Category Archives: Finjan

Crimeware server catering to “grab and run” criminals

During our research for the latest Malicious Page of the Month that has just been released, we came across a domain that was being used as a command and control for the Crimeware that was executed on attacked machines. This domain was also used as the “drop site” for private information being harvested by that Crimeware.
When we further examined this server, we found that the stolen data on it was unprotected and freely accessible to anyone – we found no access restrictions, no encryption whatsoever!
In total, we found more than 1.4Gb of personal and business data (including emails and web related data) for grabs, collected from infected PCs.

Obviously, no business or personal data was safe; we found logs with business information on shipments, intellectual property, pension funds, legal cases, patients, marketing strategies etc. but also personal information that criminal elements could use to their own benefit.

Following are some of the records that were on that server for grabs.
We changed/blurred information to protect people’s and companies’ privacy.

Medical record:

http://…../de…nts/…/MedicalRecordReview/ “Diagnosis=Admitted for IV abx 2nd spinal rod infection. Hx of SMA, wheelchair bound, on bipap c back up rate. ESR increased. Ctx neg. Not getting meds at home. Will need 42 days abx…. low grade fever 2 days ago.”

Email communications:

“…Attached you will find our personnel file. Please fill it out in its entirety and return via email….These forms are kept confidential and locked up”

crimeserver1

Outlook with email communications:

crimeserver2

Bank customer’s credit card details:

crimeserver3

We were especially curious how these user data for grabs were managed by the cybercriminals, and we found a C&C application that they used for that purpose.
The administration of this Command & Control (C&C) function consists of a PHP based web application. It managed the infected machines, and enabled the criminal to address specific groups of “users” –by country, by IP, by type of logs, you name it!

crimeserver4

The administrator could also issue commands, instructing the Crimeware on the infected machines to perform certain actions:

crimeserver5

The server we investigated hosted multiple “attack campaigns”.
Each campaign had its own logged data from the infected users, as well as an administrative interface to the attack Crimeware toolkit that was used to infect the users (in this case the “AdPack” toolkit).

crimeserver6

The administrative (statistics) interface to these AdPack toolkits showed how effective each campaign was, and provided statistical information on the geographical location of the infections, and of course, referral statistics to accurately measure where did the infections come from.

With user data services as described above, we now see that Crimeware has reached a new level of sophistication – again!
We see that Command & Control applications enable administrators to manage the actions and performance of their Crimeware. It gives them also control over the users of the Crimeware as well as its victims. Most scarily of all – it also allows easy access to user data.
The full research is captured in our MPOM April 2008.
We would like to emphasize, that due to restrictions set by law, the research discloses only a fraction of the amount and type of data that we found on the crime server.

On the (dis)merits of privacy

Following up on my last post, after filing a complaint with the abuse department of privacyprotect.org (and blogging about the problem), I have just received an update noting that:

–quote–

On investigating on your complaint , we have determined that the domain name “SPYWARESAFE.NET ” is in violation of the terms of usage of the Privacy Protect service. We have therefore,

  1. disabled the Privacy Protect service for the domain name, such that it now displays the putative contact details of the domain name holder, and
  2. notified the sponsoring Registrar about the complaint, who shall act upon the complaint in accordance with their policies.

For any further updates on this matter, you can contact ESTDOMAINS, INC.  , the sponsoring Registrar for “SPYWARESAFE.NET”.

We are extremely particular about preventing misuse of our services in any manner. Should you encounter any other such instances, please feel free to notify us immediately.

–quote–

It’s interesting to note how a little exposure, combined with an email pointing out that the privacy protection is in direct violation of the service terms, gets some gears in motion. Don’t expect though to get complete verifiable details on the domain owner… The known issue with whois data is not limited to hideouts such as privacyprotect.org, but to the entire scheme of how domain registration works, and the accountability (or lack of) of the registrars to make sure that the details of domain owners are at least somewhat relevant. As you can see from the below data, trying to find a “Pavel” that lives in Russia, is like trying to find a “Mohammad” in Saudi-Arabia, or a “Mr. Smith” back in the states…

–quote–

Registration Service Provided By: ESTDOMAINS INC
Contact: +1.3027224217
Website: http://www.estdomains.com

Domain Name: SPYWARESAFE.NET

Registrant:
N/A
Pavel        ([email protected])
kremlin st. 1
Moscow
Moskovskaya oblast,123456
RU
Tel. +495.1231212

Creation Date: 05-Dec-2007
Expiration Date: 05-Dec-2008

–quote–

At least the onion is starting to peel off and maybe hopefully law-enforcement can get better details on the owner, or work with the registrar to track him/her down.

Off to Amasterdam now – see you in BlackHat EU (Friday the 28th, track 2, 10am)!

Taking down a malicious site – the good, the bad, and the ugly…

As part of the “closure” on the February Malicious Page of the Month, which involved meoryprof.info (taken down), and spywaresafe.net we have contacted the appropriate parties in order to notify them that these websites contain malicious code.

Meoryprof.info was the first to buckle (probably under the press exposure), but spywaresafe.net have managed to stay afloat for quite a while. The problem with such domains these days, is that they are usually designed to hide the true owner in the best possible way.

Spywaresafe.net has been running in full-steam for only a short period of time, but has managed to rack up quite a track record of user visits and infections (see the below screenshot from its NeoSploit admin page)

takingDown

(note that this screenshot is rather old and contains data on the first half of February only… nevertheless, almost 300k visits were logged to the main user and 150k more on the second user)

Looking into the whois record for spywaresafe.net would yield a disappointment – it is hidden using a service provided by privacyprotect.org. This service allows domain owners to hide behind an entity that would provide them “privacy”. The practice itself may seem questionable, but privacyprotect.org has a nice website with easy to access forms for requesting the disclosure of a domain owner in case there is some kind of “abuse” done by it.

Well… that didn’t really work. Sending a couple of these forms in the past month got us absolutely nowhere. No response, not even a decline for our request. These guys must be doing a too good of a job protecting something (definitely not internet users, but something…).

On the bright side, when we contacted the hosting company that was associated with the IP address for spywaresafe.net (78.109.18.130), the response was surprisingly quick, and the security guys there took the offending site down (p.s. – always use email, trying to call in brought an unbridgeable language barrier):

—quote—

The actions accepted by us:

Server IP: 78.109.18.130 it is disconnected and formatted.

—quote—

Although the company policy there is not to disclose details about the client who paid for this service (can’t blame us for trying 😉 ).

Moral of the story – undecided (hence – good, bad, ugly?). Seems like the law enforcement efforts does work, on targeted incidents (no follow up on the second domain). Trying to be the good samaritan does not always play well, and you get to hurdles such as these privacy protection schemes (which in my opinion have no place on the internet), and to surprises such as the guys in hosting.ua (Ukraine’s national hosting) who diligently stepped up to the plate. One has to admit that there really is no place for discrimination on the net…

In hope that we won’t have to do any more of this and have law enforcement and CERTs kick in for those cases, I’ll sign off for this time 🙂

Optimizing Cross Site Scripting – and general security practices

We have been working recently on a XSS attack that impacted  a huge number of  potential victims, as the attack itself has been “optimized” by SEO (Seacrh Engine Optimization) practices that pushed it to Google’s indexes.

In itself, this is not a new technique, but the sheer size of it made us take a second look (incidentally, another security researcher has gone public with the details at the same time while we were communicating with Google’s security team about it). So how does it work? Basically the recipe is quite simple:

  1. Find an XSS vulnerability on a major site that has a decent amount of traffic (easy).
  2. Decide what you want your victim to “experience” – this can vary from serving some malicious code, to pure  Crimeware marketing (lessons learned from “what to avoid”  from SPAM email marketing).
  3. Start googling it with the XSS in the URL (most sites normally allow parameters to be passed in a GET rather than enforcing POST only).
  4. Enjoy the show – make sure that the XSS (usually a search page) also contains some keywords that would attract hits from legitimate searches.

XSSed sites used:

From what we have seen so far – including sites such as torrentreactor.net (first one) and zdnetasia.com (on 3/4/2008), tv.com (2/5/2008), torrentportal.com (3/8/2008), University of Pittsburgh’s jurist.law.pitt.edu, torrentfreak.com and fulldownloads.us (3/9/2008).

Unwanted sites used in the attack:

From is-t-h-e.com, through 72.232.39.252, media-toolbar.com, oasdc.info, do-t-h-e.com – all provide some kind of unwanted malware to be eventually dropped onto the unsuspecting user.

And finally – a glimpse into what people are looking for.  Looking at the keywords used as part of the search terms, we discovered a sort of a zeitgeist of popular terms. The obligatory mature content terms (which I won’t quote for obvious reasons!) to the other extreme such as “the lost book of the new testament bible”, and the more spiritual “working with emotional intelligence” as well as the mundane “chevy tahoe specs”. Even techies are properly served with “bash if or condition”. In short, it provides us with a truly “inspiring” journey into what makes us tick (although we already know, still, seeing it is truly believing).

And now for the replies we got from some affected parties:

From torrentreactor  – who we contacted on 3/4/2008, as their XSS was not public at the time (if you don’t count the outing done by other blogs) – we got a pretty quick response thanking us for the notification, and asking if there were more issues with their site. However, there hasn’t been a fix of the XSS issue yet at the time of this writing).

The more interesting view comes from Google (contacted early 3/4/2008). We contacted them since we saw that some of the search results were sanitized of the offending XSS effect, while other still contained a working XSS.

Google acknowledged that this was a known attack vector, and confirmed that they are indeed working on ways to manipulate and “sanitize” links provided by them in an effort to minimize the effect of incidents such as XSS on indexed sites. They also share our opinion on the reality of XSS and its affects on web browsing: “Google recommends that sites fix their cross-site scripting vulnerabilities as a priority. These can be abused in a number of ways, including bad interactions with search engines. Google is helping by reaching out to affected organizations. In addition, Google has internal processes to block abuses when the situation warrants.”

It will be interesting to see how this will work out  since sites still cache search results, thus allowing search engines to index those as results as well. That practice is exploited here where the site is affected by a XSS, which is then in turn “immortalized” when a search engine sees it.

In the meantime we would recommend the following:

  1. Website owners and developers – XSS is rated no. 1 in the OWASP top 10 web application vulnerabilities (no pun intended). Most of them are known. Test for it, fix it. It may not be a direct threat to YOUR site, but it’s a security issue nonetheless and poses a risk to your users.
  2. Stop allowing the caching of search results. All the XSS were found in the search pages of the vulnerable sites. Just disable search engine caching for them. There is no added value in it.
  3. Search Engines – you have the money and the resources. Although it’s OPP (other people’s problem), you can help prevent and mitigate such incidents (kudos to Google for their ongoing efforts).

Ending on a high note – we stand for security of online browsing, as well as responsible disclosure.

Crimeware server and the international man of mystery

While conducting research for the latest Malicious Page of the Month we have just released, we tried to track down the origins of the crimeware.

Obviously, this is a daunting task by itself, and although sometimes security researchers are able to point at specific people as the ones running the criminal activity, it does not always help that much (remember the RBN case where multiple law enforcement agencies were notified, but the people behind the scenes were never arrested or indicted).

Well then, back to our little server – the domain name hosting the crimeware (Neosploit 2.0.13) was hosted in Hong-Kong (see below)

mistery001

So that does not bring us any closer to who is this – as the address is located at a hosting company. Fortunately, our research brought in some additional IP addresses. We managed to grab these from the web server just like we have uncovered the 8,700 FTP account credentials that the research paper talks about (no exploits or attacks were used to do so – simply thinking outside the box sufficed).

Tracking these down proved to be a nice tour around the globe (long whois info deprecated for clarity):

inetnum:        78.109.19.160 – 78.109.19.167

netname:        activebill

descr:          activebill – Andrey Smirnov

person:         Andrey Smirnov

address:        125167, Leningradsky prospekt, 47, Moscow, Russia

remarks:        phone:        +7 095 795 0295

phone:          +7 495 795 0295

remarks:        fax-no:       +7 095 795 0295

fax-no:         +7 495 795 0295

nic-hdl:        AS32250-RIPE

e-mail:         [email protected]

source:         RIPE # Filtered

inetnum:        82.146.40.0 – 82.146.47.255

netname:        ISPSYSTEM

descr:          ISPsystem at MSM

country:        RU

admin-c:        DS2036-RIPE

tech-c:         AB11726-RIPE

status:         ASSIGNED PA

mnt-by:         ISPSYSTEM-MNT

source:         RIPE # Filtered

<>person:         Dmitry Sidorovaddress:        PoBox 30, 664017, Irkutsk, Russia

phone:          +7 495 727 38 79

e-mail:         [email protected]

nic-hdl:        DS2036-RIPE

source:         RIPE # Filtered

person:         Alexandr Brukhanov

address:        PoBox30, 664017, Irkutsk, Russia

phone:          +7 495 727 38 79

nic-hdl:        AB11726-RIPE

source:         RIPE # Filtered

inetnum:        85.17.111.0 – 85.17.111.255

netname:        LEASEWEB

descr:          LeaseWeb

descr:          P.O. Box 93054

descr:          1090BB AMSTERDAM

descr:          Netherlands

descr:          www.leaseweb.com

remarks:        Please send email to “[email protected]” for complaints

remarks:        regarding portscans, DoS attacks and spam.

remarks:        INFRA-AW

country:        NL

admin-c:        LSW1-RIPE

tech-c:         LSW1-RIPE

status:         ASSIGNED PA

mnt-by:         OCOM-MNT

source:         RIPE # Filtered

OrgName:    Galaxyvisions Inc

OrgID:      GALAX-6

Address:    882 3rd avenue 8th floor

City:       Brooklyn

StateProv:  NY

PostalCode: 11232

Country:    US

Putting all these guys on the map results in a very interesting “international man of mystery” cross-continent network of connections:

mistery002

Obviously we are looking at some eastern-bloc oriented operation, with some access to resources in the Netherlands and the US (either other people, or just computers from which access could have been made).

Now that law enforcement agencies are involved with this, maybe we would see some developments on the matter, although from the looks of these pins on the map, I expect some really interesting multi-lingual cop-speak to spur out soon…