Help Center URL Validation Vulnerability (CVE-2010-1885) Campaign

I've recently noticed a number of transactions to:

vvvvvv.dyndns-mail.com/
46.254.16.61 (PTR: www.asl-s.com)

Update: we're now seeing this attack hosted as well on:

blog.dyndns-blog.com

googlepics.dyndns.tv

whitehorse.dyndns-server.com

everybodythere.dyndns-blog.com

smalloffice1.dyndns-office.com

alwaystv.dyndns-free.com

showmustgoon.dyndns.info

webarchive.dyndns-web.com

Some of the transactions have referer strings from pages from a number of sites (i.e., these sites are compromised/hosting content that links to the attack pages), for example:

www.crescent-news.com
www.trainingmag.com
*.ejecentral.com.mx
www.louisville.com

www.investmentu.com

www.the-daily-record.com

www.tennispoint.com

www.recordpub.com

blog.eduzones.com

www.planodevivienda.com

www.surfnewsnetwork.com

(ads.)moneymorning.com

www.gooofullsearch.com

www.smartautosavings.com

www.times-gazette.com

www.daily-jeff.com

www.twinsburgbulletin.com

www.rvag.com

www.mimusicagratis.net

www.gooofull.com

elpartidodehoy.es

www.linuxforums.org

www.newtvsoft.com

(the list goes on ... I'll make additions with the more interesting sites as I see them)

Some of these sites are also blocked by GSB, but initially I was not able to
track down the malicious content. Fortunately Wepawet was able to help me through the maze of content being loaded on the pages. The report is visible here.

googlepics.dyndns.tv/news/1997

whitehorse.dyndns-server.com/news/1997

blog.dyndns-blog.com/news/1997

vvvvvv.dyndns-mail.com/news/1997

--->

Turns out that it exploits the Microsoft Help Center URL Validation Vulnerability (CVE-2010-1885).

Unfortunately it doesn't appear that the Wepawet sandbox falls victim to the exploit or is able to actually obtain a malicious payload from this. I'll analyze the HCP parameter / exploit further and include any information I find about the payload.

Update:

Here's the first stage decode of the payload (spaced to read better):

Update 2 (final dropper decode):

Uses cscript.exe (command-line version of Windows Script Host) to run commands that are "echoed" to a file ".js" which downloads contents from:

hxxp://vvvvvv.dyndns-mail.com:80/news/c80e9994fe5fa7af48d3a00010b9f349.php?start=4&thread_id=3256081&forum_id=1997&

and stores them into a file bonjour.exe at the root directory. This executable is then launched and all processes containing the string "help" are forcefully killed.

Unfortunately, I have not been able to directly download the executable payload from vvvvvv.dyndns-mail.com, I keep getting a 302 response to Google.

There is also a Java attack being served from this exploit kit - possibly Incognito,

but I can't access the control panel: hxxp://blog.dyndns-blog.com/admin.php (I get an "error 3" text response).

Sample of .jar file drops:

vvvvvv.dyndns-mail.com/news/8db59781b281e80e1284a8847f73d58d.jar

blog.dyndns-blog.com/news/8db59781b281e80e1284a8847f73d58d.jar

blog.dyndns-blog.com/news/ef36787f21fb429c4c7cb2212902dcbd.jar

blog.dyndns-blog.com/news/09ec45a029f86af501a1391c2a6e781c.jar

Note: I've tried to download the executable payloads spoofing the referer / user-agent and coming from different hosts without success. It is possible that the hash value filename is time or source sensitive.

Had a friend send me a copy of the binary:
V/T Report: 2/41

ThreatExpert Report shows network connectivity to:

67.18.166.173:10000/load.php?file=#

where # = 0-19 (possibly piecemeal malware building)

81.177.33.95/forum.php

Here's an earlier variant (April 12, 2011) of the malware that I was able to find, however it is just as elusive at being pinned to a specific malware family:

V/T Report: 9/42

ThreatExpert Report, network activity:

summer-ciprys.com/load.php?file=#

joomla-desing.com/admin.php

Zscaler Safe Shopping available for Firefox 4 Mobile

After porting Search Engine Security to Firefox Mobile, I have also made Zscaler Safe Shopping available for smartphones. This add-on warns users when they are browsing a fake or compromised store. If you happen to visit one of these sites, you will be warned to not enter sensitive information, such as a credit card number or a mailing address.

Mobile notifications

Version 1.1 of Zscaler Safe Shopping offers the same features as version 1.0 for Desktop browsers. However, the notification system on the mobile version is a slightly different. Extension developers can use either the built-in alert system, or display a dialog box to the user. The former system is less intrusive, but it seems that the implementation is different depending on the OS. Firefox 4 Mobile on Windows displays a nice panel at the botttom of the phone, while my Android phone shows a tiny message at the top of the phone. On my phone, the warning is barely noticeable, and does not work when the browser is in full-screen.

Desktop notification on Windows

Desktop notification on a phone

I've therefore added an option to choose the appropriate notification system. Users can choose the best option for their system.

Choose the type of alert for your OS

Low bandwidth requirements

The list of fake and compromised stores is stored locally. It is refreshed once a day, but you can change it to a longer interval using the options. The blacklist is about 11kb.

Zscaler Safe Shopping options

-- Julien 

Another Trojan Bamital Pattern

The other day I detected a handful of Bamital infected clients beaconing out with a different pattern than that listed in EmergingThreats, and thought I'd post something for the masses to consume and be on the lookout for in their networks. Microsoft's Malware Protection Center, lists a first iteration of the Trojan back in 2009 to do pop-up/injected advertising on behalf of the attacker ... but since then the malware family has grown in variations and scope of capability - for example, search result manipulation and malware dropping. There are now 29 variants listed in the MS encyclopedia, including those published in mid/late April 2011. For example,

The pattern in EmergingThreats was created from this February 2011 ThreatExpert report:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN W32 Bamital or Backdoor.Win32.Shiz CnC Communication"; flow:established,to_server; content:"/favicon.ico?0="; http_uri; content:"&1="; http_uri; content:"&2="; http_uri; content:"&3="; http_uri; content:"&4="; http_uri; content:"&5="; http_uri; content:"&6="; http_uri; content:"&7="; http_uri; classtype:trojan-activity; reference:url,www.threatexpert.com/report.aspx?md5=fbcdfecc73c4389e8d3ed7e2e573b6f1; sid:2012299; rev:2;)

The different HTTP URI pattern that I'm seeing for the Bamital C&C communication is:

/message.php?subid=

&br=

&os=

&flg=

&id=

&ad=

&ver=

And the C&Cs that I have observed have typically been utilizing free domain services like ".co.cc" and ".cz.cc" ... this type of abuse is nothing new for these "TLDs."

Here is a snippet of domains and servers used for this C&C infrastructure:

00a8cf363ddca6b75e1b5c781b0ba226.co.cc
00a8cf363ddca6b75e1b5c781b0ba226.cz.cc
150224dce21c1056c5140bdfb2e1e8c2.co.cc
150224dce21c1056c5140bdfb2e1e8c2.cz.cc
2675589750ef32cc7fe75d7ff8e3fcbd.co.cc
2675589750ef32cc7fe75d7ff8e3fcbd.cz.cc
4bc53ed6c2c5a32606588c1d72d16a59.co.cc
4bc53ed6c2c5a32606588c1d72d16a59.cz.cc
5c099914bf7eaacb8aab1cab73cdd90b.co.cc
5c099914bf7eaacb8aab1cab73cdd90b.cz.cc
7ffea8c792bb81efca737acc44861bc3.co.cc
7ffea8c792bb81efca737acc44861bc3.cz.cc
85fd1f94d59ff6936e99c281f99a0953.co.cc
85fd1f94d59ff6936e99c281f99a0953.cz.cc
936d16bf80262add68838f96677a9620.co.cc
936d16bf80262add68838f96677a9620.cz.cc
cb9df029fbcea991d8aa64f97ff9fd40.co.cc
cb9df029fbcea991d8aa64f97ff9fd40.cz.cc
ff7cca28c0bdf5a60f09b4ec52db39bf.co.cc
ff7cca28c0bdf5a60f09b4ec52db39bf.cz.cc

The above C&C domains resolve only to a handful of IPs:

112.175.243.21 (KR)
112.175.243.22 (KR)
112.175.243.23 (KR)
112.175.243.24 (KR)
207.58.177.96 (US)

Open-source info on these IPs confirms their badness as C&Cs as well as hosting malicious fake videos/plugins (for example, malwareurl.com, malc0de.com, CleanMX).

There have also been some other open-source reports that include some .info domains with the same hash-like domain format used to host the Bamital C&C infrastructure that uses the same beaconing pattern I identified above, e.g.,

DA9341709E53AD11D84C6284EDA86043.info
D5403E5622841DD806915A4DE67DD9F8.info
87D53FBC27630E53A7CA13B7242DEFB3.info

With this type of bulk registration of new domains to keep the C&C infrastructure alive, you really need to have a set of signatures in addition to domain/IP filtering. Keep an eye out for this other Bamital pattern in your networks:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Zscaler TROJAN W32 Bamital or Backdoor.Win32.Shiz CnC Communication"; flow:established,to_server; content:"/message.php?subid="; http_uri; content:"&br="; http_uri; content:"&os="; http_uri; content:"&flg="; http_uri; content:"&id="; http_uri; content:"&ad="; http_uri; content:"&ver="; http_uri; classtype:trojan-activity; reference:url,research.zscaler.com/2011/05/another-trojan-bamital-pattern.html/;)

Koobface worm still spreading using social engineering attack vectors

The Koobface worm is not new to Internet users, but remains very active and continues spreading through different mediums using a variety of techniques. Last year, we have blogged about Koobface worm activity. We are still seeing this worm spreading via social engineering attacks. Attackers are creating fake malicious websites, which look like legitimate sites such as YouTube. Then, they lure the victim by posting fake content such as videos which actually lead to the downloading of malicious binary files. Look at the one of the site used to spread this worm using video content:

If you look at the image above, you will see the site is designed like a YouTube. The website shows a fake warning for adult material. The video displays a message saying “it requires Adobe Flash Player 10.37” and then forces a malicious file to download. In fact the latest version of genuine Adobe Flash Player is 10.2 but this video says 10.37 which is not a valid version. Once this file gets executed, it communicates with different servers. Here is the list,

• http://www.powertreecorp.com/.tqe1/?action=fbgen&v=120&crc=669
• http://www.bruleursdeloups.com/.gd1nlpq/?action=fbgen&v=120&crc=669
• http://www.waypoint-center.org/.vye770/?action=fbgen&v=120&crc=669
• http://sphusa.com/.wiqp6j2/?action=fbgen&v=120&crc=669
• http://reishus.de/.zfg35n/?action=fbgen&v=120&crc=669
• http://leonardandself.com/.uozs/?action=fbgen&v=120&crc=669
• http://iq-tech.biz/.8cww/?action=fbgen&v=120&crc=669
• http://careyadkinsdesign.com/.uzb62/?action=fbgen&v=120&crc=669
• http://top-friends.co.za/.zsm4/?action=fbgen&v=120&crc=669
• http://i-dare-you.co.za/.d38o8/?action=fbgen&v=120&crc=669
• http://fatucci.it/.hkly/?action=fbgen&v=120&crc=669
• http://www.flohr.tuknet.dk/.fav3bas/?action=fbgen&v=120&crc=669
• http://www.mx2.jellingnet.dk/.n9u39y5/?action=fbgen&v=120&crc=669
• http://www.neweed.org/.f8sh/?action=fbgen&v=120&crc=669
• http://hillsdemocrat.com/.uit970q/?action=fbgen&v=120&crc=669
• http://rentsatoday.com/.flyx4m/?action=fbgen&v=120&crc=669
• http://www.aicis.it/.zm1jpub/?action=fbgen&v=120&crc=669
• http://plymouth-tuc.org.uk/.eix02/?action=fbgen&v=120&crc=669
• http://lode-willems.be/.xokpra/?action=fbgen&v=120&crc=669
• http://www.cerclewalloncouillet.be/.s6ta/?action=fbgen&v=120&crc=669
• http://www.ilfrutteto.net/.8tsple/?action=fbgen&v=120&crc=669

Zscaler, already has protection in place for these Koobface C&C servers. You can find the ThreatExpert report for this particular attack here. Never trust any site which will force you to download an executable file.

Umesh

Latest victim of an Exploit Kit - Lenovo, India

Update 05/04/11 @ 7.49pm IST: Thanks to feedback from an Anonymous blog poster, I've done some further investigation and this attack actually appears to be tied to the Incognito Exploit kit as opposed to the Blackhole Exploit kit.

Back in February, I posted a blog about the rising prevalence of attacks involving Blackhole exploit kits. We received numerous comments and emails about the same threat being found on various websites from our blog readers. The toolkit has been linked to from numerous compromised websites, which in turn have victimized a number of their visitors. Attackers are injecting malicious iframes into the legitimate sites, which in turn redirect to malicious websites hosting the Blackhole Incognito exploit kit. We have observed and identified such compromised sites due to Zscaler’s advanced security features in our solution. The latest victim is Lenovo, India whose website for product warranties http://www.lenovowarranty.co.in/ has been compromised, redirecting visitors silently to the Blackhole Incognito exploit kit. Here is the screenshot of the home page of the compromised Lenovo site:

One of the pages on the site, http://www.lenovowarranty.co.in/regspacks2.asp, is infected with a malicious iframe. Here is the screenshot of that page:

If you look at the source of page, you will find the malicious iframe injected into the source code as shown below:

The malicious iframe points to the site “hxxp://nemohuildiin.ru/tds/go.php?sid=1". This malicious site actually redirects the user to another malicious website hosting the Blackhole Incognito exploit kit. Here is the packet capture when you visit the mentioned malicious site:

Observing the “Location” field in the HTTP header, we see the user is being redirected to another malicious website hosting the malicious toolkit, a common pattern that we’ve seen in the past. The malicious website “hxxp://andromari.cx.cc” returns obfuscated malicious JavaScript code to exploit different vulnerabilities and downloads malicious binaries. Here is the screenshot of the malicious JavaScript sent by this kit

I am not going into the details of the exploits themselves as they are related to the same vulnerabilities and toolkit, which I have discussed in an earlier blog. The malicious site hosting the Blackhole Incognito exploit kit only attempts to exploit the victim on their first visit. If you revisit this site, it will either redirect you to Google or simply return a “Page not found” error.

This post further supports my claim in an earlier blog, which states that “Blackhole exploit kits are rising”.

Blackhole is Exploit kits are definitely a Bad Hole bad for web security.


Umesh

Osama Bin Laden Related Malware

We'll continue to update this blog post with new malware we're seeing related to Osama bin Laden's death, as we expect to see plenty.

---

hxxp://www.pharmafutar.hu/images/home/fotos.php

leads to low A/V detection malware:

hxxp://www.pharmafutar.hu/images/home/urgentes.dyndns.tv.fotos-osama-bin-laden-morto.com

VirusTotal Report (3/41): Trojan / Koobface

---

More Facebook scams, attempting to trick the end user into pasting Javascript into the URL bar in order to further propagate the scam.

hxxp://www.facebook.com/pages/Heavenly-father-Help-Us-all/209589715729272
hxxp://www.facebook.com/pages/Osama-Death-Live/213631485333118

---

Interesting statistic: Zscaler went from seeing fewer than 1,000 URLs containing the terms 'osama', 'usama' or 'laden' on Sunday afternoon, to a peak of over 4 million by 10am PST on Monday morning.

---

There are a handful of sites cropping up that are advertising that Osama is alive. When visited the page appears as follows:

The go.php script redirects to an Osama is Alive Facebook profile, such as:

hxxp://www.facebook.com/pages/Osama-is-Alive/127361454008017

Google search: intitle:"SHOCKING Tape - Osama Bin Laden"

This particular profile is down, however there do appear to be a number of other related Facebook profile pages recently created:

I have not witnessed anything malicious at the moment in this campaign. But because the spammy nature and number of sites / profiles it makes our list.

---

hxxp://www.limitsmodelos.com.br/ans/TELEVISA.NOTICIAS.Video-Bin.Laden.AVI.exe

V/T Report (32/42): Trojan Rinecud / Pincav

---

hxxp://www.facebook.com/pages/Exclusive-Osama-Bin-Laden-Death-Video/201412819897862?sk=app_4949752878

Asks Facebook users to 'like' the scam and then copy/paste Javascript into their URL bar, in order to generate Facebook content promoting the scam. The page alleges that once 25,000 Facebook users have promoted the scam, they will reveal the Osama Bin Laden death video.

---

hxxp://www.binladensdeathvideo.info/

Let's just call this 'poor man's Likejacking', with a dash of malvertising. The site manually walks a user through manually 'liking' content and then posting it to their Facebook page, which is allegedly required, before the video can be viewed. Upon clicking on the 'WATCH THE VIDEO NOW' link a fake 'age verification' screen is displayed, requiring the user to click on advertising links.

---

Osama Bin Laden Death Video Facebook Scams:

For example,

hxxp://www.facebook.com/pages/Exclusive-Osama-Bin-Laden-Death-Video/201412819897862?sk=app_4949752878

--> spyingonyou.info/osama/a.js

Many other Facebook profiles as well:

References: Facecrooks, Naked Security

---

hxxp://www.blogdelnarco.com/2011/05/cae-osama-bin-laden.html

News story which includes links to video with fake VLC warnings. The page may be infected with malvertising. The malware is not consistently displayed on the page.

V/T report (19/41): Hotbar Adware

---

hxxp://osamabinladenfotosineditas.blogspot.com/

Fake codec warning that leads to Hotbar Adware

A variety of attacks are included on the page, including Likejacking and Adware.

V/T Report (20/41): Hotbar Adware

---

hxxp://terrorismo.myhotting.com/videos/paquistao/terrorismo/osama/02/05/2011/video-em-que-OSAMA-BIN-Laden-aparece-segurando-jornal-com-a-data-de-hoje.php

302 redirects to:

hxxp://130.237.197.211/images/OSAMA-BIN-Laden-aparece-segurando-jornal-com-a-data-de-hoje-obama-se-passa-por-mentiroso.exe

V/T Report (24/41): Trojan Banload

Seen spread primarily through spamvertised messages to mail.live.com

Others seen:

68.7.242.6/images/OSAMA-BIN-Laden-aparece-segurando-jornal-com-a-data-de-hoje-obama-se-passa-por-mentiroso.exe

33.225.237.6/images/OSAMA-BIN-Laden-aparece-segurando-jornal-com-a-data-de-hoje-obama-se-passa-por-mentiroso.exe

148.227.118.6/images/OSAMA-BIN-Laden-aparece-segurando-jornal-com-a-data-de-hoje-obama-se-passa-por-mentiroso.exe

131.128.109.6/images/OSAMA-BIN-Laden-aparece-segurando-jornal-com-a-data-de-hoje-obama-se-passa-por-mentiroso.exe

100.166.108.6/images/OSAMA-BIN-Laden-aparece-segurando-jornal-com-a-data-de-hoje-obama-se-passa-por-mentiroso.exe

Other Banload:

noticias.terra.woonet.co.kr/videos/paquistao/terrorismo/osama/05/05/2011/video-proibido-mostra-momento-da-execucao-de-obama-por-agentes-na-operacao.exe

V/T Report (19/41)

---

hxxp://shop.akod.se/BinLadenMorto.avi_de_msn-videos.com

V/T Report (7/41): Password Stealing Trojan

---

Malware sites already capitalizing on announcement of Osama Bin Laden's Death

Update (025/02/11 9:40am EST): A before/after comparison of the photoshopped image used in the malicious post can be found here.

Within hours of the announcement of Osama Bin Laden's death, we are already seeing malicious sites emerge to capitalize on the news. One Spanish language site displays a purported photo of a murdered Osama Bin Laden and includes a story about the US led operation. Farther down the page, the reader is presented with a Flash Player window with a message indicating that the user must first update a VLC plugin, which is a popular media player, in order to view the video. When the user clicks on the link, they will download a file titled XvidSetup.exe. This file is actually a popular adware tool known as hotbar. At present, 19 of 41 antivirus engines are blocking the file.

Sadly, there will be no shortage of scams taking advantage of this historic global news. Users should use caution any time a site claims to be offering video or photos related to this news.

- michael