Fake registry cleaner using same tactics as fake antimalware

I was sent this one a few moments ago, and was expecting it to be a fake AV (ala Total Protection etc), but no, to my surprise, it was infact, for Registry Repair 2008 (a bogus registry cleaner).

The site in question is securonline.net (IP: 72.44.94.153 - ns2.2amnetwork.com, AS32748)



Which then displays:



Following through, we're taken to:

cart.secureorderstore.com/secureorder/securorder.php
IP: 66.98.218.29 (mail3.smscentar.com, AS21844)



However, contrary to the address bar, the site loads the following via iFrame;

usd.swreg.org/cgi-bin/s.cgi?s=43835&p=43835-regrep&v=0&d=0&q=1&c=USD&bb=1



The certificate issued to secureorderstore.com is courtesy of GoDaddy:

Spambot Search Tool: v0.39

I've now released v0.39 of the Spambot Search Tool. Changes in this version include;

* Modified paths for include files, now uses __FILE__ to detect SBST folder (requested)
+ Added additional Sorbs DNSBL
* Period added to end of hostnames for DNSBL checks (requested)
* Minor modification to fSpamlist routine that caused a problem for the BotScout query when no username/e-mail was passed

Download:
http://support.it-mate.co.uk/?mode=Products&act=DL&p=spambotsearchtool

FireEye: Killing the beast...Part 3

In the third part of this series, I'm going to discuss the command and control structure of another famous botnet, Clampi a.k.a ilomo. Clampi is all about data stealing and is famous for its anti-reversing and evasion techniques. The financial damage this information stealer can cause is evident from the fact that it has recently been publicly disclosed of a cyber theft of more than $150,000. Notorious isn't it..?

Like the first two parts where I discussed the command and control structure of the Pushdo and Koobface botnets, I'll start by showing the current geographical distribution of Clampi CnCs, followed by a brief analysis on the chances of shutting down these control servers and hence the complete botnet.

This article is not an in depth analysis of the malware itself but concentrates more on current geo locations of Clampi command and control servers. For detailed in-depth analysis of this malware, one may refer to this.

Let's start with a brief introduction to the Clampi command and control architecture which is not a classical client/server model. As a matter of fact, there are two types of CnC servers involved here.

Read more
http://blog.fireeye.com/research/2009/09/killing-the-beastpart-3.html

References

FireEye: Killing the beast .... Part II
http://blog.fireeye.com/research/2009/06/killing-the-beastpart-ii.html

FireEye: Killing the beast .... Part I
http://blog.fireeye.com/research/2009/06/killing-the-beast.html

RapidSwitch: UK webhosts in champagne throwing cat fight

Need another reason to avoid RapidSwitch? How about their spamming the customers of another hosting company for no other reason than, they could?

Updated Get your popcorn. It's time for the UK webhost cat fight to end all UK webhost cat fights.

Earlier this week, according to the forum dwellers at WebHosting Talk, the UK hosting outfit PoundHost sent a routine marketing email to a group of its customers - and forgot to hide their addresses in the BCC field. At which point, one of outfit's biggest competitors - RapidSwitch - snagged the addresses and sent each exposed PoundHostee a note urging them to jump ship:

Dear Poundhost Customer,

Switch your dedicated hosting to RapidSwitch, and we'll give 6 months hosting free, migration assistance, and a 100% service level agreement. As if this isn't enough, we'll even send you a bottle of champagne* to celebrate! Whether you have one server or a cluster of 100s, you can benefit from moving to RapidSwitch.

And the footnote looks like this:

* Don't worry if champagne's not your thing, we will send you a non-alcoholic hamper instead

Then, just days later, at about 11pm UK time on Thursday evening, RapidSwitch took its Maidenhead data center offline to repair a network failure - and many customers were left without service for the better part of a day. And counting. "We've got ten servers over there," one Reg reader told us very late Friday evening. "All [have] been up and [down] more than a pair of whores knickers [today]."

Read more
http://www.theregister.co.uk/2009/09/25/webhost_catfight/

Fake Youtube Pages And Seekmo

Fake Youtube pages are normally the domain of fake media codecs and other scams. Here, we have two examples (hat-tip to Steven Burn of the hpHosts Blog and the Ur I.T. Mate sites for pointing these out to me) that promise the ability to view naughty movies online - yes, just like the fake media codec sites - but serve up something a little different.

The sites in question are evideofreak.com and videoguidez.com. Visit either, and you'll see something like this:

Fake player ahoy, originally uploaded by Paperghost.

Randomly selected images of people indulging in rudieries appear down the right hand side, and a fake video (complete with star ratings, view counts etc that has clearly been ripped directly from Youtube) sits in the middle, claiming you can see the goodies within if you install "Dream Media Player". Hover over the video, and you'll see the download URL at the bottom of the image which happens to be

preview.licenseacquisition.org/196/1056417821.10121/dmp.exe

Licenseacquisition.org is a domain that's been home to Zango installers for many years (now owned by Pinballcorp.com, who took them over when they went boom not so long ago). Do you think we might see files that have a Zango-ish feel to them once the install is complete?

Read more!
http://blog.spywareguide.com/2009/09/fake-youtube-pages-and-seekmo.html

Full Circle Magazine: Issue 29

29 is the tenth prime number, but you didn’t want to know that. What you do want to know is that issue 29 means that we’re going to hit #30 next month!

This month, you’ll get:

- Command and Conquer
- How-To: Program in Python – Part 3, LAMP Server – Part 2, Virtual Private Networking.
- My Story – One Man’s Journey, and Walk With Ubuntu.
- Review – Kompozer.
- MOTU Interview – Iulian Udrea.
- Top 5 – Physics Games.
- Ubuntu Games, as well as all the usual goodness!

Read more
http://fullcirclemagazine.org/2009/09/25/issue-29-is-here/

Get it while it's hot!
http://fullcirclemagazine.org/issue-29/

Issues 0 - Current
http://fullcirclemagazine.org/downloads/

Forums:
http://ubuntuforums.org/forumdisplay.php?f=270

Wiki:
http://wiki.ubuntu.com/UbuntuMagazine

Spambot Search Tool: New MediaWiki extension

I am happy to announce, thanks to MediaWiki user, Carl Bennett, there is now a mod available for MediaWiki users, wishing to integrate the Spambot Search Tool into their Wiki's;

http://www.mediawiki.org/wiki/Extension:Check_Spambots

Senpai IT Solutions killed malicious servers

I'm happy to report, after identifying yet more malicious activity on Senpai IT Solutions network, and sending another e-mail to them, Senpai IT Solutions have informed me they've now completely disabled the servers for the following;

88.198.81.153 - static.88-198-81-153.clients.your-server.de
88.198.120.177 - static.88-198-120-177.clients.your-server.de
78.46.251.41 - static.41.251.46.78.clients.your-server.de
78.47.114.193 - static.193.114.47.78.clients.your-server.de
78.46.201.89 - static.89.201.46.78.clients.your-server.de

You'll no doubt already be aware that these have a recent history of malicious activity, and I'd like to thank Siarhei at Senpai for taking action and shutting them down.

History:

http://hosts-file.net/?s=78.46.201.89&view=history
http://hosts-file.net/?s=78.46.251.41&view=history
http://hosts-file.net/?s=78.47.114.193&view=history
http://hosts-file.net/?s=88.198.81.153&view=history
http://hosts-file.net/?s=88.198.120.177&view=history

I'll be continuing to monitor their network, and have asked him to shut down another couple of servers involved (78.46.251.43 and 78.47.91.154), so we'll see what else pops up.

/edit 23:12

Little update, I've had a response from Siarhei to inform me .43 has been disabled aswell, and .154 was apparently formatted and sold to someone else two weeks ago (there's been no activity on that IP, within the last two weeks, so obviously the new owner isn't malicious (so far)).

References:

malwaredomainslist.com - The rogues love MDL!
http://hphosts.blogspot.com/2009/07/malwaredomainslistcom-rogues-love-mdl.html

Web Poisoning: Youtube video lead to Rogue Antispyware - Antivirus360
http://malware-web-threats.blogspot.com/2009/03/web-poisoning-youtube-video-lead-to.html

Alliance and Leicester botnet: Here we go again

Looks like the Alliance and Leicester botnet is back yet again.

I've not been able to identify any other domains involved yet (haven't checked PhishTank yet however), but it's guaranteed there either is, or will be, alot more of these.

www.mybank.alliance-leicester.zewcdenixx.com

Latest IP's;

151.65.223.61 - Failed to resolve
173.19.26.252 - 173-19-26-252.client.mchsi.com
202.131.190.199 - 202.131.190.199
204.118.0.2 - Failed to resolve
208.96.88.89 - Failed to resolve
213.94.231.25 - Failed to resolve
60.53.163.145 - Failed to resolve
78.129.34.87 - Failed to resolve
79.138.212.21 - 79.138.212.21.bredband.tre.se
79.78.135.29 - 79-78-135-29.dynamic.dsl.as9105.com
83.172.102.148 - 83-172-64-148.lidnet.net
99.191.125.175 - Failed to resolve
76.69.246.38 - bas3-montreal31-1279653414.dsl.bell.ca
24.56.218.247 - c-24-56-218-247.customer.broadstripe.net
76.26.26.141 - c-76-26-26-141.hsd1.fl.comcast.net
76.28.8.230 - c-76-28-8-230.hsd1.ct.comcast.net
80.217.40.148 - c80-217-40-148.bredband.comhem.se
98.208.170.143 - c-98-208-170-143.hsd1.fl.comcast.net
82.5.94.177 - cpc1-seve5-0-0-cust688.popl.cable.ntl.com
209.51.85.202 - dynamic.apogeenet.net
92.226.74.105 - g226074105.adsl.alicedsl.de
82.254.24.128 - lns-bzn-32-82-254-24-128.adsl.proxad.net
84.224.0.25 - netacc-gpn-4-0-25.pool.pannon.hu
213.211.224.117 - port-ip-213-211-224-117.reverse.mdcc-fun.de
24.199.65.10 - user-0cceg8a.cable.mindspring.com
24.239.153.188 - user-0cev6ds.cable.mindspring.com

E-mail content:

ONLINE BANKING INFORMATION UPGRADE,


Thank you for banking online at Alliance & Leicester. At Alliance & Leicester bank, your security is our primary concern. And in order to guard against the recent spate of fraud and identity theft involving online account holders, we have recently introduced additional security measures and upgraded our software to protect our online account holders.

The security upgrade will be effective immediately and requires our customers to update their access and Sign in Protection activation.

Please Upgrade Your Information <http://www.mybank.alliance-leicester.zewcdenixx.com/index.assp=mybanknlogin_access/index.php>

For your security, you won't be able to gain access to your accounts until you've done this.

Best Regards.
Alliance & Leicester Security Department Team.

Alliance & Leicester is part of the Santander Group, one of the world's largest banking groups. More information on Banco Santander can be found at www.santander.com

References:

Alliance and Leicester botnet
http://hphosts.blogspot.com/2009/09/alert-alliance-and-leicester-botnet.html

Alert: Alliance & Leicester botnet back ....
http://hphosts.blogspot.com/2009/08/alert-alliance-leicester-botnet-back.html

Is your computer part of the Alliance and Leicester phishing botnet?
http://hphosts.blogspot.com/2009/07/is-your-computer-part-of-alliance-and.html

YoHost/Piradius (again): max-apprais.com and top-name.net scam

Seems Piradius never learn.

max-apprais.com and top-name.net appear to be two fake domain appraisal companies being "recommended" to domain owners as part of a long-running scam which we have touched on many times before.

max-apprais.com was created on 12th September to an anonymous registrant, hosted on 202.157.181.9 at Katz Global Singapore. It's a copy of max-appraisal.com which is hosted on 124.217.231.209 at well-known black hat hosts YoHost.org.

http://www.dynamoo.com/blog/2009/09/max-appraiscom-and-top-namenet-scam.html

He mentions the spams originating IP as being 74.55.131.10, which of course, has a PTR pointing to a range on ThePlanet (a.83.374a.static.theplanet.com). Hosts:

intellove.com (now fails to resolve)
allrichestmen.com

allrichestmen.com is a copy of loveandfate.com and loveismy.name, which are at 74.55.131.7 and 74.55.131.8 respectively.

74.55.131.10 is also listed on the following blacklists;

b.barracudacentral.org
dnsbl.sorbs.net
web.dnsbl.sorbs.net
dnsbl-1.uceprotect.net

Ref:
http://robtex.com/ip/74.55.131.10.html

I did a little digging on the CNET, and found quite a few malicious domains, including a few that have been reported to the IWF.

Spambot Search Tool v0.38

I've just released v0.38 of the Spambot Search Tool. This update fixes a minor bug with the StopForumSpam query.

Download:
http://support.it-mate.co.uk/?mode=Products&act=DL&p=spambotsearchtool

I've also got an update for hpHosts scheduled for later today (aka, once I've finished processing the huge list of removals).

Exploits a go-go ....

You may have noticed the major increase in domains added to the hpHosts blacklist, with the EXP classification over the past few days. Sadly, there have been thousands of sites found carrying a variety of malicious codes, from simple iFrames leading to exploits (not surprisingly, almost all have been .ru sites), to actual exploit code itself.

Interestingly, an IP (174.132.146.92 - 5c.92.84ae.static.theplanet.com ) that houses 15 celebrity tour sites (amongst others) has almost all of the tour related sites serving exploits, with the only one not serving them being shakiratourdates.com (is our attacker a Shakira fan?).


Regardless of whether your site has been compromised or not, now would be a good time to get into the habit of changing FTP etc passwords, and making sure any software you're running (e.g. WordPress, phpNuke) is up to date. Backing up your sites files whenever you make a change, and monitoring the site would be a good idea too (you do of course do that already - right?).

EchoMetrix Inc. web-monitoring software gathers data on kids

Parents who install a leading brand of software to monitor their kids' online activities may be unwittingly allowing the company to read their children's chat messages — and sell the marketing data gathered.

Software sold under the Sentry and FamilySafe brands can read private chats conducted through Yahoo, MSN, AOL and other services, and send back data on what kids are saying about such things as movies, music or video games. The information is then offered to businesses seeking ways to tailor their marketing messages to kids.

"This scares me more than anything I have seen using monitoring technology," said Parry Aftab, a child-safety advocate. "You don't put children's personal information at risk."

The company that sells the software insists it is not putting kids' information at risk, since the program does not record children's names or addresses. But the software knows how old they are because parents customize its features to be more or less permissive, depending on age.

Five other makers of parental-control software contacted by The Associated Press, including McAfee Inc. and Symantec Corp., said they do not sell chat data to advertisers.

One competitor, CyberPatrol LLC, said it would never consider such an arrangement. "That's pretty much confidential information," said Barbara Rose, the company's vice president of marketing. "As a parent, I would have a problem with them targeting youngsters."

The software brands in question are developed by EchoMetrix Inc., a company based in Syosset, N.Y.

Read more
http://www.google.com/hostednews/ap/article/ALeqM5i5CjgMEdrwRm3JxeglUykMAHAYmAD9AGNVM00

Special thanks to "Amishrabbit" for the heads up

ClamWin: How to lose more users ....

I really hope they don't go ahead with this. The second they do, I'm ripping ClamWin off of every machine I take care of, and never recommending it again.

If ClamWin will finalized it to include ClamWin Free AntiVirus with Ask Toolbar, it's sad to see another security vendor's software will be added in Products with Ask Toolbar which means we will no longer post updates information about it as our signal of protesting against Security Software bundling their installers with unwanted toolbar and flag as Ad-ware or unwanted by other security vendors and malware scanners. Not to mention that this adds unnecessary component in the system of people who has no idea whether the toolbar is required (Many beginners fall into this and they are the most impacted) and instead of the program to hunt for unwanted stuff, it will add unwanted and unnecessary stuff? Geez. Can't you just use other toolbar that has no "debatable" or "suspect" status?

Read more
http://msmvps.com/blogs/donna/archive/2009/09/17/not-good-clamwin-free-av-released-a-build-with-ask-toolbar.aspx

YoHost.org on the move to Dragonara.net

It looks like black-hat host YoHost.org is on the move to a set of IP addresses owned by "Dragonara Alliance Ltd" (dragonara.net) - a company that claims to be Swiss (and appears to use hosting in Switzerland) but is registered in the British Virgin Islands.

Dragonara claims to be a high-reliability host where clients can weather out DDOS attacks, which is a useful service. However, a lot of the sites it host seem to be quite dubious, and a lot of sites seems to be pushing "replica" (i.e. fake) Swiss watches. The fact that a Swiss company is hosting sites in Switzerland that appear to be selling fake Swiss watches is something that might end up in an interesting conversation with some Swiss lawyers.

The IP address range to look out for is 194.8.74.1 - 194.8.75.255. The sites listed below are for information purposes only, many may well be perfectly legitimate. If you have any observations, then please use the comments.

Read more
http://www.dynamoo.com/blog/2009/09/yohostorg-on-move-to-dragonaranet.html

Dynamic DNS and Botnet of Zombie Web Servers

It’s always interesting to watch how malware attacks evolve over time.

Since this spring, when I started to distinguish it from other attacks, this hidden iframe injection attack has always been among “leaders”.

- They started with gambling-related .cn domains (like cheapslotplay .cn).
- They introduced several new domains names every day so that you couldn’t hardcode them in your scanners. At this point, my records contain several hundred domains used in this attack.
- They also changed campaign names (parameters they specify in iframe URLs) regularly: mozila, banner, cocacola, pepsi, open, reopen, income.
- They used port 8080 (presumably to game dumb traffic filters that only inspect traffic on port 80).
- In the end of July, they started to use 3-letter .ru, .pl, .in and .at domains (e.g. x3y .ru, f7y .at, q5n .in, a3j .pl).
- And, finally, if you follow me on Twitter, you know that this week I started to notice 3rd-level domains registered with free dynamic DNS services.

Here are the details.

As always, it began when I started to notice a new pattern in domains of hidden iframes in Unmask Parasites reports.

Read more
http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-web-servers/

Anthony and SysAdMini have also been posting a slew of these to Malware Domain List;

http://www.malwaredomainlist.com/forums/index.php?topic=3309

Dear Symantec .....

... ever wonder how most people get infected via the interweb? (ignoring of course, P2P and e-mail). Yep - because ActiveX is enabled! This allows them to view pretty flash and Silverlight websites, but alas, it also allows the pretty much automated infection via driveby, PDF and Flash based exploits etc.

So my dear Symantec, what on earth posessed you to develop a website that is 100% Flash dependant? Indeed, I'd like to know why more and more security companies, who claim to want to protect their customers, are requring scripts and ActiveX be enabled to do something as simple as surf most of their websites?.

Incase you're all wondering what on earth I'm going on about, the website in question is everyclickmatters.com, which I found courtesy of honeyblog. Try and view it with ActiveX disabled - go on - I dare you! (I'll save you the trip - you can't).

FileInsight updated

There's a new version of FileInsight available folks;

Today we released the new version 2.1 of McAfee FileInsight. You can download your free copy from the Avert Tools site. FileInsight is a handy integrated tool environment for web site and file analysis. Hex editing, syntax highlighting, and it comes with several built-in decoders, built-in calculator, a disassembler, JavaScript scripting support, a Python-based plugin system and many more.

Let’s go through some stages of an exemplary malware attack to highlight some of its analysis features – but don’t try this stunt at home, unless you know what you’re doing; a safe, isolated lab environment is absolutely mandatory for any such research work.

Read more + Download
http://www.avertlabs.com/research/blog/index.php/2009/09/10/new-version-of-mcafee-fileinsight/

Kudos to SysAdMini for the heads up!

A little thank you to Microsoft

Just noticed the mention of this blog in the August Microsoft Security newsletter, rather nice little surprise for me.

http://www.microsoft.com/uk/security/newsletters/security_newsletter.htm

One or two updates

You may have noticed my mentioning planned maintenance the other day. Sadly I never got round to doing this (didn't have the time or finances to purchase new hardware). I have however, gotten my old Linux machine ready for use an extra server, and plan to move the more resource intensive sites over to it as soon as I get time to do so (the machine is only a 1-1.4Ghz, but has 1GB RAM, which is twice as much as the hpHosts server, and 2-3 times more than the other servers).

I've also gotten a Netgear RangeMax (DG834PN) router to replace the now very old DG834Gv2. I got it all setup and online, and there were no external issues, however, it didn't seem to like letting the machines on the network see each other, so until I get time to find out why (the current router doesn't have that problem, nor did it require any configuration to allow such), it's sitting in it's box waiting for me.

I'd also like to note, I've been completely swamped over the past few weeks, so if you've sent me an e-mail and have not yet received a response, please do let me know (either via the hpHosts forums, or the TeMerc forums, or of course, simply re-send your e-mail).

I've also been monitoring the domains I mentioned with regard to the Alliance & Leicester botnet, and these are still alive. However, I seem to have forgotten to list the IP's they were resolving to when I posted the blog. I ran through them and filtered the duplicates, and out of the > 3000 IP's, there were only 49 unique IP's, these are;

118.100.219.152    -    Resolution failed
124.182.144.193    -    CPE-124-182-144-193.sa.bigpond.net.au
138.210.154.36    -    nv-138-210-154-36.sta.embarqnow.net
142.163.221.137    -    Resolution failed
151.201.22.120    -    static-151-201-22-120.pitbpa.east.verizon.net
158.142.161.198    -    Resolution failed
200.234.35.125    -    125.35.234.200.in-addr.arpa.ig.com.br
202.181.203.146    -    Resolution failed
204.118.0.2    -    Resolution failed
209.51.85.237    -    dynamic.apogeenet.net
213.112.109.84    -    c-546d70d5.01-24-6b73642.cust.bredbandsbolaget.se
213.94.231.25    -    Resolution failed
216.16.111.15    -    host-15.216-16-111.iw.net
216.39.57.104    -    p4p-i.geo.vip.re4.yahoo.com
219.83.125.242    -    Resolution failed
24.124.55.189    -    189.55.124.24.cm.sunflower.com
24.215.207.168    -    user-0cdfjt8.cable.mindspring.com
24.224.157.168    -    blk-224-157-168.eastlink.ca
24.231.42.95    -    Resolution failed
62.219.139.9    -    bzq-219-139-9.static.bezeqint.net
64.150.244.50    -    Resolution failed
65.202.231.12    -    Resolution failed
66.169.13.214    -    66-169-13-214.dhcp.spbg.sc.charter.com
66.214.116.46    -    66-214-116-46.dhcp.hspr.ca.charter.com
66.222.90.70    -    h66-222-90-70.stmyga.dedicated.static.tds.net
66.68.15.17    -    cpe-66-68-15-17.austin.res.rr.com
67.110.218.85    -    67.110.218.85.ptr.us.xo.net
67.176.38.186    -    c-67-176-38-186.hsd1.co.comcast.net
67.77.32.172    -    Resolution failed
69.155.9.91    -    adsl-69-155-9-91.dsl.pnblar.swbell.net
69.88.210.46    -    69-88-210-46.comwavz.com
72.24.91.229    -    72-24-91-229.cpe.cableone.net
74.137.209.179    -    74-137-209-179.dhcp.insightbb.com
74.210.179.153    -    74-210-179-153.hy.cgocable.ca
75.186.111.65    -    cpe-75-186-111-65.indy.res.rr.com
75.198.76.2    -    2.sub-75-198-76.myvzw.com
75.71.206.166    -    c-75-71-206-166.hsd1.co.comcast.net
76.241.94.108    -    adsl-76-241-94-108.dsl.bcvloh.sbcglobal.net
77.126.129.61    -    Resolution failed
79.176.36.115    -    bzq-79-176-36-115.red.bezeqint.net
80.171.84.27    -    d084027.adsl.hansenet.de
80.186.217.55    -    80-186-217-55.elisa-mobile.fi
80.243.242.253    -    242-253.us.ool.fr
81.56.67.245    -    mic92-3-81-56-67-245.fbx.proxad.net
81.57.3.231    -    aut75-1-81-57-3-231.fbx.proxad.net
91.67.60.242    -    91-67-60-242-dynip.superkabel.de
98.193.136.121    -    c-98-193-136-121.hsd1.tn.comcast.net
98.249.93.67    -    c-98-249-93-67.hsd1.tn.comcast.net
99.144.178.98    -    adsl-99-144-178-98.dsl.emhril.sbcglobal.net

I'll post the latest validation results once they're finished.

/edit 03:54

The validation is now finished:

http://hosts-file.net/misc/hpObserver_-_alliance-leicester_botnet_-_090909-0354.html

Network downtime (sorry folks)

Sorry about the downtime around 10-15 mins ago folks. I was switching the servers over to the new 4 port KVM (previously had 2 x 2 port KVM's for them).

I was also informed earlier, that the guy from the electricity came round yesterday and turned the electricity off for approx 10 mins, without giving anyone time to shut down the servers (yep, I'm extremely annoyed at them).

The vURL Online server is still running very slowly (took > 10 mins to boot), so that's next on my list to be replaced/upgraded (looked at new servers but they were extremely expensive (over £2000 for the cheapest one I saw), so am going to buy the parts seperately instead as I can do it alot cheaper that way (can get a new machine put together for around £450-£500)).

Alert: Alliance and Leicester botnet

Oh dear, it started in July, then made a come back the middle of August, and now has returned yet again.

I've checked those that were alive in July, and they're all still dead, so they're not surprisingly, using brand new domains for this one. Quite why the registrars and ICANN et al, are allowing domain names with banking institues in them, astounds me - and obviously, is annoying.

I've only seen one such domain thus far (*.alliance-leicester091.com), but have no doubt there are others out there;

http://hosts-file.net/?s=alliance-leicester091

My friend over at Clean-MX has three dated September 1st and 2nd;

http://support.clean-mx.de/clean-mx/phishing.php?sort=firstseen desc&response=alive&domain=alliance-leicester%

/edit 22:26

Just received another one pointing to a different domain;

www.mybank.alliance-leicester777.com

Anthony added quite a few more to the database too, which makes the current list;

alliance-leicester091.com
alliance-leicester115.com
alliance-leicester117.com
alliance-leicester120.com
alliance-leicester128.com
alliance-leicester136.com
alliance-leicester143.com
alliance-leicester174.com
alliance-leicester185.com
alliance-leicester189.com
alliance-leicester191.com
alliance-leicester210.com
alliance-leicester223.com
alliance-leicester238.com
alliance-leicester240.com
alliance-leicester259.com
alliance-leicester304.com
alliance-leicester308.com
alliance-leicester312.com
alliance-leicester348.com
alliance-leicester353.com
alliance-leicester366.com
alliance-leicester380.com
alliance-leicester395.com
alliance-leicester423.com
alliance-leicester427.com
alliance-leicester446.com
alliance-leicester457.com
alliance-leicester487.com
alliance-leicester492.com
alliance-leicester508.com
alliance-leicester512.com
alliance-leicester519.com
alliance-leicester520.com
alliance-leicester528.com
alliance-leicester536.com
alliance-leicester547.com
alliance-leicester551.com
alliance-leicester579.com
alliance-leicester588.com
alliance-leicester603.com
alliance-leicester615.com
alliance-leicester620.com
alliance-leicester625.com
alliance-leicester628.com
alliance-leicester641.com
alliance-leicester658.com
alliance-leicester718.com
alliance-leicester727.com
alliance-leicester777.com
alliance-leicester808.com
alliance-leicester819.com
alliance-leicester830.com
alliance-leicester850.com
alliance-leicester851.com
alliance-leicester860.com
alliance-leicester872.com
alliance-leicester882.com
alliance-leicester885.com
alliance-leicester886.com
alliance-leicester890.com
alliance-leicester907.com
alliance-leicester917.com
alliance-leicester940.com
alliance-leicester945.com
alliance-leicester963.com
alliance-leicester968.com
alliance-leicester974.com
alliance-leicester975.com
alliance-leicester-co-uk.info
mybank.alliance-leicester091.com
mybank.alliance-leicester777.com
www.alliance-leicester091.com
www.alliance-leicester115.com
www.alliance-leicester117.com
www.alliance-leicester120.com
www.alliance-leicester128.com
www.alliance-leicester136.com
www.alliance-leicester143.com
www.alliance-leicester174.com
www.alliance-leicester185.com
www.alliance-leicester189.com
www.alliance-leicester191.com
www.alliance-leicester210.com
www.alliance-leicester223.com
www.alliance-leicester238.com
www.alliance-leicester240.com
www.alliance-leicester259.com
www.alliance-leicester304.com
www.alliance-leicester308.com
www.alliance-leicester312.com
www.alliance-leicester348.com
www.alliance-leicester353.com
www.alliance-leicester366.com
www.alliance-leicester380.com
www.alliance-leicester395.com
www.alliance-leicester423.com
www.alliance-leicester427.com
www.alliance-leicester446.com
www.alliance-leicester457.com
www.alliance-leicester487.com
www.alliance-leicester492.com
www.alliance-leicester508.com
www.alliance-leicester512.com
www.alliance-leicester519.com
www.alliance-leicester520.com
www.alliance-leicester528.com
www.alliance-leicester536.com
www.alliance-leicester547.com
www.alliance-leicester551.com
www.alliance-leicester579.com
www.alliance-leicester588.com
www.alliance-leicester603.com
www.alliance-leicester615.com
www.alliance-leicester620.com
www.alliance-leicester625.com
www.alliance-leicester628.com
www.alliance-leicester641.com
www.alliance-leicester658.com
www.alliance-leicester718.com
www.alliance-leicester727.com
www.alliance-leicester777.com
www.alliance-leicester808.com
www.alliance-leicester819.com
www.alliance-leicester830.com
www.alliance-leicester850.com
www.alliance-leicester851.com
www.alliance-leicester860.com
www.alliance-leicester872.com
www.alliance-leicester882.com
www.alliance-leicester885.com
www.alliance-leicester886.com
www.alliance-leicester890.com
www.alliance-leicester907.com
www.alliance-leicester917.com
www.alliance-leicester940.com
www.alliance-leicester945.com
www.alliance-leicester963.com
www.alliance-leicester968.com
www.alliance-leicester974.com
www.alliance-leicester975.com
www.alliance-leicester-co-uk.info
www.mybank.alliance-leicester091.com
www.mybank.alliance-leicester777.com

Anthony posted the hpObserver results over at MDL earlier;

http://it-mate.co.uk/temp/hpObserver_-_alliance-leicester_botnet_-_090906-1829.html

I've also ran them through hpObserver again to see if there are any new IP's;

http://it-mate.co.uk/temp/hpObserver_-_alliance-leicester_botnet_-_090906-2314.html

spywaresignatures.com offline

I was alerted by Sparsha earlier this week, that spywaresignatures.com had gotten itself compromised and was spewing exploits. After a little run around with the hosting company, I received a response from them that they would be suspending the VPS associated with it, if no response from the customer was received.

Checking earlier today, showed the original infection had been cleaned up. However, either the site had been re-hacked, or the cleanup simply wasn't done properly, as the site was still spewing malware via an iFrame to;

ohrhrhrhereo.cn/in.cgi?2

IP: 219.152.120.118
IP PTR: 118.120.152.219.broad.cq.cq.dynamic.163data.com.cn
Netname: CHINANET-CQ

There are over 100 other malicious sites in the hpHosts database, that are on this IP/range, a list of which can be found here)

After informing the hosting company of this, they have suspended the VPS and will be updating me once they hear from their customer. As soon as I hear more from them, I'll let you all know.

Until this matter is resolved, spywaresignatures.com will be offline.

References:
http://www.google.com/safebrowsing/diagnostic?site=http://www.spywaresignatures.com/&hl=en

What is Windows Home Server?

Since Windows Home Server is a new addition to The Windows Blog, we thought it would be a good idea to give everyone a refresh on what exactly Windows Home Server is and what it can do for you.

Windows Home Server was designed for households and home-based offices that have more than one personal computer. It was created to help you simplify your digital life, and provide an easy way to access your media and files from any computer, inside or outside your home. The leading benefits of Windows Home Server will help you “Share, Protect, Organize, and Grow” all of your digital content on up to 10 PCs through three basic services. These include automatic PC back-up, restoration ; document and file sharing ; and remote access capabilities. Windows Home Server software will typically be sold with new server hardware from companies like Acer and HP.

Read more
http://windowsteamblog.com/blogs/windowshomeserver/archive/2009/09/01/what-is-windows-home-server.aspx

Planned maintenance: hpHosts/fSpamlist/vURL network

Just a note folks, the following outlines plans for maintenance of the servers within the hpHosts network, and details of the work involved.

When is this work happening?

September 2nd - September 6th

What does it affect?

Access to the following sites may be affected during the transition.

*.mysteryfcm.co.uk
*.hosts-file.net
*.fspamlist.com
helenbenoist.co.uk
bughunter.it-mate.co.uk
pbone.it-mate.co.uk
hollmen.it-mate.co.uk

Certain aspects of the following services/products, could be affected;

sGB - Mail server (i.e. new guestbook notifications, new registrations)
sURL - hpHosts access for querying blacklisted domains
Spambot Search Tool - fSpamlist queries
hpObserver - hpHosts queries

How long will it take?

Currently unknown, though I'm hoping to have the work completed by September 6th (depends on sleep, free time to do it and finances I can spare for it).

What does the work involve?

I am planning on a complete re-build of all of the servers on the network, along with a redesign of the network topology, with additional hardware replacements where required (mainly including additional RAM for the hpHosts server, new hard drives for the *.mysteryfcm.co.uk and hpHosts servers, new gateway server, and a new mail server (thanks to Alt-N Technologies))

Is it likely to cause problems?

I will be rebuilding the servers one at a time, using a temporary server to house the sites on the server being replaced, whilst the rebuild is being performed, so I do not expect there to be much downtime. A little interruption may be required whilst service is transferred to the new server.

Why is this being done?

The servers have served me fantastically for years, with very little problems. However, recently there has been a major spike in the resources and bandwidth required for each server, and some of them simply cannot cope. As such, upgrades, replacements and in one or two cases, reconfigurations to allow for higher traffic levels, is required.

Is there anything else I need to know?

Given this is to be done during my free time, the times/dates referenced should be taken as approximations only. I'll keep the downtime to an absolute minimum.

Windows Server: New PHP cache extension and a new home

Microsoft today, announced a new home for Windows Home Server. You can read all about it at;

http://windowsteamblog.com/blogs/windowshomeserver/archive/2009/09/01/introducing-a-new-home-for-the-windows-home-server-blog.aspx

The folks from the Windows Server division, also announced a new PHP caching extension that those of you running PHP on Windows Server will absolutely love, as it speeds up PHP performance (will be checking it out myself when I rebuild the servers this week).

Read all about it at;

http://blogs.technet.com/windowsserver/archive/2009/09/01/download-the-new-windows-cache-extension-for-php-beta.aspx

Koobface World Tour

Koobface wrecks Search results

One question that people often ask when we describe how millions of computers are infected with malware is "Why would anyone do that?" The answer of course is: MONEY.

Some of these money making schemes are so convolluted that it seems unlikely that anyone could make any money at them, but even if they only make a couple pennies per day on each machine, when you have millions of compromised machines, that adds up over time.

Ellen Mesmer of Network World documented America's Ten Most Wanted Botnets last month, and placed Zeus at #1, followed by Koobface at #2. That's a pretty good prioritization system, and one we are following at UAB in our Malware Analysis lab. Zeus is straight-forward. It steals money by compromising their banking credentials, and stealing the money out of their bank accounts. Koobface is far more subtle. With more than 2.9 million compromised American computers, its well worth looking at closer.

UAB Computer Forensics now has three Malware Analysts looking at malware. Brian Tanner, the most senior of the crew, has been looking at Koobface on a regular basis since January, and has a good understanding of how it works. He walked me through the paces yesterday, explaining the most recent version, starting by clicking on a link posted by a "friend" we maintain on Facebook because we can always count on him to provide a link to the current malware.

Read more
http://garwarner.blogspot.com/2009/09/koobface-wrecks-search-results.html