HP ProCurve Switch comes with FREE malware

HP had announced in their Security bulletin yesterday (10 Apr) that they have shipped malware-infected compact flash card with their HP ProCurve switches.

In their official bulletin, "A potential security vulnerability has been identified with certain HP ProCurve 5400 zl switches containing compact flash cards which may be infected with a virus. Reuse of an infected compact flash card in a personal computer could result in a compromise of that system's integrity."

They have not disclosed how those malware managed to infected the Flash cards but it is likely that it had infected the systems of the third-party manufacturer that supply those flash cards.

It is not the first time that renown companies are shipping malware in their products. Seagate and Apple also have reported cases. (See my previous blog "Battery not included ... but Malware is...)

Related Reports:
- HP SUPPORT COMMUNICATION - SECURITY BULLETIN

10 Steps: Removing Spyware/Malware/Adware from a PC

To completely remove spyware from a PC can be very difficult. Most spyware like malware propagates in many different locations i.e. registry, files, system and folders and removing all the erroneous files can be a challenge.
In some instances spyware software will disable antivirus, firewall and other well known
security software as well as create fake BSODs. Some may even remove the Microsoft Windows Security Center and replace it with a fake one as well as hijack the browser and stop users from clicking on links to security websites. Worse still a PC may stop loading Windows altogether.
So you can see the difficulty in attempting to clean a PC. There are some simple steps to removing most spyware and adware – these are generic and provide useful guidance when identifying and cleaning spyware and self-replicating malware from a PC.

STEP 1:

Reboot PC in Safe Mode with Networking – always log as the same user that was previously logged in
with, in normal Windows mode*.

An analysis of the spyware threat and how to protect a PC

STEP 2:

Launch IE and from Tools>Internet Options>Connections tab click LAN SETTINGS and uncheck the
checkbox labelled Use a proxy server for your LAN.

STEP 3:

Download Process Explorer – iexplore.exe (or explorer.scr) – use this program to look for processes
linked to the rogue program you have installed. Rename the iexplore.exe or winlogon.exe installers.
Alternatively download and use AutoRuns from SysInternals (you can also run this from removable
media).

STEP 4:

Check the hosts file and if it has any entries other than 127.0.0.1, comment them out –notepad
c:\windows\system32\drivers\etc\hosts**.

STEP 5:

Download Malwarebytes Anti-malware – if this doesn’t happen then download both the program and signature update database from another PC and install on the infected PC using removable media.

STEP 6:

Then download Spybot S&D and Spyware Doctor.

STEP 7:

Reboot the PC in Safe Mode again and in most situations the malicious files have been removed. Download/update the antivirus and firewall and any other security products on the PC.

STEP 8:

Run a full scan not a fingerprint scan and then reboot the PC.

STEP 9:

Download and install CCleaner and click the Registry tab to run a registry clean – don’t forget to make a
backup of the registry.

STEP 10:

Download and install NovaShield Anti-malware software – this program uses the OS Kernel to monitor any file; registry; process and network changes. This program will work alongside your existing antivirus and firewall software.

* Sometimes the Safe Mode is disabled by the spyware/malware – this happens because the malicious file has deleted the Safeboot registry keys. It is possible to merge a reg file with the missing Safeboot entries to re-enable Safe Mode.

** Spybot S&D inserts entries into the host file – as long as the host file IP address is 127.0.0.1 then all should be ok. According to Spybot S&D these entries (which can be in their thousands and is known to affect browser performance) are inserted as part of the immunization process.


Did you know?
Antivirus software actually makes silent calls to servers to check application status/virus definition updates and some collect operating system data. The malicious spyware will continue to be a threat. Expect spyware authors to develop more cunning ways to deliver spyware as part of a malicious payload. The attack vectors will include looking for vulnerabilities in Java, Microsoft Windows, website browsers, Active X, and sending users to IFrame websites (can be done from links in search engines) just to name a few.

By the way
You can make some extra $$$ with this guide

Eleonore exploit pack

Exploit packs have been selling in the underground for hundreds of dollars in recent years. These pre-packaged kits are designed to probe the visitor’s browser for known security vulnerabilities, and then use the first one found as a vehicle to quietly install malicious software. They normally comes with a Web administration page, which gives the attacker real-time statistics about victims, such as which browser exploits are working best, and which browsers and browser versions are most successfully attacked. Those commonly found in the market were iPack, Crimepack and Eleonore.

The latter, Eleonore, is the most popular kit and have been making the headlines recently. It is claim to cost between USD$500 - USD$1000 (based on the version). The package was updated approximately every month with the latest browser, PDF and Java vulnerabilities. These kit providers provide "secured" support, updates and even cleanup of the package service if necessary.


Eleonore Web administration page


Crimepack Web administration page

w01f advise: Always patch up your system, especially Internet browser, Java, Flash and PDF applications.

Windows Lnk Exploit Protection Tool

The Recent Microsoft vulnerability in Windows Shell could allow Remote Code Execution such as using shortcut. Many malwares were found exploiting this vulnerability. Sophos had recently released a free protection tool that claims to be able to detect and block this Windows shortcut exploit from running. It will also work with your existing Anti Virus.

The tools can be downloaded from this official website.

Below is the demo video of the tools


Related Report:
- TechNet: Microsoft Security Advisory (2286198)

Disclamer: I do not in any way endorsed this tool nor responsible for any problem or issue cause by it.

Singapore Boleh... Trojan connect to SG IP

Recently, there are several newly detected malicious PDF files that exploited Adobe Reader and execute backdoor trojan on victim's system. These trojans allow remote access from cecon.flower-show.org and posere.flower-show.org. Many will think that those hosts were likely to be from China or Russia, the usual suspect.

But both hostname are resolved to 202.150.213.12, which is in Singapore. The IP belongs to "NewMedia Express Pte Ltd, Singapore Web Hosting".



Likely that NewMedia server was compromised to host and re-direct the traffic to the real hacker's address.

More details from F-Secure blog

Web Security Rating

"Web Security Rating" is a website or tools that are hosted by security vendors or team that rate each web domain whether they are safe to access.

Was trying out some of this website and tools to recommend to my colleagues and friends. Notice that even big vendor can give an incorrect rating for publicly known malicious sites.

Did a few tests and decided to show the result of "aboutadding.com". On the Malwareurl website, it shows a list of malwares detected from that domain.

McAfee SiteAdvisor detected "potential security risks ... Use with extreme caution".

While Norton Safe Web given a "SAFE" rating for this site (even though a user feedback that the domain is harmful).

Besides McAfee SiteAdvisor and Norton Safe Web, there are also other common tools such as TrendMicro's TrendProtect and Finjan SecureBrowsing.

Even Google provide warning for potential harmful sites.

This blog is not to comment on which vendor is better. Just want to share some of the available tools on secure web surfing and to advise users not to trust on one result.

Malware @ work 2

Since last year, i have been doing "research" on malware (during leisure) and sharing some research finding in w01f Labs. Many friends (including myself initially) thought that malware analysis is just about infecting the virtual system and see how the it works. They are partially correct but malware analysis is more than that.

Malware analysis basically consist of 2 main stages:

• Behaviour analysis


• Code/Static analysis (reverse engineering)

Behaviour analysis, one will infect a isolated system or virtual machine. Running analysis and monitoring tools to track the registry, system and network changes:
- Registry such as changes to registry entry "..\Windows\CurrentVersion\run".
- System such as changes to file "..\drivers\etc\hosts".
- Network such as system connecting to port 6667.

After identifying those changes, setup an isolated environment to interact with the malware. Configure a DNS to resolve and route any domain that the malware is trying to connect. Setup services such as IRC or Web service if the malware is trying to connect to those services.

You may need to modify the environment and re-infect the system several times as you find out more about the malware.

Code Analysis. There will be activities or behaviours that you may not have triggered or identified during the behaviour analysis. You will need to carry out some code analysis to confirm on those behaviour descovered and discover further.

Debugger and disassembler are commonly used for code analysis. Breakpoints are set on debugger to examine and identify the flow of the program. Patching maybe required to bypass or control certain function of the malware.

Advanced code analysis techniques will be needed to analysis malware that uses anti analysis techniques. Refer to "Counter malware analysis" for more details on these techniques.

To fully understand a malware is very time consuming. Recently a researcher from McAfee told me that the degree of analysis is normally based on the deadline given and the type of request from the customer. Normally, they are given less than a week to analyse a malware. If the request from customer was just to provide detection signature, in depth analysis will not be done.

Emerging Internet Security Threats: Spring 2009

Saw this video by Lenny Zeltser, the instructor for my GIAC Reverse-Engineering Malware(GREM) certification. Most of the stuffs presented may not be new to you, but it provide as a reminder with real life examples on some of the "attacks".

This video explores today's emerging Internet security threats to help organizations fine-tune their defenses. He examines attack patterns that have included the use of email as a gateway for fraud, the mighty power of network bots, the fertile ecosystem for web-based attacks, and the increased precision of modern attacks. The presentation presents lots of real-world examples of cyber attacks, and discusses the financial incentives behind the malicious activities that occur on the Internet.

He also covers:

• What is driving modern-day attackers to large-scale and targeted attacks
• Which recent breaches exemplify threat categories organizations need to track
• The approaches Internet criminals employ to trick victims and bypass defenses
• Whether you should adjust security architecture to match today's threat landscape

Part 1


Part 2


Part 3


About the speaker: Lenny Zeltser leads a security consulting team at Savvis. He is also a board of directors member at SANS Technology Institute, a SANS faculty member, and an incident handler at the SANS Internet Storm Center. Lenny frequently speaks on information security and related business topics at conferences and private events, writes articles, and has co-authored several books. Lenny is one of the few individuals in the world who has earned the highly regarded GIAC Security Expert (GSE) designation. He also holds the CISSP certification. Lenny has an MBA degree from MIT Sloan and a computer science degree from the University of Pennsylvania. For more information about his projects, see www.zeltser.com.

Fake Antivirus... Beware!

Receive a suspicious file last week and did a simple behaviour analysis. It is a fake antivirus program that will claim to "scan" and "detect" several virus in your system. It will trick the user to purchase the full license by having various spyware and virus pop ups.

Major AV vendor such as McAfee, Symantec, TrendMicro were not able to detect it.

For more details on my findings, visit W01f Labs - Malware Analysis: Antivirus System PRO

New malware detected!

Receive a virus on Tuesday and did a simple behaviour analysis. It seems to be a relatively new virus as major AV tools (such as McAfee, TrendMicro, Kaspersky, F-secure..) were not able to detect it.

File: 1.exe
Size: 1033728
MD5: 19AB525B9AF6CBB40F428115E8148522
Virus Found: Trojan.Dropper (Symantec), Win32/Heur (AVG), TR/Crypt.FKM.Gen (AntiVir), Mal/EncPk-EE (Sophos)

On the VirusTotal website, only 20 out of 40 AV detected it (details).

The Trojan will modify the PCIDump service, add several .sys files such as acpiec.sys into your C:\Windows\system32 folder. It will also copy itself and add a autorun.inf to C:\. Phpi.dll will be added into C:\Windows folder.

It changes the Hosts file and try to connect to www.cvbasefwdase.cn via HTTP to download other files. Likely to be trying to download more malicious payload.

For more details on my finding, visit W01f Labs - Malware Analysis: Trojan.Dropper

Malicious links or pop-up

Someone submitted this malicious link "http://jjxp22.cn/a/iqq.html" to me . It seems to be a pop-up or hidden link from some compromised sites.

It contains obfuscated Javascript that embed malicious Shockwave Flash, which compromise the Integer overflow vulnerbility in Adobe Flash Player 9.0.115.0 and earlier (CVE-2007-0071), which allows remote attackers to execute arbitrary code.

One of the Sample Flash file info
#######################

Filename: i16.swf
Size: 17897
MD5: 426969FD0D7324EE170D6F46BDB203B6
Virus Found: Bloodhound.Exploit.193 (Symantec)

On the VirusTotal website, 13 out of 39 AV detected it - Link.

For more details of my finding, visit W01f Labs

w01f advise: Patch up your Shockwave Flash Player and be careful on suspicious and hidden links.

You can check your Flash Player version by going to this website or to the link below -
http://www.adobe.com/software/flash/about/

MSN spam or malicious link??

I recently receive a Spam MSN message. Besides the standard URL links, they include some messages to "trick" the victim to believe that it is from your friend and click the link.

The messages i got were as follows:

- "damn, saw naked pics of yours or maybe the one in pic is similar to you :) .... crazy lol"

- "omg omg i cant belive you could be so cheap +0( lol ..."

I have try to do a quick check on the suspicious link. It will load a Flash (yet to do an analysis on it) and provide a MSN login.

Besides that, no malicious script was found on the website. I guess it is likely to be using the MSN login to harvest victim's username and password.



New updates! - 02 June 2009

I receive new spam MSN message. The message as follows:

- "WTF NO WAY did u upload these of yourself?? :s"

The link seems to be similar to the previous website, which uses the MSN login to harvest victim's username and password.





w01f advise: Make sure you check with your friend on the link before clicking it. They may contains malicious script like those that i have analysed in W01f Labs previously

W01f Labs @ work

I have just finish the behaviour analysis of a malware (collected). Below are the summary of my findings -

Filename: ~.exe
MD5: 3A03A20BFEFE3FDD01659D47D2ED76C8
Virus Found: W32/Sality (McAfee)

On the VirusTotal website, 36 out of 40 AV detected it - Link

The registry key -
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Documents and Settings\Owner\Desktop\~.exe: "C:\Documents and Settings\Owner\Desktop\~.exe:*:Enabled:ipsec" was add, which add the malware path in to the Windows firewall rules and name it as "ipsec".

The malware is also trying to connect and download more malicious payload from "peskostruikaz.com" and "shopatforgetmenot.com".

For more details of my finding, visit W01f Labs

Do feel free to submit any malware or suspicious file to me. I will share the findings in my blog.

To submit malware sample,
1> Please password protect zip the file with the password "werew01f"
2> Email me at "hack.werew01f[at]gmail[dot]com" with the subject "Malware Sample"

Remote method to test for Conficker Infection

Researchers have found a way to detect remotely whether a system is infected with the Conficker worm. The new technique involves remotely calling theNetpwPathCanonicalize() function. This was discovered by two German researchers Felix Leder and Tillmann Werner from the University of Bonn.

Nmap and Nessus have also "updated" with this technique to detect infected systems.

The above method is good if you need to test a large number of systems remotely. For a quick and easy way, you can just try to access sites like symantec.com or sans.org on the infected systems. Conficker will block access to these sites (and a list of other sites).

The research details can be found from the this Link - http://iv.cs.uni-bonn.de/wg/cs/applications/containing-conficker/

Updated on 07 April 09
The Conficker Working Group had setup a "Conficker Eye Chart" website to show people what their browser will look like if they have been infected. You can visit this website to check if your system is infected.



For more info on Conficker virus, visit W01f's Labs

Codec for MP3?? or just a malware..

Last week, someone emailed me a suspicious MP3 file for research. So i decided to test the file on my "research environment".

When i try to play the MP3 file with the default media player(Windows Media Player 9), it prompted that "the file extension does not match the file format" and ask "if i want to try playing it anyway". This prompt makes the file really suspicious. This will normally happen if the MP3 file is corrupted or it was not a media file at all.


I click on "Yes", which is "to try playing it anyway" to see whether it is really a MP3 file. Instead of playing, it opens up the Internet browser and direct me to "www.mp3codec.com".






In this website, it claims that a special codec is required to play the audio file and automatically prompt you to download the "Codec_setup.exe".






With the "Codec_setup.exe" file downloaded, i decided to test it with VirusTotal website. To my surprise, only 13 out of 37 anti virus detected the file as malware. Famous anti virus such as Sophos and Mcafee were not able to detect it.


Thinking that the malicious website or malware file might be removed after a week, i decided to visited the "mp3codec.com" website and even downloaded the file again.
The downloaded file might be different from the one previously downloaded, so i compare both files and found that their hash values is different. I also run the new file with VirusTotal. This time, only 5 anti virus detected it.

Downloaded from the website:
Codec_setup.exe - 55KB
MD5: 278F6EF79C58A3F5B2AD0CC83CCA79BD

Downloaded few days later:
Codec_setup.exe - 55KB
MD5: CBAC09DCB8B8323BA3E457BE0E11B092

With these finding, i hope that people can be more careful when receiving media files such as MP3 or AVI. It is not new for malicious media file to trick users to download fake codec, which is actually a malware. This finding also shows how efficient hacker these days. They will constantly update their malware to avoid detection from the anti virus.

I will being running the downloaded malware on my "research enviroment" this few days. Watch out for my finding in my future post.

W01f Quiz

Finally my first Trojan horse was born. I always wanted to write a simple Trojan to demostrate how vulnerable our PC can be. Nowadays, malware can easily compromise your system via Podslurping, Games/MP3 downloaded from Internet or a simple game (like this Torjan that i have written). Many people have the misconception that by having an updated Anti-Virus, it will protect them from all the malware.

This Trojan, W01f Quiz, is written in VBscript. I made used of some basic method from malware in this program such as
- Change of Registry
- Adding of "malicious" file in to system folder
- Set hidden file
- Trick victim with a game

It is basically written for educational purpose. To educate users to beware of programs (such as games, MP3) that were downloaded or passes around by friends. This Trojan is not malicious and will not cause any hurt to your system. You should try it and also pass around to your friends and colleagues. It consist of an interesting quiz game. You can help to educate your friends after they start to see the pop up. There is also a removal tool available for you to cleanly remove it.

Click at the file - W01fQuiz-0.1.zip to download the Trojan (MD5:047CE91054176C361A049E8495A63E96)

Trojan Removal and Protection
For those have been "infected" by my Trojan, you will see a "Trojan Alert" pop-up shown below.

If you see the above pop up, it means that your system is not properly secure. To protect your system against simple malware (like this one), do the following:
- Restrict Registry access
- Proper user access control (especially on the System folder)
- Properly harden your Windows (based on the common best practise such as Centre of Internet Security's Standards)

To properly remove this Trojan from your system, simply download the removal tool below. Please run this tool before you harden your system.

Click at the file - W01fQuiz_removal-0.1.zip to download the removal tool (MD5:5C18581BE8BE6ED79F696DDE9DF0B50E)

Malware at work !!

I have always interested in knowing how different malware (virus / trojan) infected the system. So i decided to setup a simple "research environment" to test on various malware collected.

The "research environment" consists of several versions of Windows on VM (virtual) image with some monitoring tools installed. This will be a simple setup to study and understand the behaviour and symptom of various type of malware. Don't expect to see any Reverse Engineering of the malware's code as i know nuts about reverse engineering (but i don't mind picking up if i have the "opportunity"). Just a novice trying to learn about malware.

-Updated on 20 Feb 09
I am currently picking up reverse engineering skills (with tools like IDA pro).

-Updated on 22 Mar 09
W01f Labs is officially open to share my malware analysis finding and other useful information with the community.

I like to thanks my friends for contributing sample malware for me to start with. Do feel free to submit any malware or suspected malware to me. I will share the findings if i manage to find anything interesting.

To submit malware sample,
1> Please password protect zip the file with the password "werew01f"
2> Email me at "hack.werew01f[at]gmail[dot]com" with the subject "Malware Sample"

Malware do not need admin rights??

Many Security forums, advisories and even security products claim that by restricting privilege access rights, it will stop all malware from infecting the systems.

But nowadays, it is found that many malware can still create problems without ever the need to have admin or root access. These malware doesn't need to modify your system files to your system messed up.

Normally malware are designed (like any other applications) to expect the user to be running with privileged access. For windows malware, they like to modify the OS or write itself into System32 folder. Commonly, they will also try to modify the registry such as Run or RunOnce in "Hkey_Local_Machine\software\Microsoft\Windows\CurrentVersion". As for Unix-based malware, they will be modifying or creating files in default system path such as /etc/bin or startup scripts in rc folder.

But malware these days don't really need to locate System32 folder or path that require root access. Tested on several malwares that runs on Windows or Linux, it was found that many of the files created and modifed does not require admin or root access. Some Windows malware just modify the user's own registry profile key to launch during startup as users always have Full Control to their own profile's auto-run registry keys. There are also malware that do not require to even modify a single file, it just runs on the memory and able to steal sensitive infomation or intercept your identify.

Even though having less privilege cannot stop malware from "infecting" your system, but it definately limits the possibilities for new malware creation. In Windows Vista, Microsoft introduce UAC (User Account Control) to encourage users to adopt the least privilege concept. Unix-based systems, adopt the concept long ago using SU (Switch User) function. It is still a security best practise and recommendation of adopting the least privilege concept.

Related Links:
- User Account Control Overview (Microsoft Technet)

- Linux Wiki > SU (LinuxQuestions.org)

Edison Chan Sex Scandal. Lesson to be learned!

Last week, the hottest news was seems to be Edison Chan Sex Scandal. TV news, newspapers and various magazines were reporting on it. Colleagues in the office and people in the coffee shop were also talking about it.

For the benefit of those who do not know about this news, photographs of Edison Chan(famous Hong Kong actor) in bed with several top female actresses and singers were circulated in the Internet. According to reports, those photographs were illegally copied from Edison's laptop while it was being serviced. Rumours that the culprit had attempt to blackmail Edison's management company but failed.

I decided to highlight this scandal because i think that there are afew lessons that people can learned from it. As mention previously in my blog ("Mobile Warrior - Part 1, Disk Encryption" by AhTan), everyone should encrypt their important data in their computers. Beside sexy pictures, sensitive documents (such as company proposal, financial data) and personal information (such as Bank accounts number) should be properly encrypted.

Beside properly encrypting your important data, those data should also be properly backup (previous acticle "Mobile Warrior- Part 2: Backup, Backup"). With important data properly encrypted and backup, you will not have much worries that your data be stolen or lost when sending your laptop for servicing.

There were also reports that several spoofed and virus emails, claiming to contain Edison's sex photo, were found "tricking" curious users to download malware. Those emails contains links to "Edison's Sex pictures", which actually lead to websites containing malwares. Those "malicious" links were also found in online forums discussing on Edison's scandal.

Curiosity killed the cat, this is not the first time "hackers" are using "famous" topics (e.g Paris Hilton Sex video, Asian Tsunami video) to trick users to download malware. So be careful when trying to download files from untrusted source.

Related Reports:
- Sex scandal rocks Hong Kong
- AusCERT National Alerts - Tsunami Warning Fraudulent E-mails and Malicious Web Sites

Battery not included ... but Malware is...

For past months, there are several reports of digital device containing malware. Those digital devices affected were digital photo frame, portable music player and portable storage.

According to Internet Storm Center, a network-threat monitoring group, some end-users reported that their digital photo frames contains malware that attempted to install malicious code into their systems

In October last year, password stealing malware was discovered in Seagate's hard disk. Those affected disk drives were infected and shipped from the china factory.

Reported last year, some Apple's Ipod were shipped with virus and several music title CD from Sony BMG comes with a draconian copy-protection system that qualified as malicious software.

So the next time you buy a digital device or even a present from Santa, remember to scan the device thoroughly with a renown and updated Anti-Virus. You never know what free "gift" it will comes with.

Related Reports:
-Malware hitches a ride on digital devices (Security Focus)
-Seagate Support Announcement - Maxtor Basics Personal Storage 3200
-Apple ships virus on some video iPods (Security Focus)