The Symantec Veritas Storage Foundation is a storage management suite. The product is composed of several services and agents. One of the services included in this suite is the Scheduler service which listens on TCP port 4888 by default. This is an RPC service with its own built in authentication mechanism.

The authentication mechanism in the Scheduler service utilizes the NT Lan Manager Security Support Provider (NTLM SSP) for security enforcement. The improper utilization of this component allows remote users to establish a NULL session with the service which effectively bypasses the authentication stage of the login procedure. This allows anonymous user logon to the affected service.

Exploitation of this vulnerability may allow anonymous malicious users to add, modify and delete snapshot schedules as well as potentionally run malicious code. SonicWALL has released an IPS signature to detect and block possible attack attempts targeting this vulnerability. The following signature covers this issue:

• (5204) Symantec Veritas SFW NTLMSSP Authentication Bypass PoC

August 21, 2008

In the Web attacks, which affect Mac, Windows, and Linux users running Firefox, IE, and Safari, bad guys are seizing control of the machine’s clipboard. This is a clever new way to spread malware. If someone replies to an e-mail, they may paste from the clipboard, and get the URL. Likewise with blog posts, social-networking sites, anywhere you paste.

Flash banner ads are using ActionScript code to load (persistently) a malicious URL into a target clipboard. They may be using the Flash command setClipboard. The Flash9b.ocx module is used to parse the file. A number of legitimate sites have been seen to host ads carrying the attack: including Newsweek, Digg, and MSNBC.com.

The URL points to a fake anti-virus program. So-called rogue security programs either make bogus claims that the user’s machine is infected with malware in an attempt to dupe people into buying the software, or in some cases, downloads malware rather than real antivirus software.

The particular variant used in this attack is FakeAlert.TY which we have alerted on July 18, 2008. SonicWALL blocks this attack proactively with GAV: Fakealert.TY (Trojan) signature.

We have also released a signature for a variant of the Flash copy-paste exploit – GAV: SWF.CB (Exploit). SonicWALL UTM Research Team is still monitoring for new variants of these attacks and will research them as soon as they appear.

Aug 6, 2008

A new wave of e-mails was discovered with following subjects:

• You Have An Ecard
• A card for you
• Someone sent you an Ecard.
• Your Digital Greeting Card is waiting

They are pointing to the following domains:

• bestlettercard.com
• supergreetingcard.com
• freepostcardonline.com
• worldpostcardart.com
• superlettercard.com
• digitalaudiopostcard.com
• audiopostcardmail.com
• lettercardadvertising.com
• yourlettercard.com
• oldpostcardshop.com

Here are a few examples of such e-mails:

The email contains a fake message claiming your neighbor or flatmate has sent you a greeting card along with a link. If the user clicks on the link , it opens up a page and prompts the user to download postcard.exe file which is the new variant of Storm worm.

SonicWALL detects this new wave with following signatures:

GAV: Zhelatin.ZN_13 (Worm)

Remote desktop software is software which allows graphical applications to be run remotely on a server, while being displayed locally. The remote desktop software consists of two separate computer programs, a “host version” that is installed on the computer to be controlled, and a “client version” that is installed on the controlling computer.

Remote desktop software can be divided into two categories. The first group doesn’t have a centralized server — host version software and client version software finds each other directly. Examples of this type of software include Microsoft Remote Desktop Connection and software use the VNC protocol. When host version software and client version software sit in the same network they work pretty well. However, in the scenario client version software and host version software sit in different networks, for example, a home network and a corporate network, setting up the connection could be tricky.

The second group of remote desktop software uses a centralized server to track active peers. When host version software starts, it signs in to the centralized server; the centralized server will assign a temporary ID to the machine. By providing the temporary ID to the centralized server, client version software gets necessary information of the machine it tries to connect. Host version software and client version software then try to connect to each other, either directly or through the centralized server. Examples of this type of software include GoToMyPC and TeamViewer. Typically this type of software provides great functionality to bypass firewalls.

Remote desktop software is made to increase computer users’ productivity. However, misusing the software could bring up security issues. Therefore some companies have policies that disallow the usage of remote desktop software from external networks.

July 22, 2008

New spammed wave of Storm emails was discovered on July 21, 2008. Storm worm authors have changed their social engineering theme in this new wave and the e-mail arrives with following subjects:

• Amero – the secret currency
• Amero arrives
• Amero currency Union is now the reality
• Amero is not a myth
• AMERO to replace Dollar
• Bye bye dollar, hello amero
• Collapse of the Dollar
• Death of the U.S. Dollar
• Dollar is replacing by Amero
• Dollar is replacing by new currency
• Fall of the Dollar, beginning of AMERO
• No dollars anymore
• North American Union is the reality now
• One Currency for Canada, U.S and Mexico – The Amero
• Say Goodbye to the Dollar
• The Amero is here
• The Dollar disappeared
• The new currency is coming
• Welcome the Amero
• You can forget about Dollars

They have also reverted back to their old format of using IP addresses instead of fast-flux domains in the URL spammed via e-mail. The spammed e-mail looks like below:

The user will see the following page when he or she clicks on the link in the e-mail:

North American Currency Union does not exist and the new Storm social engineering campaign may be using it because of the recent economic slowdown. The webpage also contains a hidden iframe to a script named ind.php which contains drive-by exploits. SonicWALL blocks this script file with GAV: PackTibs.O (Trojan) signature. This signature has triggered 2,794 times since it was created on June 22, 2008.

If the user clicks on the icon on the page, it will prompt to download amero.exe file which is the new variant of Storm worm.

It also drops the following files on the system:

 C:WINDOWSglok+serv.config C:WINDOWSglok+40bc-761f.sys 

It also creates a new service for the glok+40bc-761f.sys and starts it.

SonicWALL detects this new variant with GAV: Zhelatin.ZI (Worm) signature.