Smartphone Botnets over SMS Demo

Here is the proof of concept code for smartphone botnet C&C over SMS fromShmoocon 2011. This is for the Android platform. If you are looking to work with iPhone contact me directly. I don’t have access to an iPhone at this time to properly test the PoC code for iPhone. So I’m not releasing such code publicly at this time. However, the same concept of proxying the modem and application layer to make smartphone bots is known to work for iPhone. 

Download the Shmoocon slides here: http://www.grmn00bs.com
Download the code here. http://www.grmn00bs.com
To use:
compile with arm-gcc with the -static flag set
Copy to anywhere on the underlying OS that is writable (/data is good).
Rename /dev/smd0 to /dev/smd0real
Start the bot application
Kill the radio application (ps | grep rild)
The radio will automatically respawn and now the bot proxy will be working.

This proof of concept code has payloads removed, so the functionality you see in the demos will need to be added manually. Add your own stuff. Have fun and please share it with me if you do something interesting. Usual disclaimers apply. The proof of concept swallows botnet related messages based on a key that you can change, but it does not perform potentially malicious payloads as seen in the demos.

Video Demonstration:

Shmoocon 2011 Smartphone Botnets over SMS Demo

INSECT Pro v.2.6.1 - Ultimate

INSECT Pro is a new free tool for Penetration Testing and the ultimate resource to demonstrate the security or vulnerability of your network.

INSECT Pro goes beyond simply detecting vulnerabilities to safely exploiting them. The first free integrated vulnerability and penetration testing tool, INSECT is part of the complete solution Insecurity Research offers to evaluate the vulnerabilities on your network

The product’s user friendly interface has -among other options- the choice between an offensive and inoffensive attack that gives the user the ability to make different kinds of attacks without the possibility of damage and includes functions for generating complete and comprehensive reports from the gathered information.

Supported Platforms and Installations
– Windows XP,2003,Vista,2008 Server,and Windows 7 (requires Python and.NET)
Updates
– Automatic regular weekly updates
Exploits
– Contains the lastest exploits on the wild!

Download: http://www.insecurityresearch.com

Video Demo: http://www.youtube.com

WebSurgery v.0.6 Released

Web application testing suite

WebSurgery is a suite of tools for security testing of web applications. It was designed for security auditors to help them with the web application planning and exploitation. Currently, it uses an efficient, fast and stable Web Crawler, File/Dir Brute forcer, Fuzzer for advanced exploitation of known and unusual vulnerabilities such as SQL Injections, Cross site scripting (XSS), Brute force for login forms, identification of firewall-filtered rules, DOS Attacks and WEB Proxy to analyze, intercept and manipulate the traffic between your browser and the target web application.

Download: http://www.surgeonix.com