October 2007 - Posts
This 1.4M powerpoint presentation contains 60 slides and was recently referenced in Sunbelt and John Levine's blogs.
EXCELLENT Powerpoint Presentation - Download Link
QUOTE: Last weekend, Brandon Enright of UC San Diego gave a informal talk at the Toorcon conference in which he reported on his analysis of the Storm botnet. According to his quite informative slides, Storm has evolved quite a lot over the past year, with both upgrades to the underlying engine and a variety of applications, most of which involve sending spam.
Everyone should avoid e-cards or other "fun links" associated with Halloween. The Storm Worm has also been adapted to trick folks as noted by Websense. Clicking on these links could lead to hours of restoration and repair work.
Storm Worm - New Halloween based attacks
QUOTE: Websense® Security Labs™ has confirmed that the Storm worm has once again switched lure tactics. The worm has now adopted a Halloween twist in its attempts to infect users with malicious code. The first copies of the new emails began going out just before 9:00am PST on Tuesday, October 30th. As with previous Storm emails, various subjects and bodies will be used. Here is one example email:
Example of new Halloween based attacks
Subject: Nothing is funnier this Halloween
Body: Come watch the little skeleton dance.
(Malicious URL Removed)
This interesting finding could lead to malware possibly being bypassed when processing web pages containing underlying scripts embedded in the HTML.
A000n0000 0000O000l00d00 0I000E000 00T0r0000i0000c000k
QUOTE: When I found a malicious script riddled with 0×00 bytes, SANS handler Bojan Zdrnja explained to me that this was an old trick. When rendering an HTML page, Internet Explorer will ignore all zero-bytes (bytes with value zero, 0×00). Malware authors use this to obscure their scripts. But this old trick still packs a punch.
When I remove all obscuring zero-bytes from this script, things get better: 25 out of 32 AV products detect it. But what happens when I add more zero-bytes to the script? Even more AV are fooled! Gradually adding more zero-bytes makes the detection ratio go down.
And at 254 zero-bytes between the individual characters of the script, McAfee VirusScan is the only AV to still detect this obscured script. One byte more (255 zero-bytes), and VirusScan doesn’t detect the script anymore. No AV on VirusTotal detects this malware obscured with 255 zero-bytes (or more). But for IE, this obscured HTML poses no problem, it still renders the page and executes the script.
Websense has warned of a new HTML based e-card in the Spanish language. It is designed to load a Trojan horse that can steal banking account credentials from the infected PC. More threats could potentially emerge, so please be careful out there.
New Halloween e-card threats
Sample e-card from Websense
QUOTE: Websense® Security Labs™ has discovered a new Trojan Horse information stealer that is being emailed out as a Halloween Greeting Card in Mexico. To date we have seen four unique sites being spammed out all with the same binary file. They were in Korea, Brazil, and Russia, and were all up and running at the time of this alert. The file is called "hallowenDay.exe". It is also poorly detected by anti-virus signatures.
Assuming users access the site and select to run the file a Trojan Horse is downloaded onto their machine which is designed to steal banking information from users, the file appears to also be packed with a unique custom packer. We expect to see additional email lures and malicious websites on our radar with Halloween night quickly approaching. The email is written in HTML and has a variety of subject lines.
This chart denotes that rootkits, botnets, and other advanced attacks have increased two-fold during the past year. As actual infections took place, it signifies that malware authors are using improved social engineering tactics and technical innovations for malware to slip through defense systems (e.g., massive spam attacks, crafted exploits, etc).
This finding illustrates that it's more important than ever to stay up-to-date with security protection and to exercise caution in email, IM, and website visitations.
Trend Micro reports 200% increase in Severe Malware Infections
QUOTE: An infections graph released by the Trend Micro Threat Analytics shows that the growth in severe malware infections grew 200% throughout 2007.
Please be very cautious with any PDF files received in EMAIL messages
If you use Adobe, it's very important to move to the latest version 8.1.1 plus keep AV protection updated.
Malicious PDF files being spammed out in volume
QUOTE: Malicious PDF files (report.pdf or debt.2007.pdf or overdraft.2007.10.26.pdf, etc) have been massively spammed through email during last hour and the spam run is still continuing. The PDF is spiced with CVE-2007-5020 exploit that downloads ms32.exe that downloads more componets. At this point it's not clear yet what is the final payload of the malware, because of missing files in the download chain. We are investigating further.
The subjects for the spam messages include:
Your credit report
Your credit points
Your balance report
Personal Financial Statement
Personal Credit Points
Personal Balance Report
Your Credit File
Trend's Exploit Detection
Trend - Behavioral Diagram
The Storm worm botnet is so well protected that it's central servers and malware authors have remained anonymous. While it uses fast-flux servers that are ever changing, the Storm worm client can launch a DDoS based attack if researchers try to reverse engineer the code to determine how it works.
Storm worm strikes back if researchers attempt to discover its origin
The Storm worm is fighting back against security researchers that seek to destroy it and has them running scared, Interop New York show attendees heard Tuesday. The worm can figure out which users are trying to probe its command-and-control servers, and it retaliates by launching DDoS attacks against them, shutting down their Internet access for days, says Josh Corman, host-protection architect for IBM/ISS, who led a session on network threats.
A recently discovered capability of Storm is its ability to interrupt applications as they boot up and either shut them down or allow them to appear to boot, but disable them. Users will see that, say, antivirus is turned on, but it isn’t scan for viruses, or as Corman puts it, it is brain-dead. "It’s running, but it’s not doing anything.
The Real Player security patch was issued promptly by the vendor and should be applied expediently.
Real Player - Security Release for critical ActiveX vulnerability
Solution - Apply patch for RealPlayer 10.5 and 11 beta:
When cleaning Storm worm infections, the file names have changed for newer variants and the most up-to-date standalone cleaner should be used.
Storm Worm - Now infects PC with different file names
QUOTE: We all know that Nuwar aka Storm gang has been continuously changing their spam email text, download sites, executables, network traffic patterns etc in their efforts to penetrate through the security defenses at various layers, all throughout this year. I had a chance to briefly look at a ‘fresh’ Nuwar sample this weekend. It is interesting that they have now also changed the names of files Nuwar drops. It now drops noskrnl.exe, noskrnl.sys and noskrnl.config instead of Spooldr.exe, Spooldr.sys, and Spooldr.ini correspondingly. It also tried to actively propagate by coping itself on the floppy drive, which is new.
This site is one of my favorite links for locating malware cleaning facilities:
GREAT SITE FOR FREE VIRUS REMOVAL TOOLS
(see links on left top side -- "Free Protection and Removal Tools")
Users should be not open any untrusted TIFF images using iPhone's Safari web browser and watch for available security patches to be released by Apple.
iPhone unpatched vulnerability and Exploit
Description: A vulnerability has been reported in Apple iPod touch and Apple iPhone, which potentially can be exploited by malicious people to compromise a vulnerable device. The vulnerability is caused due to an error in the processing of TIFF images and can potentially be exploited to execute arbitrary code when a specially crafted TIFF image is viewed, e.g. in the Safari web browser. The vulnerability is reported in iPod touch version 1.1.1 and iPhone version 1.1.1. Other versions may also be affected
Solution: Do not browse untrusted web sites and do not open untrusted TIFF images.
Real Player - Zero Day Exploit circulating
A new zero day Real Player exploit is reported to be actively circulating which uses an ActiveX control vulnerability. Real player users the ActiveX control to determine functionality and the maliciously crafted version can allow malware to be automatically installed. Users should avoid or be careful with all Real player files until this is fixed. A killbit can be set to deactivate the ActiveX control as noted below.
Real Player - Zero Day Exploit circulating
QUOTE: Attackers are exploiting a zero-day vulnerability in RealPlayer in order to infect Windows machines running Internet Explorer, Symantec Corp. said late Thursday. The security company issued an alert that rated the threat with its highest possible score. According to a warning issued to customers of its DeepSight threat network, Symantec said an ActiveX control installed by RealNetworks Inc.'s RealPlayer program is flawed. When combined with Microsoft Corp.'s Internet Explorer (IE) browser -- which relies on ActiveX controls to extend its functionality -- the bug can be exploited and malicious code downloaded to any PC that wanders to a specially crafted site.
KILLBIT CAN BE SET: The vulnerability lies in a RealPlayer ActiveX control, and can be mitigated by setting the appropriate kill bit via the registry:
KB Article - How to set Killbit for ActiveX objects
These email messages should be blocked or deleted if found. The advice
is always misleading and folks are better served by researching stock
information on legitimate websites.
Stock spam - New MP3 version will try to talk you into it
QUOTE: MP3 Version of Pump-and-Dump Stock SpamPump-and-dump
stock spam is a classic example of sophistication and diversity of spam
techniques. Recently the pump-and-dump spammers have started using mp3 files as
a new method of spreading stock spam. In the latest observations we’ve seen an
mp3 file as an attachment in the body of an
email message – without any content – and the subject line usually includes
“RE:”, “FW:”, or is sometimes just blank. The “From:” address is usually random.
Another feature of this new pump-and-dump stock attack is that the mp3 files
have random names, such as the following examples:
The average file size is approximately 63.3 kb,
with the garbled stock tip lasting for about 30 seconds. The Audio content
sounds something like the below example: “Hello, this
is an Investor alert. nnnnn Inc. has announced it is ready to launch its new
nnnnn.com Web site. Already a huge success in Canada, we are expecting amazing
result in USA. Go read the news and hit on nnnnn that Symbol get it nnnnn Thank
All Firefox users should move to the latest release for improved security. Most users will be prompted to autoupdate and these security improvements should be completed as soon as possible.
Firefox 126.96.36.199 - Security Release
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox188.8.131.52Mozilla Foundation Security Advisory - Fixed in Firefox 184.108.40.206
MFSA 2007-36 URIs with invalid %-encoding mishandled by Windows
MFSA 2007-35 XPCNativeWrapper pollution using Script object
MFSA 2007-34 Possible file stealing through sftp protocol
MFSA 2007-33 XUL pages can hide the window titlebar
MFSA 2007-32 File input focus stealing vulnerability
MFSA 2007-31 Browser digest authentication request splitting
MFSA 2007-30 onUnload Tailgating
MFSA 2007-29 Crashes with evidence of memory corruption
Oracle DBAs and system administrators should pilot test and quickly deploy the quarterly security updates as applicable Related Article
http://news.yahoo.com/s/pcworld/20071015/tc_pcworld/138431 Oracle - Quarterly Release Links
http://www.oracle.com/technology/deploy/security/alerts.htmOracle - October 2007 Security release details
: Oracle Corp. will release security updates for its products next week fixing 51 vulnerabilities in its products. Included in the Critical Patch Update, set to be released Tuesday, will be critical updates for the company's flagship Oracle Database. Twenty-seven database bugs will be fixed, but five of the bugs can be "exploited over a network without the need for a username and password
," Oracle said in a note on next week's patches.
Recently, we may have been in "calm before the storm", as e-card attacks have diminished some. These 3 blog posts point to more innovation in new attacks that could be coming soon:
Storm Worm - New encrypted packets and I-Frame injection version coming
Strengthening Storm – Almost Hurricane?
The new Storm worm variants being seen these days have yet again evolved and are gaining strength. Well, at least in encryption technology. The P2P UDP packets (made up of the header and payload) are now encrypted using a 40-byte key. As our friends at Secure Works pointed out here, this is definitely good news for network administrators who have to deal with legitimate P2P overnet traffic.
The encryption is trivial and isn't the only new thing found in this variant. It seems to have some new techniques for propagation. Firstly, it is able to scan the file system and drop an executable into any folder with at least one .exe file. Secondly, the worm is able to harvest email addresses from the file system and send spam to those addresses. Lastly, it is able to search for .htm, .html, and .php files and inject malicious IFRAME code into them
Opera browser users should upgrade to the latest version, as the following security improvements have been made
- Fixed an issue where external news readers and e-mail clients could be used to execute arbitrary code, as reported by Michael A. Puls II. See our advisory.
- Fixed an issue where scripts could overwrite functions on pages from other domains. See the advisory. Issue reported to Opera by David Bloom.
Opera 9.24 for Windows is available for download
One of the most technical and in-depth analysis of the Storm Worm botnet can be found in the links below. Every new development should be watched by security professionals, as these constant attacks use convincing and innovative social engineering schemes (e.g., e-cards). Once a workstation becomes infected, it becomes a member of the botnet consisting of at least 1.6 PCs. These infections are also difficult to detect and clean as advanced rootkit techniques are used.
Storm Worm - Comprehensive Analysis by Cyber-TA
QUOTE: Since early 2007 a new form of malware has made its presence known on the Internet by its prolific growth rate, its ability to distribute large volumes of spam, and its ability to avoid detection and eradication. Storm Worm (or W32.Peacomm, Nuwar, Tibs, Zhelatin), as it is known, is a highly prolific new generation of malware that has gained a significant foothold in unsuspecting Microsoft Windows computers across the Internet.
Storm, like all bots, distinguishes itself from other forms of malware by its ability to establish a control channel that allows its infected clients to operate as a coordinated collective, or botnet. However, even among botnets Storm has further distinguished itself by being among the first to introduce a fully P2P control channel, to utilize fast-flux to hide its binary distribution points, and to aggressively defend itself from those who would seek to reverse engineer its logic. Despite all the hype and paranoia surrounding Storm, the inner workings of this botnet largely remain a mystery.
Additional Links and Information
Some recent discoveries have been posted where special strings after the URL address may bypass some of the security checking. As noted in the posts below, a special URL string may be crafted that can bypasses the warning prompt to the user and loads an EXE file automatically. Users should continue to be careful with URLs in email, websites, etc. and keep AV protection updated.
Internet Explorer - Special URL strings may bypass security controls for EXE files
Original IE 6 Bug as documented by Secunia and CERT
QUOTE: Sometimes it is nice to see old vulnerabilities come back from the dead. This time I'm referring to a vulnerability in Internet Explorer that was discovered almost 3 years ago by cyber_flash. The vulnerability allows an attacker to bypass the security download warning dialog, and display a regular save file dialog, by manipulating IE into displaying executable file (a file with .exe extension) as a regular html file. While this vulnerability was partially patched by Microsoft in IE7, it was still remained unpactched in IE6 SP2.
This new HTML based attack is socially engineered well and may trick folks. It's always a best practice to avoid every URL present in an email message (even to opt out of spam), unless you are absolutely sure it's safe.
New Storm Worm - Kitty Greeting Card
Websense® Security Labs™ has received several reports of a new Web site that is being distributed in spam sent out by those running the Storm attacks. This site poses as a free Ecard Web site. No exploit is on the site itself. However, when users click any of the URLs, they are prompted to download and run a file called "SuperLaugh.exe." This file contains the Storm payload code.
More Posts Next page »