le blog security

15° Man-in-the-middle (MIM) attack test : a. SSLSpoofer test: Since the file needs a service to work, it is stopped by DefenseWall. The spoofer has to be installed 'trusted to create and launch it's service, and to work; but as doing, DefenseWall is not...

Part III Client/server side attacks and other tests 11° URL obfuscation DefenseWall doesn’t claim to protect against URL obfuscation. Failed . 12° Internet Explorer exploits a) WMF exploits Note : DefenseWall doesn’t claim to prevent exploits themselves,...

Suite of Part 2 b) Worms and virus * With Feebs : The .hta file does launch IE on a false “hotmail.com secure mail server” link, mshta.exe is ‘untrusted too. Except the 100 % CPU annoyance, nothing happens once ‘untrusted processes are killed. Passed...

Part II In the wild with real malwares 7° Boot sector/Bios/MBR protection : MBR virus DefenseWall does not provide boot sector protection, and most of all, its service/driver is not a boot start but a system start: consequently, the protection during...

Part I Behaviour 1° Self-protection Intro : Execution protection DefenseWall doesn’t work on an execution-prevention principle. Then it won’t ever prevent Task Manager, Srip, notepad or calc.exe from being started (CreateProcessThread). It will just launch...

TESTS DEFENSEWALL ____________________________________ DefenseWall is an HIPS program, working on the « white-list » principle : It reduces the rights of the programs and executable files running outside of the trusted zone. The idea is to set the programs...

For the purpose of this test, we use two demonstrations which illustrate some rootkits methods, technology or behaviour. a.The first demonstration illustrates an hidden process method via Eprocess (physical memory access, ntoskrnl mapping etc).We use...

Result of online scans: the original file is detected by none AV on Virustotal, and the next image is related to the recompiled file as an .exe: This file is a Proof of Concept trojan designed to illustrate some firewall evasion methods: it hooks via...

Presentation of threats used in these tests: As said previously, we can't be as exhaustive as possibe: only samples of malwares and attacks are used.It is really statistically enough to test the efficiency of an HIPS. -adware/spyware: classical spywares...

With MSN Pass Sender: We configure this password stealer (here named roberto) and launch it: Here the fake process crss.exe is launched: Now the fake crss.exe install its windows hooks via msvbvm60.dll: hijack.exe launched via cmd trie to modify lsass.exe:...