"Google Referrer Only" malware sites

Here's a curious thing that I read in "Tacit's" LiveJournal post today. There is a new major infection on iPowerWeb.

This one has an interesting new twist. Based on Tacit's post, I decided to do some of the normal Google searches that I would do anyway, but add to them the requirement "inurl:/ad/har/", which was a string associated with what Tacit mentioned.

So, for example, I do Search Engine Optimization to keep some of the sites I host performing well. I'll do a search on "haiku books", where my haiku poetry website always is in the top 5, but with this additional requirement.

There are 142 webpages containing the words "haiku" and "books" that have the string "/ad/har/" in the URL. So, sites such as "joygabrieldentistry.com", "barkershotdogs.com", "wassermanandthomas.com", and "hawaiiyachts.com" have pages, ranging in topic from "geisha memoirs", "cybersex webcams", and "scrotum enlargement surgery", which respond to this.

I did another search on "warner genealogy", with the "/har/ad/" requirement and got 16 hits, but when I changed it to "smith genealogy" there were 3,010 with the link. All of them that I checked were hosted on iPowerWeb.

Being rather sure that "cabincraftskishop.com" was not actually a porn site, I continued with the experiment, after first making sure NoScript was running in my FireFox browser.

The sites were the traditional spam sites you've probably seen before, where whatever term you search on is randomly scattered through the content of a pornographic story. "Joan answered the door to her michael butch genealogy NY apartment. I couldn't help but notice her sizing up my centerville utah genealogy."

The links go all over the place when you click on them (with NoScript blocking like crazy...) The first took me to "3xpowered.com" which calls itself "PornTube" and is set up to look like YouTube only with porn movies. If it hadn't been for NoScript, my browser would have called a download.php file from "xyzsolution.com", which would pop a window saying "Would you like to continue?" and asking to install "setup.exe". (xyzsolution.com and 3xpowered.com are both hosted on URKTelecom in the Ukraine). 3xpowered.com is a "top 10,000 website" and is visited by over 330,000 American IP addresses per month.

3xpowered.com seems to be another venture from Nikolay Fedorov (not the philosopher) like his getxxxphotos.com. His getxxxphotos.com site forwards to "imgstorages.com", which currently tries to download malware to your computer through a link from "www.abcdperformance.com". abcdperformance.com is brand new. Not yet 48 hours old, but I bet it will gain in popularity!

The next link (compusupport.biz) tried to forward me to "xscanner.spyshredderscanner.com", which would warn me that I had malware on my computer and that I needed to install their software to protect myself. The file "Install1642.exe" would then have been run on my computer. SpyShredderScanner is hosted in Russia on the IP 77.91.229.106. According to statistics from a web monitoring company, 2.7 MILLION American IP addresses visited this website in the month of November, making it the 560th most popular website they monitor. Another webstat company gives it 2.5 Million unique visitors and calls it the 544th most popular site on the web. Anyone who goes there is at risk of infection, but the statistics clearly show that AT LEAST 100,000 AMERICAN COMPUTERS PER DAY visit the site.

Here's where things get very intersting though. Having just visited each of those sites, I then tried to visit them by typing the URL in my browser. Just as Tacit experienced, I received a "404 message" -- File Not Found.

Again, with my hat off to Tacit, we can duplicate this behavior using "wget", a text-based website fetcher.

---

C:\incoming\danger\ipower>\tools\wget http://homeautomationtech.us/images/xpxrs/har/ad/1/het.html
--07:06:05--  http://homeautomationtech.us/images/xpxrs/har/ad/1/het.html
           => `het.html'
Resolving homeautomationtech.us... 66.235.203.141
Connecting to homeautomationtech.us|66.235.203.141|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: /404 [following]
--07:06:05--  http://homeautomationtech.us/404
           => `404'
Connecting to homeautomationtech.us|66.235.203.141|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
07:06:06 ERROR 404: Not Found.

---

C:\incoming\ipower>\tools\wget --referer=http://www.google.com/ http://homeautomationtech.us/
images/xpxrs/har/ad/1/het.html
--07:03:55--  http://homeautomationtech.us/images/xpxrs/har/ad/1/het.html
           => `het.html'
Resolving homeautomationtech.us... 66.235.203.141
Connecting to homeautomationtech.us|66.235.203.141|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://traffloader.info/go.php?s=homeautomationtech.us&ver=7 [following]
--07:03:55--  http://traffloader.info/go.php?s=homeautomationtech.us&ver=7
           => `go.php@s=homeautomationtech.us&ver=7'
Resolving traffloader.info... 87.248.180.67
Connecting to traffloader.info|87.248.180.67|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://www.clipsfestival.com/movie1.php?id=4161&n=teen&bgcolor=000000 [following]
--07:03:56--  http://www.clipsfestival.com/movie1.php?id=4161&n=teen&bgcolor=000000
           => `movie1.php@id=4161&n=teen&bgcolor=000000'
Resolving www.clipsfestival.com... 82.208.18.109
Connecting to www.clipsfestival.com|82.208.18.109|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://powerof3x.com/m2/movie1.php?id=4161&n=teen&bgcolor=000000 [following]
--07:03:56--  http://powerof3x.com/m2/movie1.php?id=4161&n=teen&bgcolor=000000
           => `movie1.php@id=4161&n=teen&bgcolor=000000'
Resolving powerof3x.com... 85.255.118.156
Connecting to powerof3x.com|85.255.118.156|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://www.3xpowered.com/m4/index.php?id=4161&n=&a=Gnark&v=1392601&preview=http%3A%2F%2Fww
w.3xfestival.com%2Fst%2Fthumbs%2F047%2F4521569111.jpg [following]
--07:03:56--  http://www.3xpowered.com/m4/index.php?id=4161&n=&a=Gnark&v=1392601&preview=http%3A%2F%
2Fwww.3xfestival.com%2Fst%2Fthumbs%2F047%2F4521569111.jpg
           => `index.php@id=4161&n=&a=Gnark&v=1392601&preview=http%3A%2F%2Fwww.3xfestival.com%2Fst%2
Fthumbs%2F047%2F4521569111.jpg'
Resolving www.3xpowered.com... 85.255.115.180
Connecting to www.3xpowered.com|85.255.115.180|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]

    [  <=>                                                    ] 33,097        71.19K/s

07:03:57 (71.08 KB/s) - `index.php@id=4161&n=&a=Gnark&v=1392601&preview=http%3A%2F%2Fwww.3xfestival.
com%2Fst%2Fthumbs%2F047%2F4521569111.jpg' saved [33097]

---

Can you imagine what happens if someone calls iPowerWeb tech support to report the problem.

"What's the URL? Yes sir, we've just looked. No, there is no such page, it must have been discovered and removed."

Why wonder. I'm going to call them and try to get a live person on the phone. l-888-511-HOST.

(They are still experiencing heavy call volumes and refer me to their website. Their "live chat" puts my wait time at 12 minutes. Waiting . . .

SUCCESS! I'm on the phone with iPowerWeb now! I'll update with their response.

Well, ALMOST success. Support could duplicate the above, but said I would need to email "abuse@", who wasn't in yet this morning. (sigh)

---

An update (14 DEC 2007)

iPowerWeb is working closely with some Federal Cybercrime folks to get their sites cleaned up.

In the meantime, I was thrilled by the response from Google Investigations, who says they are going to be taking immediate action, by adding a "This Link May Harm Your Computer" link on all of these sites. They also encouraged me to share this link with others:

http://googleonlinesecurity.blogspot.com/2007/11/help-us-fill-in-gaps.html

which tells of their "report badware" program, and gives a link to allow reporting of malware-drive-by sites and to pass notes which will be included in the report sent to investigators.

Read More

Off Topic: Browser and OS Trends

WARNING!! I'm going a bit off topic today.

This post started off to be about JavaScript enabled browsing by end-users. Security professionals have long recommended that JavaScript be disabled by default, and enabled only for those sites which require JavaScript and which are trusted by the user as a "Trusted Site".

In Internet Explorer this is done in a fashion that confuses most end-users, by creating a "Trusted Zone" and setting different security properties in the Trusted Zone than in the Global Zone. (Directions for using Trusted Zones are here)

In FireFox, the best way to accomplish this is by running the Plug-In "No Script", which disables scripting by default and allows the user to click to enable scripts on Trusted Sites that seem broken if they scripting is disabled. (The NoScript homepage is here)

Bottom Line: Unless a site requires Java support and you trust it, you should not be browsing with Java Enabled!

Unfortunately, as I reviewed three groups of web statistics - from visitors to this blog, from visitors to my haiku poetry website, and from visitors to my genealogy website, Almost EVERYONE had Java enabled. Between 97.7% and 98.5%!!

Then I laughed at myself as I realized that I was using Google Analytics to do that measurement, and Google Analytics doesn't record the visit unless Java is enabled. Which now has me puzzling over how ANYONE was recorded who had no Java.

But I still had some interesting, though slighly off-topic results to share with you, Dear Reader . . .

---

If we watch the media in its various forms, we are being bombarded with a few basic messages:
- The Age of the Macintosh is upon us
- Linux Threatens Windows
- Windows Vista is the Path to Security
- Internet Explorer 7 is the Path to Security

I thought it would be interesting to look at some statistics to see if these messages reflect the reality of the Average Internet User.

After careful reflection, I realized I don't have the ability to measure The Average Internet User, so instead I looked at some Google Analytics for three websites that I have tagged. The three are of course English-language biased, but then so is most of the media I consume, so I think that's ok.

---

Sample One: People who read this blog.

This blog is about CyberCrime, and usually CyberCrime in the United States. One hopes that the readers are people who care about CyberCrime and perhaps by a bit of a stretch, protecting their computers.

For the sample period I looked at there were 3,400 unique visitors to this blog from 85 countries and all 50 states, but with 78% of the readers coming from the US.

Windows	88.65%
Mac	7.91%
Linux	3.09%
Windows breakdown
XP	83%
Vista	10%
2000	5%
Server 2003	1%
98	0.8%

Internet Explorer	58.01%
FireFox	34.69%
Safari	4.44%
Opera	1.13%
IE breakdown
IE 7.x	50.24%
IE 6.x	49.42%
IE 5.x	0.34%

---

Sample Two: People who visit my haiku poetry website.

The Haiku Poetry fans, as you might imagine, are a bit different than the readers here. 6,600 unique visitors from 98 countries and all 50 states, with only 54% of the readership coming from within the US.

Windows	88.49%
Mac	8.86%
Linux	2.53%
Windows breakdown
XP	85%
Vista	6%
98	4%
2000	3%

Internet Explorer	67.26%
FireFox	24.57%
Safari	5.64%
Mozilla	1.43%
IE breakdown
IE 6.x	58%
IE 7.x	39%
IE 5.x	2%

SLIGHTLY higher Macintosh adoption (not statistically significant), slightly lower Linux adoption (also not statistically significant), but a much greater chance of using "old" Internet Explorer, not being on Vista, and still running Windows 98.

---

Sample Group 3: People who visit my genealogy websites

This was the smallest group, with 1200 unique visitors representing 37 countries, but with 86% of the traffic coming from within the United States. Genealogists tend to be older and thriftier people than Security professionals. Probably on a "technology" basis, they are more similar to the haiku poets than the security professionals. I included this as a hope towards a "lower tech but US based" sample, to see whether the haiku poets trends were representing their tech level, or their nation of residence.

Windows	88.7%
Mac	5.67%
Linux	5.25%
Windows breakdown
XP	86.5%
Vista	7.5%
2000	3.2%
Server 2003	1.3%
98	1.2%

Internet Explorer	70.14%
FireFox	20.35%
Mozilla	4.4%
Safari	3.48%
IE breakdown
IE 6.x	50.15%
IE 7.x	49.04%
IE 5.x	.08%

---

Conclusions?

Macintosh users, from my unscientific study, still represent less than 9% of the installed user base.

Linux users are still a small enough number for the average webmaster to safely ignore them.

Vista still represents less than 10% of the installed user base.

FireFox has an impressive market share and must be considered by all webmasters, but trails both IE 6 and IE 7 when considered individually.

Despite the security benefits of IE7, slightly less than half of those who could use it are using it. (From my experience this is because many web-based applications still don't work in IE7.)

Read More

Russian Malware, Welcome to Texas!

Last week a whole group of formerly Russian malware infection websites migrated to a new home in Texas. The move seems to have been made on November 18th, when the virus sites that were formerly on the netblock with 81.95.146.236 moved wholesale to IP addresses in the netblock of 74.52.55.179.

Appropriate folks have all the details, but I wanted to talk today about the infection technique being used by one of the 46 domains, http://entireall.info/.

The way the PHP code on the website works, whatever you are sent on the command line becomes the name of an ".exe" file that is available for download.

So, if you have been sent a spam, or a messagebook-comment-spam to get the new version of Adobe Flash Version 11, then the site will obligingly give you a file called "Adobe_Flash_v11.exe"

As of this timestamp, the root directory of this site is advertising itself as an "Adobe_Flash_v11.exe" updater. VirusTotal.com indicates that only 21% of its 32 anti-virus checks detect this as a virus.

Which brings me to the real topic of today's blog: Constantly Repacked Malware

If you had a link though for "Gar_New_Virus", such as:

(badsite here)/search.php?qq=Gar_New_Virus

Then that would be the name of the file it would offer to download, sticking a ".exe" on the end of it for you.

This site functions in a similar way to other malware sites, typically related to pornographic movie spam, such as "ThisFreeMovies.com", which will send you to download "VideoAccessCodecInstall" because you are lacking the proper Windows Media Player Codec to view a movie. The malware site will obligingly announce that it is the update site for VideoAccessCodecInstall and have a file VideoAccessCodecInstall.exe for you to download.

This latter file is currently undetectable by 21 of the 32 anti-virus products at Virus-Total, including no detection from F-Prot, Kaspersky, McAfee, and Symantec.

Those that do detect it, place it in a family called "Zlob" or "Zlobar".

These sites have been live for several months. Why do the major anti-virus products not detect their malware? It has to do with the fact that they are constantly "re-packing" the offensive code so that traditional signature-based anti-virus products are constantly playing catch up.

On the older of the two malware samples I downloaded just now, the detections identify ZLob:

• AntiVir = DR/Zlob.Gen
  
• AVG = Downloader.Zlob
  
• CAT-Quickheal = TrojanDownloader.Zlob.gen
  
• ClamAV = Trojan.Dropper-2557
  
• F-Secure = W32/Zlob.ARDM
  
• Microsoft = TrojanDownloader:Win32/Zlob.AMM
  
• Norman = W32/Zlob.ARDM
  
• Rising = Trojan.DL.Win32.Zlob.def
  
• Sophos = Troj/Zlobar-Fam
  
• TheHacker = Trojan/Downloader.gen
  
• Webwasher-Gateway = Trojan.Dropper.Zlob.Gen
  
• The other 21 products detect nothing.
  

But look what happens on the nearly identical virus which was packed more recently!

• AntiVir = TR/Crypt.XPACK.GEn
  
• Authentium = could be infected with an unknown virus
  
• AVG = Downloader.Zlob.NP
  
• eSafe = suspicious Trojan/Worm
  
• F-Prot = W32/Heuristic-119!Eldorado
  
• NOD32v2 = probably unknown NewHeur_PE virus
  
• Webwasher-Gateway = Trojan.Crypt.XPACK.Gen
  
• The other 25 products detect nothing.
  

We need to develop new methods for anti-virus products to deal more appropriately with "repacked" malware. Congratulations to those that are using Heuristic detection, or marking the file as suspicious because of the strange packing, but we need to know that these things are bad and warn the users!

Read More

The Identity Theft Enforcement and Restitution Act of 2007

Senator Patrick Leahy introduced a much-needed Identity Theft bill in the Senate on October 30th. The bill, S.2168, cited as the "Identity Theft Enforcement and Restitution Act of 2007", passed by "Unanimous Consent" on November 15th, and we now anticipate rapid action from the House.

Key improvements from the bill include:

A change which removes the previous threshold of requiring $5,000 in damages to make identity theft or spyware a Federal Offense;

A change which makes the placing of spyware or keyloggers on more than 10 computers a FELONY offense;

A change to instruct Criminal Restitution to "pay an amount equal to the value of the time reasonably spent by the victim in an attempt to remediate the intended or actual harm incurred by the victim from the offense";

A change to ensure that Identity Theft resulting from theft of mail be considered under the guidelines for "Aggravated Identity Theft";

A change to the sentencing guidelines in Section 1030 Title 18 subsection (a)(5) "Malicious Spyware, Hacking, and Keyloggers", to increase first offense sentences to include a fine and prison terms up to five years. For a second offense under the same section, the prison term would be raised to up to ten years. Language was also added regarding "an attempt to commit an offense punishable under this subparagraph". ("Attempted hacking"?);

A change to Section 1030(a)(7) that would enhance and clarify the definition of Cyber Extortion;

A change allowing a much greater forfeiture of personal property gained as a result of finances obtained via identity theft;

The bill also directs the United States Sentencing Commission to consider 13 points as they seek to increase sentences for these types of offenses.

---

So what happens next?

Senator Leahy described the bill as being "requested by the Department of Justice", and "supported by a broad coalition of business, high-tech and consumer groups, including Microsoft, Consumers Union, the Cyber Security Industry Alliance, the Business Software Alliance, AARP, and the Chamber of Commerce." (A letter from the Chamber of Commerce was actually read into the Congressional Record in support of the Bill.)

In traditional law-making, bills are introduced in the House and passed to the Senate. This one appears to me to be reversing the process, which means it is now necessary for the House to accept this bill as one of their own. It is now a pressing matter that this bill be voted on by the House and get passed before we all go home for Christmas.

What can you do? Make sure that your Congressman knows about this important bill, and encourage them to get the vote scheduled and to vote in the affirmative for the bill.

Read More

Naked Britney Does It Again!

Today I'm preparing for a lecture tomorrow about Malware and Phishing Risks. When I speak on phishing, I frequently mention that the two reasons that people fall for phishing scams for two primary reasons: Fear, and Greed. They are made afraid that their account is about to be lost, or has already been abused by criminals, or they are enticed the promise of a financial reward for behaving in the way the phisher desires.

When we talk about Malware, we have to add another motivation to the risks: Lust.

This week, we have another round of malware which rides on the desire of email recipients to see Britney Spears naked. The first example is a fairly standard reminder that most anti-virus products do not detect most malware during the first few days of their attack.

In this example, email recipients are told that the attachment to the email contains a "New Britney naked video". What the attached zip file actually contains is a file called "brit.exe", which, of course, turns the infected machine into a bot. Does anti-virus detect it? 53% of AV engines detect it at this time:



The second set of spam uses an assortment of "Britney" subject lines, including:

Britney showed it again!

which connects to a variety of sites with several paths to infection.

Several of the sites linked to from the emails, including: velart.net, blurcolombia.com, agrisanterre.com, which had been modified to include an "iframe" which pulled additional code from "meoryprof.info".

The second one I looked at linked to the website of the "Associação Nacional de Pesquisa e Pós-Graduação em Psicologia". On that page, there is a crazy bit of encoded Javascript at the top. When it is decoded, one finds that it links to two sites:

(CAUTION: THESE ARE BAD SITES! DO NOT VISIT!)

http://ramoneymayker.info/

http://spl.vip-ddos.org/

Nope. Nothing suspicious about THOSE names. "VIP Distributed Denial of Service dot org?" I wonder what happens when that box infects a PC?

The owner of "vip-ddos.org" also owns "botnet.cc". Gee. He must have been counting on his encryption preventing us from seeing those names. (AGAIN, don't visit. Even going to the homepage loads malware from certain Malaysian computers.... VIP-DDOS is actually also the name of a popular Chinese attack tool.

So what does it take to become infected by a Drive By Downloader? The temporary temptation to click on a link in an email promising a new Britney picture.

Read More

Private Detective Spam

A disturbing new spam email was received thirty-four times this morning in my spam traps. The email has one of those social engineering bodies that I would imagine to be pure gold as far as its success rate convincing people to click on the attachment.

Here's the message:

I work in a private detective agency. My name is not important.
I want to warn you that i'm going to monitor your phone line.
Do you want to know who paid for shadowing you? Wait for my next letter.


P.S. I know, you don't believe me. But i think the record of your
yesterday's telephone conversation will change your point. The tape is
in archive. Archive password is 123qwe

The attachment is a ".rar" file, which is a compressed file format similar to a ".zip" file. The fact that many American computer users don't have software on their machines that knows how to open a RAR file may be the only thing that keeps some users safe!

When the file is extracted, it sits in the filelist with an icon which would make it seem to be an .MP3 File.



Although if you view it in a different manner, the fact that the file is a "Screen Saver" file.



The file name is actually:

"call1105.mp3 (many spaces here) .scr"

Of the thirty-four samples that I received at the beginning of the day:

Nine of them use the subject "attention".

Four use the subject "I'm watching you".

Six use the subject "We monitor your privacy".

Five use the subject "you are watched"

Four use the subject "Your phone is monitored"

Two use the subject "you're being monitored"

Two use "you are being monitored".

Two use "The tape of your conversation".

All have the password of "123qwe".

As of thirty minutes ago, there were twenty-one anti-virus companies that did NOT detect this as a virus in any way. Eleven companies, according to VirusTotal.com, mostly detected it as a generic "Dropper", though Symantec called it "Trojan.Peacomm.D", which is what it calls Storm Worm viruses.

F-Prot, F-Secure, Kaspersky, McAfee, Microsoft, Sophos, and others do not detect the virus at this time.

Read More

250,000 node Bot Herder Busted (Or is he??)

3G Communications Group offers many security services for their clients:



According to the 3G Communications Group website, "More than a million bot-infected computers", and they should know, since one of their Network Security professionals was running 250,000 of them.

3G terminated their 26 year old employee John Schiefer last week as the facts began to emerge. According to a Press Release from the US Attorney's Office in the Central District of California, Schiefer "and several associates" developed malware which they used to build botnets of up to 250,000 computers, which were primarily used for stealing credentials from Paypal and other sites the owners visited.

The case has been called newsworthy because it is the first time that wiretap charges are being leveled at a botmaster.

Schiefer has agreed to plead guilty to:

1. Accessing protected computers to conduct fraud.

2. Disclosing illegally intercepted electronic communications.

3. Wire fraud.

4. Bank fraud.

Schiefer operated online with the handle "AcidStorm". I can't prove that the two are related, but an AcidStorm on one webserver that I visited posts advertisements for well known anti-spyware software, with a convenient link for downloading. The software is real, and the description he gives in the post is real, but why does he suggest you download the software from RapidShare rather than directing you to the real website?

It would be interesting if this was the SAME AcidStorm, because this AcidStorm has uploaded SEVERAL illegally shared (and possibly hacked) programs SINCE pleading guilty on November 9.





Pimp Daddy of Freebies, indeed! *THIS* Acidstorm is at best a software pirate. It will be interesting to see if he is also planting Trojans in his Warez.

Read More