Flasad32.dll

Just thought I'd drop a quick "blog turd" to get another hit from Google.

Long story short(ish): had a victim of some type of Russian malware, likely a password stealing bank Trojan.  The anti-virus was clueless.  Found one suspect DLL, deleted it, and another (the title of this post) appeared to take its place.  When I went to Google the name of this DLL, Google had nothing.  So I thought I'd take advantage of that as long as they came up with blanks.

This was a few days ago.  The situation hasn't changed.

There was some silly ASCII stuff inside the DLL, very similar to stuff I found in the first DLL.  I will share it with you here...

He standard alive cutting get cup, point itself sign, were waste establish in happened five, through balloon, smaller sing without thirty set between swim development Andy national without, citizen manufacturing quit fifth in wrong at still pencil egg falloff behind water above taught, threw, thing lips whale alive cutting get cup point breakup aboard went torn draw establish in build wear, five let separate wept, fur sing completely jar development under comeup Illinois above rest increase manufacturing thou lit will still pencil wound over drive falloff breakfast leader from Johnny lips whale alive cutting, get cup, point itself sign draw establish proper five let onto arrive smaller constantly of once development under, ancient, national inside fit before thou in let will, on ranch pencil wound happily movement leader thing lips, whale alive cutting get above, frame point itself between like were waste, establish burst, wear of kill let onto arrive into, spent fur sing, completely jar development Andy national without spread manufacturing quit at scared yet become on ranch pencil egg falloff, breakfast leader thing from bat whale above, clock cutting get above frame point out of offer sign, in comeup, Germany establish burst wear five bar smaller constantly set child development Andy. 

So there you have it.  Not sure what the point is, but the "pencil egg" theme, "thing lips", and "Andy" were in the first DLL as well.  Before you go and make a firewall rule with this data, be advised I don't know if this is the malware itself or part of the payload.  I don't have a full forensic environment (I work for Cheap Bastards), so studying it in depth was out of the question.  I opted to "nuke and forget", but I did keep both DLLs, just to see how long it will take for the AV companies to catch up.

"Flasad" could be construed to be a corruption of "Flash Ad".  Something had to download it to replace the original one that got deleted, so it's not 100% of the infection.  But I did find the text amusing, so there you have it.

Let me know if you got infected by this bug.  Drop a note and we'll compare results.

UPDATE 07/12/2012

This bugger was finally detected today as "Generic PWS.y!1e3" by an AV vendor who will remain nameless.

That took SIX FUCKING WEEKS.

So I was right.  It was a password Trojan.

I'm never wrong.  And when I am I delete that post anyway so there's no proof.

/* Shitty globals */

This is nothing earth-shattering so I'll try to make it short and sweet.  And I'll add the pertinent links later.  If I feel like it.

A couple of weeks ago, the InfoSec Institute announced a privilege escalation problem with wicd in Backtrack 5 R2, which caused the BT people to go into Butthurt Mode and emit a Class 3 Shit Storm.

"Tut, tut," they proclaimed, "you can't escalate privileges on a system designed to be run as root and besides it's not our fucking code."

The InfoSec people said "Ooopsie!", the wicd wonks fixed it, and everyone went on with their lives.

Meanwhile, Hinky stumbles onto a really insecure network while he's hacking around on BT5 R2.  Digging into the available BT tools, he finds netdiscover-0.3beta7, which is basically an arp-spoofing tool in the Information Gathering→Network Analysis→Identify Live Hosts "hive".

It worked great, except the built-in OID list was ancient and didn't identify over 90% of the hosts I found.  So I search around for the code and found this, in which the author states:

I’ve written a patch for NetDiscover 0.3-beta7 (the last release) that eliminates libnet dependency. 

Apparently he had some religious objection to linking the software with both libnet (old) and libpcap (well maintained), so he fixed it.  He then gives a link to the package at backtrack.it, the Italian headquarters of Backtrack.  So I figure hot damn this must be the place!  He then gives a link to the package, and the link doesn't fucking work.

Just my luck.

But this is the Internet, so it has to be somewhere.  I find "an equivalent package" here, also with the same notes about eliminating the dependencies on libnet.

Great.  Well that settles that.  And there's an OUI update script!  Great stuff.  I update the OUIs and compile the program and then...

I am disappoint.  : (

It works, but it doesn't find the hosts that the stock BT5/R2 version finds.  WTF is going on here?

So I run both programs through Wireshark to see the differences.  And the difference is: the BT5 version sends the correct MAC address of my NIC and the "equivalent package"—same version number and beta level, mind you—sets my MAC to...

ca:fe:ca:fe:ca:fe

How about that?  So I look into the code and sure enough, in the source file ifaces.c, under a comment titled...

/* Shitty globals */

... is an array of unsigned chars representing just that value.  As an experiment, I change the array to my MAC address, recompile, and run it.

It works fine.  It finds the same hosts that the standard, off the shelf, BT5 code—same version number and beta level—finds.  And now it identifies the OIDs properly.

So... what is the difference in the code, besides the OID issue?  Intrigued, I ran both executables through "strings" and discovered that the BT5 version is linked to libnet.  Try it yourself:

#~strings /usr/local/sbin/netdiscover | grep libnet

No denying this is not the same code.  The fine folks at Backtrack took "netdiscover-0.3beta7" and put the libnet stuff back in.

Like I said, this is not earth-shattering, but I have to take Backtrack's "not our code" position with a grain of salt from now on.  I ended up hacking "netdiscover-0.3beta7" to put the real MAC into the "CAFE" array, but I wouldn't have had to do that if BT would release their code.

Shitty globals or not.

Running Chromium as Root on BT5R2

Well, sort of.

You can't do it.  They (the omnipotent and wise developers of chromium) won't let you.  If you try to run it as root, you'll get this...

You can run it su'd as a regular user while logged in as root, but it takes a little X-Fu to get it done right.  First, create your user with the "adduser" command.  Then, give him access to the X display with the "xhost" command.

Here, our user is called "bob":

xhost +SI:localuser:bob

Now start a terminal session and "su bob".  Then run...

chromium-browser --user-data-dir=/home/bob

...and you're in.

This is not unique to Chromium,  The Tor Browser Bundle for Linux will also not let you run as root, which is a bitch and a half.  This trick will work with Tor as well, but it will bitch about the user's profile.  So far I haven't found (or looked for) an equivalent "user-data-dir" switch.

Chromium isn't in BT5R2 by default, so you need to install it with...

apt-get install chromium-browser

Neither is the Tor Browser Bundle, but I'm sure you can figure out how to install that.  It's as simple as downloading & extracting it.

So anyway, BT5R2 is the best version yet, but as usual I have my complaints.  I won't bore you with them now.

Give me another week.