Computer Security Is My Interest!

Soroush Dalili’s Weblog

Nov 29

How to stop hardware key-loggers

Normal Posts, Security Articles 1 Comment »

Nowadays new generations of hardware key-loggers are emerged, and unfortunately attackers are using them intensively to steal the keystrokes of users. These key-loggers are OS independent and are in different shapes. They are even capable of stealing the BIOS password. Most of them look like a convertor for PS/2 and/or USB to PS/2 and/or USB (Fig. 1). Besides, some of them are chipsets which are embedded in the keyboard itself (Fig. 2). And others use electromagnetic features to steal the keystrokes which are put around the wire of the keyboard or work remotely by capturing the frequency spectrum of the keyboard communication[1]. The problem is that these hardware key-loggers have become very cheap and simply available[2]. Moreover, there are some free articles about how to make their circuits[3].

Simple Hardware Keyloggers

Figure 2. Embeded Hardware Keylogger

So, how can we stop it if we could not remove its hardware from our computer or there is a danger of electromagnetic key-logger?

The first and the simplest idea is using an on-screen keyboard and click on it by using a mouse. However in order to get the best result, this on-screen keyboard should be dynamic in order to prevent a hardware key-logger for the mouse itself, which captures the mouse movements and its clicks. Another way is using encryption between the keyboard and its driver. For instance, there is no doubt that by using TPM and having strong encryption methods between keyboard and motherboard (or OS itself), the keyboard can encrypt the keystrokes before sending them to the computer. But, I want to be more initiative. Another idea can be using an optical-dynamic keyboard device which shows a keyboard on your desk or on your palm, and you can touch it in order to press a key (Fig. 3). There is also an application which claims that it can detect a hardware key-logger, but I have not tried it yet and I think it is still possible to hide a hardware key-logger completely from the OS.

Figure 3.

This text is completely based on my own idea, so please respect the copyright.

[1] http://keznews.com/4985_Researchers_hack_wired_keyboards__hijack_keystrokes

[2] http://www.google.co.uk/products?q=hardware+keylogger

[3] http://derek.chezmarcotte.ca/?page_id=24

.

So, how can we stop it if we could not remove its hardware from our computer or there is a danger of electromagnetic key-logger?

The first and the simplest idea is using an on-screen keyboard and click on it by using a mouse. However in order to get the best result, this on-screen keyboard should be dynamic in order to prevent a hardware key-logger for the mouse itself, which captures the mouse movements and its clicks. Another way is using encryption between the keyboard and its driver. For instance, there is no doubt that by using TPM and having strong encryption methods between keyboard and motherboard (or OS itself), the keyboard can encrypt the keystrokes before sending them to the computer. But, I want to be more initiative. Another idea can be using an optical-dynamic keyboard device which shows a keyboard on your desk or on your palm, and you can touch it in order to press a key (Fig. 3). There is also an application which claims that it can detect a hardware key-logger, but I have not tried it yet and I think it is still possible to hide a hardware key-logger completely from the OS.

This text is completely based on my own idea, so please respect the copyright.

[1] http://keznews.com/4985_Researchers_hack_wired_keyboards__hijack_keystrokes

[2] http://www.google.co.uk/products?q=hardware+keylogger

[3] http://derek.chezmarcotte.ca/?page_id=24

Feb 02

Domain for sale was added to my webblog!

Normal Posts No Comments »

I added Domain 4 Sale section to my weblog.
Hope you enjoy these domains.

http://soroush.secproject.com/blog/domain4sale/

Jan 31

March 2009 Updated: FaceBook Automatic Friends Adder from the Apllications’ Walls

Normal Posts 6 Comments »

March 2009 Updated:

Facebook changed some forms and modules in its website in March 2009, so I updated my previous code to the new one:

At last I wrote the universal friend adder for the Facebook.com!

So, you can use this code to add your friends from your arbitrary wall such as Mobwars, Mafia Wars, Eleven Blood, Knighthood, and so on.

There are some important notes:

0- You must download and setup the iMacros first from here (http://www.iopus.com/download/).

1- You must bypass the CAPTCHA by adding more than 30 friends (maybe a bit less or more than this) manually.

2- You must find your application ID number by going to your application page and check the URL. There is always something like this:

http://www.facebook.com/apps/application.php?id=XXXXXXXXX

Which “XXXXXXXXX” is the application number which you must set it as “applicationIDNumber” in this code.

3- Please configure your settings in this code before usage if you want to get the best result.

Note: Unfortunately in this fast revision, you must choose a “friend list” name for the new friends which stands before all the friend list names. For ex. this name can be look like: “000000myfriendlist”

You can copy/paste it as Facebook_Wall_Add.js to your iMacros.

/********* FaceBook Automatic Friends Adder from Apllications' Walls (After Passing the CAPTCHA manually)*********/
/********* You can bypass the CAPTCHA by adding more than 30 friends manually at the first *********/
/********* By Soroush Dalili March-2009 Soroush.SecProject.Com *********/
/********* Begin Configuration - You can change these settings *********/
var startPage = 2; // You can change this value to your page number!
var mobInviteMessage = "Please invite me to your Mafia Wars!"; // You can add your message here
var mobFriendList = "000000myfriendlist"; // You can add your special friend list (you must made it before)
var showImages = "1"; // You can change it to "0" (for disabling) and to "1" (for enabling)
// Wall ID Number: Mobwars = 8743457343 /  Mafia Wars = 56556324950 /  Eleven Blood = 29886835263 / Knighthood = 5541055185
// Just goto your application page which is something like "http://www.facebook.com/apps/application.php?id=XXXXXXXXX". This "XXXXXXXXX" is your application number
var applicationIDNumber = "56556324950"; // Default = MobWars Wall = 8743457343
/********* End Configuration - You can change these settings *********/

/********* Begin Code *********/
// Replace <SP> instead of space character
mobInviteMessage = addImacrosSpace(mobInviteMessage);
mobFriendList = addImacrosSpace(mobFriendList);
var jsNewLine="\n";

/********* Begin Openning Mobwars Wall's Pages *********/
var FaceBook_AddFromWall_Pages_Code;
FaceBook_AddFromWall_Pages_Code = "CODE:";
FaceBook_AddFromWall_Pages_Code = FaceBook_AddFromWall_Pages_Code+"SET !ERRORIGNORE YES" + jsNewLine;
if(showImages == "0"){
// Disable images to have more speed
FaceBook_AddFromWall_Pages_Code = FaceBook_AddFromWall_Pages_Code+"FILTER TYPE=IMAGES STATUS=ON" + jsNewLine;
}
// Open mobwars wall
FaceBook_AddFromWall_Pages_Code = FaceBook_AddFromWall_Pages_Code+"URL GOTO=http://www.facebook.com/wall.php?id=" + applicationIDNumber + "&page={{PageNumber}}" + jsNewLine;
FaceBook_AddFromWall_Pages_Code = FaceBook_AddFromWall_Pages_Code+"FILTER TYPE=IMAGES STATUS=OFF" + jsNewLine;
FaceBook_AddFromWall_Pages_Code = FaceBook_AddFromWall_Pages_Code+"WAIT SECONDS=1";
/********* End Openning Mobwars Wall's Pages *********/

/********* Begin Openning Mobwars Wall's Links *********/
var FaceBook_AddFromWall_Links_Code;
FaceBook_AddFromWall_Links_Code = "CODE:";
FaceBook_AddFromWall_Links_Code = FaceBook_AddFromWall_Links_Code+"SET !ERRORIGNORE NO" + jsNewLine;
FaceBook_AddFromWall_Links_Code = FaceBook_AddFromWall_Links_Code+"SET !TIMEOUT 15" + jsNewLine;
if(showImages == "0"){
// Disable images to have more speed
FaceBook_AddFromWall_Links_Code = FaceBook_AddFromWall_Links_Code+"FILTER TYPE=IMAGES STATUS=ON" + jsNewLine;
}
FaceBook_AddFromWall_Links_Code = FaceBook_AddFromWall_Links_Code+"TAG POS={{LinkNumber}} TYPE=A ATTR=HREF:http://www.facebook.com/s.php?k=100000080*&&CLASS:profile_link" + jsNewLine;
FaceBook_AddFromWall_Links_Code = FaceBook_AddFromWall_Links_Code+"WAIT SECONDS=1";
/********* End Openning Mobwars Wall's Links *********/

/********* Begin Add  - Step1: Press "Add As Friend" *********/
var FaceBook_AddFromWall_Add_Step1_Code;
FaceBook_AddFromWall_Add_Step1_Code = "CODE:";
FaceBook_AddFromWall_Add_Step1_Code = FaceBook_AddFromWall_Add_Step1_Code+"SET !ERRORIGNORE NO" + jsNewLine;
FaceBook_AddFromWall_Add_Step1_Code = FaceBook_AddFromWall_Add_Step1_Code+"SET !TIMEOUT 15" + jsNewLine;
FaceBook_AddFromWall_Add_Step1_Code = FaceBook_AddFromWall_Add_Step1_Code+"TAG POS=1 TYPE=A ATTR=TXT:Add<SP>as<SP>Friend" + jsNewLine;
FaceBook_AddFromWall_Add_Step1_Code = FaceBook_AddFromWall_Add_Step1_Code+"FILTER TYPE=IMAGES STATUS=OFF" + jsNewLine;
FaceBook_AddFromWall_Add_Step1_Code = FaceBook_AddFromWall_Add_Step1_Code+"WAIT SECONDS=1";
/********* End Add  - Step1: Press "Add As Friend" *********/

/********* Begin Add  - Step2: Fill the forms *********/
var FaceBook_AddFromWall_Add_Step2_Code;
FaceBook_AddFromWall_Add_Step2_Code = "CODE:";
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"SET !ERRORIGNORE YES" + jsNewLine;
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"SET !TIMEOUT 15" + jsNewLine;
// Insert Message
if(mobInviteMessage!=""){
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=A ATTR=TXT:Add<SP>a<SP>personal<SP>message*" + jsNewLine;
//FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"WAIT SECONDS=1"+ jsNewLine;
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=TEXTAREA ATTR=ID:message CONTENT=" + mobInviteMessage + jsNewLine;
}
// Select Friendlist
if(mobFriendList!=""){
	//FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=SELECT FORM=NAME:NoFormName ATTR=ID:add_to_friend_list_widget_select_* CONTENT=$" + mobFriendList + jsNewLine;
	FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=SPAN ATTR=BINDPOINT:main&&CLASS:UIActionMenu_Main" + jsNewLine;
	FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=A ATTR=CLASS:UICheckList_Label CONTENT=" + mobFriendList + jsNewLine;
	//FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=INPUT:TEXT ATTR=CLASS:inputtext FriendAddingTool_CreateNewList CONTENT=" + mobFriendList + jsNewLine;
}
// Press Add Button
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=INPUT:BUTTON ATTR=ID:dialog_button1" + jsNewLine;
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"FILTER TYPE=IMAGES STATUS=OFF" + jsNewLine;
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"WAIT SECONDS=2";

/********* End Add - Step2: Fill the forms *********/

/********* Begin Close Box *********/
var FaceBook_AddFromWall_Close_Code;

FaceBook_AddFromWall_Close_Code = "CODE:";
FaceBook_AddFromWall_Close_Code = FaceBook_AddFromWall_Close_Code+"SET !ERRORIGNORE YES" + jsNewLine;
FaceBook_AddFromWall_Close_Code = FaceBook_AddFromWall_Close_Code+"SET !TIMEOUT 15" + jsNewLine;
FaceBook_AddFromWall_Close_Code = FaceBook_AddFromWall_Close_Code+"TAG POS=1 TYPE=INPUT:BUTTON ATTR=NAME:close&&VALUE:Close" + jsNewLine;
FaceBook_AddFromWall_Close_Code = FaceBook_AddFromWall_Close_Code+"FILTER TYPE=IMAGES STATUS=OFF" + jsNewLine;
FaceBook_AddFromWall_Close_Code = FaceBook_AddFromWall_Close_Code+"WAIT SECONDS=2";

/********* End Close Box *********/

/********* Begin Internal JavaScript Code *********/
var i1=0;
var i2=0;
var i3=0;
var i4=0;
var j=0;
var p=0;
for(p=startPage;p>=0;p--){
	iimSet ("-var_PageNumber", p);
	i1 = iimPlay(FaceBook_AddFromWall_Pages_Code);
	for(j=0;j<20;j++){
		iimSet ("-var_LinkNumber", j*2+1);
		i2 = iimPlay(FaceBook_AddFromWall_Links_Code);

		if (i2 >= 0) {
			iimSet ("-var_LinkNumber", j);
		    i3 = iimPlay(FaceBook_AddFromWall_Add_Step1_Code);
			if(i3 >= 0)
				i4 = iimPlay(FaceBook_AddFromWall_Add_Step2_Code);
		}else{
			break;
		}

	}
}

function addImacrosSpace(str){
	str = str.replace(/ /g, "<SP>");
	return str;
}
/********* End Internal JavaScript Code *********/
/********* End Code*********/
/********* By Soroush Dalili March-2009 Soroush.SecProject.Com *********/

Tagged with: All Facebook Application Walls • Facebook Add Friend • Facebook Automatic Friend Add • Facebook Automation Friend • Facebook Game Cheat • FaceBook MobWars Cheat

Jan 31

Blog Template Was Updated

Normal Posts No Comments »

I found some XSS vulnerabilities in my blog’s template, so I reported them to its creator (Inanis).

Thanks from Inanis because of fast fix and also for this beautiful template.

You can see these in this link:

http://www.inanis.net/blog/index.php/downloads/inanis-glass-wordpress-theme/inanis-glass-readme/

Tagged with: Blog Template • XSS Vulnerability

Jan 18

FaceBook MobWars New Cheat Updated: Automatic Friends Add in Facebook Technique by using iMacros!

Normal Posts 5 Comments »

Thanks from Mark because of telling me a good point about MobWars cheat. (In this link Please read this first if you are new)

So, I updated the codes to this new version:

Now you can send your special message and also select your friend list. Also, there is a trick to disable images during this operation in order to save the bandwidth and time!

Download .js file
or
Just save below codes as “AddmobwarsFriend.js” file and run it with iMacros. For more help, check this post.

//—————————-Begin “AddmobwarsFriend.js” ————————————

/********* By Soroush Dalili Jan-2009 Soroush.SecProject.Com *********/
/********* Begin Configuration – You can change these settings *********/
var startPage = 20; // You can change this value to your page number!
var mobInviteMessage = “Welcome to my MobWars!”; // You can add your message here
var mobFriendList = “”; // You can add your special friend list (you must made it before)
var showImages = “0″; // You can change it to “0″ (for disabling) and to “1″ (for enabling)
/********* End Configuration – You can change these settings *********/

/********* Begin Code *********/
// Replace <SP> instead of space character
mobInviteMessage = addImacrosSpace(mobInviteMessage);
mobFriendList = addImacrosSpace(mobFriendList);
var jsNewLine=”\n”;

/********* Begin Openning Mobwars Wall’s Pages *********/
var MW_AddFromWall_Pages_Code;
MW_AddFromWall_Pages_Code = “CODE:”;
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”SET !ERRORIGNORE YES” + jsNewLine;
if(showImages == “0″){
// Disable images to have more speed
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”FILTER TYPE=IMAGES STATUS=ON” + jsNewLine;
}
// Open mobwars wall
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”URL GOTO=http://www.facebook.com/wall.php?id=8743457343&page={{PageNumber}}” + jsNewLine;
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”FILTER TYPE=IMAGES STATUS=OFF” + jsNewLine;
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”WAIT SECONDS=2″;
/********* End Openning Mobwars Wall’s Pages *********/

/********* Begin Openning Mobwars Wall’s Links *********/
var MW_AddFromWall_Links_Code;
MW_AddFromWall_Links_Code = “CODE:”;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”SET !ERRORIGNORE YES” + jsNewLine;
if(showImages == “0″){
// Disable images to have more speed
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”FILTER TYPE=IMAGES STATUS=ON” + jsNewLine;
}
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS={{LinkNumber}} TYPE=A ATTR=HREF:http://www.facebook.com/s.php?k=100000080*” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=A ATTR=TXT:Add<SP>as<SP>Friend” + jsNewLine;
// Insert Message
if(mobInviteMessage!=”"){
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=A ATTR=TXT:Add<SP>a<SP>personal<SP>message*” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”WAIT SECONDS=1″+ jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=TEXTAREA ATTR=ID:message CONTENT=” + mobInviteMessage + jsNewLine;
}
// Select Friendlist
if(mobFriendList!=”"){
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=SELECT FORM=NAME:NoFormName ATTR=ID:add_to_friend_list_widget_select_* CONTENT=$” + mobFriendList + jsNewLine;
}
// Press Add Button
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=INPUT:BUTTON ATTR=ID:dialog_button1″ + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”FILTER TYPE=IMAGES STATUS=OFF” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”WAIT SECONDS=1″;
/********* End Openning Mobwars Wall’s Links *********/

/********* Begin Internal JavaScript Code *********/
var i1=0;
var i2=0;
var j=0;
var p=0;
for(p=startPage;p>=0;p–){
iimSet (“-var_PageNumber”, p);
i1 = iimPlay(MW_AddFromWall_Pages_Code);
for(j=1;j<40;j+=2){
iimSet (“-var_LinkNumber”, j);
i2 = iimPlay(MW_AddFromWall_Links_Code);
}
}

function addImacrosSpace(str){
str = str.replace(/ /g, “<SP>”);
return str;
}
/********* End Internal JavaScript Code *********/
/********* End Code*********/
/********* By Soroush Dalili Jan-2009 Soroush.SecProject.Com *********/
//—————————-End “AddmobwarsFriend.js” ————————————

Previous Entries Next Entries

Free WordPress Themes

Links

Symantec Security News

Genexus cannot connect to Genexus Server July 16, 2010
I need to connect with Genexus Server which exposes WCF services and I can`t reach it, even disabling Syamntec Endpoint Protection does not seem to work. The odd thing is that when I uninstalled Symantec Endpoint Protection everything worked just fine... allthough now my PC is not protected :( How can I configure SEP to allow this kind of communication? Rega […]
Adding a File to Quarantine - Windows 7 - Possible Bug July 16, 2010
This may have been brought up before, but I couldn't find anything on the forums. We're running SEP 11.0.6a. On Windows XP clients (32-bit), we can manually add files to the quarantine (go to the View Quarantine tab, click "Add..." then pick a file). On Windows 7 (we're using Enterprise, 64-bit), doing the same steps never brings up […]
SEP for embedded XP July 16, 2010
Can SEP for embedded XP be centrally managed from the same SEPM infrastructure used for standard Windows OS and MAC clients? […]

Google Reader

OWASP AppSec Germany 2010 Conference - OWASP July 16, 2010
[…]
OWASP’s (non)role in the Backdoored Firefox Addon | Portable Digital Video Recorder July 16, 2010
You may have recently read about two addons that were removed from the Mozilla addon store. One due to malicious code that would steal passwords and the second […]
New Statesman - Beware those Black Swans July 15, 2010
Shared by Jeff Williams "Do not give children sticks of dynamite, even if they come with a warning label" The bestselling economist Nassim Nicholas Taleb argues that we can’t make the world financial system immune to shocks –– but we can make sure it’s much more robust by building randomness into our planning. […]