.cert.at/static/downloads/data/conficker/all_domains.zip">all domains</a></td> <td> ... suitable for block lists (in proxies etc)</td> </tr> <tr> <td><a class="zip" href="http://www.cert.at/static/downloads/data/conficker/named.conf.conficker.zip">DNS named.conf file</a></td> <td> ... Bind named.conf file with all conficker domain names</td> </tr> <tr> <td><a class="db" href="http://www.cert.at/static/downloads/data/conficker/conficker.db">sample bind zone file</a></td> <td> ... suitable for the named.conf file above.</td> </tr> </table>

CERT.at 2009-10-12T10:19:30Z CERT.at 2009-10-12T10:17:23Z 2009-10-12T10:17:23Z

<h1>CERT.at Logo</h1> CERT.at-logo in various formats and sizes.<!--more--> <p /> <table style="padding-left:30px;"> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_16.png">CERT.at-logo as 16x8 PNG-file (0.5 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_32.png">CERT.at-logo as 32x17 PNG-file (1.1 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_64.png">CERT.at-logo as 64x34 PNG-file (2.7 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_100.png">CERT.at-logo as 100x53 PNG-file (4.6 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_128.png">CERT.at-logo as 128x67 PNG-file (5.6 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_150.png">CERT.at-logo as 150x79 PNG-file (6.6 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_200.png">CERT.at-logo as 200x105 PNG-file (8.8 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_256.png">CERT.at-logo as 256x135 PNG-file (11.4 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_320.png">CERT.at-logo as 320x168 PNG-file (14.4 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_640.png">CERT.at-logo as 640x336 PNG-file (29.3 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_800.png">CERT.at-logo as 800x420 PNG-file (37.8 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_1024.png">CERT.at-logo as 1024x538 PNG-file (49.2 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_1280.png">CERT.at-logo as 1280x673 PNG-file (63.8 KB)</a></td> </tr> <tr> <td><a class="png" href="http://www.cert.at/static/downloads/certatlogo/cert.at_1600.png">CERT.at-logo as 1600x841 PNG-file (82.2 KB)</a></td> </tr> <tr> <td><a class="svg" href="http://www.cert.at/static/downloads/certatlogo/cert.at_vektorisiert_inkscape.svg">CERT.at-logo as vectorized format Inkscape-SVG (17.1 KB)</a></td> </tr> <tr> <td><a class="svg" href="http://www.cert.at/static/downloads/certatlogo/cert.at_vektorisiert_plain.svg">CERT.at-logo as vektorized format Plain-SVG (14.6 KB)</a></td> </tr> <tr> <td><a class="zip" href="http://www.cert.at/static/downloads/certatlogo/cert.at_logos.zip">all CERT.at-logos as ZIP-archive (311.6 KB)</a></td> </tr> </table>

CERT.at 2009-10-12T10:17:23Z CERT.at 2009-10-12T10:21:10Z 2009-10-12T10:21:10Z

<h1>HiRes Teamphotos</h1> High resolution photographs of the CERT.at teammembers.<!--more--> <p /> <table style="padding-left:30px;"> <tr > <td ><a class="jpg" href="http://www.cert.at/static/downloads/photos/AaronKaplan_hires.jpg">Leon Aaron Kaplan</a></td> </tr> <tr > <td ><a class="jpg" href="http://www.cert.at/static/downloads/photos/OtmarLendl_hires.jpg">Otmar Lendl</a></td> </tr> <tr > <td ><a class="jpg" href="http://www.cert.at/static/downloads/photos/RobertSchischka_hires.jpg">Robert Schischka</a></td> </tr> <tr > <td ><a class="jpg" href="http://www.cert.at/static/downloads/photos/RobertWaldner_hires.jpg">Robert Waldner</a></td> </tr> <tr > <td ><a class="jpg" href="http://www.cert.at/static/downloads/photos/ChristianWojner_hires.jpg">Christian Wojner</a></td> </tr> </table>

CERT.at 2009-10-12T10:21:10Z