midnite_runr
Re:The BackDoor Factory: Patch win86/64 PE and linux86/64 binaries wit...
on Friday July 18, 2014 @07:13PM (#8056064)
Hahaha, yea. OK, Apps coming from the Windows App Store are signed (same thing with apple). But I've been doing this research for a while and most windows application are NOT signed (even non-appstore commmercial software). AVs included, oh and sourceforge (they use NSIS, not certificates), that's freeware right? And AVs don't flag if you aren't signed, only if you have a bad signature, maybe (McAfee doesn't care). Plus I think you are meaning SmartScreen Filter, not SmartFilter; this doesn't stop malicious software, it only stops software that does have a bad signature, and warns when it's not commonly downloaded software (https://twitter.com/midnite_runr/status/451738775300087808/p...), so even if it was signed like the picture IE says "I don't know George, wtf". When Jimmy McKittenButts want's his catScreenSaver.exe he's going to get it, SmartSceen Filter be damned. The _only_ thing that stops this is whitelisting (Applocker) and a smart user.
Here's a sample from BDF, patched with a reverse shell and still works normally: https://www.virustotal.com/en/file/a31ed901abcacd61a09a84157...
Edit: more sarcasm
Re:The BackDoor Factory: Patch win86/64 PE and linux86/64 binaries wit...
on Friday July 18, 2014 @01:46PM (#8054456)
Author here, I strip digital signature by default. Plus not everyone signs their windows binaries. Only Microsoft really. Plus I put BDF + mitmproxy together to patch binaries via MITM: https://github.com/secretsquirrel/BDFProxy
Ok, so you can guess the wifi access points via bruteforce:
Example: http://getwifi.io/test <-- Easy.
No transport encryption.
And why is this better than a note on the frig?