openxadvertising.com Mass Malvertising Campaign

-->

On Monday, Government Security News (GSN), reported that their website had been compromised during a mass infection. While in the case of the GSN infection, the injected content was delivered from googlecodehosting.com, we have determined that the same content was also delivered from googlecodehosting.org and googlecodehosting.net, all of which resolve to 89.45.14.87 and are now offline.

In reviewing our logs for sites with the aforementioned referrers, indicating that they too were/are compromised, we have thus far identified 65 different sites (see list below), with the earliest referrers appearing on Thursday June 13 at 6:32:28 2013 GMT. Referers for the GSN site appeared as early as Jun 14th, suggesting that the site was likely compromised for a couple of days before they became aware of the situation and took steps to clean the site.

The attack leveraged the following chain of events:

1.     Malvertising – The injected code appears to have occurred in malicious advertisements used by the impacted sites, as opposed to the sites themselves. The malicious advertisements were delivered from openxadvertising.com, which is currently blocked by Google SafeBrowsing.

2.     Redirect – The content hosted at the googlecodehosting pages (now offline) has been archived on Pastebin.  As can be seen, the actual malware is being pulled from compromised WordPress sites.

3.     Infection – A malicious .jar file is delivered. At least two separate Java vulnerabilities have been observed in the attacks (CVE-2013-1493 and CVE-2013-2423), which are used to install the ZeroAccess Trojan.

The following infected domains have been identified in this attack from reviewing referer headers referencing googlecodehosting.com/net/org:

·      2475-lsxtv.voxcdn.com

·      ads.rahesabz.net

·      ads.thehiveworks.com

·      delaware.newszap.com

·      disabilitynow.org.uk

·      dj1067fm.com

·      greenhomeguide.com

·      insanescouter.org

·      lamega.com

·      marinefuel.com

·      mess.troutcave.net

·      omahanightlife.com

·      openx.multimediajamaica.com

·      pacificweddings.com

·      supernormalstep.com

·      test.theeagle.com

·      traveloregon.com

·      truthdig.com

·      vmblog.com

·      www.adrants.com

·      www.artshound.com

·      www.beginnertriathlete.com

·      www.birmingham365.org

·      www.brambletonian.net

·      www.charlestongolfguide.com

·      www.clashmusic.com

·      www.cobizmag.com

·      www.controleng.com

·      www.dragzine.com

·      www.ediblemanhattan.com

·      www.empirepage.com

·      www.environmentalleader.com

·      www.first30days.com

·      www.girlswithslingshots.com

·      www.guideposts.org

·      www.hospitalmedicine.org

·      www.hot-dinners.com

·      www.jeepsunlimited.com

·      www.jewishjournal.com

·      www.knittinghelp.com

·      www.lakestclair.net

·      www.lethbridgeherald.com

·      www.lsxtv.com

·      www.menuclub.com

·      www.nowplayingaustin.com

·      www.onedirt.com

·      www.phillyfunguide.com

·      www.popco.net

·      www.pro-touring.com

·      www.questionablecontent.net

·      www.radiohitz92fm.com

·      www.rtbookreviews.com

·      www.sayfiereview.com

·      www.sermonspice.com

·      www.spearfishingplanet.com

·      www.sportscollectorsdaily.com

·      www.stangtv.com

·      www.success.com

·      www.talentzoo.com

·      www.thejc.com

·      www.ventura-usa.com

·      www.wannabebig.com

·      www.whichbudget.com

·      www.workerscompensation.com

·      www.worthgoing.com

For those wishing to implement IDS based signatures to prevent the attacks, the following unique strings have been identified in URL paths seen to be delivering the malicious .jar files:

"/.cache/?f=site.jar&k=" OR

"/.cache/?f=atom.jar&k="

followed by:

"&h="

This attack is very similar to one that we blogged about in May. That attack was also a mass infection, which impacted media sites and also leveraged the ZeroAccess Trojan. As a courtesy, communication has been sent to the webmasters of all impacted domains informing them of the potential infection.

- michael

Phishers target Yahoo users

Yahoo Mail introduced two-factor authentication in December 2011. Two-factor authentication can be used to prevent suspicious access to an account (login from a different country, numerous failed login attempts, etc.) and can be used to verify a user's identity when asking for a password reset.

Two-factor authentication has been in the news a fair bit lately as LinkedIn and Twitter have recently begun to offer the feature. We encountered an example whereby a phisher actually took advantage of heightened awareness of two-factor authentication to aid in an attack. The scam involved spoofed e-mails, which claim that all Yahoo users must turn on two-factor authentication:

Phishing e-mail to Yahoo Mail users

The e-mail has a spoofed FROM address (@yahoo.com) and a fake link to http://update.yahoo.com/. The user clicking on this link is actually redirected to a phishing page at http://www.antek.com/pics/tiles/yahoo.com.html as shown below:

Yahoo phishing page

At present, this URL is blocked by Google Safe Browsing (Firefox, Chrome, Safari) but not by Internet Explorer.

Yahoo is now shutting down their Yahoo Mail classic interface and forcing users to their new e-mail platform. This will no doubt be another great opportunity for phisher to take advantage of confused users.

Rise in Red Kit Exploit Kit Activity

This week, a malicious pattern of activity was observed in websites being compromised, which in turn redirected to a Red Kit exploit kit (EK) landing page. Some infected websites that were seen:

• neptunebenson[dot]com
• route66marathon[dot]com
• whitesteeple[dot]com 

(Warning! these sites may still be infected). 

Two different mechanisms were used to infect the websites. The first one being a standard iframe injection, which leads to the Red Kit EK landing page through URL redirections. The other mechanism leverages SEO based techniques to carry out HTTP 302 redirections that lead to the RedKit EK landing page.

The snapshot below shows some of the sample URLs/SEO redirections that were seen. Please refer to this URLQuery search in order to identify other URLs exhibiting the redirection patterns.  

Upon visiting the infected webpage, it sends the user to a malicious redirection (HTTP 302). The actual exploit code as shown below is then ultimately delivered.

The first landing page uses a typical RedKit Exploit, which contains the obfuscated URL that is used to fetch the payload as shown in the highlighted box below. 

The Java Sandbox bypass exploit is carried out leveraging an unsigned applet with the suspicious parameter "__applet_ssv_validated" passed, which exploits the following vulnerabilities:  CVE-2013-1493 / CVE-2013-2423 / CVE-2012-1723.

The jar applet gets the obfuscated URL from the parameter "name", which is passed by the jnlp as shown above. It is then decoded into the final URL through the following code: 

This URL contains the encrypted binary payload. The applet creates a URL Connection Steam to download the encrypted binary stream. The binary stream is then decrypted using the AES CBC 128 bit cipher block chaining scheme. The IV (Initial Vector) and the decryption key are stored inside the applet. After decryption, it stores the binary file onto the temporary folder with a random filename by making a call to java.io.tmpdir. The snapshot below summarizes some of the important routines involved in the decryption process.

The binary file was packed using UPX and has anti-vm/anti-debugging detection routines. The binary is a Keylogger Tojan that steals credentials such as credit card numbers, passwords etc. and sends it over to a remote location. Currently, the binary is being detected only by three AV vendors as malicious. 

Binary Reports:

https://www.virustotal.com/en/file/33dca051d6ad48d09fdee7a14dfacc32c174616743ea16421d6fa4ccb77aeb71/analysis/

http://www.threatexpert.com/report.aspx?md5=61925c0254ca1b8704b1fb78faedaaaf

Jar File Report: 

https://www.virustotal.com/en/file/13bfc250788893efaf9f8ad7d98fe1f01e5eb28f025fcdac9013470c7c9635fb/analysis/

It is always a good practice to keep vulnerable browser plugins such as Adobe/Java constantly updated. This protects the end user from malicious EKs leveraging known vulnerabilities. For more specfic information related to Java Plugins and how to disable them, please refer this great blog post from my colleague Julien Sobrier.

Darkleech attack continues to grow

The Apache Darkleech attack has been in the news for quite some time now. The first compromise that we identified in our transactions dates back to mid-March. This Darkleech exploit (aka Linux.Cdorked)  injects malicious redirections into a website that leads to a Blackhole exploit kit (BEK) landing page. Sucuri published up a great write up about the Darkleech infection mechanism on the server side.

We are currently observing a considerable rise in websites being compromised due to this attack. The infected websites redirect to a version of the Blackhole Exploit Kit v2. We identified the following sites being compromised in the past week within observed Zscaler traffic:

202.218.253.214
bazzillbasics.com
bigfishermanseafood.com
clasificados.zocalo.com.mx
colima.vendidoalas3.com.mx
embarque.com
kimindschool.com
mapas.guiaroji.com.mx
mediagazer.com
middleschoolbook.com
mpsrail.co.uk
new.schoolnotes.com
newsofthepast.com
norwalkmedicalgroup.com
reports.valeopartners.com
studioartsdallas.com
unit2.euro2day.gr
v2.wallpaperzip.com
www.264thegrill.com
www.acadianabusiness.com
www.alancristea.com
www.aqua-medic.com
www.aquapurawater.ca
www.backroads.org
www.beachcamsusa.com
www.bsgco.com
www.chicagohomeestates.com
www.compactpowercenter.com
www.companyrescue.co.uk
www.eastpak.com
www.euro2day.gr
www.flowersandservices.com
www.fortworthzoocoupons.net
www.freedieting.com
www.gite-mer.com
www.grandlifehotels.com
www.jackshainman.com
www.momentumtraining.biz
www.nevadasecuritylicense.com
www.qualityenvironmental.co.uk
www.ranabroadband.net
www.rentalsource.com
www.servo2go.com
www.superiorvalves.com
www.theacme.com
www.trulia.com
www.vbbound.com
www.visit-montenegro.com
www.volpifoods.com

The following list shows the list of IPs and websites observed serving the Blackhole Exploit kit landing page.

129.121.101.227
129.121.104.90
129.121.108.220
129.121.113.217
129.121.120.211
129.121.168.226
129.121.194.244
129.121.199.90
129.121.201.230
129.121.45.181
129.121.55.185
129.121.61.189
129.121.65.124
129.121.85.166
143.95.13.5
143.95.1.6
143.95.17.5
143.95.1.8
143.95.2.6
143.95.7.6
149.47.113.128
149.47.149.225
149.47.154.201
149.47.205.179
149.47.21.162
149.47.218.128
149.47.22.176
149.47.225.171
149.47.245.128
173.233.133.30
173.233.133.43
173.233.134.138
173.244.221.89
174.37.210.122
174.37.210.127
208.166.50.27
208.43.236.169
208.69.183.138
208.69.183.205
209.126.248.63
216.154.208.125
64.247.176.220
64.247.180.106
65.75.145.203
65.75.168.252
65.75.174.197
65.75.176.120
65.75.184.70
65.75.185.243
65.75.188.211
65.75.190.59
67.213.213.23
69.89.4.92
69.89.5.224
69.89.9.47
adanakenthaber.com
aftabcurrency.eu
akmusik.org
alzagh.com
aminexchange.net
austriawanderer.com
basquet-atletico.lendanearlongisland.com
boomchoon.co.uk
budgettyremaintenance.co.uk
cariparker.co.uk
cinselmarket.org
countryandleisureclothing.co.uk
egyptwanderer.com
elkadytrans.com
firstbytemicro.com
foryouroccasions.co.uk
georgemediahouse.co.uk
gheep.co.uk
gshcontracts.co.uk
hcxmy.com
hungarywanderer.com
lcwceramics.co.uk
leventerkekkuaforu.com
lovehost.co.uk
moneystopltd.co.uk
mpsrail.co.uk
mtlssc.org.uk
ondervreemdevlag.nl
partitioningsoutheast.co.uk
platjadarovirtual.com
rika.100pixels.co.uk
sms.nozom.com.eg
teddyrepair.co.uk
upminstercontainers.com
wallpapers.animalz.gr
wcwr.co.uk

The following pattern in the URL was observed:

\/[a-z0-9]{16,32}\/q.php

We also identified the following user-agent strings when the redirection was made:

Java/1.6.0_26
JNLP/1.7.0 javaws/10.21.2.11 () Java/1.7.0_21
JNLP/6.0 javaws/1.6.0_03 (b05) Java/1.6.0_03
JNLP/6.0 javaws/1.6.0_26 (b03) Java/1.6.0_26

The user agents found while visiting these infected sites were mainly: MSIE_7_X, MSIE_8_X and MSIE_9_X.

Upon visiting an infected website, it redirects to a standard BEK v2 landing page as shown below.

The exploit code targets vulnerabilities in multiple plugins including Adobe PDF and Java when run on IE, causing the attacker to load malicious code in the context of the application. When deobfuscating the PDF exploit, we can see the final URL used for redirection, as shown in the image below. However, this URL was not accessible (404 error response), at the time of writing, hence it was not possible to retrieve the malicious binary file.

Upon revisiting some of these compromised websites, it was found that the page was no longer serving the injected code. This provides a clue. The attackers probably choose random sites running the Apache Webservers that are vulnerable to the dark leech exploit and infect them only for a brief period of time and then clean them up. Hence tracking Darkleech infections is can be a challenging task. For further details on the vulnerability and how the server can be patched, please refer to CVE-2012-1557.

Fake YouTube page targets Chrome users

Fake YouTube pages are one of the favored ways attackers leverage to get users to click on malicious content. These fake pages often look the same, but the source code can reveal a new twist. This time, a recently encountered fake YouTube page host at http://facebook-java.com targets Google Chrome users only.

Fake YouTube page

We have found a many malicious sites that specifically target Internet Explorer or Firefox users, but not often Google Chrome users. In this example, any click on the fake video player or the fake ad attempts to install the following extension for Google Chrome: https://chrome.google.com/webstore/detail/nhmibhinlbilhaflldckbeokphjoifhi.

JavaScrip code that installs a Chrome extension

You may have noticed that the extension is hosted in the official Google Chrome store. Google disabled the installation of extensions for 3rd party sites in June 2012, and silent installs in late 2012.

The Chrome store page does not show any information about the extension:

Let's install the extension hosted at http://facebook-java.com/.

List of permissions requested by the extension

A new icon is added next to the URL bar:

The link redirects to http://www.getjava.net/. This shows the same page as facebook-java.com. It tries to install another extension from the Chrome store, but this one has already been removed.

getjava.net

Now that the extension has been installed, it is not possible to open Tools or Settings in Chrome. Instead, a tab opens to https://www.facebook.com/?get_cod whenever those functions are accessed. The corresponding code in the malicious extension shows how it is done:

Overrides any tab wit ha URL starting with chrome://

Thereafter, in every webpage viewed four different malicious scripts are inserted. The author uses the Google URL shortener to include the malicious JavaScript:

• http://goo.gl/9Ky9t => http://profonixcoder.com/yeni/pro.php
• http://goo.gl/gQhF6 => http://profonixcoder.com/yeni/twitter.php (down)
• http://goo.gl/t7snI => http://profonixcoder.com/yeni/youtube.php (down)
• http://goo.gl/jUEgY => http://profonixcoder.com/yeni/askfm.php (down)

Only the first script is available currently. It works on Facebook pages. It shares links using the user's account. By the name of the other files, we can assume they do something similar on YouTube, Twitter and Ask.fm

It looks like the author of this malicious extension doesn't have a high opinion of Google's security by using Google for hosting the extension and using their URL shortener to inject the malicious JavaScript.

Facebook Scam for Stalkers

If you are like me, you might feel bad about leaving your dog home alone all day while you are at work.  So to alleviate his boredom, I've let him sign up for his own Facebook.  Being new to the social media scene has already resulted in one tragedy. Well, my dog has done it again.  This time he was paranoid over whether his girlfriend from across the street was cheating on him.  So of course when he sees the new FBStalker26.com, he must try it.

On Version 26! So Advanced. So Legit.

Being a human, I know that this is obviously a phishing attempt trying to trick my dog into revealing his username and password to Facebook or worse.  Usually a Facebook scam's success is determined by the paranoia of who is looking at your profile or how many free iPads you can win.  Once you realize that, these phish attempts are almost elementary to recognize.

Always look at the address bar before entering your creds.

 The link from that photo will take you immediately to a new page where you are meant to log in again with your Facebook credentials.  A quick glance at the address bar will show you that you are not in Kansas anymore.  Don't do it!  Don't enter that information!

Oh no you did it...Now your username/password have been compromised, they still won't have an easy time into your account due to higher security policies from Facebook.  Unfortunately, my dog was gullible enough to enter in his security question and answer, only to be disappointed by a 404 error immediately after that entering his data.  Looks like he'll never know who is stalking him now, but don't worry...he won't have access to his own Facebook account for much longer.

Popular Media Sites Involved in Mass Compromise

Update (May 9): OSIRT had the opportunity to review the infected web app code for one of the compromised sites and has a great write-up to explain what was happening from a server-side vantage point.

Today, Zscaler identified yet another mass website compromise, this one impacting a number of popular media sites, including two radio stations in Washington, DC - Federal News Radio and WTOP. It's not clear if all of the sites impacted were leveraging a common backend platform that may have led to the compromise.

Sadly, mass compromises are now the norm. Attacks targeting end users generally involve some form of social engineering whereby the potential victim must be convinced to visit a site, download a file, etc. Attackers will therefore write a script designed to comb the web looking for popular sites exposing a common flaw and when identified, inject a single line of malicious code into the sites. In that way, any user visiting the otherwise legitimate (but now infected) site, can become a victim. This particular threat also displays another common trait - being dynamic in nature and only delivering content if the victim browser exhibits certain attributes. In this case, the injected content is only displayed when the browser's User Agent string reveals that Internet Explorer (IE) is being used.  When IE is used to view one of the infected pages, the following code is sent to the browser:

Ofuscated JavaScript injected into a webpage at WTOP.com

Deobfuscated version of the injected code

This obfuscated JavaScript decodes to reveal an iFrame pointing to sites hosted at Dynamic DNS (DynDNS) hosting providers. Thus far, we have identified two DynDNS providers (myftp.biz and hopto.org) involved and the actual URLs (which are numerous), conform to the following pattern:

   \/[a-z0-9]{14,15}\/[a-z0-9]{32}\/

Example URL

Once redirected to the malicious URLs, Fake AntiVirus scams and the ZeroAccess Trojan are delivered to the victim. MD5s for malware delivered include the following:

2e1997982c4dde48a995df5061f1438f
2b150bd07bb74426d676d8cb47451fd0
62547040ac637b63c2d531e17438597a
8858050e303cca778e5083ed4e442763
eee9941e4d01b65061f4fb621b2d708d
b43c1d19d35e3606a7b6227cef561986

Thus far, Zscaler has identified the following compromised sites:

Media Sites

WTOP Radio (Washington, DC) - wtop.com
Federal News Radio (Washington, DC) - federalnewsradio.com
The Christian Post - christianpost.com
Real Clear Science - realclearscience.com
Real Clear Policy - realclearpolicy.com

Others

scubaboard.com
mrsec.com
menupix.com
xaxor.com
gvovideo.com

At the time of posting, these compromised sites were still offering up malicious content.