HACKER MEDICINE – Page 373 – …a valuable resource for securing websites, PCs and mobile devices

Snapchat Spam: Sexy Photos Lead to Compromised Branded Short Domains

Hacker Medic January 15, 2014 No Comments

A few weeks after our blog post about porn and secret admirer spam targeting Snapchat users, a new spam campaign using sexually suggestive photos and compromised custom URLs is circulating on the photo messaging app.

Figure 1. Snapchat spam

Each of these spam messages includes a request to “Add my kik”, along with a specially crafted user name on the Kik instant messaging application for mobile devices.

Figure 2. Snapchat with a digital camera? It’s a trap!

After engaging these spam bots on Kik Messenger, this spam campaign is using a type of spam chat bot-script we discovered on Tinder last summer.

Figure 3. Spam bot using a familiar chat script on Kik

An interesting discovery from this campaign is the use of compromised custom URLs belonging to small websites and popular brands. Spammers have found a way to create their own links using branded short domains in order to entice users into a false sense of security.

Figure 4. Well-known branded short domain directs users to spam

The following are some of the compromised branded short domains we identified:

usat.ly (USA Today)
cbsloc.al (CBS Local)
on.natgeo.com (National Geographic)
nyp.st (New York Post)
on.mktw.net (Marketwatch)
mirr.im (Daily Mirror)
red.ht (Red Hat)
invstplc.com (Investorplace)
mitne.ws (MIT News)

Figure 5. Stats page for compromised short URL

Hidden behind the branded customized URLs are affiliate marketing links directing users to sign-up for adult webcam sites.

Symantec has been working closely with Bitly to investigate and shut down any spammer use of branded short URLs. Bitly has confirmed that some spammers obtained Bitly API keys belonging to various brands. Some of the brands affected used the AddThis social bookmarking service who recently stopped requiring users to reveal their API key in plain text as part of the AddThis website embed code.

Figure 6. Note from AddThis support page regarding API key safety

Public exposure of API keys gives anybody the ability to compromise accounts and, in this case, create short URLs using other people’s domains.

Users of the AddThis service should refer to this support article on how to secure API keys. Bitly javascript:void(0);users should follow Bitly API best practices to ensure the security of API keys.

The recent spam campaign targeting Snapchat users should not be surprising. Scammers and spammers will always target new and popular apps—like Snapchat—as soon as they gain a large enough user base. To prevent spam snaps from appearing in your Snapchat feed, Symantec recommends users change their Snapchat privacy settings to receive snaps from “My Friends” only and use caution when receiving unsolicited messages or friend requests.

Win32/64:Blackbeard & Pigeon: Stealthiness techniques in 64-bit Windows, Part 1

Avast Blog January 15, 2014 No Comments

At the turn of the year we started to observe a Trojan, not much discussed previously (with a brand new final payload). It has many interesting aspects: It possesses a complex structure containing both 32-bit and 64-bit code; it achieves its persistence with highly invasive methods; and it is robust enough to contain various payloads/functionalites. […]

.Zip Attachment Spam Makes a Grand Return

Hacker Medic January 15, 2014 No Comments

After a long hiatus, spammers are once again using an old trick, where they attach a .zip file to trick the user into executing the compressed malware. The chart below shows the number of spam messages with .zip attachments over the last 90 days in Symantec’s Global Intelligence Network (GIN).

Figure 1. Spam messages with .zip attachments over the last 90 days

On January 7, 99.81 percent of the .zip attachment spam that came into Symantec’s GIN had the file name “BankDocs-” followed by 10 hexadecimal characters.

Figure 2. Email with “BankDocs-” .zip attachment

On January 8, 99.34 percent of the .zip attachment spam seen in Symantec’s GIN had a file name “Invoice-E_” followed by 10 hexadecimal characters.

Figure 3. Email with “Invoice-E_” .zip attachment

On January 9, 98.94 percent of the .zip attachment spam seen in Symantec’s GIN had a file name “Early2013TaxReturnReport_” followed by 10 hexadecimal characters.

Figure 4. Email with “Early2013TaxReturnReport_” .zip attachment

On January 10, 98.84 percent of the .zip attachment spam seen in Symantec’s GIN had a file name “[BRAND NAME REDACTED]_December_2013_” followed by 10 hexadecimal characters.

Figure 5. Email with “[BRAND NAME REDACTED]_December_2013_” .zip attachment

While these examples have different file names and MD5s, they all carry the same malware, identified by Symantec as Trojan.Zbot. This Trojan has primarily been designed to steal confidential information from the compromised computer.

It appears that the large attack has subsided for now, as the spam volume returned to normal levels after January 10, but it is just a matter of time before spammers organize another large campaign. Users should keep their antivirus software up-to-date and should not open attachments from unknown sources.

????????? Web ???? Gongda ??????????????

Hacker Medic January 15, 2014 No Comments

シマンテックは最近、日本のある出版社の Web サイトに、悪用ツールキットがホストされている別の Web サイトに誘導する悪質な iframe がインジェクトされていたことを確認しました。この出版社は、書籍や雑誌、漫画、映画から、ゲームまで取り扱っている大手です。

確認できた限りで、この出版社のサイト上で少なくとも 3 つのファイルが感染していました。

図 1. 出版社のサイトで確認された悪質な iframe

この悪質な iframe は複数のページにわたって存在し、ホームページにも仕掛けられていました。シマンテックの遠隔測定によると、最初の被害者がサイトにアクセスしたのは、太平洋標準時 2014 年 1 月 5 日の 22:00（日本標準時 2014 年 1 月 6 日 15:00）頃で、このセキュリティ問題が修正されたのは、太平洋標準時 1 月 8 日遅く（日本標準時 1 月 9 日夕方以降）になってからでした。

ユーザーが出版社のサイトにアクセスするとすぐに、悪質な iframe は悪用ツールキットがホストされている別の Web サイトを読み込みます。悪用ツールキットは Gongda であると特定されており、今回の攻撃では以下の 5 つの脆弱性を悪用していました。

•    Oracle Java SE Runtime Environment に存在するリモートコード実行の脆弱性（CVE-2012-0507）
•    Microsoft XML コアサービスに存在するリモートコード実行の脆弱性（CVE-2012-1889）
•    Oracle Java Runtime Environment に存在する複数のリモートコード実行の脆弱性（CVE-2013-0422）
•    Adobe Flash Player に存在するリモートメモリ破損の脆弱性（CVE-2013-0634）
•    Oracle Java SE に存在するメモリ破損の脆弱性（CVE-2013-2465）

図 2. 攻撃のシナリオ

脆弱性の悪用に成功すると、Infostealer.Torpplar がダウンロードされます。これは、日本のユーザーから情報を盗み出すために作成されたマルウェアで、以下のサイトを含む日本語の Web サイトがウィンドウに表示されているかどうかを監視します。
•    2 つのオンラインバンキングサイト
•    3 つのオンラインショッピングサイト
•    3 つの Web メールサイト
•    3 つのゲーム/動画 Web サイト
•    14 のクレジットカードサイト

注目に値するのは、オンラインバンキングサイトが 2 つしか標的になっていない点で、そのうち 1 つは地方銀行です。ほとんどの銀行は、Trojan.Zbot といった高度なマルウェアに狙われていることを自覚しているため、オンラインユーザーのために幾重にもわたって保護や検証の手段を実装しています。攻撃者もその点を承知しており、金銭になりそうな情報を扱っていながら基本的なセキュリティ対策しか講じていない他のサイトを意図的に狙ったものと考えられます。

盗み出された情報は、あらかじめ定義された Web サイトに平文で送信されるため、傍受されると容易に読み取られてしまいます。

この攻撃で使われている Gongda 悪用ツールキットによって試みられる悪用を遮断するために、シマンテックは以下の IPS シグネチャを提供しています。

• Web Attack: Gongda Exploit Kit Website
• Web Attack: Gongda Exploit Kit Website 2

Infostealer.Torpplar の検出定義だけでなく、この攻撃に伴うファイルに対して以下のウイルス検出定義も用意しています。

•    Trojan.Webkit!html
•    Trojan.Malscript
•    Trojan.Maljava
•    Trojan.Swifi

このような攻撃から保護するために、最新のパッチを適用し、ウイルス検出定義と IPS 定義を常に最新の状態に保つことをお勧めします。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Scammers Exploit Vacation Hangover with Malware Attacks

Hacker Medic January 15, 2014 No Comments

It is not surprising to see scammers exploiting the laxity of Internet users.

Symantec has observed another malware wave over the past few days following the holiday season, as many users check their utility and official emails post-vacation to see if they missed out important ones. This is where spammers take their chances that users will click on malicious links in their emails.

In this wave of attacks, spammers are taking advantage of users’ urgency to open a link and respond to the email instantaneously. When this happens, the malware infects users’ computers and extracts confidential data.

Last week, I too, received some delivery failure notification emails that claim to be from well-known stores with an online presence, stating that I missed out a couple of parcels while I was away on vacation.

At first, I wondered how it happened since I did not place any orders, and the thought that they might be surprise gifts also crossed my mind.

However, just before clicking the link, I checked the status bar only to find that the link had been spoofed. This raised my level of suspicion, which was further confirmed by the language and grammatical errors used in the email, as shown in the following figure:

Figure 1: A spam email with grammatical errors and a malicious link

Similarly, there was an email in which the spammer masquerades another well-known brand, making the message appear to be a statement, while embedding a malicious link.

Fortunately, there was a goof-up between the template used by the brand and the email headers which belonged to another email, with no association between both. Upon further inspection, it was found that the embedded link contained a malware.

The spam run also used a hijacked URL as shown in the following figure:

Figure 2. Another spam email on delivery failure

I bumped into another email which invited me to attend the funeral of someone I did not know. I began to check if I knew the family by any chance, or if it was a college friend, or a neighbor, but then discovered that the link in the email was malicious.

Figure 3: A spam email on a funeral notice

Such spam emails require users to adopt a two pronged approach–to be on guard while sieving through emails, and be able to see through the mistakes made by scammers.

Some of which could be a coercion to click on a link immediately, but they are full of grammatical errors, faulty sentence structures, tactical errors of spoofing one retail operator and associating the email headers with a competitor. Another tactic employed in such spams is the use of hijacked domains and URLs which are rotated and recycled over time, but have no association with the brands or entity.

While you are overcoming your post-holiday blues, Symantec recommends that you exercise diligence when dealing with your emails, and not let scammers exploit your vacation hangover.

2916652 – Improperly Issued Digital Certificates Could Allow Spoofing – Version: 2.1

Hacker Medic January 15, 2014 No Comments

Revision Note: V2.1 (January 15, 2015): Advisory revised to announce a detection change in update 2917500. This is a detection change only. Customers who have already successfully updated their systems do not need to take any action.
Summary: Microsoft is aware of an improperly issued subordinate CA certificate that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. The subordinate CA certificate was improperly issued by the Directorate General of the Treasury (DG Trésor), subordinate to the Government of France CA (ANSSI), which is a CA present in the Trusted Root Certification Authorities Store. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue.

Improperly Issued Digital Certificates Could Allow Spoofing – Version: 2.1

Hacker Medic January 15, 2014 No Comments

Severity Rating:
Revision Note: V2.1 (January 15, 2015): Advisory revised to announce a detection change in update 2917500. This is a detection change only. Customers who have already successfully updated their systems do not need to take any action.
Summary: Microsoft is aware of an improperly issued subordinate CA certificate that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. The subordinate CA certificate was improperly issued by the Directorate General of the Treasury (DG Trésor), subordinate to the Government of France CA (ANSSI), which is a CA present in the Trusted Root Certification Authorities Store. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue.

Microsoft Security Advisory (2916652): Improperly Issued Digital Certificates Could Allow Spoofing – Version: 2.1

Hacker Medic January 15, 2014 No Comments

Rest in Peace Scams

Hacker Medic January 14, 2014 No Comments

The rise of “rest in peace” scam messages on social media sites continues. Jackie Chan, Morgan Freeman, Will Smith, Keanu Reeves, and Rihanna are only a few of the celebrities that have been proclaimed dead in recent scams. The sensational messages usually include links to a video. Before the user gets to see the video, they are tricked into manually sharing the bait message with all of their family and friends in order to spread the scam further. Even after sharing the post, the user will still not be able to see the fake video. Rather, they will be redirected to a site with advertisements that asks the user to fill out a survey. The ads and surveys generate revenue for the scammer. Other variants of the scam ask the user to download a malicious browser extension or application. This kind of scam is not new, but as long as they make money, they will continue.

Figure 1. Fake video scam shared across social media sites

Some scammers are currently focusing on Paul Walker and Roger Rodas, who both recently died in a car accident. Even though the base of the story is true, the scammers are using these tragic deaths to try to promote fake videos which claim to include unseen footage of the crash. One scam group has specialized in the use of malicious Facebook applications to boost the reach of the scam. With a simple geo IP location JavaScript, the scammers can determine the user’s location and redirect their browser to a site that suits their region. This is straight forward and common behavior nowadays. The redirects can point to malicious Facebook apps, remotely hosted scams sites, or phishing sites. Luckily, in this example, the phishing website does not look very convincing, as some browsers break the layout of the site.

Figure 2. Fake Facebook login Web page with broken layout

Unfortunately, the redirects can sometimes skip one of Facebook’s warnings about malicious URLs. Whenever a user clicks on a link in a Facebook post, the browser will get redirected to a transfer script. If Facebook thinks that the destination URL is suspicious, a warning message is displayed, informing the user and allowing them to report the post as spam. Since the Web page is shown in an iframe below the warning, it is possible, in some rare cases, that the scammer could automatically redirect the user to a new site. As a result, the user will only see the warning message for less than a second before they are sent to the malicious Facebook application page. Often, multiple redirects are involved until the final page is reached.

Figure 3. Link redirection warning

If a user attempts to install a malicious application, the app asks for permission to read the user’s data and to post in their timeline. The scammer’s main goal here is to post the message through the user’s Facebook account without the victim’s knowledge so that more people fall for the scam. Once the user installs the application, the scam message is posted to their timeline and the user is redirected to the survey scam Web pages.

A few hundred people per hour have clicked on each of these links and some have installed the application. Of course, Facebook is doing its best to block the malicious links and remove the applications as fast as possible. Unfortunately the bad guys have automated scripts on their side. Each of the analyzed domains hosted more than 2,000 copies of the malicious Facebook application, each under a slightly different name. This allows the scammers to rotate the malicious links once the app is blocked.

Figure 4. Scam application asking for permissions

As always, Internet users are advised to follow best practices:

Be vigilant and skeptical when reading sensational stories on social media sites
Do not install plugins or tools from untrusted sites
Think twice before filling out verification surveys in order to access content
When installing social applications, verify that the requested permissions are really required

Symantec customers are protected against these types of attacks by various IPS signatures and our URL reputation blocking service.

Symantec would like to encourage Facebook users to report any scams that they encounter to Facebook. The Facebook security team is currently working on this particular scam and they are blocking and removing the threat as new versions appear.

Microsoft Patch Tuesday – January 2014

Hacker Medic January 14, 2014 No Comments

Hello, welcome to this month’s blog on the Microsoft patch release. This month the vendor is releasing four bulletins covering a total of six vulnerabilities. All six of this month’s issues are rated ’Important’.

As always, customers are advised to follow these security best practices:

Install vendor patches as soon as they are available.
Run all software with the least privileges required while still maintaining functionality.
Avoid handling files from unknown or questionable sources.
Never visit sites of unknown or questionable integrity.
Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the January releases can be found here:
http://technet.microsoft.com/en-us/security/bulletin/ms13-Jan

The following is a breakdown of the issues being addressed this month:

MS14-001 Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2916605)

Memory Corruption Vulnerability in Microsoft Word (CVE-2014-0258) MS Rating: Important

A remote code execution vulnerability exists in the way that affected Microsoft Office software parses specially crafted files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

Memory Corruption Vulnerability in Microsoft Word (CVE-2014-0259) MS Rating: Important

A remote code execution vulnerability exists in the way that affected Microsoft Office software parses specially crafted files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

Memory Corruption Vulnerability in Microsoft Word (CVE-2014-0260) MS Rating: Important

A remote code execution vulnerability exists in the way that affected Microsoft Office software parses specially crafted files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.
MS14-002 Vulnerability in Windows Kernel Could Allow Elevation of Privilege (2914368)

Kernel NDProxy Vulnerability (CVE-2013-5065) MS Rating: Important

An elevation of privilege vulnerability exists in the NDProxy component of the Windows kernel due to the improper validation of input passed from user mode to the kernel. The vulnerability could allow an attacker to run code in kernel mode. An attacker who successfully exploited this vulnerability could run a specially crafted application and take complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full administrator rights.
MS14-003 Vulnerability in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2913602)

Win32k Window Handle Vulnerability (CVE-2014-0262) MS Rating: Important

An elevation of privilege vulnerability exists when the Windows kernel-mode driver improperly uses window handle thread-owned objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code with elevated privileges.
MS14-004 Vulnerability in Microsoft Dynamics AX Could Allow Denial of Service (2880826)

Query Filter DoS Vulnerability (CVE-2014-0261) MS Rating: Important

A denial of service vulnerability exists in Microsoft Dynamics AX that could allow an attacker to cause a Dynamics AX server to become unresponsive.

More information on the vulnerabilities being addressed this month is available at Symantec’s free SecurityFocus portal and to our customers through the DeepSight Threat Management System.