CounterMeasures - A Security Blog

YES the partner friendly exploit system.

Rik Ferguson — Thu, 11 Mar 2010 16:01:31 +0000

The Russian crimeware “YES Exploit System” is a fully manageable system that generates malicious code for injecting into compromised pages or malicious web sites. This code is designed to redirect victims to files on your own hosted exploit server allowing you to push out malicious files invisibly and instantly, and it just got a major verion update.

The advertisement for the latest version boasts:

“Hacked all Windows version 9x to 7 32 bit and 64 bit
Hacked all browsers running a vulnerable plug-in”

Using the built in TDS (Traffic Direction System) criminals can specify which malware they want to push out by country, by browser and by OS. It is clearly designed to support the inter-related vendor infrastructure of the criminal economy. YES Exploit System is a fully fledged platform for delivering malware on behalf of other criminal enterprises, perhaps to seed a new ZeuS campaign or maybe to push out some scareware. As previous blog posts have shown YES is often bundled into full service underground ZeuS offerings. As you can see from the screen shot below, projects can be divided on a per-customer basis.

click to enlarge

One feature that really stood out for me in this new version, in light of other recent blog postings, was the addition of a module that automates testing against AV vendors to ensure the malware remains undetected. This is in addition to URL checking functionality already released in earlier versions of YES.

In another illustration of cloud adoption in online crime, the module is priced on a subscription basis at $70USD per month (including support of course) and tests malicious files against 26 of the biggest security companies out there. All processing is offloaded so as not to overburden your own server.

click to enlarge

As is so often the case, the first step in this chain of compromise is a malicious script inserted into an otherwise innocent website, my previous blog gives you a few tips on securing your browser against these types of attack.

Which browser is the most secure, is that the question?

Rik Ferguson — Wed, 10 Mar 2010 17:20:02 +0000

Over the past week I have been asked twice now for my opinion on the question “Which browser is the most secure?” Probably as a result of the release of Microsoft’s “Browser Choice” update. In my view, this choice that people are being prompted to make is leading most of us to ask the wrong question entirely. Your browser will not keep you safe, whoever made it, you need to take steps to keep *yourself* safe, whichever browser you choose.

Image: J. Anderson

This update no doubt exposes millions of users to a choice which they may not, in many cases, have even been aware they were able to make; the choice of which application to use when browsing the web. Many alternatives are available when making this important choice; Internet Explorer (natch), Mozilla Firefox, Safari, Opera, Google Chrome and seven others are on offer through the Microsoft pop-up.

Rightly security is many folks’ primary concern when browsing online these days, so they want to know which browser is the safest or will offer them the highest personal security. I’m not convinced though that “Which browser is the most secure?” is really the right question.

Every browser has its flaws, vulnerabilities and patches (or lack of them). In any case attacks are increasingly aimed not only at browsers but at application plug-ins like QuickTime, Flash or Acrobat that can be used in multiple different flavours of browser. Either that or they are simply attacks aimed at the individual using the browser (like phishing, pretexting and other social engineering attacks).

Better (and more useful) advice than “Which browser is most secure?” would be “How can I best secure my browser of choice?” Trend Micro offers free tools such as Browser Guard and the Web Protection Add On for Internet Explorer. Browser Guard detects and blocks popularly used exploit techniques (such as heap spray and buffer overflow as well as looking for shellcode) offering proactive protection against unknown threats. The Web protection Add-On blocksknown malicious sites. Many other tools and plug-ins for many other browsers are also out there such as AdBlock Plus or NoScript for Firefox just for example.

It’s different strokes for different folks and various security tools or techniques require varying degrees of familiarity with the browser, with technology or with threats in general in order to effectively protect you without ruining your Internet experience beyond redemption. Helpfully, different indpendent tests and opinions will give you conflicting advice, of course.

In most cases the best advice is stick with the browser you are most familiar with but take steps to secure it. If you suddenly jump into using a browser with which you are unfamiliar, just as a simple knee-jerk reaction your unfamiliarity may leave you less secure than you were before the change.

Cybercriminals research their own bad reputation

Rik Ferguson — Mon, 01 Mar 2010 20:47:42 +0000

While the anti-malware industry is still working on agreeing standards for effective product testing, the criminals already know it’s no longer all about the files.

A few years ago, criminals figured out that traditional anti-malware solutions could be overcome by a surge in the volume of malicious files. If malware code could be rolled often enough, then by the time the security companies had a pattern file available it would already be out of date. This realisation is responsible for the exponential growth in malware we have seen over the past three or so years, a growth that has put a serious dent in overal detection rates of file-centric security solutions. One of the services that has grown up around this explosion of variants is the file-scanning on demand against multiple security vendors, which I have previously blogged about.

Of course it was always going to happen, but the criminals have seen the industry’s response to the threat of volume and their service offerings are evolving to cope. Any decent security solution now will include detection for the threat as a whole, examining not only the malicious file, but the source email or the destination website or IP to get a holistic view. So it is becoming important for criminals to know not only when their file is being detected, but also when their web presence for distribution of Command & Control gets blacklisted, and they need that information real-time.

Enter AdwareSpywareDetective, a file scanning service that has been online since October of 2009. A colleague pointed out to me yesterday that their service has evolved. Now not only do they offer file scanning by subscription but will also include Domain, IP and URL scanning against sixteen different databases, including ZeuS Tracker, Malware Domain List, Spamhaus, Google Safe Browsing, Microsoft SmartScreen and a litany of others (not yet including Trend Micro).



The service boasts that they made their 500,000th check on the 23rd February against their 27 different AV vendors and 16 domain, IP or URL databases.

In fact their site boasts

“This service is about to help you in anonymous check of different anti-virus system. This check will be made by numbers of anti-virus system and no reports will be send to developers of this anti-virus system. You can be fully sure that your files will not be send to anti-virus databases. All reporting system in our version of anti-virus engines was disabled MicrosoftSpyNet, ESET ThreatSense.Net Early Warning System etc.

Updates of all anti-viruses made each hour, most of main anti-virus system made updates in real-time.

We give you maximum speed of scanning, 10 files will be scanned by all anti-virus system starting from 30 second.

We support periodic checks. You need to select amount of time that check will be happened, and select method system will contact you after found something suspicious.”

Unfortunately it’s true that as soon as you build a better mousetrap, some rat comes along and eats all the cheese.

Rogue Facebook app “Like” pushing Zwinky & MyWebSearch

Rik Ferguson — Sat, 27 Feb 2010 17:09:25 +0000

Initially I wasn’t going to blog about this, as I didn’t want to appear to be on a run of Facebook related posts. However this has been ongoing for over a week now, this same rogue app keeps reappearing, several of my own friends have fallen victim, so a warning seems like a good idea!

The rogue Facebook app in question has appeared for at least the third time in the space of a week and is clearly designed to fool victims into clicking the spam notifications it sends out, in order to earn the scammer some cash through affiliate based advertising.

The app is named “Like” and borrows the icon from the official Facebook “Likes” function. The Spam notifications it sends out have also been designed to resemble the real Facebook functionality. The name of the application contained in the Facebook URL has equally been designed to fool each time, it has been ”im_best_app”, “farn_ville” and “pet_villeik” respectively.

Rogue app Facebook notification.

If you click the link in the notification you are invited to allow the rogue app access to “your profile information, your photos, your friends’ info and other content it requires to work”. Of course with the app having ‘borrowed’ so freely from official Facebook look and feel many otherwise cautious users are falling for the ruse.

Rogue app "Like".

If you do click the “Allow” button you will very briefly see an application page that simply reads “Error! Error! ERROR!” before being forwarded to an external (to Facebook) website hosted at Dizzy Networks.

Like Facebook app page

Dizzy Networks is a “technology focused advertising company” whose advertisers are apparently “hand selected and control their campaigns to fully optimize your overall performance“. Although, if you were interested in signing up as an advertiser for Dizzy Networks you’ll need to be trusting because the terms and conditions that you must agree to are “coming soon”!

The page at Dizzy Networks contains only a JavaScript that redirects once more to the landing page at Zwinky proposing the installation of the Zwinky software. The URL of that landing page contains the partner ID ZJxdm493 which would perhaps identify the person behind the scam. At the very least it would appear that Zwinky may be paying out commission under false pretences and Facebook users are having their personal information put at risk.

Facebook staff have responded to user complaints and to the information that I have sent them very rapidly in the two previous cases and I am sure this third example will also be removed quickly. Wouldn’t it be great though if some mechanism could be put in place to protect their hundreds of millions of users proactively?

All that glisters is not (Facebook) gold.

Rik Ferguson — Sun, 21 Feb 2010 23:30:44 +0000

There is no Facebook Gold Account, but internet scammers would have you believe otherwise.

: Facebook Page Suggestion

Gold Membership Trolling has been doing the rounds for a few years now, it started in 2007 as a prank aimed at users of the 4chan image board. Bogus images were posted that supposedly only “Gold Members” could view. This was a troll to fool people into believing that paying for an upgraded account was necessary.

4chan Gold Account from whatport80.com

As is the case with many internet memes the Gold account scam has been picked up and is being abused by criminals looking to turn a quick profit.

Facebook pages have been set up with names like “GET YOUR UPGRADE WHILE THEIR FREE!!” which promise the unwary enhanced functionality and freedom from advertisements, among other things. Just a quick look at a couple of features of the Facebook page should set some alarm bells ringing though.

: Bogus Facebook Gold Account page

I have been biting my tongue (or my fingers) trying not to mention the terrible spelling error in the page title, but there it is, that’s a clue. Also if you were to examine the list of “comments” on the right you would notice that they are not comments at all, rather an image file which itself also links to the scam web page.

So what’s the point for the scammer? Well if you follow all the instructions, first you invite all your friends to come and check out this (cough) great deal. Then, if you are credulous enough to click the button, you are informed that in order to access the Account Upgrade page you must complete “1 quick, free survey”, different versions of the scam page offer different surveys, but this is where the money is made.

The survey I tested linked (via a couple of affiliate marketing services) to a “Werewolf vs Vampire” quiz which promised to tell me which I am (surely I should know that already?) at the end of the ten questions I am invited to enter my mobile phone number to receive my results. If I do that I am agreeing to pay a £9.00 joining fee followed by £9.00 every week until I cancel my membership via SMS.

Of course the terms and condtions are displayed on the page, but to say that I arrived at the quiz under false pretenses would be understatement to say the least. The scammer will almost certainly be receiving a commission for every activation they drive to the quiz site. There are currently over 50 different versions of this particular page on Facebook, with a total of over 1,000,000 fans! I have informed Facebook and I’m sure they are removing the content as we speak.

Top tips to avoid this kind of scam; before you forward anything to any of your friends or contacts, research it. You may be in time to save yourself but your Aunt Petunia may not be so clued-up.

Never give up your mobile phone number to receive the results of an online quiz or survey, if they can’t show you in a web page, it’s not worth seeing.

Don’t believe any tales about Facebook functionality being added/taken away/made chargeable unless you hear it from Facebook themselves. Criminals are obviously aware of the huge popularity of Facebook and are using it to their advantage.

Kneber for sale or rent (rooms to let 50 cents)*

Rik Ferguson — Fri, 19 Feb 2010 13:15:58 +0000

I realise I might be getting a reputation as the infosec curmudgeon, always ready with a bucket of cold water when the occasion demands, but once again I feel moved to write about hype.

“Seemingly there is no reason for these extraordinary intergalactical upsets. Only Dr Hans Zarkov formerly at NASA has provided any explanation”*

Stories in the press recently have been aghast at the scale of a “new” botnet called Kneber. According to a report from NetWitness one particular botnet that uses the ZeuS crimeware has successfully infiltrated thousands of corporations and tens of thousands of computers. This is of course terrible news for the companies affected and certainly many corporate security lessons can be learned from experiences such as this.

What is important to point out though is that there is nothing at all that is “new” or “unprecedented” about a botnet using ZeuS or a botnet of this size, ZeuS (or ZBot) has been around since at least 2007. In the online underground ZeuS is the equivalent of commodity crimeware. It is openly traded in online forums both as a software product and as preinfected botnets. Increasingly providers are finding that they must bundle services with their criminal offering, or Crimeware as a Service.

Screen shot from underground forum

Older versions of the software are downloadable free of charge, though these are often backdoored by other criminals. There is no honour among thieves. In fact botnets are in such plentiful supply that the price of preinfected machines is surprisingly low.

175 thousand bots for sale... globally.

Of course if you don’t have the means or the desire to run your own botnet, you can always simply buy the output…

I'm a lumberjack and I'm OK. Logs for sale.

A quick look at ZeuS Tracker shows they are tracking almost 1300 command & control servers for various ZeuS botnets of which about half are online right now. They show the average binary detection rate (how your antivirus products detects using pattern files or signatures) is as low as 49.62% which goes some way towards explaining the successful infection rate.

It is widely known that malware writers and other criminals have already worked out how to overcome traditional anti-malware protection that relies on pattern or signature updates. They simply roll their code as often as possible, estimates say that we are currently seeing a unique malicious binary every 1.5 seconds.

So here’s corporate security lesson number one from this recent publicity…

Make sure your anti-malware solution is not relying simply on the infection layer “what the file looks like“; make sure that it is also investigating the exposure layer, “where the file comes from and who the file reports back to“. If ZeuS Tracker knows where the bad guy servers are, so should every one of your endpoints. At that point, what the actual binary looks like becomes a secondary issue.

By the way here is a free tool to check if you are a part of a bot network.

* With apologies to Roger Miller and Queen

Polticians and scum-sucking pigs make uncomfortable bedfellows

Rik Ferguson — Tue, 16 Feb 2010 11:27:05 +0000

In yet another example of the potential pitfalls of social networking in the workplace, a British MP for Telford and party whip is today at the centre of a storm over an offensive post on the micro-blogging site Twitter.

MP David Wright tweets

Yesterday evening, the Twitter account of MP David Wright posted the message

“#ivenevervotedtory because you can put lipstick on a scum-sucking pig, but it’s still a scum-sucking pig.”

The tweet was joining in with the Twitter meme responding to the latest Tory poster campaign which features the tag line “I have never voted Tory before but…”. However the turn of phrase has hit a raw nerve among many Twitter users, prompting the MP to delete the offensive tweet and apologise.

TrippyPip talks to David Wright MP

Out of interest, in response to the question above “Do you *really* think it’s acceptable to call people ’scum-sucking pigs”???” The MP responded as in the next image:

MP David Wright tweets

The story doesn’t end there though.. David Wright MP has said that he actually posted the comment as “#ivenevervotedtory because you can put lipstick on a pig, but it’s still a pig.” (in a kind of homage to Barack Obama use of the phrase during his election campaign) but that his message was subsequently “tinkered with” and the extra words added. Mr Wright told the BBC that this was a legitimate “edgy Twitter comment about the political process” and the Tories’ “general policy position“.

I’ll be very interested to see how this story ends, because currently neither the Twitter interface or any of the third-party Twitter clients have any kind of functionality that allows the editing of Tweets once they have been posted. So for these words to have been mischievously added by persons unknown must mean a quite substantial security failure at Twitter themselves. Either that or Mr. Wright just forgot what he actually typed.

Twitter.Grader.com hacked?

Rik Ferguson — Thu, 11 Feb 2010 20:07:29 +0000

Twitter Grader home page

UPDATE: You will see in the comments on this post an update from HubSpot with a link to their blog explaining the incident, I know a lot of folks don’t read the comments, so here it is in full.

“We are very sorry for the mistake. It is completely our fault. As your article mentions, we have contained the situation and stopped the malicious tweets.

We do want to make clear that by design, the HubSpot software applications are on different servers and systems from our free Grader.com tools. This attack did NOT affect the HubSpot software used by our 2,100 customers. Again, there is no impact on our paid product or paying customers.

We have posted an article on our company blog with more information:

http://www.hubspot.com/blog/bid/5594/One-Lesson-From-The-Twitter-Grader-Screw-up-OAuth-Rocks

- Mike Volpe
HubSpot (makers of Twitter Grader)”

…and that, ladies and gents, is an object lesson in how to deal with an event like this. Much respect to HubSpot.

__________________________________________________________________________________________

In what looks like another compromise related to Twitter services, a large number of Twitter users who have granted access to their accounts to the web service Twitter.Grader.com have all begun tweeting a bizarre and unauthorised message.

: Example of affected accounts (search by Twitscoop)

Fortunately the link that has been endlessly tweeted by grader users does not appear to host any malicious content. It points to a blog with an embedded YouTube video of Biz Stone back in 2006 promoting Twitter.

The domain name of the destination site however might give us a clue to the motivation behind the attack. Seonix presumably refers to Search Engine Optimisation and perhaps that is the real purpose of this attack. Forcing large numbers of Twitter users to tweet a link to the site may well be an effective method of pushing it up the search engine rankings. The domain seonix.org was created on the 11th February 2010 and the details of the owner have been anonymised.

Embarassingly the victims of this attack also include Dharmesh Shah, the founder of Grader

: Dharmesh Shah on Twitter

UPDATE: Hubspot, the parent company have tweeted that they are aware of the hack and working on a solution. In the meantime, if you are a Grader user, you may want to consider temporarily revoking Access to Grader in your Twitter profile via Settings -> Connections.

Cloud Control

Rik Ferguson — Thu, 11 Feb 2010 19:13:58 +0000

Three quarters of UK CIOs see security as being the major barrier to cloud adoption and yet if you take a look at the Wikipedia (I know, I know) entry on cloud computing, “Security” is listed as one of the Key Characteristics of cloud-based services, how can this be?

One of the reasons for this apparent contradiction must surely lie with the language itself, and not the technology. We already know that the term “cloud” when applied to technology has a different meaning to everyone who uses it and everyone who hears it. Hell, the term “cloud” when applied to clouds has a multitude of possibilities! The truth is though the same is true of the term “security”.

If you talk to a sysadmin, a network admin, a coder, a hacker, a security guard, a facilities manager or a three star general about security then once again they will each have their own understanding of the definition, the aims and the means of achieving that elusive “security”. If you ask a C-level executive what security means, especially in the context of cloud, then they will have a different understanding again.

To an executive, security is all about control and accountability. Data and the management of data are the asset and the task that are currently mostly considered for delegation to cloud providers. Today’s legislation places a burden and corresponding sanctions on corporate executives to ensure that the data which they hold is stored and processed in a secure manner. Future legislation promises to extend this burden of accountability and the penalties for non-compliance can be severe, stretching, if you’ll pardon the pun, to even to jail-time.

When your most precious assets are tucked up tight in your own data centre, handled by your own employees on physical systems that you can secure discretely then creating an audit trail and accountability is far simpler. The control remains with the data owner. In the cloud environment as it currently stands, much of this control is outsourced, but none of the accountability.

Virtualisation, multi-tenancy and storage area-networks are the technological engines powering cloud services. The rapid provisioning of virtual machines across highly-scalable, highly available infrastructure gives cloud providers the economic advantage that is their business promise. Cloud customers need to be secure in the knowledge that they retain control over the secure perimeter of their virtual machine and that it is not dependent on any configuration at the provider end. Cloud customers need to know that their data is sufficiently encrypted in the SAN that it cannot be accessed or used by anyone other than those who hold the keys and that the keys are not held by the cloud provider.

In order to increase the acceptability of cloud to the enterprise executive, we need to design tools that ensure control over the security of key underlying technologies. It is only when a CIO has control that they can reasonably be expected to accept accountability.

Your guilty conscience could get you pwned

Rik Ferguson — Wed, 03 Feb 2010 15:28:59 +0000

I just received an email from some guy called Willie Hickey. Aside form having an extremely amusing name, Mr. Hickey was offering me some very urgent advice:

Mail from Willie Hickey

The message reads

“Hey, some jerk has posted your pictures (u understand what kind of pictures are there) and sent a link of them to all ur friends. I have already replied back. Said, that he is an idiot. See the link:”.

This little piece of social engineering is obviously designed to arouse fear and doubt in the recipient; “Oh no, not those photos, the zookeeper promised he would destroy the negatives.”

Don’t be tempted though to click the link. There are no photos, there is no Willie Hickey.

The link leads to a malicious JavaScript which redirects the browser to a Russian IP address where multiple PDF exploits and an ActiveX exploit are used to push out a variant of the ZeuS crimeware. The sample itself has very low detection rates with only 9 out of 40 detections on VirusTotal

If you’re already a Trend Micro user you would be protected from this as the malicious website is already blocked by the Smart Protection Network and the malware detected. If you have received a similar mail and clicked the link and are worried you may be affected, run a free clean up with HouseCall.