Zscaler releases Android Master Key vulnerability scanner

The recently disclosed Android master key vulnerability by CTO of BlueBox Jeff Forristal, allows an attacker to inject malicious code into an Android application without the need to alter or invalidate the application’s digital signature. This impacts almost all current Android implementations and to make matters worse, patches cannot be issued directly by Google, but require individual handset manufacturers to provide patches for their unique Android implementation. To date, some have provided patches, while others haven’t.

This vulnerability allows an attacker to inject malicious code by placing duplicate executable files – such as classes.dex – into an application package. The package verification that occurs during installation is done against only the original, legitimate file and thus the .apk passes the verification. However, at runtime, the duplicate .dex file will also be executed. The attacker’s malicious code in the second classes.dex may for example, have a routine for leaking personal information such as email addresses or IMEI numbers. It could also send SMS or make calls without user consent. A second AndroidManifest.xml file supporting the second classes.dex, replaces the legitimate .xml file, so that additional permission declarations are injected along with necessary permissions needed by the malicious classes.dex file. 

Open source tools are already available which allow for code to be injected into an .apk file and modify the Android manifest file to take advantage of this vulnerability. One such tool is available here -  https://gist.github.com/poliva/36b0795ab79ad6f14fd8. 

While a user may notice the excessive permissions that are required by the second android manifest file at the time of installation, it’s quite likely that this attack will go completely undetected. As apps have already been spotted in the wild exploiting this vulnerability, Zscaler has developed a simple web application designed to scan any .apk to identify those apps that are exploiting the Android Master Key vulnerability. Our web app works by checking the integrity of the .apk file. Specifically, it dissects the .apk file to look for the presence of additional, malicious classes.dex files or any extra Android manifest files. You simply need to upload any .apk to the scanner in order to obtain a report indicating if the Android app is taking advantage of this vulnerability. 

The scanner is freely available and can be found at http://zulu.zscaler.com/research/scanner.html 

Scan your apps and be safe.

Malware using GoogleCode for distribution

Malware hosting sites rarely stay up for too long.  After the first few instances are seen by security vendors, they are added to blacklists which, in turn, are fed into other blacklists throughout the industry.  Malware writers are now turning to commercial file hosting sites to peddle their warez.  If these legitimate file hosts are not scanning the content they are hosting, it may force network administrators to block the service altogether.  The kicker is that this time we see that GoogleCode seems to have swallowed the bad pill.

The first file in question is hosted at: hxxps://code.google.com/p/onflashplayers/source/browse/AdobeFlashPlayer.exe

You may also recognize it by a few other names as seen here(21/45):
https://www.virustotal.com/en/file/12ba2c059963799fda3b48bce3d51f06940c7cdcb7b20559c752acdee2d43594/analysis/1375130106/

We also have reports of this file being downloaded via Dropbox, but it appears to have been taken down at the time of research

This incident sets a precedent that no file hosting service is beyond reproach.  Blind trust of specific domains should not be tolerated from an organizational or personal perspective.  So set those security privileges to kill and keep one eye open for shady files coming from even a seemingly trusted location.

Other files from this location that were also flagged as malicious as noted below:
fc79708c4b5a7ac7ffc666c65af3d402 - 9/46
4372fa69e33307b8998447e3a79ed13a - 7/46
d9040e39cc4b9e2ce19dcb2fa26e2d36 - 17/46
93650214ef3c5e0f7fc657150fe4f670 - 13/46
9a85728e541c1dd34ec8ecca02f3ba92 - 6/46
f7dd919004cb65f89ae87f0360222f05 - 17/46
79bfcaf15acbb4f6e00df9f5e9e97078 - 4/45
6f197c2542933bb1a94916312f2075f7 - 5/45
a6a054ff40e24fe1e67230a4dec282cd - 21/46
9e49f709cd6df526cb261969a1239ef1 - 16/46
7d7b1329d25731c779fcd3ba41003cea - 9/46
86680f427e4c139f4112f506d8b2a770 - 21/46
3fd508edba21cb1c9f69e316828d8847 - 16/45
a1a66e2aadb4b4e231513f9e49166c72 - 16/46
3f8cd82f528fd7bd7635639583e4da09 - 22/46
5abbdd8b0f60e4ad80cd328d80fde7b9 - 12/46
3b1d052884949231f8a8ab927dffc0de - 5/46
e553a555c20a6a9caab15471fc147a4c - 8/46
38f148e53f44394911c6d876c6288407 - 5/46
3715ff5da288cfbb548b424722b664d6 - 6/46
04c3adff92b188dcfc0b944a457f3d74 - 5/46
4372fa69e33307b8998447e3a79ed13a - 7/46
fa694888e878efc6afb4e4781b007154 - 5/45
d256a34f4d9be8a74033c7bede40b2aa - 16/46
a842fcda221aaddd2fa21f77abaf91ce - 8/46
b4ee1ea0494f0800635e8d8398bc7779 - 22/46
7548f78f7e626403dd503421d1e6e42d - 6/46
d276561d27e2a343e2ace1fbbf9474e3 -  5/46
f951cfcfe8f293c2fa551297222fb37a - 13/46
9da48c984b71e26887b3c58f7a5c5d05 - 5/46
8fcb14b676fa0ecacbee92b702ce59b4 - 16/46
09e82c7811d1e155e6825a4aa98455bb - 8/46
3c76a70ffb42a9c2071b05bb0a430b5e - 5/46

Phishing for Ad Scams

Today we have a perfect storm of basic attack vectors which inevitably lead victims to a variety of advertising scams including adware executables, parked domains, pay-per-click scams or phishing sites.  First a small list of all of the websites seen to be hosting this threat.

• 1yahoo.com/
• testflightapps.com/
• www.find-your-date.org/
• www.conmdirect.de/
• www.chanuteinsurancepool.net/
• translateitonline.com/
• compartel.gov.cofacebook.com/
• www.autobypass.com/
• rerbox.com/
• ravelrey.com/
• www.corall.com/
• accountservices.wiipro.com/
• losangeles.craigslst.org/
• www.styel.com/
• spritnpcs.com/
• www.nbarumors.com/
• www.eetime.com/
• bleacherrepot.com/
• www.elmundoe.es/
• iflswa.com/
• debshop.com/
• www.cnnis.com/
• myfintesspal.com/
• televisaeportes.com/
• www.testflightapps.com/
• wwwbunte.de/
• hiffingtonpost.com/
• bhestbuy.com/
• www.dbm.de/
• noobroom6.com/
• scripts.codingclick.com/
• eaterny.com/
• www.thatlantic.com/
• usnwwc.com/
• texasrangersmlb.com/
• idlebrian.com/
• laspass.com/
• spliwise.com/
• www.iflswa.com/
• www.usbankhomemortagage.com/
• www.linkdein.com/
• mdrudgereport.com/
• theeverywhereist.com/
• www.hiffingtonpost.com/
• redditt.com/
• www.saukaryam.com/
• malaimalar.com/
• www.bradypeople.com/
• bmohariss.com/

The thing that all of these websites have in common is that they all take advantage of cybersquatting, by registering slight variations of popular domain names. This common phishing technique is used to bring a false sense of certainty that the victim is on the intended website. These websites were pulled together from a list of referral URLs, which matched a common pattern for dubious redirection found in Javascript files.  Once the user visits the site, they are presented with a Javascript redirect via an iFrame, similar to the following:

This immediately takes you to a seemingly random series of advertising scams. One of the scams presents a "Click Here To Enter"link.

NO DON'T!

The above picture is the only visible addition to this page.  After clicking on the link, the victim is immediately sent to a page that leads them to suspect their Browser/Flash version is not up to date.

These cases both resolve to one of two adware binaries being installed on the customer's system.

https://www.virustotal.com/en/file/a157438070a712bbd3c26ff9de26eb8013af7b18d63d6d707553e45e3369c2f2/analysis/1374266431/
https://www.virustotal.com/en/file/56eebb8067af1febd1ecb35b4ece27fab83200ba6d4e1815749decdcdad9eb1b/analysis/1374266466/

In other cases, the victim is only redirected to a pay-per-click scam that promises "Free Vouchers" and free Apple products, but fails to deliver. 

Revisiting one such domain in the list will only lead the victim back to a parked domain page. This is done to discourage researchers from dissecting their threat to avoid meaningful detection from security vendors.  The best idea to avoid misdirection from such phishing attempts would be to tighten up your browser security.

FlimKit coughs up more Malvertising

FlimKit is a known exploit kit which takes advantage of Java Vulnerabilities in order to drop malicious content on the victim's PC.  Previous iterations of this Exploit Kit were known to be distributed through at least 1 popunder service.  The EK itself is fairly straight forward.  Like so many other kits, it begins with a malicious flash based redirect from a malvertising ad.  From there it will exploit known Java vulnerabilities to drop JAR file which in turns will give you a malicious executable.  In most cases, this will be some variation of ZBOT.

The following domains were seen as newly added to the FlimKit drop:

• 9euei.info
• kvmhja.info
• sdjeu7.info
• adiwep.info
• d0e9ue.info
• idueya.info
• sdioep.info
• sieod.info

Previous iterations of this exploit were also sent as part of known ad services.  This instance is no different other than they have obviously branched out to other services to spread their malvertising message.  Through my research I found that the following ad services were known to send user's to the malicious Exploit Kit which exploits CVE-2013-2423:

• yieldmanager.net
• smxchange.com
• glispa.com

As far as the actual exploit is concerned, there is solid example seen here.

Tracking a botnet infection

Recently we found several malicious executables with similar characteristics. These files were found on the following six domains:

• janashfordplumbing.com
• kalliskallis.com
• lowes-pianos-and-organs.com
• continental1.com
• foreigntire.com
• gjhimages.com

The URLs used, adhered to the following two formats:

• http://www.[domain].com/awstats6_data/[a-f0-9]{10}/?f=sm_main.mp3&k=[0-9]{15}
• http://www.[domain].com/images/[folder]/[folder]/[a-f0-9]{10}/?f=sm_main.mp3&k=[0-9]{15}

These six domains are otherwise legitimate sites that have been compromised and used to serve malicious content. While I didn't determine the vulnerability used to obtain  control of these websites, all of them were misconfigured, allowing directory listings (viewing all files available in folders) and/or having AWSTATS publicly available.

The malicious files kept changing, with different signatures. Their behavior, however, was always the same and was identified as a botnet. When executed, the botnet hides itself in the Recycle bin and infects other running processes. It connects to over 50 IP addresses over UDP/16471 and TCP/16471. These IPs keep changing with each file and each execution.

The botnet always connects to xlotxdxtorwfmvuzfuvtspel.com through HTTP, but the domain answers with an empty response. You'll notice that the malware uses HTTP/1.0 with a Host header (not RFC compliant), often a good sign of malicious HTTP activity.

HTTP request to C&C

We found the malicious samples through Behavior Analysis, then used our log correlation to find the source of the malicious executables.

openxadvertising.com Mass Malvertising Campaign

-->

On Monday, Government Security News (GSN), reported that their website had been compromised during a mass infection. While in the case of the GSN infection, the injected content was delivered from googlecodehosting.com, we have determined that the same content was also delivered from googlecodehosting.org and googlecodehosting.net, all of which resolve to 89.45.14.87 and are now offline.

In reviewing our logs for sites with the aforementioned referrers, indicating that they too were/are compromised, we have thus far identified 65 different sites (see list below), with the earliest referrers appearing on Thursday June 13 at 6:32:28 2013 GMT. Referers for the GSN site appeared as early as Jun 14th, suggesting that the site was likely compromised for a couple of days before they became aware of the situation and took steps to clean the site.

The attack leveraged the following chain of events:

1.     Malvertising – The injected code appears to have occurred in malicious advertisements used by the impacted sites, as opposed to the sites themselves. The malicious advertisements were delivered from openxadvertising.com, which is currently blocked by Google SafeBrowsing.

2.     Redirect – The content hosted at the googlecodehosting pages (now offline) has been archived on Pastebin.  As can be seen, the actual malware is being pulled from compromised WordPress sites.

3.     Infection – A malicious .jar file is delivered. At least two separate Java vulnerabilities have been observed in the attacks (CVE-2013-1493 and CVE-2013-2423), which are used to install the ZeroAccess Trojan.

The following infected domains have been identified in this attack from reviewing referer headers referencing googlecodehosting.com/net/org:

·      2475-lsxtv.voxcdn.com

·      ads.rahesabz.net

·      ads.thehiveworks.com

·      delaware.newszap.com

·      disabilitynow.org.uk

·      dj1067fm.com

·      greenhomeguide.com

·      insanescouter.org

·      lamega.com

·      marinefuel.com

·      mess.troutcave.net

·      omahanightlife.com

·      openx.multimediajamaica.com

·      pacificweddings.com

·      supernormalstep.com

·      test.theeagle.com

·      traveloregon.com

·      truthdig.com

·      vmblog.com

·      www.adrants.com

·      www.artshound.com

·      www.beginnertriathlete.com

·      www.birmingham365.org

·      www.brambletonian.net

·      www.charlestongolfguide.com

·      www.clashmusic.com

·      www.cobizmag.com

·      www.controleng.com

·      www.dragzine.com

·      www.ediblemanhattan.com

·      www.empirepage.com

·      www.environmentalleader.com

·      www.first30days.com

·      www.girlswithslingshots.com

·      www.guideposts.org

·      www.hospitalmedicine.org

·      www.hot-dinners.com

·      www.jeepsunlimited.com

·      www.jewishjournal.com

·      www.knittinghelp.com

·      www.lakestclair.net

·      www.lethbridgeherald.com

·      www.lsxtv.com

·      www.menuclub.com

·      www.nowplayingaustin.com

·      www.onedirt.com

·      www.phillyfunguide.com

·      www.popco.net

·      www.pro-touring.com

·      www.questionablecontent.net

·      www.radiohitz92fm.com

·      www.rtbookreviews.com

·      www.sayfiereview.com

·      www.sermonspice.com

·      www.spearfishingplanet.com

·      www.sportscollectorsdaily.com

·      www.stangtv.com

·      www.success.com

·      www.talentzoo.com

·      www.thejc.com

·      www.ventura-usa.com

·      www.wannabebig.com

·      www.whichbudget.com

·      www.workerscompensation.com

·      www.worthgoing.com

For those wishing to implement IDS based signatures to prevent the attacks, the following unique strings have been identified in URL paths seen to be delivering the malicious .jar files:

"/.cache/?f=site.jar&k=" OR

"/.cache/?f=atom.jar&k="

followed by:

"&h="

This attack is very similar to one that we blogged about in May. That attack was also a mass infection, which impacted media sites and also leveraged the ZeroAccess Trojan. As a courtesy, communication has been sent to the webmasters of all impacted domains informing them of the potential infection.

- michael

Phishers target Yahoo users

Yahoo Mail introduced two-factor authentication in December 2011. Two-factor authentication can be used to prevent suspicious access to an account (login from a different country, numerous failed login attempts, etc.) and can be used to verify a user's identity when asking for a password reset.

Two-factor authentication has been in the news a fair bit lately as LinkedIn and Twitter have recently begun to offer the feature. We encountered an example whereby a phisher actually took advantage of heightened awareness of two-factor authentication to aid in an attack. The scam involved spoofed e-mails, which claim that all Yahoo users must turn on two-factor authentication:

Phishing e-mail to Yahoo Mail users

The e-mail has a spoofed FROM address (@yahoo.com) and a fake link to http://update.yahoo.com/. The user clicking on this link is actually redirected to a phishing page at http://www.antek.com/pics/tiles/yahoo.com.html as shown below:

Yahoo phishing page

At present, this URL is blocked by Google Safe Browsing (Firefox, Chrome, Safari) but not by Internet Explorer.

Yahoo is now shutting down their Yahoo Mail classic interface and forcing users to their new e-mail platform. This will no doubt be another great opportunity for phisher to take advantage of confused users.