Chris Mosby at myITforum.com

Apple (QuickTime exploit) with a twist

Four days after news of the recent Apple QuickTime vulnerability began to spread, a new proof-of-concept exploit, with a twist, has been published. While the shell code in the previous exploit was contained within a malicious RTSP data stream, this time the shell code is sent via JavaScript, separate from the stream.

Let’s break down how this might play out. A client requests a Web page from a malicious site. The page that is sent contains malicious shell code and a request for a QuickTime movie. If the client is using Internet Explorer, the shell code is written to a heap area for later use. Meanwhile, the browser receives the QuickTime movie and then opens it with QuickTime, creating an RTSP stream to the malicious server. Only the RTSP server in this scenario is hosting a hacked version, which actually sends back a stream that overwrites the stack in the client’s QuickTime install. The end of the buffer overflow then calls the shell code that was previously written to the heap, and voila!, the malicious code is executed.

This method of exploiting the vulnerability has its advantages and disadvantages. On the plus side, the server hosting the exploit must have a hacked RTSP server for this to work, since standard RTSP servers will not operate in this way. On the downside, this new exploit makes it much easier for attackers to use their own shell code in an attack using this vulnerability.

The good news is that this exploit is easily enough avoided by taking a few precautionary measures. Symantec antivirus products with the latest definitions will detect this threat as Trojan.Quimkids. We also recommend the following options if you’d like to further protect yourself from such attacks:

Prohibit the RSTP protocol on your networks
Unless there is a need for using this protocol, it is best to avoid it for the time being.

Disable QuickTime browser objects
If QuickTime ActiveX controls in Internet Explorer and plug-ins in Firefox are disabled, the exploit will not work.

Disable JavaScript where possible
If the script cannot execute, it cannot write shell code to the heap.

Avoid untrusted QuickTime files
If you’re unsure of the source of a QuickTime file, do not execute it.

Domo arigato to Kazumasa Itabashi for his work in analyzing this new exploit.

Posted by Ben Nahorney on November 28, 2007 08:11 AM

Source: Symantec Security Response Weblog: Apple (QuickTime exploit) with a twist

Exploit Haunts WinRAR

November 28th, 2007 by JM Hipolito

SANS Internet Storm Center reports that an exploit code that takes advantage of a buffer flow vulnerability in WinRAR archiving software is making rounds in the wild. The said exploit code affects WinRAR versions 3.50 and earlier.

Further analysis by TrendLabs researchers reveal that the said exploit (detected as TROJ_RDROPPER.A) arrives as a malicious .RAR file. Once the said file successfully exploits the WinRAR flaw, it proceeds to drop the file %User Temp%WINRAR.EXE, which is detected by Trend Micro as BKDR_DARKMOON.AH. The dropped backdoor, in turn, opens a random port and allows remote code execution by a malicious user.

This is not the first time a bug was discovered in earlier versions of WinRAR. As early as 2005, Threat Researchers Jonell Baltazar and Joey Costoya were able to procure of an exploit code that also takes advantage of a buffer overflow vulnerability. At that time, however, they concluded that the said exploit could not be used for malicious purposes.

Trend Micro strongly recommends WinRAR users that they upgrade to the latest version of the program (3.61) to avoid possible infection. Users of Trend Micro products are also advised to update their patterns.

Source: Exploit Haunts WinRAR - TrendLabs | Malware Blog - by Trend Micro

Wednesday, November 28, 2007

More on the massive SEO poisoning -- it was targeted at Google. And it was more crafty than we thought.

As a follow-up to our recent posts, here’s some additional information.
First, we can ring the all-clear bell. Google took action on these domains and you won’t find them anymore in Google.
However, check out this javascript:
(source: cxsjrkelgvjs(dot)cn/gopnikovnet(dot)js << malware site)

So. if you use search terms like “inurl” and “site”, you won’t see these malware pages in your results. Clever, since that’s one way for malware researchers to find stuff (I recently wrote an article on this subject for VirusBulletin). And, it only cares if you’re coming from Google.
Quite interesting.
Alex Eckelberry
(Thanks to Sunbelt researchers Adam Thomas and Francesco Benedini)

Source: SunbeltBLOG: More on the massive SEO poisoning -- it was targeted at Google. And it was more crafty than we thought.

Pharming Pharmaceuticals

Earlier today there was a report about Al Gore's site, climatecrisis.net, being hacked. The site contained links that weren't visible to the visitors, which pointed to various pharmaceutical products. The links could be viewed by looking into the source code of the page being displayed. The fact that Al Gore's site got hacked or compromised, while definitely of significance, uncovers a much bigger technique now being used by spammers. Here is a snapshot of the links from the hacked climatecrisis.net site:

(Click for larger image)

As you can see, there are loads of links to a university's server. None of the links work. However, the hackers were able to get to the top of search results by creating links such as these. No one visiting the hacked site would have noticed these links or been affected by any malicious program - not as of yet anyway.

Here is a picture showing the results of a search for "discount zovirax c.o.d." What you'll see is that most of the results show up as being served from some university or other legitimate business site not affiliated with such pharmaceutical products:

(Click for larger image)

How did this happen? Well, the comment spammers added tons of comments into various forums using custom search terms. These comments all lead to either a link within one of the forums or another site. The number of links from these forums pointing to one entry or page raised its position in the search engine's results:

(Click for larger image)

Following that link from the forum leads one to the following page:

(Click for larger image)

As you can see, the spammers were able to get a hacked university page to the top of the search engine results. Following that link leads you to the eventual pharmaceutical Web site being marketed here:

(Click for larger image)

The spammers and hackers took over legitimate blogs, mostly running some vulnerable version of WordPress Web publishing software. Once they were able to inject their code into these pages the search engines looking at this source were able to pick them up and place them high enough for visibility. In some cases, it seems like the server hosting the vulnerable versions of WordPress was completely compromised. Here is a snapshot of one of the search results:

(Click for larger image)

Clicking on the link using the search engine takes us to 'http://www(dot)canadacertified(dot)com'. However, if you copy and paste the URL shown in the search engine, you'll not be referred to the pharmaceutical site and are instead shown a "404 Page Not Found."

We've seen the spammers go from comment spamming to hacking WordPress, to injecting links, to getting top listing on the search engine results, to finally marketing pharmaceutical sites through a large network of interwoven links. So far, the only visible damage caused is for the administrators of the servers with the hacked Word Press. This could have been much worse had the hackers decided to insert links to malicious programs. Fortunately, the ka-ching! of cash trumps notoriety.

Posted by Vikram Thakur on November 27, 2007 03:37 PM

Source: Symantec Security Response Weblog: Pharming Pharmaceuticals

Tuesday, November 27, 2007

Malware redirects: The aftermath

Hi all, Adam Thomas here from the Malware Research Team. I just wanted to post a follow up to our blog post yesterday regarding malware redirects from search engine results.

Sunbelt Software has uncovered tens of thousands of individual pages that have been meticulously created with the goal of obtaining high search engine ranking. Just about any search term you can think of can be found in these pages.

For example, the image below shows one page that focuses heavily on searches including the word “infinity”.

This example shows hundreds of search terms for “hospice”. Pretty sick.

For months now, our Research Team has monitored a network of bots whose sole purpose is to post spam links and relevant keywords into online forms (typically comment forms and bulletin board forums). This network, combined with thousands of pages such as the two seen above, have given the attackers very good (if not top) search engine position for various search terms.

In our previous post, we mentioned that the malicious pages also contained an IFRAME link which would attempt to exploit vulnerable systems. If you were unlucky enough to run across one of these links while surfing with a vulnerable system, you would become infected with a family of malware that we call Scam.Iwin. With Scam.Iwin, the victim's computer is used to generate income for the attacker in a pay-per-click affiliate program by transmitting false clicks to the attacker's URLs without the user's knowledge. The infected Scam.Iwin files are not ordinarily visible to the user. The files are executed and run silently in the background when the user starts the computer and/or connects to the internet.

Scam.Iwin is also used to load malware for other groups. In this case, one of those malware groups is known to have been associated with the infamous RBN (Russia Business Network).

Links loaded by Scam.Iwin:

So far we have observed the following malware being installed:

Trojan.Crypt.XPACK.Gen
Trojan-Downloader.Small.AAGX
Trojan-Downloader.Win32.Agent.ev
Trojan-Downloader.Win32.Agent.bnm
Trojan-Downloader.Win32.Agent.eus
Trojan-Downloader.Gen
Trojan-Downloader.Win32.Obfuscated.n
Trojan-Downloader.Win32.Small.ddx
Trojan-Downloader.Win32.Small.cib
Trojan-Proxy.Win32.Xorpix.Fam
Trojan.DNSChanger.Gen
Trojan.Win32.Patched.q
Trojan.Rawlam.C
Trojan.FakeAlert
Trojan.SpamThru (Spam-Bot)
Trojan.Netview (Information Stealer)
Trojan-Downloader.Win32.BHO.bt
Trojan.Win32.Pakes.bqt
Scam.Iwin
Dialer.Win32.GBDialer.i (v)
Backdoor.Rustock (spam-bot)
Trojan.Srizbi
Trojan-PWS.Win32.Bzub.gen (Information stealer)
Backdoor.Win32.Small.lu (Information Stealer)
Awola (Rogue Security Program)
Ultimate SecuritySuite (Rogue Security Program)

If your system was not vulnerable (i.e. your system is fully up-to-date with the latest patches), and you were duped into installing the “ActiveX Upgrade”, then you might simply be left with a toolbar installed into Internet Explorer as well as some pesky pop-up advertising for Rogue Security Software.

Of course, the team over at Google has been notified of this. Other search engine companies are welcome to contact us for more information.

Oh, what a tangled web we do weave . . .

Adam

Source: SunbeltBLOG: Malware redirects: The aftermath

Fake YouTube URLs Downloading Suspicious Executable

Malicious code writers have always used popular Web brand names to spread malicious code through spam vectors and these days the YouTube brand name is popping up more and more. However, the spoofed URL in this latest scam redirects visitors to dynamic domain names with seemingly unusual top level domains (TLDs), such as .li, .ch, and .es. Last month, spammers used the YouTube brand name in an attempt to spread spam regarding male enhancement pills and get-rich-quick schemes.

The email looks harmless enough, because the “From” header is spoofed to appear as if it's coming from "YouTube Service" , which helps it to look like a legitimate invitation. The video's description is enticing and seems innocuous, inviting potential victims to open a shared video file, which is a fake YouTube link. Here is a sample of one of these scam emails:

From: "YouTube Service" service@youtube.com
To: [REMOVED]
Bcc: [REMOVED]
Subject: Your friend sent you a video!
Date: Thu, 15 Nov 2007 08:58:31 +1000

Note: The domains that are used to impersonate the YouTube Web site are giower.li, fineir.ch, and be4koy.com.es. These TLDs are not the usual .com or .net domains. The links will force the download of a malicious executable “install_flash_player.exe,” which in fact is a threat already detected by Symantec.

There were a number of spoofed URLs included in the spam emails during the campaign. Fortunately the Web sites associated with the URLs have since been taken down. Below are a few examples of the spoofed URLs:

(Click for larger image)

Posted by Jitender Sarda on November 28, 2007 05:00 AM

Source: Symantec Security Response Weblog: Fake YouTube URLs Downloading Suspicious Executable

I have been hearing a lot about this yesterday and today, sounds like it is getting ugly…

 

Google Search Campaign

Published: 2007-11-28,
Last Updated: 2007-11-28 15:07:23 UTC
by Mari Kirby Nichols (Version: 1)

Computerworld is reporting a "large scale, coordinated campaign to steer users toward malware-spewing Websites from Google search results is under way."  

• They are quoting approximately 40,000 pages may be hosting malware. 
• 27  different domains are involved.
• Each with up to 1499 malicious pages.
• Tactics Used per Sunbelt:
  • "comment spam" - bots hide in comment sections with links
  • "blog spam" -bogus blog posts
  • plug links into any web form requesting a link

Please let us know if you are seeing this activity via our contact page.

Thanks, Mari Nichols

Source: SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

Lotus Notes buffer overflow in the Lotus WorkSheet file processor

Published: 2007-11-27,
Last Updated: 2007-11-27 19:19:47 UTC
by Joel Esler (Version: 2)

Core Security has put out a new advisory concerning a buffer overflow in Lotus Notes. Both remotely and locally exploitable.

Core lists the vulnerable software pieces as:

- Lotus Notes version 7.x
- Lotus Notes version 8.x (not confirmed by Core)
- Lotus Notes version 6.5.6 (not confirmed by Core)
- Other software packages using Verity KeyView SDK using vulnerable
versions of l123sr.dll

Although it's prudent to keep in mind that as of now 8.x and 6.5.6 are NOT confirmed by Core (as in their advisory, and the cut and paste above).

Cut and Paste from Core's Advisory:

Lotus Notes customers should follow the instructions of the following
support Technote, which outlines the available options based on specific
versions of Lotus Notes:

http://www.ibm.com/support/docview.wss?rs=475&uid=swg21285600

Workaround 1: Delete the keyview.ini file in the Notes program directory.
This disables ALL viewers. When a user clicks View (for any file), a
dialog box will display with the message "Unable to locate the viewer
configuration file.".

Workaround 2: Delete the problem file l123sr.dll file. When a user tries
to view the specific file type, a dialog box will display with the message
"The viewer display window could not be initialized." All other file types
work without returning the error message.

Workaround 3: Comment out specific lines in keyview.ini for any references
to the problem file (l123sr.dll). To comment a line, you precede it with a
semi-colon (;). When a user tries to view the specific file type, a dialog
box will display with the message "The viewer display window could not be
initialized". For example:
[KVWKBVE]
;81.2.0.5.0=l123sr.dll
;81.2.0.9.0=l123sr.dll

Workaround 4:  Filter inbound emails with attachments with potentially
malicious files.  Lotus 1-2-3 files are usually associated to MIME
Content-Type headers set to the following strings:
application/lotus-1-2-3
application/lotus123
application/x-lotus123
application/wks
application/x-wks
application/vnd.lotus-1-2-3
Note however that workaround #4 is a simply stop gap measure that could be
circumvented by relatively unsophisticated attackers.

 

Joel Esler

http://www.joelesler.net

0 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=3696'; digg_title = 'Lotus Notes buffer overflow in the Lotus WorkSheet file processor'; digg_skin='compact'; digg_topic = 'security';

0 comment(s)

Source: SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

Cries of Joy ring out throughout the land!! 

IE Automatic Component Activation (Changes to IE ActiveX Update)

Back in April 2006, we made a change to how Internet Explorer handled embedded controls used on some webpages. Some sites required users to “click to activate” before they could interact with the control. Microsoft has now licensed the technologies from Eolas, removing  the “click to activate” requirement in Internet Explorer. Because of this, we're removing the “click to activate” behavior from Internet Explorer!

It’s important (and cool) to note that this change will require no modifications to existing webpages, and no new actions for developers creating new pages. We are simply reverting to the old behavior. Once Internet Explorer is updated, all pages that currently require “click to activate” will no longer require the control to be activated. They’ll just work.  

	Before April 2006	After April 2006 IE Active X update	After April 2008 Removal
Controls Injected Via JavaScript	No “Click to Activate”	No “Click To Activate”	No “Click To Activate”
Controls loaded Direct In HTML (<object>, <embed>, <applet>)	No “Click to Activate”	“Click To Activate” Required	No “Click To Activate”

So you’re probably wondering when we are going to release this update? The first chance will be with an optional preview release, called the Internet Explorer Automatic Component Activation Preview, available in December 2007 via the Microsoft Download Center. Additionally this change will be made part of the next pre-release versions of Windows Vista SP1 and Windows XP SP3. After giving people enough time to prepare for this change, we’ll roll this behavior into the IE Cumulative Update in April 2008, and all customers who install the update will get the change.

If you have a custom application using WebOC or MSHTML, there may be some changes that affect your application. For example:

• If your application uses the DOCHOSTUI flag to opt-in to the current “Click To Activate” behavior, that behavior will continue to be respected and your application will require “Click To Activate”
• If you application uses the registry key FEATURE_ENABLE_ACTIVEX_INACTIVATE_MODE to opt-in to the current “Click To Activate” behavior, this registry key will no long be respected. If you wish to continue to use the “Click to Activate” behavior, please use the DOCHOSTUI flag.

In the coming weeks, we'll be updating the MSDN article with descriptions of the new behavior. Keep an eye out here for when the preview goes live. 

Thanks,

PEte LePage
Senior Product Manager

Source: IEBlog : IE Automatic Component Activation (Changes to IE ActiveX Update)

Time to update your Firefoxes! (Firefox 2.0.0.10)

Published: 2007-11-27,
Last Updated: 2007-11-27 15:48:34 UTC
by Joel Esler (Version: 1)

There's a new update for Firefox out.  2.0.0.10.

Copy and Paste from Mozilla.org on the updated security features:

MFSA 2007-39 Referer-spoofing via window.location race condition
MFSA 2007-38 Memory corruption vulnerabilities (rv:1.8.1.10)
MFSA 2007-37 jar: URI scheme XSS hazard

Source: SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

Hacker targets Mac fan blogs

Tuesday November 27, 2007 at 6:16 am CST
Posted by Harish Garg

Trackback

A self-proclaimed Mac user is targeting Mac fan blogs. He has already defaced 2 famous Mac related blogs.

http://www.applematters.com/

http://iphonematters.com/

In his own words ” I’M A MAC USER. I JUST HAVE A STRONG DISTASTE FOR MAC SYCOPHANTS.”

This is possibly the first time a hacker is targeting Mac related websites. This is interesting month for the Mac user base, with multiple Trojans/malware appearing along with a horde of security updates from Apple itself.

Things are definitely heating up in Mac Land!

Source: Computer Security Research - McAfee Avert Labs Blog

Malicious Advertisements

On November 2, 2007 I had the opportunity to participate in a panel at the Federal Trade Commission on the future of online behavioral advertising. While this topic is not one that is normally associated with information protection issues, there are some interesting implications that I touched upon at the panel and that I thought I’d reiterate here.

First, let’s think about some of the overall trends related to Web advertising. To begin with, the Web has certainly exploded in popularity and people are spending more and more time each day surfing their favorite sites.

Second, online advertising has proven itself to be a viable business model for many companies. Countless Web sites display ads that are viewed by an even greater number of people.

Third, along these same lines the online advertising supply chain is fairly complex. In the simplest incarnation, an advertiser might work with an ad network who will arrange to have the ad published through one or more content publishers. In a more complex, but still quite common incarnation, an ad network might work with a syndicator (and the syndicator might work with sub-syndicators).

Fourth, advertising itself has become very rich. While text-based advertisements are still popular, we are definitely seeing more fancy ads that use technologies like Flash. The reality is that an advertisement is more than just ad – it's a small piece of software that runs on your machine in the context of your Web browser.

And finally, browsers are becoming more complex. In addition to the core Web browser, people often enhance their Web experience through one or more plug-ins. For example, Flash is enabled on a Web browser through a plug-in.

This increase in prevalence combined with the increased complexity makes online advertising a ripe target for attackers. Since an advertisement is a piece of software, there is potential for that software to be malicious. One example that I blogged about previously involved a social networking site, a little over a year ago. One of the advertisements they served took advantage of a well known Windows vulnerability. Over a million people saw the advertisement. Although the vulnerability was known, and although a patch had been issued, it’s likely that many people who viewed the ad didn’t have their patches up to date. In these cases, companies are otherwise innocent bystanders since the advertisement content itself is being provided by the ad network.

Along the same lines, anything one can do in a scripting language like JavaScript can also be done in Flash. So, in principle, Flash-based advertisements can implement the kinds of attacks possible through malicious JavaScript. These include scanning internal network hosts and drive-by pharming.

\What makes attacks leveraging online advertising especially powerful is that it is entirely possible for an otherwise trustworthy, popular, and well-meaning site to host an advertisement containing malicious code. While there have thus far only been a few instances of malicious online ads, I expect it to be a growing trend.

The unfortunate moral here is that there are no real safe locations on the Internet. That shouldn’t stop you from surfing the Web but merely realizing that if you do so it’s important to be protected. Recognizing that these types of issues would come up, Symantec has built a number of excellent Web-browsing protections into our 2008 products, which were launched recently.

Posted by Zulfikar Ramzan on November 27, 2007 05:00 AM

Source: Symantec Security Response Weblog: Malicious Advertisements

ConfigMgr 2007: Microsoft Exchange Server 2003 MSIT Intermediate Configuration Pack for Configuration Manager 2007

Overview

The Microsoft Exchange Server 2003 MSIT Intermediate Configuration Pack is designed to be used for managing the configuration of Exchange 2003 servers. This configuration pack defines recommended configurations based on a substantial number of settings affecting the configuration of Exchange 2003 servers in the Microsoft IT environment. A partial list of the included configuration items and settings can be obtained by downloading the Microsoft Exchange Server 2003 MSIT Basic Configuration Pack; more extensive configuration items and settings can be obtained by downloading the Microsoft Exchange Server 2003 MSIT Comprehensive Configuration Pack. It is recommended that users begin by evaluating their configuration against the Basic configuration pack, and then progress to the Intermediate and Comprehensive configuration packs as desired configurations are verified.

Once imported into SCCM 2007, this configuration pack and its included configuration items can be targeted to collections of systems which are then audited for compliance with the recommended configurations. When settings are detected to be out of compliance, events will be generated and sent to the Configuration Manager server where the data is available for reporting. This enables early detection of potentially detrimental configuration changes and allows the administrator to correct the settings before they may cause downtime events.

Please note that the configuration items, settings, and values used by Microsoft IT and included in this configuration pack will not necessarily reflect the desired configuration for every possible Exchange Server 2003 environment. The administrator should verify that the rules being evaluated reflect the desired configuration for their specific environment. If desired, the administrator can also modify the configuration pack by changing the value(s) specified for given settings-based configuration items or by adding/removing configuration items from the model through the Desired Configuration Management user interface within the SCCM 2007 console. Where settings and values are represented by a Parent and Child configuration item pair, the Child configuration item will contain the editable rules and values that an administrator may choose to modify.

Feature Bullet Summary:
The Microsoft Exchange Server 2003 MSIT Basic Configuration Pack includes configuration items for the following:

• Exchange Core
• Bridgehead (BH)
• Front End (FE)
• Internet Mail Connector (IMC)
• Mailbox (MBX)
• Public Folder (PF)
• Windows Hotfixes (W2K3_Ent)

In some cases, the settings and values will be represented by a Parent and Child configuration item pair. Please note that the Child configuration item will contain the editable rules and values that an administrator may choose to modify to reflect the desired configuration for their specific environment.

To understand in detail what each configuration item will be evaluating please review the properties of that configuration item in the context of the server role being addressed.

To read more and to download the configuration pack visit http://www.microsoft.com/downloads/details.aspx?FamilyId=40D9D7C0-B2A0-4052-8615-533C3BD06A2B&displaylang=en.

J.C. Hornbeck

Source: SMS&MOM : ConfigMgr 2007: Microsoft Exchange Server 2003 MSIT Intermediate Configuration Pack for Configuration Manager 2007

New Vulnerability in QuickTime
Posted by Patrik @ 04:04 GMT |

---

Not very long ago we posted about fixed vulnerabilities in QuickTime. Now another vulnerability has been discovered, this time in the way QuickTime handles the RTSP Content-Type header. RTSP is a protocol used to stream media. Unfortunately there's public exploit code available and no patch yet from Apple.

The team over at US-CERT has posted some workarounds such as disabling the QuickTime ActiveX Controls, blocking RTSP. If you do the registry changes, make sure you revert them once you have installed the coming patch or else you won't be able to view any streaming QuickTime media.
Additional Notes: Symantec has some excellent analysis located here. They found that this exploit crashes the ActiveX Control in IE. Firefox on the other hand passes off the QuickTime request directly to QuickTime player. So Firefox users may therefore be more vulnerable, not because of the browser itself, but because Firefox will deliver the exploit directly to its most optimal platform.
Also, while this exploit allows remote code execution and is potentially quite severe, it's not yet being implemented in the wild. There is however a very good chance of that changing as QuickTime is one of a growing number of popular third-party applications targeted by the bad guys.

Source: New Vulnerability in QuickTime - F-Secure Weblog : News from the Lab

My Egyptian Vacation
Posted by Mikko @ 11:32 GMT |

---

No, we haven't visited Egypt. But we're seeing a malware distribution run using a unique lure.
First, you get an e-mail like this from "Anita":

The ZIP contains these files:

How nice, Anita has even included an image viewer for us so we can take a look at her photos.
However, if you run viewer_img.exe, you'll get just an empty Paintbrush window:

Of course, this is just a bluff. In the background it's dropping and executing a variant of the LdPinch data-stealing trojan.
Let's see. It loads up a Russian version of pbrush.exe. The images are named "egipet.jpg" — Egipet is the Russian spelling of Egypt. And LdPinch is Russian malware. So this attack is probably (we're guessing) coming from … Denmark!

Source: My Egyptian Vacation - F-Secure Weblog : News from the Lab

Pay Up, Or The Computer Gets It!

Monday November 26, 2007 at 12:02 pm CST
Posted by Seth Purdy

Trackback

Ok, having been doing this stuff for a while I’ve seen a fair amount of questionable practices. It takes something pretty unique to get my goat (antivirus researcher pun intended) at this point. That said, what I found Micro Bill Systems doing had my jaw hitting the desk.

Following up on a post to the Grok.org.uk [Full-Disclosure] mailing list, I did some research (and yes, it was legitimate reasearch!) into the billing method used by sexxxpassport.com. Micro Bill Systems (MBS) provides the billing used by the site, and the model is rather unconventional, to say the least.

Sexxxpassport offers a free three-day trial to their adult site. All that is required is download and execution of the “Authenticator” software. (Note: most images link to original resolution versions)

The full terms (all 11+ pages) are displayed below this when clicking the link (which consists of that entire underlined text block shown). However, the user is not required to actually view the terms at any point before proceeding. In combination with the fact that the most alarming sections of the Terms begin around page 5, it begs the question of how reasonable it is to assume the user will have fully absorbed and understood them.

Furthermore, by offering access to the services without requiring any billing information it seems very likely the content providers are banking (literally!) on people assuming they can just stop accessing the site before the trial ends, without needing to affirmatively cancel the service, and all will be well. However, that assumption is woefully incorrect.

After three days (in accordance with the Terms), it’s assumed the user wishes to subscribe, and they are charged for 90 days worth of access at “less than 45p per day” (so, somewhere around £40, or approximately $80). Then the popups start.

The frequency and persistence of the popups is actually outlined in the full Terms & Conditions. In fact, it is very explicit about what the MBS software is going to do, with the forcefullness of the billing display ramping up over a few weeks.

Possibly the most alarming item of the Terms & Conditions is in Section 12:

12.5 If You choose to ignore the payment reminders and do not pay the Membership Fee, You hereby understand and acknowledge that the prompt reminders may become more frequent and that You may lose the ability to use Your computer until You have submitted payment. The payment reminders will be active while your computer is online or offline.

Yes, you read that correctly. They are claiming the right to disrupt and potentially completely disable use of your computer as a means to compel payment. Depending on the current display resolution of the system the locked billing popup can indeed obscure things to the point of making it unusable. The popup window will automatically restore itself if resized or moved. It also carries the “always on top” attribute, so it will cover other desktop elements or application windows. Though the disruption is limited in duration it appears that the daily display count for the billing reminder is reset if the system is rebooted, and so could occur more than once per day.

There are also clauses in the Terms & Conditions where fees can pile up quickly.

Depending on how you interpret (a), I could see it adding £25 a day for each beyond the 7th that you have an outstanding bill. Not versed in accounting, I’m unclear precisely the circumstances where (b) and (c) are to be applied.

The closest analogy I’ve come up with: You’re offered a free trial of satellite radio for your car. Then, a week later, you go to leave for work one morning and find a boot on your car, immobilizing it until you pay up.

The most they should be able to do, in my view, is cut off access to their services and refer the individual to collections. What it appears they are doing is, in my humble opinion, a form of extortion based on the (usually correct) assumption that a person’s computer will be key to many other activities in their daily life. Also, possibly with inadvertent/passive blackmail as a bonus: someone not wanting other family members or a spouse to realize they’ve been surfing for pornography, or perhaps even more dire, someone to see it on a computer at their workplace, and becoming desperate to silence the persistent billing popups.

Faced with such a situation, it is probable that most “customers” would quickly pay to regain control of their systems and avoid possible embarrasment. I strongly suspect the powerful social engineering leverage created by this situation is not accidental.

Additional details are available at the Avert Labs Threat Library page for MicroBillSystems.

Source: Computer Security Research - McAfee Avert Labs Blog

Apple QuickTime 7.3 RTSP Response 0day

Published: 2007-11-26,
Last Updated: 2007-11-26 19:05:40 UTC
by Joel Esler (Version: 1)

Thank you all for writing in!!  We appreciate it, things have been a little crazy around the ISC today, so we haven't been able to throw some stuff up on the diary about the Quicktime bug.  (We've had to wake everyone up, they all ate turkey..tryptophan... it's not pretty, anyway...)

As outlined by Secunia, Apple's Quicktime 7.2 and 7.3 has a overwrite condition via incorrect rtsp parsing.  Check it out here. 

There are several things you can do until this gets patched (just remember to undo them after you patch!).

1) Block the RTSP protocol.  Ports are 554/tcp and 6970-6999/udp.

2) Set the Killbit for Quicktime CLSID's:

{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
{4063BE15-3B08-470D-A0D5-B37161CFFD69}

There are some other recommendations over at the US-CERT site.  But like I said, remember to undo them after the patch, or you will be wondering why things aren't working with your Quicktime streams. 

Please remember that Quicktime is a component of iTunes...

Joel Esler

http://www.joelesler.net

Source: SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

Gemini 2.0
Posted by Sean @ 13:41 GMT |

---

Host Based Intrusion Prevention Systems (HIPS) offer a very important complement to traditional antivirus software.
Behavioral blocking software nevertheless, does have its own problems, specifically "noise". Many harmless applications have the same behavioral patterns as malware. Trojan-downloaders connect to the Internet and download executable files onto their hosts in a similar way to an installer loading legitimate software.
So behavioral blocking software needs to be trained to know bad from good.

Our database releases of November 15th included Gemini Update 2007-11-15_09.
What's Gemini?
Our Gemini engine is a component used by System Control alias DeepGuard. That's our HIPS technology.
You've already received this update if you're using one of our products that includes DeepGuard.
The Research Lab team responsible for DeepGuard's development used what they've learned since its first release and have now re-trained the Gemini engine.
It's a fairly significant engine update that promises to result in more automatic malware detections with fewer interruptions from legitimate software. That is to say, less noise. It allows DeepGuard to do its job while asking fewer questions. It's been termed Gemini 2.0 in-house.
And while Gemini 1.0 was excellent, we think that Gemini 2.0 is even better.
One of our tests used all of the unique Orion detected malware samples collected during the month of October. (Orion is signature based.) From that set, we found that 51% received high scores from Gemini. Scores that will result in an automatic block should DeepGuard determine an attempt do something dangerous on the computer. (No traditional signature detections required.)
That's a 20% improvement over the old training that would have resulted in a prompt to "Allow" or "Deny". Our customers will no longer need to decide for a greater percentage of malicious files.
There should be fewer questions of legitimate applications as well. Tests show a marked improvement on the number of good applications that receive a low score.
And as there is an apparently never-ending stream of malware — research on Gemini's training also continues.
Kudos to our hard-working Antimalware Technologies team.

Source: Gemini 2.0 - F-Secure Weblog : News from the Lab

Zero-Day Exploit for Apple QuickTime Vulnerability

Proof of concept exploit code for a newly discovered vulnerability in Apple's QuickTime player has been made available to the public today. The vulnerability (Apple QuickTime RTSP Response Header Content-Length Remote Buffer Overflow Vulnerability) was first reported on November 23rd by Polish security researcher Krystian Kloskowski.

The publicly released exploit works successfully when tested with the latest stand-alone QuickTime player application version 7.3. It does not seem to execute any shellcode when tested with the QuickTime browser plugin even though the browser crashes due to the buffer overflow.

At the moment we believe the most likely attack scenarios to appear using this vulnerability could be:
1. Email based attacks.
2. Web browser based attacks.

In the email attack scenario the user receives a malicious email with an attachment containing a file with some extension associated by default to QuickTime Player (e.g. .mov, .qt, qtl., gsm, .3gp, etc). The attachment is not actually a media file, but instead it is an XML file which will force the player to open an RTSP connection on port 554 to the malicious server hosting the exploit. When the QuickTime Player contacts the remote server, it receives back the malformed RTSP response which triggers the buffer overflow and the execution of the attacker’s shellcode immediately. This attack requires users to double-click on the QuickTime multimedia attachment to run. It is worth bearing in mind that this attack may also work with other common media formats such as mpeg, .avi, and other MIME types that are associated with the QuickTime player.

In the Web browser attack scenario, the attack will most likely start with a hyperlinked URL sent to the user. When the user clicks on the URL, the browser loads a page that has a QuickTime streaming object embedded in it. The object initiates the RTSP connection to the malicious server on port 554 and exploit code is sent in response.

We have tested the exploit behavior of the current exploit against some of the common Web browsers. We have seen that with Internet Explorer 6/7 and Safari 3 Beta the attack is prevented.

The browser in this case loads the QuickTime Player as an internal plugin and when the overflow occurs, it triggers some standard buffer overflow protection that shut downs the affected processes before any damage can be done. Attackers may attempt to refine the exploit in the coming days in order to overcome this initial hiccup and work to create a reliable exploit that works on Internet Explorer.

Firefox users are more susceptible to this attack because Firefox farms off the request directly to the QuickTime Player as a separate process outside of its control. As a result, the current version of the exploit works perfectly against Firefox if users have chosen QuickTime as the default player for multimedia formats.

At this time there is no patch available to resolve this issue so to reduce the risk against this threat users are advised to restrict out bound connections on TCP 554 using their firewalls and to avoid following links to untrusted Web sites.

Posted by Elia Florio on November 25, 2007 10:45 AM

Source: Symantec Security Response Weblog: Zero-Day Exploit for Apple QuickTime Vulnerability

Trojan aboard LaoAirlines

November 23rd, 2007 by Irene Vicente

Users visiting the Laoairlines Web site (laoairlines.com) are up for a surprise without them knowing it. Sophos Australia (via iTnews) has reported that visiting the said site for online bookings or any other activities can lead to downloading a malware.

Upon further analysis by Trend Micro threat analyst Ryan Flores, the compromised site automatically redirects unsuspecting users to cs.{BLOCKED}ick.cn , which is known to host several malware, including the following:

• JS_AGENT.WLN
• JS_PSYME.ACK
• TROJ_DLOADER.BZQ

Fortunately for Trend Micro users, the said site is already blocked by the Web Reputation Service. The malicious files are also detected as early as 2006.

Now that the holiday season has officially kicked off in most countries, this incident should serve as a reminder that malicious authors are not only targeting online shoppers and online bankers (as is the usually the case during this time of the year). Travels - and therefore online bookings - are also bound to increase. With the rise of Web-based attacks, computer users should have all bases covered.

Source: Trojan aboard LaoAirlines - TrendLabs | Malware Blog - by Trend Micro

Need a passport or driving license? Find them on the web from €400

Monday November 26, 2007 at 8:24 am CST
Posted by Chris Barton

Trackback

The wonders of the underweb never cease to amaze me some days. Not because of the devious goings-on that go on but because some groups are so blatant about their devious goings-on.

Need a passport? You might have visited http://www.new-pasport.org. [Google cache]

Allow me to translate:

Passports of the European Union

» Lithuania - 2500 euros without an advance payment and 2000 euros on an advance payment in 50 %
» Latvia - 2500 euros without an advance payment and 2000 euros on an advance payment in 50 %
» The Great Britain - 3500 euros without an advance payment and 3000 euros on an advance payment in 50 %
» Germany - 3500 euros without an advance payment and 3000 euros on an advance payment in 50 %

Driving licenses too:

Driving license of the European Union:

» Lithuania - 600 euros on an advance payment in 50 % and 800 euros without an advance payment
» Latvia - 600 euros on an advance payment in 50 % and 800 euros without an advance payment
» The Great Britain - 600 euros on an advance payment in 50 % and 800 euros without an advance payment
» Germany - 600 euros on an advance payment in 50 % and 800 euros without an advance payment

The payment methodology is interesting too: It’s cheaper if you pay upfront. If you don’t trust the document dealer you can opt to pay a little more in 2 Western Union payments, withhold half the payment by withholding the code need to claim the second transfer until your fraudulent documents arrive.

This isn’t the first time we’ve seen this operation either, they have some history on a .biz version of the domain too.

Almost a year ago the BBC broadcast a Panorama program whereby a researcher had purchased 20 fake or fraudulent passports, some of which were purchased at great personal risk to the reporter. You can see a clip of the program at BBC Online or the whole program here.

UK law is pretty clear on this one: Traveling into the UK on a false, forged or stolen passport carries a prison sentence of up to 10 years, while making a false declarations to obtain a passport can lead to a prison sentence of up to 2 years.

Source: Computer Security Research - McAfee Avert Labs Blog

The Monster Gets Beaten Again

November 23rd, 2007 by Justine Paredes

Job hunters are in danger yet again. Monster.com, a job-seeking site, has been attacked for the second time, affecting Monster Company Boulevard, in particular.

The said page was said to contain an iFrame, which redirected users to servers hosting Neosploit, The Register reported. Neosploit is said to be as destructive as Icepack and Mpack, two of the more known exploit kits. The said attack sabotaged searches for well-known companies such as Toyota, Eddie Bauer, and Best Buy, making the exploit successful, as many people are probably seeking for jobs from companies as huge as the said three.

This latest attack is a sequel to another Monster.com hacking where user names were stolen by hackers for phishing and spamming purposes.

A spokesman from Monster.com assured users that the Web site is now up and running, and that the sabotaged pages have been restored. It was also said that only a small percentage of users were affected. This is the good news. But the bad news, and the one that matters more, is that there is no guarantee that these incidents won’t happen again. We should remember that this is already the second time. Who knows if there would be a third, a fourth and, a fifth?

Caution should be practiced by online job-seekers out there. Before they can even get employed, the bad guys are already out there to get them.

Source: The Monster Gets Beaten Again - TrendLabs | Malware Blog - by Trend Micro

Her Majesty’s CDs Stolen

November 22nd, 2007 by JM Hipolito

United Kingdom–More than a month after Her Majesty’s Revenue and Customs (HMRC) admitted to losing a laptop containing data on 400 of its customers, HMRC admits to the loss yet again of two CDs containing a database of 25 million names, bank account details, and other confidential data of child benefit recipients, setting off what can be considered the biggest data breach for the UK yet. The CDs were sent through courier service. This was apparently the fourth time the CDs containing the database were sent through courier to HMRC from the National Audit Office, and vice versa.

HMRC owned up to the loss only last November 20 when in fact a month had already gone by since the actual event happened (October 18). These series of events have led to the resignation of HMRC Chairman Paul Gray.

The two password-protected disks were apparently sent unregistered through the TNT postal system, but was never received by its intended recipient. Chancellor Alistair Darling called for an immediate search, soon followed by a large-scale investigation by UK’s Metropolitan Police Service and Independent Police Complaints Commission (IPCC).

The disks reportedly appeared on eBay according to The Register with the bid starting at ₤0.99 and with profits allegedly going to UK Charity, Sue Ryder Care.

The Register posted the eBay description of the controversial items and, apparently, the CDs may have landed -more or less- in good hands judging by these admonitions:

I haven’t read the data myself. The database appears to have approximately 25 milion records in it, but is password protected, so it is impossible to read it and it’s definitely impossible to extract any bank account data from it.

Any information that you might discover (should you be lucky enough to win the auction for these useful items and read the database thereon) must be kept in the strictest confidence.

The last part of the eBay description just about takes the cake:

PLEASE NOTE: Government departments should contact me by email before bidding, since they will have to be vetted for competence before entrusting such items to them.

Competence indeed.

Sources:

• The Register
• eWeek.com
• BBC News

Source: Her Majesty’s CDs Stolen - TrendLabs | Malware Blog - by Trend Micro

The Complaining Trojan

November 21st, 2007 by Bixie Villavicencio

VIP? Not in a fraudster’s vocabulary. Fraudsters choose no person, date or time when to release their attacks. US Department of Justice (USDOJ) is never an exception of getting victimized by fraud spammers.

There is a spam email message that is circulating the Web resembling the authentic USDOJ letterhead where the hoax message is written. Bearing the USDOJ logo, an unsuspecting recipient could be deceived to believe that the email is legitimate.

The message disturbs the recipient by saying that a complaint to the US Dept. of Justice has been filed against the recipient’s company. A copy of the complaint is attached to the mail. The recipient, getting shocked of the email, would then open the attached document.

What the recipient does not know is that the file attached is actually a Trojan downloader detected by Trend Micro as TROJ_DLOADER.QRQ. When executed, this Trojan also drops several malicious files, including TROJ_RUNDIS.H and TROJ_AGENT.ADCU.

People have to be triple cautious about email messages. Without an antivirus software and other proactive security measres (such as Web reputation/Web blocking services), only personal discretion would save or bring one to malware danger.

This applies to all, no VIP treatments on this department.

Source: The Complaining Trojan - TrendLabs | Malware Blog - by Trend Micro