Tester Jobs Requirements (VIDEO GAME)

In the previous post a general idea of a baiting attack has been described and some techiques how to persuade victims to use malicious application have been explained. In this post concrete implementation and architecture of data stealing system will be desribed in details.

When a malicious thread starts it creates a hidden folder called System backup in a Public user directory where several important text files will be generated and used to control the further process. Most users dont know how to reveal hidden files and dont even feel a need to check them, Public users folder is rarely used by anyone and it is not protected by administrator permissions which makes it possible for your program to work without any permission before running it. Also, System backup is a folder name that creates a sense of trust and false security and user is afraid to alter that folder to avoid making unwanted changes on his �system backup�. In this folder three text files will be created. After a program starts, the list of paths of all interesting files is created in a first file named list_of_files.txt. The files that are considered are usually smaller files that contain key data like .xls, .txt, .doc, .docx, .odt, .ppt or .pdf files. You can also try adding photos extensions to it, but then you should put a priority on smaller files to be stolen first. The second files called list_of_backup.txt contains the list of paths of stolen files which is updated as the data is being stolen. After a list of all interesting files (list_of_files.txt) is generated, a program randomly stores all data in a number of zip files with maximum size of 25 MB which is a limitation for email being sent by Gmail service. Those zip files are also stored in System backup folder. From array of fake email accounts a program chooses one to send and one to receive that zip file and after the message is sent that zip is deleted and paths of all files that were previously stored in it are added to list_of_backup.txt. Once the game is first started an intriguing interface asks a player to white his name or nickname to start playing and that name is stored in the third text file called index.txt. Although it cannot be guaranteed that a player writes his real name and that his nickname should give any clue of his identity this information is important to make sorting by victims name possible after files from all sources are obtained. In addition to a victims name a counter that stores the number of zips sent from that computer is also written in index.txt file, which makes it easier to monitor data and create reports send to emails. That counter is increased with every email sent.

Stealing files from computer takes time, from ten minutes to several hours, depending on number and type of files that are being stolen. It is therefore highly unlikely that the victim will keep playing your game until the malicious thread is completed. The main purpose of list of paths of stolen files and index.txt is to make it possible to continue an attack once the game is restarted. Firstly, the nickname or name of your victims will be stored from the first session so it will not be asked again and counting of sent zip files will not start from zero. Secondly, the files that have been stolen and have not been moved to different path will not be stolen again. Once the application restarts, a program recreates list_of_files.txt document and lists paths of all files of specified format that are found on computer and not listed in list_of_backup.txt files. Zip files from previous session are deleted and,zip files with max size of 25 MB are randomly created and the thread continues until they are all sent or its interrupted.

While running application whose purpose is to obtain the documents, it is important that they are easily sortable and that they come with easily readable and unambigious report. Of course your emails should contain the attachment with vital data, but subject title and message are also very important. The title and content of message should not tell the real purpose of those emails. The title should be: New report from the computer of <victim> named info_<serial number of zip>.zip and the message should be: You have received a new report from the computer of <victim>. This is a list of scanned files.