SophosLabs blog

Malware authors and software-protectionists alike go to great lengths to obfuscate and contort their code in an attempt to hide or obscure its true nature [1,2]. The assumption being that it is difficult for human or machine to make sense of the code, extending analysis time and giving the bad guys a free run.

For the most part, such obfuscations (in particular JavaScript) are relatively easy to unravel because they are static transformations [3]. The more complex encrypted forms require some form of script emulator (or your browser of choice) and a skillfully inserted alert() instead of eval(), however a new form akin to the one-time-pad concept is now being deployed.

Script obfuscated and encrypted with contextual data

Such [quasi] one-time encryptors function by generating and encrypting the content on-demand while at the same time choosing a key which is a function of the download environment, such as the referer or the last modified time. When the script is rendered it has all the necessary information to correctly decode. However when that script is submitted by the customer for analysis, the environment has long been destroyed making the script nearly impossible to decode.

Thus examining the script on Friday 13th (13/11/2009) at 11:08:23 yields (poorly) decrypted content which does not render.

Script decoded with wrong key

yet behold, on (every) 47th second of the 7th day of each month the script correctly decodes revealing its secrets - here, deciding whether to serve a (quite likely malicious) PDF, or Flash element.

Correctly decoded given context

Static offline analysis of such scripts is easily thwarted, however any scanning engine which has access to the HTTP data stream should be able to cope since it has all the relevant contextual data required at the time of rendering.

Brute-forcing aside, the only real way to tackle this problem is to use “Just in time” detection (otherwise known as on-access), failing that, NoScript remains your best protection.

Before everybody peruses the ‘net in search of their fish supper this cold and wet Friday night.* Stop!!

Do you have adequate protection?

For your Internet browsing?

Earlier this week SophosLabs spotted that the famous chip shop brand Harry Ramsden’s website had been haked by a malicious iframe. I codn’t believe it when I saw that the mootools.js script on the site is infected with Troj/Iframe-DF meaning that the website isn’t the plaice to visit.

The injected code is all mushed up though so the malicious script may be floundering.

The obfuscated iframe points to a haked site in Germany that when you go there redirects you to a fake Google site registered in the EU. Which triggers Troj/ObfJS-R.

I don’t want to carp on about the responsibilities of Web masters and Web hosters but they really have to protect their sites as well as tuna them up.

All this talk of fish’n'chips has made me hungry for a chip butty.

*Apologies for the puntastic tabloid style of this post but it is Friday :)

I saw in the news today about Facebook groups being hijacked through a design flaw. When a group is created on Facebook, you have the option of it being an open group (anyone can join) or a closed group (invite only). Then there is an owner and an administrator of the group. Usually they are the same person, but you can delegate. If the owner/admin no longer wishes to be a part of the group, they can leave, but that means the group no longer has an owner. Anyone can then take ownership of the group to keep it going.

I am not going to debate whether this is a good or bad policy on the part of Facebook. What I want to talk about is the blatant hacking of the group “Control your info”. While I understand their desire to “help” hacking and defacing groups on Facebook is hardly the way to go about it.

Once they joined a group and took it over, they would post the following message there:

“This means we control a certain part of the information about you on Facebook. If we wanted we could make you appear in a bad way which could damage your image severly.

For example we could rename your group and call it something very inappropriate and nasty, like “I support pedophile’s rights”. But have no fear - we won’t. We just renamed it Control Your Info. Because this is really all we want:

Think about the safety in your social media life to the same extent you do in your real life.

Watch the videoclip for more information or check out for more tips soon!

We promise to restore your group name and leave the group by the end of next week. Don’t worry - we won’t mess anything up.

Best regards”

What they are doing really is no different to a hacker gaining control of a group and defacing it. Two wrongs do not make it right. While this group may think they are “helping” they are in fact making themselves look just as bad as a black hat. Think about the hacker that “Rickrolled” a bunch of iPhones that Graham posted about. Does it really make it right to hack into computers, phones, and websites to “try to raise security issues”? Not in our books.

I’ve been watching the latest phishing attack happening on Twitter for the last week or so. It seems to be one major campaign that keeps changing the DM (direct message) text every couple of hours. It’s been messages like

“woah… you’re on this ”
“LOL..Nice look ”
“This thing has your pic ”

The links got to videos.twitter. and videos.blog.. Sophos customers using the WS1000 are safe as we’ve been blocking the domain. Interestingly, we’re now seeing new URL shorteners being used, such as wapurl.co.uk and others. Seems the malware authors are tired of bit.ly and 3.ly blocking their stuff or perhaps because third party applications such as TweetDeck won’t preview those, but will happily open them.

I had someone ask the question “Why phish for Twitter credentials?” We saw this type of attack on Facebook. Lots of phishing messages, links, and posts were posted to capture credentials. Then later on we saw the malware attachments spammed out to the email addresses associated with the compromised accounts and when the malware was run, it became part of a botnet to send yet more spam. Taking this history, we are wondering if this will take a similar turn and start sending out malicious emails purporting to be from Twitter saying “Update your account/password” or “Updated Terms of Service, please open.”

Another reason for the phishing attacks would be to expand the “attack surface”. More and more people are tweeting from their iPhones, Androids, Blackberries, Palms and other smart phones. This means a whole new vector to be exploited, since again, most third party Twitter apps do not preview the shortened URL.

We have to say it again, PLEASE be careful out there. Just because a message came from a friend/follower doesn’t mean it’s completely trustworthy. Check the link with an expander service such as LongURL, use NoScript and URL expander plugins and keep your security software and OS up to date. Otherwise, your machine is likely to be “dinner”

For those of you who aren’t mixed martial arts fans, this past Saturday night was the Strikeforce television event where one of the worlds greatest fighters Fedor Emelianenko fought Brett Rogers, and what a fight it was. It was a fairly significant fight since Fedor is generally not seen fighting in North America and his exposure is fairly limited, but it aired on regular cable TV on CBS so you can be sure plenty of people saw it. As the fights were being televised at one point the gym that each fighter trained at was shown on the screen and I didn’t give it a second thought until this afternoon.

While doing my daily rounds of digging through newly infected pages I spotted something in a link that looked familiar, Red Devil Sports Club, the gym Fedor trains at. The infected page was being hosted on a website used to help promote MMA gyms, and sure enough when you Google the terms “Red Devil Sports Club” the website in question appears on the first page of results. Following the link led to a page that had been compromised with the latest Gumblar variation which Fraser blogged about yesterday.

It seems recent celebrity deaths aren’t the only thing hackers abuse to find new victims. Granted, the method of delivery is a little more obscure since not everyone is going to go and Google the name of the gym Fedor trains at that they heard while watching TV, but it’s just one of many methods this kind of malware uses to spread.

Readers may have noticed some of the recent rumours about new Gumblar-related activity (see for example here or here). The original Gumblar attack (May 2009) involved the mass-defacement of huge numbers of legitimate sites with a malicious script Sophos products blocked as Troj/JSRedir-R. The purpose of this was to infect users with a data-stealing Trojan known as Troj/Daonol-Fam.

The payload of the recent attacks looks similar, the malicious binaries now being detected as Mal/Daonol-A.

As with the previous wave of site defacements, it appears to be stolen FTP credentials that is driving the new attacks. These enable the attackers to upload malicious PHP scripts which can then be used to construct the attack. Contrary to the previous attacks, the payload is now also being hosted on compromised hosts, making the attacks more resilient.

At the end of last week, we managed to get hold of one of the key PHP script components being used by the attackers. Analysis of the script gives us some interesting insights into these attacks.

The PHP script can be used by the attackers to inject a malicious script into all suitable pages on the victim site. Files below ~200kB whose extension do not match any of the following are targeted (up to a maximum of 5 within any particular directory):

• .zip
• .rar
• .gz
• .jpg
• .gif
• .avi
• .mp3
• .wma
• .mpg
• .png
• .txt
• .swf
• .css
• .js
• .log
• .pdf
• .ppt
• .fla
• .as
• .tar

Some simple techniques are used to make the injected scripts mildly polymorphic (between each injected page). These include function/variable substitution and simple string obfuscation.

The purpose of the injected script is simple - adding a script element to the page which will cause the browser to load further malicious content from a remote server (hosted on another compromised site).

The PHP script makes it trivial for the attackers to change the redirection payload of the scripts that are injected into pages. Issuing a HTTP request to the PHP script with the desired target domain in the query string is all that is required. So, requesting http://compromised_site_A/path/gumblar.php?dom=compromised_site_B will result in:

• removal of any injected scripts previously added to suitable pages on compromised_site_A
• injection of new scripts, whose payload will be to load content from compromised_site_B

This makes the new wave of attacks more resilient to URL filtering. Sophos customers are protected - aside from detecting the payload as Mal/Daonol-A, pages injected with the redirection scripts are blocked as Troj/JSRedir-AE. Indications at this point are that a large volume of sites have been affected - the detection is already contributing to almost 4% of all web-based threats for the past 48 hours.

Additionally, detection for the malicious PHP scripts uploaded to compromised sites has been added as Troj/PHPMod-B. If you are a webmaster or hosting provider and encounter this detection, please let us know. It would be interesting to collect further samples of the PHP kits being used.

Back in May, we posted some stats on the prevalence of Troj/JSRedir-R. Last week, I asked was Mal/Iframe-N: The next big threat?. Looking through our stats on malware hosted on websites this morning I saw that Mal/Iframe-N fifth in the overall stats for October.

Looking at the latter part of the month from the 21st (when the detection was published) onwards.

Mal/Iframe-N is clearly first and if the results are extrapolated for the whole month Mal/Iframe-N should have easily beat Mal/Iframe-F into second place!

Late last week, I downloaded:

• 2819 infected URIs infected with Mal/Iframe-N
• hosted on 2294 different domains
• with 163 different TLDs including:

.edu.in
.edu.tr
.edu.tw
.edu.ua
.ej.am
.eng.br
.es
.eu
.fi
.fr
.fr.cr
.ge
.go.th
.gov.br
.gov.pk
.gov.tr
.gr

I have had a few correspondences with other security researchers regarding this threat (see iframes are EVIL! Hate Zeus!) particularly with Unmask Parasites who has gone into more details of this type of threat (see 1, 2) who like me originally thought that the ‘onload’ attribute wasn’t legal in an iframe. Two things changed my mind:

1. Visiting an infected site on a goat machine.
2. The number of infected sites (>40, 000).

In someways the second fact is more persuasive as malware authors don’t tend do things for no reason.

Another Twitter direct message (DM) scam was happening today, but apparently this time the hook was to prey on users’ vanity. Several messages were seen with the following text:

“I lost 25lbs using this ”
“whoa this works. i feel good and look good ”
“lol it’s amazing. look and feel great with ”

When a user clicked on the link, it redirected you to this site:

All you had to do to get your “free” bottle was fill out your name, address, phone number and email. However, once you submitted that, you then get to the screen to input your billing information and input your credit card details. Why do you need to input credit card details for something that’s free? With all that information, the cybercrooks have more than enough info to commit identity theft and fraud on your card. They have your name, address, card info and you’ve even confirmed that the address you gave is the billing address too.

At the risk of sounding preachy, these pills never work. They only thing that gets “slimmer” is your wallet.

Twitter users should be especially careful this morning as there’s a new Twitter phish campaign going on. The message that is being seen is using a known tactic where it tries to trick the user into believing there’s some content on the internet about them, whether it be a photo or a video, and tricks them to browse to the link to find out what it is. Similar tactics have been seen in messages on Facebook and even via email. The message simply states the following.

“hi. this you on here? http://blogger.djh****.com”

The good news is if you do a search on Twitter, you’ll have a hard time finding an example of the original message since there’s an overwhelming number of people tweeting to their friends warning them about this campaign. Slowly but surely, people are learning to be more cautious.

This morning the security researcher behind the Malware Domain List emailed me after reading Mal/Iframe-N: The next big threat? and pointed me at an interesting compromised website he had noticed.

This JavaScript is non-malicious and will neuter Iframes on a page similar to the Defensive Iframing. It appears that a malware writing team is targeting iframes and Zeus (aka ZBot). Is this the same team as those behind Bredo? Or is there a new Web-based grouping?