Sendangrejo: Juli 2009

Den Mas Kukuh

Artikel ini tidak ditujukan untuk mengajari anda gimana mencuri data kartu kredit, tapi kami ingin memberitahu anda supaya di kemudian hari anda bisa terhindari dari kejahatan pencurian data kartu kredit. Istilah kejahatan kartu kredit yang biasa di istilahkan "carding" sejak adanya internet meningkat ratusan persen. Ironisnya Indonesia masuk dalam jajaran top 10 (sempat di peringkat pertama) sehingga kartu kredit terbitan Bank-Bank Indonesia ditolak ketika belanja online di situs luar negeri.
Hal ini juga pernah di alami oleh penulis yang ingin berlangganan majalah game luar negeri dengan pembayaran online lewat kartu kredit.

Para hacker sangat suka sekali kejahatan yang satu ini, kenapa? Karena kalau cuma nge-hack website atau deface (merubah tampilan/link website) merupakan sesuatu yang tidak ada untungnya. Dan hal ini bisa ke deteksi dan pelaku kejahatan bisa ketangkap dengan mudah kalau sites yang dia masuki memiliki TRACKER (program pelacak ip/link) atau LOG FILE (file yang mencatat aktivitas user/ip yang masuk ke website). Kalau carding mereka bisa bebas tanpa jejak dan juga kadang-kadang setelah mendapatkan datanya, mereka sebarkan antar hacker sehingga susah dilacak orang pertama yang mencuri data kartu kredit. Kejadian baru-baru ini yaitu situs internet teroris Indonesia juga di register dari hasil carding.

Ada beberapa cara yang digunakan oleh hacker dalam mencuri kartu kredit, antara lain:
1. Paket sniffer, cara ini adalah cara yang paling cepat untuk mendapatkan data apa saja. Konsep kerjanya mereka cukup memakai program yang dapat melihat atau membuat logging file dari data yang dikirim oleh website e-commerce (penjualan online) yang mereka incar. Pada umumnya mereka mengincar website yang tidak dilengkapi security encryption atau situs yang tidak memiliki security yang bagus.

2. Membuat program spyware, trojan, worm dan sejenisnya yang berfungsi seperti keylogger (keyboard logger, program mencatat aktifitas keyboard) dan program ini disebar lewat E-mail Spamming (taruh file-nya di attachment), mirc (chatting), messenger (yahoo, MSN), atau situs-situs tertentu dengan icon atau iming-iming yang menarik netter untuk mendownload dan membuka file tersebut. Program ini akan mencatat semua aktivitas komputer anda ke dalam sebuah file, dan akan mengirimnya ke email hacker. Kadang-kadang program ini dapat dijalankan langsung kalau anda masuk ke situs yang di buat hacker atau situs porno.

3. Membuat situs phising, yaitu situs sejenis atau kelihatan sama seperti situs aslinya. contoh di Indonesia ketika itu situs klik bca (www.klikbca.com), pernah mengalami hal yang sama. situs tersebut tampilannya sama seperti klikbca tetapi alamatnya dibikin beberapa yang berbeda seperti www.clikbca.com, www.kikbca.com, dll, jadi kalau netter yang salah ketik, akan nyasar ke situs tersebut. Untungnya orang yang membuat situs tersebut katanya tidak bermaksud jahat. Nah kalau hacker carding yang buat tuh situs, siap-siap deh kartu kredit anda bakal jebol.

4. Menjebol situs e-commerce itu langsung dan mencuri semua data para pelanggannya. Cara ini agak sulit dan perlu pakar hacker atau hacker yang sudah pengalaman untuk melakukannya. Pada umumnya mereka memakai metode injection (memasukan script yang dapat dijalankan oleh situs/server) bagi situs yang memiliki firewall. Ada beberapa cara injection antara lain yang umum digunakan html injection dan SQL injection. Bagi situs yang tidak memiliki security atau firewall, siap-siaplah dikerjain abis-abisan.

Ada beberapa cara lagi yang dilakukan para hacker, tapi cara-cara di atas adalah cara yang paling umum dilakukan hacker untuk carding. Cara yang tidak umum akan dijelaskan nanti di lain waktu. Kejahatan tidak hanya terjadi karena ada niat dari si pelaku, tetapi karena adanya kesempatan, waspadalah... waspadalah...

Den Mas Kukuh

Stopping network share infectors

Many viruses today are share infectors. They infect open shares throughout the network. A single infected computer is capable of infecting hundreds of other machines.

It is a common scenario that many sites have open shares on their servers where all users has unlimited access. The intention of these shares is to provide an universal area where all users can exchange common files and information. Other scenarios include shares that are not intended for common purposes, but they are open due to lack of planning and security.
No matter the reason, these file shares are highly exposed to viruses like Pinfi and Funlove that have open file shares as a target for infection.

A share infector scenario:

The figure above illustrates an unprotected workstation (IP: 192.168.0.13) that is allowed to execute a file infected with the Pinfi virus. The infected workstation will propagate open file shares on computers in the network, look for files with .exe and .scr extension on these shares and then try to infect these files.

All servers in this situation are protected with updated antivirus software, which monitors the file system on the servers. An attempt to infect files on these shares will be detected and infected files are instantly cleaned.

The problem, however, is that the workstation is still infected and will re-infect the .exe and .scr files shortly after the antivirus software has performed the first clean operation. We now have an infect-clean-infect cycle that will go on forever unless something is being done with the original infection: the infected workstation.

Finding the source of the problem

In a large network with hundreds, even thousands of machines, it can be really hard to find this particular workstation. The Virus Alert message normally just points at the target file for the infection, which virus that was found, and what has been done to the file. There is obviously a need for some extra information to solve this problem.

One way of solving the problem is to use an external tool to monitor a file that is likely to be infected. To avoid too many changes on any of the original servers it may be a good idea to set up a new test machine in the network, create an open share on this machine, and place a copy the .exe file here. In the Pinfi case we know that .exe files are attractive targets to infect, and we copy the file calc.exe from the \Windows directory to the new file share. The calc.exe file is now a “bait" for the infector.

Before we connect the “bait" machine to the network, we need to install a “sniffer" program. We think Ethereal is a good alternative, but programs like Sniffer Pro and Etherpeek will do as well, but Ethereal can be downloaded free of charge. It contains a lot of functionality, so in this paper we will only cover functions relevant to solve this particular scenario.

Install Ethereal

You need two components:

1. Install and run the WinPCap driver that can be downloaded from winpcap.polito.it
2. Install and run Ethereal - can be downloaded from ethereal.com

NOTE: Although our experience with Ethereal is good, we do not support it, so you use it at your own risk.

Monitoring the activity on the network

When Ethereal is installed, make sure that the NVC’s On-access scanner is running on the machine, and start the NVC Utilities program where you open the Messages window.

Before you start monitoring the file, make sure that it gets infected by watching the virus alerts in the Messages window. If no virus alerts appear, then the bait does not work. Check again to make sure that the directory containing the bait really is shared, and that all users have full access to the share.

If this still does not work, you may need to install Ethereal on one of the servers where the infection originally appeared. Some share infectors just infect shares that were available upon start of the infected program. In such a case, find a file here to use as bait for the infection.

Now start Ethereal. We want to capture the activity that the machine receives via the network. But we only want to focus on activity related to the bait, which is the calc.exe test file.

n the lower left corner there is a field labelled Filter: In this field type the string:

smb.file contains “calc.exe"

Select the command Capture/Start and then click OK. The capture window appears. From now on watch the activity in the NVC Utilities’ Messages window. As soon as there is a new infection on our bait, close the Ethereal capture window. The log from the capture appears in the main window. Make sure that our filter is active by clicking Apply.

By watching the “Source" and “Destination" columns you should now be able to see the IP addresses used in manipulations of the calc.exe file. In our case the local address for our machine is 192.168.0.15. The other IP address involved in the transactions is 192.168.0.13.

Obviously a machine with the address 192.168.0.13 is the infector. You can now solve the problem by isolating it and then perform a complete On-demand scan supplied with the relevant fix(es).

Repeat the process to ensure that there are no other infectors in the network.

source: Norman antivirus

Kamis, 16 Juli 2009

Situs-situs penyedia E-Card ucapan selamat terbaik!

Cara Hacker curi data Kartu Kredit

Mengatasi virus menginfeksi seluruh jaringan komputer

Virus Jaringan Hebaaaaat

Adsense Camp

Arsip Blog

Pengunjung :