Recently I came across what could possibly be the next iteration of Koobface, W32/Koobfa-O, which came with Skype hacking functionality and some additional promises for the future. The new variant of Koobface attacks Skype accounts on the compromised machine to get various pieces of information about the victim using the different Skype API commands. The following screenshot demonstrates a few:

W32/Koobfa-O collects information about the user such as HOMEPAGE, ABOUT, PHONE_MOBILE, PHONE_OFFICE, PHONE_HOME, CITY, COUNTRY, BIRTHDAY, FULLNAME, PSTN_BALANCE etc. The collected information is dumped into a file which is packed as a RAR archive and either emailed or uploaded to a remote server. The worm then logs on to Skype chat as the user and starts a conversation with friends online. In the body of the worm there are snippets of conversation in 18 different languages including some Asian languages. The following screenshot shows a snippet of available conversation items in English:

I initially expected that there might be some lexical analysis being done to talk somewhat intelligently with the person at the other end of the chat, but it seems the worm pastes conversation pieces fairly randomly. This will be because the worm supports conversation in 18 languages, and it is too complicated to do a lexical analysis for the different languages. It is easier to just randomly chat. The worm will also paste a link to a compromised domain in the chat conversation, visiting which will download W32/Koobfa-O.

W32/Koobfa-O also does something which promises upcoming functionality in the future.

Koobface already attacks Facebook and MySpace, so those two on the list are no big surprises. The list contains new additions: blogger.com, wikipedia.org, youtube.com, yahoo.com and google.com. The worm doesn’t do much except look to see if some information (possibly credentials) exists for these domains. But is this a promise for the future? Clearly as social networking and collaborative sites/tools multiply in number and become bigger, more malware will attempt to take advantage of them.

Following the links will lead a user to arrive at “making-money-with-Google” or Online Pharmacy sites:

The Twitter accounts themselves appear to be legitimate and do not look to be bot-registered. They contain normal-looking tweets in the previous days and months. We’re still looking into how the accounts are compromised. Certain malware such as koobface would steal Twitter credentials. There is also the possibility of the accounts credentials being compromised through phishing.

As for regular users, it’s important now more than ever to scrutinize the links you receive through Twitter. Today these links point to spam sites. Tomorrow these links could be pointing to malware.

Do you think she’s hot? Her name’s Katya and she is my latest entry to my long list of “girlfriend-wannabe” / “potential one-night-stands”. If my mum were to find out about her, she will definitely give me a hard backhand on my head for letting such a great girl like Katya waiting.

Katya wrote me a really sweet email. However, I am appalled by her English. Let me share snippets of her declaration of love for me :)

1.   The agency of acquaintances has a contact to other agencies of acquaintances in other countries and I have received yours e-mail, therefore now I write to you.

I must get hold of her agencies of acquaintances as they do have acquaintances who are pretty young things!

2.   I very much like walks on fresh air, I very much love the nature.

She can walk on air! I’m impressed n_n

3.   I like the sea and it is pleasant to float, in the summer I like to float and sunbathe.

Floating is easy. Dead people float too.

4.   I trust in family and love, and I search for the person to the one whom I will give all heat of my heart and with that whom I will be always together,

I feel for you too girlfriend!

5.   My person, clever also has strong spirit, he is kind and magnanimous and generous, he will be do something for me, and will know, that I will be do something for him.

Yup! I do fit her checklist :D

On that I will finish my blog entry. Katya, “if I have interested you then write to me.” :)

For the most part, such obfuscations (in particular JavaScript) are relatively easy to unravel because they are static transformations [3]. The more complex encrypted forms require some form of script emulator (or your browser of choice) and a skillfully inserted alert() instead of eval(), however a new form akin to the one-time-pad concept is now being deployed.

Script obfuscated and encrypted with contextual data

Such [quasi] one-time encryptors function by generating and encrypting the content on-demand while at the same time choosing a key which is a function of the download environment, such as the referer or the last modified time. When the script is rendered it has all the necessary information to correctly decode. However when that script is submitted by the customer for analysis, the environment has long been destroyed making the script nearly impossible to decode.

Thus examining the script on Friday 13th (13/11/2009) at 11:08:23 yields (poorly) decrypted content which does not render.

Script decoded with wrong key

yet behold, on (every) 47th second of the 7th day of each month the script correctly decodes revealing its secrets - here, deciding whether to serve a (quite likely malicious) PDF, or Flash element.

Correctly decoded given context

Static offline analysis of such scripts is easily thwarted, however any scanning engine which has access to the HTTP data stream should be able to cope since it has all the relevant contextual data required at the time of rendering.

Brute-forcing aside, the only real way to tackle this problem is to use “Just in time” detection (otherwise known as on-access), failing that, NoScript remains your best protection.

Dear Microsoft Customer,

Starting 12/11/2009 the ‘Conficker’ worm began infecting Microsoft customers unusually rapidly. Microsoft has been advised by your Internet provider that your network is infected.

To counteract further spread we advise removing the infection using an antispyware program. We are supplying all effected Windows Users with a free system scan in order to clean any files infected by the virus.

Please install attached file to start the scan. The process takes under a minute and will prevent your files from being compromised. We appreciate your prompt cooperation.

Regards,
Microsoft Windows Agent #2 (Hollis)
Microsoft Windows Computer Safety Division

The fact that the so-called antispyware program comes attached with the email is a good indication that something is not looking right.

When the attached program was executed, it did not start a “free system scan” as claimed, but instead it simply moved itself into other folders in the system and have set up itself to be automatically started on windows startup.

Not surprisingly, the attached file is detected by Sophos as Mal/FakeAV-AX and the email message has also been blocked.

This is another example of social engineering tricks employed by malware authors to capitalize on fears of the user to entice them into running malicious software.

As always with dealing with emails, think twice before running what came with the attachment.

Do you have adequate protection?

For your Internet browsing?

Earlier this week SophosLabs spotted that the famous chip shop brand Harry Ramsden’s website had been haked by a malicious iframe. I codn’t believe it when I saw that the mootools.js script on the site is infected with Troj/Iframe-DF meaning that the website isn’t the plaice to visit.

The injected code is all mushed up though so the malicious script may be floundering.

The obfuscated iframe points to a haked site in Germany that when you go there redirects you to a fake Google site registered in the EU. Which triggers Troj/ObfJS-R.

I don’t want to carp on about the responsibilities of Web masters and Web hosters but they really have to protect their sites as well as tuna them up.

All this talk of fish’n'chips has made me hungry for a chip butty.

*Apologies for the puntastic tabloid style of this post but it is Friday :)

“Tweeting for # years, # months, # weeks, # day, # hours, # minutes # seconds (MM DD, YYYY) How about you? <link>

Being curious, I decided to investigate the link.

The first thing it does is ask for your screen name and shows a bunch of ads of “How to get more Twitter followers”. Ok, not the best ads, but moving on. You enter the screen name, then hit go. It looks up the name and gives an accurate date, but then it offers to tweet it for you. So you enter in your username and password. Wait a minute. That would be handing over your password to an unknown entity.

I did some initial investigation of the url. It’s only been around two months and is hosted with a fairly dodgy source, a proxy hosting service. This is a private hosting so you can’t see any info on the person/business who actually own the site. Hmmm. Usually, legit sites don’t mind having that info available. I also notice it doesn’t use the OAuth verification that many Twitter sites use to mean they are trying to be legit. Again, seems suspicious.

But how many people have willingly sacrificed their passwords by using such seemingly benign tools or links or applications? They seem totally harmless, don’t they? Like I posted in my previous blog post here there’s great value to malware authors to get that info. Now I’m not necessarily condemning this particular tool, this one may be totally innocent, but I feel compelled to warn people to not just blithely hand over their passwords. PLEASE think about what you are doing, even if it seems like it’s harmless fun.

Mention-worthy updates this month include MS09-065 and MS09-068.

MS09-065 addresses several kernel vulnerabilities. The vulnerability of particular concern is related to specially crafted Embedded OpenType fonts, and could be exploited to run unauthorized code in the system context.

Most remote code execution vulnerabilities we see typically run in the user context at the same privilege level as the currently authenticated user. Now, if you’re the user this means that all your files are at risk, but the system itself is reasonably safe (unless your administrator hasn’t been adhering to best practices, and has granted you administrative privileges … in which case you’ve pretty much granted the attacker’s code access to the entire box). With this kernel-mode driver remote code execution vulnerability, the current user’s privilege level is irrelevant. It doesn’t matter how unprivileged the current user is - the unauthorized code has unfettered access to the local system. Assuming, that is, the attacker doesn’t destabilize the system and BSOD before their code runs. Kernel vulnerabilities have a habit of not just bringing down processes, but bringing down entire boxes.

MS09-068 is mention-worthy, as it addresses issues in Microsoft Word, for both the Windows AND Apple platforms. Windows users that have automatic updates configured will automatically have protection provided to them - but Apple users will have to rely on the Microsoft Office Update Utility “Microsoft AutoUpdate” or go to here, here or here, to download the relevant update.

You can find the rest of our analysis here.

And, as always, if you’ve found our vulnerability posts to be valuable, or have some suggestions for how we can better serve you, please let us know at sophosblog@sophos.com

I am not going to debate whether this is a good or bad policy on the part of Facebook. What I want to talk about is the blatant hacking of the group “Control your info”. While I understand their desire to “help” hacking and defacing groups on Facebook is hardly the way to go about it.

Once they joined a group and took it over, they would post the following message there:

“This means we control a certain part of the information about you on Facebook. If we wanted we could make you appear in a bad way which could damage your image severly.

For example we could rename your group and call it something very inappropriate and nasty, like “I support pedophile’s rights”. But have no fear - we won’t. We just renamed it Control Your Info. Because this is really all we want:

Think about the safety in your social media life to the same extent you do in your real life.

Watch the videoclip for more information or check out for more tips soon!

We promise to restore your group name and leave the group by the end of next week. Don’t worry - we won’t mess anything up.

Best regards”

What they are doing really is no different to a hacker gaining control of a group and defacing it. Two wrongs do not make it right. While this group may think they are “helping” they are in fact making themselves look just as bad as a black hat. Think about the hacker that “Rickrolled” a bunch of iPhones that Graham posted about. Does it really make it right to hack into computers, phones, and websites to “try to raise security issues”? Not in our books.

“woah… you’re on this ”
“LOL..Nice look ”
“This thing has your pic ”

The links got to videos.twitter. and videos.blog.. Sophos customers using the WS1000 are safe as we’ve been blocking the domain. Interestingly, we’re now seeing new URL shorteners being used, such as wapurl.co.uk and others. Seems the malware authors are tired of bit.ly and 3.ly blocking their stuff or perhaps because third party applications such as TweetDeck won’t preview those, but will happily open them.

I had someone ask the question “Why phish for Twitter credentials?” We saw this type of attack on Facebook. Lots of phishing messages, links, and posts were posted to capture credentials. Then later on we saw the malware attachments spammed out to the email addresses associated with the compromised accounts and when the malware was run, it became part of a botnet to send yet more spam. Taking this history, we are wondering if this will take a similar turn and start sending out malicious emails purporting to be from Twitter saying “Update your account/password” or “Updated Terms of Service, please open.”

Another reason for the phishing attacks would be to expand the “attack surface”. More and more people are tweeting from their iPhones, Androids, Blackberries, Palms and other smart phones. This means a whole new vector to be exploited, since again, most third party Twitter apps do not preview the shortened URL.

We have to say it again, PLEASE be careful out there. Just because a message came from a friend/follower doesn’t mean it’s completely trustworthy. Check the link with an expander service such as LongURL, use NoScript and URL expander plugins and keep your security software and OS up to date. Otherwise, your machine is likely to be “dinner” ]]> http://www.sophos.com/blogs/sophoslabs/?feed=rss2&p=7366 http://www.sophos.com/blogs/sophoslabs/?p=7361 http://www.sophos.com/blogs/sophoslabs/?p=7361#comments Tue, 10 Nov 2009 00:24:30 +0000 Onur Komili, Researcher, SophosLabs, Canada http://www.sophos.com/blogs/sophoslabs/?p=7361 For those of you who aren’t mixed martial arts fans, this past Saturday night was the Strikeforce television event where one of the worlds greatest fighters Fedor Emelianenko fought Brett Rogers, and what a fight it was. It was a fairly significant fight since Fedor is generally not seen fighting in North America and his exposure is fairly limited, but it aired on regular cable TV on CBS so you can be sure plenty of people saw it. As the fights were being televised at one point the gym that each fighter trained at was shown on the screen and I didn’t give it a second thought until this afternoon.

While doing my daily rounds of digging through newly infected pages I spotted something in a link that looked familiar, Red Devil Sports Club, the gym Fedor trains at. The infected page was being hosted on a website used to help promote MMA gyms, and sure enough when you Google the terms “Red Devil Sports Club” the website in question appears on the first page of results. Following the link led to a page that had been compromised with the latest Gumblar variation which Fraser blogged about yesterday.

It seems recent celebrity deaths aren’t the only thing hackers abuse to find new victims. Granted, the method of delivery is a little more obscure since not everyone is going to go and Google the name of the gym Fedor trains at that they heard while watching TV, but it’s just one of many methods this kind of malware uses to spread.

The payload of the recent attacks looks similar, the malicious binaries now being detected as Mal/Daonol-A.

As with the previous wave of site defacements, it appears to be stolen FTP credentials that is driving the new attacks. These enable the attackers to upload malicious PHP scripts which can then be used to construct the attack. Contrary to the previous attacks, the payload is now also being hosted on compromised hosts, making the attacks more resilient.

At the end of last week, we managed to get hold of one of the key PHP script components being used by the attackers. Analysis of the script gives us some interesting insights into these attacks.

The PHP script can be used by the attackers to inject a malicious script into all suitable pages on the victim site. Files below ~200kB whose extension do not match any of the following are targeted (up to a maximum of 5 within any particular directory):

• .zip
• .rar
• .gz
• .jpg
• .gif
• .avi
• .mp3
• .wma
• .mpg
• .png
• .txt
• .swf
• .css
• .js
• .log
• .pdf
• .ppt
• .fla
• .as
• .tar

Some simple techniques are used to make the injected scripts mildly polymorphic (between each injected page). These include function/variable substitution and simple string obfuscation.

The purpose of the injected script is simple - adding a script element to the page which will cause the browser to load further malicious content from a remote server (hosted on another compromised site).

The PHP script makes it trivial for the attackers to change the redirection payload of the scripts that are injected into pages. Issuing a HTTP request to the PHP script with the desired target domain in the query string is all that is required. So, requesting http://compromised_site_A/path/gumblar.php?dom=compromised_site_B will result in:

• removal of any injected scripts previously added to suitable pages on compromised_site_A
• injection of new scripts, whose payload will be to load content from compromised_site_B

This makes the new wave of attacks more resilient to URL filtering. Sophos customers are protected - aside from detecting the payload as Mal/Daonol-A, pages injected with the redirection scripts are blocked as Troj/JSRedir-AE. Indications at this point are that a large volume of sites have been affected - the detection is already contributing to almost 4% of all web-based threats for the past 48 hours.

Additionally, detection for the malicious PHP scripts uploaded to compromised sites has been added as Troj/PHPMod-B. If you are a webmaster or hosting provider and encounter this detection, please let us know. It would be interesting to collect further samples of the PHP kits being used.

Dear Facebook user,

Due to Facebook policy changes, all Facebook users must submit a new, updated account agreement, regardless of their original account start date.
Accounts that do not submit the updated account agreement by the deadline will have restricted.

Please unzip the attached file and run “agreement.exe” by double-clicking it.

Thanks,
The Facebook Team

Of course we all know that it is pure folly to unzip and run an unknown executable attached to an e-mail, however the implied threat of finding their access to Facebook restricted by ‘the deadline’, whenever that may be, is obviously severe enough to panic a number of the users of Facebook into falling for this trick.  

They really should think twice, by agreeing to install agreement.exe they will install a Trojan.

Sophos detects this threat as Troj/Dloadr-CWS.

It is not hard to spot that this email is a phish since clicking on the link does not take us to PayPal.com but to some remote site (which is already blocked by Sophos’s web appliance).

The web page loaded from this site disguises itself as PayPal.com as shown below.

However, this web page is just an image of the real PayPal.com web page. All the tabs and links on this fake web page can not be selected and only the email address and password text field can be used. This is another obvious sign that the web site is fake. By logging in with some fake  email address and password we were lead to the following page.

By clicking on the link we were directed to another web page as shown below.

How can we tell that this web page is fake? It is quite simple, this page has the following URL.

We  provided some fake  account and address information, the site then redirects  us to a page asking us to supply our banking details.

We then decided to supply more fake banking information to the web page and see where it will lead us. As a result we were lead to the following page.

Finally, the site will refresh and redirect us to the genuine PayPal.com web page.

From my point of view this is malware. Why?

1. The warning screen isn’t  multi-lingual if English isn’t your first language you will still recognize ‘PRESS ANY KEY TO CONTINUE’.
2. Even if English is your first language a child looking for games on the computer will not read the warning but press through to the game.



3. Would our corporate customers want this on their networks?

The concept behind OSX/LoseGame-A is ill conceived and it is likely to have malicious consequences not considered by the author.

However, malware can also be found in links provided within e-mails:

According to its name,  “You have won!.pdf”, it suggests to people that they have won some kind of a lottery.  However,  the URLs lead you to a malicious file, which seems to have been taken down (access to which is already blocked by Sophos’s web appliance).

So, please beware of such malicious links and their fake claims that you have won some money ;-).

If you are curious of what you did win, you can always click on the link and win yourself a piece of malware ;-).

For a few days during the past week, the group has turned their attention to the Federal Deposit Insurance Corporation (FDIC), spamming out links to malware sites with the message below:

With the global economy as it is, notice of bank failures would certainly draw a lot of attention and irrational behavior. After all, thoughts of hard-earned money being gone forever is going to scare a lot of people. Of course, downloading the “personal FDIC insurance file” would give nothing but grief. The bank deposits are still safe, but the computer would probably get infected.

After the blast of FDIC messages, the Zbot authors turned to facebook as their latest platform to spread malware. However, they added a twist to it. The messages are well-crafted to look like a real Facebook message:

The message asks the user to update their facebook account. The new twist is that, when they get to the linked site, there is no link to download an executable yet. Instead, they’re shown with a fake Facebook login page:

Victims who have entered their facebook login would get their account details phished, probably for the purpose of spreading more malware. Since this is not a real facebook page, any random login info would bring you to this next page:

It is on this page where the malware author provides an executable for download. This file, updatetool.exe is a Zbot executable that is proactive detected as Mal/EncPk-LE.

With the creative social engineering that the Zbot authors have been using, users should be real careful when reading messages, whether it’s in an email or from a social network. Avoid clicking links directly, manually type the address to access the site, and not executing files would do a lot in protecting one’s computer.

Looking at the latter part of the month from the 21st (when the detection was published) onwards.

Mal/Iframe-N is clearly first and if the results are extrapolated for the whole month Mal/Iframe-N should have easily beat Mal/Iframe-F into second place!

Late last week, I downloaded:

• 2819 infected URIs infected with Mal/Iframe-N
• hosted on 2294 different domains
• with 163 different TLDs including:

.edu.in
.edu.tr
.edu.tw
.edu.ua
.ej.am
.eng.br
.es
.eu
.fi
.fr
.fr.cr
.ge
.go.th
.gov.br
.gov.pk
.gov.tr
.gr

I have had a few correspondences with other security researchers regarding this threat (see iframes are EVIL! Hate Zeus!) particularly with Unmask Parasites who has gone into more details of this type of threat (see 1, 2) who like me originally thought that the ‘onload’ attribute wasn’t legal in an iframe. Two things changed my mind:

1. Visiting an infected site on a goat machine.
2. The number of infected sites (>40, 000).

In someways the second fact is more persuasive as malware authors don’t tend do things for no reason.

It appears that this Halloween the malware writers preferred choice of infection vector is by using SEO (Search Engine Optimization) techniques to poison popular search terms.

We at SophosLabs have seen relatively few email campaigns that exploit Halloween this year, but there have been plenty of campaigns pushing malware loaded URL’s into festive search terms.

We have various Fake AV families featuring highly:

and

Which leads to the familiar:

and

There are also families that pose as fake media codecs exploiting Halloween to push their wares:

As users wise up to the dangers of email attachments we are seeing SEO poisoning becoming a more and more popular attack vector.

Sophos detects this years nightmares variously as Mal/FakeAvJs-A, Mal/Krap-A and Mal/EncPk-LH.

“I lost 25lbs using this ”
“whoa this works. i feel good and look good ”
“lol it’s amazing. look and feel great with ”

When a user clicked on the link, it redirected you to this site:

All you had to do to get your “free” bottle was fill out your name, address, phone number and email. However, once you submitted that, you then get to the screen to input your billing information and input your credit card details. Why do you need to input credit card details for something that’s free? With all that information, the cybercrooks have more than enough info to commit identity theft and fraud on your card. They have your name, address, card info and you’ve even confirmed that the address you gave is the billing address too.

At the risk of sounding preachy, these pills never work. They only thing that gets “slimmer” is your wallet.