Category: Uncategorized

Just for fun, Sunbelt researcher Adam Thomas (who discovered the VML exploit yesterday) has cataloged what is installed with one installation he observed.   Epic quantities of junk:

Virtumonde
Trojan-PSW.Win32.Sinowal.aq
BookedSpace Browser Plug-in
AvenueMedia.InternetOptimizer
Claria.GAIN.CommonElements
Mirar Toolbar
7FaSSt Toolbar
webHancer
Trojan.SvcHost
Trojan.Delf
Begin2Search Toolbar
MediaMotor Trojan Downloader
Trojan-Downloader.Winstall
TargetSaver Browser Plug-in
InternetOffers Adware
SurfSideKick
Trojan.Vxgame
SafeSurfing.RsyncMon
Trojan-Downloader.Small
Freeprod/Toolbar888
ConsumerAlertSystem.CASClient
SpySheriff
Trojan-Downloader.Qoologic
Zenotecnico
Command Service
WebNexus
Webext Browser Plug-in
Trojan-Downloader.Gen
Danmec.B-dll
Traff-Acc
EliteMediaGroup
NetMon
TagASaurus
Trojan-Downloader.Win32.Small.awa
FullContext.EQAdvice
Trojan-Clicker.Win32.VB.ij
Yazzle.Cowabanga Misc
Backdoor.Shellbot
Trojan.Danmec
TopInstalls.Banners
Trojan-Dropper.Delf.VA
Adware.Batty
Trojan-Downloader.Win32.Small.cyh
Toolbar.CommonElements
Trojan.Win32.PePatch.dw
Backdoor.Win32.Delf.aml
BookedSpace 

In other words, your machine is beyond pwned.  (Note that this just happens to be what one bad boy has included as a payload.  Anything could be put in there.  Just one simple trojan.  Or a whole boatload of crap. Also this is a listing from a spyware scan and probably has some overlapping items.)

As Roger Thompson of Exploit Prevention Labs said today to eWeek:

“This is a massive malware run,” says Roger Thompson, chief technical officer at Atlanta-based Exploit Prevention Labs. In an interview with eWEEK, Thompson confirmed the drive-by attacks are hosing infected machines with browser tool bars and spyware programs with stealth rootkit capabilities.

In other news, word on the street is that Microsoft is targeting this flaw to be patched on October 10th, the next patch day — unless things get really bad out there.  Hmm…

Late Tuesday morning, Microsoft acknowledged the bug, and said it was working on a fix. “The security update is now being finalized through testing to ensure quality and application compatibility and is on schedule to be released as part of the October security updates on October 10, 2006, or sooner as warranted,” a spokesman said. Other details, however, such as whether IE 7 users were at risk, were not forthcoming.

Link here.   MS Security Advisory here.

The security community is engaged on this exploit:

CERT advisory.

ISS advisory. 

SANS handler diary entry.

More as I get it.

Alex Eckelberry

Follow-up to the zero day Sunbelt researchers found yesterday:

Secunia advisory issued: 

A vulnerability has been discovered in Microsoft Internet Explorer, which can be exploited by malicious people to compromise a user’s system. Link here.

Washington Post article:

A previously undocumented flaw in Microsoft‘s Internet Explorer Web browser is reportedly being exploited by online criminals to install an entire kitchen sink of malicious software on any computer that visits any of a handful of sites currently exploiting the vulnerability.  Link here.

Slashdot here.

On Digg here.

eWeek story here.

 

Alex Eckelberry

Our security research team has observed a new zero day exploit being used to infect systems.  Coming from a porn website, this particular one is a vulnerability in VML inside of Internet Explorer.  

On a sample Vmware, the following behavior was observed:

The machine was fully patched —

And just to double-check, we ran an MBSA scan which confirmed the box as fully patched:

Then, the exploit code proceeds to install spyware. 

The exploit uses a bug in VML in Internet Explorer to overflow a buffer and inject shellcode.   It is currently on and off again at a number of sites.

Security researchers at Microsoft have been informed.

This story is developing and research is ongoing.   Security professionals can contact me for collaboration or further information.

This exploit can be mitigated by turning off Javascripting. 

Update: Turning off Javascripting is no longer a valid mitigation.   A valid mitigation is unregistering the VML dll. 

Eric Sites
VP of R&D

Update: Microsoft advisory here.  See our main blog for other updates as well.

Spam stats from TQM3

Link here (thanks Kurt).

Alex Eckelberry

David Linhardt is funny.  Here’s one of his emails that he sent a couple of years ago to the Spamhaus folks:

…You’re not interested in the truth. You just get your rocks off by illegally interfering with legitimate business and illegally restraining trade. It must be a real power rush for you.

I’m sorry God gave you such a small penis. 

(Surprisingly, as a spammer, he passed up a natural opportunity to pitch a solution to this alleged size problem.)    

Anyway, apart from the sophomoric humor value in his emails, Dave did something else funny:  He sued Spamhaus.  And won.  But no one really cares, because it was a default judgment in Illinois and SpamHaus is in the UK (at one time, housed on a houseboat on the Thames river). 

David can join others who claim Spamhaus is a secret group that “tightly controls free speech on the Internet”.  There’s not much else he can do, apart from try and sue in the UK — and I sincerely doubt that he will make that mistake.

More here via /.

Alex Eckelberry

 

 

Direct Revenue filed to dismiss the New York AG’s lawsuit a while back, but I’m not sure many have seen the document: 

Direct Revenue claims that the New York Attorney General’s lawsuit is over “historic” practices that were “commonplace” at the time, and “utilized by such well-known companies as Google and Ask Jeeves”. Direct Revenue explains that it advertises on behalf of “mainstream companies like JPMorgan Chase, Priceline, and United Airlines.”

More here (and you can view the motion itself here at CollinsLaw).

This one is funny:

So it was free, it was ok? And consumers “affirmately desired to obtain” this software? And they received the software and ads “as promised”?  Lollers!!!!

Of course, they are trying to argue a technicality.  We’ll just have to see what happens.

 

Alex Eckelberry

Back in 2001, our chief scientist for security, Joe Wells, wrote a seminal piece on antivirus testing.  It’s called Pragmatic Anti-Virus Testing and if you’re involved in testing security products, it’s well worth a read.   Joe has an extensive experience in antivirus research and testing, having been involved in this field for almost 20 years at IBM Thomas Watson Labs, Symantec, Trend and other companies.  He also founded the Wildlist.

We can talk to technical managers in large corporations who deal with AV problems every day. (Now, there’s a novel idea: ask users what they want to see tested.) This means it’s time to admit
that these people know their jobs and know what they need. In the past, some AV ‘experts’ have interpreted user requests as ‘wants’ as opposed to ‘needs’. (‘We know better than the users. We’ll
give them what they really need.’) This ideology is wrong. We do not know the users’ situation and environment better than they do. When they say they need something, they genuinely do need
it. We must listen to them – recognizing them as the professionals they are. Taking their requests and suggestions into consideration will help us fulfill their needs.

There are resources available to us within our own industry. A testing organization can ask an AV company how their product should be tested: QA staff should be asked what they test and how
they do it, and technical support staff should be asked what ‘really’ needs to be tested in a product, based on their experience of the problems they have encountered.

I’ve posted the entire piece here.

On a side note, Joe was recently interviewed by a magazine.  They wanted some pictures of him, and of course, he sent pics of himself in his usual ultra-casual clothing. 

Well, they wanted him looking more “corporate”. So this morning, Joe comes in for the photo shoot dressed in a suit and tie.  But take a look at the tie.

Always the renegade…

ALex Eckelberry

New fake codec site as of 9/12/2006:

Whois Data:
85.255.118.194 
strcodec.com   
Marinkovic Petronije      
wm @ strcodec.com     
Stepojevac        CS

Partick Jordan

The bureaucratic  monolith of the Department of Homeland Security (this is an organization larger than even a superstar manager like Jack Welch could manage), put on training exercise back in February, dubbed Cyber Storm:  

The results? The AP says an internal agency document shows the simulated attacks bombed or otherwise infiltrated computer servers, crashing the Federal Aviation Administration’s control system, defacing newspaper Web sites and threatening power outages. Apparently the defenders had trouble recognizing coordinated assaults and even more trouble coordinating their responses among dozens of agencies and entities who had yet to be formally introduced. 

Link here.

No wonder this agency hasn’t been able to keep a cyber security czar around. 

(To be fair, this is the kind of stuff you find when you do such exercises.  My beef is with the idiocy of joining together a vast army of different agencies under one wing — and then expect it all to work right, whether in a hurricane or a cyber attack).

 

Alex Eckelberry

Robert LaFollette (above), our creative director, just got back from a trip to the San Francisco bay area for a photography workshop.  He took some amazing pictures.

Link here (and his blog is here).

Alex

We love what Zango does for the MySpace community.  Security researcher Brian Porter ran across this one recently.  You just hit the page http://www.myspace(dot)com/82959792 and immediately get hit with a Zango installer to watch a movie.

What you get for all this is a 30 second idiotic “commercial” of a man rolling his eyes:

Nothing new, PaperGhost over at Vitalsecurity.org has been on this for some time.  Just more background noise from “a small group of fixated critics”.

Alex Eckelberry

From PIRT:

1. PayPal  
2. eBay  
3. Bank of America  
4. Fifth Third Bank  
5. Wachovia  
6. Nationwide  
7. Bank of Scotland (Halifax)  
8. Volksbank  
9. e-gold  
10. Barclays 
11. Halifax  
12. Wells Fargo  
13. CitiBank  
14. National Credit Union Administration  
15. NAFCU  
16. Commonwealth – NetBank  
17. Michigan Schools and Government Credit Union  
18. Chase  
19. Texas Dow Employees Credit Union  
20. National Australia Bank  
21. Lloyds TSB  
22. Bank of Scotland  
23. Banesto  
24. Flagstar Bank  
25. IRS 
26. Key Bank  
27. St. George Bank  
28. Banca Fideuram  
29. EGG  
30. Desjardins 

Link here.

Remember, we always need more volunteers for phishing takedown… feel free to volunteer here.

Alex Eckelberry

Lance James is a good friend of ours and an epic guru on phishing (heck, he’s even got a book about it).   He’s doing a webcast on phishing, sponsored by us.

Here’s a brief description:

WEBCAST:  Phishing exposed
WHEN:     Premieres September 19, 2006 – available on demand
SPEAKER: Lance James, Author, “Phishing Exposed”

Information security and phishing expert Lance James exposes the world of undercover phishing operations. He reveals the sophisticated techniques used by phishers and explains how to protect your data from phishing attacks. Register for this webcast here.

Feel free to join us for this seminar!

 

Alex Eckelberry

Vitalsecurity follows-up on our post yesterday with more:

Well, sadly the guy who owns that site also happens to own the Paris Hilton site covered here by Sunbelt. They get you to download completely fake “videos” that actually install lots of Dollar Revenue Adware (and some other stuff, too). It’s a big, fat, fake scam and it stinks. Now that we’ve established this guy pushes Zango videos from the car-chick site, do you think I’m about to directly tie Zango in with the wonderfully deceptive Paris Hilton site? Well, take a wild guess.

Link here.

Alex Eckelberry

How to change taskbar grouping behavior
You can configure the taskbar Properties in XP to group similar items together (for instance, all open Word documents) when the buttons start to get too small. By default, the items are group in the order they were opened (the one opened first is first in the group, etc.). You can change the grouping behavior by editing the registry. Here’s how:

1. Open your favorite registry editor and navigate to this key: HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
2. Create or open the DWORD entry called TaskbarGroupSize.
3. In the Value Data field, enter one of the following values, depending on how you want items to be grouped: 0 = group by age (this is the default); 1 = group by size, largest first; 2 = group any group of two or more; 3 = group any group of 3 or more.
4. Close the registry editor.

You have to log off and log back on before the change takes effect, and it only applies to the user account logged on when the change is made.

How to Tweak the XP Recovery Console
Here’s a very useful article that shows you how to remove the built-in restrictions on XP’s Recovery Console so you can use it to work anywhere on the hard drive, use removable media, and more, here.

This month’s Patch Tuesday looks like a light one
Patch Tuesday is today, but it appears there will only be three security updates released this month, with one of these (for Office) listed as critical. Read more here.

Running a web site on XP.
If you want want to run your own web site and host it on your XP system, you need web server software. If you’re running Windows XP Pro, you can install Internet Information Service (IIS) 5.1 through the Control Panel | Add/Remove Programs | Windows Components. IIS 5.1 has some limitations: you can only create one site, and only ten people can connect to it simultaneously. That may be sufficient for a family site. If you need a more robust site or multiple sites, you can get Windows Server 2003 Web Edition, which costs much less than the other editions of Server 2003 ($399, as opposed to $999 for standard edition) and includes IIS 6.0.

Another option is to run the open source Apache web server on XP. For more info, click here.

Finally, consider your Internet connection bandwidth and terms of service. You need a decent upstream speed (preferably at least 384Kbps) for those who visit your site to have a pleasant experience. Many ISPs throttle upstream bandwidth. Some also prohibit running servers in their TOS, so check your contract. You also need a static IP address, or you’ll need to use a service such as TZO’s dynamic DNS to map your domain name to a dynamic IP address.

But remember: When you set up your own website, you are responsible for the security of that site.  All too many times, we see websites hacked to run phishing operations and malware, simply because the administrator of that website didn’t keep the web server software updated to the latest version, or didn’t put in basic security. 

Error 633 when starting broadband connection
If you try to connect to your broadband service and get an error message that says “the modem (or other connecting device) is already in use or is not configured properly,” it usually means you already have an active connection. The solution is to disconnect the existing connection before trying to establish the new connection. See KB article 279658.

Taskbar appears on the wrong monitor
If you’re using multiple monitors in XP and you change the monitor you want to be primary monitor and then log off, you may find when you log back on that the taskbar appears on the secondary monitor, even though your icons are on the primary monitor. This can happen when you use a video adapter. Luckily, there’s a simple procedure for fixing the problem. Just follow the steps in KB article 905776.

Desktop icons randomly change
A common problem we hear about is when some of the icons on the XP desktop and/or on the Quick Launch bar randomly change to a different icon. This happens when the icon cache isn’t properly updated. There’s a registry edit that can fix it, but be sure to backup the registry and use caution when making changes. You can find step by step instructions in KB article 132668.

New Vista Networking Features
Microsoft completely rewrote the TCP/IP stack in Vista, making a number of improvements. Some of these, such as native support for IPv6, won’t mean much to the average home or office user. Others, like the new algorithms that should result in a considerable improvement in network speed/improvement for those with fast broadband connections, will be welcome by all.

The new Network Center, which replaces My Network Places, may take a little getting used to. I like the graphical map of the network, and it’s nice that you can use the Personalize feature to change the name and icon of a network connection. This is especially useful when connecting to wireless networks that were previously identified by their SSIDs (which was often something generic like Linksys3345).

You can read more about Vista’s new networking features here.

Deb Shinder, MVP

From getting married to running for office, it seems you can do just about everything online these days. Childbirth, memorial services and almost everything in between – they’re all turning up on the web. We’ve talked before about how important the Internet has become in doing everyday tasks like paying our bills and keeping in touch with our friends and families. Now we’re also marking many of the big milestones of our lives on the ‘Net, too.

Last weekend, our local paper did a feature on the phenomenon of online weddings (link).

It seems that for a price (ranging from a few hundred to a couple thousand dollars) you can broadcast a live feed of your wedding ceremony over the Internet, so that those who aren’t able to make it in person can be there not just in spirit, but in virtual reality, too. The video can also be saved and posted for a period of time following the wedding, so that your guests not only don’t have to travel, they don’t even have to be free at the time of the wedding.

I can see how this is useful when you have elderly relatives who aren’t able to physically get to your wedding location, and it could certainly save folks a lot of money (virtual guests don’t even need to worry about getting dressed up to attend), but I don’t know – to me, it’s just not the same as being there. I hope it remains a supplement to, and not a replacement for, the “real thing.”

If saying your vows in front of a virtual audience “out there” somewhere isn’t exhibitionist enough for you, we’ve also heard of a few mothers “going live” with the video of their babies’ births. I guess this is the natural extension of recording the birth (something I did with my own homebirth); I just hope these folks are putting password protection on those web files. I’d hate to know that just any stranger could stumble across such video.

Politicians are using the Internet to their advantage more and more, finding it a relatively cheap and effective way to reach voters. Back in the 80s when I ran for city council, I had to rely on ads in the local newspaper, yard signs, flyers and good old-fashioned door-to-door handshaking. Today you could theoretically get elected to public office without ever leaving the comfort of your home.

Even at the end of life, the ‘Net is still there. Memorial web sites are becoming a popular service for funeral homes. For example, Lifestorynet (www.lifestorynet.com) is a site on which funeral homes post a biographical web presentation with photos and text of the deceased. Online-Funeral (www.online- funeral.com) provides “live” coverage of the visitation room at the funeral home and saved video footage of the funeral service, as well as a family website where you can send messages to the family, and sells CDs of the funeral. Many major newspapers now include online guest books in their obituaries section where friends and families can share memories and express condolences. An example is here.

What do you think about this “cradle to grave” Internet archiving of our lives? Is it a great new way to share important life events with more people and extend our families, or does it constitute an invasion of the little privacy that we have left? Would you want your wedding, birth of your baby, or funeral services to be available online? 

Deb Shinder, MVP

Adam Thomas in our spyware research team caught two more security scam codec sites right after I posted my blog.

icodecpack(dot)com           
85.255.118.13   
Nikita Englund Freecodecs ltd    
nik @ freeecodecs.net
Albany NY         US

playercodec(dot)net
216.255.176.178           
Hilary Reed      
webmaster @ playercodec.net
Bastad  SE

Alex Eckelberry

DollarRevenue, a fruitful source of malware, just keeps having fun with users.

First, we search for “sexy paris hilton” in Google, and get a hit — the first one.

Then we click on the video picture to view it.

We get an install box. No EULA appears and to the casual surfer, it just seems like you’re installing the video. 

The installer, sexybabesx(dot)com/parisspicyburger.exe (Virustotal) actually calls the loader file from promo.dollarrevenue(dot)com/bundle/loader.exe.  And your life, at that point, is no fun at all.  

You can see a movie, here.

Alex Eckelberry
(With copious acknowledgement to Patrick Jordan in our spyware research team)

A new fake code site, movscodec(dot)com, hosted (not surprisingly) by the infamous Intercage/Atrivo.  

These fake codecs are bad news and this one is no better. A user recently told us:

“This disgusting program installed itself when I was told I needed to install a codec to view a movie about my stocks. I was prompted to buy tons of programs and my computer hasn’t been successfully cleaned since.”

Movscodec is even blatant about what they do in their EULA:

SOFTWARE INSTALLATION: Components bundled with our software may report to Licensor and/or its affiliates the installation status of certain marketing offers, such as toolbars, and also generalized installation information, such as language preference and operating system version, to assist Licensor in its product development. No personal information will be communicated to MEDIA-CODEC or its affiliates during this process. Licensor may offer additional components through our version checking/update system. These components include:
(a) “Internet Explorer Security Plugin 2006”: Internet Explorer toolbar that protects your computer while you browse by setting high level of security for suspicious hosts.
(b) “Public Messenger ver 2.03”: Popup advertising module that opens Internet Explorer ad windows when you are connected to internet.
(c) “Internet Security Add-On”: your Internet Explorer homepage will be changed.
(d) Security software: antivirus/antispyware application.

Other similar sites include:

dvdcodec(dot)net
emcodec(dot)com
emediacodec(dot)com
emediacodec(dot)com
imediacodec(dot)com
Intcodec(dot)com
media-codec(dot)com
mediacodec(dot)net
media-codec(dot)net 
movscodec(dot)com
mpgcodec(dot)com
nvidcodec(dot)com
nvidcodec(dot)com
pcodec(dot)com
svideocodec(dot)com 
vcodec(dot)com
V-codec(dot)com
vcodecdownload(dot)com
vcodec-download(dot)com
vcodecget(dot)com
vcodec-get(dot)com
vcodecpull(dot)com
Vicodec(dot)com
Vidcodec(dot)com
vidscodec(dot)com
zcodec(dot)com

Alex Eckelberry
(Thanks to Sunbelt researchers Patrick Jordan and Adam Thomas)

Free AD browser 
Nice Windows freeware AD browsing with self-service and optional chat. Easy to deploy via GP Software Installation and ADM template.  Link here.

Process killer
This little tool shows you which process locks a file and allows you to kill that process. Quite useful! Appropriately named “Who Lock Me”. Link here.

Expert Q&A: Virtualization.info Founder Shares Thoughts
In this expert interview, read the thoughts of Alessandro Perilli, the Internet’s most well-known virtualization advocate and author of the popular virtualization.info blog. Learn what he had to say about the next big technology shifts in the virtualization arena, what Xen has to do to compete with VMware and ways to learn more about virtualization. At SearchServerVirtualization.com.

Top 10 SQL Server Security Tips
Password cracking and SQL Server hacking tips topped the list of favorites on SearchSQLServer.com during the first half of 2006. View all of the top 10 tips that piqued reader’s SQL Server security interests. Some of the tips you will find include: ten hacker tricks to exploit SQL Server systems, discover and lock down vulnerable SQL Server services, and password cracking tools for SQL Server. At SearchSQLServer.com (free registration required).

Add Gigabytes By Reducing Disk Space For XP’s System Restore
Perhaps the fastest way to a few gigabytes more on a disk is to reduce the amount of disk space devoted to XP’s System Restore feature. Learn more in this tip.

VMware On Mac Will Do Little To Ease Desktop Management Pain
VMware Mac product will not impact desktop management or help standardize platforms in heterogeneous shops. Read more in this article.

When ActiveSync Won’t Download Mailbox Items To Mobile Devices
One of the toughest problems to troubleshoot is when Exchange ActiveSync won’t download mailbox items to a portable device. In this tip, contributor Serdar Yegulalp outlines the potential causes. At the SearchExchange site.

New: Draft Guidelines on Electronic Mail Security
The Computer Security Division of the National Institute of Standards and Technology has come out with a number of draft publications. One of these, SP 800-45A, “Guidelines on Electronic Mail Security,” is intended to aid organizations in the installation, configuration, and maintenance of secure mail servers and mail clients.” It’s a 143-page document with an awesome amount of really useful information. Link here.

Microsoft, Cisco Release NAP/NAC Roadmap
Microsoft and Cisco released plans on just how they would make their competing security architectures interoperable. At the Security Standard conference in Boston this week, they demonstrated an architecture that will enable interoperability between Cisco’s Network Admission Control and Microsoft’s Network Access Protection technology. The two had promised interoperability between their network access security offerings two years ago. They plan beta testing of the architecture by the end of the year. General availability is expected in the second half of 2007, following the launch of Microsoft’s “Longhorn” Server. More at SearchWinIT.com.

Stu