Th3 S3cr3t Ag3nt

This is the story of a phishing email that came across my desk. It's good to take a look at what the bad guys are doing sometimes. It's often not rocket science but it's handy to keep an eye on the simple techniques used. And if this isn't your day job you probably don't get forwarded a huge number of phishing emails, malware to analyse or dodgy sites to investigate. In fact hopefully you do your best to avoid all of those things. The Attack Chain So this particular phishing campaign started as many others do with a simple phishing email. It's not an aggressive email, it's not selling itself too hard, no spelling mistakes, no funny looking URLs and it's pretty simple. There's only one link to click on. Just a quick note here about clicking on links in nefarious emails. Don't do it unless you are ready to. This link could trigger some malware, it could be unique to the targeted email (so the attacker knows the email address is valid...

Zip bombs aren't new. Since the days of bulletin board systems people have been highly compressing implausibly large files and transferring them to target machines to consume resources. Machines these days can handle much larger files and have ever larger amounts of RAM to process them, but zip bombs can still be very useful to an attacker in bypassing weak antivirus or filling up poorly protected servers. Some antivirus software will try to expand the zip file to scan it, using a lot of resources. Others don't try to expand huge files and simply let them through. Either of these options don't really protect us. There was a zip file going around a year or two ago called 42.zip which expands to about 4.5PB. It's good, but can we do better? The most efficient thing to compress is a string of 00000000's. So let's start with a GB of nothing. dd if=/dev/zero bs=1024 count=1048576  And less squeeze that as much as possible dd if=/dev/z...