Emanuele De Lucia

This topic has been dealt in one of my last technical articles. The document shows as it’s possible to approach an incident investigation on the basis of common instructions used by shellcodes to achieve their goals. The analysis is conducted within a memory dump. In this regard have been developed some yara custom rules that can be used as an aid for experienced analyst to quickly locate malicious code. Note, however, that this is a very wide topic (have you ever heard of padding, permutations, … [Read more]

This is a document written for an italian magazine by Emanuele De Lucia (Information Security n°27 @ Edisef Editore) and used for a training course headed by the author.In this paper are covered topics useful to ensure business continuity of our organizations. The common differences between a BCP and a DRP and others topics such as “centers of redundancy” and “high availability infrastructures” are also dealt.The article can be viewed on Information Security Magazine website:  … [Read more]

Do you know what to do with this below ?  # ShellShock Bash Vulnerability CVE-2014-6271 Test Tool # # This has been coded by Emanuele 'ac1d' De Lucia for educational purposes only # # The author is NOT responsible for any harmful use you decide to make # # Coded 25/09/2014 01.55. Online 25/09/2014 02.30 CET # # yabba dabba doooooo, Wilma !!! Where's my club ?!?! # # Please, turn on your brain before to continue.... # # nc -l -p 4444 may be useful but...take a look at the bottom … [Read more]

“Conflitti Digitali: Classificazione e Retroscena” is an article written for a seminar to which the author has participated as speaker. The text is very discursive and examines the evolution of a new way of thinking about the offense: the wars in the cyber space and their backstory. For now, the text is available in italian only... Download Now

This evening I received an email with an attached zip. This email was very well made and my anti-virus did not detect anything dangerous -_- veeeery nice…i decided to take a look and see what strange monster was inside :] The executable is a trojan/downloader packed with something custom! After recovering the original executable bypassing all protections, i  was able to have a look within it and immediately i saw some interesting functions … [Read more]

To quickly summarize: there has not been an anti-malware solution that was effectively able to avoid the infection of the system or to prevent the privileges escalation put into play. None of the tested solutions was also able to alert the user about an abnormal behavior of our executable. Stop! That’s all ! Further details: The malware is a P2P (D)DoS agent written in pure C by Emanuele De Lucia with TCP SYN and HTTP Flood capabilities, named “apt.exe”. This is basically a dropper. It’s … [Read more]

This script allows to test a full /24 subnet for OpenSLL TLS HeartBeat (HeartBleed) Vulnerability. Originally coded by Jared Stafford ([email protected]) to test this weakness on a single host at a time, it has been modified by Emanuele De Lucia to allow the scan of an entire subnet. This modification has been made for work reasons within few hours by the notice of the vulnerability, in order to readily identify the affected services within a very wide range of systems exposed. May be … [Read more]

 Thousands and thousands of data items currently are riding the Internet every day; their representation could be a continuous stream of data transiting through the entire globe. With the growth in quantity and especially in the importance of such informations, the need to adopt systems designed to guarantee a good level of protection and security has also grown in proportion. This paper explores those that are the common steganographic algorithms used to hide informations within seemingly … [Read more]

Reb October is the name of a cyber-espionage toolkit discovered by Kaspersky Lab. The malware was operating worldwide for up to 5 years before to be discovered, transmitting to its C&C servers a lot of informations. Red October is considered an advanced cyber-espionage campaign intended to targeting diplomatic, governmental and financial organizations. This is an analysis conducted by me on 01/13 for InfoSec Institute but published but published after a little... It's possible to view my … [Read more]

 SANS DFIRCON is a challenge where we have to download a memory image from SANS and perform over it a complete forensic analysis in order to find the real chinese APT hidden inside and so to answer to five questions about it; These questions may be very similar to: What's the PID of the rogue process ? How is the malware achieving persistence on the system ? What is the name of the file that caused the infection of the system ? If you think to be able to answer, download the image and hunt the … [Read more]