New Amero Storm Wave (July 22, 2008)

/in /by

July 22, 2008

New spammed wave of Storm emails was discovered on July 21, 2008. Storm worm authors have changed their social engineering theme in this new wave and the e-mail arrives with following subjects:

  • Amero – the secret currency
  • Amero arrives
  • Amero currency Union is now the reality
  • Amero is not a myth
  • AMERO to replace Dollar
  • Bye bye dollar, hello amero
  • Collapse of the Dollar
  • Death of the U.S. Dollar
  • Dollar is replacing by Amero
  • Dollar is replacing by new currency
  • Fall of the Dollar, beginning of AMERO
  • No dollars anymore
  • North American Union is the reality now
  • One Currency for Canada, U.S and Mexico – The Amero
  • Say Goodbye to the Dollar
  • The Amero is here
  • The Dollar disappeared
  • The new currency is coming
  • Welcome the Amero
  • You can forget about Dollars

They have also reverted back to their old format of using IP addresses instead of fast-flux domains in the URL spammed via e-mail. The spammed e-mail looks like below:

screenshot

The user will see the following page when he or she clicks on the link in the e-mail:

screenshot

North American Currency Union does not exist and the new Storm social engineering campaign may be using it because of the recent economic slowdown. The webpage also contains a hidden iframe to a script named ind.php which contains drive-by exploits. SonicWALL blocks this script file with GAV: PackTibs.O (Trojan) signature. This signature has triggered 2,794 times since it was created on June 22, 2008.

If the user clicks on the icon on the page, it will prompt to download amero.exe file which is the new variant of Storm worm.

screenshot

It also drops the following files on the system: 

 C:WINDOWSglok+serv.config C:WINDOWSglok+40bc-761f.sys

It also creates a new service for the glok+40bc-761f.sys and starts it.

SonicWALL detects this new variant with GAV: Zhelatin.ZI (Worm) signature.

screenshot

Java Web Start Vulnerability (July 25, 2008)

/in /by

July 25, 2008

Java Web Start is a framework developed by Sun Microsystems. Unlike Java applets, Web Start applications do not run inside the browser, which allows an application to implement richer functionality while still preserving sandbox-level security. Java Network Launching Protocol (JNLP) is an XML-based protocol that specifies how Java Web Start applications are launched.

There exists a stack based buffer overflow vulnerability in Sun Java Web Start. The vulnerability, which has been assigned CVE-2008-3111, is due to improper handling of attributes of the j2se element within a JNLP file. More specifically, the vulnerable code copies the values of “initial-heap-size” and “max-heap-size” using a sprintf() function without validating the size of those values. A remote attacker can exploit this vulnerability by enticing the target user to open a crafted JNLP file, potentially causing arbitrary code to be injected and executed in the context of the current user.

SonicWALL has developed 2 IPS signatures for this vulnerability:

  • 5120 Java Web Start JNLP File initial-heap-size BO Attempt
  • 5121 Java Web Start JNLP File max-heap-size BO Attempt

These signatures detect and prevent malicious JNLP files from reaching the internal network.

Fake anti-spyware Antivirus 2009 (July 18, 2008)

/in /by

July 18, 2008

A public beta of Norton Antivirus 2009 opened this week and the scammers didn’t wait long to follow suit with a new bogus scanner: Antivirus 2009.

Antivirus 2009, also known as Antivirus2009, is a rogue anti-spyware program that uses false spyware results to lure you to purchase its full version. Antivirus2009 is an updated version of Antivirus 2008.

Antivirus 2009 is usually promoted via a ZLOB/MediaAccess Codec installer found on adult websites. Zlob has been the trojan of choice to infect users with pop ups disguised as system notifications that lead to websites with rogue anti-spyware programs. You can also install Antivirus 2009 manually on the rogue websites:

More related URLs:

  • Antivirus-2009.com
  • antivirus-scanner.com
  • antivirus2009professional.com
  • antispyware2008purchase.com
  • virusremover2008.com
  • antivirus2009-freescan.com
  • antivirus2009-scanner.com
  • totalantivirusonline.com
  • virus9-webscanner.com
  • windows-scanner.com
  • virus9-webscanner.com
  • xponlinescanner9.com
  • freewebscanner.com

screenshot

We recomend blocking the above domains by editing your local hosts file to redirect them to 127.0.0.1

When clicking on SCAN or CHECK YOUR PC, a “AV2009Install_0011.exe” file is pushed on to your system. It’s usually run-time compressed with UPX or PolyCrypt packer. We have received at least 140 different variants of this threat.

When run it issues a GET HTTP request as follows: 

 GET /download/av2009b.exe HTTP/1.1              Host: antivirus-2009.com

screenshot

Then the fake antimalware product is installed and starts giving fake results and making the system unusable until a full version is purchased.

screenshot

screenshot

screenshot

SonicWALL is blocking this threat with GAV: XPAntivirus_12 (Adware) and GAV: Fakealert.TY (Trojan) signatures.

Adobe PDF Javascript Vulnerability (July 18, 2008)

/in /by

July 18, 2008

The vulnerability is created by a lack of proper boundary checks when processing arguments supplied to several JavaScript functions. Given a large string argument to a vulnerable function it is possible to write arbitrary code past the alloted stack buffer. This results in corruption of local stack variables as well as the return address of the calling function. In effect, exploitation can allow for process diversion to arbitrary code. As the vulnerable application is running within the logged in user security context, the exploitation will be limited to the same. The vulnerability has been assigned CVE-2007-5659.

The method used to store JavaScript in PDF files presents a number of difficulties in terms of detection of malicious files. Firstly, in order to detect a malicious file, the JavaScript code needs to be interpreted to determine its intent. This step requires a JavaScript interpreting engine. Secondly, the JavaScript itself is compressed within the PDF file. Thus, in order to be able to analyze the code, it first has to be decompressed. Lastly, the compressed stream has to be found within the PDF file as it is usually a separate object referred to by an index defined in a previous JavaScript object defenition.

Sonicwall has developed a series of GAV signatures to detect and prevent malicious PDF files from being transfered. These signatures will detect exploits which have been found to be actively used in exploitation attempts in the wild. The signatures detect malicious JavaScript code in its compressed form. There are currently fourteen exploits known to have been used to target this vulnerability. All known exploits are covered by Sonicwall. The following signatures cover this vulnerability:

  • PDF.JavaScript.L
  • PDF.JavaScript.K
  • PDF.JavaScript.J
  • PDF.JavaScript.I
  • PDF.JavaScript.H
  • PDF.JavaScript.G
  • PDF.JavaScript.F
  • PDF.JavaScript.E
  • PDF.JavaScript.D
  • PDF.JavaScript.C
  • PDF.JavaScript.B_2
  • PDF.JavaScript.A
  • PDF.JavaScript.CI.B
  • PDF.JavaScript.CI.A

CEO subpoena phishing attacks (April 16, 2008)

/in /by

On April 14, 2008 hundreds of CEOs received an official looking subpoena via email requesting to appear in San Diego in front of a grand jury. This was a targeted attack known as “whaling”. The emails were only sent to CEOs and they looked legitimate, including personalized name, phone number, and company for each recipient.

The email contained a link to http://CACD-USCOURTS.COM to view the details of the “subpoena”. This domain was registered by an individual in UK 2 days prior to the attack and the web server was hosted in China. The link actually went to a Trojan file, which pretended to be Adobe Acrobat PDF Reader ActiveX Control. Here is a screenshot of the subpoena email.

SonicWALL released a GAV signature to protect against web downloads of malware exploiting the fake subpoena social engineering. The initial Trojan was first seen in the wild on April 14, 2008. Since April 15, 2008, users of SonicWALL’s Unified Threat Management technology have been protected against this threat with the GAV: Small.BSL (Trojan) signature.