How you hack into Microsoft: a step by step guide

It's easy, watch....

  • alert
  • submit to reddit

The smart choice: opportunity from uncertainty

Microsoft's recent sacking at the hands of unskilled malicious crackers has engendered a vast cloud of false scent from company flacks, who in past days have progressively shrunk their damage assessments. According to company sources, the intruders had access for only 12 days, not six weeks as first reported, and did not corrupt any software in development.

Others note that, twelve days or not, the intruders can't have helped stealing the source code for the new versions of Windows ME/2K and Office, and might well have implanted back doors, laying the foundation for easy remote exploitation once the finished products reach the marketplace.

So, were the walls of the castle breached? Was the digital diadem of William Perfidious defiled by the grubby hands of the unwashed? Or did a handful of malicious kiddies manage nothing more than to give the Kingdom of Gates a scare? We don't pretend to know; but we're going to walk you through the likely steps the intruders would have taken, and let you decide how much damage they might, or might not, have done.

Barbarians at the gate

Network security becomes increasingly difficult as point-and-drool cracking tools proliferate. So many painfully easy-to-use appz have been developed in recent years that persistence is now a far more reliable predictor of success than skill: even a newbie cracker can succeed by using pat scripts and casting his nets wide enough.

The Microsoft intrusion was almost certainly not the work of elite hackers; if it had been, we would not now be reporting it. What we're going to detail below is how a fool can (and did) sack the Magic Kingdom.

Everything the newbie cracker needs to break in to the Microsoft Developers' Network is readily available on the Web following a brief search. Here's how you go about it: First, you'll download a Trojan which can be distributed via e-mail. QAZ, which was used in the M$ attack, is a fine choice because it will automatically copy itself throughout shared folders on a LAN. It's a malicious backdoor program masquerading as the familiar Microsoft utility Notepad.

Once activated, QAZ searches for notepad.exe and copies itself in place of the standard Notepad file, while simultaneously re-naming it note.com. The beauty here is that when someone executes their Trojanised Notepad, it also launches note.com, or the original Notepad, so the application appears to behave normally to the user. It then searches the entire LAN for additional copies of notepad.exe to infect.

To get it implanted on a LAN in the first place, you need to feed it to someone dense enough to execute it. It's easy enough to distribute as an e-mail attachment, but not everyone will fall for it. Thus there are two chief obstacles to getting started, neither of which is terribly difficult to overcome.

First there is social-engineering - that is, baiting the victim. The wording of the e-mail message has got to make executing the attached program both desirable and sensible. Presenting it as a software patch or upgrade is a common stratagem, though there are others. Zipping it and naming it PornCollection.zip or DirtyJokes.zip is another.

If the e-mail message makes sense in context of the attachment, and if it's sent to enough potential victims, the combined laws of probability and human nature ensure that some dumb bastard will activate the payload. And with QAZ, you only need one victim; it will propagate on its own.

Your second obstacle is anti-virus software. Not a tough one either, despite all the glowing claims of heuristic genius touted by anti-virus vendors. We took several of the most popular Trojans: Back Orifice, SubSeven, NetBus and Hack'a'Tack, and first verified that our copy of Norton AntiVirus would detect them, both as-is and zipped. We then compressed them using a sweet little developer's tool called NeoLite and ran Norton AntiVirus again.

Not one Trojan was detected, because NeoLite alters the signatures used by anti-virus manufacturers to identify malicious code. Only the Trojan Deep Throat, which we received already compressed by NeoLite, was detected, presumably because it's usually distributed in that form and its compressed signature is known. And the beauty of NeoLite is that it's self-extracting. No third-party software like WinZip need be loaded on the victim's machine for the compressed programs to be executed.

On the inside

Once you've managed to infect a machine on the target LAN, QAZ will e-mail you the IP automatically, activate WinSock and wait for a connection on port 7597. Simply check your mail, connect, and, voila, you're in. We're assuming you have the sense to use a Web-based e-mail account for QAZ to communicate with, which you will have opened with fictitious personal data, and that you know the basics of concealing your computer's IP.

Now you'll need to swim around inside the LAN sharkwise until you find yourself a nice, juicy target. Be patient; as the Trojan spreads, more machines will come on-line for you to connect to. Check them all thoroughly. What you're looking for is a box to which you can connect directly, and which is trusted by your ultimate target - some machine with valuable data on it.

You can pretty well assume that any box containing real treasures will be protected by a firewall. You probably won't be able to connect directly to it with a Trojan, but that's all right. There are other machines on the LAN which your target box will trust. So find out which of the boxes to which you can connect might themselves be plugged into something sweet, like another box with the source code for Win-2K, par example. The strategy here is to leapfrog from machines which you own, to the one you want to own.

Where do you want to go today?
Now you've got access to a machine with interesting, valuable data. Let's say it's on the MS Developers' Network, and contains the source code for Win-2K. What's your next move?

It would make sense to download the code first so that if you're suddenly discovered and shut out, you'll at least have something to show for your efforts. Source code is jealously guarded and of course extremely valuable to Microsoft's competitors. Owning it can be immensely profitable for you, especially if you know a sleazy development house in a country with virtually no piracy enforcement, like in Russia, say, or anywhere in East Asia.

You might also wish to implant malicious code of your own in the source to make it easy to exploit once it reaches market, or, alternatively, examine it closely for weaknesses already coded into it, to get a jump on the competition once it ships. A lot of valuable data gets served up on these products; merely knowing where the weaknesses are before the security industry catches on can lead to considerable riches.

So how difficult would that be? Obviously, profiting from such an intrusion requires skill; though as we've illustrated, getting inside the network is child's play. You might be a dangerous cracker, and one so clever that as part of your social-engineering strategy you've deliberately opted to use common tools and techniques to conceal your true, terrifying capabilities. But then again, you might not.

More likely you're a young fool with virtually no skills and little ambition, snapping up toolz and appz from the Web and feeling your way blindly towards the cracker pantheon. You'll do no harm because you don't know how to do harm, but you'll think quite highly of your insignificant achievements. You'll recall your modest exploits with fondness, boast about them in IRC h4x0r chatrooms hoping to impress some k1dd13 even lamer than yourself, and get busted by one of the hundreds of Feds who regularly hang out in these venues.

And that, more than anything, is what Microsoft is fervently hoping. ®

Related Stories

MS hacked! Russian mafia swipes WinME source?
Redmond strives to cram Great MS Hack back in box
MS blocks staff dial-in access after 'minor' hack

Securing Web Applications Made Simple and Scalable

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
prev story


Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.