Google Chrome leaves old versions behind when updated?

So I fire up Secunia on a PC today, and this alert appears:

image

 

But the user seems to be running the latest version:

image

 

Only one version appears in add/remove programs:

image

 

image

 

 

The extra folder, 3.0.195.38, is over 66 megabytes in size, and almost identical in content to 4.0.249.78.

 

Questions:

Can the folder 3.0.195.38 be deleted safely?

Can the bad guys use the contents of the old folder 3.0.195.38 to leverage security vulnerabilities, similar to the bad old days of Sun Java, when Java would be updated but old, vulnerable, versions of the application would be left behind which could be accessed by the bad guys and any security vulnerabilities leveraged?  There are various DLLs, a SETUP.EXE, and quite a few JS files in the old folder.

 

I’ll see what I can do about getting those questions answered.

Posted by sandi with 4 comment(s)
Filed under:

Malware infected Firefox Add-Ons – again

Remember the Vietnamese Language Pack malware debacle that occurred in May of 2008?  That was when Mozilla admitted that they only scanned add-ons for malware when the files were first uploaded – too bad for Firefox users if an infection was new, and not yet detectable.  After that debacle Mozilla changed their protocols to re-scan add-ons (although I must admit, I still don’t understand why they weren’t doing that in the first place).

Now we have another incident. To quote the Mozilla blog:

Two experimental add-ons, Version 4.0 of Sothink Web Video Downloader and all versions of Master Filer were found to contain Trojan code aimed at Windows users. Version 4.0 of Sothink Web Video Downloader contained Win32.LdPinch.gen, and Master Filer contained Win32.Bifrose.32.Bifrose Trojan. Both add-ons have been disabled on AMO.

Cite: http://blog.mozilla.com/addons/2010/02/04/please-read-security-issue-on-amo/

Mozilla advises that:

Master Filer was downloaded approximately 600 times between September 2009 and January 2010. Version 4.0 of Sothink Web Video Downloader was downloaded approximately 4,000 times between February 2008 and May 2008. Master Filer was removed from AMO on January 25, 2010 and Version 4.0 of Sothink Web Video Downloader was removed from AMO on February 2, 2010. AMO performs a malware check on all add-ons uploaded to the site, and blocks add-ons that are detected as such. This scanning tool failed to detect the Trojan in Master Filer. Two additional malware detection tools have been added to the validation chain and all add-ons were rescanned, which revealed the additional Trojan in Version 4.0 of Sothink Web Video Downloader. No other instances of malware have been discovered.

PWS:Win32/Ldpinch.gen detection has been around since at least February 2008.  So would somebody like to explain to me why that Trojan was not detected by Mozilla until after “two additional malware detection tools (were) added to the validation chain”?   And this is despite the scare that they suffered in May of 2008 when the Vietnamese Language Page malware was discovered?  Just what “malware detection tools” were they using up until now? 

Win32.bifrose (as distinct to Win32.Bifrose.32.Bifrose – is that a typo?) has been around since as early as 2006.

Why was Mozilla oblivious to the existence of the Trojans until “CatThief” reported it to them?

The next time you download some add-on from addons.mozilla.org that were uploaded by heaven-knows-who ask yourself ask yourself, just who are you trusting?

Update:  While we’re on the topic of “just who are you trusting”, this is a quote from Computerworld:

Little could be found on the Web about the author of Master Filer, identified as "haklinim," other than that he or she used an anonymous proxy server in Japan to shunt traffic to a developer biography, which Mozilla has also deleted.

SourceTec Software, which makes Sothink Web Video Downloader, is based in China, according to the phone number listed on its Web site. The company did not reply to a request for comment or an explanation of how its add-on was infected.

Mozilla also was unavailable late Thursday to respond to questions, including why the infected Sothink Web Video Downloader add-on was not detected in 2008, and whether it planned to reach out to users who had downloaded the tainted extensions.

(Thanks to ObiWan for the heads up)

FTC versus Innovative Marketing et al – developments

Motions for default judgment have been filed.

There are three individual motions, one against Daniel Sundin, one against Sam Jain, and one against Innovative Marketing.

The monetary relief sought in all three motions is identical - $163,167,539.95 - being the "total revenues, minus funds returned to consumers through refunds and charges, from the conduct alleged in the FTC's complaint from 2004-2008".

Information about revenues, refunds etc was obtained from Innovative Marketing’s financial records for the period 2004 - 2006 that had been submitted in the Canadian lawsuit combined with testimony from Jettis Technologies.  Jettis Technologies were the management company for the payment processor the Defendants used between 2006- 2008 to sell their scareware products.  The Canadian lawsuit is the lawsuit that was filed by Innovative Marketing against Marc D'Souza and Maurice D'Souza in the Ontario Superior Court of Justice.

It is important to note that the figure of $163,167,539.95 is NOT the sum total of all of the Defendants’ activities from 2004-2008 and, as stated by the FTC in its motions, "certainly undercounts the total consumer injury at issue in this case".

All three motions also ask for Permanent injunctive relief.

 

Conduct prohibitions:

The Defendants, as well as their Representatives, be permanently restrained and enjoined from, directly or indirectly, engaging or participating in the marketing, distributing, installing, downloading, providing customer support for, offering for sale, or sale of any Computer Security Software.

The Defendants, as well as their Representatives, be permanently restrained and enjoined from, directly or indirectly, engaging or participating in the marketing, distributing, installing, downloading, providing customer support for, offering for sale, or sale of any Software that interferes with a consumer’s computer use, including but not limited to Software that:

A. changes consumers’ preferred Internet homepage settings;

B. inserts a new advertising toolbar onto consumers’ Internet browsers;

C. generates numerous “pop up” advertisements on consumers’ computer screens when consumers’ Internet browsers are closed;

D. adds advertising icons to the computer’s desktop;

E. tampers with, disables, or otherwise alters the performance of other programs, including anti-spyware and anti-virus programs;

F. alters Internet browser security settings, including the list of safe or trusted websites; or

G. installs other advertising Software on consumers’ computers;

In connection with the marketing, distributing, or sale of, or the provision of customer support for, any goods or services, the Defendants, as well as their Representatives, be permanently restrained and enjoined from:

A. Using any domain names that have been registered using false or incomplete information;

B. Claiming that they place advertisements on behalf of, or otherwise represent, individuals or entities, unless they possess written authorization to represent such individuals or entities;

C. Misrepresenting, directly or by implication, to any potential purchaser of any goods or services, any material fact, including, but not limited to:

1. The total cost to purchase, receive, or use, or the quantity of, any goods or services that are subject to the sales offer;

2. Any material restrictions, limitations, or conditions to purchase, receive, or use the goods or services; or

3. Any material aspect of the nature or terms of a refund, cancellation, exchange, or repurchase policy for the goods or services; or

D. Providing substantial assistance to any third party to make any material misrepresentation, including, but not limited to, those misrepresentations prohibited by Paragraph C, above.

 

There are orders for compliance monitoring and reporting, as well as record keeping provisions and orders for distribution (that is, who must be informed of the order).

Posted by sandi with no comments
Filed under: ,

FTC versus Innovative Marketing et al – developments

image

 

 

The FTC's Renewed Motion for Rule 37 Sanctions against Sam Jan was granted on 19 January 2010.

It was further ordered that Default be entered against Jain pursuant to Rule 37(d) and that the FTC shall submit evidence to the Court as to the total consumer injury resulting from the allegations in the Complaint.

The Court will review the evidence of total consumer injury and then enter default judgment.

Now we wait to see what sort of monetary and other penalties the Court will impose upon Jain.  The FTC’s second motion claimed that “Jain perpetrated one of the largest online frauds ever prosecuted by the FTC, with a total consumer injury figure that – as the Court will soon hear – exceeds $150 million”, which gives you some idea of the sort of fiscal penalty Jain now faces.

****

In other developments, Marc D'Souza had disputed the scope of discovery being sought by the FTC. 

Because of a concern that "broad enquiries from the FTC aimed at each of Mr D'Souza's business partners could result in significant disruption to Mr D'Souza's new business" the Court has decided that the FTC can conduct discovery regarding D'Souza's post January 1, 2007 activities, but only if the FTC has identified a particular company as having done business with D'Souza prior to January 1, 2007.  The FTC is also free to seek discovery from D'Souza about any continued use of "computer scans" to sell security software.

Posted by sandi with 1 comment(s)
Filed under: ,

Dynamoo finds malvertizing at ebuddy.com

image

 

 

Cite: http://www.dynamoo.com/blog/2010/01/zoombannercom-yieldmanager.html

 

The domain cited by Dynamoo as the end of the legitimate chain, zoombanner.com, is worth a closer look.  It may be registered to “Domain Owner” (trafficbuyer.@gmail.com) of 15156 SW 5th of Scottsdale, Arizona *now*, but it used to be registered to a name with a far older, nefarious, history - Modena Inc.

Modena Inc have a dubious history, with complaints as far back to 2005 about "spyware infested filesharing programs", site scraping and 302 domain poisoning:

http://www.freedomcrowsnest.org/forum/viewtopic.php?t=1416
http://forum.abestweb.com/showthread.php?p=456066&mode=threaded#post456066

Modena Inc domains were also part of the malvertizing incident that hit digitalspy.co.uk:
http://msmvps.com/blogs/spywaresucks/archive/2009/07/22/1704910.aspx

And was implicated in malvertizing that attempted to infect computers via PDF exploit:
http://msmvps.com/blogs/spywaresucks/archive/2009/09/12/1722754.aspx

There is also a dishonorable mention at bluetack.co.uk (**10** different security exploits were used in that incident) - domains used were banners.exitexchange.com and count.exit1208.com:
http://www.bluetack.co.uk/forums/index.php?showtopic=18064&st=210&p=90509&

It is interesting that ashoping.com was part of the incident recorded at bluetack.co.uk. The registrant, helen.nikolson@gmail.com, has been seen myriad times, in association with traffichunters.net (which we can tie to Innovative Marketing in the Ukraine):
http://msmvps.com/blogs/spywaresucks/archive/2009/03/27/1682054.aspx

 

 

 

 

 

Since we can follow the bouncing ball back from zoombanner.com to Innovative Marketing in the Ukraine it occurs to me that I should check to see if there has been any progress with the FTC versus Innovative Marketing Lawsuit.  My regular readers will know that Sam Jain's lawyers, Patton Boggs, asked for permission to withdraw as Jain's lawyers.  That request was granted on the 15th of January.

A telephone conference regarding "Discovery Dispute" was held on the same day - sorry, I have no further information about that.

The second motion for sanctions against Sam Jain, filed on 22 October last year, remains outstanding:

10/22/2009
Second MOTION for Sanctions Pursuant to Rule 37 Against Sam Jain by Federal Trade Commission.

"Sam Jain has made a mockery of this proceeding and has demonstrated nothing but contempt for this Court and the American judicial system as a whole. Together with his codefendants, Jain perpetrated one of the largest online frauds ever prosecuted by the FTC, with a total consumer injury figure that – as the Court will soon hear – exceeds $150 million. After being caught red-handed by the FTC, Jain promptly fled the United States, leaving his lawyers behind to delay the FTC’s efforts to redress the massive consumer injury Jain helped inflict. After nearly a year of delay, Jain has reached the end of the road. Unwilling to comply with this Court’s command that he participate in discovery, Jain has no further ability to stall this litigation. As a result, Jain has washed his hands of this matter, and simply disappeared. Given these facts, it is difficult to imagine a case that better supports the imposition of terminating sanctions, or an individual more deserving of such an outcome than Jain."

 

Off topic:

Personally, I think that people who use services such as ebuddy.com, which asks you to hand over your username and password for MSN, Yahoo, AIM, GTalk, Facebook, ICQ and MySpace, are very foolish.  There’s no way I’m ever going to do that – no how, no way.

Don’t forget what happened to RockYou (to cite a recent example):
http://www.rockyou.com/help/securityMessage.php

Posted by sandi with no comments
Filed under:

bootcampmedia – some problems have been cleaned up, but others continue

Cite: http://www.dynamoo.com/blog/2010/01/more-malvertisment-domains.html

 

Dynamoo noticed that bonnapet.com is not resolving at the moment

image

 

Check out the Host names sharing ip (217.20.114.40) with a-records – what do you think the chances are that any of those sites are legitimate?

*.p2doctors.com
*.p2drugstore.com
*.p2eudrugs.com
*.p2menhealth.com
*.p2peoplehealth.com
*.p2pharmacy.com
*.p2ultram.com
*.p2usadrugs.com
*.p2usapills.com
*.p2versus.com
*.p2womanhealth.com
*.p2yourpills.com
ad115.unix-server.com
mail.bonnapet.com
mail.fairhyip.com
ns1.bonnapet.com
ns2.bonnapet.com
p2block.com
p2doctors.com
p2drugstore.com
p2eudrugs.com
p2medicine.net
p2menhealth.com
p2mypills.net
p2peoplehealth.com
p2pharmacy.com
p2pillsru.net
p2tramadol.net
p2ultram.com
p2usadrugs.com
p2usapills.com
p2versus.com
p2womanhealth.com
p2yourhealth.net
p2yourpills.com
fairhyip.com

Yeah, we love Netdirekt – they’re such a clean host (not).

Posted by sandi with no comments
Filed under:

Attack of the psycho server

 

Hmm, it seems that my mail server has learned a foreign language – that or it is swearing at me ;o)

Ok, so what’s the diagnosable problem? 

0x800CCC6C SMTP_452_NO_SYSTEM_STORAGE No space to store

>sigh<  I blame the IMAP accounts.

 

image

Posted by sandi with no comments
Filed under:

Malvertizing at boingboing.net

image

Original source: Dynamoo
http://www.dynamoo.com/blog/2010/01/boingboingnet-bootcampmediacom-ad-leads.html

We have seen problems at bootcampmedia for a LONG time (at least a year) – Jamie Dalgetty needs to start cleaning up bootcampmedia.

Historical evidence:
http://www.google.com/cse?cx=007665253733268001951:qtjb7x6vodw&ie=UTF-8&q=bootcampmedia&sa=Search&siteurl=www.google.com/cse/home%3Fcx%3D007665253733268001951:qtjb7x6vodw

 

Now, I’ve been able to reproduce Dynamoo’s findings, but I saw a different advertisement (I’m sure I’ve seen that fake craigslist advert before), and different domains.

I bounced from bootcampmedia.com to firedogred.com to deliver.azrielwhereincozen.com (which hosted the advert itself) to content.bookletjigsawsenam.com (which redirected us to bonnapet.com).  bonnapet.com is the domain that was used to attempt to download malicious content to my test machine (an attempt that was easily thwarted, thanks to IE8’s infobar).

Domain details are below the screenshot.

The malicious behaviour has been reported to Right Media (Yieldmanager) with supporting evidence.

image

bootcampmedia.com
ICANN Registrar: GODADDY
Created: 11 dECEMBER 2007

IP: 69.163.209.214 - New Dream Network LLC

Shares IP with 26 other sites.

Registrant hidden by domainsbyproxy.com

*****

firedogred.com
ICANN Registrar: GODADDY
Created:15 September 2009

IP: 68.178.232.100 - Godaddy.com, inc.

Registrant - anonymised...
Domain Owner
15156 SW 5th
Scottsdale, Arizona 85260
USA

Aren't 555 phone numbers always fake? 800 555 1212

*****

azrielwhereincozen.com
ICANN Registrar: GODADDY
Created: 7 January 2010

IP: 74.207.232.202 - New Jersey - Absecon, Linode

Registrant hidden behind domainsbyproxy.com

*****

bookletjigsawsenam.com
ICANN Registrar: GODADDY
Created: 7 January 2010

IP: 69.164.196.55 - New Jersey - Absecon, Linode

Registrant hidden behind domainsbyproxy.com

*****

bonnapet.com
ICANN Registrar: ENOM, INC
Created: 11 January 2010

IP: 217.2.114.40 - Berlin - Netdirekt E.K.

Registrant:
Wade Cook (wade.cooke@yahoo.com)
12 Hull Street
Boston MA 02113
US

An excellent improvement to Adobe Reader security

The most important piece of advice that is generally given to users of Adobe Reader to protect them from malicious exploits in PDF documents is to disable JavaScript, but it has always been an “all or nothing” situation – the chances that somebody would heed our advice, disable JavaScript, only to need to turn it on again (and forget to turn it off) was high.

The October update of Reader, though, offers a new feature which I quite like – note how you can enable JavaScript for just the one document and, if you so desire, for just one time.

So my new advice is to disable JavaScript and enable “Enhanced Security”.

Now, if only they would give us a way to turn off the functionality that allows criminals to use Flash advertisements to hijack web browsers…

image

Old dialogue – JavaScript disabled

image

New dialogue – JavaScript disabled

image

 

 New dialogue – blacklisted JavaScript encountered

image

 

Source: http://blogs.adobe.com/asset/2010/01/a_few_words_on_the_january_201.html
Source: http://kb2.adobe.com/cps/504/cpsid_50432.html

softwarespam.net and stablemates

A friend was hit by a redirect to softwarespam.net when she clicked on a Google search result for timesheets compatible with MYOB - the site exhibited classic scareware/fraudware behavior.

 

Domain details:

softwarespam.net
ICANN Registrar: Key-Systems GMBH
Created: 21 December 2009

IP: 93.190.140.165 - Netherlands, Wordstream

Shares IP with softwareanti.com, softwarejar.com, softwarerising.com, softwaresecure.net, softwarespyware.net, softwarethe.net, softwarethreats.com, softwarethreats.net, softwarexp.net

Registrant:
P-SNG999
Stanislav Gladishev (glad1shev@mail.ru)
pr Andropova 27-8
Moskva 115487
Russia
7.4996156560

*****

softwareanti.com
ICANN Registrar: Arsys Internet, S.L. D/B/A NICLINE.COM
Created: 22 December 2009

Registrant:
Stanislav Gladishev (glad1shev@mail.ru)
pr Andropova 27&#8206-8
Moskva 115487
Russia
7.4996156560

*****

softwarejar.com
ICANN Registrar: Arsys Internet, S.L. D/B/A NICLINE.COM
Created: 22 December 2009

Registrant:
Same as softwareanti.com

*****

softwarerising.com
ICANN Registrar: Arsys Internet, S.L. D/B/A NICLINE.COM
Created: 22 December 2009

Registrant:
Same as softwareanti.com

*****

softwaresecure.net
ICANN Registrar: Key-Systems GMBH
Created: 21 December 2009

Registrant:
Same as softwarespam.net

*****

softwarespyware.net
ICANN Registrar: Key-Systems GMBH
Created: 21 December 2009

Registrant:
Same as softwarespam.net

*****

softwarethe.net
ICANN Registrar: Key-Systems GMBH
Created: 21 December 2009

Registrant:
Same at softwarespam.net

*****

softwarethreats.com
ICANN Registrar: Arsys Internet, S.L. D/B/A NICLINE.COM
Created: 22 December 2009

Registrant:
Same as softwareanti.com

*****

softwarethreats.net
ICANN Registrar: Key-Systems GMBH
Created: 21 December 2009

Registrant:
Same at softwarespam.net

*****

softwarexp.net
ICANN Registrar: Key-Systems GMBH
Created: 21 December 2009

Registrant:
Same at softwarespam.net

“GodMode”?

image

 

There is some “excitement” over at CNET, thanks to an article about the so-called “GodMode” published by Ina Fried:
http://news.cnet.com/8301-13860_3-10423985-56.html

Ina Fried says that “Windows enthusiasts are excited over the discovery” (well, this one isn’t, thank you). 

Putting aside the fact that the information has actually been around since 2008 or so (sorry Ina), y’all may be interested to know that you can name the folder anything you want – all you need to do is ensure that the folder name ends with the correct GUID – ie:

{ED7BA470-8E54-465E-825C-99712043E01C}

And, don’t forget to include the full stop as well, eg:
This_is_the_folder_name.{ED7BA470-8E54-465E-825C-99712043E01C}

 

 

So have fun gang.  Perhaps you’re an athiest….

image

 

Perhaps you’re a fan of Sesame Street…

image

 

Or if you’re feeling disillusioned with the popular press….

image

Posted by sandi with no comments
Filed under:

ALERT: Please treat these domains with extreme caution

Hat tip to phishlabs (www.phishlabs.com) for the heads up :)

 

There have been reports of potential malvertizing activity in association with dowsonandco.com and vertfi.com.

dowsonandco.com

Created 8 November 2009

Registrar: BIZCN.COM, INC (notoriously problematic)

IP: 217.23.7.177 (Faro - Worldstream)

Server is running nginx (Software preferred by the miscreants)

Registrant: Timothy Davis (davist@yahoo.com) of 4786 Nutters Barn Lane, Des Moines IA 50317 (I can’t find evidence that this address exists)

Business address is listed as 1221 Brickell Ave Miami, FL, which is the address of some executive offices.  Note that you won’t find Dowson and Co at that address according to this web site:
http://www.corporationwiki.com/Florida/Miami/1221-Brickell-Ave-Miami-FL-33131-a4202.aspx

Shares IP with advert-ex.com, bradeymedia.com and lemanmarketing.com as well as mail.parsok.com.

*****

advert-ex.com

Created 8 November 2009

Registrar: BIZCN.COM. INC

Registrant: Johnny Johnson (johnj@dnsconsulting.com), 4765 Horner Street, Montgomery AL 36107

*****

bradeymedia.com

Created 8 November 2009

Registrar: BIZCN.COM, INC

Registrant: Travis Davis (davis@vipdomains.com), 1728 Rafe Lane, Memphis MS 38118

*****

lemanmarketing.com

Created 8 November 2009

Registrar: BIZCN.COM, INC

Registrant: Curtis Bridges (curtisdomains@yahoo.com), 2674 Ryder Avenue, Seattle WA 98101

******************************************************************************

vertfi.com

Created 20 December 2009

Registrar: BIZCN.COM, INC

IP: 217.23.7.83 (Faro, Worldstream) Note that there is also a vertfi.info registered.

Shares IP with febring.com, indrine.com and schnine.com

Registrant:  Kenneth Mcdonald (dns@vertfi.com), 33 Tibbs Ave, Superior MT 59872

*****************************************************************************

Other stuff:

A search of IP 217.23.7.% reveals some worrying web sites, eg:

  1. abercrombielife.com (which displays a series of fake security seals purporting to be issued by BBB, Verisign, McAfee and Security Metrics).
  2. googie-anaitlcs.ws, googie-analytics.ws
  3. A series of 'advertising' type domains such as 4livemarket.com, bellwayinteractive.com, goldbaymedia.com, revoltechmedia.com, smartmediaway.com (several of which have been seen before in association with IP addresses of domains used to facilitate the distribution of malvertizing).

I find it interesting that some domains (bellwayinteractive.com, goldbaymedia.com, revoltechmedia.com and smartmediaway.com) used to be within IP range 212.117.175.% – they were IP stablemates with spark-smg.com which was the domain used to trick Gawker Media into accepting malvertizing.

 

I have also spotted the domain vigana-media.com and yewomedia.com (IP: 217.23.7.175)

vigana-media.com is sharing IP address with yewomedia.com.  yewomedia.com's web site is visually identical to vigana-media except for a few minor textual changes to make the blurbs suit the different domains.

Vigana-media.com claims to have been around since 1997 and yewomedia.com claims to have been around since 2002, which is quite interesting, considering both domains were not registered until late 2009.  Both sites also claim to have been "ranked by AdvertisingAge as a "Top 100 Interactive Agency Nationwide".  Despite the extensive similarities between the web sites, there is no similarity when it comes to the Registrants.

 

vigana-media.com
ICANN Registrar: BIZCN.COM, INC
Created 15 October 2009

Registrant:
Gene West (genetwest@gmail.com)
510-696-1538
4014 Clifford Street
San Leandro CA 74578

yewomedia.com
ICANN Registrar: BIZCN.COM, INC
Created 30 November 2009

Registrant:
FreeBiofuel
Christopher Penaflor (christopherpenaflor@gmail.com)
503-361-4762
988 Mattson Street
Salem OR 97301

Posted by sandi with no comments
Filed under:

Alert: please treat these domains with extreme caution

Originally spotted via this blog entry (you’ll see SpywareSucks cited in the comments).

Putting aside the fact that the author of the blog is completely wrong to claim that Google was blocking biggovernment.com because of “bad publicity”, we can be grateful that the author has brought some malvertizing domains to our attention.

Ironically, redstate.com has been having problems with malicious content itself

If you look at the screenshot of the Google Chrome alert posted at redstate.com, you will see that biggovernment.com was being blocked, but not because of any “bad publicity”, but rather because Google detected that biggovernment.com was serving content from statsistat.com – and yes, statsistat.com is definitely bad news.

image

 

Let’s try to answer a few of the gentleman’s questions:

Why would Google be marking BigGovernment.com as a page that has malware on it?

Because content from statsistats.com was detected.

I have never before received this warning from Google when going to BigGovernment. I suppose it is possible that BigGovernment did have malicious code on it. Of course, I would then also have to believe that in the following two hours BigGovernment isolated the malicious code and removed the code. Why?

biggovernment.com may not have detected or cleaned up anything at all.  It may be that the malicious code only appears once per IP address (or once per computer if browser/flash cookies are being used to control behaviour), which is a very common trick the bad guys use to make it difficult to prove that malicious content exists, or existed.  It may be that the malicious code only appears if the correct referrer is detected (another very common trick).

Well, how else would Google Chrome now be allowing you to go to BigGovernment.com without a warning?

Because the malicious code is no longer being detected.  See above.

Is their product malfunctioning?

No. See above.

Also, Safari uses the same system as Chrome for detecting malicious sites, why didn’t Safari give the same warning when I attempted to use it?

See above.

 

Now, let’s take a look at that domain…

 

statsistats.com
ICANN Registrar: DIRECTI
Created 26 December 2009

IP: 193.104.22.153 - Malta, Kratosweb-net

Sharing IP with statcstat.com, statdstat.com and (previously) statbstat.com.

Registrant hidden behind privacyprotect.org

*****

The IP range 193.104.22.% is an absolute treasure trove of potential danger - take a look at the following domains - all of them should be treated with extreme caution:

Bestcards.biz  | Nationaltravel.biz  | Advancepublicsafety.com  | An-ty-virusstore.net  | Antivirussoftdrink.com  | Antyvirustoolshop.net  | Bestscanada.com  | Biohomesecurity.com  | Cheapreadweb.com  | Eessentialoil.com  | Homevirusscan.com  | Malwareexamination.com  | Onlinewebstie.com  | Scaninternetworld.com  | Socialsecurityimaging.com  | Antispywaresofttoday.com  | Antivirussoftstore.com  | Antyspywaretoolnow.com  | Freeremovevirustool.com  | Onlinecheckdirect.com  | Onlineantivirusdirect.com  | Onlinesecurtydirect.com  | Virtualespywareremove.com  | Rootcollection.com  | Internetnonmalware.com  | Antivirusscanblog.com  | Antyspyvarescanblog.com  | Illnessremover.com  | Malwaredrop.com  | Antysoftwarestudy.com  | Scan-online-website.com  | Scanspiritonline.com  | Bestporncity.com  | Mediaboxvideo.com  | Mediafilmonline.com  | Pornmovieshot.com  | Statcstat.com  | Statdstat.com  | Statsistats.com  | Print-design.cn  | Beatthebearblackhole.com  | Chinaaaredarmy.com  | Thepoweblessninja.com  | Powertraffstakes.com  | 2009antispyware.net  | Againstspyware.com  | Anti-spyware-2010.net  | Antispycenterprof.com  | Antispyware24x7.com  | Antispywareglobal.com  | Antispywareonline.net  | Antispywaresnet.com  | Antispywarets.com  | Antispywareweb.net  | Antispyworldwideint.com  | Antisspywarescenter.com  | Antivirplatinum2009.com  | Antivirplatinum2010.com  | Antivirus-live.net  | Antivirus-service.net  | Antiviruscenter.net  | Antivirusexpert.net  | Antiviruslive-pro.com  | Antiviruslive2010.com  | Antiviruslivepro.com  | Antivirustop.net  | Bestantispysoft2010.com  | Eliminater2009pro.com  | Intsecureprof2010.com  | Itsafetyonline.com  | Ivirusidentify.com  | Iwebantispyware.com  | Iwebpcdoctor.com  | Iwebpcprotect.com  | Myprivatesoft2009.com  | Netantivirus.net  | Onlineantispysoft.com  | Osadwarekill2010.com  | Owndefender.com  | Pcdoctorz2010.com  | Pcprotect2010.com  | Pcsafety2009pro.com  | Pcsafetyplatinum.com  | Protection2010.com  | Protectorservice.com  | Security2010.net  | Securityprosoft.com  | Securityztop.com  | Spydetector2009.com  | Spywaredetect24pro.com  | Superantivirus.net  | System-deffender.com  | Systemprotector.net  | Threat-detector.com  | Threat-finder.com  | Viridentifycenter.com  | Virus-detector.net  | Virusdetect24.com  | Virusermoverpro2009.com  | Virusermoverpro2010.com  | Viruskill2010.com  | Virusremoveonline.com  | Web-antispyware.com  | Webantispysoftpro.com  | Websantispyware.com  | Webspydetectunlim.com  | Winguard2009.com  | Winguard2010.com  | Winshield2010.com  | Winvantivirus.com  | World-antispyware.com  | Worldantispyware1.com  | Worldprotection.net  | Worldsantispysoft.com  | 812jid.com  | 89364.net  | Nsrdomain.com  | Stpxy.com  | Carsaudioforum.com  | Clubusamusicguide.com  | Alphaprogressgroup.com  | An-ty-virustoday.net  | Antivirussoftspoken.com  | Antyvirustoolonline.net  | Bestinternetportal.com  | Bestsecuritylawyers.com  | Bestsecuritytool.net  | Bestsecurityworld.com  | Bordersecuritytools.net  | Buyonlineinternet.com  | Essentialoilharmony.com  | Greatbillingupdate.com  | Readnetbooks.com  | Scanbankonline.com  | Scanchinanet.com  | Superscanjet.com  | Trojanscansite.com  | Yourscantool.com  | Antispywareeasy.com  | Antispywaresoftonline.net  | Antyillegalsoftware.com  | Antyillegalsoftwaretool.com  | Antyspywaresonline.com  | Antyspywaretoolblog.com  | Ewebcheck.com  | Supersecurty.com  | Pianetaspywareremove.com  | Rootkiteraser.com  | Antiageonline.com  | Virusscanersite.com  | Antivirusscanimages.com  | Antyspyvarescapean.com  | Malwareremovesite.com  | Thebossremover.com  | Legacyvirusscan.com  | Newscanlifeonline.com  | Scanonlinesitenow.com

Posted by sandi with no comments
Filed under:

ALERT: Please treat the following domains with extreme caution

advertisingcommunity-s.com
ICANN Registrar: DIRECTI
Created 2 November 2009

IP: 217.23.10.16 - Worldstream, Netherlands.

Registrant hidden behind Privacy Protect, dedicated hosting.

Implicated in malvertizing incidents before:
http://www.mywot.com/en/scorecard/advertisingcommunity-s.com

*****

adrime.net
ICANN Registrar: ENOM, INC
Created 18 November 2009

IP: 64.27.26.81 - Calpop.com Inc, Los Angeles

Registration Service: director@climbing-games.com (www.ruler-domains.com) - a familiar name and email address; see here for an example of past history: http://msmvps.com/blogs/spywaresucks/archive/2009/04/23/1690203.aspx

Registrant: Pol Andersson (pol@hiparis.fr)
70, Rue Hautpoul
Paris, 75019
FR

Sharing IP with ad-spenser.com, adendum.net, colorednews.com, eu-planning.com, exanza.net, ie-adv.com, inclick-eu.com, maps-europe.net

Digging around I find a NS connection with impressionsreport.com, advunit.com

Posted by sandi with no comments
Filed under:

Quote of the day…

The point is that I was dumb enough to think that Ubuntu was secure enough out here in the Linux wonderland that I love so much that I ended up on gnome-look downloading everything that looked cool without examining everything first.

 

The quote is taken from a thread about a “screensaver” for Ubuntu, sourced from gnome-look.org, that installed malicious script (as reported here).  There was also a dangerous “theme” entitled “Ninja Black” (info here).

Here is a message, allegedly from the screensaver author – scary, yes?

image

 

I have been saying this for years … we need to stop saying "use this - its better".  They need to say "use this - its better - but make sure you check regularly for security updates and patches, and always practice safe hex".  I’m not going to say “only install software from trusted sources”, because even the trustworthy screw up – let’s not forget what happened to Mozilla when the Vietnamese Language Pack trojan was uploaded to addons.mozilla.org, orthat there were HP drivers infected with a virusLenovo has been hit, as has ASUS.

Remember, there is no software on this planet that will protect its users from attack via social engineering.  It may be able to protect you from infection **without user interaction** to some extent, but it can’t protect you from yourself.

So, do you think that there is yet another World of Warcraft account theft operation planned?

image

 

 

All of the following domains list XINNET as the Registrar:

worldofwaracrft.com (created 15 November 2009)
IP: 98.126.210.19 - Krypt Technologies

worldofwaruraft.com (created 24 December 2009)
IP: 174.139.248.82 - Krypt Technologies
Sharing IP with worldofwancraft.com (created 17 December 2009)

worldofwrracraft.com (created 27 December 2009)
IP: 98.126.122.67 - Krypt Technologies

worldofwarcraft-account-instructions.com (created 27 December 2009)
IP: 74.63.200.104 - Limestone Networks

worldofwurcraft.com (created 24 December 2009)
IP: 174.139.248.82 - Krypt Technologies

worldofwarcraft-account-management.com (created 21 December 2009)
IP: 205.209.136.189 - Managed Solutions Group Inc

worldofwarcracrft.com (created 15 November 2009)
IP: 98.126.210.19 - Krypt Technologies

worldofwarcraft-wowaccountadmin.com (created 19 December 2009)
IP: 205.209.161.30 - Managed Solutions Group Inc

worldofwarcraft-account-notification.com (created 24 December 2009)
IP: 205.209.161.30 - Managed Solutions Group Inc

 

Edit… and another one:

worldofwarcraft-accountlogin.com (created 25 December 2009)
IP: 205.209.184.15 - Managed Solutions Group Inc

Badly implemented password security

Go to https://twitter.com/signup, right click the page, and then select “View Page Source” (FF/Google Chrome) or “View Source” (IE).  There, in all its glory, you will find Twitter’s list of forbidden passwords (all credit to Sophos who pointed out that the list was available for all to see).

For what its worth, I have long since stopped advising that people use “strong passwords”.  Rather, I encourage the use of “pass phrases”.  Unfortunately, pass phrases don’t work with web sites that limit the number of characters that you can use, or do not allow non standard characters such as spaces (sadly, there are still too many web sites that do that) but for the rest, pass phrases such as “I may move slow but I look good!” are very easy to remember, and extremely difficult to crack.

BTW, the password “password1234” is accepted by Twitter (and is assessed by the Twitter sign-up page as “strong”), as is “1password” and “!@#$%^&*()” and “twitter123” (assessed as “good”)… I’m not sure what security Twitter thinks they are achieving…

image

Malvertizing at tweetmeme.com?

image

image

 

Wayne Small, the owner of sbsfaq.com called me today and asked me to look into a malvertizing incident that he experienced while at tweetmeme.com.  You can see his report here.

I have not been able to reproduce the behavior that Wayne saw thus far, but do note that tweetmeme seems to be using openx. 

There is a vulnerability in older versions of openx that may allow a remote attacker to gain administrator access to the adserver. It is strongly recommended that all users upgrade their systems to 2.8.3 which, apparently, fixes the problem. The download is available at http://www.openx.org/ad-server/download.  Information about the openx hack can be found here

A news report about an openx hack incident can be found here.

I cannot say that an openx vulnerability is definitely the cause of the problem that Wayne saw at tweetmeme, but it seems to be a likely candidate.  The only ads that I am seeing at tweetmeme at this point in time are Google/Doubleclick advertisements.  Google/Doubleclick are, more often than not, clean (although they have had problems in the past).  I am not seeing any evidence of content being hosted on suspicious domains.

Posted by sandi with no comments
Filed under: ,

Silent Noise was hacked?

See here:
http://matchent.com/wpress/?q=node/500

 

What is interesting is the IP address that the author of the blog post cites as the source of the trouble - 72.167.232.86.

72.167.232.86 belongs to GoDaddy (p3nlh036.shr.prod.phx3.secureserver.net).  The server at that IP is host to over 4,000 web sites.

 

As for how Silent Noise was hacked – that I cannot answer.  My first guess was that they were using WordPress but it looks like they may have migrated to Drupal (according to a blog post back in 2008).  If Drupal, there are security advisories for the Drupal Core, as well as “contributed projects” that should be investigated.

For example, look at this one:
http://drupal.org/node/579482

The description of the vulnerability reveals that:

“The core OpenID module does not correctly implement Form API for the form that allows one to link user accounts with OpenID identifiers. A malicious user is therefore able to use cross site request forgeries to add attacker controlled OpenID identities to existing accounts. These OpenID identities can then be used to gain access to the affected accounts.”

A nasty vulnerability.  It just goes to show – you need to keep *all* of your software updated *all of the time*. 

ALERT: Please treat content from these domains with caution…

cdn-adrotation.com
cdn-businessweek.com
cdn-gamingahead.com
cdn-justin.tv
cdn-ovguide.com
cdn-thestreet.com
cdn-transworld.net
cdn-veoh.com
pdnads.com

The Registrants are all hidden behind Domains By Proxy, Inc, all domains are hosted at IP 74.81.169.61 (carohosting.net), all were registered using Godaddy, and all were created on 14 July 2009.

All are using name servers at softdreams.eu

softdreams.eu was registered on 6 February 2009 to a Ionut Bogdan Dumitru, Str.Zambielor nr. 6, bl. 60, ap.5, sector 2, 032801 Bucuresti, Romania.

You'll see that there was a complaint about cdn-adrotation.com content back in September of this year at gaiaonline.com (a web site that has had more than its fair share of malvertizing):

http://www.gaiaonline.com/forum/bug-reports-technical-support/report-inappropriate-ads-on-gaia/t.41805411_1621/?sequence=1621

and the Kaspersky forums:

http://forum.kaspersky.com/lofiversion/index.php/t138891.html

As well as a smattering of other places.

It is concerning that names such as businessweek and veoh are there.  In fact, take away "cdn-" and every single URL leads to legitimate domain (except for adrotation.com).

It makes you wonder if the domains are intended for use to impersonate legitimate websites such as businessweek.com and veoh.com…

Posted by sandi with no comments
Filed under:
More Posts Next page »