Blacklisted Security Researchers

As a security researcher you often encounter strange and unexpected behaviors visiting known-bad sites. In most cases you're actually hoping something will happen to your unpatched and disposable Web browser as you navigate a suspicious site that was reported to you by a customer or managed service provider.

You arm your system with numerous monitoring agents and wait for the unseen explosion of activity as your VM gets infected from some drive-by-download site. Or maybe not.

In the past I've talked about advancements to the X-morphic Attack Engines used by drive-by-download operators and how they often "blacklist" IP addresses of known security research institutions - such that the "good guys" don't get served the malicious goodies, and can't then discet the code and develop new protection signatures/algorithms.

Until recently I'd never actually seen one of those blacklists of security researchers that the bad guys don't want to serve their crimeware to up close - until now. Yuval Ben-Itzhak over at Finjan managed to uncover one such list from a crimeware toolkit and posted a nice blog about what they found - "Security vendors watch out, your IP address might be blacklisted by cybercriminals".

I guess the question now is whether I can get my home DSL netblock added to the blacklist for safer browsing by the family? Probably not.

(near) Cyberheist at Sumitomo Bank

John Leydon over at The Register has a great article on the recently announced failed cyberheist targeting Sumitomo Bank - "How police busted UK's biggest cybercrime case".

It's well worth the read.

I hadn't realized that the attempted heist was conducted back in 2006 and that the police had been working on the case for a couple of years. When I read previous news stories it kind of sounded like an open & shut case - but evidently not.

On a related note, someone recently asked me about the use of commercial keyloggers and why you'd want to use them? Well, there are several reasons:

1. They're plentiful and you can purchase them online with a credit card.
2. Many are designed to be used within corporate environments and their manufacturers have agreements with the major anti-virus companies to NOT raise a client-side alert to their presence (since its "probable" that the IT department installed the keylogger intentionally for HR/police monitoring purposes).
3. Many of the commercial keyloggers allow you to download trial versions, and you can also acquire licence key generators from many of the warez sites (i.e. you don't even need to pay the money if you were criminally inclined).
4. Typing "keylogger" in to Google will yield pages of links to commercial keyloggers first (lazy criminals ;-)

If you're interested in learning more about keylogging technologies, I wrote a couple of blogs on the topic a while back over on my main Web site www.technicalinfo.net.

• Professional Keylogging
• Commercial Keylogging