SonicWALL UTM Research team observed a new Trojan Downloader spammed in the wild starting June 9, 2009 pretending to be from Microsoft Security Department.

The email pretends to contain important Windows XP/Vista security update related to the Conficker worm and also contains a link to download a removal tool. The download link points to the new Trojan Downloader. The link leads to download of the malicious executable file from a domain in Russia:

• windowsupdate.microsoft.com.(Removed).ru/remtool_conf.exe

The downloaded file has zero AV detection at the time of writing this alert and it looks like this:

When executed the Trojan performs following activities:

• Stops the Windows security center service (Service Name: wscsvc)
• Creates a new directory (Windows Temporary folder)nsf3.tmp and drops webexplorer.exe, nsExec.dll, and NSISdl.dll files in it.
• Opens up a new window displaying Symantec Trojan.Brisv.A Removal Tool 2.1.0.7 EULA:



• If the user clicks accept button and starts the tool it will run for a while and display a “fixbrisa” message box at the end:



• It attempts to connect to makemymoneys.com domain and downloads an Injector Trojan by sending HTTP GET request:
  • GET /install/winupdate.exe

  – Detected as GAV: Injector.PI (Trojan)

SonicWALL Gateway AntiVirus provides protection against this malware via GAV: Agent.MSU (Trojan) signature.

Screenshot of the original e-mail message is shown below:

Apple QuickTime is a media player application developed by Apple. It is capable of playing back numerous multimedia file formats from local file system or remote servers. QuickTime movie file is one format of media files that can be played by QuickTime.

A QuickTime movie file consists of Metadata and Atoms. The Metadata stores the description of the media content while atoms are the data units of media content. Each atom contains size and type fields that precede any other data. The common structure of an atom is as below:

 Type      Description --------- ------------------- UINT32    Atom size (n) UINT32    Atom identifier BYTE[n-8] Atom data 

There are a lot of buffer overflow and integer overflow vulnerabilities found in Apple QuickTime product. Most of the vulnerabilities are due to the improper validations of the atoms fields. These atoms include moov, trak, minf, stsd, avcC, rpza, sdtp and so on. For example, there is one memory corruption vulnerability found recently in QuickTime media player, which is due to improper input validation on specially crafted QuickTime movies containing an ‘stsd’ atom with malicious ‘rpza’ video data. The Apple Video compression format (rpza) has the following structure:

 Type      Description --------- -------------------------- UINT16    version UINT16    revision level, set to 0 BYTE[4]   vendor UINT32    temporal quality, 0 ~ 1023 UINT32    spatial quality, 0 ~ 1024 UINT16 width UINT16    height UINT32    horizontal resolution UINT32    vertical resolution UINT32    data size, set to 0 UINT16    frame count, usually 1 

The vulnerable code doesn’t validate the ‘width’ value from the above ‘rpza’ structure and rounds up the ‘width’ value to a multiple of 4-byte and then multiplies it by 4, which may cause an integer overflow. Remote attackers could exploit this vulnerability to inject and execute arbitrary code in the target system.

SonicWALL UTM team has analyzed each of the vulnerabilities, and created multiple IPS/GAV signatures for them. For the vulnerabilities that can not be covered by generic signatures, SonicWALL UTM team monitored the published exploits and released signatures for each of them. The following released signatures are related with Apple QuickTime media player and QuickTime movie file format:

• 1691 Apple QuickTime ctab Atom Heap Corruption PoC
• 1806 Apple QuickTime stsd Atom Heap BO Attempt
• 2107 Apple QuickTime H.264 Crafted Movie BO PoC
• 2293 Apple QuickTime udta Atom Parsing BO Attempt 1
• 2372 Apple QuickTime udta Atom Parsing BO Attempt 2
• 2373 Apple QuickTime udta Atom Parsing BO Generic Detection 3
• 4958 Apple QuickTime crgn Atom Parsing Memory Corruption PoC
• 5031 Apple QuickTime hdlr Atom Integer Overflow PoC
• 5412 GStreamer QuickTime File Parsing Heap Overflow PoC 1
• 5414 GStreamer QuickTime File Parsing Heap Overflow PoC 3

Microsoft Internet Information Server (IIS) is a collection of Internet service packages. It provides Web Server, FTP Server, SMTP Server services and so on. The Web Server service is equipped with the Active Server Pages (ASP) technology which is utilized for dynamic content generation.

IIS supports Web Distributed Authoring and Versioning (WebDAV), an extension set of the HTTP protocol, which allows user to manage files on a Web server, such as creating file, reading files or modifying files. Locking/protection, extended document properties, name space management, and resource collections are included as important features in WebDAV protocol.

The WebDAV extension introduces a new HTTP request header, “Translate”. If the value of this header starts with “f”, the request is for a file, rather than the evaluation result of a server side script. WebDAV also adds PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK and UNLOCK as HTTP request methods.

WebDAV protocol uses an XML-based data transaction scheme defined in RFC 2518. The following is an example of WebDAV PROPFIND request:

PROPFIND /webdav/abc.txt HTTP/1.1 Depth: 0 User-Agent: Microsoft-WebDAV-MiniRedir/5.1.2600 Host: x.x.x.x Content-Length: 0 Connection: Keep-Alive Pragma: no-cache 

A vulnerability exists in the IIS product when WebDAV extension is enabled. The vulnerability is due to improperly handling of Unicode token ‘/’ (%c0%af) embedded in WebDAV request URIs. The vulnerable code in WebDAV extension will discard the Unicode character ‘/’ and return the required resource without proper credentials, which causes the information disclosed to unauthorized people.

An example of an attack request for a protected file is listed bellow:

GET /%c0%af/webdav/confidential HTTP/1.1 Translate: f Connection: close Host: x.x.x.x 

SonicWALL has created and released an IPS signatures that detect and block generic attack attempts targeting this vulnerability. The following signature addresses this issue:

• 1466 MS IIS 6.0 WebDAV Information Disclosure 1
• 1469 MS IIS 6.0 WebDAV Information Disclosure 2
• 1481 MS IIS 6.0 WebDAV Information Disclosure 3

The Oracle Database Server is an enterprise-level relational database application suite. To extend the functionality of the Oracle Database Server, extra packages are included in the suite such as procedures, constants, cursors, and exceptions, in order to ease data management. The included stored procedures and functions are essentially sets of SQL statements that are stored on the server. One such bundled package is the Oracle Workspace Manager.

The Oracle Workspace Manager enables application developers and DBAs to manage current, proposed and historical versions of data in the same database. Interface to the Oracle Workspace Manager tools is provided by the DBMS_WM package. Among the functions supplied by this package is RollbackWorkspace. This function takes two arguments:

 WORKSPACE   - VARCHAR2 AUTO_COMMIT - BOOLEAN

An SQL injection vulnerability exists in the aforementioned function. The flaw is created due to a lack of proper sanitization of user supplied arguments. The function is vulnerable to an SQL injection attack in the WORKSPACE argument. Injecting a single quote inside the data passed in this argument will cause the internally generated script to treat a portion of the passed argument as a separate SQL statement.

The code that may be injected through the vulnerable function is limited in scope, length and functionality. Because of these constraints, execution of any complex SQL commands may only be performed through user created functions. Thus, exploitation of the flaw would require an attacker not only to have valid credentials to log into the vulnerable server, but also to have privileges to create SQL functions.

It should be noted that by default, all database users have permissions to execute the vulnerable function. Thus, a database user with normal privileges may inject SQL statements which will be executed with system privileges on the target database server.

Any injected SQL commands will be executed within the security privileges of the database administrator, SYSDBA, effectively compromising the database server. Exploitation of the vulnerability is considered to be an easy task, given that the attacker has privileges to create functions.

SonicWALL has created and released an IPS signature that detects and blocks generic attack attempts targeting this vulnerability. The following signature addresses this issue:

• 1471 – Oracle LT.ROLLBACKWORKSPACE SQL Injection Attempt

SonicWALL UTM Research team came across a new Fake codec malware drive-by site posing to contain nude Rihanna video.

The drive-by site was actively serving the malware at the time of posting this alert:

 www.scribd.com/(REMOVED)/Rihanna-nude | --> http://tumler(REMOVED)/2.html  |  --> http://xtube-host.com/(REMOVED)Mediacodec_v3.7   |   --> Mediacodec_v3.7.exe (1,984,538 bytes)   detected as GAV: FakeAlert.BDP (Trojan) 

The downloaded malware executable file looks like:

It performs the following activity on the victim machine:

• Creates multiple directories including (App Data)PCenter and (Program Files)PCenter.
• Drops multiple files including (Program Files)PCenteragent.exe and (Program Files)PCenterpc.exe.
• It adds registry keys to ensure that agent.exe and pc.exe starts every time on system reboot:
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunagent.exe = “(Program Files)PCenteragent.exe”
• HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogonShell = “(Program Files)PCenterpc.exe”
• It creates following mutex objects to mark its presence on the system:
  • AMResourceMutex2
  • VideoRenderer
• It sends HTTP request to below URLs:
  • http://194.165.4.(REMOVED)/software_response.php?uid=1235
  • http://privacyupdate447.com/avail

The screenshots of the drive-by site and the Fake codec Trojan being downloaded are shown below.

Main site posing to host nude Rihanna video:

When user attempts to start the video, it opens a new page asking the user to download a certified ActiveX video codec (VAC codec) to protect content Copyrights. The page looks like below:

If the user clicks on the video frame again then it downloads the malware executable file as seen below:

The Trojan is also known as Win32/Adware.PrivacyComponents [ESET], Trojan.FakeAlert.BDP [BitDefender], and Cryp_FakeAV-12 [Trend Micro].

SonicWALL Gateway AntiVirus provides protection against this malware via GAV: FakeAlert.BDP (Trojan) signature.