CyberInsecure.com

Google AdSense Abused Through Click Fraud Malware Applications

Miscreants have developed one of most sophisticated click fraud malware applications to date. The Trojan code - dubbed FFsearcher by security firm SecureWorks - plugs into a Google API that allows webmasters to add a Google-powered search widget (called “Google Custom Search”) to their website. In normal use, search results made via the widget are displayed alongside Google AdSense ads, with webmasters receiving a small fee every time a surfer follows an ad.

The malware hijacks this feature so that every search an infected user makes is performed through a search widget under their control, so that they get paid by Google every time a surfer clicks on a sponsored ad. Hackers have also worked out a means to pull off this sleight of hand without giving any indication to surfers that anything might be amiss. Google might find it hard to unravel instances of fraud.

FFSearcher installs itself by attaching to an existing system file as an NTFS alternate data stream. These files are hidden from Explorer windows and command-line directory listings. In this case, the name of the system file was C:\WINDOWS\system32\netcfgx.dll, and the alternate data stream was named “Zone.Identifier”, making the stream accessible only by requesting the entire path, C:\WINDOWS\system32\netcfgx.dll:Zone.Identifier.

The name “Zone.Identifier” is used by Windows post-XP Service Pack 2 as a way to mark an executable that has been downloaded from the Internet, so it would not be unexpected to find such an alternate data stream attached to a file. FFSearcher modifies the existing registry entry that loads the netcfgx.dll to point to netcfgx.dll:Zone.Identifier instead. This way the trojan can load itself into the system without creating any new and suspicious registry keys that might be noticed by startup registry analysis tools. When the trojan DLL finished loading, execution continues on with the original system DLL as if nothing had happened.

The registry key modified is HKLM\software\Classes\CLSID\ {5B035261-40F9-11D1-AAEC-00805FC1270E}\InProcServer32, which controls the location of the DLL for the network configuration component object of Windows.

The final payload is designed to use a kind of “augmented reality” to redirect searches in Google to a third-party website, my-web-way.com, while maintaining the appearance in the browser that the user is still viewing the Google website and search results the entire time.

The motivating factor behind this scheme is a system Google created called “AdSense for Search”. Google provides an API to webmasters to add a Google-powered search widget (called “Google Custom Search”) to their website. AdSense ads are displayed in the search results, and if a user clicks on one of the ads, Google will pay the webmaster a small sum of money. Many websites and blogs use this service legitimately.

This is one of the more clever click-fraud trojans with an impressive feature set:

1. Working code to hijack both Firefox and IE
2. Difficult to spot by the average user
3. Minimally impacting to the infected machine
4. Probably difficult for fraud detection systems at the search engine sites to detect, since every ad-click that comes through ]is generated on purpose by a user in the course of normal web-surfing activity.

As such, the attack is more sophisticated than previous click fraud approaches, which relied on tricks such as changing a surfer’s start page and searches to point to a third-party search engine, types of behavior that might more easily be detected. FFsearcher works on both IE and Firefox.

“Every click on an ad is user-generated, and the user never notices any change in their web-surfing experience,” writes Joe Stewart, director of malware analysis at SecureWorks. FFsearcher is part of the exploit bundle spread by the recent Nine-ball mass compromise, SecureWorks adds.

Credit: The Register
Credit: SecureWorks

More on CyberInsecure:

Another Google Adwords Phishing

PC Webcams Might Be Abused Through Clickjacking To Silently Spy On Users

Fake Meeting Invitations Spam In Google And Outlook Calendars

Google Docs Abused In Latest Spam Technique

Google Code Project Abused By Spam And Malware

Torrentreactor.net Website Compromised, Serves Exploits Through IFRAME

Websense Security Labs has detected that Torrentreactor, one of the oldest and most reliable torrent search engines on the Web, has been compromised and injected with malicious code. The site has been injected with an IFrame leading to a site laden with exploits. The exploits on the payload site include Internet Explorer (MDAC) and Microsoft Office Snapshot Viewer, as well as Adobe Acrobat Reader and Adobe Shockwave.

According to Websense, the malware has an extremely low detection rate, with just two of 32 anti-virus engines identifying the threat. Once executed, it installs a rootkit on victims’ machines. If the user’s browser is successfully exploited, a malicious file is downloaded and run from the exploit site. The file is a Trojan Downloader and connects to a Bot C&C server at IP 78.109.29.116. After connecting to the IP, the file downloads a Rootkit installer from the same IP. This IP address has ties to the Russian Business Network.

This isn’t the first time that security researchers have reported Torrentreactor is foisting malware on its users. In March 2008, the site suffered a similar iframe attack, according to Dancho Danchev.

Credit: The Register
Credit: Websense Security Labs

More on CyberInsecure:

CBS.com Subdomain Compromised, Installing Malware On Visitors PC’s

Infect Your Own Website Visitors For Russian Cash

Malicious Javascript Code In Another CNET Networks Website

ActiveX bugs Are Targeted In A New Attack Kit

More Websites Are Compromised, This Time Avoiding Chinese Websites And Users

Conficker Infection Left Manchester Unable To Issue Traffic Tickets

Manchester City Council was prevented from issuing hundreds of motoring penalty notices in time after the infamous Conficker worm knocked out parts of its IT systems.

Drivers caught on camera driving in bus lanes escaped punishment after the town hall fine processing system was taken offline in February, following infection by the infamous worm. Failure to issue 1,609 tickets within the statutory limit of 28 days left the city £43,000 out of pocket.

Clean up costs and consultancy fees were a far more significant cost, resulting in costs estimated at £600k. In additional, council IT chiefs spent a further £600k on Wyse thin client terminals as part of an enhanced backup strategy.

Town hall chiefs also spent a further £169,000 on extra staff needed to handle a backlog of benefits claims. Compensation payments to benefit claimants piled on the financial pain.

In total the incident cost the council an estimated £1.5m, the Manchester Evening News reports. Infection by the worm left council workers unable to send emails or print documents, and struggling with extra red tape after they were obliged to keep additional back-up paper records in case data was lost.

Council chiefs have banned the use of memory sticks, which were blamed (extracts from memos here) for causing the infection, as well as disabling all USB ports in response to the incident. Albert Square IT chiefs have also promised to revamp the council’s disaster recovery strategy, which the incident exposed as hopelessly inadequate.

Steve Park, Head of ICT at Manchester city council, told the MEN: “I’d like to reassure the public that we’ve built on and improved our disaster recovery strategy, which covers all our main networks.”

“This means that in the event of an emergency those key systems can be recovered with minimal disruption to the services involved.”

The fallout from the Conficker worm infection represents the second time in a week that Manchester City Council has made headlines following IT cock-ups. Data Watchdogs at the ICO put the council on notice over breaches of the Data Protection Act last week following the earlier loss of two unencrypted laptops from council premises. One of the stolen machines contained personal details on hundreds of teachers and support workers at local schools.

Previous victims of the Conficker worm have included the UK’s Houses of Parliament and hospitals in Sheffield, as well as many other organisations outside the UK.

Credit: The Register

More on CyberInsecure:

UEFA Lottery Scam Targets UK Football Fans

Houston Justice System Paralyzed By Conficker Worm

Fake Microsoft Patch Email Campaigns Install Malware

Phishing Websites Sell Fake Olympics Tickets

Social Security Numbers Displayed On Maryland Courts Website

Michael Jackson Death Prompts Malware And Mass-mailing Worms

Miscreants have created a Michael Jackson mass-mailing worm. The malware follows a growing list of other hacking attacks in the wake of the superstar’s death last week and claims to offer secret songs and photos of Jackson in an attached zip file. In reality, the emails (which claim to come from sarah@michaeljackson.com) offer malicious code.

Prospective marks duped into opening the infected attachment on Windows machines get infected while further spreading the worm. The malware is also capable of spreading via USB memory sticks. The mass mailing worm - identified by Symantec as Ackantta-F - spreads in messages that typically bear the subject line “Remembering Michael Jackson.”

Ackantta is far from the only item of malware trying to ride on the coat-tails of Michael Jackson’s death. For example, an executable file posted on counterfeit photo-sharing sites was detected by F-Secure last week. The malware tried to established a backdoor on compromised Windows PCs.

Separately, a domain loaded with exploit code - supposedly touting Jackson death conspiracy theories - is actually just an outlet for an exploit tool, Sunbelt Software warns. The domain, complete with Matrix-like animation, is running “Unique Pack” exploit package version 2. The malicious domain is being promoted via an enthusiastic spamming campaign.

Credit: The Register

More on CyberInsecure:

DDoS Attack Hits Internet Service Providers In Kyrgyzstan

IBM’s New USB-based Device Might Allow Safer Online Banking

Ladyboydolls.com Website Attacked By Recently Discovered Type Of DDoS

MySpace And Facebook Users Targeted By New Worms

Computers Storing Personal Data Breached At Pocono Mountain School District

Critical Adobe Shockwave Player Vulnerability Affects Millions

Adobe’s Shockwave Player contains a critical vulnerability that could be exploited by remote hackers to take complete control of Windows computers, according to a warning from the software maker. According to Adobe, 450 million Internet-enabled desktops have installed Adobe Shockwave Player.

This issue is remotely exploitable and affects Adobe Shockwave Player 11.5.0.596 and earlier versions. According to Adobe’s advisory, this vulnerability could allow an attacker who successfully exploits this vulnerability to take control of the affected system. Adobe has provided a solution for the reported vulnerability (CVE-2009-1860). This issue was previously resolved in Shockwave Player 11.0.0.465; the Shockwave Player 11.5.0.600 update resolves a backwards compatibility mode variation of the issue with Shockwave Player 10 content.

To resolve this issue, Shockwave Player users on Windows should uninstall Shockwave version 11.5.0.596 and earlier on their systems, restart, and install Shockwave version 11.5.0.600, available at http://get.adobe.com/shockwave/.

Credit: ZDNet.com Security BLogs

More on CyberInsecure:

Critical Security Vulnerability Patched In Adobe AIR 1.5

Adobe Fixes Clickjacking Vulnerability In Flash Player 10

Highly Critical Vulnerabilities Fixed In Urgent RealPlayer Update

Buffer Overflow Critical Vulnerabilities In Adobe Reader And Acrobat

Potential Vulnerability In Adobe Flash

Latest Version Of Green Dam Vulnerable To Remote Code Execution

The recently exposed as vulnerable to trivial remotely exploitable flaws Chinese censorware Green Dam, has silently patched the security flaws. However, not only is the latest Green Dam v3.17 version still vulnerable to remotely exploitable flaws, but also, for over a week now a working zero day exploit (Exploit.GreenDam!IK; W32/GreenDam.A) has been circulating in the wild.

Green Dam intercepts Internet traffic using a library called SurfGd.dll. Even after the security patch, SurfGd.dll uses a fixed-length buffer to process web site requests, and malicious web sites can still overrun this buffer to take control of execution. The program now checks the lengths of the URL and the individual HTTP request headers, but the sum of the lengths is erroneously allowed to be greater than the size of the buffer. An attacker can compromise the new version by using both a very long URL and a very long “Host” HTTP header. The pre-update version 3.17, which we examined in our original report, is also susceptible to this attack.

According to Green Dam’s official web site, the latest 3.17 version which still remains exploitable, has already been downloaded 426,138 times, combined with raw data on over 7,172,500 downloads of the previously vulnerable version, the current situation could easily turn the “Great Botnet of China” from theory into practice if the exploits ends up embedded within a web malware exploitation kit.

Credit: ZDNet.com Security Blogs

More on CyberInsecure:

Remote-Execution Vulnerability In Adobe Flash 9.0.124.0

New Firefox 3.0 Is Vulnerable To High-Severity Code Execution

68 Fixes In Apple Update 10.5.3 and Apple Security Update 2008-003

Mozilla Fixes 12 Security Vulnerabilities In Firefox 2.0.0.15

Remote Code Execution Through Intel CPU Vulnerability Will Be Presented In Hack In The Box Security Conference

Fake Microsoft Patch Email Campaigns Install Malware

Researchers from Computer Associates and Sophos are reporting on three currently active malware campaigns using fake Microsoft patch themes as a social engineering tactic to spread over email.

The first one is spreading as an “Important Windows XP/Vista Security Update” and is offering a bogus Conficker removal tool, the second is using an “Outlook re-configuration” — also spammed earlier this month — and the third one is using an out-of-the-band “Update for Microsoft Outlook / Outlook Express (KB910721)” theme, which in reality is nothing else but a trojan.

The fake Conficker removal tool campaign has been active for over a week now, with Symantec pointing that not only are the authors unable to make the difference between Troj/Brisv.A and Conficker, but also, they misspelled Conficker as ConFlicker in between attaching their malware to Symantec’s original removal tool in an attempt to build more legitimacy into the campaign.

A similar fake “Conficker Infection Alert” spam campaign redirecting to scareware took place in April, however, despite the fact that cybercriminals continue sticking to the cyclical pattern of the “Microsoft security update/patch” social engineering theme, compared to previous campaigns where the timing was perfect, in this latest one it thankfully isn’t.

The second, Outlook re-configuration campaign is serving Outlook_update.exe through several legitimate and logically compromised web sites, next to the purely malicious ones. Interestingly, the third campaign promoting the fake Outlook critical update has directly attached the executable officexp-KB910721-FullFile-ENU.exe to the email, indicating their lack of experience in such campaigns.

Credit: ZDNet.com Security Blogs

More on CyberInsecure:

Genuine Microsoft Software Trojan Infection

Fake Microsoft-like Sites Attempt To Install Malware

Another Breaking News Social Engineering Spam Installs Malware And Fake Anti-Spyware Tools

Fake IE 7 Update Spam Installs Malware

Microsoft’s “Experimental Security Fix” Is Actually A Malware

Iranian Opposition Launches Organized Cyber Attack Against Government Sites

The Iranian opposition coordinated a cyber attack yesterday that has successfully managed to disrupt access to major pro-Ahmadinejad Iranian web sites, including the President’s homepage which continues returning a “The maximum number of user reached, Server is too busy, please try again later…” message.

Through a combination of DIY (do it yourself) denial of service attack tools (DDoS), multiple iFrame loading scripts, public web page “refresher” tool, and a much more effective PHP script, the participants have already prompted some of the major Iranian outlets to switch to “lite” versions of their sites in an attempt to mitigate the attack.

The campaign appears to have been organized through Twitter, which despite public reports that the site has been banned in Iran, appears to be still accessible through a a persistent supply of proxy servers on behalf of the opposition.

Moreover, the ongoing distributed denial of service attacks, are using techniques which greatly resemble those used in last year’s Russia vs Georgia cyber attack, and the ones Chinese hacktivists used back in 2008 in order to temporarily shut down CNN, with a single exception - there’s no indication of a botnet involvement in the present attack.

Instead, the attack relies on the so called people’s information warfare concept, which is the self-mobilization of individuals, or their recruitment based on political/nationalistic sentiments by a third-party, for conducting various hacktivism activities such as web site defacements, or launching distributed denial of service attacks.

The following are some of the sites that are currently under attack, remain totally unresponsive, or return “server is too busy” error messages:

Ahmadinejad.ir - Mahmoud Ahmadinejad’s Official Blog - under attack
Leader.ir - Office of the Supreme Leader, Sayyid Ali Khamenei - under attack
President.ir - Presidency of The Islamic Republic - under attack
Farsnnews.com - Fars News Agency - under attack
Irib.ir - Islamic Republic of Iran Broadcasting - under attack
Kayhannews.ir - News Portal - “Service Unavailable”
Irna.ir - Islamic Republic News Agency - “service unavailable”
Mfa.gov.ir - Ministry of foreign affairs , Islamic Republic of Iran - under attack
Moi.ir - Ministry of Interior - under attack
Police.ir - National Police - under attack
Justice.ir - Ministry of Justice - under attack
Presstv.ir - Iranian Press TV - “server is too busy”

Among the first web-based denial of service attack used, is a tool called “Page Rebooter” which is basically allowing everyone to set an interval for refreshing a particular page, in this case it’s 1 second. Pre-defined links to the targeted sites were then distributed across Twitter and the Web, through messages link the following :

“Please spread word about a cyber effort to exert pressure on the paramilitary in Iran. They have launched denial of service attacks on US websites that are run by live bloggers feeding us up to the minute information about what is going on in Iran on the ground. To fight back, open these two URLs in as many tabs/windows as possible and simply leave your computer running overnight! We must show solidarity with them in their quest for freedom! The 2nd link targets PressTV, the mouthpiece of Ahmadinejad and Khamenei.”

The second stage of the campaign consisted in the distribution of a multiple iFrame loading script which was automatically refreshing farsnews.com, irna.ir and rajanews.com. The script has since changed its location and is advertised under a new domain.

The third stage included a combined attack, this time including DIY (do-it-yourself) denial of service tools (DDoS), which despite their primitive nature are indeed causing server overload for their targets. Each of the tools is distributed with a simple manual, including links to large images at the targeted web sites, one which the software using proxies will attempt to obtain automatically.

The tools themselves, BWRaeper.exe (detected as Worm.AutoIt.AA); PingFlooder.exe (flagged as banker malware); Server_Attack_By-_C-4.exe (Riskware.ServerAttack.F) and SupportIran.php, have already been picked up by antivirus vendors. The last tool is a basic PHP script targeting those running a server that supports PHP in order to use it.

SupportIran.php has also been released as an improved version to the multiple iFrame loader, and is currently used in the attack as well, having the following sites pre-defined to attack simultaneously - khamenei.ir; presstv.ir; irna.ir; president.ir; mfa.gov.ir; moi.ir; police.ir; justice.ir; live.irib.ir.

There have already been speculations that the magnitude of these local attacks — Iranian users targeting Iranian web sites – is contributing to the “strange changes in Iranian traffic transit” reported during the last couple of days. The attacks are still ongoing.

Credit: ZDNet.com Security Blogs

More on CyberInsecure:

Radio Free Europe Have Been Under Heavy DDOS

White House Network Hacked By Chinese On Multiple Occasions

DDoS Attack Hits Internet Service Providers In Kyrgyzstan

Critical Flaws Patched In Opera 9.61, New Zero-day Vulnerability Remains Unpatched

Coordinated Cyber Attacks Hit Websites Due To Russian-Georgian Conflict

Firefox Update Patch 9 Security Vulnberabilities, 4 Rated Critical

Mozilla has released a new version of its Firefox browser that plugs nine security holes, four of which are rated “critical,” the foundation’s highest vulnerability level.

Version 3.0.11 squashes a javascript chrome privilege escalation bug, which Mozilla said allows attackers to execute malware on the computers of end users. Exploits would work by manipulating chrome privileged objects, such as a browser sidebar.

Other critical vulnerabilities include stability bugs in the browser engine, crashes that caused memory corruption and a race condition while accessing the private data of a NPObject JS wrapper class object. A complete list of fixes is available here.

Mozilla said some of same bugs have been fixed in version 2.0.0.22 of Thunderbird, but at time of writing, the most current version of the email application was 2.0.0.21. We wouldn’t be surprised if an update was released soon.

As usual, the update will be pushed directly to Firefox users and requires only a simple restart of the browser to be installed.

Credit: The Register

More on CyberInsecure:

Critical Internet Explorer Security Vulnerability Fixed By Microsoft

New Firefox 3.0 Is Vulnerable To High-Severity Code Execution

Two Critical Vulnerabilities Fixed By Mozilla In Firefox 3.0.8

Five Vulnerabilities Patched In Firefox 3.0.2 and 2.0.0.17, Two Of Them Are Critical

Mozilla Fixes 12 Security Vulnerabilities In Firefox 2.0.0.15

Apple Users Targeted By Smut-punting Video Codec Malware

Mac fans are targeted via a pair of new malware-themed attacks, one of which is on offer through what purports to be a portal for adult videos.

The Jahlav-C Mac-specific Trojan poses as an ActiveX update needed to watch grumble flicks. The same booby-trapped website, which runs code to detect whether surfers are using Mac or Windows PCs, is a equal opportunity infector that also deploys code designs to infect Windows PCs using similar social-engineering trickery.

In addition to the Trojan, Sophos discovered a new strain of the Mac OS X-specific Tored worm on Thursday.

Mac-specific malware remains a rarity compared to the hundreds of thousands of Windows-specific virus strains, of course. However, it would be a mistake for Mac fans to think they are immune from malware when downloading warez or hunting for porn. “It is becoming more and more common for hackers to use social engineering tricks - like telling surfers that they need to download a plugin on their Mac to watch a video - to weasel their way onto computers,” said Graham Cluley, senior technology consultant for Sophos.

“Once the malware is running on your computer, it can download further code from the internet - opening the door for your computer to be infected by scareware, send out spam, or become part of a zombie botnet. Windows users are used to fighting malware, but many Mac users are oblivious of the battle taking place for control of the public’s computers.”

Credit: The Register

More on CyberInsecure:

Malware Posing As Youtube Codec

Critical Flaws Patched By Apple in QuickTime 7.5 Update

Apple QuickTime Multiple Remote Vulnerabilities

Digg.com Hit By Comments Spam That Leads To Malware

Government Sites Tainted With Malware, Lure Users To Click Sex Videos