66.220.17.200 A Haven For Swizzor

Update:
Based on a comment, I modified the title to be 66.220.17.200 versus DNSMADEEASY. Let me explain:

• DNSMADEEASY provides the resolution / name services for the domains in question
• Hurricane Electric / C2 Media provides the hosting / IP space (66.220.17.200)
• Tucows is the registrar for the registered domain names

When I was doing the analysis I was looking at free/cheap DNS services and their abuse, which was why I fixated on the name resolution services, DNSMADEEASY. However, there are multiple players supporting this Swizzor infrastructure and it should be explained as such.

Update 2:
Also, after I published the post, I checked and found that the hostname portion of the domain does not seem to matter / affect the ability to download the binary payload. For example,
hxxp://garbage.nb.host192-168-1-2.com/bins/int/9kgen_up.int
let's you download the binary (where "garbage" can be anything). It is likely that the hostname is used for tracking purposes to identify which sites / trojan packages are most successful. The listed fully-qualified domain names below are what was seen in the wild.

Post:
This may not be news for some of you, all it takes is a simple Google for something like host192-168-1-2.com malware. You’ll see a rich history of abuse from Trojan Swizzor ranging from 2009 to today:


host192-168-1-2.com is registered through Tucows and has resolution / name services provided through DNSMADEEASY. This robtex report shows the other related domains, each having a varying degree of abuse related to Swizzor:

adserver5.com
cidhelp.com
dns-look-up.com
host-domain-lookup.com
host127-0-0-1.com
host192-168-1-2.com
host255-255-255-0.com
lop.com
netbios-local.com
netbios-wait.com
range159-195.com
zone-media.com

Below is a brief list of recent domains used to host Trojan Swizzor payloads. Note the domains used / listed here include: host127-0-0-1.com, host192-168-1-2.com, host-domain-lookup.com, and host255-255-255-0.com:

All resolve to the Hurricane Electric IP: 66.220.17.200
Note, the above active/live list we provide is much more extensive that what is listed on MalwareURL for example. The URL paths to the malware within the above domains include:
/bins/int/9kgen_up.int
/bins/int/upd_admn.int
/bins/int/kr3.int
/bins/int/tp_map16.int


While they all have an "int" file extension, they are all PE32 executable files.

9kgen_up.int (Swizzor variant)
MD5: c79cd77012c848f93e0a8dfc28dee992
V/T (20/41)

upd_admn.int (Swizzor variant)
MD5: 43edfa7f55d4331ad2d3f5ca1bb4b999
V/T (22/42)

kr3.int (Swizzor variant)
MD5: ff7d4cbb6aa30bbf58d945e182700fb7
V/T (22/41)

tp_map16.int (Swizzor variant)
MD5: 599ebaed9e147ef8a0b6967dba2da040
V/T (24/42)

Swizzor is a Trojan that is typically installed via drive-by download or social engineering. It has the ability to interact with Internet Explorer through Browser Helper Objects (BHOs) to inject ads and to download/install other threats (for additional information see Microsoft's threat entry for Swizzor). In the particular variants that I downloaded, I saw C&C update activity to other related domains, e.g.,

hxxp://upd.host255-255-255-0.com/upd/check?version=0.1unk&fxp=614a69d6edf1b0f55a0a07bfd613edb3cceeefa1b7223878206dc7870f0307bf6e496e69
IP: 66.220.17.200

hxxp://ayb.host127-0-0-1.com/abt?udata=WWW_9WWW:5.60www:%20140445784:United%20States:program_started:1cb20aef0c84a243
IP: 66.220.17.154

I’m in the process of sending something along to Hurricane Electric / Tucows/ DNSMADEEASY now, but you may want to check the logs in your environment for systems connecting to the mentioned domains. Here's a continuation of the above list of recent Swizzor domains:

Nearly 3 million "Hot Video" pages pushing fake AV are undetected

Note: Google contacted me shortly after the blog was published, and claimed there were only 77 such links. But when I tried a query for the first domain in the list, naghoospress.ir, I got more than 600 Google results for just this domain: site:naghoospress.ir hot video. Attackers create fake Youtube pages for each 20 Google Hot Trend each day on each domain. I've seen pages for trends of the last 60 days at least, so that's about 1,000-1,200 pages per domain. There seemed to be at least 100 domains indexed by Google, so a very low estimate is 100,000 Hot Video pages in Google search results. But each Google queries show different domains, so there could be more fake pages. Google displays a maximum number of 1,000 results for any search, only they know the real numbers. But it was clearly at least 100,000 when the post was published.

We've seen many fake YouTube pages redirecting to fake antivirus software downloads in the past. However, we're now seeing this same phenomenon with a new twist: Google has indexed nearly 3 million "Hot Video" pages - all pushing fake AV. Yandex, a Russian search engine, also returns numerous links to these pages for random searches. Try the following Google search: inurl:"page.php?page=" "hot video" :

Google search for Hot Video

The fake Youtube video page is covered by an invisible Flash layer and the Flash object automatically redirects the user to a fake AV page. If the user has Flash disabled, the page becomes harmless. The URL of the Flash file, hosted on a different domain, is obfuscated with Javascript.

Fake Youtube page

The spam content, which is used to ensure that the page is indexed by search engines, includes an invisible DIV element pushed out of the screen. It contains links to other fake Youtube pages on the same site. To make the content look more legitimate, the page includes links to legitimate sites (e.g. flickr.com, nasa.gov, etc.) and images from external sites.

HTML code of the spam

Redirection to Fake AV

The fake YouTube page redirects to a fake AV page. Several domains are used to host the fake AV software, including www2.soft-analysis79.co.cc, www1.selfprotection20.co.cc, etc. There are different variations of the Fake AV page, but they are all similar to pages previously seen elsewhere.

Fake AV page

Virtually undetected

Besides the huge numbers of such malicious pages indexed, and the fact that they show up in many search results, the main problem here is that the pages and their malicious payloads are virtually undetected by regular security tools:

• Google Safe Browsing does not block most of these pages (90% I've tried where not blocked in Firefox), and the fake AV domains were not detected either.
• The detection rate amongst anitivrus vendors is only 11%!

This type of threat is different from the usual Balckhat spam SEO: the same content is shown to the user and to the search engine, therefore the page can be accessed directly, without clicking on search engine results.

Because the "Hot Video" page uses both obfuscated Javascript and Flash, it is harder for security scanners to detect them. Zscaler has protection in place for our customers.

-- Julien

A week of Research

This post is a little bit different from what I usually write. Rather than explaining one topic, I'd like to provide insight into what we uncover during a typical week of research. Here are some of the malicious pages that I found this week during some research not related to spam SEO.

Phishing

Facebook phishing pages are showing up regularly. I uncovered an Italian phishing page at hxxp://facebookentry.altervista.org/. The page looked exactly like the Facebook login page, but all the links produce a blank page. It looks like the author focused on getting the main page right, but did not bother to create fake links. Anyway, I guess most  people will fill out the form right away and will not check the links.

This page has been up for more than a week.

Italian Facebook Phishing page

Another Facebook phishing page that I uncovered was hosted at hxxp://www.facebookconfirmation.com/ - a great domain name! I have not seen this login or "confirmation" page anywhere on Facebook, but I'm sure it fooled many people. The domain is registered bin Russia.

Fake Facebook confirmation page

Fake antivirus vendor

hxxp://generalavs.com/ looks like an online store for antivirus. You are invited to try their software for free, and you must even accept their "Terms and Conditions". The executable GeneralAntivirus4.exe which a user is prompted to download, is actually a virus. Fortunately, it is detected by 90% of the AV vendors.

Fave AV online store

hxxp://bulletproofsoft.com/ is a similar malware site, but it has more than 10 executables for download. The detection rate among AV vendors is much lower at about 40%.

Malicious sites for download

These are examples of all the malicious sites that are out there. Once again, using Google Safe Browsing (with Firefox, Opera, Safari) or SmartScreen filters (Internet Explorer) does not help. None of these sites were flagged. They have been up for several days, probably weeks, and may not be taken down any time soon.

Antivirus can help to protect against some malware, but they are not a silver bullet.

-- Julien

Union Public Service Commission website of India Compromised

My previous blog discussed the injection of malicious JavaScript into the html/JS pages of a Red Cross website. This time victim of similar attack is an Indian government website, namely http://upsc.gov.in/ .

Screen-shot of the UPSC homepage:

Screen-shot of the source code:

A quick Google search for this malicious JavaScript code shows that many sites are infected with the same code. Clearly, there is an automated attack targeting the same application logic flaws within various different websites. Currently, the link to the malicious website is down. Though it seems from related attacks that the perpetrators are continually changing the domains and the malicious script associated with the attacks. Tried to send notification on certain email address found while doing look up on domain name, but messages were rejected.

For those not aware, Virustotal has now launched new functionality that permits you to submit URLs, which will then be checked against popular blocklists. The result for this site shows that none of the lists have yet detected the infection. Additionally, if you submit malicious HTML file, only 8/41 AV engines identify it as malicious.

Pradeep

More Chinese phishing sites

in a previous post, I talked about the QQ phishsing sites targeting chinese users. There is another popular type of Chinese phishing: Yahoo! Auctions lotteries. Yahoo Auctions is more popular than eBay in China.

These phishing sites claim that Yahoo users have won a gift, and that they need to login with their Yahoo! Auctions credentials to claim their reward. Like the QQ Reward phishing pages, these fake sites look all the same.

Fake yahoo Auction lottery page

These sites were not flagged by Google SafeBrowsing or Phishtank. One of them, hxxp://ccyahoo.in/, is now down. But others are still live: hxxp://yahoo.uu2010.in/index.asp, hxxp://ye.163.to/, etc.

Languages in Phishtank

"PhishTank is a collaborative clearing house for data and information about phishing on the Internet." (from their website). The site maintains a public list of phishing URLs. Since none of the Chinese phishing sites were included in Phishtank, I was wondering if the list was centered on english phishing sites only.

I used the Google Ajax Language API to verify the language of each Phishing page. 90% of the phishing pages still reachable are in English. Number 2 is French, with 6% of the list.

Languages in Clean-MX

Another public list of phishing sites is provides by clean-mx.de. It contains about 3,500 URLs versus the 250 of Phishtank.

The Clean-MX list contains 80% English phishing sites. There were only 6 Chinese pages out of 2,158. I am not aware of any public phishing list focused on Chinese language, but it would appear that one is warranted.

-- Julien

QQ phishing sites stay under the radar

In April, Mike reported an increase of QQ phishing sites. This does not come as a surprise, QQ is the equivalent of Google + eBay + Paypal in China. QQ first started as an Instant Messaging site and has now evolved as a Chinese web giant, with e-mail, search, online auctions, online payments, etc.

QQ Security Center

The main target here is the QQ Security Center aq.qq.com, which is used, among other things, to retrieve lost passwords, confirm account ownership, etc. The phishing sites are exact copies of the original site.

Most of the sites spotted are still live, and not blocked by Google Safe Browsing or Phishtank:

• hxxp://www.qqaq.info/
• hxxp://aq.qq.com.inddexx.com/
• hxxp://aqq.txfree.net/aq/
• hxxp://aq.qq.com.cgi-get.tencant.com.cn/
• hxxp://aq.qq.sevrivae.cn-indvx.com/index.asp
• hxxp://qq2010hd.h7.8210.cn/qq/88.htm

Phishing site hxxp://www.qaq.info/

QQ Rewards

The other popular QQ phishing target is the Reward Center, where QQ rewards users for using their services. Fake QQ Reward Centers attempt to steal user credentials. Like for the QQ Security center scam, all phishing pages are nearly identical, and not detected by Phistank or Google SafeBrowsing.

QQ Reward phishing page

Some of the phishing pages are:

• hxxp://ctqq.in/qq/
• hxxp://asdsdf.ns3.lianfa.info/qq2010/
• hxxp://1111aaaa.01kro.idcqq.net/3/
• hxxp://qqtx08.tk/
• hxxp://nghfyu585.us3.hg288m.com/qq1/
• etc.

hxxp://qqtx08.tk/ QQ phishing site

I've seen only one QQ phishing site flagged by Google Safe Browsing while reviewing more than 20 QQ phishing sites, and the domain was already down: hxxp://qqli.go.3322.org/


-- Julien

Red Cross Hacked Again!!!

It seems as though attackers are fond of Red Cross sites as this isn’t the first time that we’ve blogged about a compromised Red Cross site. The victim this time was the Red Cross of Serbia. Previously, they hacked the site by simply injecting a malicious iframe. Injecting malicious content into static pages on the server side seems to be an emerging trend. Let’s analyze how it was done this time.

Screen-shot of the homepage:

Screen-shot of “http://www.redcross.org.rs/” source code:

Some of the infected JavaScript files are,
http://www.redcross.org.rs/java3/menu_common.js
http://www.redcross.org.rs/java3/menu123.js
http://www.redcross.org.rs/java3/fw_menu.js

A simple Google search on the domain “obscurewax.ru” suggests that this domain has been used in other attacks as victims can be seen discussing similar injected code on various forums and similar files have been submitted to online malware analyzers. We have also observed that many sites are still infected by the same malicious script. For example, “http://www.myasianroots.com/, where the same malicious script is inserted at the bottom of the webpage.

Although the injected JavaScript file “hxxp://obscurewax.ru/Kbps.js” is no longer accessible, this same file has appeared on other domains. Even though the malicious code is no longer being delivered, it is possible that the vulnerability that led to the attack has not yet been patched and further infection could occur, or the existing malicious content could become active once again. Notifications are being sent to Redcross.

Pradeep