Chris Mosby at myITforum.com

Here's a screenshot of a site:



It's a phishing site using Google AdWords as the lure.

What it really tries to do is to steal your Google AdWords account username and password.

And your credit card number.

Now look again. Look at what the browser is offering.



No thanks, I'd rather not save my password for this site, thank you very much.

Secunia Advisory: SA32791

Release Date: 2008-11-24

Popularity: 902 views
Critical:
Not critical Impact: DoS
Where: Local system Solution Status: Unpatched
OS:Microsoft Windows Vista

Subscribe: Instant alerts on relevant vulnerabilities

Description:
A vulnerability has been reported in Microsoft Windows Vista, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to the "CreateIpForwardEntry2()" function not properly limiting the length of the IP address prefix of the destination IP address passed via the "MIB_IPFORWARD_ROW2" structure. This can be exploited to cause a buffer overflow and e.g. crash a vulnerable system.

Successful exploitation requires that the attacker is a member of the "Network Configuration Operators Group".

The vulnerability is reported in Microsoft Windows Vista Enterprise (32 bit and 64 bit) and Microsoft Windows Vista Ultimate (32 bit and 64 bit). Other versions may also be affected.

Solution:
Only add trusted users to the "Network Configuration Operators Group".

Provided and/or discovered by:
Marius Wachtler, Michael Burgbacher, Carson Hounshell, Michael Craggs, and Thomas Unterleitner of phion AG

Original Advisory:
http://marc.info/?l=bugtraq&m=122711627932563&w=2

Nov22

WinCE Malware Blackens Phone Wallpapers

by Jake Soriano (Technical Communications)

Making its way back in the wild is a WinCE malware that infects Windows mobile phones. Detected by Trend Micro as WINCE_CRYPTIC.A, this new variant uses the same old routines that made WinCE malware notorious before.

Advanced Threats Researcher Jamz Yaneza says it works as a typical companion virus because it stores the infection code in another file. Typical viruses infect files themselves but WINCE_CRYPTIC.A does not. Instead, it creates “companion” files using the same file names as the infected mobile phone’s storage card. These companion files contain the infection code, and when users run the storage card, the malicious files run first.

So in essence it does not infect files themselves, and changes are made from the polymorphic engine of the malware. Yaneza adds that the file could actually be considered a Trojan with some polymorphic functionality. Companion viruses do this to avoid detection. Users are tricked into thinking they are still running a legitimate application when in fact they are already executing the malware.

Users however, will notice changes in their infected mobile phones as WINCE_CRYPTIC.A changes the text and background colors of the affected device. Here are some screenshots:

WinCe malware changes a mobile phone’s display colors.

The malware may be distributed through memory cards. It may also be hosted on malicious websites and may arrive in mobile phones through downloads. Yaneza believes that document-sharing via infrared or Bluetooth could also be a possible avenue for infection, as remote malicious users could easily pass on documents when these said devices are left on.

With more users using mobile devices that are Web-enabled, malware authors are also quick to adapt. From spam to ransomware, cybercriminals are exploiting mobile phone usage as a new avenue for profit. Interestingly, this malicious software deviates from the usual scheming operations that use Symbian malware to extort money from affected users for example. Symbian malware are notorious for locking phones and then asking users for money so affected phones could be fixed.

WinCE malware in the past did not have this routine. Our researchers believe that creators of this new WinCE malware are testing the waters for a bigger threat on mobile devices.

The following mobile phone models may be affected by WINCE_CRYPTIC.A:

• Windows Mobile 5.0 Smartphone
• Windows Mobile 5.0 PocketPC/PocketPC Phone Edition
• Windows Mobile 6.0/6.1 Classic
• Windows Mobile 6.0/6.1 Standard
• Windows Mobile 6.0/6.1 Professional

The Trend Micro Smart Protection Network already detects WINCE_CRYPTIC.A and provides solutions for its cleanup and removal. Trend Micro meanwhile advises users to not download phone applications from unknown locations on the Web. WINCE_CRYPTIC.A itself does not run on PCs but files may be downloaded from there to mobile phones. Beamed applications and documents should also be handled with caution. The US National Institute of Standards and Technology also provides guidelines on mobile phone security.

Increase in USB-Based Malware Attacks

• date 11-19-2008 04:17 PM
• author Security Intel Analysis Team writes:

Symantec is currently observing an increase in malicious applications that use USB flash drive devices as a propagation method. Just as a clarification for any of our readers that are not familiar with the term “USB flash drive,” a USB flash drive is typically a removable portable storage device that uses a USB (universal serial bus) port to interface to a computer. USB ports are part of most modern computers and they are designed to allow many peripherals to be easily connected (plug-and-play) to a computer through a standardized interface. These USB flash drive storage devices are very useful and are becoming fairly ubiquitous in the workplace.
The USB flash drive storage medium is designed to be portable, making it easy to connect to many computers in its lifetime. This, unfortunately, exposes the flash drive to the risk of infection. There are many malicious applications that propagate simply by making a copy of themselves on all drives that are attached to a computer. The portability of the USB device and its small form factor can also make it easy for attackers to plug it into computers that they have limited physical access to, potentially granting them remote access at a later time.
At the moment, there are two popular methods that malicious applications use to infect USB flash drives:
Simple file copy method

With this method, a malicious application that is installed on an infected computer simply makes copies of itself to all storage devices that are attached to the infected computer. A copy of the malicious code will be placed on network shares, local drives, and removable media (such as USB flash drives) that are connected to the computer. Usually the malicious application will also attempt to copy itself to peer-to-peer (P2P) file-sharing shared folders as well. With this method, a malicious file is often named with a sensational filename to lure a victim into launching the file and causing malicious code to be executed. Quite often there are familiar file icons such as Microsoft Windows icons for videos and images that are used to trick unsuspecting victims into thinking that an executable file is a harmless image or video. This infection method requires that the victim manually execute the malicious file from their computer to become infected.
AutoRun.inf modification method

Microsoft Windows and some other operating systems have a functionality that is called “AutoRun” (sometimes also referred to as Autoplay). AutoRun functionality is basically designed to perform some actions that are automatically executed when removable media is inserted or removed from a computer.
On Microsoft Windows platforms, “autorun.inf” is the file that contains instructions for the AutoRun functionality. The autorun.inf file can instruct AutoRun to use a certain type of icon; add menu commands; and among other things, start an executable.
With this infection method, the malicious application modifies or creates an autorun.inf file on all of the network shares, local drives, and removable media (including USB flash drives) that are connected to the computer. When an infected USB flash drive is inserted into another computer, the copy of the malicious application is automatically executed. Under a default configuration of Windows, this infection method does not require any interaction from the victim other than physically attaching the media to the computer.
Increasing trend of drive-infecting malicious code
Symantec has recently observed that both of the above methods are becoming an increasingly popular propagation method for malicious code. We have noticed the following percentile increase in several pieces of malicious code that Symantec antivirus currently blocks:

This trend is substantiated in vol. XIII of the Symantec Internet Security Threat Report (quoted from page 56, Propagation mechanisms subsection of the Malicious Code Trends section):

"In the second half of 2007, 40 percent of malicious code that propagated did so as shared executable files (table 9), a significant increase from 14 percent in the first half of 2007. Shared executable files are the propagation mechanism employed by viruses and some worms that copy themselves to removable media. As stated in the “Malicious code types” section above, the increasing use of USB drives and media players has resulted in a resurgence of malicious code that propagates through this vector.
This vector lost popularity among malicious code authors when the use of floppy disks declined and attackers instead concentrated on other more widely used file transfer mechanisms such as email and shared network drives. However, as use of removable drives has become more widespread, attackers have again begun to employ this propagation technique. Although current removable drives differ from floppy disks, the principle remains the same, enabling attackers to make simple modifications to old propagation techniques.”

How to mitigate this threat
There are many policy- and configuration-based mitigations that can be used to adequately limit the propagation of these threats. Network administrators are advised to:

•    Ensure that antivirus software is up to date.
•    Disable AutoRun functionality for removable media, which should be possible using endpoint security systems. For personal computers, there are many detailed tutorials on how to disable AutoRun. Also, holding down the SHIFT key while inserting a USB flash drive can temporarily disable AutoRun.
•    If removable drives are not required, endpoint security systems can distribute policies to prevent removable media from being recognized.
•    User education should be a priority to educate network users about these threats.

Message Edited by SR Blog Moderator on 11-20-2008 04:03 PM

Last Friday, we came across a rogue application, VirusResponse Lab 2009, that used a fake 404 page as part of its social engineering attack.

Many rogue affiliate sites will use script to generate animated "online scans" and then attempt to convince the visitor into downloading the rogue installer file via a pop-up dialog.

404dnswebsite .com took a different approach. Rather than producing a fake scan and prompting for a download, it instead simply hosted a fake 404 error message:



If the victim fell for the trick, they would have downloaded what we detect as FraudTool.Win32.Agent.eh.

As you can see from the screenshot above, the fraud page is not at all dynamic. Even though we opened the page with Firefox on a Linux based system, the page displays the text "Internet Explorer".

The 404dnswebsite account is now suspended.

Secunia Advisory: SA32772

Release Date: 2008-11-18

Popularity: 186 views
Critical:
Highly critical

Impact: System access
Where: From remote Solution Status: Vendor Patch
Software:Adobe AIR 1.x

Subscribe: Instant alerts on relevant vulnerabilities
CVE reference:CVE-2008-4824
CVE-2008-5108


Description:
Some vulnerabilities have been reported in Adobe AIR, which can be exploited by malicious people to compromise a user's system.

1) Multiple unspecified input validation errors in the parsing of SWF files can be exploited to potentially execute arbitrary code.

2) An unspecified error may allow execution of untrusted JavaScript with escalated privileges if data is loaded from a malicious source.

The vulnerabilities are reported in version 1.1 and prior.

Solution:
Update to version 1.5.
http://get.adobe.com/air

Provided and/or discovered by:
The vendor credits:
1) Riley Hassell and Josh Zelonis, iSEC Partners.
2) Chris Weber, Casaba Security.

Original Advisory:
http://www.adobe.com/support/security/bulletins/apsb08-22.html
http://www.adobe.com/support/security/bulletins/apsb08-23.html