Fort Knox Networks

Saturday, September 15, 2012

Fake AV Strain - New URL Callbacks

I have observed a new fake AV strain in the wild at a site that does not have Layer 7 forensics. They do, however, have full URL logging which enabled me to backtrack the events and callouts to what appears to be a total of 15 separate sites. The common string among them appears to be that many of them are Registrar: BIZCN.COM, INC.

The malware in this case was very noisy to the user, changed attributes to hidden on all files in the system and changed GP settings.

The infection point in the case I investigated was a random ftp1.biz website. The user searched online for a specific type of weight lifting technique, was redirected from a legitimate page to the ftp1.biz and hit with an exploit kit of unknown type which was successful.

What was interesting in this case is two points:
1. Once the user ran combofix, malwarebytes and Windows updates on their workstation, the system appears to call back out through a series of different octet-stream requests.
2. The URLs follow a pattern that appears to be new (fresh in the last 2 days according to urlquery.net).

Here are the URLs in order, in case anyone else runs into them.

hxxp://108.178.59.39/links/reveals_formed.php

Some in formation on this URL exists in urlquery. The researched links here have contained only two direct to IP requests, 174.140.166.71 and 46.249.37.122.

http://urlquery.net/report.php?id=177843
http://urlquery.net/report.php?id=177013

hxxp://108.178.59.39/links/reveals_formed.php?udvf=03080407333603030a3302340235073836093508033706363836353505080833&tvaxpmbue=0a09380b0a3508360208&rdm=02&bnvru=dolz&gwxjfli=ewsxs

hxxp://108.178.59.39/links/reveals_formed.php?iwzwf=03080407333603030a3302340235073836093508033706363836353505080833&biwoe=03090708363335340408&qymzixvp=02&amoo=vypv&kcdo=ljyuum

hxxp://108.178.59.39/links/reveals_formed.php?psgm=03080407333603030a3302340235073836093508033706363836353505080833&ygxrse=333d&xfkcr=iqu&rhdays=ewmp

hxxp://108.178.59.39/links/reveals_formed.php?psgm=03080407333603030a3302340235073836093508033706363836353505080833&ygxrse=333d&xfkcr=iqu&rhdays=ewmp

hxxp://108.178.59.39/links/reveals_formed.php?yxuaovb=03080407333603030a3302340235073836093508033706363836353505080833&cgqua=47&jgysdt=030907083633353404080c0c0a09380b0a3508360208&hwalpqs=0302000200020002

hxxp://108.178.59.39/links/reveals_formed.php?psgm=03080407333603030a3302340235073836093508033706363836353505080833&ygxrse=333d&xfkcr=iqu&rhdays=ewmp

The next URL is indiciative of known Fake AV Urls

hxxp://175.41.28.157/api/urls/?ts=3e73d632&affid=60830

As seen, for example, here:
http://urlquery.net/report.php?id=177167

hxxp://report.o7o3179a1k931wsk.com/?Y93o31=%96%C6%D3%A5%D4%D6a%D0n%A4%94%95ji%C2i%CF%9C%98e%DD%A3%A2g%9C%A7%CF%8Al%98%A2%98%95%98%DC%E6%AC%E9%EA%86%BF%5D%E4%9C%95tn%99f%9E_%9F%9F%DE%B0%D0%9C%90%C4%C0%7F%A6%9C%D3pu%A3%A7%A7%A4%A5%A5%60%B5m%A8hh%7C%7B%93d%A3~dd%B9%A7%AFa%A5%A0%9F%92iu%A0Y%A3%D7%D8%AD%9F%A2%A4%5E%9Fj%A0cagi%92a%9Bica%A7%A3%9BT%D9%AC%9D%89ic%9Fdf%AB%89

hxxp://report.o7o3179a1k931wsk.com/?Y31716=%96%C6%D3%A5%D4%D6a%D0n%A4%94%95ji%C2i%CF%9C%98e%DD%A3%A2g%9C%A7%CF%8Af%96j%96%9A%98%DC%E6%AC%E9%EA%86%BF%5D%E4%9C%95tn%99f%9E_%9F%9F%DE%B0%D0%9C%90%C4%C0%7F%A0%9A%9Bnz%A3%A7%A7%A4%A5%A5%60%B5m%A8hh%7C%7B%93d%A3~dd%B9%A7%AFa%A5%A0%9F%92cshW%A8%D7%D8%AD%A0%A2%A4%5E%9Fh%A5cagi%92a%9Bica%A7%A3%9BT%D9%AC%9D%89cagbk%AB%89

hxxp://report.o7o3179a1k931wsk.com/?Q31717=%96%C6%D3%A5%D4%D6a%D0n%A4%94%95ji%C2i%CF%9C%98e%DD%A3%A2g%9C%A7%CF%82f%96j%96%9B%98%DC%E6%AC%E9%EA%86%BF%5D%E4%9C%95tn%99f%9E_%9F%9F%DE%B0%D0%9C%90%C4%C0w%A0%9A%9Bn%7B%A3%A7%A7%A4%A5%A5%60%B5m%A8hh%7C%7B%93d%A3~dd%B9%A7%AFa%A5%A0%9F%8AcshW%A9%D7%D8%AD%A0%A2%A4%5E%9Fh%A6cagi%92a%9Bica%A7%A3%9BT%D9%AC%9D%81cagbl%AB%89

hxxp://report.o7o3179a1k931wsk.com/?Q93120=%96%C6%D3%A5%D4%D6a%D0n%A4%94%95ji%C2i%CF%9C%98e%DD%A3%A2g%9C%A7%CF%82l%98d%97%94%98%DC%E6%AC%E9%EA%86%BF%5D%E4%9C%95tn%99f%9E_%9F%9F%DE%B0%D0%9C%90%C4%C0w%A6%9C%95ot%A3%A7%A7%A4%A5%A5%60%B5m%A8hh%7C%7B%93d%A3~dd%B9%A7%AFa%A5%A0%9F%8AiubX%A2%D7%D8%AD%9F%A2%A4%5E%9Fi%9Fcagi%92a%9Bica%A7%A3%9BT%D9%AC%9D%81icace%AB%89

hxxp://update2.hpl4i1i6elvmn3.com/?i4=kdbTmsPWmJNlndHQZ5mSoZrI0arTnmpnnKfPpqPJlNnJWJHX3uCm2J3Vm9ep3s7hm1TQ2NGy0ceX1sdlj5%2BlzZicYcpuyc%2FbodRjZZyopdehl8anypZS

hxxp://report.o7o3179a1k931wsk.com/?W79343=%96%C6%D3%A5%D4%D6a%D0n%A4%94%95ji%C2i%CF%9C%98e%DD%A3%A2g%9C%A7%CF%88j%9Ef%99%97%98%DC%E6%AC%E9%EA%86%BF%5D%E4%9C%95tn%99f%9E_%9F%9F%DE%B0%D0%9C%90%C4%C0%7D%A4%A2%97qw%A3%A7%A7%A4%A5%A5%60%B5m%A8hh%7C%7B%93d%A3~dd%B9%A7%AFa%A5%A0%9F%90g%7BdZ%A5%D7%D8%AD%9F%A2%A4%5E%9Fk%A2cagi%92a%9Bica%A7%A3%9BT%D9%AC%9D%87giceh%AB%89

hxxp://update.9ik8rgxkc3zlg0.com/?xi=kdbTmsPWmI9wnsycpZfZo8eW36DNYGWcqKXXoZfGp8qSX8zapubZ59fPmOyp2pmV0ZXR1uTFntuoiH3duIPA2bG8oFnn1cttj8alz9ejxZipxpJsmcxw1srdn8ljsaWgaJCUotKo1ciF

hxxp://billingshoper.com/p/?&lid=3060001&affid=60830&nid=F4C9B6B4&group=liv

At this point, the user ran combofix, malware bytes and avg. Then, after 5 hours, these occurred, I am unsure if they are related to the infection, but centralops reports the registered owner as:

person:         Dariusz Mach
address:        SuperHost.pl sp. z o.o.
address:        ul. Slaska 9/1
address:        81-319 Gdynia
address:        POLAND
phone:          +48587396369

fax-no: +48587396368

hxxp://tiptoppoprock2.com/bv?type=js

hxxp://tiptoppoprock2.com/ga.js?W1u9=%98%D6%D9%D8%AC%A5%A0%B3%A7%B7%A0%A5%AFsf%96%A0%A3%8Bf%A8q%AA%9F%B3%B5%A4%B6%B1%A2%A2%A3%B1%A6%B0v_%89%E4%D6%BBn%A5_%EA%CE%E2%E7%D8%DF%DE%AC%A2%A4%A1%87

1 minute later

hxxp://tiptoppoprock2.com/gs.js?1&code=5053a968f1483&title=&keywords=&keywords_text=hollow%2Cnews%2Cny%2Cseptember%2Ccredit%2Cevents&ref=http%3A%2F%2Ftarrytown.patch.com%2F&u=7&pref=&utmcc=__utma%3D195079987.693177053.1333033673.1347020645.1347544109.23%2B__utmz%3D195079987.1344265429.12.4.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3Dsuffolk%20county%20pd%20contract&bd=

After nearly an hour, the system ran Windows updates and was immediately followed by the following Get requests (rerverse chronological order here, oldest last). The /support/u and /support/ur are MIME octet-stream.

hxxp://exasmicine.com/support/u
hxxp://icturesofam.com/support/ur
hxxp://icturesofam.com/support/u
hxxp://icturesofam.com/support/u
hxxp://icturesofam.com/support/u
hxxp://exasmicine.com/support/u
hxxp://menecalenesyny.com/support/u
hxxp://uperctvalm.com/support/u
hxxp://opateomin.com/u.php?0Q9oBPXEN0uECUgzEJ95RQsajz7vq1aG3F/2q5oNvBGAyHya0iCsG5//bBw9iKz11e/law==
hxxp://yjbgcalof.com/support/u
hxxp://dicasenowenuc.com/?ylOdR9GQqXquMlTvsmXlkaz1x3Ea+w==
hxxp://dicasenowenuc.com/updates/msupdate.dat
hxxp://sutonsbaym.com/updates/msupdate.dat
hxxp://cguielinesfo.com/updates/msupdate.dat
hxxp://cguielinesfo.com/updates/msupdate.dat
hxxp://www.update.microsoft.com/v9/1/windowsupdate/redir/muv4wuredir.cab?1209142251

exasmicine.com - Registrar is Bizcn.com
menecalenesyny.com- Registrar is Bizcn.com

Friday, September 14, 2012

Updated FreeDNS Regex

Monday, August 13, 2012

FreeDNS Provider Regex

Wednesday, May 9, 2012

SQL Injection Redirect to Blackhole from Religious Site

Written by Frank Angiolelli, CISSP

Recent metrics from Symantec are showing that religious sites are more often compromised or serving malicious content than adult content sites. In a recent analysis, I have encountered this myself and I will delve briefly into how the malicious event occurred.

User searches in Google for religious content

User clicks on the link, in this case, fassatiny.com, a youth religious website.

Unbeknownst to the user or, likely, fassatiny.com, the website has been injected with obfuscated javascript code.

The result of this code is a get request for: khigaijc.ddns.ms/stds/go.php?sid=1
http://jsunpack.jeek.org/?report=d55b34d070095158ed87123ef1d828c4c16f5139

khigaijc.ddns.ms/stds/go.php?sid=1 redirects you to:
hxxp://lnuzdqhs.ddns.mobi/main.php?page=bd9afdd8df7aa34c

An you have yourself a new experience. Malware via blackhole and insecure religious websites. I, in no way wish to pick on religious websites. They are far from the only insecure websites on the internet.

Anyone can fall a victim to this type of injection, and anyone can fall victim to exploits akin to this.

Now, lets take this one step further:

Lotta trouble out there.

Now, let's detect. How about snort?
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"Exploit: Malicious Obfuscated Javascript Redirect"; flow:from_server,established; content:"<script>i=0;try{prototype;}catch"; content:"</script>"; reference:url,http://jsunpack.jeek.org/?report=d55b34d070095158ed87123ef1d828c4c16f5139, reference:fortknoxnetworks.blogspot.com/2012/05/anatomy-of-compromised-religious-site.html; sid:98100014; rev:1;)

Other tools:
Obfuscated javascript
Nginx server
URL strings consistent with Blackhole

I put the trailing <script> into this rule in the desire to capture the entire script. You may have a better suggestion for the rule and I welcome it.

As always, I welcome your comments, thoughts and suggestions. Follow me @fknsec.

Friday, March 23, 2012

thecheapostore.com - The face of Identify Theft?

TheCheapOStore.com - Everything is sold for 99 cents, including your identity?

Thecheapostore.com is an anomoly in a world of cheap stuff and people searching for the cheapest stuff. At the thecheapostore.com you can buy anything for 99 cents but whether anything actually gets sold is another question.

As you might probably guess, I am constantly making my friends and family aware of malicious internet "stuff". Apparently, they listen.

My wife approached me yesterday to tell me about what she considered a funny story about a website where she was trying to puchase something. The website was called thecheapostore.com. Apparently, everything is on auction and everything costs 99 cents.

There were two funny things about it she told me. The first was that when she tried to purchase, my network identity theft protection fired off an prevented her from going to the website . The second was that all auctions start at 99 cents, end in 30 minutes, but if you refresh your browser, the clock starts again.

"DING!"

So I asked her to show me the site. Here is my short analysis:

The site itself is a simple front end showing "Latest Products", and it opens rather slow, presumably because it is a DSL connection as reported by centralops.

The products are presented to you in an iframe from another website madsem.com

Now, go to madsem.com

It says only.

"welcome Biatches :)"

So what exactly happens to your information when you click "Send". Someone has it. And he thinks your a biatch.

My suggestion is to research websites before you send their information or making a purchase.

http://www.scamadviser.com/is-thecheapostore.com-safe.html
http://www.webutation.net/go/review/thecheapostore.com#
http://answers.yahoo.com/question/index?qid=20120314153644AArQVTz

Registrant:
Domains By Proxy, LLC
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States

Registered through: GoDaddy.com, LLC (http://www.godaddy.com)

IP Address:
82.211.28.22
ACCELERATED IT SERVICES GMBH
Germany
DAWN-SERVER.DE
ip2location.com lists this as a DSL connection

Queried whois.ripe.net with "-B 82.211.28.22"...

% Information related to '82.211.28.0 - 82.211.28.255'

inetnum: 82.211.28.0 - 82.211.28.255
netname: DE-MEDIA-IP-NETWORK-20110823
descr: Media IP Network
country: DE
admin-c: HN1156-RIPE
tech-c: HN1156-RIPE
status: ASSIGNED PA
remarks: ************************************************
remarks: * ABUSE CONTACT: medianetworksg@gmail.com IN *
remarks: * CASE OF HACK ATTACKS,ILLEGAL ACTIVITY, *
remarks: * VIOLATION, SCANS, PROBES, SPAM, ETC. *
remarks: ************************************************
mnt-by: ACCELERATED-MNT
changed: nk@accelerated.de 20110823
source: RIPE

person: Hang Nguyen
address: Duong 8B Pho 4 Bin An, Quan 2
address: Saigon, Vietnam
phone: +84 906482860
e-mail: medianetworks@gmail.com
nic-hdl: HN1156-RIPE
mnt-by: ACCELERATED-MNT
changed: lir@accelerated.de 20110623
source: RIPE

% Information related to '82.211.0.0/18AS31400'

route: 82.211.0.0/18
descr: IP-Routing by Accelerated IT Services GmbH
origin: AS31400
mnt-by: ACCELERATED-MNT
changed: nk@accelerated.de 20080709
source: RIPE

Traceroute

6 TenGigE0-0-1-0.GW14.BOS4.ALTER.NET (152.179.2.97) 80.593 ms 81.399 ms 81. 276 ms
7 0.ge-0-3-0.XL4.BOS4.ALTER.NET (152.63.17.134) 80.176 ms 86.179 ms 85.477 ms
8 0.xe-7-0-3.XL4.IAD8.ALTER.NET (152.63.2.106) 105.865 ms 103.278 ms 112.64 8 ms
9 0.ae4.BR1.IAD8.ALTER.NET (152.63.33.121) 104.557 ms 117.249 ms 97.695 ms
10 194.25.211.17 (194.25.211.17) 102.064 ms 111.042 ms 182.673 ms
11 f-ed6-i.F.DE.NET.DTAG.DE (62.156.131.242) 259.001 ms 194.25.6.90 (194.25.6. 90) 256.655 ms 251.036 ms
12 80.156.160.162 (80.156.160.162) 260.455 ms 242.994 ms 241.802 ms
13 fra4.xe-0-1-0.accelerated.de (84.200.230.81) 225.309 ms 224.549 ms 212.82 0 ms
14 82.211.28.22 (82.211.28.22) 228.830 ms 216.740 ms 215.035 ms

Thursday, March 8, 2012

Why Forwarding Email to a Free Email Provider is a Bad Idea

Written by Frank Angiolelli, CISSP
www.fortknoxnetworks.com

In many cases, we must balance availability against confidentiality. The two are not necessarily mutually exclusive, but in general by increasing confidentiality you decrease availability at least in terms of methods, locations and speed of access.

Why Forwarding Your Email to A Free Email Provide is Good

The benefits of such an action are easy to see:
1. Easier access to the emails.
2. Accessible from any computer without hoops to jump.
3. Easier to configure phones and mobile devices to receive
4. Synchronization options with mobile devices

I have seen cases where this has been done by individuals that just wanted the convenience, did not know how to access their email securely and I have seen cases where a cell phone provider was just trying to help someone access their email but did not know the proper settings, so they assisted with forwarding all the email and setup the phone to receive the forwarded mail.

Why Forwarding Your Email to A Free Email Provide is Bad

The costs associated with this can be tremendous. The primary cost is the considerable lessening of confidentiality. While it is true that most free email solutions provide encryption by default, these services are available to anyone on the web from any computer without restriction. Additionally, their password reset mechanisms are available to anyone on the web.

Beyond that, there is no incident response team attempting to identify unauthorized accesses. Furthermore, audits of who is accessing the system are not possible.

This sets up your organization for the possibility of a malicious individual creating a channel to read corporate email without detection. Take for example the FBI Conference call which was recorded by Anonymous. In this case, an FBI agent had apparently forwarded the conference call details to a free email provider, but the account password had been compromised by the hackers. The result was hackers recording the conference call, which ironically was related to hacking investigations, and posting it to the internet.

What is worse then someone posting the information to the internet? Someone not posting the information and silently, persistently reading the email and information without detection or limits.

In this case where a phone conference was hacked, the forwarding of email to a free email provider was used to further gain access to secure operations, in this case a conference call discussing current investigations. Without disclosing that this had occurred, the malicious individuals could have monitored the email for any other systems which they could access and maintained or even extended their access.

How To Prevent This
1. Block access to webmail providers
2. Monitor mail servers for email forwarding
3. Implement DLP systems
4. Ensure this behavior is restricted by policy
5. Train employees

As always, I welcome thoughts and suggestions.

Tuesday, February 14, 2012

Converting RRAS Logs Into MySQL Database

Written By: Frank Angiolelli, CISSP
www.fortknoxnetworks.com

This discussion is about how to automatically pull the RRAS files and convert them into a formatted CSV file which can be imported automatically into a SQL database for querying and reporting. There are tools available that provide a manual interface or the capability to open the files and view them manually and discussion of them is outside the scope of this article.

First and foremost, Windows Servers typically log RRAS connections to %windir%\system32\logfiles and in my case, the files were called in12??.log (in1201.log, in1202.log, etc... presumably the 12 is the year and the ?? is the log file number).

Secondly, the format for RRAS logs is multi-line which is somewhat of an irritation, however can be worked around using find and piping the output.

In the case I was reviewing, the client had Server 2003 using Windows Authentication. Your case may be different and this may be a good starting point.

Running the following find command against the logs extracts what for this example are the usable portions of information concerning login.

find /I "Use Windows Authentication" %windir%\system32\logfiles\in*.log

The output will look something like this
"SERVERNAME","RAS",02/14/2012,10:02:14,4,"username",,,"<WAN IP ADDRESS>",,"<LAN IP ADDRESS>", ,"<SERVER IP ADDRESS>",132,,"<SERVER IP ADDRESS>",,132329231734,,5,,1,2,,,0,"311 1 <SERVER IP ADDRESS> 01/26/
2012 13:48:05 123",,,,,1,,,,"204",2,,,,,"275",1,,1,1,"<WAN IP ADDRESS>",,,,,,,,"MS
RASV5.20",311,,"0x00414C4142",4,,"Use Windows authentication for all users",,,,"
MSRAS-0-<REMOTE COMPUTERNAME>","MSRASV5.20"

For those of you not familiar with using the For /f command check out this link.

Now, let's output all that information into a single file which we can use.

find /I "Use Windows Authentication" %windir%\system32\logfiles\in*.log >> raslog.output.csv

Once all of that information is outputted to a single csv file, we can use the information presented, however we will need to extract only the useful parts that we want. It is not helpful to have a csv file with 35 columns of which we need, say 7. No need to re-invent the wheel here, the tokens we want are 1,3,4,6,7,8 and 31.

Let's go get them. Don't forget to adjust to single %'s if you are not calling this from a batch script.

for /f "tokens=1,3,4,6,7,8,31 delims=," %%a in ('find /I "Use Windows authentication" %windir%\system32\logfiles\in*.log') do echo %%a, %%b, %%c, %%d, %%e, %%f, %%g>> raslog.csv

Wonderful. Some suggestions here would be to use your tool of choice to schedule this as a task and have the output file placed in a location where it can be imported easily into your SQL system, unless you import directly from the RRAS server.

Now schedule that into a batch script and execute using your scheduled task operator or other task scheduler user. Now we have useful information. Notice in your output file, there are three lines for each connection and one for each disconnection and the most useful line is in this format.

"SERVER", 02/14/2012, 07:59:44, "username", "WANIP", "Assigned Lan IP", "MSRAS-0-Computername"

Import that data to a SQL database of your choice, create a front end using <insert web stuff here> and you have usable data which can now be aggregated, sorted and queried.

Each scenario and implementation will be different, please feel free to contact me if you would like assistance with your systems. I welcome any comments or improvements, as well as observations of your scenarios.