full-disclosure - more than just malware.. [was: Google Malware Search]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.21.0607180907450.1369-100000@linuxbox.org>
Date: Tue, 18 Jul 2006 09:15:20 -0500 (CDT)
From: Gadi Evron <ge@...uxbox.org>
To: full-disclosure@...ts.grok.org.uk
Cc: funsec@...uxbox.org
Subject: more than just malware.. [was: Google Malware
	Search]

Guys, HD and the guys at Websense are obviously very cool for noting this
Google hacking technique and exploiting it (HD publicly).

Still, this thing can be used far and wide.. a lot more than just for
known signatures of malware, etc.
I was lucky enough to be playing with this for a bit before Websense went
completely public and HD made it public, so I came up with a few more
possibilities...
Also, I have cool friends who played with this and gave me some ideas
too! :)

A few examples I gave in my blog on this, inspired by Websense and then
HD's new tool, is to look for other signatures rather than just known
stuff.

For example, looking for UPX packers results in almost 10K suspect
samples:
signature: 00004550 UPX1

The PE binary part, and then the UPX section named UPX1.

Trying other combinations, possibly along with the filetype: feature, can
result in many interesting findings other than known malware. How many
packers and protection systems are out there for starters?

Also, tried any checks for open directory indexes? :)

I wrote more about this on my blog at securiteam:
http://blogs.securiteam.com/index.php/archives/513

	Gadi.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/