TowerNet CapitalOne: Avalanche returns after 15 monthsOne

The Avalanche Botnet, which has been spamming phishing pages, and most recently the IRS Zeus campaign, has returned to traditional phishing. The UAB Spam Data Mine has received hundreds of samples today with subjects like this:

Download and install digital certificate
Enhancements: New Release
How to install digital certificate
Install Digital certificate
Install Digital Certificate software
Obtain Digital Certificate
Pick Up and Install Digital Certificate
Please install digital certificate software
Please read this important information concerning your privacy
Please Read: This Document Contains Important Information
This Document Contains Important Information



Advertised websites in this target group include:

towernet.capitalonebank.com.racder1c.net
towernet.capitalonebank.com.racder1x.com
towernet.capitalonebank.com.raeder1f.net
towernet.capitalonebank.com.rarder1g.com
towernet.capitalonebank.com.raxsder1.net
towernet.capitalonebank.com.rzasder1.com
towernet.capitalonebank.com.t1fliil.com
towernet.capitalonebank.com.t1fliil.net
towernet.capitalonebank.com.t1fliil.tc
towernet.capitalonebank.com.yyy1yyrd.co.uk
towernet.capitalonebank.com.yyy1yyre.co.uk
towernet.capitalonebank.com.yyy1yyrf.co.uk
towernet.capitalonebank.com.yyy1yyrg.co.uk
towernet.capitalonebank.com.yyy1yyrj.co.uk
towernet.capitalonebank.com.yyy1yyrk.co.uk
towernet.capitalonebank.com.yyy1yyrl.co.uk
towernet.capitalonebank.com.yyy1yyrm.co.uk
towernet.capitalonebank.com.yyy1yyro.co.uk
towernet.capitalonebank.com.yyy1yyrq.co.uk
towernet.capitalonebank.com.yyy1yyrr.co.uk
towernet.capitalonebank.com.yyy1yyrs.co.uk
towernet.capitalonebank.com.yyy1yyru.co.uk
towernet.capitalonebank.com.yyy1yyrv.co.uk
towernet.capitalonebank.com.yyy1yyrx.co.uk

The October 2009 Email

Dear Capital One TowerNetSM or Treasury Optimizer user,

As part of the new terms and conditions of the Data Access Agreement between your organization and the Capital One, your organization will be given a Digital Certificate.

Because of the private nature of the client data, worldwide access via Web to that data, and the potential for fraud, the system must be certain of user identity and authorization. Capital One online banking services use two security mechanisms:
1. Customer & User Codes and passwords to identify users; and
2. Digital certificates to ensure that the user is access the business services through a valid computer, in a trusted organization.

Each registered user must have the Capital One's digital certificate installed on his or her machine in order to access online banking services.

To pickup and install your Digital Certificate, please visit:

http://towernet.capitalonebank.com/capitaloneid/usersdir/formpage.aspx/index.php?em=mymail@mydomain.com&id=703121513513613724734835496595606706767090

Please do not respond to this message as it is generated automatically.


Thank you for choosing Capital One!

DO NOT REPLY TO THIS MESSAGE
To protect your privacy, this e-mail box is not equipped to handle replies. If you have any questions, please use the secure messaging options available through Online Banking or contact Customer Service at 1-877-442-3764.

This e-mail is intended solely for the use of the individual(s) to whom it is addressed. If you believe you received this e-mail in error, please contact Customer Service at 1-877-442-3764 immediately, delete the e-mail from your computer and do not copy or disclose it to anyone else.

NOTICE ABOUT SERVICING E-MAILS
This e-mail contains information directly related to your account with us, other services to which you have subscribed, and/or any application you may have submitted.

You may receive customer service e-mails even if you have requested not to receive e-mail marketing offers from Capital One.

Capital One and its service providers are committed to protecting your privacy and ask you not to send sensitive account information through e-mail. You can view our privacy policy and contact information at www.capitalone.com. This e-mail relates to financial services offered by the Capital One family of companies, including Capital One Bank (USA), N.A. and Capital One, N.A., members FDIC. ©2009 Capital One.
Capital One is a federally registered service mark. All rights reserved.



The information contained in this e-mail is confidential and/or proprietary
to Capital One and/or its affiliates. The information transmitted herewith
is intended only for use by the individual or entity to which it is
addressed. If the reader of this message is not the intended recipient,
you are hereby notified that any review, retransmission, dissemination,
distribution, copying or other use of, or taking of any action in reliance
upon this information is strictly prohibited. If you have received this
communication in error, please contact the sender and delete the material
from your computer.

A quick check in our spam data mine showed that we had many messages from July 9th to July 23rd, 2008 that looked very similar:

towernet.capitalonebank.com.mj.org.kg
towernet.capitalonebank.com.srv1.com.es
towernet.capitalonebank.com.mem.org.kg
towernet.capitalonebank.com.srv1.com.es
towernet.capitalonebank.com.srv2.com.es
towernet.capitalonebank.com.whymangame.org.es
towernet.capitalonebank.com.simongrog.com.es
towernet.capitalonebank.com.serversid.co.uk

The July 2008 Email

In July of 2008, the spam messages didn't actually take customers to a phishing page, but rather to a "Digital Certificate page". Now we have spam that is claiming to be a Digital Certificate, but actually just seems to be a phish. Some of the Summer of 2008 Digital Certificate domains targeting Capital One included:

dexoim.com
jimmedy.com
jioece.com
jioeres.com
klainey.com
maginele.com
mkeiop.com
niytec.com
nnerdix.com
poemils.com

Note: This is a service message regarding TowerNET Form.

Dear customer:

As part of the new security measures, all Capital One Bank business customers (including all former customers of North Fork bank) are required to complete TowerNET Form (or Treasury Optimizer Form). Please complete the form as soon as possible.

To select your form please click on the following link:

http://towernet.capitalonebank.com/onlineform/IDslcertificatedlls/userdirectory/stack/comdir/userform.aspx?ID=2987123067912365091827359023&refer=23987529

Thank you for being a valued customer.

Sincerely,

Online Banking Team

0x4685 create tmp QH3M X1Z end F1W6 XJKV exe XVRO. start: 0x6, 0x5609, 0x4 97925705631835442299918536989 0x67430426, 0x206, 0x3, 0x392 0x67, 0x988 0x2, 0x23, 0x01703069, 0x1, 0x4856 YTU: 0x0763, 0x43816681, 0x5182, 0x831, 0x99970266 IW8D: 0x6947, 0x4267, 0x07, 0x01751563, 0x9651, 0x373, 0x44043375, 0x5, 0x342, 0x5, 0x6101, 0x99, 0x0223, 0x58, 0x199 GJY: 0x1992, 0x78, 0x5, 0x348, 0x56, 0x409, 0x4538, 0x9683, 0x89015643, 0x44, 0x746, 0x03185899, 0x9, 0x3

end: 0x8, 0x2234, 0x8, 0x436, 0x07, 0x53322197, 0x2873, 0x41, 0x114, 0x6, 0x87, 0x7065, 0x74627088 media: 0x5 api: 0x264, 0x871, 0x9589 OT5 2IUL 0x7916, 0x2898, 0x320, 0x67922853, 0x0113, 0x4701, 0x7559, 0x8186, 0x5, 0x5639, 0x74679667, 0x4 920911942973 0x595 BDLA WH2. 0x4673, 0x16778534, 0x0, 0x9845, 0x423 QV1: 0x20765394, 0x9, 0x22851093, 0x0, 0x3, 0x53759855, 0x726, 0x8, 0x66030524 0x96413662, 0x7, 0x5

serv: 0x139, 0x5, 0x710, 0x871, 0x054, 0x6709, 0x037, 0x2, 0x6621, 0x02753076, 0x18651692, 0x5760, 0x881, 0x6691 0x43852370, 0x7292, 0x7, 0x0, 0x9 6U4: 0x25193089, 0x84976848, 0x6, 0x944, 0x350, 0x94990755, 0x3528, 0x51 YXO: 0x36, 0x50, 0x774, 0x64, 0x40539047, 0x89 578, file. 0x96291281, 0x24, 0x907, 0x0123, 0x3, 0x50, 0x0007, 0x1, 0x38693923, 0x5745, 0x39770877 4XFD: 0x50, 0x5, 0x76148701, 0x500, 0x77686479, 0x7463, 0x73962606, 0x51 0x24, 0x01601735, 0x3, 0x82, 0x54, 0x03, 0x2175, 0x57, 0x61 hex X5I9 exe 9AI api start. dec: 0x97, 0x0, 0x615, 0x3, 0x80455440, 0x25, 0x1, 0x61, 0x6, 0x69, 0x14, 0x61152270, 0x18, 0x33 9629819832066915873

45514408333619487641751706301863961 cvs: 0x85, 0x896, 0x95342281, 0x04 stack: 0x53, 0x71382978, 0x708, 0x0, 0x1, 0x9, 0x338, 0x265 D4HL: 0x61307749, 0x865, 0x647, 0x2002, 0x2, 0x1, 0x87, 0x22, 0x0561, 0x4, 0x31, 0x08

We actually ALSO saw this as "Rock Phish" back in April 2006 -

http://session421087.towernet.capitalonebank.com.kigrt.jp/customerservice/formpage
http://session6152365674.towernet.capitalonebank.com.kigrt.jp/customerservice/

Zipped Malware Attachments in Spam: Here comes Conflicker!

This morning I had a couple tweets from our friends at Arbor Networks. (I actually don't know who tweets their feed, but I always picture it as coming from my friend Jose Nazario...)

The first one said:

malcode being spammed as attachment in emails with subject line "Conflicker.B Infection Alert", claims to be from MSFT (follow: http://twitter.com/arbornetworks)

I checked the UAB Spam Data Mine, and saw that we were also seeing the same spam.

Dear Microsoft Customer,

Starting 18/10/2009 the ‘Conficker’ worm began infecting Microsoft customers unusually rapidly. Microsoft has been advised by your Internet provider that your network is infected.

To counteract further spread we advise removing the infection using an antispyware program. We are supplying all effected Windows Users with a free system scan in order to clean any files infected by the virus.

Please install attached file to start the scan. The process takes under a minute and will prevent your files from being compromised. We appreciate your prompt cooperation.

Regards,
Microsoft Windows Agent #2 (Hollis)
Microsoft Windows Computer Safety Division

A couple interesting spam features - first, although the "Sender name" on the spam is "Microsoft Windows Agent", the email actually is setup to use the recipient's own email address as the "From" email. This is a fairly common spammer trick - who blocks email from themselves?

The second interesting feature is that the email contains an attachment named "install.zip". We have been receiving spam for several days claiming to be a Microsoft Outlook update using "install.zip" as the name of the upgrade we should be installing:

You have (5) New Message from Outlook Microsoft

- Please re-configure your Microsoft Outlook Again.
- Download attached setup file and install.

That email was also "from yourself", using the name "support". The subject for that email was primarily:

Microsoft Outlook Notification for the (your email here)

We received our last Microsoft Outlook Notification email at 1:13 AM.

The very first Conflicker email arrived at 12:50 AM, and started coming in a steady stream by 1:05 AM.

I thought it would be interesting to show what Percentage of all the spam we receive at the UAB Spam Data Mine was a "Zipped Malware Attachment". MOST of these were named "install.zip", and contained "fake antivirus" updates, however some have been Zeus or Zbot infectors.


Zipped Malware has ranged from 2.5% to 6.8% of total spam during past two weeks

(Click for full-sized image)

One of the most interesting days represented by this graph was on October 14th, when we began to receive the spam labelled "new settings" in the graph above:

Dear user of the garsdomain.com mailing service!

We are informing you that because of the security upgrade of the mailing service your mailbox garsmail@garsdomain.com settings were changed. In order to apply the new set of settings open zip attached file.

Best regards, garsdomain.com Technical Support.

The subject line on these emails was:

A new settings file for the (youremailhere) has just been released

The malware file size was 13063 bytes with MD5 = 8e84d473b6d2e0fa62e4021b09ea94b5.

At the same time, we had a huge number of nearly identical spam messages which instead of having the attachment, pointed to an Avalanche fast flux website and claimed to be a new Microsoft Outlook Web Application update, as we described in our October 14th blog entry: Targeted URLs in spam . . .OWA Settings update.

Other emails represented on this graph are given below:

Subject: Your internet access is going to get suspended

Your internet access is going to get suspended

The Internet Service Provider Consorcium was made to protect the rights of software authors, artists.
We conduct regular wiretapping on our networks, to monitor criminal acts.

We are aware of your illegal activities on the internet wich were originating from

You can check the report of your activities in the past 6 month that we have attached. We strongly advise you to stop your activities regarding the illegal downloading of copyrighted material of your internet access will be suspended.

Sincerely
ICS Monitoring Team

Subject: Western Union transfer is available for withdrawl

Dear customer.

The amount of money transfer: 1037 USD.
Money is available to withdrawl.

You may find the Money Transfer Control Number (MTCN) and receiver's details in document attached to this email.

Western Union.
Customer Service.

Subject: UPS Delivery Problem Number 2321 (random number)

Dear customer!

Unfortunately we were not able to deliver the postal package which was sent on the 20th of June in time
because the addressee's address is incorrect.
Please print out the invoice copy attached and collect the package at our office.

United Parcel Service of America.

Subject: DHL Tracking Number 3YMH6JJY (Random tracking number)

Dear customer!

The courier company was not able to deliver your parcel by your address.

You may pickup the parcel at our post office personaly.

The shipping label is attached to this e-mail.
Please print this label to get this package at our post office.


Thank you for attention.
DHL Express Services.

Subject: Thank you for setting the order No.475456 (always that number)

Dear Customer!

Thank you for ordering at our online store.
Your order: Sony VAIO A1133651A, was sent at your address.
The tracking number of your postal parcel is indicated in the document attached to this letter.
Please, print out the postal label for receiving the parcel.

Internet Store.

Subject: You've received a postcard

Good day.

Your family member has sent you an ecard from 123greetings.com.

Send free ecards from 123greetings.com with your choice of colors, words and music.
Your ecard will be available with us for the next 30 days.
If you wish to keep the ecard longer, you may save it on your computer or take a print.
To view your ecard, open zip attached file.

Of course, no one should ever open a ".zip" file received as an email attachment, but be especially careful of this campaign!

Hacked Newspaper loads Google News with malware sites

Certain news searches on the Google News site today were pointing users to some troubling websites which seemed to be hosted by the "Chipley Bugle". Having never heard of the Chipley Bugle, I first confirmed that it was a real newspaper from a few sources, including a visit to archive.org's Wayboack Machine, which confirms that the paper has been online since at least 2000.

This is the first time that I've seen a real newspaper used to feed malware-oriented news stories to Google News.

A search for News stories where the source was "chipley_bugle" starts out with normal stories for a small town paper, such as:

BBB reports great turnout
and
Chipola Little Indians program for grades 1-8

It falls apart pretty quickly after that. The next several hundred entries, all posted about 18 hours ago, are for "news stories" with pornographic names of all varieties, and incoherent news stories, such as:

www.privatevoyeur.com
Chipley Bugle - 18 hours ago
At this top benzi knows how to progress hr the ravaged significat and female-to-female time she exists in age to have an boyfriend.

or

www.egotastic.com
Chipley Bugle - 18 hours ago
Naked inmates must be reflected websites, critized producers , and began www.egotastic.com. Janice makes him a late law, flossing him ...

You can verify this behavior by going to Google News and searching for "source:chipley_bugle", although I would recommend not following any of the links!



Many of the "news stories", such as the one above, use the names of real porn websites. If the website is followed, it displays a webpage such as this one, which appears from the URL to actually be on the Chipley Bugle website!



The graphics are actually being called by the Chipley Bugle's website from "imageshack.us", but the webpage is being loaded by what looks to be some content injected into the newspapers content-management system.

A "real" news story for the Chipley Bugle uses a URL like this one:

http://www.chipleybugle.com/index.php?option=com_content&view=article&id=2464:fwc-fills-top-law-enforcement-position&catid=3:local-news&Itemid=23

All of the fake news stories that lead to porn sites use URLs like this one:

http://chipleybugle.com/graduation2009/sponsors/?option=com_content&view=article&id=2415:breast-cancer-awareness-symposium&catid=10:events&Itemid=98

Regardless of whether you say "Enter" or "Exit", the web page forwards thevisitor away from the newspaper site to very hard core porn site calling itself "PornTube". All of the images there lead to the following malware, by claiming a new Adobe Player is needed to view the movie:

The malware has these characteristics:

File name: adobeflashplayerv10.0.32.18.exe
File size: 17920 bytes
MD5 : 5f49907a0e20b4ddebc6c31bde9eb6f1

Its currently only detected by 8 of 41 anti-virus products at VirusTotal, however several anti-virus products will still protect from this type of attack by blocking the malicious website on which the malware is hosted:

davaidavai.cn

which is hosted in the Ukraine on the IP address 80.91.176.190.

This IP address is well-known as a malware infection site, hosting such domains as:

kon4a.org
allsearchweb.org
turbosoftware.org
tubeololo.org
trailerfobia.cn
videopublicclub.cn
xratedtube.cn
xvideostube.cn
go-xtube.cn
hugextube.cn
xmoviesarchive.cn
pumpingstorm.cn
prodaemdeshevo.cn
showallwebs.cn
exclusiveprices.cn
weblmovies.cn
go-xmovies.cn
klikaemnavidos.cn
archieprodaet.cn
ourbestsearch.info
allvideoz.info

again, avoid these webpages as they all lead to malware!

The newest web domain was created toay by a user using the email:

scaryscream@gmail.com

The registrar was one frequented by Ukrainian criminals regularly, the Chinese registrar: 广东时代互联科技有限公司 (also known as "now.cn").



Other in the group used other emails and registrars, such as:

ricm512@yahoo.com who used OnlineNIC
or
exshit@yandex.ru who used Directi Internet Solutions
or
win32parit.b@gmail.com who also used 广东时代互联科技有限公司

Targeted URLs in spam . . .OWA Settings update

All of our trap domains are seeing a new spam campaign today where the website being spammed actually SEEMS to be the email recipient's own domain.

The webpage claims to be a new Microsoft Outlook Web Access update.

Sample email:

Dear user of the mydomain.com mailing service!

We are informing you that because of the security upgrade of the mailing service your mailbox (mymail@mydomain.com) settings were changed. In order to apply the new set of settings click on the following link:

http://mydomains.com/owa/service_directory/settings.php?email=mymail@mydomain.com&from=mydomain.com&fromname=mymail

Best regards, mydomain.com Technical Support

The email subjects which have been used have been:

A new settings for for the mymail@mydomain.com mailbox has just been released
For the owner of the mymail@mydomain.com mailbox
The settings for the mymail@mydomain.com mailbox were changed

In this entire post, remember that where "mymail@mydomain.com" will be replaced by the actual email recipient's userid and domain name.

The websites look like this:



Of course the link is a new version of the Zeus / Zbot trojan.

http://mydomain.com.bertdffe.co.uk/owa/service_directory/settings.php
http://mydomain.com.bertdffe.eu/owa/service_directory/settings.php
http://mydomain.com.bertdffm.co.uk/owa/service_directory/settings.php
http://mydomain.com.bertdffm.eu/owa/service_directory/settings.php
http://mydomain.com.bertdffo.eu/owa/service_directory/settings.php
http://mydomain.com.bertdffw.co.uk/owa/service_directory/settings.php
http://mydomain.com.bertdffw.eu/owa/service_directory/settings.php
http://mydomain.com.nerrasssb.eu/owa/service_directory/settings.php
http://mydomain.com.nerrassso.eu/owa/service_directory/settings.php
http://mydomain.com.nerrasssp.co.uk/owa/service_directory/settings.php
http://mydomain.com.nerrasssp.eu/owa/service_directory/settings.php
http://mydomain.com.nerrassst.co.uk/owa/service_directory/settings.php
http://mydomain.com.nerrassst.eu/owa/service_directory/settings.php
http://mydomain.com.nerrasssu.co.uk/owa/service_directory/settings.php
http://mydomain.com.nerrasssu.eu/owa/service_directory/settings.php
http://mydomain.com.nerrasssw.co.uk/owa/service_directory/settings.php
http://mydomain.com.nerrasssw.eu/owa/service_directory/settings.php
http://mydomain.com.nerrasssx.co.uk/owa/service_directory/settings.php
http://mydomain.com.nerrasssx.eu/owa/service_directory/settings.php
http://mydomain.com.nerrasssy.co.uk/owa/service_directory/settings.php
http://mydomain.com.nerrasssy.eu/owa/service_directory/settings.php
http://mydomain.com.oikkkkua.co.uk/owa/service_directory/settings.php
http://mydomain.com.oikkkkua.eu/owa/service_directory/settings.php
http://mydomain.com.oikkkkuf.co.uk/owa/service_directory/settings.php
http://mydomain.com.oikkkkuf.eu/owa/service_directory/settings.php
http://mydomain.com.oikkkkuh.co.uk/owa/service_directory/settings.php
http://mydomain.com.oikkkkuh.eu/owa/service_directory/settings.php
http://mydomain.com.oikkkkuy.co.uk/owa/service_directory/settings.php
http://mydomain.com.oikkkkuy.eu/owa/service_directory/settings.php
http://mydomain.com.polikka.eu/owa/service_directory/settings.php
http://mydomain.com.polikki.co.uk/owa/service_directory/settings.php
http://mydomain.com.polikki.eu/owa/service_directory/settings.php
http://mydomain.com.polikko.co.uk/owa/service_directory/settings.php
http://mydomain.com.polikko.eu/owa/service_directory/settings.php
http://mydomain.com.polikkp.co.uk/owa/service_directory/settings.php
http://mydomain.com.polikkp.eu/owa/service_directory/settings.php
http://mydomain.com.wsasdec.eu/owa/service_directory/settings.php
http://mydomain.com.wsasdep.co.uk/owa/service_directory/settings.php
http://mydomain.com.wsasdep.eu/owa/service_directory/settings.php
http://mydomain.com.wsasder.co.uk/owa/service_directory/settings.php
http://mydomain.com.wsasder.eu/owa/service_directory/settings.php
http://mydomain.com.wsasdev.co.uk/owa/service_directory/settings.php
http://mydomain.com.wsasdev.eu/owa/service_directory/settings.php
http://mydomain.com.wsasdez.co.uk/owa/service_directory/settings.php

IRS Zeus via Geocities

After a couple days with no "IRS Zeus" spam, the flow of spam messages has restarted. The new spam messages are exactly like the ones we've been seeing since September 9th, with one very significant difference:

Subject: Notice of Underreported Income


Taxpayer ID: e0cdd8db-00000684284766US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: e0cdd8db-00000684284766US

Internal Revenue Service

Two changes are that my email address is no longer part of the "taxpayer id", nor is it part of the URL to which the spam directs me.

When I followed the link in the most recent spam message, I "eventually" end up on the website:

http://www.irs.gov.nerrasssb.co.uk/fraud_application/directory/statement.php?tid=target-00000169290787US

however, that URL is *NOT* what is present in the email message!

http://geocities.com/AnnabelleRichardson78/yredaxubu.htm
http://geocities.com/AshleyWyatt42/ohulociqam.htm
http://geocities.com/AustinHobbs20/nulaxubumul.htm
http://geocities.com/AveryGoodwin43/ihociqamy.htm
http://geocities.com/bcwowpuyne/yredaxubu.htm
http://geocities.com/BillSantos33/nulaxubumu.htm
http://geocities.com/BriannaHensley06/yredax.htm
http://geocities.com/DamienMorris57/apegapyzap.htm
http://geocities.com/ddfsteyxbext/alynahej.htm
http://geocities.com/DevinSnyder65/ikahejov.htm
http://geocities.com/EdwinRandall53/nulaxubumul.htm
http://geocities.com/EltonLawson02/uwalajahe.htm
http://geocities.com/foayoqetpxe/nulaxu.htm
http://geocities.com/FreddyCampbell36/ohuloc.htm
http://geocities.com/hshybmbcg/alynah.htm
http://geocities.com/KirbyRaymond27/ociqam.htm
http://geocities.com/kktpxdqnhb/ulociqamy.htm
http://geocities.com/kmbxpkrkpe/byhegap.htm
http://geocities.com/ktywgegrcudf/byhegapy.htm
http://geocities.com/LiliaMathews67/yredaxubu.htm
http://geocities.com/MarionHudson45/nulaxu.htm
http://geocities.com/MasonSalinas48/rociqamynah.htm
http://geocities.com/MiguelPatterson69/ohuloci.htm
http://geocities.com/MilesFlowers05/alynah.htm
http://geocities.com/msxpytqms/apegapyz.htm
http://geocities.com/MurrayWaters50/byhegapy.htm
http://geocities.com/nmxtumdrfrff/alynah.htm
http://geocities.com/npxqrwxww/apegapyz.htm
http://geocities.com/ocaxbasohmgo36/hiqamyna.htm
http://geocities.com/rhauwqyee/nulaxubumul.htm
http://geocities.com/RobinWhitley59/byhegapy.htm
http://geocities.com/RussChandler61/yredax.htm
http://geocities.com/sfgesqfhrtrx/yredaxubu.htm
http://geocities.com/ShirleyTrevino49/bumulociqa.htm
http://geocities.com/TanyaWeber50/nulaxubumu.htm
http://geocities.com/TiffanyKirby11/yredaxubumu.htm
http://geocities.com/TyreeOsborne93/byhegapyz.htm
http://geocities.com/ufxesabsq/apegap.htm
http://geocities.com/WadeJoyce45/mulociqam.htm
http://geocities.com/yoqrawycf/yredaxubumu.htm
http://geocities.com/zgdgesbnw/ynahejoveke.htm
http://geocities.comgeoffreyPowell47/yredaxubum.htm

Of course none of these URLs actually is the final destination.

The current malware is

File size: 89600 bytes
MD5...: d62e9d994d587e94e04ad3f75ff14f69

you can see a VirusTotal report which shows a 6 of 41 detection rate. Only six anti-virus products out of 41 currently know that this is malware.

A weekend of Old News

Adobe

I'm not sure whose idea it was that we should be able to execute Javascript inside a PDF or Flash file, but we continue to see this exploited. Let's review:

In February 2009, Kevin Haley from Symantec warned that the Adobe PDF reader had an unpatched bug that was being exploited in the wild.
Adobe acknowledged this in a February 19th security advisory.

In April 2009, Computerworld shared a warning from David Lenoe of Adobe urging people to disable Javascript, saying "All currently supported shipping versions of Adobe Reader and Acrobat, 9.1, 8.1.4, and 7.1.1 and earlier, are vulnerable to this issue.

In May 2009, SANS Internet Storm Center warned that the current version of Adobe Flash Player (9.0.124.0) was vulnerable to a similar exploit.

In July 2009, SANS advised of "YA0D" or "Yet Another 0-Day" in Adobe Flash Player.

And finally we get to this week . . . on October 8th, Adobe again released a security advisory, which could be paraphrased as: "hey! if you run our program, you may get owned. We'll patch it next week," advising that a patch would be released on October 13th.

You know, rather than warning us every sixty days that its dangerous to run Javascript in their programs, perhaps Adobe would consider turning it off by default?

IRS Zeus / Zbot continues

Another day, another million dollars stolen by the Russians. This weekend the fake IRS websites are continuing to be a top spam category with more than 56 new websites pretending to be the Internal Revenue Service.

The current malware is still undetected by most anti-virus products, and as always, it changes on an almost daily basis. The current version was first seen Saturday morning, and only 4 of 41 anti-virus products detected that version. Its now up to 12 of 41 according to this current VirusTotal Report for MD5 fb9580be8bcdca37cc377e365365d4de which is 90,112 bytes in size.

Here are the websites we've seen spammed over the past few days according to the UAB Spam Data Mine:

Those spammed on October 9th . . .

www.irs.gov.beffaxsde.eu
www.irs.gov.bezfalsdo.eu
www.irs.gov.bezfazsda.eu
www.irs.gov.brtferho.eu
www.irs.gov.brtferhx.eu
www.irs.gov.brtferhy.eu
www.irs.gov.byugggb.com
www.irs.gov.byugggb.net
www.irs.gov.byugggk.com
www.irs.gov.byugggk.net
www.irs.gov.byugggl.com
www.irs.gov.byugggl.net
www.irs.gov.byugggm.com
www.irs.gov.byugggm.net
www.irs.gov.byugggr.com
www.irs.gov.byugggr.net
www.irs.gov.byugggu.com
www.irs.gov.byugggu.net
www.irs.gov.feraaaz.eu
www.irs.gov.feraaze.eu
www.irs.gov.gerfas1k.com
www.irs.gov.gerz1der.cn
www.irs.gov.gerz1der.com
www.irs.gov.gerz1der.net
www.irs.gov.gerzfdek.cn
www.irs.gov.gerzfdek.com
www.irs.gov.gerzfdek.net
www.irs.gov.linners.cz
www.irs.gov.oiiiterqa.cn
www.irs.gov.oiiiterqa.com
www.irs.gov.oiiiterqa.eu
www.irs.gov.oiiiterqq.cn
www.irs.gov.oiiiterqq.com
www.irs.gov.oiiiterqr.cn
www.irs.gov.oiiiterqr.com
www.irs.gov.oiiiterqw.eu
www.irs.gov.oiiiterqz.cn
www.irs.gov.oiiiterqz.com
www.irs.gov.oiiiterqz.eu
www.irs.gov.oyicoemqu.eu
www.irs.gov.oyicoerqz.eu
www.irs.gov.oyiioerql.eu
www.irs.gov.qazseek.eu
www.irs.gov.qazseep.eu
www.irs.gov.qazsewe.eu
www.irs.gov.qazsewl.eu
www.irs.gov.qazsewm.cn
www.irs.gov.qazsewx.eu
www.irs.gov.qazskem.eu
www.irs.gov.qazsxek.eu
www.irs.gov.refdree.eu
www.irs.gov.refdref.eu
www.irs.gov.refdrek.eu
www.irs.gov.refdrem.eu
www.irs.gov.yxeeddlrp.eu


Those spammed on October 10th . . .

www.irs.gov.brtferho.eu
www.irs.gov.brtferhv.eu
www.irs.gov.brtferhx.eu
www.irs.gov.brtferhy.eu
www.irs.gov.byugggb.com
www.irs.gov.byugggb.net
www.irs.gov.byugggk.com
www.irs.gov.byugggk.net
www.irs.gov.byugggl.com
www.irs.gov.byugggl.net
www.irs.gov.byugggm.com
www.irs.gov.byugggm.net
www.irs.gov.byugggr.com
www.irs.gov.byugggr.net
www.irs.gov.byugggu.com
www.irs.gov.byugggu.net
www.irs.gov.feraaaz.eu
www.irs.gov.feraaze.eu
www.irs.gov.gerfas1k.com
www.irs.gov.gerz1der.cn
www.irs.gov.gerz1der.com
www.irs.gov.gerz1der.net
www.irs.gov.gerzfdek.cn
www.irs.gov.gerzfdek.com
www.irs.gov.gerzfdek.net
www.irs.gov.linners.cz
www.irs.gov.refdree.eu
www.irs.gov.refdref.eu
www.irs.gov.refdrek.eu
www.irs.gov.refdrem.eu

Those spammed on October 11th . . .

www.irs.gov.brtferho.eu
www.irs.gov.brtferhv.eu
www.irs.gov.brtferhx.eu
www.irs.gov.brtferhy.eu
www.irs.gov.byugggb.com
www.irs.gov.byugggb.net
www.irs.gov.byugggk.com
www.irs.gov.byugggk.net
www.irs.gov.byugggl.com
www.irs.gov.byugggl.net
www.irs.gov.byugggm.com
www.irs.gov.byugggm.net
www.irs.gov.byugggr.com
www.irs.gov.byugggr.net
www.irs.gov.byugggu.com
www.irs.gov.byugggu.net
www.irs.gov.feraaaz.eu
www.irs.gov.feraaze.eu
www.irs.gov.gerz1der.cn
www.irs.gov.gerz1der.com
www.irs.gov.gerz1der.net
www.irs.gov.gerzfdek.cn
www.irs.gov.gerzfdek.com
www.irs.gov.gerzfdek.net
www.irs.gov.linners.cz
www.irs.gov.refdree.eu
www.irs.gov.refdref.eu
www.irs.gov.refdrek.eu
www.irs.gov.refdrem.eu

Comcast raises the bar for ISP Behavior

There is one new news item I wanted to call attention to this weekend. According to Brian Krebs "Security Fix" column in the Washington Post Comcast, the largest residential Internet Service Provider, is beginning a new program to alert home PC users who might be infected with malicious bot software.

Good job, Comcast! If we can get more Internet Service Providers monitoring for malicious software, we could dramatically reduce the number of infected computers. We look forward to hearing how this initiative impacts your customers!

The FBI's Biggest Domestic Phishing Bust Ever

Yesterday the FBI began performing arrests of more than 100 individuals involved in a phishing investigation announced in the Central District of California courts. The case, known as Operation Phish Phry was the top story on the FBI website yesterday. Robert Mueller announced the case during a speech to the Commonwealth Club of California, where he praised the cooperation with the Secret Service and their Los Angeles Electronic Crimes Task Force, as well as state and local law enforcement. He said this was the first joint cyber investigation with Egypt and that this cooperative effort illustrates "the power of our global partnerships." Mueller also used the speech to praise the 32,000 members of the FBI's InfraGard program, "experts on our critical infrastructure" who help the FBI prevent risks to that infrastructure from becoming a reality.

The official press release from the Los Angeles FBI office says the announcement of the case came from:
Keith B. Bolcar, Acting Assistant Director in Charge, FBI Los Angeles
George S. Cardona, Acting United States Attorney, Los Angeles
and
Kieran Ramsey, FBI Legal Attache in Cairo Egypt
along with Egyptian Law Enforcement Authorities.


The 85 page indictment, which was presented to a Grand Jury back in February was unsealed once the arrests began, and contains a wealth of information. WIRED Magazine's Threat Level blog was the first to have a copy of the indictment.

The basic charges are:
18 USC S 1349: Wire and Bank Fraud Conspiracy
18 USC $ 1344(1): Bank Fraud
18 USC $ 1028A: Aggravated Identity Theft
18 USC $ 371: Computer Fraud Conspiracy
18 USC $ 1030(a)(4): Computer Fraud
18 USC $ 1956(h): Money Laundering Conspiracy

I'm especially happy to see the Aggravated Identity Theft charge, as it provides an automatic and non-negotiable +2 years to each sentence, which guarantees none of these people will get a "slap on the wrist", unless the prosecution fails to show they used the identities of at least ten individuals.

Although the investigation is labelled "Operation Phish Phry" by the FBI, the US-based charges deal with the money-laundering aspects more than the actual phishing. The phishing portions of the scheme seem to have been run by a group of nearly fifty individuals primarily in Egypt, who would transfer bank account credentials to the US-based ring leaders, who would use their network to move the money through mule accounts, out to cash, and eventually to be wired back to Egypt (minus a commission for the US-based players). Mueller mentions that the funds came from "approximately 5,000 American citizens" who were presumably the victims of these phishing attacks.

This was a tiered operation involving three ring leaders, who used sixteen associates to enlist thirty-eight money mules to receive stolen funds and wire them primarily to Egypt. In order to establish that each of the defendants was definitely involved, the indictment lists 335 "Overt Acts", mostly taking the form of giving a date, place, defendant, and an amount of money transmitted from a stated account to another defendant or unindicted co-conspirator.




(click for larger image, created with i2 Analyst's Notebook by Gary Warner)

The three ring-leaders identified in the indictment were:

Kenneth Joseph Lucas of Los Angeles, California
Nichole Michelle Merzi of Oceanside, California
Jonathan Preston Clark

These three operated a ring of middlemen who recruited the actual money mules. The middlemen were:

Jarrod Michael Akers
Kyle Wendell Akers
Wayne Edwards Arbaugh
Demorris Brooks
Antonio Late Colson
Kenneth Crews
Manu T. Fifita
Jennifer Anabelle Lopez Gonzalez
Tinika Sabrina Gunn
Jason Marcellus Jenkins
Sylvia Johnson
Remar Ahmir Lawton
Kyle Brandon Martin
Frankline Anthony Ragsdale
Steven Aaron Saunders
Rynn Spencer
Raquel Raffi Varjabedian
Candace Marie Zie

Lastly, the actual money mules that were indicted:

Ashley A. Ager
Latina Shaneka Black
Michael Dominick Gunn Dacosta Jr.
Virgil Phillip Daniels
Tramond S. Davis
Shontovia D. Debose
Joshua Vincent Fauncher
Krystal Fontenot
Anthony Donnel Fuller
Michael Christopher Grier
Bryanna Harrington
Shawn K. Jordan
Billy Littlejohn Kelly
Reggie B. Logan, Jr.
Ikinasio Lousiale, Jr.
Raymond V. Mancillas
David P. Mullin
Vincent Nguyen
Ario Plogovii
Brandon R. Ross
Alan Elvis St. Pierre
Courtney Monet Sears
Me Arlene Settle
Paula W. Sims
Jamie Smith
Brandon Kyle Thomas
Christopher Uhamaka
James Michael Viorato
Jovon Darnell Weems
David D. Westbrooks
Bridget Deque Wilkins
Marcus Deshaun Williams

The ages of the defendants range from 19 to 44, with only two being older than 31. Kenneth Crews and Demorris Brooks recruited seven money mules from North Carolina, and one or more unindicted recruiters gathered seven additional mules from Nevada, including at least four from Las Vegas.

Overt Acts are broken into sections:

A. Defendants Lucas and Zie:
Zie opens a bank BOA account, communicates with Lucas by telephone five times, withdraws stolen funds that were tranferred to his bank account. He opens two more account, talks to Lucas 54 times by telephone, and withdraws more stolen funds. Opens more accounts, communicates with Lucas 24 times in a single day, withdraws more stolen funds. The first 14 acts are about these two.

F. Defendants Lucas, Crews, and Logan:
Crews text-messages account numbers opened by Logan to Lucas, who causes funds to move from a victim account to Logan's accounts. Logan withdraws the money.

G. Defendants Lucas and Mancillas:
(Unindicted coconspirator) text-messages Lucas with account numbers opened by Mancillas at BOA. Lucas transfers funds from a victim to the Mancillas account, and Mancillas withdraws the funds.

H. Defendants Lucas and Mullin:
(Unindicted coconspirator) text-messages Lucas the account numbers opened by Mullin at Bank of America. Lucas moves funds from a victim account to the Mullin account, and Mullin withdraws the funds.

They do that over and over and over. The first 200 "Overt Acts" listed all involve Lucas as the one who moves the money from the victim's account.

The credentials for the victim accounts were acquired by phishing, but at this time, we don't have enough details to really know WHICH phishing attacks we're dealing with. It should certainly be pointed out that the phishing attacks were NOT NECESSARILY against Bank of America and Wells Fargo. Funds from any bank can be sent to Mule accounts at any bank, as long as they are both part of the ACH network. Hopefully more details will come out as this case progresses.

The later activities in the indictment make it seem that at least one or more of the defendants had their phone tapped or was cooperating with investigators, such as:

On February 17, 2009, defendants Colson, Weems, and Lucas agreed via telephone that defendant Colson would deliver $1,200 to defendant Lucas

Beginning with Overt Act #201 in the indictment (page 54) the activities turn to Wire Transfers, such as:

On January 12, 2007 in Los Angeles County, defendant J. Akers transmitted $1,300 by Western Union to unindicted coconspirator E.A.

The next forty acts involve Jarrod Michael Akers wiring nearly $100,000 to various parties, mostly unnamed in this indictment. Rehmar Amir Lawton also does more than $30,000 in wire transfers in "Overt Acts". Jonathon Preston Clark, Nichole Michelle Merzi, Candace Marie Zie, Demorris Brooks, Jennifer Lopez Gonzalez and others are also involved in the Wires.

One of the key telephone conversations that was part of the indictment is "Overt Act No. 241":

On December 22, 2008, in Los Angeles County, defendants LUCAS and K. AKERS, in a telephone conversation, discussed the scheme to cause unauthorized transfers of funds into bank accounts for the purpose of allowing coconspirators to withdraw the transferred funds, and defendant LUCAS advised defendant K. AKERS to solicit individuals who need money to assist in the scheme.

Microsoft "Your e-mail will be blocked" phish

An interesting phishing campaign has resulted in several news stories about stolen passwords. That got me digging in the UAB Spam Data Mine looking for related emails. I didn't find THAT phish, but we did receive a large number of email messages claiming to be sent by Microsoft.com with this seemingly important warning:

Your e-mail will be blocked within 48 hours for spam, if this is mistake please cintact us.
Please click here for detailes.

Thank You.
Spam security Customer Service

The "Click Here" portion of the email was a link to a website containing the domain name:

58342875324752.com

with a randomized "host name" portion of the machine, such as:

http://jicjhfchcf63990210626.58342875324752.com/1.html
http://bcaifegghi22625742876.58342875324752.com/1.html
http://ahgdjifchf33143196196.58342875324752.com/1.html
http://dacjfiefdf06964096947.58342875324752.com/1.html
http://aggjbdbejf52476850184.58342875324752.com/1.html
http://gichjabdga24449952037.58342875324752.com/1.html
http://cdbbeibcce54169406995.58342875324752.com/1.html
http://cgahdjahih39067688421.58342875324752.com/1.html
http://dibgdfdbjc50687902460.58342875324752.com/1.html
http://geghdgfbbd77652789593.58342875324752.com/1.html
http://hbahfdbfhb41867793765.58342875324752.com/1.html
http://ecfafijdic45542087833.58342875324752.com/1.html
http://jfjhbgidfj46950802509.58342875324752.com/1.html
http://chcdgeecgh27341962790.58342875324752.com/1.html

Email subject lines observed during this phishing campaign included:

Alert: Account Deactivation Notice
Important message about your account information
NOTIFICATION OF LIMITED ACCOUNT ACCESS
Online Access Supended
Online Account Locked
Online Security Measures
Re-Confirm Your Online Access.
Your account has been flagged!
Your account has been placed on restricted status
Your Account Suspension
Your Online Account Needs Update

The spam had a unique forgery in the email headers to make them appear to be from Microsoft. In an email header, there is a "Received" line which shows the address from which an email was sent, such as:

Return-Path:
Received: from dsl-189-139-6-108-dyn.prod-infinitum.com.mx (dsl-189-139-6-108-dyn.prod-infinitum.com.mx [189.139.6.108] (may be forged))
by GarsServer.com (8.11.6/8.11.0) with ESMTP id n96Lew069365
for <85qrhskymaucw@GarsDomain.com>; Tue, 6 Oct 2009 21:40:59 GMT
(envelope-from bec713-security@microsoft.com)
Received: from dns749.microsoft.com(dns697.microsoft.com [189.139.6.108]) by 189.139.6.108 with SMTP id 69811070;

In this case, the "Return-Path" line is fake, and has been added by the sender. The second "Received" line is also fake, trying to convince you that the sending IP "189.139.6.108" is actually a Microsoft computer, which it's not!

The End?

Unfortunately, that's as far as this part of the investigation can go. The website had already been terminated, by asking the Registrar to remove the nameserver from active duty, meaning that no computers can reach the website in question.

But is that really the end?

The nameserver for this domain, which has already been terminated, was ns1.bloktrest.net. By setting that as our nameserver, we can see that the site was "fast flux" hosted on many different IP addresses. For instance, resolving the domain currently, according to bloktrest.net, points us to:

211.220.122.249
59.28.65.79
61.82.161.51
84.126.133.91
85.136.101.254
86.101.82.52
89.74.19.174
94.189.175.182
116.65.199.187
118.34.214.178
118.38.110.10
119.196.189.101
121.141.44.120
121.181.5.75

By hard-coding one of these IP addresses to the domain name, we can see that what WOULD have happened if we had visited the site was that we would have loaded an IFRAME from the site:

(DO NOT VISIT!) us-business-shop-2019.com/shop/?0a8f23e34c3fccbdbc459ef0d52b3910

THAT website has been listed since September 3rd at MalwareDomainList as a LuckySploit exploiter.

So, the question is at large - was this a phishing site at all? or merely a way to get people to have LuckySploit take over their computers?

Whois points to Badness

Here is the WHOIS data for 58342875324752.com which was registered October 5, 2009 at TodayNIC.com, an infamous Chinese registrar.

Administrative Contact:
Name: Ferd Derfo
Organization: Ferd Derfo
Address: Moskow
City: Moskow
Province/state: MSK
Country: RU
Postal Code: 133331
Phone: +7.9357738849
Fax: +7.9357738849
Email: molda3333vimo@safe-mail.net

Here is the WHOIS data for us-business-shop-2019.com which was registered at another infamous Chinese registrar, ONLINENIC.com, on July 21, 2009:

Serpino Berbeto ad6@safe-mail.net +1.2128848801
Serpino Berbeto
403 po box
New York NY US 10037

ns1.dns-diy.net
ns2.dns-diy.net

Do a search on "Serpino Berbeto" and you'll find more than 1,000 ways in which this identity is involved in the creation of domains used for the distribution of malware, and with online fraud domains, including fake Escrow sites, spam, pirated software (easy-software-store.com), Canadian Pharmacy (shop29.net).

The Serpino identity is one of the many "resellers" that cause OnlineNIC and other Chinese registrars to be such widely used havens for cybercriminals.

Serpino is hosting this site, and several other recent malware infection sites he's been behind, on a webblock belonging to "The Bigness Group" in St. Petersburg, Russia.

Serpino's sites on that netblock include:

yournewvideo.info - 195.88.190.29
brberfsdfsdafs.com - 195.88.190.31
lovisiribkabolishajaimalenkaja - 195.88.190.235
us-business-shop-2019.com - 195.88.190.202
fgddfgdgdfg.com - 195.88.190.235

of course other aliases are also hosting malware on this netblock, which seems to be filling the role of the old Russian Business Network, also of St. Petersburg:

Tourino Markes / moldavimo00@safe-mail.net has registered:
vertigoinvasion.com = 195.88.190.240 - associated with both Zeus and the Fragus exploit kit

Kelly Watsen / potenciallio@safe-mail.net has registered:
landingerfor.org = 195.88.190.235 - associated with LuckySploit exploit kit

Fego Fegochev / moldavimo@safe-mail.net has registered:
ppoqass.info = 195.88.190.246 - associated with the LuckySploit exploit kit
bbortixx.info = 195.88.190.246 - also associated with LuckySploit

Passive DNS reveals all sorts of badness. Recommendation? Everyone should block "The Bigness" and their entire network block!

IRS Zeus Again???

I ran the fast flux IP addresses given above through some checks at a Passive DNS Logging system to see if they were "known" IP addresses. Yes. Several of the IP addresses above are part of the same Fast Flux network which is being used for the "Avalanche" botnet, which is currently behind the IRS Zeus net!

So what happens if we hard-code a host entry for the above IP addresses, and tell it that it is one of the recent IRS domains?

That's right. I added this line to my "hosts" file:

211.53.54.227 www.irs.gov.hyu111a.com

and visited:

www.irs.gov.hyu111a.com/fraud_application/directory/statement.php

an IRS domain which has no active nameserver and has not been live for more than a week. It resolved on the IP address used above for the domain 58342875324752.com, and displayed the IRS Zeus infection website, complete with an active link for downloading the current malware.

File size: 95744 bytes
MD5...: fe80e38049ebb5f082adfb3dd9110d51
Click for Virus Total Report, showing that only 7 of 41 anti-virus products currently detect this Zbot / Zeus Bot infector.

A Day in the Life of Spam

Its been quite a while since I did a "Day in the Life of Spam", but with some recent ups and downs in the trends, I thought it would be worth taking a look again.

For this study, I chose one group of trap addresses for the UAB Spam Data Mine, and decided to try to categorize every email received on October 4, 2009. These particular trap accounts received 10,583 spam emails that day. So how did they break out?

5854 emails or 55.3% = Pharmaceutical products
2303 emails or 21.7% = Watches and other counterfeit goods
1044 emails or 9.8% = Malware distribution
512 emails or 4.8% = Illegal software "OEM" software downloads
397 emails or 3.8% = Fake diplomas or instant degrees
69 emails or 0.6% = Work at home scams
66 emails or 0.6% = Russian language emails
30 emails or 0.3% = Casino spam
28 emails or 0.26% = "Giveaways gotchas" (gift cards, plane tickets,
cell phones, laptops that are called "free" but aren't)
28 emails or 0.26% = Chinese/Japanese emails

200 emails or 1.9% = miscellaneous things other than categories above
insurance, credit reports, DISH Network, ink & toner,
language learning, government grants, dating services,
GI bill info, teeth whitening, government auctions,
ab circle, timeshares, florida rental properties,
colo detox, etc.

Digging in deeper, Canadian Pharmacy dominated the pharmacy category, with what
seems to be at least 19 different spam campaigns, all pushing Canadian Pharmacy
affiliated websites. Compared to other affiliate pill programs, they win hands down:

5358 emails = Canadian Pharmacy
260 emails = Maximum Gentleman penis enlargement
107 emails = Canadian Health Care
61 emails = Online Pharmacy
32 emails = My Canadian Pharmacy
16 emails = Canadian Health & Care Mall
12 emails = Canadian Family Pharmacy
8 emails = Acai Berry

The big changes that stand out especially are that the famous "Russian Brides" spam has almost vanished entirely. Gone also is the Acai Berry spam, which was at one point nearly 15% of all of our spam email messages. 419 scams are disappearing as well, with only 7 emails out of the 10,500+ examined for this "Day in the Life" peek.

When we look at the URLs advertised just in those 5,358 Canadian Pharmacy emails, we find 7,056 unique URLs hosted on 348 domains, of which 234 are ".cn" domains:

aobypwto.cn
aohumwto.cn
bavulov.cn
biyahaj.cn
bjelunep.cn
bobobuk.cn
bohetoj.cn
botazux.cn
bsobidar.cn
bsozefew.cn
busegis.cn
buwaneg.cn
cabavov.cn
cedwoyep.cn
cixivic.cn
cmeqoher.cn
cnahehas.cn
cpiliguk.cn
cqolodar.cn
csimigek.cn
cucodag.cn
cujozas.cn
cuyilec.cn
czavoyig.cn
dadodeg.cn
dahonif.cn
darohus.cn
dbixumaq.cn
ddayatot.cn
dejoviw.cn
dhajeqiy.cn
dijajiv.cn
dilonef.cn
disaniv.cn
dnojisud.cn
doboget.cn
docuyiv.cn
dojiqur.cn
dtusukir.cn
dzayowis.cn
dzolufay.cn
fasosup.cn
fceqinaf.cn
fducilox.cn
fehavux.cn
fejunab.cn
fibujes.cn
ficimap.cn
finahoz.cn
fohiyub.cn
fovihag.cn
fpupewat.cn
fsoresok.cn
fxocefew.cn
gakarid.cn
gbukagef.cn
gebosor.cn
ggefalom.cn
girucav.cn
glimesaf.cn
gmogacof.cn
gmonigec.cn
gobahod.cn
gpevehig.cn
gzevohaq.cn
hakobiz.cn
havarul.cn
hbejivix.cn
hgodakej.cn
hkawutet.cn
hocacap.cn
holoyin.cn
huvayov.cn
hxeqotet.cn
hyunohep.cn
jagegop.cn
jimigok.cn
jiquwac.cn
jirohup.cn
jjunopov.cn
jjunopov.cn
jpatoxih.cn
jranoxug.cn
jvafohit.cn
jvoqidev.cn
jxubocot.cn
kepomat.cn
kkamugag.cn
kovupaj.cn
krecahol.cn
kufanuv.cn
kyejixey.cn
lamadul.cn
lbihakag.cn
lbogupey.cn
lemecij.cn
loganuw.cn
lqihedax.cn
ltexujis.cn
lufogay.cn
luladuz.cn
lwofepib.cn
lwofexiv.cn
lxolemaj.cn
lyarazok.cn
lyuvuced.cn
mahalam.cn
mbajihiz.cn
mivutim.cn
mobivis.cn
moqeqez.cn
mtejuxad.cn
muhazec.cn
myibaqum.cn
nagozuc.cn
nahojut.cn
napojox.cn
nhofewih.cn
niduqab.cn
njihivax.cn
nnifikaj.cn
nocigoj.cn
nosadoc.cn
nqewonih.cn
nropemij.cn
pajikub.cn
pawucit.cn
pazoxif.cn
pevular.cn
pirebav.cn
pkipuyom.cn
pqezosem.cn
puhoquj.cn
puwuwug.cn
qahomeh.cn
qdiwoxaq.cn
qelaquk.cn
qfudocik.cn
qivokex.cn
qiyejas.cn
qoconug.cn
qokutuq.cn
qonanih.cn
qoxifuw.cn
qqisuluw.cn
qtufetag.cn
qudehiv.cn
qzonumeg.cn
rasafas.cn
rewelay.cn
rfozinud.cn
rgekepum.cn
rgekepum.cn
rizexez.cn
rjuyunex.cn
rmenisul.cn
rqasesoy.cn
rwobucem.cn
scelamoq.cn
shetepoc.cn
sirepil.cn
sjowemor.cn
socowuv.cn
sodajud.cn
somorez.cn
soqunup.cn
sorufar.cn
sovuzoq.cn
spojoxiq.cn
tatapum.cn
tawamof.cn
tdiceruk.cn
tfenuhah.cn
thidafak.cn
thodurux.cn
tnawulod.cn
tnikixep.cn
tvufisux.cn
vapabog.cn
vibariq.cn
vivuxab.cn
viyezis.cn
vludihum.cn
vobenog.cn
vohuren.cn
vopaguz.cn
voxaziq.cn
vqamiwur.cn
vriyigip.cn
vvobipad.cn
wabifoy.cn
wbakilit.cn
wbohovuh.cn
wgesirok.cn
wicigeh.cn
wiyisuh.cn
wnexejip.cn
wonefaq.cn
worldvld.cn
wovewab.cn
wuqumud.cn
xehevug.cn
xexugan.cn
xifepuj.cn
xipames.cn
xozowoj.cn
xquwavuk.cn
xuyokir.cn
ycaqoped.cn
ycetuvow.cn
yfolobow.cn
ygemuhop.cn
yinicuv.cn
yipenov.cn
ylafarum.cn
yororom.cn
yujacub.cn
yvukudey.cn
yzigawim.cn
zajeqav.cn
zapoyuf.cn
zcixefat.cn
zecemiz.cn
zfumulik.cn
zicorem.cn
zkodibay.cn
zlesanus.cn
zovoliz.cn
zowimij.cn
zrugaviv.cn
zsomiyon.cn
ztokusut.cn
zuguvov.cn
zupabuv.cn

Another 84 are ".com" domains:

12n3.com
150m.com
adabisnis.com
adorewow.com
adsnote.com
aftermelody.com
angerpeople.com
awaredear.com
barracudacentral.com
betterspoke.com
boldcover.com
cefjedhoha.com
chordspend.com
clickboothlnk.com
cncd-tex.com
coatfew.com
codetwo.com
comfyrace.com
confluencehr.com
connectionends.com
couldfloor.com
creamyglass.com
createsend2.com
entervanish.com
expertreason.com
fallsautumn.com
frankoferosscom.com
gate2service.com
giftedstood.com
gisdany.com
google.com
gotmoral.com
groupfinger.com
havebasic.com
hecreamy.com
helpleave.com
hesheet.com
hoawukfue.com
ihrodinpe.com
images-amazon.com
iomega.com
kezlink.com
livejournal.com
magicrange.com
metalartmaster.com
microsoft.com
mightysing.com
miturl.com
nbcmediacenter.com
onbisnis.com
passport.com
periodtwo.com
pharmacyonlineoffernow.com
posesea.com
proudnoble.com
quietcotton.com
qupdumvov.com
razoncollins.com
renownchief.com
restcalm.com
restthere.com
shegentle.com
shrtn.com
sidecatch.com
smooththan.com
soilbear.com
sonbottom.com
spreadtwenty.com
stoodstudy.com
stringmunchy.com
suchpull.com
t35.com
talkjoyful.com
thebraintree.com
tinytwitt.com
trucktingle.com
waitname.com
webmd.com
weightboxtime.com
whiledesire.com
winsportbike.com
yahoo.com (abused in the form of newly created "yahoo groups")
zestquart.com

Cyber Security Awareness Month: Day Two

Fake IRS Email Continues

I know this is becoming the Spam Campaign that Just Won't Die, but today we are still seeing extreme volumes of spam claiming to be from the Internal Revenue Service, with the subject line "Notice of Underreported Income". Here are the host names being used in the spam for October 1st and so far on October 2nd:

October 2, 2009 Domains seen in spam by the UAB Spam Data Mine:

www.irs.gov.ccviilli.com
www.irs.gov.ccviilli.net
www.irs.gov.ccviilll.com
www.irs.gov.ccviilll.net
www.irs.gov.ccvillli.com
www.irs.gov.gerradsz1.be
www.irs.gov.gerradsz1.co.ee
www.irs.gov.gerradsz1.com
www.irs.gov.gerradsz1.eu
www.irs.gov.haqwaz1.co.im
www.irs.gov.haqwaz1.com.im
www.irs.gov.haqwaz1.im
www.irs.gov.haqwaz1.net.im
www.irs.gov.hyyyyf1.cn
www.irs.gov.hyyyyf1.eu
www.irs.gov.hyyyyf2.eu
www.irs.gov.hyyyyf3.cn
www.irs.gov.hyyyyf4.cn
www.irs.gov.hyyyyf5.cn
www.irs.gov.hyyyyf6.cn
www.irs.gov.hyyyyf6.eu
www.irs.gov.hyyyyf7.cn
www.irs.gov.hyyyyf7.eu
www.irs.gov.hyyyyf8.cn
www.irs.gov.hyyyyf8.eu
www.irs.gov.nyuz1a.com
www.irs.gov.nyuz1a.net
www.irs.gov.nyuz2a.com
www.irs.gov.nyuz2a.net
www.irs.gov.nyuz3a.com
www.irs.gov.nyuz3a.net
www.irs.gov.nyuz4a.com
www.irs.gov.nyuz4a.net
www.irs.gov.nyuz5a.com
www.irs.gov.nyuz5a.net
www.irs.gov.vsdftpp.net

October 1, 2009 Domains seen in spam by the UAB Spam Data Mine:

www.irs.gov.ercc1zw.com
www.irs.gov.hyu111a.com
www.irs.gov.msrvtpp101.be
www.irs.gov.msrvtpp101.com
www.irs.gov.msrvtpp101.eu
www.irs.gov.msrvtpp102.be
www.irs.gov.msrvtpp102.com
www.irs.gov.msrvtpp102.eu
www.irs.gov.msrvtpp103.be
www.irs.gov.msrvtpp103.com
www.irs.gov.msrvtpp103.eu
www.irs.gov.vsdftpp.biz
www.irs.gov.vsdftpp.com
www.irs.gov.vsdftpp.in
www.irs.gov.vsdftpp.info
www.irs.gov.vsdftpp.mobi
www.irs.gov.vsdftpp.net
www.irs.gov.vsdftpp.org

Attempting to retrieve the malware from these sites, we were successful only with those on the ".im" country code. Like many cybercriminals, the criminals behind Zeus rely on inexperienced or uncooperative domain name registrars in order to keep their malicious websites live longer. In this case the domains:

haqwaz1.co.im
haqwaz1.com.im
haqwaz1.im
haqwaz1.net.im

as you're no doubt aware (ok, I had to look it up too!) .IM = Isle of Man. These domains would have been registered from "nic.im", who holds the keys to taking those domains off-line. I'm using the "nic.im" "contact us" page to report these fraud domains now.

The current version of the malware, which is still a Zeus Bot or "Zbot" infector, has these characteristics:

File size: 95232 bytes
MD5...: 869dba8c4bd9bb5a9030a24096883c6b

and is currently detected by only 9 of 41 anti-virus products at VirusTotal as you can see in this VirusTotal Report.

Other Malware in the Mail

Another long-running spam campaign claims that there has been a "delivery problem" with either DHL or Western Union.

The spam message says something like:

Hello!

We were not able to deliver the package you have sent on the (date here) in time
because the recipient's address is inexact.
Please print out the invoice copy attached and collect the package at our department.

DHL Customer Service

In this case the "attached package" is a piece of malware:

File size: 62464 bytes
MD5 : a4c926feeb6f906344f583091a02598f

which is well-detected as "BredoLab" as you can see in this VirusTotal Report by 16 of 41 anti-virus products.

Another version of the same spam says the same thing, only uses "UPS Delivery Problem" as the subject line and claims to be sent from "United Parcel Service".

A third version of the spam claims to be from Western Union, using the subject line "Wester Union transfer is available for withdrawl".

Dear customer.

The amount of money transfer: 8566 USD.
Money is available to withdrawl.

You may find the Money Transfer Control Number and receiver's details in document attached to this email.

Western Union.
Customer Service Center.

Whichever of these BredoLab malwares you run, you end up with Fake AV products being installed on your computer.


In the last prominent malware campaign we'll look at today a spam message is sent with the subject line "Thank you for setting the order No.475456". The text of the email reads:

Dear Customer!

Thank you for ordering at our online store.
Your order: Sony VAIO A1133651A, was sent at your address.
The tracking number of your postal parcel is indicated in the document attached to this letter.
Please, print out the postal label for receiving this parcel.

Internet Store.

Several slight variations of the attachment, sometimes called "install" and other times called "open" detect as different malware, with the two main versions being:

File size: 13312 bytes
MD5 : 595dc19dab1fa441304d77971c507d65

which detects as "Bravix" or "FakeAlert" or many other names, as you can see in this VirusTotal Report, which shows that 20 of 41 Anti-virus products detect this as malware.

and

File size: 13824 bytes
MD5 : 19daf4ef68dd4d830d4159e3d0dc7eb0

which also has many different detection names, including "Bravix", as you can see in this VirusTotal Report, which shows 23 of 41 anti-virus products detect this as malware.

Cyber Security Awareness Month: Day One

The Department of Homeland Security has designated the month of October to be Cyber Security Awareness Month, and we are off with a bang!

ASProx Compromised Webpages

Last night we received word that the ASProx SQL injection attack was back in full swing. After several months of no activity, this botnet is back to its old tricks of attacking vulnerable the ASP pages on IIS Servers trying to add a malicious javascript link to legitimate webpages by manipulating the underlying Microsoft SQL servers.

The main site which is hosting the malicious code right now is "ads-t.ru". Sites which have been hacked by this attack tool will contain a tag which leads to the page "ads-t.ru/ads.js". A quick Google search for this string will currently reveal more thousands of webpages which have had this code injected.

The Javascript causes an IFRAME to be loaded which causes the following file to be loaded:
adtcp.ru/ad/index.php

That domain was registered on September 29th with the email address omit@blogbuddy.ru

I wasn't sure if I should try my malware analysis VM 30,000 feet over Wichita Kansas, but I gave it a shot. The index.php file downloads a hostile Flash Player file:

/ad/spl/files/8628468724.swf

That file is only 797 bytes. VirusTotal has 1 of 41 detects for it, with Symantec calling it "Bloodhound.Exploit.266". The MD5 is 148a8c05fb0b63f036f024e2104a6e4c

The index.php files also causes a malicious PDF file to be downloaded. When the PDF file is opened by an older version of Adobe Reader, the computer becomes infected with one of the "scareware" fake Anti-virus products.

Unfortunately, I don't have a vulnerable copy of Adobe Flash Player handy, so I can't tell you yet what is downloaded by this flash file.


Let's take a search engine agnostic approach for a moment though:

Google.com shows pages injected with:
www.ads-t.ru/ads.js
www.bannert.ru/ads.js
www.bannerdriven.ru/ads.js
www.adtcp.ru/ads.js


Bing.com lists these as the top sites injected with "ads-t.ru":

justcorvettes.com
positiveresults.com
denver.mixliving.com
wirtzrealty.com
leonedirect.com
sandiegomix.com
thepartypeople.com.au
texasmoving.com
pcain.org
s-ecto.com
mpgourmet.com.au
equinehealthcentre.com
specialeducatorsamerica.com

Yahoo! lists only 823 results on ads-t.ru/ads.js with top hits being:
portalhomes.com
pocketlearn.com
justcorvettes.com
positiveresults.com
leonedirect.com
isleofman.com
tccs.org
visittheheart.com
scottsdirectories.com
tccs.org
healthgene.com
artsednj.org
bestpetsupply.com
chargrilled.com.au
healthyhomerecipes.com
lopeor.com
acrosser.com

AOL's search gives a number of results for "ads-t.ru/ads.js". One thing that cracks me up is the "sponsored links"! Can someone possible have bought adwords for that? When I search the path for this hostile Russian hosted javascript attack tool, I am told that:

"Apartments in El Paso, TX" LiveATIndependence.com/FortBliss
and
"TRUE.com The Safest Site in Online Dating" www.TRUE.com
and
"Tv Ads, Create & Run Video Ads Online" www.SpotMixer.com/video

are sponsored links for that search.

The domain names involved in this scam are all Fast Flux hosted, meaning that machines belonging to a botnet are used to resolve the website addresses. The traffic is then proxied from those IP addresses to the "real" criminal server. Here are some recently used IP addresses. If anyone recognizes that botnet, please shoot me an email:

24.17.154.91
24.65.94.114
24.113.68.58
24.151.19.155
24.210.184.44
24.220.226.110
65.189.239.122
66.223.140.55
67.180.252.95
67.185.125.93
67.233.93.235
68.38.133.22
68.40.167.165
69.151.150.145
69.181.182.250
69.245.96.203
70.44.247.207
71.108.37.140
71.121.172.27
71.202.204.125
72.39.29.137
74.130.69.226
74.132.42.47
75.15.183.0
75.34.216.140
75.37.106.134
75.62.36.251
76.87.82.83
76.99.70.115
76.179.209.62
77.86.61.126
81.182.27.22
81.183.112.36
82.126.78.225
82.131.156.180
82.131.217.88
82.131.222.164
83.173.149.63
84.0.96.52
85.67.62.86
86.101.168.70
88.153.34.164
89.200.152.188
91.82.134.228
92.141.150.234
92.249.203.67
94.21.19.98
94.220.214.111
96.245.233.90
96.245.238.218
98.134.46.213
98.150.54.94
128.192.33.6
141.154.188.249
147.134.182.51
147.134.222.113
165.123.143.179
207.168.223.80
207.168.223.92
209.19.94.197
209.55.68.243
216.119.45.147
216.229.86.21

IRS Version of Zeus

I'm actually blogging this using my free trial of Delta's "GoGo" WIFI service as I fly back from San Jose, where I was speaking at the Merchant Risk Council meeting. What is the primary email that I'm downloading this morning? Its still the fake IRS emails which are being used to distribute the IRS version of the Zeus Bot trojan.

So far this flight I've received 330 copies of the current IRS Zeus email. The domain names used in these emails are:

www.irs.gov.hyu111a.com
www.irs.gov.vsdftpp.org
www.irs.gov.vsdftpp.in
www.irs.gov.vsdftpp.mobi
www.irs.gov.vsdftpp.biz
www.irs.gov.msrvtpp103.eu
www.irs.gov.msrvtpp102.eu
www.irs.gov.msrvtpp101.be
www.irs.gov.msrvtpp102.com

The binary its dropping is brand new - I was the first one to have it scanned at VirusTotal. As usual with the new binaries, detection is not very good, 9 of 41 antivirus products are currently detecting it, but at least we do have some of the Big AV Guns on board.

See the VirusTotal Report Here.

Detects from F-Secure, Kaspersky, McAfee, Microsoft, Sophos, Sunbelt, and VBA32 right now.

File size: 96256 bytes
MD5...: 36ac39070d175b21cb2f46e2bdfe668c

Don't Be a Phishing Victim

Today's BBC News quotes Rohyt Belani, the founder and chief executive of Intrepidus Group, a security consultancy:

"Our studies have shown that within the first hour of someone receiving a phishing e-mail, 60% of people click on them. That is not enough time for the security folks to act."

I agree with Rohyt totally, and would urge the consumer message of the day to be "BE CAREFUL with links in your email". If your bank really has an important message for you, go to your bank's website in the way you would normally log in, and do so. If there are important messages from your bank, you should be able to find them there easily.

FBI Director Mueller, and remember Special Agent Sang Jun

Director Mueller gave a briefing to Congress yesterday that you can read here.

Director Mueller briefs Congress


Mueller outlined the work and challenges of the FBI in the areas of:

CounterTerrorism,

Counter Intelligence,

Cyber Attacks (including the National Investigative Joint Task Force)

White Collar (including Public Corruption, Mortgage Fraud, Health Care Fraud, Corporate Fraud)

Violent Crime (including Criminal Gangs, Border Violence, and Crimes Against Children)

If you aren't familiar with the National Cyber Investigative Joint Task Force, there's a pretty decent article describing it from Internet Business Law Services. As they point out, the NCIJTF was in a line item in the DOJ 2009 budget that read like this, although we can't tell how much of it was for the NCIJTF alone:

15. Comprehensive National Cybersecurity Initiative
The FBI requests 211 positions (35 Agents and 113 Intelligence Analysts) and $38,648,000 in personnel and non-personnel funding in support of investigative, intelligence, and technical requirements of the Comprehensive National Cybersecurity Initiative. Included in this request are resources for counterintelligence/computer intrusions investigatory requirements, National Cyber Investigative Joint Task Force (NCIJTF) infrastructure requirements, cyber training, intelligence/information sharing and analysis resource requirements, equipment funding for the continued operations and maintenance costs of its Consolidated Collection CALEA Cell Site Server and Carrier Records Digital Interfacing efforts. FY 2009 Current Services for this program are 89 positions (33 agents), 89 FTE, and $36,000,000.

There's also an interesting chart from the White House showing How the NCIJTF links to other Federal Cyber Centers. Despite that chart, the NCIJTF is a real item and moving forward. The FY10 Intelligence Appropriations bill authorizes a greater involvement in the JTF from the Intelligence community, and I believe this year we will see even greater accomplishments, although its possible we'll never learn about their best work, as is true in so much of the activities of the FBI and others as they defend our nation from attack.

Fallen Agents

At the end of Mueller's remarks, he shared the fact that since his last annual address to Congress, the FBI lost three agents, and he asked that they be remembered:

Special Agent Sam Hicks, "a decorated Baltimore police officer who was part of the Pittsburgh Joint Terrorism Task Force";

Special Agent Sang Jun, "a top-notch cyber agent who served in the El Paso Division";

Special Agent Paul Sorce, "a lifelong street agent who worked on the Detroit Violent Crimes Task Force"

---

I wanted to mention Sang Jun, because he actually re-arrested my very first cyber-criminal, Robert Lyttle, when he got out the first time and hacked NASA, which gave me a tiny connection to him.

-----------
Here's a picture of Sang Jun (right) with Sung-ki Lim, who also went "from geek to g-man":



Sang Jun was a cybercrimes agent who was interviewed by the San Francisco Chronicle in 2005, along with his co-worker Sung-ki Lim, about his new job working in cyberterrorism investigations. At the time, Jun said he took a 25% cut in pay to walk away from a great computer job to join the FBI.

In that interview, it describes his decision making process like this (which I've added and re-ordered slightly):

Jun took a somewhat different route. A high school teacher persuaded him to join the computer club, and he took an advanced Pascal class "and fell in love with it."

In 1994, he graduated from Jacksonville University in his native Florida with a degree in computer science. He worked for three years as a systems analyst with Blue Cross/Blue Shield, then for a year in a similar job at Merrill Lynch. He then joined consulting giant Capgemini, traveling to many Fortune 500 firms.

During that time, he applied to the FBI, but ultimately rejected a job because the salary couldn't compete. He jumped from Capgemini to Andersen Consulting and kept up his glamorous high-flying career.

Until Sept. 11. "That hit me," he said. "I did a lot of traveling on the airlines. I said, 'That could have been me. I want to do something. I want to contribute.' "

He called the FBI again and was hired in 2003.

Both men loved the training. Jun dropped 35 pounds just getting in shape for the training.

Now that they're full-fledged special agents, they can't talk much about their jobs. In Jun's time on the computer intrusions squad, he helped bring down the "Deceptive Duo," a case in which Robert Lyttle, 21, of Pleasant Hill pleaded guilty in March to hacking into computer systems at NASA Ames Research Center and other government sites.

Now Jun works on cyberterrorism, which is the FBI computer unit's top priority. Although cyberterrorism can be defined in many ways, the FBI is particularly concerned with terrorists who might use computer systems to compromise real world infrastructure, such as dams or the power grid.

Much of Jun's work in that arena is pro-active, meaning it involves securing those systems before an attack, rather than waiting until they've been hit.

Now, as a special agent assigned to combating cyberterrorism, Jun said, "You can't beat this. There, I was making a difference on a small scale. Here, I'm protecting the country. ... At the end of the day, all in all, I feel like I accomplished something."

Citizens like Sang Jun deserve our highest respect, and should challenge us to ask ourselves what we are doing to protect the country we love. When Jun thought about September 11th, he walked away from his ten years in a comfortable job at Accenture/Anderson to serve our country in a greater mission. How will you help your country?

Sang died in El Paso on October 22, 2008. His friends and family made a memorial page for him. His best friend, Mel, remembers teasing him about driving to Quantico in his convertible BMW. His sister remembers playing together at their home in Korea and the long plane ride to the US when they were children, and his other sister says because of his inspiration she finished college.

In Brief: The New York Times fake anti-virus redirect

Several people have emailed asking if the fake anti-virus products I mentioned in today's blog article, US Open and VMAs top rogue anti-virus efforts, was the same fake anti-virus that was reported as being launched from advertisements at the New York Times website over the weekend. The truth is, I didn't know! So I looked into it.

The New York Times fessed up that they were having problems in This note on September 13th:

Some NYTimes.com readers have seen a pop-up box warning them about a virus and directing them to a site that claims to offer antivirus software. We believe this was generated by an unauthorized advertisement and are working to prevent the problem from recurring. If you see such a warning, we suggest that you not click on it. Instead, quit and restart your Web browser. Questions and comments can be sent to webeditor@nytimes.com.

A second NYT story today tells only SLIGHTLY more information:
http://bits.blogs.nytimes.com/2009/09/14/times-site-was-victim-of-a-malicious-ad-swap/?hpw, see also: http://gadgetwise.blogs.nytimes.com/2009/09/14/what-to-do-if-you-saw-an-antivirus-pop-up-ad/


A new advertising network that fed ads to the NYT ran "normal" ads for about a week, then suddenly started advertising malware sites over the weekend. An ad, that at least part of the time redirected to russell-brand.cn, contained hostile javascript, which redirected to the actual fake AV site.

Some of the domains involved included:

protection-check07.com which resolved to IP address 88.198.107.25. That IP was also used by:

antivirusonlinescan03.com
antispywarescanner07.com
antispywarescanner08.com
best-antivirus03.com
best-spyware-scan01.com
best-spyware-scan03.com
intellectual-vir-scan08.com
intellectual-vir-scan09.com
malwareinternetscanner03.com
online-antivir-scan09.com
protection-check07.com
quick-virus-scanner01.com
quick-virus-scanner02.com
quick-virus-scanner08.com
reliable-scanner02.com
reliable-scanner05.com


These actually were shared across several IPs, including:

78.46.251.43 - Berlin, Germany, "your-server.de"
88.198.107.25 - Sweden, - "your-server.de"
88.198.120.177 - your-server.de
91.212.107.5 - Cyprus - Ricomm
91.212.127.200 - UK - Telos Solutions
94.102.51.26 - Netherlands - Ecatel

As I was not a first-hand witness, I'm going to wrap this up short as promised by pointing to a few other blogs:

http://ddanchev.blogspot.com/2009/09/ukrainian-fan-club-features.html


http://troy.yort.com/anatomy-of-a-malware-ad-on-nytimes-com

US Open and Video Music Awards top rogue anti-virus efforts

This summary is not available. Please click here to view the post.