Enter your password securely

I came across a nifty little utility that just might keep you from having your passwords stolen from you by a keylogger or similar devices and programs. Neo Aplin wrote this tiny little app called Neo's SafeKeys which will let you enter your passwords via a little onscreen keyboard. The really nifty part is that not only are you defeating keyboard loggers, but it places the buttons differently and the program window is a different size each time it's run, thereby defeating any program that attempts to log which button was clicked by mouse placement. All-in-all if you use public computers or even are just paranoid about your own and run Windows, this app's for you! If you missed the above link, here it is again.

USB Flash Drive Virus Proof of Concept

I came across something very disturbing a few minutes ago, and I think the world really needs to know about it. I know you all know that Windows is horribly vulnerable to every PC malady that has ever existed, but here's one that is basically built-in on purpose by Microsoft.

This particular exploit utilizes the built in autorun.inf 'feature' in all recent versions of Windows to run its payload, whose source code can be seen at QuantumG's site where I Stumbled Upon it. What the code does, is basically as soon as you insert the flash drive containing this program, opener.exe, and the 4 lines in autorun.inf, it will find any other removable drives, copy itself onto them, and hide itself. The actual process goes like this:

1. Open an explorer window for the drive we're running from.
2. Make sure there is only one copy of opener.exe running.
3. Scan the available drives for any that are removable.
4. Check that there is some free space on the drive.
5. Check that the drive doesn't already have an autorun.inf.
6. Dump the following into autorun.inf:

   [autorun]
   shell\eject=Eject
   shell\eject\command=opener.exe
   shell=eject
   

   This creates a new shell command which I've just randomly named "Eject" and, importantly, makes it the default action.
7. Write a copy of opener.exe to the drive.
8. Mark both autorun.inf and opener.exe as hidden.
9. Do any other removable drives we can find.
10. Wait about a minute.
11. Go back to step 3.

This is very basic virus behavior, but if the author was malicious, absolutely anything they wanted to do could be done. This has very serious implications for users, and needs to be addressed post-haste by Microsoft. Let's get the word out, you can help by Stumbling, Digging, or doing whatever you can to share this post and get it fixed.

Original site at http://rtfm.insomnia.org/~qg/opener.php
Image courtesy of Francois Thé

Windows Vista important security announcement

It's come to my attention that there is a serious security issue in Windows Vista that all users should be aware of. It involves the use of Unicode characters to change the way that a filename appears in the explorer and desktop to make a dangerous executable in screensaver (.scr) format appear to be a harmless JPG. This vulnerability doesn't appear to exist in XP, only Vista. The following screenshots, as captured by Max Ried, demonstrate the vulnerability and show how serious the problem is.

The file on the XP desktop: The file on the Vista desktop:








As you can see the only way to identify it as not being just a picture is by hovering your mouse over it. It appears to me that this is done by using a particular character, which is actually 2 Unicode characters, one being the circle of commas, the other being the code which causes everything after it to be typed backwards. You can see how it works by copying the character, and pasting it into any text entry box, such as notepad.exe, then start typing right after you paste it. The character is at the bottom of this post as it becomes very hard to type forwards if pasted anywhere in the middle of the article. It looks like the filename is made up of the code to insert the gpj. backwards at the end of the filename (or appear as such to the viewer,) and then the actual filename, Nice Picture.scr. Apparently XP is not affected because it does not correctly support Unicode for filenames within explorer.exe and therefore the desktop. This vulnerability was first demonstrated at Heise Security and adapted here to include my additional data on the cause.

Another view of the problem in the 7Zip program, first in XP:















And in Vista:













And now the character I believe is responsible, along with the character that makes it possible to copy and paste it, otherwise the character doesn't take up any space and therefore can't be highlighted to copy, it would just cause everything you typed after it to be backwards, as I'll demonstrate here:

‫‬‭‮‪‫‬‭‮҉

this is what happens after you paste and start typing
‫‬‭