<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title> &#187; Crypto</title>
	<atom:link href="http://www.megapanzer.com/tag/crypto/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.megapanzer.com</link>
	<description></description>
	<lastBuildDate>Fri, 23 Dec 2011 13:02:33 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3</generator>
		<item>
		<title>Fishing sensitive data with MioStar</title>
		<link>http://www.megapanzer.com/2010/11/17/fishing-sensitive-data-with-miostar/</link>
		<comments>http://www.megapanzer.com/2010/11/17/fishing-sensitive-data-with-miostar/#comments</comments>
		<pubDate>Wed, 17 Nov 2010 14:31:58 +0000</pubDate>
		<dc:creator>carrumba</dc:creator>
				<category><![CDATA[C]]></category>
		<category><![CDATA[C#]]></category>
		<category><![CDATA[Coders corner]]></category>
		<category><![CDATA[Tools & sources]]></category>
		<category><![CDATA[Crypto]]></category>
		<category><![CDATA[DLL injection]]></category>
		<category><![CDATA[funkction hooking]]></category>
		<category><![CDATA[Hacking]]></category>
		<category><![CDATA[Hooking]]></category>
		<category><![CDATA[injectin]]></category>
		<category><![CDATA[Passwords]]></category>

		<guid isPermaLink="false">http://www.megapanzer.com/?p=4365</guid>
		<description><![CDATA[What is MioStar MioStar is an offspring of the SkypeTrojan. Unlike the SkypeTrojan MioStar puts its focus on hooking functions that deal with sensitive data like account information or network traffic. The initial objective was not to produce a hacker tool ready to use or incorporate in malware. But at the point we reached now [...]]]></description>
			<content:encoded><![CDATA[<h3>What is MioStar</h3>
<p> <img src="http://www.megapanzer.com/wp-content/uploads/code-300x300.jpg" alt="" title="code" width="75" height="75" class="alignright size-medium wp-image-3203" /><br />
MioStar is an offspring of the SkypeTrojan. Unlike the SkypeTrojan MioStar puts its focus on hooking functions that deal with sensitive data like account information or network traffic. The initial objective was not to produce a hacker tool ready to use or incorporate in malware. But at the point we reached now it is more than just a simple proof of concept. We have a nice, fancy GUI now and a handful of preconfigured applications where we can extract sensitive data. And in the future the list will grow.<br />
<br/></p>
<h3>What function calls are intercepted</h3>
<p>Currently the following functions can be intercepted with MioStar &#8230;<br />
</p>
<table width="500" border="0">
<tr valign="top">
<td width="50%">
    <strong>Files</strong></p>
<ul>
<li>CreateFile</li>
<li>ReadFile</li>
<li>WriteFile</li>
</ul>
</td>
<td width="50%" rowspan="4">
     <strong>Crypto</strong></p>
<ul>
<li>CryptEncrypt</li>
<li>CryptDecrypt</li>
<li>CryptHashData</li>
<li>EncryptFile</li>
<li>DecryptFile</li>
<li>NCryptEncrypt</li>
<li>NCryptDecrypt</li>
<li>NCryptCreatePersistedKey</li>
<li>SslEncryptPacket</li>
<li>SslDecryptPacket</li>
<li>BCryptEncrypt</li>
<li>BCryptDecrypt</li>
<li>BCryptHashData</li>
<li>BCryptGenerateSymmetricKey</li>
<li>CPEncrypt</li>
<li>CPDecrypt</li>
<li>CryptProtectData</li>
<li>CryptUnprotectData</li>
<li>CryptProtectMemory</li>
<li>CryptUnprotectMemory</li>
<li>CryptMsgGetParam</li>
<li>CryptMsgUpdate</li>
<li>CryptHashMessage</li>
<li>CryptDecryptMessage</li>
<li>CryptEncryptMessage</li>
<li>nss3.dll::PK11SDR_Encrypt</li>
<li>nss3.dll::PK11SDR_Decrypt</li>
</ul>
</td>
</tr>
<tr valign="top">
<td>
    <strong>Registry</strong></p>
<ul>
<li>RegOpenKey</li>
<li>RegOpenKeyEx</li>
<li>RegQueryValue</li>
<li>RegQueryValueEx</li>
<li>RegGetValue</li>
</ul>
</td>
</tr>
<tr valign="top">
<td>
    <strong>Networking</strong></p>
<ul>
<li>send</li>
<li>WSASend</li>
<li>WSPSendTo</li>
<li>GetAddrInfo</li>
<li>GetAddrInfoEx</li>
<li>WinHttpOpenRequest</li>
<li>WinHttpConnect</li>
<li>WinHttpWriteData</li>
</ul>
</td>
</tr>
<tr valign="top">
<td>
    <strong>System</strong></p>
<ul>
<li>LoadLibrary</li>
<li>LoadLibraryEx</li>
<li>GetProcAddress</li>
<li>GetModuleHandle</li>
<li>GetModuleHandleEx</li>
<li>FreeLibrary</li>
</ul>
</td>
</tr>
</table>
<p><br/></p>
<h3>Which applications use these calls</h3>
<p>MioStar can be used with any application but without guarantee of success. From following applications<br />
sensitive data can be extracted &#8230;</p>
<table width="500"  border="0">
<tr valign="top" height="40">
<td width="50%"><strong>Application name</strong></td>
<td width="50%"><strong>Function</strong></td>
</tr>
<tr valign="top">
<td>Safari</td>
<td>CryptProtectData<br />
	CryptUnprotectData</p>
</td>
</tr>
<tr valign="top">
<td>Chrome</td>
<td>CryptProtectData<br />
	CryptUnprotectData</p>
</td>
</tr>
<tr valign="top">
<td>GoogleTalk</td>
<td>CryptProtectData<br />
	CryptUnprotectData</p>
</td>
</tr>
<tr valign="top">
<td>Microsoft Live Messenger</td>
<td>CryptEncrypt</p>
</td>
</tr>
<tr valign="top">
<td>Microsoft Live Mail</td>
<td>CryptProtectMemory<br />
	CryptUnprotectMemory</p>
</td>
</tr>
<tr valign="top">
<td>Yahoo Messenger</td>
<td>SslEncryptPacke</p>
</td>
</tr>
<tr valign="top">
<td>Thunderbird</td>
<td>
        nss3.dll::PK11SDR_Decrypt<br />
	nss3.dll::PK11SDR_Encrypt</p>
</td>
</tr>
<tr valign="top">
<td>FireFox</td>
<td>
	nss3.dll::PK11SDR_Decrypt<br />
	nss3.dll::PK11SDR_Encrypt</p>
</td>
</tr>
<tr valign="top">
<td>SeaMonkey</td>
<td>
        nss3.dll::PK11SDR_Decrypt<br />
	nss3.dll::PK11SDR_Encrypt</p>
</td>
</tr>
<tr valign="top">
<td>RockMelt</td>
<td>
        CryptProtectData<br />
	CryptUnprotectData</p>
</td>
</tr>
</table>
<p><br/></p>
<h3>Manipulating functions</h3>
<p>Instead of extracting sensitive data you can also manipulate the function arguments and replace the passed values by your own. As an example the function  <strong>GetAddrInfoEx</strong> normally resolves hostnames and gives back the according IP address. Instead of resolving www.google.com replace this parameter by www.megapanzer.com. <strong>All traffic for google gets then redirected to Megapanzer.</strong><br />
<br/></p>
<h3>How can I participate</h3>
<p>You can participate in three ways. If you know of &#8230;</p>
<ul>
<li> applications using one of the functions mentioned in the list above that deal with sensitive data.</li>
<li> Windows functions that handle sensitive data and they are not implemented in MioStar yet.</li>
<li> DLLs providing functions that deal with sensitive data.</li>
</ul>
<p>&#8230; then please drop me a <a href="http://www.megapanzer.com/contact/">mail</a> and let me know.<br />
<br/></p>
<h3>Feedback</h3>
<p>In case you encounter any problems with the tool, you find a bug, you have suggestions to improve it, or you tested it with a Windows version i&#8217;ve not yet tested please drop me an <a href="http://www.megapanzer.com/contact/">email</a>.<br />
<br/></p>
<h3>Where can I download it</h3>
<table border="0">
<tr>
<td>
<img style="background:none; border-top:none; border-left:none;" src="http://www.megapanzer.com/wp-content/uploads/App_DOS.jpg" width="12" height="12" class="alignleft size-full wp-image-4358" />Version 0.1 &#8211; <a href="http://www.megapanzer.com/wp-content/uploads/MioStar_0_1.zip">Binary &#038; source</a>
</td>
</tr>
<tr>
<td>
<img style="background:none; border-top:none; border-left:none;" src="http://www.megapanzer.com/wp-content/uploads/App_WIN.png" width="12" height="12" class="alignleft size-full wp-image-4358" />Version 0.2 &#8211; <a href="http://www.megapanzer.com/wp-content/uploads/MioStar_0_2.zip">Binary &#038; source</a>
</td>
</tr>
</table>
<p><br/></p>
<h3>Why this strange name</h3>
<p>There are many security related tools out there with heroic, martial, elite or marketing strategic, odd sounding names. Why not name a tool something like a household appliance? MioStar is a product line of a Swiss store that offers great products for your household like MioStar mixer, MioStar hair dryer, MioStar vacuum. MioStar, a great name for a tool!<br />
<br/></p>
<h3>MioStar video</h3>
<p>Will follow soon &#8230;<br />
<br/></p>
<h3>Screenshot</h3>
<table>
<tr>
<td>
<a href="http://www.megapanzer.com/wp-content/uploads/Miostar.jpg" target="_blank"><img src="http://www.megapanzer.com/wp-content/uploads/Miostar-300x230.jpg" alt="Fishing sensitive data with MioStar" title="Miostar" width="150" height="115" class="alignleft size-medium wp-image-4364" /></a>
</td>
</tr>
<tr>
<td>&nbsp;</td>
</tr>
</table>
]]></content:encoded>
			<wfw:commentRss>http://www.megapanzer.com/2010/11/17/fishing-sensitive-data-with-miostar/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>RC4Encryption : Encrypt and decrypt files with RC4</title>
		<link>http://www.megapanzer.com/2009/06/09/rc4encryption-encrypt-and-decrypt-files-with-rc4/</link>
		<comments>http://www.megapanzer.com/2009/06/09/rc4encryption-encrypt-and-decrypt-files-with-rc4/#comments</comments>
		<pubDate>Tue, 09 Jun 2009 19:02:56 +0000</pubDate>
		<dc:creator>carrumba</dc:creator>
				<category><![CDATA[Crypto]]></category>
		<category><![CDATA[Tools & sources]]></category>
		<category><![CDATA[Encryption]]></category>
		<category><![CDATA[RC4]]></category>
		<category><![CDATA[Sources]]></category>
		<category><![CDATA[Tools]]></category>

		<guid isPermaLink="false">http://www.megapanzer.com/?p=2111</guid>
		<description><![CDATA[Tool name : RC4Encryption 0.1 &#160; Description : RC4Encryption is a tool to encrypt and decrypt files with the RC4 algorithm. The tool itself is not really hot stuff. OpenSSL supports RC4 since years and also many other algorithms. But you can use this code without any dependency of an additional library and you have [...]]]></description>
			<content:encoded><![CDATA[<table border="0" width="100%">
<tbody>
<tr valign="top">
<td width="30%"></td>
<td width="70%"></td>
</tr>
<tr valign="top">
<td><strong>Tool name</strong> :</td>
<td>RC4Encryption 0.1</td>
</tr>
<tr>
<td colspan="2">&nbsp;</td>
</tr>
<tr valign="top">
<td><strong>Description</strong> :</td>
<td>RC4Encryption is a tool to encrypt and decrypt files with the RC4 algorithm. The tool itself is not really hot stuff. OpenSSL supports RC4 since years and also many other algorithms. But you can use this code without any dependency of an additional library and you have working functions of stream cipher encryption.
</td>
</tr>
<tr>
<td colspan="2">&nbsp;</td>
</tr>
<tr valign="top">
<td><strong>Tested on</strong> :</td>
<td>Windows XP</td>
</tr>
<tr>
<td colspan="2">&nbsp;</td>
</tr>
<tr>
<td><strong>Feedback</strong> :</td>
<td>In case you encounter any problems with the tool, you have suggestions to improve it, or you tested it with a Windows version i&#8217;ve not yet tested please drop me an <a href="http://www.megapanzer.com/contact/">email</a>.</td>
</tr>
<tr>
<td colspan="2">&nbsp;</td>
</tr>
<tr valign="top">
<td><strong>Downloads</strong> :</td>
<td><a href="http://www.megapanzer.com/wp-content/uploads/rc4encryption.exe">Binary</a> | <a href="http://www.megapanzer.com/wp-content/uploads/rc4encryption.cpp" target="_blank">Source</a></td>
</tr>
<tr>
<td colspan="2">&nbsp;</td>
</tr>
<tr valign="top">
<td><strong>Screen shots</strong> :</td>
<td>&nbsp;</td>
</tr>
</tbody>
</table>
]]></content:encoded>
			<wfw:commentRss>http://www.megapanzer.com/2009/06/09/rc4encryption-encrypt-and-decrypt-files-with-rc4/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
	</channel>
</rss>

