Month: September 2006

Busy past few weeks … first the VML exploit (now patched by Microsoft), then the daxtcle.ocx exploit (not patched yet), and then last night, our friend Roger Thompson reported seeing another exploit, commonly referred to as “setslice” [since it uses the setslice() method to exploit] in the wild.

Mitigation methods are basically non-existent in Microsoft’s advisory, so the best source of information on mitigation is this SANS entry here. The SANS website links to a test page.  Run the test page, see if your browser crashes.  Then run the program they have made available to set the kill bits. 

Also, both ZERT and Determina have relead temporary patches against this exploit, here.  

Secunia advisory here.

Be safe.

Alex Eckelberry

 

It turns out that one of the methods HP investigators used was a service called ReadNotify.  It’s a tracker that tells someone when an email is open by a designated recipient.   Basically, it drops a small amount of html code into an email that reports back when you’ve opened the email (this is usually referred to as a web bug).

Email spyware?  Yes, and remember that if you subscribe to newsletters and the like, chances are that email’s delivery is already being tracked through web bugs.  And spammers have certainly used this trick to track what email addresses are live. But Readnotify is a little scarier — it’s not some nameless tracking of broad open rates on emails — it’s someone who is personally tracking the emails they’ve sent you. 

Creepy?  Yup.

Using ReadNotify is fairly straightforward (after you signup with their service):  You can either download a plug-in, or you can simply append “.readnotify.com” after the end of an email.

The email looks normal, so the only way you can tell if you’re being tracked is by looking in the message header. 

Or, if you read messages in plain text, you’ll see the web bug they put in the email, and can readily see if you’re being tracked (and also, if you’re in plain text, the tracking won’t work).  The emails will also ask you for a Return Receipt (which I routinely ignore, despicable things that they are).

However, if you prefer to keep reading email with pretty fonts and graphics (as opposed to plain text, which is always the safest method), you can create a simple Outlook rule to look for Readnotify.

For example, you could create a simple rule in Outlook which puts a colored flag or some time of visual cue whenever someone sends you a Readnotify message.  It’s not perfect, but it’s a start.

Simply create an Outlook rule, select “with specific words in the message header” and then add the following strings:

readnotify.com
readnotify
emsvr.com

(If you need help creating rules, twclark has a nice explanation of creating x-header rules — at least for spam — here.)

Also, turning off images in your email program should stop the notification to Readnotify as well..

As a side note, Emsvr.com, related to readnotify.com, has one of the creepier websites, using “The great leap forward” to describe their service.  Never mind that the term “the great leap forward” is generally associated with Mao Tse Tung’s disastours attempt to rapidly advance China, leading to the deaths of, oh, about 14–20 million Chinese.   The site also inserts “We hope you enjoyed your www.emsvr.com site visit” persistently into your clipboard.”.  Like I said, creepy.

I’m sure some enterprising fellow will think up a better Outlook rule than me, so feel free to drop a comment if you’ve got a better idea. And keep in mind these rules will only work for Readnotify, and not other email tracking services — and will only work as long as Readnotify puts that domain into the email.

Alex Eckelberry

If you’d like to test our new beta 2.0, please follow the instructions in this post.

I think it’s a pretty cool new product and we’d really appreciate any feedback you might have on it.

To my competitors:  Hey, you’ll just have to wait until we release it 😉

Alex Eckelberry

 

Faithful blog reader Jack Duggan sent me this little example of greeting card malware:

Date: Tue, 26 Sep 2006 18:37:33 +0000
From: Abigail <Lewisqure@voltronik.pl>
Subject: You’ve got an “e-card” at .greeting-cards.com..
Reply-to: Abigail <Lewisqure@voltronik.pl>
X-Virus-Scanned: by amavisd-new at voltronik.pl
User-Agent: Mozilla 4.73 [en]C-SYMPA  (Win98; U)
Original-recipient: rfc822;jxduggan@optonline.net

Dear recipient !
sender at Abigail sent you an “e-card”
“Here’s the Rub” from ‘greeting-cards’ !
Click_here_to_view_the_”e-card”.

This ecard will be stored for one week, so
print or save the “e-card” as soon as possible.

Hope you enjoy our “e-cards”! Spread the love and send one of our “e-cards”!

Brought to you by ‘greeting cards’ – a better way to greet!

If you happen to click on “Click_here_to_view_the_e-card, you’ll get sent to this site below (made to look like a legitimate greeting card site, but using stolen graphics), which tells you that your flash player is outdated.  If you install this fake flash player, you get two Haxdoor variants — really nasty stuff.  

 

We were able to access the website where the malware author is counting the installs done using this scam, and we see about 2,500 installs so far on this.  Maybe not a large number, but that’s 2,500 users who may be facing a very unpleasant time.

Alex Eckelberry

Just a reminder to do the following before patching your system from Microsoft with the VML patch:

If you’ve unregistered the vgx.dll, you will need to re-register it.  This can be done by typing the following command in the StartRun dialog:

regsvr32 “%CommonProgramFiles%Microsoft SharedVGXvgx.dll  

This will also work to rollback the ZERT patch.

 

Alex Eckelberry

Out of cycle…

Typical download size: 250 KB , less than 1 minute
A security issue has been identified in the way Vector Markup Language (VML) is handled that could allow an attacker to compromise a computer running Microsoft Windows and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.  

Check Windowsupdate.

Alex Eckelberry
(Thanks F-secure)

Bad hard drive sounds
If your had drive is making a funky sound, you can go to this useful website. For example, a slow spindle motor sounds like this.

Vista Sidebar and Gadgets
One new feature in Vista that beta testers seem to either love or hate is the Sidebar, which appears by default vertically aligned on the right side of your monitor screen and contains a variety of “gadgets,” little quickly-accessed applications like a notepad for typing or pasting quick notes, an RSS feed display, weather forecasts, CPU and memory monitors, a slideshow that displays the photos in your Pictures folder, a stock ticker, clocks, a calculator and much more. See the sidebar here.  

You can choose from the gadgets included in Vista, or download new ones from the Microsoft Windows Live Gallery web site. You can move the sidebar to a secondary monitor or to the left side of the screen, and you can turn it off if you don’t like it taking up screen real estate.  Link here.

How to get the look of Vista without giving up XP
Some have written me to say that they tried the Vista beta and love the new interface – but went back to XP because their computers had hardware peripherals (usually sound cards or video cards, but sometimes NICs and other essential components) or software applications that wouldn’t work with Vista.

A couple of you have told me that you’ve found a way to get the Vista look on your XP machines by installing the Vista Transformation Pack. Although you don’t get the “under the hood” changes to Windows (such as the new Explorer), it does make XP look and feel more like Vista – including adding the Sidebar. Best of all, it’s free. You can download it from here. (Note that we were unable to download the program from its vendor’s web site. We kept getting an error when we downloaded the file there. Also, there’s a rather silly little dialog box you have to go through to get to the installation program.  Alternative link here.)  

However, strong disclaimers apply — use this software at your own risk.  For example, this dialog box doesn’t engender a great deal of confidence:

I would stay away from and wait for Vista.

Files that are automatically skipped by the backup program
If you use the backup program built into Windows XP, it’s important to note that certain files are skipped by default during the backup and restore process. These include files that are locked by other applications, as well as other files depending on permissions, temporary nature and remote registry files. To find out more about this, see KB article 104169.

Description of Windows File Protection Feature
All editions of Windows XP include Windows File Protection (WFP), which prevents programs from overwriting critical system files, such as .DLL, .EXE and .SYS files that are installed as part of Windows. If you want to know how WFP works and how protected system files can be replaced, see KB article 222193.

Saving files from Office programs resets security settings
If you’re running Windows XP Pro, you can protect your files by setting file level (NTFS) permissions to specify what users or groups can access them, both across the network and on the local machine. However, if you save a file in Microsoft Word, Excel or PowerPoint XP/2003, you may find that the NTFS permissions get reset because of the way Office programs create temp files when you edit them and delete the original files when you save the changes. Luckily, there are some workarounds to this problem. Find out about them in KB article 102888.

Deb Shinder, MVP  

Ben Edelman has just published an exhaustive study on TRUSTe:

…What do I find? In short, nothing good. I examine a sampling of 500,000+ top web sites, as reported by a major ISP. Of the sites certified by TRUSTe, 5.4% are untrustworthy according to SiteAdvisor’s data, compared with just 2.5% untrustworthy sites in the rest of the ISP’s list. So TRUSTe-certified sites are more than twice as likely to be untrustworthy. This result also holds in a regression framework controlling for site popularity (traffic rank) and even a basic notion of site type.

Link here (and a basic understanding of the economic term Adverse selection is useful).

Alex Eckelberry

WebSense writeup here.

We are starting to see mass mailing lures for websites that are hosting VML exploit code. Most of the sites are using updated Web-Attacker code. A recent example that came to us from Message Labs appears to lure users to the site by claiming they have received a Yahoo! Greeting Card. The site downloads and installs an Internet Explorer Browser Helper Object that directs all HTTP posts from forms to a third party, and then collects information on end-users.

Alex Eckelberry

 

Interesting, a group of lawyers have filed an Amicus brief in the New York Attny General’s case against Direct Revenue.  More here via David Fish.

Alex Eckelberry

Juha-Matti Laurio does the hefty lifting, with an extensive FAQ here.

Alex Eckelberry

VML exploit in a fake ecard:

On our test system, the greeting card in question downloaded a number of pieces of executables: is.exe, ie.exe and cpu.exe.

One assumes this will be sent via spam, but we have not seen any samples.

Credit goes to Roger Thompson over at Exploit Labs and Alex Shipp at MessageLabs.

Alex Eckelberry

The daxtcle.ocx exploit is the “other” zero day exploit, which to our knowledge hasn’t been seen in the wild.  However, Adam Thomas in our security research team has just discovered a website with a modified version of the exploit that downloaded malware to a fully patched XP SP2 machine.  The malware site was in a redirect script off of a porn site, in the same area as we discovered the VML exploit.

The exploit downloaded a fake version of svchost.exe, and a DLL was created in %system%hehesox.dll which is receiving commands from a malware site.   The browser did crash, but malware was successfully installed. 

Mitigation: The DirectAnimation Path control can be disabled by setting the kill bit for the following CLSID:  {D7A7D7C3-D47F-11d0-89D3-00A0C90833E6} More information about how to set the kill bit is available in Microsoft Support Document 240797. More at CERT.

This story is developing and research is ongoing.   Security professionals can contact Eric Sites for collaboration or further information.

 

Alex Eckelberry

Yesterday, I blogged about an ISP, HostGator, that had its servers hacked to spread the VML exploit.

More light is shed. 

HostGator says hackers compromised its servers using a previously unknown security hole in cPanel, the control panel software that is widely used by hosting providers. “I can tell you with all accuracy that this is definitely due to a cPanel exploit that provides root access and all cPanel servers are affected,” said HostGator system administrator Tim Greer. “This issue affects all versions of cPanel, from what I can tell, from years ago to the current releases, including Stable, Release, Current and Edge.”

Link here via Ferg.

Alex Eckelberry

My apologies for the constant stream of posts on the VML exploit. I’m really not trying to spread a unnecessary panic here — and we are not at panic levels on this thing.  There’s just a fair amount of data coming out on this thing and this blog has become a bit of a VML tempest.

Anyway, latest interesting news is this:

Hackers have hijacked a large number of sites at web hosting firm HostGator and are seeking to plant trojans on computers of unwitting visitors to customer sites. HostGator customers report that attackers are redirecting their sites to outside web pages that use the unpatched VML exploit in Internet Explorer to install trojans on computers of users. Site owners said iframe code inserted into their web pages was redirecting users to the malware-laden pages.

HostGator general manager Jason Muni told Security Fix that attackers had “reconfigured an unknown number of Web sites hosted on the company’s servers to redirect visitors to a third-party Web site that tried to load the IE exploit.” Muni said the company reconfigured all of its 200 servers to address the problem. But as of 5:30 pm EST Friday, some HostGator customers were continuing to report that their sites were compromised and redirecting visitors, indicating the problems were ongoing.

Link here.

It’s an exploit.  And it works. What else do you expect hackers to do?

The world isn’t coming to an end though.  Just take your normal precautions and unregister the VML dll.

Alex Eckelberry
(with a gracious hat tip to Ferg)

 

New one.

IP/Whois:
85.255.118.196
winmediacodec.com
Alex Baroni-Martins
alex @ winmediacodec.com
Niederfeulen BE

Adam Thomas

Eric Sites here did some quick and dirty testing to see what versions of Outlook are vulnerable to the VML exploit.  Here’s our current list:

Outlook 2007 – 12.0.417.1006, Can view VML but apparently not vulnerable. 
Outlook 2002 – not vulnerable
Outlook 2000 – not vulnerable
Outlook 2003 11.5608.8028 – not vulnerable
Outlook 2003 11.5608.5606– not vulnerable
Outlook 2003 11.6568.6568 SP2 – not tested
Outlook 2003 11.8010.8036 SP2 – vulnerable

So, ironically, your most patched version of Outlook 2003 is the most likely at risk.

A mitigation is turning off the Preview Pane and reading all your email in plain text.  Or, simply disable VML — easy and quite effective.  We’ve done it company-wide ourselves.

Alex Eckelberry

Our friends over at WebSense have put together a killer video that shows the VML exploit in action, resulting in a fake Paypal website that steals your login information.

It’s a must see video.   

Now — don’t go off trying to visit the site in question, as you’ll find yourself with a lovely infection.  Just watch the video, which is safe for viewing.

Their blog entry on the movie.

And the movie itself (a takedown effort is in progress on this site).

 

Alex Eckelberry

 

Scott Deacon at Microsoft Security response just posted a new blog entry.  Microsoft may go out of cycle on the patch, they’re not seein many sties infected and they don’t recommend using the ZERT temporary patch.

I’ll quote relevant passages:

On breadth of attacks: 

Attacks remain limited.  There’s been some confusion about that, that somehow attacks are dramatic and widespread.  We’re just not seeing that from our data, and our Microsoft Security Response Alliance partners aren’t seeing that at all either.  Of course, that could change at any moment, and regardless of how many people are being attacked, we have been working non-stop on an update to help protect from this vulnerability.

Patching out of cycle a possibility:

…around 24-48 hours ago we began to see we have the possibility of going out of band here and we will keep you posted as we go.  The primary driver here is quality and protecting customers, not adherence to the monthly schedule.

On the ZERT patch:

That last bit is important because we were made aware this morning of a third party “update” for this issue.  We think it’s great that there are people out there working to help protect our customers.  But as we’ve always said, we cannot endorse third party updates.  As a best practice, customers should obtain security updates and guidance from the original software vendor.  

Link here.

Alex Eckelberry
(Hat tip to Ziv Mador at Microsoft)

If you want to test to see if you’re vulnerability to the VML exploit, ZERT has put up a test page. 

However, if you run this page, remember this disclaimer from ZERT:

Test your system once you are patched! by using our test page: After installing this patch you can test your IE browser by visiting a special page. A patched browser will not crash when it visits this page.

If your browser shows a red-square when visiting the page, your browser is patched or does not need the patch.

Warning! If you visit the above test page with an unpatched version of Internet Explorer it will crash.

You can find it on their download page, or by this direct link here.

Alex Eckelberry