A Slashdot reader posted an article about an attack his company recently suffered. The summary is a criminal from Lebanon contacted him asking for a "fee" not to attack, the company initially said no and was taken offline by a DDoS, the company paid and the attack ceased.
A DDoS is an attacked aimed at exhausting a resource: a compute resource (CPU, Memory, HDD space) or a network resource (Router/Firewall CPU or memory, number of sessions, bandwidth). The most important is to understand what your systems are vulnerable too.
For instance, an attacker could perform a DDoS of an application by requesting abnormally long calculations in a loop, let's say computing pi to the 20 billionth decimals. If the system has at its heart only a single application server, it may be busy processing the request while delaying all the other queries. In the same way, the attacker could also request something that's abnormally large, for example generating a picture that is 10 million per 10 milllion pixels.
The most important is to know what you can act upon and what you can: there are things you can change - the architecture of the applications, the way parameters are validated, if you distribute the front-end load across multiple servers and so forth - and things you can't change: the number of sessions coming from the Internet and the rate at which they come in. For the latter, it is important to understand what your business is, who you are doing business with and what level of degradation/loss of service you accept: an american company may consider that dropping all requests from South America, Africa and Asia is acceptable if this helps maintaining its business with the USA, and thus may negotiate with their provider that upon request, an ACL allowing only the networks assigned to the ARIN and RIPE are to go through. Other companies may find this unacceptable and will have to find other solutions, such as geo-location for the access to the application.
Showing posts with label malware. Show all posts
Showing posts with label malware. Show all posts
Monday, November 12, 2012
Friday, November 9, 2012
Adobe Reader 0-day exploit sold for $50,000
Talking of commoditizing IT, here is something that gets it full swing: Adobe Reader 0-day exploit sold for $50,000. More and more, that kind of stunt will appear, with rogue security researchers selling these. My question is: how long before we see underground auctions for 0-days?
Also, don't miss this video of the exploit being run.
Also, don't miss this video of the exploit being run.
Thursday, November 8, 2012
"You received a voice mail" leads to malware
I have a few colleagues who got an e-mail with a page saying "You received a voice mail", followed by a link pretending to be a wave file.
The first link leads to a page with a table of three items on different servers, called js.js. These are basic redirectors. Out of the three, only two works and return the exact same javascript code, a redirection to a PHP page on a website.
That second URL returns an obfuscated massive Javascript: the author took some time to correctly do the work: a few tautologies such as "if(document.body) {}" and others add some weight, certains function names are split in different string variables, pieced together and eval'd into other variable to be used as functions. And that's only the decoding portion.
A massive i tag contains a 112 attributes, all identified by integers. In the HTML code, they are not in order, but the code re-order everything and builds a large string, which is passed to a second function whose role is to:
The result is another javascript script which is evaluated. Its exact role is not yet known, but here are a few notes:
Once that object executed, it contacted a forum, then attempted a download from three different sites, which returned the same executable. My only guess at this time is the author planned for some redundancy should some of the sites be taken down. The additional download was also submitted to VirusTotal (info). As of yesterday, around the same time, the detection rate was 6/44.
When executed, these additional did nothing during the analysis period. They may be dormant or waiting for some condition to be met.
The analysis continues!
The first link leads to a page with a table of three items on different servers, called js.js. These are basic redirectors. Out of the three, only two works and return the exact same javascript code, a redirection to a PHP page on a website.
That second URL returns an obfuscated massive Javascript: the author took some time to correctly do the work: a few tautologies such as "if(document.body) {}" and others add some weight, certains function names are split in different string variables, pieced together and eval'd into other variable to be used as functions. And that's only the decoding portion.
A massive i tag contains a 112 attributes, all identified by integers. In the HTML code, they are not in order, but the code re-order everything and builds a large string, which is passed to a second function whose role is to:
- if the first character of the current pair of character is "=", go to the next pair;
- decode the value as a base-23 integer, convert into a character and add it to the decoded string.
The result is another javascript script which is evaluated. Its exact role is not yet known, but here are a few notes:
- it detects the OS and browser;
- it searches for a number of Adobe, MS DOMXML and others plugins and gets the versions;
- there is a mention of a PDF file in the code;
- two URLs are mentioned, one was taken down already and was used to download a file called "update_flash_player.exe", confirming that it may be trying to exploit some flash vulnerabilities, the other one was still live at the moment of the analysis and was used to serve an executable (Info on VirusTotal). Yesterday at around 6PM EST, the detection rate was 4/44.
Once that object executed, it contacted a forum, then attempted a download from three different sites, which returned the same executable. My only guess at this time is the author planned for some redundancy should some of the sites be taken down. The additional download was also submitted to VirusTotal (info). As of yesterday, around the same time, the detection rate was 6/44.
When executed, these additional did nothing during the analysis period. They may be dormant or waiting for some condition to be met.
The analysis continues!
Wednesday, August 15, 2012
Royal mail in the a...
Another day, another malware. Detection ratio for this one is 1/42 @ 8/15/2012 7:06 EST.
Information about it on Virus Total
Information about it on Virus Total
Saturday, June 30, 2012
How to report an abuse to an ISP/SP
From time to time, you will have to report an abuse to an Internet Service Provider (ISP). Having been at both ends of this, I know it can be a frustrating task. As the person submitting the abuse report, you always end up having to feedback or a vague, generic e-mail that informs you that your report will be read and that, if needed, actions will be taken. In most of the case, this is the only response you will get.
As the person receiving the abuse reports, you have to deal with incomplete or ambiguous information, people demanding the name of a subscriber, and from time to time, profanities and threats. Usually, that receiver gets the report from someone with no connection whatsoever to his service - understand by that "not paying anything" - on someone who gives him good money. That's a conflict of interest various laws tried to solve by imposing to the ISPs the obligation of notifying users of potential misconducts, as these may be unintentional, for instance in the case of machines infected by a virus.
In all cases, it is important to stay polite and courteous, after all, the person reporting the abuse is asking for help, but the person receiving the report may have a legal obligation in taking action.
A good report includes:
- The IP address of the machine that allegedly did the abuse;
- The IP address of the machine that was the target of the abuse;
- A description of the abuse, in factual terms - no elaboration or intents;
- The relevant entries from the logs with timestamps - the relevant entries only, no need to forward a 10MB log to show 2 lines;
- The timezone the machine is in.
In addition to these, I usually add a short note inviting the ISP to contact me should more information be needed.
Unless you are familiar with the language spoken by the ISP you are reporting the abuse to, English is a good bet to write the e-mail. If your logs are not in the same language, offer to provide a translation.
Here is an example of e-mail I would send:
Subject: potential abuse coming from x.x.x.x
Sir,
My logs indicate that x.x.x.x tried several combinations of username/password on my SMTP server, with IP y.y.y.y.
Please find the logs below. All the times are EST.
Should you need more information or log, feel free to send me an e-mail.
[Logs]
Now comes the question: how to find the e-mail address to report an abuse.
The Whois service
All IP networks have been allocated by a regional Internet Registry. These operate over a geographic area and are responsible for assigning the IP networks, maintaining the technical and administrative contacts and providing some base information regarding the IP networks.
For the North America, the registry is ARIN. On the top right corner, there is a box called "Search WHOIS". This is were you will put the offending IP. The result may, or may not include an "abuse contact".
When it doesn't include such a record, I look to see if there is a link to another delegation: some ISPs have hundreds of networks and operate their own WHOIS. In that case, the best is to follow the link and to search for the information in the next database.
In the event there is no such delegation and no abuse contact, I usually go for the parent network, until I find an abuse contact.
Going to Justice
If the abuse costed you money or caused harm or damages, you may want to go to the police. In that event, the procedure depends on where you are and what jurisdiction applies. Contact your local authorities for more information.
In that case, it is important to preserve as much information as possible: if the abused machine is your desktop, don't use it anymore, disconnect it from the network and wait for instructions.
Happy Surging!
Saturday, June 23, 2012
Antivirus protection (some are free)
In a previous article, I mentioned that a better practice is to run an antivirus on each computer. But what is an antivirus?
This is an application that will scan your disks and check the objects against a list of known bad signatures. This latter is a sequence of bytes indicative of a certain strain of malware. Depending on the product, it may also scan these files and objects as they are moved in and out of the memory, from example copied from the network or from a website. Certain have additional protections, such as detecting known attacks coming from the network or trying to exploit bugs in products such as Internet Explorer or Adobe Acrobat.
The fact is, the antivirus is as smart as its database: something new will not be detected by a pure comparison. That is why certain commercial products have a "heuristic" scan: they will detect patterns that are a possible indication of a malware, but without doing an exact comparison with a database. In a number of cases, there will be false positives, or non malware pieces of code flagged as potentially nefarious.
Another fact to keep in mind is the size of the database. Even if there are very fast algorithms to perform searches and comparisons, the fact rests that the larger the number of signatures, the slower the scan. This may be particularly true and sensitive during real-time scanning.
A few criteria to chose an Antivirus solution:
The number of signatures present in the database - the more signatures, the more viruses detected, but at the same time, the slower the scan;
The frequency at which new signatures are made available - how many times per month/week/day are new signatures released? Are they released on a schedule or when ready?
How does the vendor follow the discovery of new malwares? - What is the average period between discovery and availability of a signature? Does the vendor have its own malware lab?
What are the features of the Antivirus solution? - besides scanning files at rest (called on-demand scanning), does the solution provide in-memory scanning? Activity scanning? Does it protect against network attacks?
What is the cost of the solution? - No explanation needed, does the solution cost something? If it does, what are the benefits? Is it a one-time fee or an annual subscription?
A few free solutions:
Some opensource and free solutions exist. In addition, some vendors have free versions for personal use, or for a use limited in time, such as scanning a computer.
ClamAV:
This is a very good, opensource solution. For Windows, ImmuNet is available which runs the ClamAV engine. Initially, ClamAV was designed as an antivirus for e-mail gateways.
BitDefender, free version:
Although BitDefender is a commercial product, there is a free version which includes only the on-demand scanning.
F-Prot, Free for 30 days:
This is the full version, but with a limit of 30 days. After that, you have to either uninstall it or take a subscription.
There are plenty of other solutions to be found on the Internet. One word of caution though: beware of some fake antivirus, which are actually malware designed to scare you into installing it.
Happy Surfing!
This is an application that will scan your disks and check the objects against a list of known bad signatures. This latter is a sequence of bytes indicative of a certain strain of malware. Depending on the product, it may also scan these files and objects as they are moved in and out of the memory, from example copied from the network or from a website. Certain have additional protections, such as detecting known attacks coming from the network or trying to exploit bugs in products such as Internet Explorer or Adobe Acrobat.
The fact is, the antivirus is as smart as its database: something new will not be detected by a pure comparison. That is why certain commercial products have a "heuristic" scan: they will detect patterns that are a possible indication of a malware, but without doing an exact comparison with a database. In a number of cases, there will be false positives, or non malware pieces of code flagged as potentially nefarious.
Another fact to keep in mind is the size of the database. Even if there are very fast algorithms to perform searches and comparisons, the fact rests that the larger the number of signatures, the slower the scan. This may be particularly true and sensitive during real-time scanning.
A few criteria to chose an Antivirus solution:
The number of signatures present in the database - the more signatures, the more viruses detected, but at the same time, the slower the scan;
The frequency at which new signatures are made available - how many times per month/week/day are new signatures released? Are they released on a schedule or when ready?
How does the vendor follow the discovery of new malwares? - What is the average period between discovery and availability of a signature? Does the vendor have its own malware lab?
What are the features of the Antivirus solution? - besides scanning files at rest (called on-demand scanning), does the solution provide in-memory scanning? Activity scanning? Does it protect against network attacks?
What is the cost of the solution? - No explanation needed, does the solution cost something? If it does, what are the benefits? Is it a one-time fee or an annual subscription?
A few free solutions:
Some opensource and free solutions exist. In addition, some vendors have free versions for personal use, or for a use limited in time, such as scanning a computer.
ClamAV:
This is a very good, opensource solution. For Windows, ImmuNet is available which runs the ClamAV engine. Initially, ClamAV was designed as an antivirus for e-mail gateways.
BitDefender, free version:
Although BitDefender is a commercial product, there is a free version which includes only the on-demand scanning.
F-Prot, Free for 30 days:
This is the full version, but with a limit of 30 days. After that, you have to either uninstall it or take a subscription.
There are plenty of other solutions to be found on the Internet. One word of caution though: beware of some fake antivirus, which are actually malware designed to scare you into installing it.
Happy Surfing!
Sunday, March 11, 2012
Updates and upgrades
Upgrades and updates: everybody knows them, but ... when it is time to install them. OK, you get the picture.
What's the main difference between an update and an upgrade? An update brings mostly fixes for vulnerablities, an upgrade new features and fixes.
Both are equally important for the fixes: some of these are application improvements, speed or crashes, but others concern security vulnerabilities, bugs that an attacker may use to execute other programs without being suspected.
Many Operating Systems (Windows, Linux, Mac Os X) have a feature to auto check for updates and upgrades. Be aware that it concerns only the operating system itself and usually the applications from the same vendor. Other applications installed may have to be manually updated or upgraded.
For a long time, Microsoft has been providing a way to automatically update its Operating Systems and key applications. In Windows XP - and if you kept the themes - this function lives under "Control Panel" > "Security Center" > "Automatic Updates"
The default setting of "Turn on Automatic Updates" is to download and install the recommended updates every day at 3AM. However, unless you don't really care about your power consumption, at that time your computer will be off.
I usually edit these settings, accessible at the bottom of the same window under "Automatic Updates". and change them to "Download updates for me, but let me choose when to install them." As soon as new updates are available, your computer will notify you with the "little yellow shield."
As I said, this will install the recommended updates, not all the updates. There are two additional types of updates available from Microsoft: "optional updates", which don't fix anything critical, and "hardware updates", which improve the hardware support and correct driver issues.
These are available through the website "Windows Updates", operated by Microsoft. In IE, go to "Tools" and click on "Windows Updates."
At the screen offering to chose "Express" or "Custom", select "Custom". For each category, you may click on "select all". However, from time to time, you may have to choose between certain patches: for instance you cannot install in the same sweep .net framework 4 and .net framework 1.1. In that case, the system will show you what patches need to be installed independently.
Remains the other applications. Most of us have, in addition to Windows and Office, a browser for the non IE users, adobe reader, adobe flash, various players, possibly iTunes and so forth. All the modern applications have an option to check whether you are up-to-date, and this usually lives under "?" -> "About" or "Help" -> "Check for updates".
Windows 7 has a built-in interface you may invoke by typing "windows update" in the search bar in the Start Menu. There, you can select what to upgrade. By clicking on "Check Upgrade", you will start the detection process.
Optional updates are not selected by default. Click on it to select these additional packages.
In all cases, when upgrading, it is important to close all running applications, to avoid losing data should one be closed.
If an update fails, retry after having disabled your AV: from time to time, an AV may stop the installation of system components thus preventing the correct installation of an update.
To do
Happy surfing.
What's the main difference between an update and an upgrade? An update brings mostly fixes for vulnerablities, an upgrade new features and fixes.
Both are equally important for the fixes: some of these are application improvements, speed or crashes, but others concern security vulnerabilities, bugs that an attacker may use to execute other programs without being suspected.
Many Operating Systems (Windows, Linux, Mac Os X) have a feature to auto check for updates and upgrades. Be aware that it concerns only the operating system itself and usually the applications from the same vendor. Other applications installed may have to be manually updated or upgraded.
For a long time, Microsoft has been providing a way to automatically update its Operating Systems and key applications. In Windows XP - and if you kept the themes - this function lives under "Control Panel" > "Security Center" > "Automatic Updates"
The default setting of "Turn on Automatic Updates" is to download and install the recommended updates every day at 3AM. However, unless you don't really care about your power consumption, at that time your computer will be off.
I usually edit these settings, accessible at the bottom of the same window under "Automatic Updates". and change them to "Download updates for me, but let me choose when to install them." As soon as new updates are available, your computer will notify you with the "little yellow shield."
As I said, this will install the recommended updates, not all the updates. There are two additional types of updates available from Microsoft: "optional updates", which don't fix anything critical, and "hardware updates", which improve the hardware support and correct driver issues.
These are available through the website "Windows Updates", operated by Microsoft. In IE, go to "Tools" and click on "Windows Updates."
At the screen offering to chose "Express" or "Custom", select "Custom". For each category, you may click on "select all". However, from time to time, you may have to choose between certain patches: for instance you cannot install in the same sweep .net framework 4 and .net framework 1.1. In that case, the system will show you what patches need to be installed independently.
Remains the other applications. Most of us have, in addition to Windows and Office, a browser for the non IE users, adobe reader, adobe flash, various players, possibly iTunes and so forth. All the modern applications have an option to check whether you are up-to-date, and this usually lives under "?" -> "About" or "Help" -> "Check for updates".
Windows 7 has a built-in interface you may invoke by typing "windows update" in the search bar in the Start Menu. There, you can select what to upgrade. By clicking on "Check Upgrade", you will start the detection process.
Optional updates are not selected by default. Click on it to select these additional packages.
In all cases, when upgrading, it is important to close all running applications, to avoid losing data should one be closed.
If an update fails, retry after having disabled your AV: from time to time, an AV may stop the installation of system components thus preventing the correct installation of an update.
To do
- Configure the windows automatic updater to download new updates and notify when they are available;
- Go from time to time (once every month or so) and force all the updates, if possible including the optional updates;
- On a regular basis (once every month or so), for all used applications, check if there are updates, either using the built-in mechanism or by visiting the vendor's website.
Happy surfing.
Sunday, February 19, 2012
Trinity Rescue Kit to the ... rescue!
So, after playing with my virtual machine and the malwares I downloaded from my e-mail account, time for some experiments from the other side: the clean-up effort.
Cleaning up after a virus infection is probably the most horrible task I have ever had to perform. Not only it takes a long time, but you can't rely anymore on the installed Operating System, all systems have to be taken down or isolated to control the spread of the infection, the users call every 30 seconds asking when "they will be able to work because they have important things to do" and, of course, it always happen when there is something else interesting to do.
Until recently, when I had to be involved in a clean-up effort, I tended to ask for the hard drives to be imaged - to keep a copy of the infection - then I connected the drive to another machine known to be clean, and I ran the antivirus tools from there. Not only this was extremely time consuming, but there was a need to have access to the machine, which is possible with workstation or stand alone servers, not so much with virtual machines, and I don't mention the fact that servers have, nowadays, multi terabyte storages drives on SANs. Another solution had to be found.
There comes a cool distro: TRK - the Trinity Rescue Kit. It does way more than just virus scans, but that's a non negligible part of its job. Among the other tasks, let's just mention the password recovery, the junkfile clean up, the backup/restore and the imaging facility.
Back to the virus clean-up. TRK comes with not less than five different AVs: ClamAV, F-Prot, BitDefender, Vexira and Avast. This last one requires that you register to get a key, and it's free.
To access these tools, two solutions, either the menu-driven way or the command line.
First stop: mounting the local file systems. The menu-driven has an option to mount all the local file systems automatically, and all the operations are taken care of: if your NTFS was not unmounted cleanly, i.e. you powered the machine off in a rush, the automated mount will mount it after taking care of the possible issues. A small caveat though: these file systems are mounted read-write when possible, so be aware that there is a risk of touching things on the hard drive.
An interesting point: in one of my tests, I ran TRK on a mac book pro. It automatically mounted the local drive (UFS), but read-only.
If you want to keep a maximum control, I recommend opening a shell and mounting the relevant file systems by hand, using mount. For the NTFS file system, the suite ntfs-3g is present and can be used to achieve that purpose.
Next step: the virus scanning. Again, either menu-drive and you chose your AV, or at the command-line using the virusscan command.
After selecting the destination to scan, you proceed and select the AV to run.
As mentioned, the other way is to use the virusscan command. This is a form of one-stop shop for scanning a file system, and it takes care of all the necessary steps, such as downloading and installing the relevant packages, updating the virus definitions, and running the scan.
I found I needed to use this way with the mac book pro scan: by default and through the menu-driven, a log file is written in the mount point, which is at the root of the scanned file system. When the mount is done read-only, as it was with my UFS, this is not possible, and the scan will fail.
By default, "ClamAV" will be run. Concerning this one, an important note is that infected files will be reported and quarantined, but not deleted.
An example of the command is:
This will run both ClamAV and F-Prot against the file system mounted in /sda1, logs will be written under /, and not on the mounted file system.
A gotcha: if you try to run Vexira, it will fail, due to an error in the command-line switch for the updater.
Here is a workaround:
ClamAV - 0 infected file detected
F-Prot - 1 infected file detected
BitDefender - 0 infected file detected
Vexira - 0 infected file detected
Avast - 0 infected file detected
To be fair to BitDefender, Vexira and Avast, they were run after F-Prot, so they may have detected it if given the chance.
The file F-Prot categorized as a malware is "/Users/Administrator/AppData/Roaming/winc.exe", as W32/Trojan.DFP. The file was removed.
However, when the machine restarted and was logged on, another access was made to "yerurr.com", meaning the actual infection was not removed. After rebooting and rescanning with F-Prot, no file found infected, so indeed, something is still present on the system, but not yet detected.
If you recall, in order to execute the malware on my 64bits install of Windows 2008, I had to disable DEP. After enabling it back and rebooting the machine, an executable was blocked: memnvexec.exe. This file lives in /Users/Administrator/AppData/Roaming. This is actually the same file as "servicesa.exe" that I saw downloaded from a website in Germany during my initial run of the strain. As of now, this file is not detected by any AV present on virus total.
Conclusion -
I do like TRK. This is an awesome tool for helping in dealing with outbreaks. However, it suffers from the same ailments as all AVs: this is a reactive business, signatures may take time to make it to the end user and not everything qualifies as a malware.
The menu-driven interface makes it really easy to use. Advanced users will make a heavy use of the command line for a variety of tasks, such as taking images over a network to a NFS server, doing virus scans or deploying images. Additional functions are possible, such as network booting TRK on multiple computers to take care of larger networks.
If you are an IT or a security professional, this definitely has to be in your toolbox.
Cleaning up after a virus infection is probably the most horrible task I have ever had to perform. Not only it takes a long time, but you can't rely anymore on the installed Operating System, all systems have to be taken down or isolated to control the spread of the infection, the users call every 30 seconds asking when "they will be able to work because they have important things to do" and, of course, it always happen when there is something else interesting to do.
Until recently, when I had to be involved in a clean-up effort, I tended to ask for the hard drives to be imaged - to keep a copy of the infection - then I connected the drive to another machine known to be clean, and I ran the antivirus tools from there. Not only this was extremely time consuming, but there was a need to have access to the machine, which is possible with workstation or stand alone servers, not so much with virtual machines, and I don't mention the fact that servers have, nowadays, multi terabyte storages drives on SANs. Another solution had to be found.
There comes a cool distro: TRK - the Trinity Rescue Kit. It does way more than just virus scans, but that's a non negligible part of its job. Among the other tasks, let's just mention the password recovery, the junkfile clean up, the backup/restore and the imaging facility.
Back to the virus clean-up. TRK comes with not less than five different AVs: ClamAV, F-Prot, BitDefender, Vexira and Avast. This last one requires that you register to get a key, and it's free.
To access these tools, two solutions, either the menu-driven way or the command line.
First stop: mounting the local file systems. The menu-driven has an option to mount all the local file systems automatically, and all the operations are taken care of: if your NTFS was not unmounted cleanly, i.e. you powered the machine off in a rush, the automated mount will mount it after taking care of the possible issues. A small caveat though: these file systems are mounted read-write when possible, so be aware that there is a risk of touching things on the hard drive.
An interesting point: in one of my tests, I ran TRK on a mac book pro. It automatically mounted the local drive (UFS), but read-only.
If you want to keep a maximum control, I recommend opening a shell and mounting the relevant file systems by hand, using mount. For the NTFS file system, the suite ntfs-3g is present and can be used to achieve that purpose.
Next step: the virus scanning. Again, either menu-drive and you chose your AV, or at the command-line using the virusscan command.
After selecting the destination to scan, you proceed and select the AV to run.
As mentioned, the other way is to use the virusscan command. This is a form of one-stop shop for scanning a file system, and it takes care of all the necessary steps, such as downloading and installing the relevant packages, updating the virus definitions, and running the scan.
I found I needed to use this way with the mac book pro scan: by default and through the menu-driven, a log file is written in the mount point, which is at the root of the scanned file system. When the mount is done read-only, as it was with my UFS, this is not possible, and the scan will fail.
By default, "ClamAV" will be run. Concerning this one, an important note is that infected files will be reported and quarantined, but not deleted.
An example of the command is:
virusscan -a clam,fprot -d /sda1 -l /
This will run both ClamAV and F-Prot against the file system mounted in /sda1, logs will be written under /, and not on the mounted file system.
A gotcha: if you try to run Vexira, it will fail, due to an error in the command-line switch for the updater.
Here is a workaround:
virusscan -a va -d /<to scan>This will start the download of all the updates. After that, you may proceed and run the scan normally
# This will fail, that's normal
cd /linkedfs/usr/share/vascan
./vdbupdate.sh
cd /Back to the test. My virtual machine was infected with the strain I got in the "Booking.com" e-mail. Running the various scans in sequence I have:
virusscan -a va -d /<to scan>
ClamAV - 0 infected file detected
F-Prot - 1 infected file detected
BitDefender - 0 infected file detected
Vexira - 0 infected file detected
Avast - 0 infected file detected
To be fair to BitDefender, Vexira and Avast, they were run after F-Prot, so they may have detected it if given the chance.
The file F-Prot categorized as a malware is "/Users/Administrator/AppData/Roaming/winc.exe", as W32/Trojan.DFP. The file was removed.
However, when the machine restarted and was logged on, another access was made to "yerurr.com", meaning the actual infection was not removed. After rebooting and rescanning with F-Prot, no file found infected, so indeed, something is still present on the system, but not yet detected.
If you recall, in order to execute the malware on my 64bits install of Windows 2008, I had to disable DEP. After enabling it back and rebooting the machine, an executable was blocked: memnvexec.exe. This file lives in /Users/Administrator/AppData/Roaming. This is actually the same file as "servicesa.exe" that I saw downloaded from a website in Germany during my initial run of the strain. As of now, this file is not detected by any AV present on virus total.
Conclusion -
I do like TRK. This is an awesome tool for helping in dealing with outbreaks. However, it suffers from the same ailments as all AVs: this is a reactive business, signatures may take time to make it to the end user and not everything qualifies as a malware.
The menu-driven interface makes it really easy to use. Advanced users will make a heavy use of the command line for a variety of tasks, such as taking images over a network to a NFS server, doing virus scans or deploying images. Additional functions are possible, such as network booting TRK on multiple computers to take care of larger networks.
If you are an IT or a security professional, this definitely has to be in your toolbox.
Friday, February 17, 2012
And another one: booking.com
In the same fashion, I got an e-mail today allegedly from booking.com to give me some information about a reservation I have done. Or so is it written.
Again, a zip file is attached, that contains an executable. Here are the md5 hash values:
Again, a zip file is attached, that contains an executable. Here are the md5 hash values:
46ea3e441be4ba82fa2d059a5ca45f23 Booking-Com-Reservation.exe
e877998eef741bc7ed688584ed7595b6 Booking-Reservation-Details-NUM930833336.zip
It uses the same host (yerurr.com).
Interestingly enough, there is either a timer or a wait for the next reboot: after a reboot and having waited for a while, there was some activity to a site in Germany (www.floodwave.de) to get /services/images/servicesa.exe (md5sum: 8d39f983e08f68ca4ccb3a92f5e4a7ac). This file is not recognized as malware by any antivirus (VirusTotal Report)
When rebooted one more time, the machine followed the same cycle: request to Google, resolution of yerurr.com, POST /was/tnk.php. I stopped there, but I suspect that the machine would probably do something after a time, which I will try this week-end.
Wednesday, February 15, 2012
And another strain - DHL Express
Another one, again posing to be from a delivery company.
I got an e-mail, with a zip attachement (DHL_Express_Shipment_POST_ORDER_ID92VMUANA.zip, md5 hash: b8d96b95875bc31d9f5448e5d06837cc ). When decompressed, an executable is present (DHL_Express_Shipment_POST_ORDER_ID.exe, md5 hash: cc6e8193c7475ef34f79ab82ec6f90fc)
As of 02/14/2012, only 3 out of 43 AVs correctly detect the file as infected (VirusTotal report). Once decompressed, that number falls to 2/43 (VirusTotal report).
Funnily, my first attempt to run the executable into my 2008 virtual machine (64 bits) failed - DEP intercepted it and prevented the execution.
As for the previous two strains, this one first makes a request to Google.com (GET / HTTP/1.1). It then resolves yerurr.com and does a POST /was/tnk.php with a very long body. In my case, the activity stopped there.
I got an e-mail, with a zip attachement (DHL_Express_Shipment_POST_ORDER_ID92VMUANA.zip, md5 hash: b8d96b95875bc31d9f5448e5d06837cc ). When decompressed, an executable is present (DHL_Express_Shipment_POST_ORDER_ID.exe, md5 hash: cc6e8193c7475ef34f79ab82ec6f90fc)
As of 02/14/2012, only 3 out of 43 AVs correctly detect the file as infected (VirusTotal report). Once decompressed, that number falls to 2/43 (VirusTotal report).
Funnily, my first attempt to run the executable into my 2008 virtual machine (64 bits) failed - DEP intercepted it and prevented the execution.
As for the previous two strains, this one first makes a request to Google.com (GET / HTTP/1.1). It then resolves yerurr.com and does a POST /was/tnk.php with a very long body. In my case, the activity stopped there.
Wednesday, February 8, 2012
Deutschen Post Strain 1 - Some information
Nothing to mention, really. I ran the first strain in the same condition ... and got the same outcome. It seems that the two are variants of the same piece of code.
They both try to access Google.com, then resolve "kemolderin.com" and to do a POST request to "/wap/udp.php".
For more information: see my previous post
They both try to access Google.com, then resolve "kemolderin.com" and to do a POST request to "/wap/udp.php".
For more information: see my previous post
Tuesday, February 7, 2012
Deutschen Post Strain 2 - Some information
Since this morning, as I am home sick, I have decided to give Strain 2 from my previous post a try.
I installed a Windows 2008 Standard in a virtual environment to run the malware.
It started by doing a DNS request for "kemolderin.com" (resolution 66.199.231.30 on 02/07/2012 at 2:09 EST). It then connected to that IP on port TCP/80 and did a "POST /wap/udp.php" with a very long string of data.
The answer from the server was "HTTP/1.1 302 Found" , with a few extra data (c0 83 a4 1c 1d 5f 72 ab).
The fun thing is I tried to browse to the same page, but I was greeted with a "Suspended Domain".
At this time, that's it folks. I will monitor the machine next time I reboot it, and I will try with a windows XP as soon as I have one.
I installed a Windows 2008 Standard in a virtual environment to run the malware.
It started by doing a DNS request for "kemolderin.com" (resolution 66.199.231.30 on 02/07/2012 at 2:09 EST). It then connected to that IP on port TCP/80 and did a "POST /wap/udp.php" with a very long string of data.
The answer from the server was "HTTP/1.1 302 Found" , with a few extra data (c0 83 a4 1c 1d 5f 72 ab).
The fun thing is I tried to browse to the same page, but I was greeted with a "Suspended Domain".
At this time, that's it folks. I will monitor the machine next time I reboot it, and I will try with a windows XP as soon as I have one.
Fedex, DHL, Deutschen Post and you've got ... a virus
Among the many things I truly love about my Google Mail is its ability to detect viruses in what people try to send me. But first things first.
I used to operate my own mail server for nearly a decade. Along the road came the installation of an antis-spam daemon (spamassassin team: you rock!), an attempt at installing an anti-virus/anti-malware using ClamAV, and various other tweaks and tunes to make it (a) work correctly and (b) avoid something that approaches 90% of undesirable content.
Also, as I am more and more often traveling, I installed a webmail application on my server, so I could process my mail without having to establish a POPS/IMAPS connection to my server. This came with the loss of a few features, but all in all, it was working OK.
Then one day, I tried Google Mail. The interface is sleek and easy to use, I have all my features back and things. And Google gets my e-mail on my "own" address.
So recently, I have started getting more and more "Message left on server: ...." as it contains a potential virus or suspicious attachment. And more and more, I have been intrigued about these.
They all purport to come from DHL, FedEx or Deutschen Post. They all have a ZIP attachment, and they all enjoin you to take an immediate action: execute the piece in the attachment. The title are visibly generated at random for the last part, all the zip have an executable. The latter has a title that is non random: in all the recent zip files I received, the exec file name is "Deutschen_Post_oder_DHL-ID.exe".
In these, I have identified two different strains.
The first one has a MD5 hash value of "3162d052c388c5310a5f1a9f429c670c" and a size of 135168 bytes. As of 02/07/2012 10:58am EST, only 14 scanners out of 42 detect the executable file as malware (Report on VirusTotal.com), less than 40%.
The second strain has a MD5 hash value of "c497c6d0b69cb2e03236af82cc651193" and a size of 114688 bytes. As of 02/07/2012 11:05am EST, only 10 scanners out of 43 detect the executable file as malware (Report on VirusTotal.com), less than 30%.
As (a) the names are consistent except for a random part in the zip file, (b) the archive content is exactly the same within a strain and (c) that I got these from various IPs, I lean toward an automated type of distribution, possibly a worm or a bot type.
I still need to do some homework and play with these to see whether they point to the same "owner".
I used to operate my own mail server for nearly a decade. Along the road came the installation of an antis-spam daemon (spamassassin team: you rock!), an attempt at installing an anti-virus/anti-malware using ClamAV, and various other tweaks and tunes to make it (a) work correctly and (b) avoid something that approaches 90% of undesirable content.
Also, as I am more and more often traveling, I installed a webmail application on my server, so I could process my mail without having to establish a POPS/IMAPS connection to my server. This came with the loss of a few features, but all in all, it was working OK.
Then one day, I tried Google Mail. The interface is sleek and easy to use, I have all my features back and things. And Google gets my e-mail on my "own" address.
So recently, I have started getting more and more "Message left on server: ...." as it contains a potential virus or suspicious attachment. And more and more, I have been intrigued about these.
They all purport to come from DHL, FedEx or Deutschen Post. They all have a ZIP attachment, and they all enjoin you to take an immediate action: execute the piece in the attachment. The title are visibly generated at random for the last part, all the zip have an executable. The latter has a title that is non random: in all the recent zip files I received, the exec file name is "Deutschen_Post_oder_DHL-ID.exe".
In these, I have identified two different strains.
The first one has a MD5 hash value of "3162d052c388c5310a5f1a9f429c670c" and a size of 135168 bytes. As of 02/07/2012 10:58am EST, only 14 scanners out of 42 detect the executable file as malware (Report on VirusTotal.com), less than 40%.
The second strain has a MD5 hash value of "c497c6d0b69cb2e03236af82cc651193" and a size of 114688 bytes. As of 02/07/2012 11:05am EST, only 10 scanners out of 43 detect the executable file as malware (Report on VirusTotal.com), less than 30%.
As (a) the names are consistent except for a random part in the zip file, (b) the archive content is exactly the same within a strain and (c) that I got these from various IPs, I lean toward an automated type of distribution, possibly a worm or a bot type.
I still need to do some homework and play with these to see whether they point to the same "owner".
Subscribe to:
Posts (Atom)