Is it really that easy to bypass firewall and antivirus?
Someone emailed me asking this very question. The short answer is NO, unless you are good in programming and know MS VC++. Of cuz assuming u're writing a trojan for Windows.
The longer answer is YES tho. It is actually a simple affair to bypass AV. Just write unique code, don't rip off stuffs you download from the net. Once you can do that, you bypass AV, since AV detect by known signature, NOT behaviour.
How about firewall? Ok, software based firewall eg ZoneAlarm and Sygate Personal Firewall, well they block traffic based on known application, eg iexplore.exe or firefox.exe. The cruel fact is you can write a program to hijack running apps to do work for you. This is known as DLL Injection. How it works is via a combinatino of a few things, including SetWindowsHookEx, (optionally) LoadLibrary and Windows Messages. You can get running apps (your trojan) to ask other apps to load a DLL of your choosing.
Using Windows Messages is particularly good. You can intercept standard messages like alt-tab/windows focus, keypress and mouse click. Anyway in the example of bypassing firewall, you write a DLL with functions to log keypress and upload to a FTP server. Then you write a hook to make every app that is run by the user load your DLL. Eg he run notepad, it loads your DLL and log keypress. This is allowed cuz Windows allows programs to load DLL, since that's how Windows functions!
When you detect a alt-tab/window focus to eg Internet Explorer (aka iexplore.exe), you request iexplore.exe to load your DLL as normal. But this time since it's iexplore.exe, ur DLL runs an extra function, which is to FTP ur logs to your FTP server. Since Internet Explorer is most likely already approved by ur SPF or ZA as an ok-to-access-net app, the upload succeeds without user intervention or firewall blocking!
If you need source to explain more, just email me.
But wait, how to infect the person? Simple, u need another app, called a joiner. You can write your own (best) or download some but those likely detected by AV. To write a joiner u need to understand CreateFileFromResource. Once u do, it's a simple affair to package your own trojan using a nice payload like a game crack.
The longer answer is YES tho. It is actually a simple affair to bypass AV. Just write unique code, don't rip off stuffs you download from the net. Once you can do that, you bypass AV, since AV detect by known signature, NOT behaviour.
How about firewall? Ok, software based firewall eg ZoneAlarm and Sygate Personal Firewall, well they block traffic based on known application, eg iexplore.exe or firefox.exe. The cruel fact is you can write a program to hijack running apps to do work for you. This is known as DLL Injection. How it works is via a combinatino of a few things, including SetWindowsHookEx, (optionally) LoadLibrary and Windows Messages. You can get running apps (your trojan) to ask other apps to load a DLL of your choosing.
Using Windows Messages is particularly good. You can intercept standard messages like alt-tab/windows focus, keypress and mouse click. Anyway in the example of bypassing firewall, you write a DLL with functions to log keypress and upload to a FTP server. Then you write a hook to make every app that is run by the user load your DLL. Eg he run notepad, it loads your DLL and log keypress. This is allowed cuz Windows allows programs to load DLL, since that's how Windows functions!
When you detect a alt-tab/window focus to eg Internet Explorer (aka iexplore.exe), you request iexplore.exe to load your DLL as normal. But this time since it's iexplore.exe, ur DLL runs an extra function, which is to FTP ur logs to your FTP server. Since Internet Explorer is most likely already approved by ur SPF or ZA as an ok-to-access-net app, the upload succeeds without user intervention or firewall blocking!
If you need source to explain more, just email me.
But wait, how to infect the person? Simple, u need another app, called a joiner. You can write your own (best) or download some but those likely detected by AV. To write a joiner u need to understand CreateFileFromResource. Once u do, it's a simple affair to package your own trojan using a nice payload like a game crack.
posted by Beng Hacks at 7:10 PM
5 comments
