Archive for September, 2009

Ants vs. worms: Computer security mimics nature

Glenn Fink, a research scientist at Pacific Northwest National Laboratory (PNNL) in Richland, Wash has come up with a new way to detect threats on your network. The method consists of an army of Digital ants that mirror the behavior of real ants in the sense that the “digital scent” left behind when a threat/evidence is found. This in turn will attract more digital ants which produces a swarm that marks a potential computer infection.

This summer a study was conducted where a worm was introduced to a network which consisted of 64 computers. The army of digital ants was able to successfully identify the infected hosts. Computer users need not worry that a swarm of digital ants will decide to take up residence in their machine by mistake. Digital ants cannot survive without software “sentinels” located at each machine, which in turn report to network “sergeants” monitored by humans, who supervise the colony and maintain ultimate control.

More on this interesting article can be found here

The Internet Infestation, How Bad Is It Really?

Found an interesting article posted by Trend Micro which talks about some research they have done on infected machines. A sample of 100 million compromised IP addresses was used in this study which showed 1/2 being infected for an average of 300 days. If the length of time is decreased to 30 days then the number changes to 80%.

Infection data by country

Out of the 1 million IP addresses 3/4 were identified as consumer users and the remain 1/4 were related to enterprise level networks. Because enterprise level networks typically have a handful of gateway IP addresses that could potentially represent thousands of hosts.  The number of infected hosts on these networks may be more.

The conclusion of the study comes to no surprise to anyone who is currently in the trenches in the security industry. The AV vendors constantly struggle to keep up with the ridiculous amount of samples being thrown at them every day. There are also many examples of malware disabling AV, windows firewall and modifying the hosts files to prevent updates. Its only going to get worse and its unfortunate that a majority of the public has no idea what threats are lurking online.

Read More

Dynamic DNS and Botnet of Zombie Web Servers

Denis Sinegubko, an independent researcher based in Magnitogorsk, Russia, has discovered infected web hosting servers that run legitimate websites but have been hacked to also run a nginx which serves malware.

The malware is installed via iframe redirection example below

i_frame src=”http ://a86x . homeunix . org:8080/ts/in.cgi?open2

He goes on to describe the evolution of the campaign from his perspective starting this spring.

“They started with gambling-related .cn domains (like cheapslotplay .cn). They introduced several new domains names every day so that you couldn’t hardcode them in your scanners. At this point, my records contain several hundred domains used in this attack. They also changed campaign names (parameters they specify in iframe URLs) regularly: mozila, banner, cocacola, pepsi, open, reopen, income. They used port 8080 (presumably to game dumb traffic filters that only inspect traffic on port 80). In the end of July, they started to use 3-letter .ru, .pl, .in and .at domains (e.g. x3y .ru, f7y .at, q5n .in, a3j .pl).”

I have also been watching this campaign dubbed the “pepsi campaign” for the use of the word “in.cgi?pepsi18″ within the GET requests generated by the series of redirects which ultimately leads to the installation of malware. The article can be found here.

Listed below are the latest ones from today.

20090914 _a5i.at:8080/welcome.php?id=0
20090914 _digifero.com:8080
20090914 _f8a.ru:8080/welcome.php?id=0
20090914 _gianttoplocate.cn:8080/landig.php?id=4
20090914 _gianttoplocate.cn:8080/load.php?id=0

Converting Shellcode into an Executable For Further Analysis

Exploit Tool kit’s out in the wild often utilize Download and execute shell-code which when run on the end system downloads and executes a file to allow the attacker to control the system. This is commonly used in Drive By Download attacks where a victim visits a malicious web page that in turn attempts to execute the shell-code in order to install software on the victim’s machine.

More often then not the shell-code is buried within obfuscated javascript. Searching the Murls database reveals one such URL (hxxp://rrrxgvdf.6600.org/kuaile/19.htm).

The above image visualizes the series of redirects that occur via Iframe tags after the victim browses to (hxxp://rrrxgvdf.6600.org/kuaile/19.htm). The example below was found at the following URL. (wm.yxnjs.com_x148_of.js) This shows a simple form of obfuscation where they substitute “%u” for “MTV”

Example of Obfuscated Shellcode

Exploits that target browsers commonly encode shellcode in a JavaScript string using Percent-encoding, “%uXXXX”-encoding or entity encoding. Some exploits also obfuscate the encoded shellcode string further to prevent detection by IDS. The example above is one such example of obfuscation because they are substituting the characters MTV with %u and in this case utilizing percent encoding.

Thanks to David Zimmer over at Idefense the following tool can be used to investigate shell-code either by static or dynamic analysis. Before we can do that we have to clean up the code by replacing MTV with %u and eliminating everything so that we have a “%uXXXX” format. Once the code is all cleaned up you can submit it here The script will then return you a file named shecode.exe_ (the underscore is so that you dont execute it by accident). After saving to the desktop you can then submit to Virus Total, open in your debugger/disassembler or submit to Anubis for a behavioral analysis.

Virus Total Report
Threatexpert Report

Three Ways a Twitter Hack Can Hurt You

An interesting article on how twitter can be used as a medium to steal your identity, infect your computer or using your twitter password to gain access to other online accounts. Below is a good example on how twitter can be used to infect a large amount of people.


Malware Infection

Twitter officials said 33 accounts had been attacked in the latest hack, including high-profile users such as Britney Spears and Barack Obama. The hackers used their temporary access to send offensive messages. CNN journalist Rick Sanchez found his account had been hacked with a message that read “i am high on crack right now might not be coming to work today.”

The damage could have been much worse, said Cluley, if the hacker had decided to take a different approach.

“Imagine if instead, in the case of Britney Spears account for example, that the hacker had posted a link that said: ‘Here’s my new video. Click on this link.’ Imagine how many people would have clicked on that and it could have pointed to malware? And Barack Obama is one of the most followed people on Twitter. If he said: ‘I’ve just made a new speech. Check it out.’ a lot of people would click on that link and get infected.”

Read About the other 2 ways

Return top