Kategoriearchiv: Case Studies

A new IoT malware loader: „privatgodgg.sh“

/ März 9, 2017/ IT Security, IT Security News&Updates/ 0Kommentare

As usual, it targets ARM-based devices and it tries to download other files (privntpd1, privsshd1, privopenssh1, privbash1, privtftp1, privwget1 etc) via curl or wget (whichever is available on the infected devices). As usual, we suspect this loader to be injected via unauthenticated telnet/hard-coded credentials – although it could be a RCE, but we haven’t found indications about that. As soon


IoT Malware advances

/ Februar 16, 2017/ IoT News&Updates, IoT Security, IT Security, IT Security News&Updates/ 0Kommentare

A new strain (as long as December 2016 can be called new) has been spotted on GitHub that combines both a standard telnet scanner and also MIRAI. It has been uploaded here:https://github.com/geo93033/u. In the header(s) you can find some credentials: Xmpp: b1nary@nigge.rs Twitter: @P2PBOTNET Instragram: @Rebirth.c Skype: b1narythag0d and Skype: uriede XMPP: Crypt@nigge.rs Changes: Made Date: 7-30-16 And also a


Google Dork Hacking: „use our awesome search tool…“

/ Februar 14, 2017/ IT Security/ 0Kommentare

„… to find the right candidates“ Why would anyone (or anything – as in a software or a web-bot) search for a string like „site:.eu „use our awesome search tool to find the right candidates““ on Google? Well, probably to extract some information. Personal Identifiable Information / Sensitive Personal Information? Maybe. For what use? One we can think of: phishing.


Gr1N – a new malware that also targets IoT devices?

/ Februar 8, 2017/ IoT Devices&Security, IoT Security, IT Security, IT Security News&Updates/ 0Kommentare

While doing some investigations for one of our clients, we came across a (new) malware strain. After some quick investigations, we found out 2 sources (both in C++, a client and a server). They are signed with: // Client.c Made By @Gr1n1337 – // DeepWeb Fourms User Name – Gr1n – // This Client Only Has UDP TCP HTML –


Google Analytics – no data validation?

/ November 29, 2016/ IT Security, IT Security News&Updates/ 0Kommentare

Recently, one of our clients contacted about something rather strange: a „language“ value in his newly Google Analytics setup that stated: „Secret.ɢoogle.com You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!“ Of course, we all know that browser headers/requests can be easily altered, but we still wonder why Google allows such values in it’s [non-bot]


RTT. Retaliate if CyberAttacked

/ Oktober 6, 2016/ IoT Security/ 0Kommentare

Our RTT solution helps companies retaliate if attacked by vulnerable / infected IoT devices. Still in Beta, but you can get a glimpse of it at any time. Just e-mail us at office@evosec.eu for more details.