Technitium MAC Address Changer

Technitium MAC Address Changer allows you to change Media Access Control (MAC) Address of your Network Interface Card (NIC) irrespective to your NIC manufacturer or its driver. It has a very simple user interface and provides ample information regarding each NIC in the machine. Every NIC has a MAC address hard coded in its circuit by the manufacturer. This hard coded MAC address is used by windows drivers to access Ethernet Network (LAN). This tool can set a new MAC address to your NIC, bypassing the original hard coded MAC address. Technitium MAC Address Changer is a must have tool in every security professionals tool box. Technitium MAC Address Changer is coded in Visual Basic 6.0.

Features

• Support for Windows Vista SP1 and Windows Server 2008 added.
• Allows you to remove all registry entries corresponding to Network Adapter that is no longer physically installed on the system.
• Allows you to configure Internet Explorer HTTP proxy settings through configuration presets or command line.
• Issues with installer program resolved. (Thanks to all your feedbacks)
• Identifies the preset applied to currently selected Network Interface Card (NIC) automatically making it easy to identify settings.
• Most known issues with Windows Vista removed. (Thanks to all your feedbacks)
• Changes MAC address of Network Interface Card (NIC) including Wireless LAN Cards, irrespective of its manufacturer or its drivers.
• Has latest list of all known manufacturers (with corporate addresses) to choose from. You can also enter any MAC address and know which manufacturer it belongs to.
• Allows you to select random MAC address from the list of manufacturers by just clicking a button.
• Restarts your NIC automatically to apply MAC address changes instantaneously.
• Allows you to create Configuration Presets, which saves all your NIC settings and makes it very simple to switch between many settings in just a click and hence saves lot of time.
• Allows you to Import or Export Configuration Presets to or from another file, which saves lot of time spent in reconfiguration.
• Allows you to load any Configuration Presets when TMAC starts by just double clicking on any Configuration Preset File. (*.cpf file extension)
• Has command line interface which allows you to perform all the tasks from the command prompt or you can even create a DOS batch program to carry out regular tasks. (see help for command line parameter details)
• Allows you to export a detailed text report for all the network connections.
• Displays all information you would ever need to know about your NIC in one view like Device Name, Configuration ID, Hardware ID, Connection Status, Link Speed, DHCP details, TCP/IP details etc.

Source http://tmac.technitium.com/tmac/index.html

Botnet Installs SQL Injection Tool

The Asprox botnet is sending out more than just phishing e-mails—it is now spreading a SQL injection attack tool.

A botnet is outfitting its army of compromised computers with a SQL injection attack tool to hack Web sites, researchers at SecureWorks have discovered.

According to SecureWorks, the Asprox botnet, once used solely to send out phishing e-mails, is pushing the tool out to systems in its network via a binary with the file name msscntr32.exe. The executable is installed as a system service with the name "Microsoft Security Center Extension."

Despite the name, the file is in fact a SQL injection attack tool that when launched searches Google for .asp pages that contain certain terms. It then launches SQL injection attacks against the Web sites returned by the search. According to SecureWorks, the attack is designed to inject an IFrame into the Web site that tricks visitors into downloading a JavaScript file from the domain direct84.com.

This file in turn redirects computers to a site where additional malicious JavaScripts are stored, although the secondary site appeared to be down when SecureWorks first reported the attacks May 14. When successful, however, the site installs additional copies of Asprox, the password-stealing Trojan Danmec or the SQL attack tool.

When researchers have the power to seize control of botnets, should they? A recent discovery triggers ethical debate. Click here to read more.

According to a list from VirusTotal, only a handful of the major anti-virus vendors are detecting the attack tool at this time.

"This is the first time I've seen a SQL injection tool, but certainly other botnets have tried to spread in a similar manner, infecting Web sites with IFrames," said Joe Stewart, director of malware research at SecureWorks. "For instance, Storm tries to get your password if you log in to a Web site with FTP, and will put an IFrame into the page for you."

So far, SecureWorks has found 1,000 Web sites infected by this wave of SQL attacks. Visitors to these infected Web sites are infected with the Asprox malware—turning them into bots—and also download some scareware.

"We've estimated [the Asprox botnet] at around 15,000 hosts, but that was before the wave of SQL attacks," Stewart said in an interview with eWEEK.

Researchers are still investigating exactly what vulnerability on the Web sites is being exploited, Stewart said. The Web sites are English-language and their owners include law firms and midsize businesses.

A similar attack technique is currently being seen spreading game-password-stealing Trojans from China. Whether the tool is related or only the attack syntax is shared, it is clear that SQL injection attack activity is on the rise from multiple sources, Stewart wrote in his blog.

Source -http://www.eweek.com/c/a/Security/Botnet-Installs-SQL-Injection-Tool/