CyberInsecure.com

Archive for the ‘Mass Web Attacks’ Category

Swedish authorities are no closer to discovering who may have been behind two distributed denial-of-service (DDoS) attacks that downed the websites of the police and some 40 media sites on Thursday.

The media companies affected by the initial attack all rent server space from Swedish IT service provider Basefarm. According to Baseform, the attack was specifically aimed at one of its clients, media IT development company Adeprimo. “Normally, a website with relatively high traffic will receive around 800 requests per second,” said Basefarm CEO Sara Murby Forste in a statement. “During the attack on Adeprimo, we were registering around 400,000 requests per second,” she added.

News websites affiliated with the Stampen media group, which uses Adeprimo’s media platform, were among those hardest hit. These include main Gothenburg newspaper Göteborgs-Posten, whose site was inaccessible from early morning until lunchtime on Thursday.

Basefarm said it did not receive any warning or threat prior to the attack. The company is preparing to submit a report to the police and is continuing an internal investigation into the attack.

“We know from the nature of the attack that they possess a lot of knowledge. This took place in a planned manner, outside Europe, and with serious force,” said Basefarm’s technical manager Stefan Månsby. “There is much to suggest that the traffic came from Asia and the United States. It could well be Asian, bouncing via the US.”

A second attack later in the day knocked out the website of the Swedish police, which was down for a couple of hours hours in the late afternoon. Police IT experts believe the two attacks are almost certainly linked. “I don’t think it’s a coincidence,” said Ann-Marie Alverås, head of the national police’s web security division. “The amount of traffic was exactly the same in both attacks and we too witnessed traffic from the United States. But the saboteur could be anywhere in the world,” she added.

Thursday’s attacks are to be investigated by the police’s IT crimes unit. Ann-Marie Alverås said the purpose of the attacks remained a mystery. “But I can hazard a guess that it was to attract attention,” she said.

Credit: thelocal.se

An estimated 5.8 million pages belonging to 640,000 websites were infected with code designed to launch malware attacks on visitors, according to a report released Tuesday.

The numbers, compiled over the third quarter by security firm Dasient, represent a significant jump in number of legitimate websites that have been compromised. According to numbers Microsoft released on April, some 3 million pages were infected. The number of sites blocked by Google more than doubled between December and August, to almost 350,000.

“The bad guys are significantly taking advantage of attacking servers so they can distribute their malware to a very, very large number of clients,” said Dasient co-founder Ameet Ranadive. “A lot of these infections are complex and often pretty obfuscated, so it’s difficult for experienced webmasters to figure out what parts of their site have been infected and then to remediate it.”

To understand just how hard it is for webmasters to clean up the mess, consider this: In the third quarter, 39.6 percent of compromised sites had been reinfected after trying earlier to clean up the malware. Criminals are often able to attack a site repeatedly because webmasters fail to change passwords or patch vulnerable web applications that led to the initial exploit.

Eleven days ago, ScanSafe, a separate security firm that announced Tuesday it is being acquired by Cisco, reported that more than 2,000 websites were compromised by a mass web infection known as Gumblar. Many of those sites were likely hit in earlier waves and simply reinfected, a ScanSafe researcher said at the time.

An estimated 54.8 percent of the attacks observed by Dasient involved malicious javascript that was injected into compromised sites. iFrames that silently redirected users to malicious sites came in second at 37.1. Dasient has cataloged more than 72,000 unique malware infections involving websites.

The attacks are growing in popularity because they allow criminals to reach large numbers of victims with a minimum amount of effort. For end users who fail to install the latest versions of Adobe Reader, Adobe Flash and other software on their machines, the attacks often result in a “browse and get compromised” scenario, in which their systems are surreptitiously infected simply by visiting the site.

“Hackers are starting to see some success from these attacks and whenever they see success, they continue to invest more,” Ranadive said.

Credit: The Register

Malicious hackers have managed to infect about 57,000 web pages with a potent exploit cocktail that targets a variety of vulnerable applications to surreptitiously install malware on visitor machines.

The exploits install an assortment of nasty software, including Gologger, a keystroke logging trojan, and a backdoor that attempts to connect to a website hosted in China, according to Mary Landesman, a researcher at ScanSafe, a company that protects end users from malicious websites.

The attackers were able to plant a malicious iframe in the pages by exploiting SQL injection vulnerabilities. Once in place, the script silently pulls down javascript from a0v.org that silently runs while people are visiting one of the infected websites. Affected sites included health care organizations such as the New York Methodist Hospital, charitable and nursing facilities such as howellcarecenter.com, sweetgrassvillagealf.com, foodsresourcebank.org, and morningsideassistedliving.com, and others.

The vast majority of search results returned by Google and Yahoo failed to detect the threat despite the use of technology on both sites that’s supposed to prevent users from clicking on malicious links.

Once called, the malicious javascript contacts one of a half-dozen other domains that actually serve the exploit code. The sites were registered on August 3, so it’s clear the attack is less than three weeks old. ScanSafe has been blocking the attack since August 14.

Web infections are an increasingly common way for criminals to get their malware installed on end-user machines. Because the attacks occur while people are visiting sites they know and are often operated by reputable businesses and charities, few victims have any reason to suspect what’s happening behind the scenes.

Landesman said in an email that she’s been tracking a separate mass infection that in late June was used to deliver exploits targeting a zero-day ActiveX vulnerability. While the number of infected sites was once in the millions, it has since slipped to about 70,000.

SQL injection attacks exploit weaknesses in web applications that fail to adequately scrutinize text that users enter into search boxes and other web fields. The attacks have the effect of passing powerful commands to the website’s back-end database.

Credit: The Register

Researchers are sounding the alarm for a serious administrator password-reset vulnerability affecting the latest version of WordPress, the popular open-source blog publishing platform. An attacker could exploit this vulnerability to compromise the admin account of any wordpress/wordpress-mu 2.8.3 and older.

The flaw, which can be exploited via the browser, gives an attacker a trivial way to compromise the admin account of any WordPress of WordPress MU (multiple user) installation.

The attack uses an ability of PHP to not only set values on variables, but also make them arrays. Basically a GET request can add data like: http://www.example.com?data

PHP takes this a notch further by allowing arrays to be created from a GET as well:

http://www.example.com?variable[]=value1&variable[]=value2

PHP being a typeless environment, this means that if you process variables submitted by a user, the developer needs to be careful not to be fed an array by an attacker instead of the expected string.

A web browser is sufficient to reproduce this Proof of concept: http://DOMAIN_NAME.TLD/wp-login.php?action=rp&key[]= The password will be reset without any confirmation.

The “handy” feature to submit an array in a GET request might well be ignored by many other developers beyond those at wordpress, so if you wrote PHP code yourself, best verify for this possibility.

No patch available for the moment. A fix is in the making and those who use wordpress will see an updated version soon enough.

Credit: SecLists.org

Microsoft has released an advisory related to an Office Web Components ActiveX vulnerability. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. When using Internet Explorer, code execution is remote and may not require any user intervention.

This vulnerability exists in the ActiveX control used by IE to display Excel spreadsheets. Microsoft mentions that they are aware of active exploits against this vulnerability and at the moment there is no patch, just a a workaround. Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft advisory can be found here.

The list of affected products include:

Microsoft Office XP Service Pack 3;
Microsoft Office 2003 Service Pack 3;
Microsoft Office XP Web Components Service Pack 3;
Microsoft Office Web Components 2003 Service Pack 3;
Microsoft Office 2003 Web Components for the 2007 Microsoft Office system Service Pack 1;
Microsoft Internet Security and Acceleration Server 2004 Standard Edition Service Pack 3;
Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition Service Pack 3;
Microsoft Internet Security and Acceleration Server 2006;
Internet Security and Acceleration Server 2006 Supportability Update;
Microsoft Internet Security and Acceleration Server 2006 Service Pack 1; and
Microsoft Office Small Business Accounting 2006.

The vulnerability is being actively exploited on web sites as attackers just modify the code with a fresh download and payload to slightly modified malware. There is a .cn domain that is using a heavily obfuscated version of the exploit - which may become an attack kit (think MPACK) and is similar to recent DirectShow attacks.

Earlier today there was a highly targeted attack against an organization who received a Microsoft Office document with embedded HTML. It was specifically crafted for the target - with the document being tailored with appropriate contact information and subject matter that were specific to the targeted recipient. Analysis of the document and secondary payload found the attacker used a firewall on the malicious server so that all IP traffic outside of the targeted victim’s domain/IP range would not reach with the server.

Here is the workaround details from Microsoft Technet Blog:

By default, if the control is installed, it can be instantiated and scripted as seen by the tool output below:

C:\>ClassId.exe {0002E541-0000-0000-C000-000000000046} (*)
Clsid: {0002E541-0000-0000-C000-000000000046}
Progid: OWC10.Spreadsheet.10
Binary Path: C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
Implements IObjectSafety: True
Safe For Initialization (IObjectSafety): True — IE will allow loading
Safe For Scripting (IObjectSafety): True — IE will allow scripting
Safe For Initialization (Registry): False
Safe For Scripting (Registry): False
KillBitted: False — It is not killbitted

(*) This example uses the OWC10 classid. Same applies to the OWC11 classid: {0002E559-0000-0000-C000-000000000046}

In order to protect your system you can issue the killbit for the two classids by adding the following value in the registry following these steps:

1) Use Registry Editor to view the data value of the Compatibility Flags DWORD in the following two registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0002E541-0000-0000-C000-000000000046}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0002E559-0000-0000-C000-000000000046}

2) Change or add the value of the Compatibility Flags DWORD value to 0×00000400.

After applying the killbit you can check it again with the ClassId.cs tool:

C:\>ClassId.exe {0002E541-0000-0000-C000-000000000046} (*)

Clsid: {0002E541-0000-0000-C000-000000000046}
Progid: OWC10.Spreadsheet.10
Binary Path: C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
Implements IObjectSafety: True
Safe For Initialization (IObjectSafety): True
Safe For Scripting (IObjectSafety): True
Safe For Initialization (Registry): False
Safe For Scripting (Registry): False
KillBitted: True — Since the kilbit has been applied, IE will refuse to load the control

(*) This example uses the OWC10 classid. Same applies to the OWC11 classid: {0002E559-0000-0000-C000-000000000046}

At this point you are no longer vulnerable to this threat through the IE vector.

As mentioned in the advisory, we are also providing a way to apply this workaround automatically. You can click the button below to set the kill-bit on this control.

Credit: SANS ISC
Credit: Microsoft TechNet Blogs

According to ZDNet, during the last couple of hours, visitors of popular and high trafficked web sites such as CNN, BBC, Washington Post, Gamespot, WorldOfWarcraft, Mashable, Chow.com, ITpro.co.uk, AndroidCommunity, Engadget and Chip.de, started reporting that parts of the web sites are unreachable due to malware warnings appearing through the EyeWonder interactive digital advertising provider.

According to Google’s SafeBrowsing advisory for EyeWonder, the exploits were hosted on currently active and participating in the Cold Fusion injection attack domains, namely elfah .net, 2ici .cn and javazhu.3322 .org - the following have also managed to compromise Pakistan’s Telecommunication Authority.

By using RealPlayer Import stack overflow exploit and another one attempting a QVOD Player URL overflow, the cybercriminals then attempt to push eight different malware samples. Detection rates for the droppers are improving.

Interestingly, one of the malware samples attemps to download the updated list of malware binaries by connecting a compromised Italian site part of the Cold Fusion injection attacks (betheboss.it) since it appears to have been exploited in such a way.

This malware incident demonstrates how a single exploitation of a trusted third-party content/ad serving vendor can not only undermine its credibility, but potentially the credibility of the sites using the network. And since the ads on the affected sites are dynamically served through different networks, it remains questionable whether it was in fact EyeWonder that served malicious content, or a compromised partner of the network itself.

Case in point - the partnership between Facilitate Digital and EyeWonder comes in a very insecure fashion with EyeWonder having a permanent iFrame tag loading a domain (adsfac.us) belonging to Facilitate Digital on its front page.

For the time being, EyeWonder.com remains down for maintenance.

Credit: ZDNet.com Security Blogs

Hackers are running a mass compromise against sites running vulnerable ColdFusion application server installations.

Security watchers at the SANS Institute’s Internet Storm Centre are warning that a “high number” of sites have been hit over the last 36 hours or so. Miscreants are exploiting sites running older installations of some ColdFusion applications, such as FCKEditor (a popular HTML text editor) or CKFinder (an Ajax file manager).

The two main strands of the assault both target FCKEditor. Firstly version 8.0.1 of ColdFusion installs a vulnerable version of FCKEditor that is enabled by default. The security flaw creates a means for criminals to upload arbitrary files on affected servers. Details of how to resolve this problem can be found on ColdFusion’s site.

The second strand of the attack relies on third party applications, in particular the CFWebstore e-commerce app, that incorporate vulnerable versions of FCKEditor.

Hackers are taking advantage of the vulnerabilities to plant malicious scripts onto compromised websites, as part of a drive-by download attack that ultimately aims to infect visiting surfers.

SANS reckons the crackers behind the attack are the same as the gang that pulled off a similar attack back in March. Security researchers urge sites to review their ColdFusion installations, paying particular attention to deleting older applications that may have been left around as orphans during systems upgrades.

Credit: The Register

The Iranian opposition coordinated a cyber attack yesterday that has successfully managed to disrupt access to major pro-Ahmadinejad Iranian web sites, including the President’s homepage which continues returning a “The maximum number of user reached, Server is too busy, please try again later…” message.

Through a combination of DIY (do it yourself) denial of service attack tools (DDoS), multiple iFrame loading scripts, public web page “refresher” tool, and a much more effective PHP script, the participants have already prompted some of the major Iranian outlets to switch to “lite” versions of their sites in an attempt to mitigate the attack.

The campaign appears to have been organized through Twitter, which despite public reports that the site has been banned in Iran, appears to be still accessible through a a persistent supply of proxy servers on behalf of the opposition.

Moreover, the ongoing distributed denial of service attacks, are using techniques which greatly resemble those used in last year’s Russia vs Georgia cyber attack, and the ones Chinese hacktivists used back in 2008 in order to temporarily shut down CNN, with a single exception - there’s no indication of a botnet involvement in the present attack.

Instead, the attack relies on the so called people’s information warfare concept, which is the self-mobilization of individuals, or their recruitment based on political/nationalistic sentiments by a third-party, for conducting various hacktivism activities such as web site defacements, or launching distributed denial of service attacks.

The following are some of the sites that are currently under attack, remain totally unresponsive, or return “server is too busy” error messages:

Ahmadinejad.ir - Mahmoud Ahmadinejad’s Official Blog - under attack
Leader.ir - Office of the Supreme Leader, Sayyid Ali Khamenei - under attack
President.ir - Presidency of The Islamic Republic - under attack
Farsnnews.com - Fars News Agency - under attack
Irib.ir - Islamic Republic of Iran Broadcasting - under attack
Kayhannews.ir - News Portal - “Service Unavailable”
Irna.ir - Islamic Republic News Agency - “service unavailable”
Mfa.gov.ir - Ministry of foreign affairs , Islamic Republic of Iran - under attack
Moi.ir - Ministry of Interior - under attack
Police.ir - National Police - under attack
Justice.ir - Ministry of Justice - under attack
Presstv.ir - Iranian Press TV - “server is too busy”

Among the first web-based denial of service attack used, is a tool called “Page Rebooter” which is basically allowing everyone to set an interval for refreshing a particular page, in this case it’s 1 second. Pre-defined links to the targeted sites were then distributed across Twitter and the Web, through messages link the following :

“Please spread word about a cyber effort to exert pressure on the paramilitary in Iran. They have launched denial of service attacks on US websites that are run by live bloggers feeding us up to the minute information about what is going on in Iran on the ground. To fight back, open these two URLs in as many tabs/windows as possible and simply leave your computer running overnight! We must show solidarity with them in their quest for freedom! The 2nd link targets PressTV, the mouthpiece of Ahmadinejad and Khamenei.”

The second stage of the campaign consisted in the distribution of a multiple iFrame loading script which was automatically refreshing farsnews.com, irna.ir and rajanews.com. The script has since changed its location and is advertised under a new domain.

The third stage included a combined attack, this time including DIY (do-it-yourself) denial of service tools (DDoS), which despite their primitive nature are indeed causing server overload for their targets. Each of the tools is distributed with a simple manual, including links to large images at the targeted web sites, one which the software using proxies will attempt to obtain automatically.

The tools themselves, BWRaeper.exe (detected as Worm.AutoIt.AA); PingFlooder.exe (flagged as banker malware); Server_Attack_By-_C-4.exe (Riskware.ServerAttack.F) and SupportIran.php, have already been picked up by antivirus vendors. The last tool is a basic PHP script targeting those running a server that supports PHP in order to use it.

SupportIran.php has also been released as an improved version to the multiple iFrame loader, and is currently used in the attack as well, having the following sites pre-defined to attack simultaneously - khamenei.ir; presstv.ir; irna.ir; president.ir; mfa.gov.ir; moi.ir; police.ir; justice.ir; live.irib.ir.

There have already been speculations that the magnitude of these local attacks — Iranian users targeting Iranian web sites – is contributing to the “strange changes in Iranian traffic transit” reported during the last couple of days. The attacks are still ongoing.

Credit: ZDNet.com Security Blogs

A large internet service provider said data for as many as 100,000 websites was destroyed by attackers who targeted a zero-day vulnerability in a widely-used virtualization application.

Technicians at UK-based Vaserv.com were still scrambling to recover data on Monday evening UK time, more than 24 hours after unknown hackers were able to gain root access to the company’s system. The attackers were able to penetrate his servers by exploiting a critical vulnerability in HyperVM, a virtualization application made by a company called LXLabs. Vaserv.com got hit by a zero-day exploit in version 2.0.7992 of the HyperVM application.

No one could receive a response to inquiries sent to LXLabs company, which according to its website is located in Bangalore.

Data for about half of the websites hosted on Vaserv was destroyed all at once sometime Sunday evening, shortly after administrators noticed “strangeness” on the system. The attackers had the ability to execute sensitive Unix commands on the system, including “rm -rf,” which forces a recursive delete of all files.

Some 50 percent of Vaserv’s customers signed up for unmanaged service, which doesn’t include data backup. It remains unclear of those website owners will ever be able to retrieve their lost data. As a result, at least half the websites that were hosted on the site remain offline.

“Since last night, I’ve had probably 40 phone calls from clients saying ‘Why is my website down,’” said Daniel Voyce, a web developer for Nu Order Webs who uses Vaserv to host customer sites. “It’s making me look bad.”

Voyce said the hackers, given the high level of server access they gained, were likely able to intercept a wealth of sensitive data stored on Vaserv’s servers. Voyce said his customers are safe because all sensitive information was encrypted.

Little is known about the people who attacked the site. So far, there are no known reports of individuals taking credit for the hack. The breach was likely the result of a SQL injection attack that penetrated Vaserv’s central management software and removed vital binaries and data for about half of all user data stored by the service.

Vaserv specializes in low-cost web hosting using VPS, or virtualized private servers. Virtualization features in LXLabs’ HyperVM helped Vaserv provide the service, which costs a fraction of the price of dedicated server hosting.

It remains unclear how other webhosts using the HyperVM have been affected.

Update: On Monday, the boss of LxLabs was found dead in a suspected suicide. Reports of the death of K T Ligesh, 32, come in the wake of the exploitation of a critical vulnerability in HyperVM. The effect of his death on the development of updated software by LxLabs is unknown at time of writing.

Ligesh was found hanged in his Bangalore house on Monday morning, after a late night drinking session. The Times of India reports that he was upset with the loss of a recent contract. Ligesh was also still coming to terms with the suicides by hanging of his sister and mother five years ago.

Security researchers at Milw0rm warn that the Kloxo (formerly Lxadmin) web hosting platform from LxLabs contains 24 security vulnerabilities and exploits. The flaws include SQL injection vulnerabilities and flaws that create a way for hackers to gain file access to files hosted on a vulnerable system.

The vulnerabilities are confirmed to affect Klaxo version 5.75, though other versions may also be affected. Milw0rm went public with an alert on the vulnerability last Thursday after failing to hear back from LxLabs in what it considered to be a timely manner.

LxLabs recently said that more than 30,000 virtualized private servers (vpses) were managed by HyperVM, and more than 8,000 servers running Kloxo. The largest single installation of hyperVM centrally manages more than 4000 VPSes.

Virtualization features of HyperVM allow hosting firms such as VAserv to provide low-cost web hosting at a fraction of the price of dedicated server hosting.

Credit: The Register

Early last week TrendLabs alerted a government agency about one of the pages in their site that appears to have been injected with malicious frames. The San Bernardino County site’s probation page was, during that time, carrying a frame that directs users to a known disease vector under the domain videosdivx(dot)net. The target URL bear the strings “KATRINA+HALILI+NUDE” which suggests that videos or pictures of the Filipino actress may be viewed from the URL. Halili is currently involved in a much talked about sex video scandal proliferating in the Philippines.

While the site is now clean, Threat Analyst Joseph Pacamarra found another attack capitalizing on the same sex video scandal, this time using the Ask George website, the state-wide information portal of Washington DC in the US. Accessing the said page, which had been injected with a script containing the words “katrina+halili+sexy+pic,” redirects to a site http://hot-unlikely-tube.com/xplaymovie.php?id=40039

Clicking on the black screen, the user is informed that he needs to download a codec to be able to watch the video. But instead of a codec, the user downloads malware: TROJ_DLOAD.TID and its payload, TROJ_COGNAC.J.

TROJ_COGNAC.J is saved as b.exe. It modifies the system registry to make sure it runs at every startup. It assists TROJ_DLOAD.TID in downloading files named qwerce.gif and a.exe from different URLs. As of this writing, the .gif file is non-malicious, and the URL that downloads a.exe is not accessible. While this means little danger for current victims of these attacks, the actual contents of the URLs may actually change any time to exhibit more dangerous side-effects.

The affected pages from Ask George appear to have been modified last May 30, early morning US time.

Credit: Ailene Dela Rosa, Trend Micro TrendLabs