Increase in use of PDFs for spam

In recently weeks, I have noticed an increase in the use of PDF files for spam. Instead of uploading an HTML page using a compromised account, as seen shown in a previous post "Hundreds of College and Government websites still redirecting to fake stores", spammers are instead uploading PDF files. My guess for their motivation, is that PDF files are less likely to be checked for spam than plain HTML pages.

Most of the spam PDF files contain text only.

Example of spam PDF

The goal of the spammer is to redirect users to a malicious website. This is done using a piece of JavaScript embedded into the PDF file.

JavaScript snippet from the PDF file

In this example, the user is redirected to hxxp://searchglobalsite.com/in.cgi?23 (the URL is obfuscated in the PDF file) which then redirects to hxxp://www.results-today.com/.

hxxp://www.results-today.com/

The list of websites hosting spam PDF files is very similar to what I have reported earlier. It includes college web sites, governmental sites, and wiki pages, such as the following:

• hxxp://forum.wiki.usfca.edu/file/view/file10.pdf
• hxxp://www.lapspecs.com/wiki/_media/http:cr43.pdf 
• hxxp://www.dublincore.biz/accessibilitywiki/ImplementersNews?action=AttachFile&do=get&target=dub14.pdf
• hxxp://wikiglobe.org/en/images/c/c9/Texas-veterans-home-loan.pdf
• hxxp://wiki.solusvm.com/images/c/c6/Uk-cash-loans.pdf
• hxxp://nspcommunity.net/wiki/images/e/e8/Small-loan-business.pdf
• hxxp://wiki.fossasia.org/images/6/67/Ship-loans.pdf
• hxxp://vuas.net/~dpmccann/mw/images/Real-estate-mortgage-loans.pdf

A Google search for "cialis viagra canadian pharmacy filetype:pdf site:.edu" for example, provides plenty of other examples.

-- Julien

Facebook under attack by scammers

Facebook is facing no shortage of attacks from scammers. Yesterday, I posted a blog about a recent scam being circulated on the Facebook network and only a few hours later, we uncovered yet another one. The goal of this scam remains the same as earlier one, namely to coerce Facebook users into completing various surveys which in turn generate money for the scammer. The interesting fact about this scam is that it is not only posting the malicious message to the wall of the victim’s friends, but it also gets a list of online friends to send them chat message like “hey you are still there?Check my wall for the link ^_^ It showed me who viewd my profile. Amazing :p" with a link to the malicious domain. Here is what the wall posts look like:

When a user clicks on the links in the message, they are presented with a fake pop up displaying how many friends are supposedly viewing the victim’s profile. Here is a screenshot:

Remember, this is fake message and each time it is accessed, it simply generates a random number– this has nothing to do with actual users viewing your profile (something that Facebook does not share). The page also suggests that the user must copy and paste JavaScript into the address bar, which will of course execute the JavaScript in the context of the victim. This is similar to the earlier scam. Once the user runs that malicious code, they are presented with some fake messages requiring that they undertake surveys or view additional messages: Here are the screenshots:

As mentioned, the attack also sends chat messages to online friends in order to further spread the attack. Here is the screenshot of the associated source code:

The malicious code also forces the victim to become a fan of “OSAMA” Facebook pages. Here is the screenshot of that code:

Facebook is currently losing this cat and mouse game. As quickly as they take scams down, new ones appear and take their place, each time evolving the tactics slightly to evade detection. This is second scam we uncovered in only a few hours. Facebook needs to do a better job protecting its users. Both of these scams use the same techniques of social engineering users into pasting JavaScript into the URL bar – something that we’re seeing on a more regular basis and something that would never be required by a legitimate page.

Nasty Scams!!!
Umesh

Yet another Facebook scam – You look so stupid in this video

Today, we have come across yet another rapidly spreading Facebook scam. The ultimate aim of this scam is to coerce Facebook users into completing various surveys which in turn generate money for the scammer. The messages arrive with embedded Flash video and different messages such as “WTF!! You look so stupid in this video” or “yo, why are you on this video” etc. Below is a screenshot of such messages:

The post displays fake meta data showing the number of “Views”, “Likes”, etc. to make the posts appear more genuine. When a user clicks on the video link, the Flash file loads in the background. Once the loaded, it prompts the user to play a fake video. When the user clicks again to play the video, it looks like,

The above message displays instructions with keyboard shortcuts that cause the victim to paste clipboard information in the address bar. The flash file itself sets the clipboard data with malicious JavaScript which further spreads the attack. Here is what the malicious JavaScript looks like:

Let’s format this for better readability. Here is a formatted version:

If user runs this malicious JavaScript in the address bar, the script will randomly load one of two JavaScript files from different domains. The “config.js” is actually used to further spread this scam using different descriptions of the video. This JavaScript file not only posts the same flash video message to user’s wall, but also their friends walls. Here is partial screenshot of “config.js” file:

The above code contains all the configuration settings for spreading this message with different text messages and different domains. The “config.js” file also contains the code for posting the message to wall of every Facebook friend.

Here is what the source of “verify.js” looks like:

The above file references yet another JavaScript file. This referenced file is used to keep track of real time stats. The user is further prompted with message box asking “Please verify your identity” by taking surveys as shown below:

It will keep checking for the survey to be completed even if you click “Complete” button without taking the survey. This is yet another scam run by attackers to earn some money by encouraging Facebook users to complete surveys that pay for completion. This is not the first time we have seen such a scam spreading on Facebook. Attackers are doing an excellent job by taking advantages of both social engineering and social networking.

Believe me - I don’t look stupid in that video!

Umesh

India’s DNA e-newspaper website infected with fake antivirus campaign

DNA (Daily News and Analysis) is an Indian daily English language newspaper. According to Wikipedia, DNA ranks 8th among the top ten English dailies in India. Recently, the Zscaler solution was blocking access to this site, as it contained malicious content. Here is the homepage of this website:

The ‘Today’s E-newspaper’ link (circled above) is an online version of the printed periodical. We discovered that one of the pages from this e-newspaper site was infected with malicious script. Here is the screenshot of that page:

The malicious script tag had been inserted in plain text as can be seen in this screenshot of page
source:

The malicious script tag directs the victim’s browser to ‘hxxp://vcvsta.com/ur.php’. This page then redirects the user to another malicious site (‘hxxp://www4.to-gysave.byinter.net,), which will again redirect victim to random sites hosting fake antivirus campaigns. Here is the screenshot displaying a fake malware alert:

As usual, page employs social engineering tactics, which display fake warning messages and threat names to scare the victim into downloading a fake AV product. The VirusTotal result for the downloaded binary currently shows only 10/43 AV engines detecting this particular attack. Here we have yet another example of a legitimate and popular websites being infected so that the attacker(s) can impact a significant number of victims.

Umesh

Geek.com hacked with an exploit kit

Update 15/04/11 @ 3.40pm IST: With further research, it has come to our attention that many different pages like main homepage, about us page are infected with malicious Iframe pointing to different malicious sites.

We often blog about popular web sites being infected with different exploit kits. The attack vector remains the same, namely injecting a malicious HTML Iframe or script tag into the legitimate pages. One of our blog readers, Mr. David S. emailed me to share a popup alert that he was receiving on one of the pages of Geek.com. Geek has been a very popular site for online technology resources since 1996. They feature the latest news and reviews from the technology world. Here is the home page:

If you look at the screenshot above, you will notice that they feature the latest articles on the home page. The latest topic or article currently discussed is “Call of Duty: Modern Warfare 3 details leaked”. As this is first article is highlighted and “Call of Duty” is a very popular game, one can assume that many people have fallen victim to this attack. It is in the article itself where the malicious Iframe has been injected. Here is the screenshot of the article in question:

The article was published on May 13th. As usual, the malicious Iframe is injected at the bottom of the page. Here is a screenshot of the malicious Iframe:

The malicious Iframe redirects victims to a malicious website hosting an exploit kit. Once you visit, heavily obfuscated JavaScript is returned which will target various known vulnerabilities. Here is what the exploit looks like:


The decoded version of this malicious JavaScript results in the same vulnerabilities being exploited as we have seen in past blogs on exploit kits, so I will omit details on decoding the JavaScript. For interested readers, a Webpawet report is available for the malicious JavaScript.

Unfortunately, we see hundreds of attacks such as this each and every day. Many legitimate websites are being compromised by taking advantages of poor coding practices in web applications. Attackers are constantly on the lookout for popular websites or top news sites as targets for their attacks. Users need to be aware that no site is a safe site.

Umesh

The most common obfuscation techniques in Fake AV pages

We have shown some of the heavy JavaScript obfucation techniques used by Fake AV pages, but the vast majority of such pages use lighter, yet effective techniques. Those techniques are aimed at bypassing detection devices (IDS, antivirus, etc.), rather than hiding the source code. The creators focus on making life difficult for those tasked with writing signatures to detect the malicious content.

HTML encoding and white space

The FakeAV pages often encode random HTML elements using HTML entities.

Use of HTML entities in the TITLE tag

This is a very common and basic evasion techniques. FakeAV pages have now however, brought this to the next level, and even encode HTML attributes (ID, Name, Class), not just text content.

Use of HTML entities in tag attributes

They also add random white space throughout the page. This causes problems for string matching algorithms.

JavaScript and CSS encoding

While most of the CSS information is contained in external files, some inline CSS is included within the HTML document. Attackers use hexadecimal encoding (\xXX) in combination with JavaScript. Again, the encoded characters differ from page to page.

Encoded inline CSS

This hexadecimal encoding is actually used for most inline JavaScript code on the page.

Hexadecimal encoding in JavaScript code

JavaScript obfuscation

The FakeAV pages use some JavaScript obfuscation, as seen in most malicious pages, but it tends to be very light, and the code spans over a few line only.

Obfuscated JavaScript

I have found over 100 variants of the Fake AV pages in the past year. The code and the obfuscation techniques have changed quite a bit, but the result is still very much the same. I have encountered only about 10 visually different Fake AV pages.

-- Julien

Rajasthan State marketing site infected with malicious code

India’s Rajasthan State Co-operative Marketing Federation Ltd (http://rajfed.gov.in/) has been infected with a malicious script tag. This government site promotes the objectives of procuring agricultural produce from farmers through the member societies on support prices declared by the Govt. of India. Here is the home page of this site:

The malicious script has been injected at the bottom of this page. Here is the screenshot of source page,

Below, you can see a decoded version of the script using Malzilla.

The decoded script tag leads to JavaScript from “hxxp://cs.cskick.cn/cs/sc.js”. Currently, this malicious site is down. A quick Google search for this domain shows that it has been involved with malicious activity in the past. Trend Micro has issued a report for a separate threat hosted at that same domain.

Umesh