placeblogger and others lead to imgwebsearch spam

Over the weekend I was playing around with the iPad application SkyGrid to read the latest news stories on particular subjects. In one of my feeds that I setup for mobile security I saw a story with the title "GvHpMqAVt." From the title I immediately suspected the story as spam (can't seem to go anywhere these days without running into some type of spam on the web). The page has nothing on Blackberry or mobile security which was my topic on SkyGrid - but there was one link on the page for "streaming porn on blackberry pearl" - not really the subject I was looking for. The page is a spam advertisement page to multiple affiliate pages advertising various porn and dating sites. Figured I'd write a brief blog post to detail this campaign:

Placeblogger spam page:


Clicking any of the links takes you to the affiliate page (this one is setup on Quogger but there are a large number of social media sites used for this):

It didn't take long from here to start to unravel the web of spam and affiliate pages setup to monetize porn and dating service pay-per-clicks / pay-per-purchase.

Some Placeblogger spam pages:
hxxp://placeblogger.com/content/gvhpmqavt
hxxp://placeblogger.com/content/rrvlxrrhjpnt
hxxp://www.placeblogger.com/content/tvkbzvxrmydrdmtlit
hxxp://placeblogger.com/content/hnuxlavx
hxxp://placeblogger.com/content/efvwiokczlmffeeugnt
hxxp://placeblogger.com/content/tipsgyxr
hxxp://placeblogger.com/content/lxyyfrohukysmzev
hxxp://placeblogger.com/content/frbonuntjf
hxxp://placeblogger.com/content/dnlnfbbkmfvcxga
hxxp://placeblogger.com/content/hsgsqurgd
The list goes on...
This Google search identifies about 300 or so for example.

Some Affiliate / Advertisement pages:
hxxp://www.quogger.com/pg/profile/AassidyWood49
hxxp://silentzow.com/elgg/pg/profile/AaydaThompson01
hxxp://www.yappey.com/pg/profile/AharlizeMiller59
hxxp://jivebook.co.uk/main/pg/profile/AreannCook29
hxxp://www.quogger.com/pg/profile/ArynnJames38
hxxp://www.swakiya.com/pg/profile/AaylaHayes00
hxxp://socialcommerce.in/pg/profile/AryannaDoyle28
~ snip ~
Note: there are a lot more affiliate pages - about 10 per Placeblogger spam page. Most of these are profile pages on a variety of social media sites.

Most of the affiliate links direct the visitor through imgwebsearch.com. A search for this site uncovers a large number of spam links to a variety of campaigns including: porn/dating, pharma, casinos, loans, replicas, etc., etc. Imgwebsearch spam shows up everywhere - yes, including Facebook. An example of imgwebsearch pharma spam on Facebook:
hxxp://www.facebook.com/pages/Com-Program-ahdth-bramj-alkmbywtr/277890114062
Actually, this Google search shows over 600 some related spam pages on Facebook.

How does this work?

Here is an example of one such related spammer detected via Project HoneyPot. In this case the spammer / spam group seems to have one or more netblocks (94.142.131.0/24 in Latvia for example) with the hosts setup to spider the web and post comment spam to sites (infected machines / bots may be used or rented out for this purpose as well). In this case all of the spammer's links were through imgwebsearch. The pool of source IP addresses for spidering / spamming and the changing of the user-agent is used to evade detection. This relatively simple spam operation could be home grown by the spammer(s), or there are relatively inexpensive tools such as XRumer for purchase to facilitate this type of spam (also used for SEO). This and other tools provide account creation / CAPTCHA bypass to be able to spam to sites that require account / login. Affiliate programs (aka Partnerka in Russian slang) -- in this case it appears to be imgwebsearch -- pay these spammers from anywhere from a few cents per click, a few dollars per sign-up/purchase, or in some cases tens of dollars per install (for example, the FakeAV campaigns). There is a good paper from Dmitry Samosseiko from last year's Virus Bulletin that details the Partnerka.

Exploit Targeting a 7 Year Old Vulnerability? Really?

We’ve actually spotted in-the-wild exploitation of “Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness” (Bugtraq ID 10514), a vulnerability first released in 2003. The exploit does get a little more modern as the code also targets vulnerability from 2009 (MS09-002). Here is a screenshot of the live infected page,

The malicious obfuscated JavaScript has been injected at the bottom of webpage. Let’s decode it. Here is the small part of the decoded script.

From the above code, it is clear that it is targeting the ADODB.Stream vulnerability from 2003. Here is the other part of the decoded content which exploits the MS09-002 vulnerability.

I am not going into the more details of this exploit as the code is pretty self explanatory. It is going to download additional malicious binaries and execute them on the system. The author who discovered this older ADODB.Stream vulnerability has posted a proof-of-concept. For those interested, an explanation of the MS09-002 vulnerability can be found here.

Virustotal results for the infected webpage show it being detected by 13 of 41 AV engines – not very impressive results for a seven year old vulnerability. It would appear that no matter how old vulnerabilities are, attackers will still try to leverage them as weapon. Hopefully most people have patched their systems at some point during the past seven years. Sadly, despite the age of the vulnerability, the use of JavaScript obfuscation has made this attack a challenge for AV vendors – a topic that we’ve discussed in the past.

Umesh

.co.cc is the new place for viruses, free proxies, spam, etc.

Co.cc offers free domain names with full DNS management. They claim more than 5 million .co.cc domains names. .CC is for Cocos (Keiling) Islands. The sub-domain co.cc is managed by a Korean company.

I've never seen a registrar with such prominent links to reports of "Spam or Abuse", but there is a good reason for this: most of the malicious sites (fake AV, browser exploits, etc.), spam and free proxies seen in recent weeks use co.cc domains.

One of the 3 links to report spam and abuse at www.co.cc

All of  the fake AV sites we've seen since July 1st are .co.cc domains, including sunclear.co.cc, avsolution20.co.cc, truefind49p.co.cc, oksave5.co.cc, fillfree21.co.cc, etc.

37% of all free proxies we've seen from our customers in the past 5 days are .co.cc including: surflife.co.cc, feelmuchbetter.co.cc, pickupsurf.co.cc, surfday.co.cc, etc.


Example of a malicious co.cc domain

Here is an example of malicious co.cc site: hxxp://flashupdate.co.cc/ As its name suggests,  the sites tries to lure users into thinking they are downloading a never version of the Flash plugin. The page was made for Internet Explorer users. It displays a fake IE warning that the  flash version is too old, and automatically attempt to download a malicious executable v11_adobe_flash_update.exe. This executable is flagged by only 9 antivirus vendors out of 41.

Malicious site faking a Flash upgrade

-- Julien

ATECH-SAGADE Badness - Malicious .IN campaign

I'm working on generating our Q2 2010 Stats and Trends report, and I noticed a large number of blocked exploit kit activity from domains registered with the .IN TLD. These were not hacked sites but domains registered for the explicit purpose of supporting a criminal enterprise. This activity is on-going. As the post will show, the campaign involves leveraging exploit kits to exploit known vulnerabilities on client applications and installing various payloads including installing various wares to monetize pay-per-installs.

A large number of the the malicious domains have been hosted on:

91.188.60.225 - 91.188.60.227

These IPs belong to the 91.188.60.0/24 owned by ATECH-SAGADE:

Which other ATECH-SAGADE netblocks have been described as "evil" in blog posts from earlier this month:

"Evil network: Sagade Ltd / ATECH-SAGADE" -- Dynamoo

"Basically, 91.188.59.0 – 91.188.59.255 is completely evil and has no legitimate use as far as I can see." -- ComputerSecurityArticles

"Exploits, Malware, and Scareware Courtesy of AS6851, BKCNET, Sagade Ltd." -- ComputerSecurityArticles

There have also been a number of recent malicious sites related to this .IN campaign seen on the 85.234.190.0/24 ATECH-SAGADE netblock as well, for example:
nvild.in
volnv.in
uinge.in
brusd.in
woonv.in
brayx.in
edois.in
which currently resolve to 85.234.190.4, .15, and .16.

Here is a snippet of what we've seen and blocked related to this ongoing .IN campaign:


Other open-source research show several of these sites still live on this /24, for example:
http://support.clean-mx.de/clean-mx/viruses.php?ip=91.188.60.225&sort=id%20desc
http://support.clean-mx.de/clean-mx/viruses.php?ip=91.188.60.226&sort=id%20desc
http://support.clean-mx.de/clean-mx/viruses.php?ip=91.188.60.227&sort=id%20desc

Here is an example of the WHOIS for one of the malicious .IN domains:
Russian based information and self-resolving domain. The name servers currently resolve to 91.188.60.225 and 91.188.60.229 respectively on the same ATECH-SAGADE netblock.

Here is a small snippet from the exploit kit hosted on the .IN domains:
I believe this is from the SUTRA exploit pack. In any case, here is an example of an earlier Wepawet report from analyzing one of these .IN sites:
http://wepawet.iseclab.org/view.php?hash=753106a87a6e72e407c7e7b80164a538&t=1277905162&type=js
The exploits detected from the report are CVE-2009-0927 and CVE-2007-5659
And the ActiveX controls:
CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA
CA8A9780-280D-11CF-A24D-444553540000

While many of the payloads include Trojan Downloaders and FakeAV, there have been some other wares installed via this campaign. VirusTotal has shown that some of the payloads dropped by the kit are undetectable via anti-virus:
http://www.virustotal.com/analisis/bb16ee91e726a4d99e79e1815f539bbac6fc5195a0ef2b9f2d25d5df8ab11148-1277895209

The sigcheck on the artifact shows it as System Explorer by the Mister Group:
Secunia has a brief advisory posted on the Mister Group and their System Explorer here.

The Mister Group has a few pages setup for their System Explorer:
http://www.mistergroup.org/
http://www.systemexplorer.net/



From the above, it seems that this campaign is largely driven by pay-per-install profit.

Spam SEO trends & statistics (Part III)

I've shown in Spam SEO trends & statistics (Part II) that the volume of spam SEO in Google searches can vary greatly, with anywhere from 0 to 90% of the search results being malicious. As a data miner, I'd love to be able to know which hot searches I should focus on, and after how many days. With minimal resources, I'd like to quickly find the trends that would give the me the most number infected links in order to find more malicious pages.

Trends by search rank

First, let's try to see if the rank of a search term turns out to be a factor. Hot trends are ranked from 1 to 20. A search term can appear on several days in hot trends, with a different rank each time. The graph below shows the average number of spam links for each trend rank:

The average count of spam links varies from five to twelve. It looks like ranks two thru thirteen give the highest numbers, but I am not sure the graph will look the same over time.

I generated the same type of graph, but based on the percentage of searches that contain at least one spam link:

The variations are smaller: 44% to 65% of each rank contains at least one SEO spam link.

The distribution of spam per hot trend search is pretty flat, so it is not a good indicator of which search is more likely to be interesting for security research.

Trends by days

Next I checked the distribution of spam over time. One researcher told me that there seems to be a spike of spam, five days after a term first appears in the hot trends. A search is more likely to contain spam, or contain more spam results, five days after it first appeared in Google hot trends. Here is what I get from my data:

The graph shows a peak at day six: about nine spam SEO links on average are shows for searches scanned six days after they first appeared in Google hot trends. Most the spam links can be found after five to twelve days.

The graph below shows similar information: the number of searches that contain at least one spam result. As I have not scanned as many searches each day, I also included the number of search terms scanned that day:

On day eleven - eleven days after a trend made it to the top-20 - 76% of the 132 searches I scanned contained at least on spam link.

Conclusion

How can I reduce the number of security scans required, while maximizing the potential number of spam links I find? I cannot rely on the rank of a trend, as the distribution is flat, but I can skip trends which appeared within five days. I'll probably scan the search results five to ten days after they show up in Google Hot trends.

-- Julien

Fake Youtube page used to infect soccer fans

Attackers are using the excitement surrounding the World Cup to attack users. As we've shown earlier, they have posted links to fake live streams on social networks, or used BlackHat SEO spam to infect the top soccer-related searches.

Attackers are constantly changing the way the operate. Recently, I found a malicious page for the search term "world cup extra time rules", which does not have the common traits of a spam SEO attack for a fake AV page.

The Google result is actually a fake YouTube page (see screen shot below). The page is comprised of three parts:

• HTML and images display a fake YouTube video page
• Hidden HTML (a
  
  tag moved outside of the screen) stuffed with keywords for "world cup extra time rules" in order to rank well in searches
  
  
• Obfuscated Javascript which redirects the user to a different domain

Spam SEO trends & statistics (Part II)

As a follow up to Spam SEO trends & statistics (Part I), here are some high-level statistics on Google spam SEO from 05/17/2010 to 06/28/2010. The following chart shows that over 50% of the most popular search terms contain at least one spam SEO links and that 10% of the search results contain over 50% of the total malicious links.

Number of infected search results

More than 50% of the popular searches contain at least 1 SEO spam.

Number of spam links per infected search

Less than 10% of the infected searches display more than 50% of the malicious links! We've even found some searches where 90% of the results contain malicious links.

You can compare these statistics with the number of warnings shown by Google:

Number of warnings in overall search results

 Number of warnings for infected searches

Comparing the graphs above, 41 searches contained more than 50% of the malicious links. But only 3 searches showed more than 50 warnings. In general, Google is very rarely able to flag all the harmful links. Warnings tend to disappear from the first 10 pages of results as new, legitimate content pushes them down.

-- Julien