Hidden Tear - Script Kiddies Ransomware Demo

fFile Encrypter Ransomware (CryptoLocker) is a common one, victims' files are encrypted, and evils will ask for ransom so as to give them the keys to decrypt the locked files. According to Hackernews (http://thehackernews.com/2015/08/ransomware-creator-toolkit.html) , script kiddies can also get the source code and create the ransomware themselves.

Today I have tried to get the source and become a script kiddie to test in my virtual environment, REMEMBER just test within your own environment, don't try it on your host machine and other computers... in case the program crashed and you have lost the key :o)....

1.) As a victim, Windows 7 64x,... he browses a fake Google website, and find free PDF, haha (actually people get ransomware elsewhere, hacked websites or some other ;)...)

2.) The victim downloaded the so called PDF file (actually it's an exe with PDF icon, for testing purpose, all antivirus and warning are turned off)

3.) In his desktop, there are some important files

4.) The victim tried to open the PDF file, and nothing happend except..... the text files on the desktop were given new extension "*.locked"... and content is one, oh dear... :(

5.) Wait, there's a file called "Read_IT.txt"... and the evil was asking for "ransom"...

6.) Okok....the victim surrendered and "paid" the ransom, the evil kept the promise and gave him the decrypter and the key (not sure in reality)...

and Yeah baby, the files were back to normal!

=========================================================

Ok, the above is the demonstration of how the ransomware locked the files and they "could be" decrypted afterwards. Let's analyze the some of the source code, behavior and traffic.

For the source code, you could get it from github, the sample is simply a .Net program, changed the parameters and compiled it again. From Readme, change the location of evil server, so that the encryption key could be sent to it. The blackmail message could be configured as well. For testing, HTTP is used, not HTTPS.

The password is created randomly and encrypt the files.

The decrypter just gets the input and decrypt the files.

For evil server, I was using the Kali Linux (any web servers will do), it's writing the key to a text file. The machine name, user name and key were saved. The key was randomly created.

For traffic, we can take a look on the pcap, it's sending the key back to the evil server, of course in real case, it may be HTTPS that we will have less information for analysis.

After some analysis, how about anti-virus detection? Normally when downloading an executable, it would warn you whether you want to keep or discard, and executing it, system may ask you whether you really want to run it, of course it's another story if the file was downloaded due to other means like browser exploitation.

Also, in the VM, the file was actually detected by the scanner. The hidden-tear.exe is also submitted to VirusTotal, it's detected as CryptoLocker. (https://www.virustotal.com/en/file/ad2cfd31e5220eaf3ca8bcab5b963505f203b96fa31a8002312ecc45708a3c41/analysis/1440052245/)

That's all for today, the demo is completed. Good luck and not suffering CryptoLocker anymore my friends :)

Arduino 4-digit-7-segment display counter

Tried a single digit 7-segment display previously, this time tried a 12-pins 4-digit-7-segment display. Using 7 segments to display a digit, for four digits, it's controlled by selecting the digit to HIGH, and segments to LOW (since it's common anode like the previous one).
Using multiplexing at one time only one digit is active(e.g. for 2ms). All digits is turned on is serial, but because human’s eye is inert we have illusion, that all digits are lighting at same time. (ref: https://www.electronicsblog.net/4-digits-7-segments-led-display-multiplexing-with-arduino/)

The circuit can be built as following: (ref: http://ecotronics.ch.honorius.sui-inter.net/wordpress/2013/multiplexed-4-digit-7-segment-led-display-mit-arduino-ansteuern/)

To make the counter, actually the display is rapidly refreshing to display the digits.

the programming will be as following: (adapted from the codes: https://www.electronicsblog.net/4-digits-7-segments-led-display-multiplexing-with-arduino/)

 // segment | Arduino board PIN number   
 #define segG 12  
 #define segF 11  
 #define segA 6  
 #define segB 7  
 #define segE 10  
 #define segD 9  
 #define segC 8  
 #define DP 13  
 #define GND1 2  
 #define GND2 3  
 #define GND3 4  
 #define GND4 5  
 int timer=0;   
 int i=0;  
 // functions to display digits  
 void digit0 () {  
  digitalWrite(segA, LOW);  
  digitalWrite(segB, LOW);  
  digitalWrite(segC, LOW);  
  digitalWrite(segD, LOW);  
  digitalWrite(segE, LOW);  
  digitalWrite(segF, LOW);  
  digitalWrite(segG, HIGH);  
 };  
 void digit1 () {  
  digitalWrite(segA, HIGH);  
  digitalWrite(segB, LOW);  
  digitalWrite(segC, LOW);  
  digitalWrite(segD, HIGH);  
  digitalWrite(segE, HIGH);  
  digitalWrite(segF, HIGH);  
  digitalWrite(segG, HIGH);  
 };  
 void digit2 () {  
  digitalWrite(segA,LOW);  
  digitalWrite(segB, LOW);  
  digitalWrite(segC, HIGH);  
  digitalWrite(segD, LOW);  
  digitalWrite(segE, LOW);  
  digitalWrite(segF, HIGH);  
  digitalWrite(segG, LOW);  
 };  
 void digit3 () {  
  digitalWrite(segA,LOW);  
  digitalWrite(segB, LOW);  
  digitalWrite(segC, LOW);  
  digitalWrite(segD, LOW);  
  digitalWrite(segE, HIGH);  
  digitalWrite(segF, HIGH);  
  digitalWrite(segG, LOW);  
 };  
 void digit4 () {  
  digitalWrite(segA,HIGH);  
  digitalWrite(segB, LOW);  
  digitalWrite(segC, LOW);  
  digitalWrite(segD, HIGH);  
  digitalWrite(segE, HIGH);  
  digitalWrite(segF, LOW);  
  digitalWrite(segG, LOW);  
 };  
 void digit5 () {  
  digitalWrite(segA,LOW);  
  digitalWrite(segB, HIGH);  
  digitalWrite(segC, LOW);  
  digitalWrite(segD, LOW);  
  digitalWrite(segE, HIGH);  
  digitalWrite(segF, LOW);  
  digitalWrite(segG, LOW);  
 };  
 void digit6 () {  
  digitalWrite(segA,LOW);  
  digitalWrite(segB, HIGH);  
  digitalWrite(segC, LOW);  
  digitalWrite(segD, LOW);  
  digitalWrite(segE, LOW);  
  digitalWrite(segF, LOW);  
  digitalWrite(segG, LOW);  
 };  
 void digit7 () {  
  digitalWrite(segA,LOW);  
  digitalWrite(segB, LOW);  
  digitalWrite(segC, LOW);  
  digitalWrite(segD, HIGH);  
  digitalWrite(segE, HIGH);  
  digitalWrite(segF, HIGH);  
  digitalWrite(segG, HIGH);  
 };  
 void digit8 () {  
  digitalWrite(segA, LOW);  
  digitalWrite(segB, LOW);  
  digitalWrite(segC, LOW);  
  digitalWrite(segD, LOW);  
  digitalWrite(segE, LOW);  
  digitalWrite(segF, LOW);  
  digitalWrite(segG, LOW);  
 };  
 void digit9 () {  
  digitalWrite(segA, LOW);  
  digitalWrite(segB, LOW);  
  digitalWrite(segC, LOW);  
  digitalWrite(segD, LOW);  
  digitalWrite(segE, HIGH);  
  digitalWrite(segF, LOW);  
  digitalWrite(segG, LOW);  
 };  
 //function to display digit from inputed int  
 void showdigit (int digit)  
 {  
  switch (digit) {  
  case 0:  
   digit0 ();  
   break;  
  case 1:  
   digit1 ();  
   break;  
  case 2:  
   digit2 ();  
   break;  
  case 3:  
   digit3 ();  
   break;  
  case 4:  
   digit4 ();  
   break;  
  case 5:  
   digit5 ();  
   break;  
  case 6:  
   digit6 ();  
   break;  
  case 7:  
   digit7 ();  
   break;  
  case 8:  
   digit8 ();  
   break;  
  case 9:  
   digit9 ();  
   break;  
  default:  
   break;  
  };   
 };  
 // showing 4 digits  
 void showdigits (int number)  
 {  
  // e.g. we have "1234"  
  showdigit(number/1000); // segments are set to display "1"  
  digitalWrite(GND1, HIGH); // first digit on,  
  digitalWrite(GND2, LOW); // other off  
  digitalWrite(GND3, LOW);  
  digitalWrite(GND4, LOW);  
  delay (1);  
  number = number%1000; // remainder of 1234/1000 is 234  
  digitalWrite(GND1, LOW); // first digit is off  
  showdigit(number/100); //// segments are set to display "2"  
  digitalWrite(GND2, HIGH); // second digit is on  
  delay (1); // and so on....  
  number =number%100;    
  digitalWrite(GND2, LOW);  
  showdigit(number/10);  
  digitalWrite(GND3, HIGH);  
  delay (1);  
  number =number%10;   
  digitalWrite(GND3, LOW);  
  showdigit(number);   
  digitalWrite(GND4, HIGH);  
  delay (1);  
 };   
 void setup()  
 {  
  pinMode(segA, OUTPUT);  
  pinMode(segB, OUTPUT);  
  pinMode(segC, OUTPUT);  
  pinMode(segD, OUTPUT);  
  pinMode(segE, OUTPUT);  
  pinMode(segF, OUTPUT);  
  pinMode(segG, OUTPUT);  
  pinMode(DP, OUTPUT);  
  pinMode(GND1, OUTPUT);  
  pinMode(GND2, OUTPUT);  
  pinMode(GND3, OUTPUT);  
  pinMode(GND4, OUTPUT);  
 };  
 void loop ()  
 {   
  timer++;  
  showdigits (i);  
  if (timer==10) {  
   timer=0;  
   i++;  
   if (i>10000) {  
    i=0;  
   };  
  };   
 };  

Arduino 7 Segment LED Counter

Same environment with Kali Linux 2.0 and Arduino IDE, this time trying to work on a common anode 7-segment LED display. The 7-segment display consists of 7 segments (A to G) and one dot (DP), to display a number, controlling whether the segment is on or off.

Before building the circuit, testing if the segments are working,

Building the circuit as below:
Connect the seven segment displays pin number 7(A) to arduino pin2 , 6(B) to arduino pin3 , 4 (C) to arduino pin 4 , 2 (D) to arduino pin5 , 1 (E) to arduino pin6 , 9 (F) to arduino pin7 , 10 (G) to arduino pin8 , 5 (DP) to arduino pin9.

ref: http://www.hacktronics.com/Tutorials/arduino-and-7-segment-led.html
ref: http://www.instructables.com/id/Seven-Segment-Display-Tutorial/?ALLSTEPS

Since it's a common anode 7-segment display, when coding, HIGH means off and LOW means on. For example, displaying zero, A to G are ON and G is OFF.
///
void digit0 () {

  digitalWrite(A, LOW);
  digitalWrite(B, LOW);
  digitalWrite(C, LOW);
  digitalWrite(D, LOW);
  digitalWrite(E, LOW);
  digitalWrite(F, LOW);
  digitalWrite(G, HIGH);
};
///

Sample code, just straight forward to hardcode all digits :)

 //7 segment digital display  
 int A = 2;  
 int B = 3;  
 int C = 4;  
 int D = 5;  
 int E = 6;  
 int F = 7;  
 int G = 8;  
 int DP = 9;  
 //common anode 7 -segment digital display  
 //HIGH and LOW should be inverted  
 void digit0 () {  
  digitalWrite(A, LOW);  
  digitalWrite(B, LOW);  
  digitalWrite(C, LOW);  
  digitalWrite(D, LOW);  
  digitalWrite(E, LOW);  
  digitalWrite(F, LOW);  
  digitalWrite(G, HIGH);  
 };  
 void digit1 () {  
  digitalWrite(A, HIGH);  
  digitalWrite(B, LOW);  
  digitalWrite(C, LOW);  
  digitalWrite(D, HIGH);  
  digitalWrite(E, HIGH);  
  digitalWrite(F, HIGH);  
  digitalWrite(G, HIGH);  
 };  
 void digit2 () {  
  digitalWrite(A, LOW);  
  digitalWrite(B, LOW);  
  digitalWrite(C, HIGH);  
  digitalWrite(D, LOW);  
  digitalWrite(E, LOW);  
  digitalWrite(F, HIGH);  
  digitalWrite(G, LOW);  
 };  
 void digit3 () {  
  digitalWrite(A, LOW);  
  digitalWrite(B, LOW);  
  digitalWrite(C, LOW);  
  digitalWrite(D, LOW);  
  digitalWrite(E, HIGH);  
  digitalWrite(F, HIGH);  
  digitalWrite(G, LOW);  
 };  
 void digit4 () {  
  digitalWrite(A, HIGH);  
  digitalWrite(B, LOW);  
  digitalWrite(C, LOW);  
  digitalWrite(D, HIGH);  
  digitalWrite(E, HIGH);  
  digitalWrite(F, LOW);  
  digitalWrite(G, LOW);  
 };  
 void digit5 () {  
  digitalWrite(A, LOW);  
  digitalWrite(B, HIGH);  
  digitalWrite(C, LOW);  
  digitalWrite(D, LOW);  
  digitalWrite(E, HIGH);  
  digitalWrite(F, LOW);  
  digitalWrite(G, LOW);  
 };  
 void digit6 () {  
  digitalWrite(A, LOW);  
  digitalWrite(B, HIGH);  
  digitalWrite(C, LOW);  
  digitalWrite(D, LOW);  
  digitalWrite(E, LOW);  
  digitalWrite(F, LOW);  
  digitalWrite(G, LOW);  
 };  
 void digit7 () {  
  digitalWrite(A, LOW);  
  digitalWrite(B, LOW);  
  digitalWrite(C, LOW);  
  digitalWrite(D, HIGH);  
  digitalWrite(E, HIGH);  
  digitalWrite(F, HIGH);  
  digitalWrite(G, HIGH);  
 };  
 void digit8 () {  
  digitalWrite(A, LOW);  
  digitalWrite(B, LOW);  
  digitalWrite(C, LOW);  
  digitalWrite(D, LOW);  
  digitalWrite(E, LOW);  
  digitalWrite(F, LOW);  
  digitalWrite(G, LOW);  
 };  
 void digit9 () {  
  digitalWrite(A, LOW);  
  digitalWrite(B, LOW);  
  digitalWrite(C, LOW);  
  digitalWrite(D, LOW);  
  digitalWrite(E, HIGH);  
  digitalWrite(F, LOW);  
  digitalWrite(G, LOW);  
 };  
 //function to display digit from inputed int  
 void showdigit (int digit) {  
  switch (digit) {  
  case 0:  
   digit0 ();  
   break;    
  case 1:  
   digit1 ();  
   break;    
  case 2:  
   digit2 ();  
   break;    
  case 3:  
   digit3 ();  
   break;    
  case 4:  
   digit4 ();  
   break;    
  case 5:  
   digit5 ();  
   break;    
  case 6:  
   digit6 ();  
   break;    
  case 7:  
   digit7 ();  
   break;    
  case 8:  
   digit8 ();  
   break;    
  case 9:  
   digit9 ();  
   break;    
  default:  
   break;  
  };  
 }  
 void setup() {  
  pinMode(A, OUTPUT);  
  pinMode(B, OUTPUT);  
  pinMode(C, OUTPUT);  
  pinMode(D, OUTPUT);  
  pinMode(E, OUTPUT);  
  pinMode(F, OUTPUT);  
  pinMode(G, OUTPUT);  
  pinMode(DP, OUTPUT);  
 };  
 void loop () {  
  for (int i=0;i<10;i++) { //counting from 0 to 9  
   showdigit(i);  
   delay (1000); // 1000ms= 1s delay  
  };  
 };  

Arduino Simple Traffic Light

Using the same development environment (Kali Linux 2.0 + Arduino IDE), we can build a simple traffic light. The setup can be referenced here, just the three LEDs wired with resistors to three separate input pins, and all connected to the ground.  (http://www.makeuseof.com/tag/arduino-traffic-light-controller/)

The sample sequence as following:
Red (5s)
Red + Yellow (2s)
Green  (5s)
Yellow (2s)
Red (5s)... loop back again

The sample code:

 int red = 13; int yellow = 12; int green = 11;  
 void setup(){   
  pinMode(red,OUTPUT);   
  pinMode(yellow,OUTPUT);   
  pinMode(green,OUTPUT);   
 }  
 void loop(){   
  changeLights();   
 }    
 void changeLights(){   
  //red first  
  digitalWrite(red,HIGH);   
  digitalWrite(green,LOW);   
  digitalWrite(yellow,LOW);   
  delay(5000);    
  //red + yellow   
  digitalWrite(red,HIGH);   
  digitalWrite(yellow,HIGH);   
  digitalWrite(green,LOW);   
  delay(2000);  
  //green  
  digitalWrite(red,LOW);   
  digitalWrite(yellow,LOW);   
  digitalWrite(green,HIGH);   
  delay(5000);  
  //yellow  
  digitalWrite(red,LOW);   
  digitalWrite(yellow,HIGH);   
  digitalWrite(green,LOW);   
  delay(2000);  
 }  

Kali Linux 2.0 and Arduino

Kali Linux 2.0 has been released for some time, and Arduino IDE is already included in the system. :)
Simply launch Kali Linux, and on the left menu, you can find Arduino IDE. I am not good at building circuits / electronic stuff, but it's fun to play with. I am totally new to this area, correct me if I am wrong :)

The IDE already contains a lot of examples that you can try.

Simply connecting the Arduino board with USB, and try blinkg test. To build the circuit, connect one end of the resistor to Arduino pin 13. Connect the long leg of the LED (the positive leg, called the anode) to the other end of the resistor. Connect the short leg of the LED (the negative leg, called the cathode) to the Arduino GND (ref: https://www.arduino.cc/en/Tutorial/Blink?from=Tutorial.BlinkingLED)