Remote desktop software is software which allows graphical applications to be run remotely on a server, while being displayed locally. The remote desktop software consists of two separate computer programs, a “host version” that is installed on the computer to be controlled, and a “client version” that is installed on the controlling computer.

Remote desktop software can be divided into two categories. The first group doesn’t have a centralized server — host version software and client version software finds each other directly. Examples of this type of software include Microsoft Remote Desktop Connection and software use the VNC protocol. When host version software and client version software sit in the same network they work pretty well. However, in the scenario client version software and host version software sit in different networks, for example, a home network and a corporate network, setting up the connection could be tricky.

The second group of remote desktop software uses a centralized server to track active peers. When host version software starts, it signs in to the centralized server; the centralized server will assign a temporary ID to the machine. By providing the temporary ID to the centralized server, client version software gets necessary information of the machine it tries to connect. Host version software and client version software then try to connect to each other, either directly or through the centralized server. Examples of this type of software include GoToMyPC and TeamViewer. Typically this type of software provides great functionality to bypass firewalls.

Remote desktop software is made to increase computer users’ productivity. However, misusing the software could bring up security issues. Therefore some companies have policies that disallow the usage of remote desktop software from external networks.

Aug 6, 2008

A new wave of e-mails was discovered with following subjects:

• You Have An Ecard
• A card for you
• Someone sent you an Ecard.
• Your Digital Greeting Card is waiting

They are pointing to the following domains:

• bestlettercard.com
• supergreetingcard.com
• freepostcardonline.com
• worldpostcardart.com
• superlettercard.com
• digitalaudiopostcard.com
• audiopostcardmail.com
• lettercardadvertising.com
• yourlettercard.com
• oldpostcardshop.com

Here are a few examples of such e-mails:

The email contains a fake message claiming your neighbor or flatmate has sent you a greeting card along with a link. If the user clicks on the link , it opens up a page and prompts the user to download postcard.exe file which is the new variant of Storm worm.

SonicWALL detects this new wave with following signatures:

GAV: Zhelatin.ZN_13 (Worm)

In the recent few weeks, a lot of SQL Injection attacks appeared on the Internet. These attacks use vulnerable ASP or PHP code to inject malicious SQL into the target database server. Furthermore, some SQL Injection Attack Tools have been developed and released on the Internet. The tools can query the Internet search engine such as Google, to find the ASP/PHP pages as the candidate targets. Then, the malicious SQL codes are injected into the target web pages. The attack may affect the database directly, or even the users who visit the infected pages. Danmec/Asprox SQL Injection Attack Tool is a good example.

The main method of these SQL Injections is to send the following HTTP request to the target:

GET /page.asp?id=xx;DECLARE%20@S%20NVARCHAR(4000);SET%20@S=CAST(0x4400450043004C00410052004500200040
00540020007600610072006300680061007200280032003500
350029002C0040004300200076006100720063006800610072
002800320035003500290020004400450043004C0041005200
4500200www.example.com HTTP/1.1

The contents within the CAST function are the hexadecimal value of the SQL sentences, and they may vary. One example of the malicious codes is listed below:

DECLARE @T VARCHAR(255),@C VARCHAR(255) DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype=’u’ AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN EXEC(‘UPDATE [‘+@T+’] SET

In response to these attacks, SonicWALL UTM team has created the following IPS signatures:

• 1062 DECLARE CURSOR EXEC Attempt (Highly Possible SQL Injection)
• 1092 CAST EXEC Attempt (Possible SQL Injection)
• 1445 DECLARE CAST EXEC Attempt (Highly Possible SQL Injection)
• 1074 DECLARE CAST EXEC Attempt 2 (Highly Possible SQL Injection)
• 1079 DECLARE CAST EXEC Attempt 3 (Highly Possible SQL Injection)
• 1080 DECLARE CAST EXEC Attempt 4 (Highly Possible SQL Injection)
• 1111 DECLARE CAST DECLARE Attempt 1 (Possible SQL Injection)
• 1112 DECLARE CAST DECLARE Attempt 2 (Possible SQL Injection)
• 1113 DECLARE CAST DECLARE Attempt 3 (Possible SQL Injection)
• 1114 DECLARE CAST DECLARE Attempt 4 (Possible SQL Injection)
• 3336 SQL Inject Attack Attempt

These signatures will detect most of the attack cases described above. The following figure shows us the SQL Injection Attack activities within the last two months.

From the figure we can clearly find that these attacks began at the end of June, and they are still going. The SonicWALL UTM team will continue monitoring the attacks, and release up-to-date information about these SQL Injection Attacks.

July 22, 2008

New spammed wave of Storm emails was discovered on July 21, 2008. Storm worm authors have changed their social engineering theme in this new wave and the e-mail arrives with following subjects:

• Amero – the secret currency
• Amero arrives
• Amero currency Union is now the reality
• Amero is not a myth
• AMERO to replace Dollar
• Bye bye dollar, hello amero
• Collapse of the Dollar
• Death of the U.S. Dollar
• Dollar is replacing by Amero
• Dollar is replacing by new currency
• Fall of the Dollar, beginning of AMERO
• No dollars anymore
• North American Union is the reality now
• One Currency for Canada, U.S and Mexico – The Amero
• Say Goodbye to the Dollar
• The Amero is here
• The Dollar disappeared
• The new currency is coming
• Welcome the Amero
• You can forget about Dollars

They have also reverted back to their old format of using IP addresses instead of fast-flux domains in the URL spammed via e-mail. The spammed e-mail looks like below:

The user will see the following page when he or she clicks on the link in the e-mail:

North American Currency Union does not exist and the new Storm social engineering campaign may be using it because of the recent economic slowdown. The webpage also contains a hidden iframe to a script named ind.php which contains drive-by exploits. SonicWALL blocks this script file with GAV: PackTibs.O (Trojan) signature. This signature has triggered 2,794 times since it was created on June 22, 2008.

If the user clicks on the icon on the page, it will prompt to download amero.exe file which is the new variant of Storm worm.

It also drops the following files on the system:

 C:WINDOWSglok+serv.config C:WINDOWSglok+40bc-761f.sys 

It also creates a new service for the glok+40bc-761f.sys and starts it.

SonicWALL detects this new variant with GAV: Zhelatin.ZI (Worm) signature.