Fake "Correspondence manager" job

Money mule scams are now very common - basically some poor fool ends up laundering money or reshipping goods following the instructions of someone they have never met and is likely to be untraceable.

This particular job offer seems to go a step further. This "correspondence manager" could well be another layer in the scammer's obfuscation. Perhaps the correspondence manager handles communications with the money mules?

One danger here is that this particular role is more credible that the "money for nothing" jobs that scammers usually offer. On the face of it, it doesn't involve handling money, but it does seem to be very easy and the salary looks attractive.

There's an interesting bit of social engineering where the email says "THE SELECTED CANDIDATE MUST PASS A CRIMINAL BACKGROUND CHECK". Of course, it is the employer who needs to pass a background check too. Always verify that your job offers are from a genuine, verifiable business.

---

Subject: Re: WELL - PAID JOB!
From: ls51@salud.gov.pr
Date: Fri, August 1, 2008 11:52 am

Dear, Job Seeker!

Our firm has an opening vacancy: Correspondence manager.

Please attach your resume in DOC or reach text format and apply right now. This
position is limited.



Company Name
Global Logistic


Job Category
Correspondence


Location
United States


Position Type
Part-Time/Home Based


Salary
$ 35,000 - $ 50,000


Experience
1+


Desired Education Level
High School or Equivalent


Date Posted
March 17, 2008



Job Summary:
You will make some basic tasks from your manager daily; manage personal assets;
making simple correspondence operations. You don't need to have any kind of
education or experience. We will make online training for position offered. You
will have more information in job description document. Apply now.
Requirements: US citizenship or US permanent residency

High school or College in relevant field or 1+ years experience in management;
basic computer, good verbal and grammar skills; must have a cellular phone for
urgent tasks; must be able to work part-time; must provide resume for
qualification process.

ALL RESUMES WILL BE CONFIRMED AND VERIFIED. THE SELECTED CANDIDATE MUST PASS A
CRIMINAL BACKGROUND CHECK
If you're interested send your full name, phone number, age and RESUME
mailto:NannieHolderCE@gmail.com and I'll redirect it to our HR department.

---

Beware of unsolicited loan offers

Loan scams are a another variant of the advanced fee fraud scam (e.g. fake lotteries, dead dictator's fortunes etc). These seem to be more popular recently due to the "credit crunch". Fundamentally the approach is the same as any other advanced fee fraud: you apply for the loan only to discover that there is a fee payable up front. Of course, no legitimate lender would ask for an up front fee for a loan.

Although the wording for this particular example sounds like it is from Nigeria, the IP address is from the Hathway network in Bangalore. Oddly from "from" address is Hathway too.

Subject: LOAN OFFER
From: ramanks@hathway.com
Date: Thu, July 31, 2008 8:14 pm
Priority: Normal


Dear Customer
We are corporate lenders. we give out loans to
A very honest and reliable personalities. we give
out our loans at low interest rate and moderate
values as cheap as 3% rate. Because of scam
we tender our qualifications if it satisfies, you
can continue with the transaction, but if you are
not satisfied you can go to another lender.
Channel your response to this email.
thomassteve2@gmail.com
Greatest Regards
Marketing Manager
Mr Thomas Steve.

Although this particular one is pretty laughable, it is likely that the scammers will get better at it. Beware of unsolicited loan offers and remember that all fees and interest will come out of your repayments, not from an up front fee.

PestPatrol: Zuten detected in c:\windows\minidump

This one looks like a false positive.. CA PestPatrol with signature version 2008.7.29.15 seems to be detecting Zuten in the c:\windows\minidump folder.

A close examination of the description indicates that the following files may be being misdetected:

%windows%\minidump\mini072908-01.dmp
%windows%\minidump\mini072908-02.dmp

As you can see, yesterday's date in encoded into the .dmp files. If your computer system has generated a .dmp file in the past day, then PestPatrol may well be mis-detecting it.

The SQL Injection war

Dancho Danchev had has some very good writeups on the current round of SQL injection attacks. This post on copycat attacks caught my eye, because it shows that there's more than one crew at work here.

If anything, this situation is likely to get worse. The tools needed to carry out a SQL injection attack are now almost available off-the-shelf, the attacks are obviously financially successful because they have been ongoing now for some months, and enumeration of vulnerable servers can be done through Google or Yahoo if you don't want to bother crawling the web.

Identifying and blocking domains helps, but it isn't a real solution. Most of these attacks are thwarted by a fully patch client (and I do mean all the software on the client, the Secunia Software Inspector can help here or some other decent audit tool). Using Firefox + NoScript is a good idea for the technically savvy. But ultimately, the best way of fighting this is to secure or shut down infected SQL servers. Don't be afraid to use the abuse@ email address where a web site is posing a continuing threat.

Asprox domains: 29/7/08

These are this morning's active Asprox domains. New ones are in bold.

• b4so.ru
• bce8.ru
• bjxt.ru
• bnsr.ru
• bosf.ru
• bsko.ru
• ch35.ru
• gty5.ru
• iroe.ru
• jve4.ru
• kj5s.ru
• kjwd.ru
• kpo3.ru
• kr92.ru
• ncb2.ru
• ncwc.ru
• nemr.ru
• njep.ru
• nmr43.ru
• oics.ru
• pfd2.ru
• po4c.ru

Asprox domains: 28/7/08

These seem to be the current Asprox domains to block or check for. New ones are in bold.

• bs04.ru
• bce8.ru
• bjxt.ru
• bnsr.ru
• bosf.ru
• bsko.ru
• ch35.ru
• iroe.ru
• jve4.ru
• kjwd.ru
• kodj.ru
• kpo3.ru
• kr92.ru
• ncb2.ru
• ncwc.ru
• nemr.ru
• nmr43.ru
• oics.ru
• pfd2.ru
• po4c.ru

ngg.js still seems to be the name of the javascript file injected into compromised hosts.

Asprox domains: 25/7/08

These domains seem to be active today, new ones in bold.

• bce8.ru
• ch35.ru
• iroe.ru
• jve4.ru
• kjwd.ru
• kodj.ru
• kpo3.ru
• kr92.ru
• ncwc.ru
• nemr.ru
• nmr43.ru
• pfd2.ru
• po4c.ru

One oddity - the URL zvz.cc/forums/8L0/join.upq has been spotted as a redirector for these Javascript exploits. Google list zvz.cc that as a malware infected site, it is hard to tell though if this is just another victim or part of the C&C for the botnet. For the record, these are the WHOIS details.. but they might not mean very much.

Registration Service Provided By: ESTDOMAINS INC
Contact: +1.3027224217
Website: http://www.estdomains.com

Domain Name: ZVZ.CC

Registrant:
Himpet .Inc
Evgenij Novoberkov (zvz@tut.by)
Stahanov.St 120
Minsk
Missouri,222120
US
Tel. +022.2720771

Creation Date: 09-Apr-2008
Expiration Date: 09-Apr-2009

Domain servers in listed order:
ns2.zvz.cc
ns1.zvz.cc

Administrative Contact:
Himpet .Inc
Evgenij Novoberkov (zvz@tut.by)
Stahanov.St 120
Minsk
Missouri,222120
US
Tel. +022.2720771

Technical Contact:
Himpet .Inc
Evgenij Novoberkov (zvz@tut.by)
Stahanov.St 120
Minsk
Missouri,222120
US
Tel. +022.2720771

Billing Contact:
Himpet .Inc
Evgenij Novoberkov (zvz@tut.by)
Stahanov.St 120
Minsk
Missouri,222120
US
Tel. +022.2720771

Status:ACTIVE

Asprox: jve4.ru, nmr43.ru and po4c.ru

Three new Asprox domains that have gone live in the past few hours, probably some more on the way. Either block these or check your logs if you are a network admin.

• jve4.ru
• nmr43.ru
• po4c.ru

"ABT Solutions" scam email

Following on from the recent "Infopulse" scam, another Ukranian firm has been targeted by the money mule operators. ABT Solutions appears to be a legitimate and quite innocent company that has been around for a few years, but this email does not come from ABT Solutions. The [fake] name used in the email is very similar to the name used in the abtsolutions.net WHOIS data, it is likely that it has been lifted from there.

Two telltale signs - one is the use of a Google Mail address where you would expect it to come from abtsolutions.net, the other one is that the job offer appears to be too good to be true. The company name is also spelled incorrectly.

---

Subject: A proposal for collaboration. Additional revenue.
From: job.abtsolutions@gmail.com
Date: Wed, July 23, 2008 11:07 pm

Hello Sir/Madam,

I am Chebotar' Aurelian, Director of ABT Solutins
specializes in innovative IT solutions and complex software projects development.

My company based in Ukraine. We've earned ourselves a reputation of a
reliable and trustworthy partner working successfully with a number of
West European companies and providing them with reliable software
development services in financial and media sectors.
Unfortunately we are currently facing some difficulties with receiving
payments for our services. It usually takes us 10-30 days to receive
a payment and clearing from your country and such delays are harmful
to our business. We do not have so much time to accept every wire transfer.

That's why we are currently looking for partners in your country to help
us accept and process these payments faster.
If you are looking for a chance to make an additional profit you can
become our representative in your country. As our representative you will
receive 8% of every deal we conduct. Your job will be accepting funds in
the form of wire transfers and forwarding them to us.
It is not a full-time job, but rather a very convenient and fast way
to receive additional income. We also consider opening an office in your
country in the nearest future and you will then have certain privileges
should you decide to apply for a full-time job. Please if you are
interested in transacting business with us we will be very glad.

Please contact me for more information via email:

and send us the following information about yourself: job.abtsolutions@gmail.com

1. Your Full Name as it appears on your resume.
2. Education.
3. Your Contact Address.
4. Telephone/Fax number.
5. Your present Occupation and Position currently held.
6. Your Age

Please respond and we will provide you with additional details on how you
can become our representative. Joining us and starting business today will
cost you nothing and you will be able to earn a bit of extra money fast
and easy. Should you have any questions, please feel free to contact us
with all your questions.

Sincerely,
Chebotar' Aurelian,
Director of ABT Solutins.

---

Asprox domains: 23/7/08 - Part II

Just a couple more to add:

• cgt4.ru
• kc43.ru

Asprox domains: 23/7/08

A shift in domains used by the Asprox crew - these new domains are all in the .ru TLD and are registered via NauNet (contact details here). ngg.js is still the name of the Javascript file to look for, I suspect that vrcgoo.js might be a new name to keep an eye out for too.

• 4cnw.ru
• 4vrs.ru
• 5kc3.ru
• 90mc.ru
• 9jsr.ru
• bts5.ru
• chds.ru
• cvsr.ru
• d5sg.ru
• ecx2.ru
• gb53.ru
• h23f.ru
• jex5.ru
• jvke.ru
• keec.ru
• keje.ru
• kgj3.ru
• lkc2.ru
• lksr.ru

For most organisations, blocking the entire .ru TLD will probably do no harm as these are usually always Russian language sites.

"Infopulse Ukraine Ltd" Money Mule Scam

Infopulse Ukraine appears to be a legitimate software development company, but this email that claims to be from them is certainly not legitimate. Tell-tale signs are the free email address (rather than using infopulse.com.ua and the fact that this sort of money transfer operation appears to be an easy way to earn money doing very little.. which means that it will be some sort of money laundering operation. Avoid.

---

Subject: Earning additional salary with us!
From: jobinfopulse@gmail.com
Date: Wed, July 16, 2008 4:56 pm

Hello Sir/Madam,

I am Alexey Sigov, Director of Infopulse Ukraine Ltd
specializes in innovative IT solutions and complex software projects development.

My company based in Ukraine. We've earned ourselves a reputation of a
reliable and trustworthy partner working successfully with a number of
West European companies and providing them with reliable software
development services in financial and media sectors.
Unfortunately we are currently facing some difficulties with receiving
payments for our services. It usually takes us 10-30 days to receive
a payment and clearing from your country and such delays are harmful
to our business. We do not have so much time to accept every wire transfer.

That's why we are currently looking for partners in your country to help
us accept and process these payments faster.
If you are looking for a chance to make an additional profit you can
become our representative in your country. As our representative you will
receive 8% of every deal we conduct. Your job will be accepting funds in
the form of wire transfers and forwarding them to us.
It is not a full-time job, but rather a very convenient and fast way
to receive additional income. We also consider opening an office in your
country in the nearest future and you will then have certain privileges
should you decide to apply for a full-time job. Please if you are
interested in transacting business with us we will be very glad.

Please contact me for more information via email:

and send us the following information about yourself: jobinfopulse@gmail.com

1. Your Full Name as it appears on your resume.
2. Education.
3. Your Contact Address.
4. Telephone/Fax number.
5. Your present Occupation and Position currently held.
6. Your Age

Please respond and we will provide you with additional details on how you
can become our representative. Joining us and starting business today will
cost you nothing and you will be able to earn a bit of extra money fast
and easy. Should you have any questions, please feel free to contact us
with all your questions.

Sincerely,
Alexey Sigov,
Director of Infopulse Ukraine Ltd

---

Asprox domains: 16/7/08

The following Asprox SQL Injection domains appear to be active today. New ones are in bold.

• adwnetw.com
• adpzo.com
• ausbnr.com
• brcporb.ru
• btoperc.ru
• cdport.eu
• cdrpoex.com
• gbradde.tk
• grtsel.ru
• korfd.ru
• movaddw.com
• tctcow.com
• usabnr.com

ngg.js still seems to be the name of the script file. Block these sites and/or check your logs.

Asprox domains: 15/7/08

Another bunch of Asprox SQL Injection domains, new ones are in bold.

• adpzo.com
• adwnetw.com
• ausbnr.com
• bkpadd.mobi
• butdrv.com
• cdport.eu
• cdrpoex.com
• cliprts.com
• gbradde.tk
• gbradp.com
• gitporg.com
• hdrcom.com
• loopadd.com
• movaddw.com
• nopcls.com
• porttw.mobi
• pyttco.com
• tctcow.com
• tertad.mobi
• usabnr.com

These are still using ngg.js in the injected code.

"I'm customer from Singapore.."

If you sell any kind of high-value goods (or even if you have a web site that just mentions them) then you probably get all sorts of fraudulent emails.

One in particular is the "Customer from Singapore" email of which the following is an example.

---

Subject: special order
From: "Tony Canna"
Date: Fri, July 11, 2008 7:45 am

I'm customer from Singapore ,and I would like to purchase some products from your
company,but before we doing bussines,I need your answers for my questions
below.

1.Do you accept credit card for payment?
2.Do you ship overseas via UPS,DHL or FedEX Service ?

Thanks before for the attentions and we are glad to doing more bussines with
your company.

I look Forward to hearing from you soon.

Best Regards,
Tony Canna

---

Singapore is a pretty good place to do business with. Crime and corruption are very low, and you could be reasonably certain that business transactions from with Singapore would be 100% legitimate. The problem with this email is that the sender isn't from Singapore at all, but from neighbouring Indonesia as an examination of the mail headers shows. At the risk of offending Indonesian readers.. well.. put it this way - Indonesia is a much more tricky place to do business with.

Another telltale mark of a fraud is the phrase "Special order". I don't know why, but these scammers often like to mark their emails with this. Go figure.

This Indonesian/Singaporean scam is actually quite common, so be cautious about people claiming to be from Singapore, check mail headers carefully and check that the delivery address is a real business or residential address if you can (rather than some warehouse at an airport, for example).

"Dibag Industries AG" money mule scam

A money mule scam pretending to come from Dibag Industries AG - clearly trying to pass itself off as the wholly legitimate Dibag Industriebau AG who have nothing to do with it.

Of course there is a PayPal Germany and $78,000 a year for an Office Assistant is probably a little on the high side..

---

Subject: Office Assistant Required - 1500/week

We are a Germany company, we are doing business all over the Europe, our main
activities are real estate investments and digital currencies exchanges.
As a result of expading our business in North American region, our company must keep
up with our American customers accepting the most popular payments in the United
States: Paypal. We are currently seeking an dependable and enthusiastic US
representative to handle the transactions.
Being located in Germany, a transfer via Paypal system sent here can take up to 14
days to arrive, therefore we need a US representative with an US paypal account who
able to accept the payments from our US customers.
This will significantly improve our business, that's why we can pay 5% from every
transfer processed.
Almost anyone is accepted, but a verified paypal account is required, an account
where you will be receiving the transfers.
If you are interested to find more about this position, let me know at:
martin_rohwerder@live.com

Thank you,
Martin Rohwerder
Dibag Industries AG

---

Asprox domains: 10/7/08

These seem to be the currently active Asprox SQL Injection domains to block or check for. New ones are in bold.

• adwnetw.com
• ausadd.com
• ausbnr.com
• bnsdrv.com
• butdrv.com
• cdrpoex.com
• crtbond.com
• destad.mobi
  
• destbnp.com
• drvadw.com
• gbradw.com
• loopadd.com
• movaddw.com
• nopcls.com
• porttw.mobi
• pyttco.com
  
• tertad.mobi
  
• usaadw.com
• usabnr.com

No prizes for guessing that Vivids Media GmbH handled the registrations.

Two more new ones as well:

• bkpadd.mobi
• tctcow.com

ZoneAlarm: "The firewall has blocked Internet access to.."

If you have recently patched your Windows computer with KB951748 and have ZoneAlarm installed then you'll probably find that everything has stopped working with a message similar to:

ZoneAlarm Security Alert
Protected
The firewall has blocked Internet access to whatever.com (0.0.0.0) (HTTP) from your computer (TCP Flags: S)

This is because the Microsoft patch you just applied has made some fairly significant changes to the way your PC looks up internet names (such as web pages, email hosts etc) and ZoneAlarm isn't aware of those changes and is consequently having a panic.

It isn't really a fault with the patch, and given the nature of the change, you can perhaps expect ZoneAlarm not to cope [see note below]. If you really want some more technical background read this article at the Internet Storm Center: Multiple Vendors DNS Spoofing Vulnerability.

As a temporary workaround, the best advice is to deinstall the KB951748 until ZoneAlarm is updated. It is an important update, but you are either going to have to disable ZoneAlarm or remove the patch and at the moment my advice would be to stick with ZoneAlarm.

To remove the patch in Windows XP (Vista will be similar):

1. Click Start and select Control Panel (or Start.. Settings.. Control Panel depending on your setup).
2. Open "Add or Remove Programs"
3. Tick "Show Updates"
4. Scroll down (probably very near the bottom of the list) to Security Update for Windows XP (KB951748) (Vista may be worded differently, but the key thing to look for is KB951748).
5. Click Remove
6. Follow the steps to remove the patch and then reboot

Keep an eye out on the ZoneAlarm Official Announcements forum for updates - hopefully your copy of ZoneAlarm should download a fix for it automatically. When you have downloaded the update for ZoneAlarm, then visit Windows Update and then reapply the patch.

Update 1:
Sandi made the following comment:

It is not necessary to uninstall the patch, or disable/remove Zonealarm. Simply reset the ZoneAlarm database:

http://forum.zonelabs.org/zonelabs/board/message?board.id=cfg&message.id=52727

"To solve this, just reset the ZA database and the ZA will be "fresh" as when it was first installed:


Boot your computer into the Safe Mode
Navigate to the c:\windows\internet logs folder
Delete the backup.rdb, iamdb.rdb, *.ldb and the tvDebug files in the folder
Clean the Recycle Bin
Reboot into the normal mode
ZA will be just like new with no previous settings or data


Once this is finished, reboot back into the normal mode and in the new network found windows, set the new network to Trusted.
Then do this to ensure the ZA is setup properly:

Make sure your DNS and DHCP server IP's are in your Firewall's Trusted zone. Finding DNS and DCHP servers, etc

1. Go to Run and type in command and hit 'ok', and in the command then type in ipconfig /all then press the enter key. In the returned data list will be a line DNS and DHCP Servers with the IP address(s) listed out to the side. Make sure there is a space between the ipconfig and the /all, and the font is the same (no capitals).
2. In ZA on your machine on the Firewall, open the Zones tab, click Add and then select IP Address. Make sure the Zone is set to Trusted. Add the DNS IP(s) .
3. Click OK and Apply. Then do the same for the DHCP server.
4. The localhost (127.0.0.1) must be listed as Trusted.
5. The Generic Host Process (svchost.exe) as seen in the Zone Alarm's Program's list must have server rights for the Trusted Zone.
Plus it must have both Trusted and Internet Access."

Update 2:
ZoneAlarm have a press release with a couple of workarounds here.

Workaround to Sudden Loss of Internet Access Problem

Date Published : 8 July 2008

Date Last Revised : 9 July 2008

Overview : Microsoft Update KB951748 is known to cause loss of internet access for ZoneAlarm users on Windows XP/2000. Windows Vista users are not affected.

Impact : Sudden loss of internet access

Platforms Affected : ZoneAlarm Free, ZoneAlarm Pro, ZoneAlarm AntiVirus, ZoneAlarm Anti-Spyware, and ZoneAlarm Security Suite

Recommended Actions -

Download and install the latest versions which solve the loss of internet access problem here:

ZoneAlarm Internet Security Suite

ZoneAlarm Pro

ZoneAlarm Antivirus

ZoneAlarm Anti-Spyware

ZoneAlarm Basic Firewall

- or follow the directions below.

Option 1: Move Internet Zone slider to Medium

1. Navigate to the "ZoneAlarm Firewall" panel
2. Click on the "Firewall" tab
3. Move the "Internet Zone" slider to medium

Option 2: Uninstall the hotfix

1. Click the "Start Menu"
2. Click "Control Panel", or click "Settings" then "Control Panel"
3. Click on "Add or Remove Programs"
4. On the top of the add/remove programs dialog box, you should see a checkbox that says "show updates". Select this checkbox
5. Scroll down until you see "Security update for Windows (KB951748)"
6. Click "Remove" to uninstall the hotfix

I must say what is kind of annoying about this whole thing is that ZoneAlarm is owned by Checkpoint who will definitely have been in on the whole DNS update issue and could have updated the product in a more timely manner. Many users of ZoneAlarm have been left high and dry because they don't have the technical skills to fix this.

Asprox domains: 9/7/08

Another shift in the Asprox SQL Injection domains, still registered with Vivids Media GmbH. As ever, check your logs or block them.

• adwnetw.com
• ausadd.com
• ausbnr.com
• bnsdrv.com
• butdrv.com
• cdrpoex.com
• cliprts.com
• crtbond.com
• destbnp.com
• drvadw.com
• gbradp.com
• gbradw.com
• hdrcom.com
• loopadd.com
• movaddw.com
• nopcls.com
• tctcow.com
• usaadp.com
• usaadw.com
• usabnr.com

"Ban Ki-moon / United Nations" scam

An almost laughable scam email claiming to be from Ban Ki-moon (the UN's Secretary General) offering to reward victims of scams with $250,000. Of course if you are daft enough to fall for it, then you will soon find that there will be problems that will require up-front fees to be paid etc etc. Note that the reply-to address is actually mrbankimoonun1@sify.com (a free email service provider in India) although the email originated from Google Mail. You can be reasonably assured that Ban Ki-moon does not need to use a free email provider.

---

Subject: SCAMMED VICTIM/ US$ 250,000.00 BENEFICIARY.REF/PAYMENTS CODE:078654
From: "info@unitednation.org"
Date: Wed, July 9, 2008 12:44 pm

ZENITH BANK COMPENSATION UNIT, IN AFFILIATION WITH THE UNITED
NATION. Send acopy of your response to official email:
zenithba_nkplc19_51@hotmail.com
ATTN:Sir/Madam,

How are you today? Hope all is well with you and family?,You may not
understand why this mail came to you.

We have been having a meeting for the passed 7 months which ended 2 days ago
with the then secretary to the United Nations

This email is to all the people that have been scammed in any part of the
world, the United Nations have agreed to compensate them with the sum of US$
250,000.00
(Two Hundred and Fifty Thousand United States Dollars)This includes every
foriegn contractors that may have not received their contract sum, and
people that have had an unfinished transaction or international businesses
that failed due to
Government problems etc.

Your name and email was in the list submitted by our Monitoring Team of
Economic and Financial Crime Commission observers and this is why we are
contacting you, this have been agreed upon and have been signed.

You are advised to contact Mr. Jim Ovia of ZENITH BANK NIGERIA PLC, as he is
our representative in Nigeria, contact him immediately for your Cheque/
International Bank Draft of USD$ 250,000.00 (Two Hundred and Fifty
Thousand United
States Dollars) This funds are in a Bank Draft for security purpose ok? so
he will send it to you and you can clear it in any bank of your choice.

Therefore, you should send him your full Name and telephone number/your
correct mailing address where you want him to send the Draft to you.

Contact Mr. Jim Ovia immediately for your Cheque:

Person to Contact Mr. Jim Ovia
Telephone No: +234_8064109875.
Email: zenithba_nkplc19_51@hotmail.com

Goodluck and kind regards,


Mr. Ban Ki Moon
Secretary (UNITED NATIONS).
Making the world a better place

---

Who are Vivids Media GmbH?

If you have been tracking the latest round of SQL Injection domains, then you might be familiar with the name Vivids Media GMBH as being the current registrar of choice.

The odd thing is that Vivids Media GmbH doesn't appear to have a web site or any traceable contact details. However, most of the domain registrations have a contact telephone number in Berlin of +49.3094413291 and some searching around gives this page with what looks like the correct contact details of:

Name: Vivids Media GmbH
Email Address: support@klikdomains.com
Address: Leege-Gr str. 41
City: Berlin
Zip: 13055
Country : Germany
Tel No.: +49.3094413291

That indicates that Vivid Media GmbH is related to klikdomains.com and therefore klikvip.com which are part of another company that claims to be in Berlin, Klik Media GmbH (some of the alleged goings on of this company are mentioned here). A short step away from Klik are a whole set of domains registered via Estdomains (a familiar name to many) and things start to get seedy from there.

There's no evidence that Vivid Media GmbH is directly invovled in anything bad - in fact there is barely any evidence that Vivid Media GmbH actually exists at all. Spammers and other bad guys do have a knack of finding registrars who are slow at terminating their accounts, so let's be charitable and say that Vivids Media are just understaffed in their abuse department.

The problem is that if you want to contact Vivids Media, then it seems to be very difficult. Their website is 56823.myorderbox.com which is a sort of white label domain registrar site. Myorderbox.com seems to be based in India, and looks to be a reseller of ResellerClub which in turns registers names through PublicDomainRegistry.com.

Complicated? Well, yes.. but ultimately PublicDomainRegistry.com are the registrar and it turns out that there is some light at the end of the tunnel. You will find that most of the domains used in these SQL Injection attacks have false WHOIS data, and you can report false WHOIS data here. Hopefully then the domain will be suspended.. not that it really matters too much because the bad guys will just register some more.

So the answer to the question "who are Vivids Media GmbH?" is "I don't know" but for most practical puporses you wouldn't need to deal with them if complaining about one of these domains, go to the registrar and report it there.

Asprox domains: 7/7/08 and another SQL Injection mitigation article

Another batch of Asprox domains are active today - it also seems that those from 3rd July are still running too. I advise that you check your logs for these or block them:

• adbtch.com
• aladbnr.com
• allocbn.mobi
• adwadb.mobi
• apidad.com
• appdad.com
• asodbr.com
• asslad.com
• blcadw.com
• blockkd.com
• bnradd.mobi
• bnrbase.com
• bnrbasead.com
• bnrbtch.com
• browsad.com
• brsadd.com
• canclvr.com
• catdbw.mobi
• clrbbd.com
• dbgbron.com
• ktrcom.com
• loctenv.com
• lokriet.com
• mainadt.com
• mainbvd.com
• portadrd.com
• portwbr.com
• stiwdd.com
• ucomddv.com
• upcomd.com

If you're looking at ways of protecting your server against these SQL injection attacks, then Sophos has a blog entry called Avoiding SQL injection attacks which looks like a good starting point.

Asprox domains: 3/7/08 and ngg.js

The Asprox domains used in the current round of SQL Injection attacks have shifted again, the ones to check for or block are:

• adwadb.mobi
• allocbn.mobi
• canclvr.com
• catdbw.mobi
• ktrcom.com
• lokriet.com
• mainbvd.com
• portwbr.com
• stiwdd.com
• testwvr.com
  
• upcomd.com
• ucomddv.com
  

The malicious javascript file has also changed to ngg.js (usually it is b.js or m.js or similar). If you're using Google Alerts or similar to monitor your own site or sites of interest, you might want to change the search string to something like "script src=http:" .js site:oceanic-air.com (replace the domain name with the site you want to monitor).

Asprox domains: 2/7/08

These seem to be the currently active domains used in the Asprox SQL Injection attack. Registrar of choice at the moment is Vivids Media GMBH (if they really exist) via Directi Internet Solutions (publicdomainregistry.com).

• adupd.mobi
• adwste.mobi
• bnrupdate.mobi
• cntrl62.com
• config73.com
• cont67.com
• csl24.com
• debug73.com
• default37.com
• get49.net
• pid72.com
• pid76.net
• web923.com

Best advice to to block access to these sites and check your logs.

"Royal Alliance Financial Investment" scam

A slightly strange scam from some outfit pretending to be "Royal Alliance Financial Investment" offering a low-cost loan. The initial email does not ask for much in the way of personal data, presumably that comes as the next step.

There is no such company as "Royal Alliance Financial Investment" in the UK. Originating IP is 196.216.69.54 which is allocated to Swift Global Kenya Limited in Nairobi. Finance companies do not generally use free email accounts to solicit business, and the address is clearly wrong. Avoid.

---

From: "Royal Alliance Financial Investment"
Date: Mon, June 30, 2008 3:43 pm


Royal Alliance Financial Investment
(Financial Aid Professionals)
Contant Address:85 Fleet Street.
London EC4Y 1AE.
Manchester United Kingdom.


Are you searching for a Genuine loan? at an affordable interest rate ?
processed within 4 to 6 working days. Have you been turned down constantly
by your Banks and other financial institutions? The goodnews is here !!!

Welcome to Royal Alliance Financial Investment,interest rate at 3%.It
gladdens our
hearts to bring to your notice that we offer all kinds of loan to any
part of the world.Being a licensed and registered company under the
finance ministry here in the United Kingdom we make available to customers
legitimate loan offers that are quick and affordable with interest rate at
a mere 3%.

Our Packages include:*Home Loan *Auto Loan*Mortgage Loan*Business
Loan*International Loan*Personal Loan*And Much More.

Please if you are delighted and interested in our financial offer,Do not
hesitate to contact us if in need of our service as you will be required
to furnish us with the following details to commence with the process of
your loan sum accordingly

1st INFORMATIONS NEEDED ARE

First Name:___________________________
Last Name:____________________________
Gender:_______________________________
Marital status:_______________________
Contact Address:______________________
City/Zip code:________________________
Country:______________________________
Date of Birth:________________________
Amount Needed as Loan:________________
Loan Duration:________________________
Monthly Income/Yearly Income:_________
Occupation:___________________________
Business name:________________________
Purpose for Loan:_____________________
Phone:________________________________
Fax:__________________________________


Thanks For Your Patronage!


'Your Business Is Our Blessing'

Mr,Jerry Mccarthy,
London Operations Manager,
Contant Address:85 Fleet Street.
London EC4Y 1AE.
Manchester United Kingdom.
Email:royalalliance.finance02@gmail.com
visit.royalalliance@gmail.com

---

Asprox: new domains including .mobi

Another set of domains used in the Asprox SQL Injection attack: bnrupdate.mobi, adwste.mobi, adupd.mobi, hlpgetw.com, hdadwcd.com, rid34.com, adwsupp.com,supbnr.com, suppadw.com, dl251.com, aspx49.com, kadport.com, tid62.com, and batch29.com.

It's the first time that I've seen .mobi used in this way. Blocking access to all .mobi domains will probably do little harm.

Asprox: list of domains and mitigation steps

The folks over at Bloombit Software have a useful article called ASCII Encoded/Binary String Automated SQL Injection Attack which explains some of the technical details behind these attacks and also has another list of domains serving up malware which is useful to keep an eye on.

Asprox: app52.com, aspssl63.com, update34.com, appid37.com, asp707.com, westpacsecuresite.com

Another bunch of domains coming up in the latest batch of Asprox SQL Injection attacks: app52.com, aspssl63.com, update34.com, appid37.com, asp707.com, westpacsecuresite.com - check your logs for these.

Microsoft Security Advisory (954462) - Rise in SQL Injection Attacks Exploiting Unverified User Data Input

A timely advisory from Microsoft on SQL Injection attacks plus some tools to help secure your setup are available on KB954462 with more information here and ISC's commentary here.

Of particular interest is the free Scrawlr tool available from HP. That could be a useful way to see if your server is vulnerable before the bad guys find it,

Motorola MOTOZINE ZN5

Former Moto fans such as myself have waited ages for a truly decent handset to come out from Motorola.

The Motorola ZINE ZN5 certainly has an impressive looking camera.. but the problem is that the rest of the phone is pretty unimpressive.

Motorola's woes have been well documented, but this certainly does look like Motorola's last chance. And it looks like the ZN5 is not really up to the task..

ISC: SQL Injection mitigation in ASP

If you're trying to secure your SQL server against the latest round of injection attacks, then check out this item from the Internet Storm Center, which gives some pointers on how to secure you database with ASP.

It probably makes much more sense to an SQL development than to me.. but the important point is that just cleaning up the injection attack is not enough - you also need to prevent it from happening again by securing your SQL server. And I'm afraid that probably involves spending some time and money..

SQL Injection: bnradw.com

Another SQL Injection domain to block or watch out for in your logs - bnradw.com.

Other than that, the bad guys seem to have been quiet for a couple of days, however it does look like they've managed to exploit 3 million or so pages (according to Yahoo!) so it could just be that they are very busy.

List of SQL Injection domains

My postings here about SQL injected domains are a bit ad-hoc, but Shadowserver also have a pretty up-to-date list if you're looking at blocking them.

Quite a lot of these domains are .cn (China). You might want to consider completely blocking access to .cn, but if you only have basic filtering then you might find yourself blocking things like www.cnn.com too (that took some diagnosing followed by a "d'oh!).

SQL injection: pingadw.com, alzhead.com, pingbnr.com, coldwop.com, adwbnr.com, bnrcntrl.com, chinabnr.com

More SQL Injection domains, this time pingadw.com, alzhead.com, pingbnr.com, coldwop.com, adwbnr.com, bnrcntrl.com and chinabnr.com. Probably a good idea to check your logs and/or block access to these sites.

No change in the method of attack, and the cleanup of SQL servers is proceeding pretty slowly. It's clear that some sites are not going to be fixed any time soon, so if you see a site that hasn't been secured then perhaps a complaint to their web host might help.

msmvps.com, msinfluentials.com and Spyware Sucks offline

I'm a regular reader of Spyware Sucks and was surprised to see that it had been offline for a few days. It turns out that the server that runs the msmvps.com blogging service (used by main Microsoft specialists) got infected with this nasty.

The Google cache of the SBS Diva Blog throws up this information:

In getting ready for the upgrade to CS 2008 I was trying to make some special backups... that wouldn't work. Well in digging into the matter more, that' service that is missing some files which is causing the peer to peer backups between Brianna and Yoda to fail.. isn't a real service at all.

http://www.sophos.com/security/analyses/viruses-and-spyware/w32rbotgos.html

We have backups so first thing tomorrow morning I'll be calling PSS Security to, more than anything else find out the "how" this happened.

Bottom line we got a critter on the box and I didn't (intentially anyway) put it there.

And to check to see if Yoda should be quarantened (aka web server turned off) to protect web visitors as well. So if the blog goes off the air a bit we're just doing it to better protect viewers.

and

In looking at the log files and event logs of Yoda, I'm not liking what I'm seeing... so the blog site at www.msmvps.com and www.msinfluentials.com will be offline starting at 7p.m. Pacific possibly until Friday.

Apologies for the inconvenience to all the bloggers on the site and we'll get back online as soon as we can.

Microsoft recommends that any systems found to be compromised or suspected of being compromised be formatted and re-installed from a known good build (i.e. operating system CD + all security patches while disconnected from the network). CERT has a good web site that provides information on recovering from security incidents located at: http://www.cert.org/nav/recovering.html

Oh well.. it can happen to anyone.

HTM Hell

One feature of these recent SQL Injection attacks is that the same sites will get repeatedly hit. So an infected site might have any number of malware-laded domains injected into the code. Click the image below to see a snippet from a really badly infected site.


The interesting thing about these attacks is that they are not very reliable. It's perfectly possible to visit an infected site and have the javascript fail to load because that particular node of the fast flux botnet is offline - but where there are several calls to several different domains, then the likelihood of infection is much greater. The upside is that any sharp-eyed user should notice something odd with these badly infected pages.

chkadw.com

The latest domain in the SQL Injection attacks is chkadw.com (i.e. pointing to www.chkadw.com/b.js). Domain is registered to a (probably fake) Chinese contact through a Chinese registrar. Delivery mechanism and payload seem to be identical to the latest attacks.

Yet more SQL injection domains

Keep an eye out for datajto.com, dbdomaine.com, upgradead.com, clsiduser.com, clickbnr.com, bnrcntrl.com, domaincld.com, jetdbs.com, updatead.com, all pointing to b.js (e.g. www.dbdomaine.com/b.js) - all forming part of the latest SQL injection attack.

Registrar is VIVIDS MEDIA GMBH - let's see if they clean up their act.

If you're in tech support, check your outbound logs for connections to these domains. If you're an end user then I'd recommend Firefox with Noscript as a good way to protects youself.

One to watch: js.users.51.la

What the heck is js.users.51.la? In fact, where the heck is .la anyway? And why am I asking?

As I've mentioned before, there are possibly two gangs carrying out the current round of SQL Injection attacks, one possibly based in China and one based in Russia. Their techniques are very similar, but the seem to have distinct differences.

js.users.51.la appears in many of the "Chinese" exploits - 51.la itself appears to be a legitimate web counter site. Presumably part of the bad guys' statistical tracking system the js.users.51.la domain is combined with what appears to be a randomly named .js file.

This doesn't appear to be a malware site in itself, but it could be a useful thing to look for in your proxy logs as it may well help track down machines that have visited infected sites. Either search for js.users.51.la or perhaps just 51.la as part of your normal audit process.

Where is .la? Officially it is Laos, but the TLD is also being punted as "Los Angeles" by www.la. No clue there, but the fact that all the signups for 51.la are in Chinese really does indicate that there's a Chinese connection here.

advabnr.com and adsitelo.com

SQL injection time again, this time with two new domains advabnr.com and adsitelo.com both loading a script called b.js (i.e. advabnr.com/b.js and adsitelo.com/b.js)

This is turning up on sites that have already been infected with other SQL injection attacks. The good news is that the new attacks seem to be smaller, indicating that people really are managing to secure their web servers.

Some notable infected sites (many of these have been cleaned up).

adsitelo.com

• bioimmune.com - BioImmune Inc (Health)
• immuquest.com - Health
• eyemdlink.com - Health
• tandberg.com - Tandberg (Electronics)
• techsol.com - Technology Solutions Company (ERP services)
• pollingcompany.com - The Polling Company (Market Research)
• spjc.edu - St Petersburg College
• judge.com - The Judge Group (jobs)

advabnr.com

• ibs.com - IBS, Inc (IT Services)
• outsourcingcentral.com - Business information
• mintek.com - Mintek Mobile Data Solutions
• engcen.com - Engineering jobs
• micronet.com - Digital storage

If you're searching for these domains yourself, I recommend using Yahoo! and Google as they give different results. Of course, these sites contain live malware so approach with caution.

bigadnet.com - lastest SQL injection domain

A continuation of the latest wave of SQL Injection attacks is bigadnet.com - many sites infected with "older" attacks have been "upgraded" to bigadnet.net. The inserted code to look for is www.bigadnet.com/b.js which then forwards to bigadnet.com/cgi-bin/index.cgi?ad - this in turn seems to be able to deliver a variety of malware.

bigadnet.com is running on a fast flux botnet, so it's highly distributed and resilient but not very reliable at actually delivering a payload.

UK Goverment sites hit by SQL Injection attacks

Do you trust the government with your personal data? A look at some recent national and local government sites that have been compromised with SQL injection attacks might make you think again.

• fco.gov.uk - Foreign and Commonwealth Office
• dfes.gov.uk - Department for Children, Schools and Families
• harrow.gov.uk - Harrow Council
• cwic.cornwall.gov.uk - Cornwall County Council
• cityoflondon.gov.uk - City of London
• corpoflondon.gov.uk - City of London
• nottinghamcity.gov.uk - Nottingham City Council
• relocateleicester-shire.gov.uk - Leicetershire County Council
• gos.gov.uk - Government Office Network
• lda.gov.uk - London Development Agency
• uktradeinvest.gov.uk - UK Trade & Investment
• dcalni.gov.uk - Northern Ireland leisure and tourism
• colchester.gov.uk - Colchester Borough Council
• countryside.wales.gov.uk - Welsh assembly
• cefngwlad.cymru.gov.uk - Welsh assembly
• broadband.cymru.gov.uk - Welsh assembly
• wmra.gov.uk - West Midlands Regional Assembly
• wmlga.gov.uk - West Midlands Local Government Association
• wycombe.gov.uk - Wycombe District Council
• southshropshire.gov.uk - South Shropshire District Council
• businesslink.gov.uk - Business Development
• shetland.gov.uk - Shetland Council
• unlockingessex.essexcc.gov.uk - Essex County Council
• southshropshire.gov.uk - South Shropshire District Council
• e-petitions.kingston.gov.uk - Kingston Borough Council
• clevelandfire.gov.uk - Cleveland Fire & Rescue
• surreyheath.gov.uk - Surrey Heath Council
• rbkc.giv.uk - Royal Borough of Kensington and Chelsea
• conwy.gov.uk - Conwy County Council

These are some example searches that show the problem (note that the search results will change over time, and the results themselves may lead to malware). Yahoo! examples: 1 2 3 4 5; Google examples: 1 2 3 4

Widen the search to sites containing .gov with a "b.js" exploit in (the most common), and you can see that government sites all over the world have been compromised, with Yahoo! estimating 11,000 infected pages. Think about it.. these should be trusted sites, but clearly they are not safe. Remember: there is no such thing as a trusted site anymore.

SQL Injection: advertbnr.com, logid83.com, script46.com, rexec39.com

Another batch of domains being used in SQL Injection attacks: advertbnr.com, logid83.com, script46.com, rexec39.com. Sanitize your inputs.

It looks like a lot of recent domains have been suspended by their registrar, some of the recent domains are with Xin Net who have been spam-friendly in the past, but may be cleaning up their act.

Google indicates that around 668,000 web pages are infected, but a search at Yahoo! shows around 3,000,000 infected pages which is probably more accurate.

Apple iPhone 3G

After lots and lots of rumours, the Apple iPhone 3G is finally here. It adds UMTS and HSDPA (3.5G), plus GPS and mapping. There's a new software platform, plus a number of other enhancements. But, really it's a bit disappointing.. the camera is still poor and you can't take out the battery.. and the 480 x 320 pixel display is so last year..

One surprising thing is that the iPhone will ship to 70 countries from July onwards. They've managed to do all that while keeping the iPhone 3G very quiet indeed.

Oh well, perhaps the iPhone 3 will finally be the one that fits in everything but the kitchen sink!

SQL Injection: sslnet72.com, encode72.com, bannerupd.com, err68.com, cookieadw.com

Another batch of domains showing up in SQL injected are sslnet72.com, encode72.com, bannerupd.com, err68.com, cookieadw.com.

Some notable compromised sites:

• ise.ie - Irish Stock Exchange
• pittsfield-ma.org - City of Pittsfield
• corangamite.vic.gov.au - Corangamite Shire, Victoria
• fdc.org.br - Brazilian government agency
• dailyu.com - Local newspaper
• www.humanrightsfirst.org - Campaigning organisation
• therecruitbusiness.com - Recruiting
• corporate-responsibility.org - Business information
• childcarefinancialaid.org - Financial information
• micronet.com - Computer storage
• tairawhiti.ac.nz - Tairawhiti Polytechnic, New Zealand

The payload at the moment is undertermined, and some of these sites will have been cleaned up. At the time of writing, Irish Stock Exchange at ise.ie is still compromised.

"Company Littmann Stethoscopes Co.Ltd" bogus job, spoofing medisave.net

medisave.net is an "under construction" website belonging to the wholly legitimate Medisave UK Ltd, a supplier of medical equipment.

Unfortunately, there is a fake job offer being sent out in Medisave's name. One twist is that the "From:" address is jobs@medisave.net, but the reply to address is littmannstethoscopeshelpdesk@gmail.com. The spammers are taking advantage of the fake the the "reply to" address is often not clear until the user clicks "reply", otherwise they tend to see the fake "from" address (note, medisave.net is not compromised and is not sending out these emails).

The job offer is likely to be some sort of money mule/money laundering scam. Really there's no need to dig further. Of interest is the fact the the email address has been harvested from a UK retailer and this is a UK-targeted spam.

From: Company Littmann Stethoscopes Co.Ltd
Reply-To: littmannstethoscopeshelpdesk@gmail.com
Subject: Online Job Opportunity (Apply Now )

Would you like to earn £5,000 in a week?

Reply Back for more details

100% legal No upfront payment from you.

Risk Free

Amazon.com - reverse pump and dump or blackmail?

I received this unintelligible email from an IP address in Russia (213.221.29.19), probably relating to the recent mystery outage at Amazon.com.

Subject: Amazon.com In what a problem?
Date: Mon, June 9, 2008 7:14 am

Hello!
News agency Reuters informs about not to working capacity of a site amazon.com in
current of two weeks since June, 9th and corresponding it to falling of share price. Be close
at work with them.

What gives? My best guess is that someone is trying to either drive the share price down (perhaps they have a put option), or perhaps it is part of some blackmail plot relating to the amazon.com outage.

Unfortunately for the bad guys, the email is completely incomprehensible. As spam, this one is definitely destined for the failboat.

Googling for SQL injection infected sites

A very rough and ready Google search shows (warning: results may lead to malware) 792,000 pages that were infected when Google visited the site. Sites that say "This site may harm your computer." can be considered as persistent offenders. Note also that the search results may have some false positives.

All very interesting, you might think. But if you work in an IT department, it can be very useful to find sites that your users might visit so that you can take action.. or perhaps you can even check your own business.

In this current round of attacks, the bad javascript file is called b.js, so you can find a lot of infected sites by Googling for "script src" b.js (you need to include the quotes). That gives hundreds of thousands of matches.

One obvious check is to add your company name, for example "script src" b.js "oceanic airlines", but Google is cleverer than that. If you use the "inurl" function, then you can search for sites in certain TLDs or with certain names. For example "script src" b.js inurl:gov lists several government sites, "script src" b.js inurl:oceanic would find results on sites such as oceanic-air.com, oceanicair.net, oceanic-air.co.uk.

You can narrow down results by country by using the Advanced Search (or you could just use the "national" Google site such as google.co.uk, google.ca etc). You can use other search engines too, but really Google has the most powerful searching options.

Of course, if you want to confirm if the site is still infected, then you will need to visit it. If you don't want all the hassle of firing up a Linux box, then one safe tool is SamSpade for Windows which allows you to look at the underlying HTML safely. It's a pretty old tool, and not perfect, but very useful for a number of tasks. Alternatively, WGET for Windows is more powerful and it allows you to download files in a command line (although care needs to be taken once they are on your machine). I tend to use both.

More SQL injection fun: view89.com, exe94.com and tag58.com

Yet more new domains in this never ending wave of SQL Injection attacks: view89.com, exe94.com and tag58.com. Infected sites load a malicious javascript from www.view89.com/b.js or www.tag58.com/b.js which redirects through exe94.com/cgi-bin/index.cgi?ad - that in turn might try any number of things to infect the visitor's PC.

Chinese "selling-domain" mails

Probably not a scam, and really only a moderate hit on the Spam-O-Meter, but there do seem to be a number of emails from a person called Liu offering to sell a .cn version of your .com domain.

Subject: selling-domain: ------.cn
From: ljp013@vip.163.com
Date: Thu, June 5, 2008 1:13 am


Hello
We have ------.cn and think it is useful for you to made a China Website and
to explore China market.

We are pleased to inform you that we are now engage an activity by which you
can purchase this domain only with $1000 USD. If you are interested in it
,please reply to us and discuss the domain tranfer matters.
We could finish the transaction through www.sedo.com which is a international
Domain trade agency.Then,sedo.com will help you transferred the domain.
China is the biggest market in the world £¡Dot.cn domains is a symbol of
enterprises in China£¡10,000,000 .cn domains are been registered£¡

At last,Sorry for the disturb if any.

Wish you a happy new year 2008, and welcome to our China to visit Olympic Games.

Best Regards.

Liu


=================

Appendix:
Some large international companies use .cn domain in China.
http://www.google.cn/ The world's largest search company google.com China Station
http://www.Amazon.cn The world's largest online bookstore amazon.com company
China Station
http://www.Yahoo.cn Yahoo.com he is the sub-stations in China

It used to be the case that anyone wanting to register a .CN name had to either live in China or have a business that operated in China, although this is no longer the case and it seems everyone can register a .CN name (some restrictions apply on names and content). Neulevel's FAQs on the .CN TLD are enlightening. There is a dispute policy if you feel that your domain name has been registered unfairly.

To be honest, I'm not at all bothered about .CN names and I certainly won't be shelling out $1000 for something I won't use. But as ever, if you want to protect your brand abroad then perhaps securing the .cn version of your domain might be a good idea, there's a list of registrars at CNNIC.

flyzhu.9966.org and exec51.com SQL injection attacks

More in the ever morphing world of SQL injection attacks. Sites that were hit with the xiaobaishan.net attack are now directing to flyzhu.9966.org/us/Help.asp and sites previously infected with en-us18.com are now pointing to www.exec51.com/b.js

9966.org appears to be a dynamic DNS service, exec51.com is a fast flux botnet. My best guess is that there are two rival groups performing SQL injections, one of them is Chinese and the other Russian.

The nature of the botnet means that the payload delivery is a bit erratic, but with a bit of effort exec51.com coughs up a reference to fake anti-spyware site advancedxpdefender.com. That tries to install a trojan which is pretty well detected by most AV products.

Thanks also to Amir who pointed us in the direction of his guide to preventing SQL injection attacks - if your server has been hit by one of these exploits, then it might be useful to you.

Redmondmag.com and related sites serving up malware

One notable name that keeps coming up with regards to the latest round of SQL Injection attacks is Redmondmag.com, published by 1105 Media, Inc as well as a number of sister sites. For a publication for IT professionals to be so badly impacted by SQL injection attacks raise some eyebrows.

A quick bit of Google searching shows how bad it is: a search for sysid72.com "1105 media" shows 35 infected pages belonging to virtualizationreview.com, visualstudiomagazine.com, redmondmag.com, reddevnews.com and certcities.com. Searching for xiaobaishan.net "1105 media" comes up with 121 matches for tcpmag.com and certcities.com. There are similar hits when searching for en-us18.com and locale48.com.

An alternative search you can do is b.js "1105 media" where this current batch of injected javascripts can clearly be seen (of course, this blog entry will also turn up for the same search string in time!)

This problem goes back to at least April when redmondmag.com was infected by the nihaorr1.com attack.

Here's the thing: the sites showing up in Google are not infected at the moment, but they were when Google crawled them. Clearly 1105 Media cleans up the attacks quickly, but it has not yet managed to secure its SQL server against injection attacks. Perhaps 1105 Media should read some of their own articles on the subject (see redmondmag.com/news/article.asp?editorialsid=9928 - visit at your own risk!)

win496.com, tag58.com, rundll841.com and sslput4.com: another SQL injection attack

Yet another SQL injection attack doing the rounds, this time inserting references to www.win496.com/b.js, www.tag58.com/b.js and www.rundll841.com/b.js. The javascript redirects to sslput4.com/cgi-bin/index.cgi?ad. (Obviously, don't visit these sites unless you know what you are doing!)

All the domains run on a distributed botnet and were freshly registered this morning to a no-doubt fake address:

whois -h whois.crsnic.net win496.com ...
Redirecting to DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM

whois -h whois.PublicDomainRegistry.com win496.com ...
Registration Service Provided By: VIVIDS MEDIA GMBH
Contact: +49.3094413291

Domain Name: WIN496.COM

Registrant:
n/a
lera (casta4000@mail.ru)
reklama uslug 727 94-00
Seul
3566,123456
RU
Tel. +7.4952345672

Creation Date: 04-Jun-2008
Expiration Date: 04-Jun-2009

Domain servers in listed order:
ns4.win496.com
ns3.win496.com
ns2.win496.com
ns1.win496.com


Administrative Contact:
n/a
lera (casta4000@mail.ru)
reklama uslug 727 94-00
Seul
3566,123456
RU
Tel. +7.4952345672

Technical Contact:
n/a
lera (casta4000@mail.ru)
reklama uslug 727 94-00
Seul
3566,123456
RU
Tel. +7.4952345672

Billing Contact:
n/a
lera (casta4000@mail.ru)
reklama uslug 727 94-00
Seul
3566,123456
RU
Tel. +7.4952345672

Status:ACTIVE

There are probably several different payloads, one we have seen is the Danmec trojan which drops a file called aspimgr.exe into the SYSTEM32 folder (more details here, here and here). The payload delivery may be randomised, it seems to be quite difficult to determine exactly what is going on.

If your server has been infected, then you need to do more than just clean it up.. you need to sanitize your SQL inputs. You can read more details of how SQL injections works here.

Right now it is difficult to say how many sites are impacted as the domains are really very new.

Added: you can add sysid72.com/b.js to this list too. That was registered 5 days ago, and a Google search already shows over 2000 hits. Also locale48.com has infected over 4000 pages in the same time frame.

Some people are stupid

A classic post over at the F-Secure blog where some muppet "hacker" accidentally emailed out their malware generation tool and put it right into the hands of anti-virus researchers. To quote F-Secure, Hey, thanks. Keep up the good work.

On a more serious note, this tool is used to generate trojanised PDF files. So go and check that your version of Adobe Reader is up to date right now before doing anything else..

en-us18.com, libid53.com and rundll92.com SQL injection attack

Another bunch of at least three domains (perhaps more) being used in SQL injection attacks are en-us18.com, libid53.com and rundll92.com. In each case the injected script points to b.js, and this then tries to redirect visitors to libid53.com/cgi-bin/index.cgi?ad

It looks like some sort of fast flux network based on a botnet, so it's not actually very reliable and as yet it hasn't delivered a payload in our lab. The ISC indicate that the attack serves up a couple of infected Flash banners, although in this case the redirector seems to be en-us18.com/cgi-bin/index.cgi?ad

At the moment, these merely serves up another redirector to MSN.com, but it would be easy enough for the botnet controllers to change it to a malicious payload.

Some notable infected sites:

• tcpmag.com (Technology magazine - again!)
• annefrank.org (Anne Frank Museum)
  
• galatta.com (Indian movies)
• onefootball.dk (Sport)
• tvoneonline.com (US TV station)
• belfastcity.gov.uk (UK local government)
• marketingprinciples.com (Marketing guide)
• hobsonsbay.vic.gov.au (Australia local government)

This is quite a fresh looking exploit, this is not comprehensive. It is very disappointing to see tcpmap.com listed yet again, and we've seen sister publication redmondmag.com infected before too.

xiaobaishan.net - yet another SQL injection attack

It looks like the sites hit by the chliyi.com attack have been hit again, this time with an injection to a script pointing at www.xiaobaishan.net/dt/us/Help.asp. Right at the moment, the www.xiaobaishan.net domain is not resolving, but it does appear to be hosted on 219.146.128.119 in China.

It looks like the domain may well be a legitimate one that has somehow been compromised and 219.146.128.119 looks like a pretty standard shared server.

It's possible that the chliyi.com infected sites were deliberately targeted, the resulting HTML is an awful mess though (see below).

Some notable infected sites:

• kcsg.com (again)
• sciencescotland.org (again)
• paramountcomedy.com (again)
• drdrew.com (again)
• gisp.org (again)
• legis.state.ia.us (Iowa State legislature)
• modernamuseet.se (Stockholm Museum)
• calbears.berkeley.edu (University)
• reportchildsex.com (Child protection)
• cas.org.uk (Citizen's Advice Scotland)
• tcpmap.com (Technlogy magazine)
• randomhouse.com.au (Random House publishers, Australia)
• ispyni.com (Northern Ireland tourism)

There are a number of other sites, notably in Ireland, Australia and Canada hit too.

This is not the only SQL injection attack doing the rounds today, and I suspect that some of them have been hit by another one pointing at en-us18.com/b.js

As an aside, these multiple SQL injections are really messy. A code snippet from sciencescotland.org demonstrates this:

Bizarre USPS scam

It's hard to tell what the scammer is trying here due to the amusingly bad English. Mail originates from the spammers favourite email service, Gmail (72.14.214.225) but uses a French Yahoo! email address as a drop box with a Polish "From" address.

Clearly some sort of parcel scam where there will be a release fee of some description. Steer clear.

Subject: Please Contact Us With This Email Address Below (usps6864@yahoo.fr)
From: "markwillams2 Gazeta.pl"


Hello Dear,


Please i have to let you knowing this that your have reciverd your parcel,
and do not let me knowing about that since last year.



At this very point now, do to i have not heard from you to knowing the
sitution of things now, for your information track your parcel and you will
sean what am talking about please.

However if you knowing that you are not the one please do get back to me as
matter of urgent to day.please track and sean with this information Below

http://www.usps.com/shipping/trackandconfirmfaqs.htm

Label Number: 0515 0134 7110 8886 8806

Please Contact Us With This Email Address Below (usps6864@yahoo.fr)

Thanks
Mark Williams

pest-patrol.com is not the real PestPatrol - part II

The fake pest-patrol.com site we mentioned a few days ago has fixed its download problem and has given us a sample. Like many of these fake anti-malware sites, the executable morphs continually to avoid protection.

Detection rates are not good (VirusTotal results), and the real PestPatrol / eTrust product doesn't pick it up yet.

I strongly suspect that there's nothing good in the 85.255.112.0 - 85.255.127.255 range at all, and it is probably a good idea to block access to that entire IP block.

Antivirus;Version;Last Update;Result
AhnLab-V3;2008.5.22.1;2008.05.27;-
AntiVir;7.8.0.19;2008.05.27;SPR/Dldr.PestPatr.A
Authentium;5.1.0.4;2008.05.26;-
Avast;4.8.1195.0;2008.05.27;-
AVG;7.5.0.516;2008.05.26;-
BitDefender;7.2;2008.05.27;-
CAT-QuickHeal;9.50;2008.05.26;-
ClamAV;0.92.1;2008.05.27;-
DrWeb;4.44.0.09170;2008.05.27;-
eSafe;7.0.15.0;2008.05.26;-
eTrust-Vet;31.4.5826;2008.05.27;-
Ewido;4.0;2008.05.26;-
F-Prot;4.4.4.56;2008.05.26;-
F-Secure;6.70.13260.0;2008.05.27;-
Fortinet;3.14.0.0;2008.05.27;-
GData;2.0.7306.1023;2008.05.27;-
Ikarus;T3.1.1.26.0;2008.05.27;-
Kaspersky;7.0.0.125;2008.05.27;not-a-virus:Downloader.Win32.FraudLoad.bz
McAfee;5303;2008.05.26;-
Microsoft;1.3520;2008.05.27;-
NOD32v2;3134;2008.05.27;-
Norman;5.80.02;2008.05.26;-
Panda;9.0.0.4;2008.05.27;-
Prevx1;V2;2008.05.27;-
Rising;20.46.12.00;2008.05.27;-
Sophos;4.29.0;2008.05.27;-
Sunbelt;3.0.1123.1;2008.05.17;-
Symantec;10;2008.05.27;-
TheHacker;6.2.92.320;2008.05.26;-
VBA32;3.12.6.6;2008.05.27;-
VirusBuster;4.3.26:9;2008.05.26;-
Webwasher-Gateway;6.6.2;2008.05.27;Riskware.Dldr.PestPatr.A

chliyi.com - another injection attack

Thanks to Dancho Danchev for the heads up, it looks like there's another SQL injection attack on the loose, this time pointing to chliyi.com/reg.js, with about 10,000 hits currently on Google for a variety of sites.

Reportedly, this launches some sort of ActiveX attack via obfuscated VBscript. This is another good reason not to use Internet Explorer, as most other browsers do not support ActiveX and are not vulnerable.

Unlike some other recent injection attacks, this one seems to use a legitimate domain called chliyi.com - unfortunately for the bad guys, the registration on the domain is going to run out pretty soon.

Domain Name.......... chliyi.com
Creation Date........ 2003-06-12 11:21:39
Registration Date.... 2003-06-12 11:21:39
Expiry Date.......... 2008-06-12 11:21:39
Organisation Name.... junrong shen
Organisation Address. dongxiaoqiao3-1-104
Organisation Address.
Organisation Address. suzhou
Organisation Address. 215006
Organisation Address. JS
Organisation Address. CN

Admin Name........... shen junrong
Admin Address........ dongxiaoqiao3-1-104
Admin Address........
Admin Address........ suzhou
Admin Address........ 215006
Admin Address........ JS
Admin Address........ CN
Admin Email.......... wzh@hisuzhou.com
Admin Phone.......... +86.51265678898
Admin Fax............ +86.51257306265

Tech Name............ zhihui wang
Tech Address......... suzhou
Tech Address.........
Tech Address......... suzhou
Tech Address......... 215021
Tech Address......... JS
Tech Address......... CN
Tech Email........... wzh@hisuzhou.com
Tech Phone........... +86.5169697639
Tech Fax............. +86.5167621807

Bill Name............ zhihui wang
Bill Address......... suzhou
Bill Address.........
Bill Address......... suzhou
Bill Address......... 215021
Bill Address......... JS
Bill Address......... CN
Bill Email........... wzh@hisuzhou.com
Bill Phone........... +86.5169697639
Bill Fax............. +86.5167621807
Name Server.......... dns22.hichina.com
Name Server.......... dns21.hichina.com

The IP address of the server is 218.30.96.87 which is not in the Spamhaus DROP list which indicates again that the chliyi.com might well be legitimate, just compromised.

This is another attack that goes to show that "there is no such thing as a safe site". A scan of the Google results comes up with some interesting (and alarming) infected sites:

• forces.ca - Canadian military
• paramountcomedy.com - Paramount Comedy (Cable TV channel)
  
• kcsg.com - KCSG (Utah TV station)
• umnh.utah.edu - University of Utah
• digital.lib.ecu.edu - East Carolinia Unitersity
• chapel.duke.edu - Duke University
  
• drdrew.com - Dr Drew (relationship advice)
• gisp.org - Global Invasive Species Program
  
• sciencescotland.org - Royal Society of Scotland
  
• moffitt.org - H. Lee Moffitt Cancer Center and Research Institute
• confetti.co.uk - Confetti (Wedding planning)
  
• buildabear.com - Build-a-Bear Workshop
  
• delluniversity.com - Dell
• trelleborg.com - Trelleborg AB (Polymer manufacturer)
  

None of these are huge sites when it comes to traffic, but there are some well-known names there and certainly some which you would hope would be more secure. Out of the other infected sites, it seems that the US Canada, Australia, the UK and Ireland seem to have the biggest cluster of infected sites with very few showing outside those countries.

This is not a comprehensive list of infected sites, and many of these sites will have been cleaned up.

If you are running an SQL server, then the rule is to secure your inputs, else you will get attacked again and again.

pest-patrol.com is not the real PestPatrol

Thanks to Dancho Danchev for pointing out pest-patrol.com, yet another dodgy looking scareware site. Of course, the real PestPatrol is a pretty well known and legitimate anti-spyware product from CA, the one with the hyphen in the middle is definitely trying to pass itself off as the real thing. (Click the thumbnail for a larger picture).



The fake pest-patrol.com is hosted on 85.255.121.181 in the Ukraine, a range of network addresses that features on the Spamhaus DROP list, and has domain registration service from Estdomains which always seems to be a popular choice with dodgy web sites.

The bottom of the page has a copyright notice claiming that it was created by "Pest Patrol, Inc.", but that is likely to be fake. A large amount of text has been copied and pasted directly from the real CA site. The "PestPatrol" name is pretty widely registered as a trademark, so apart from anything else, this fake pest-patrol.com site is clearly violating CA's trademark rights.

What's interesting about this is just how the pest-patrol.com domain ended up in the hands of a bunch of guys in Eastern Europe. Although the "PestPatrol" name is trademarked, that only applies to computer software. As is turns out, the original pest-patrol.com controlled pests of the creepy crawly variety. CA (or SaferSite Inc as it was before CA took over) would have had no claim over the domain name as it wasn't violating any trademark or causing confusion. But eventually the name expired and after being dropped a couple of times it ended up with someone who clearly is using it to violate a trademark.

The lesson for businesses is perhaps that they need to keep an eye on domains that could potentially violate a trademark or be confusing and secure them if they expire, several registrars can back order domain names. In the long run, that's probably easier than trying to track down an anonymous registrant from the former Soviet Union.

The download option on pest-patrol.com doesn't work at present, but it could be similar to this one (VirusTotal scan results) which appears on a sister site. Unfortunately, CA's genuine product doesn't seem to detect it..

Mass phpBB attack free.hostpinoy.info and xprmn4u.info

Another injection attack reported by the ISC, and this time it appears to be using one of many potential flaws in phpBB. Injected code points to free.hostpinoy.info/f.js and xprmn4u.info/f.js, and a Google search of these two terms currently comes up with 858,000 matches between them indicating that this is a very large scale attack.

phpBB is a great bit of software, but sadly it is riddled with security holes and requires constant updating. If you're running a phpBB forum then you need to patch it as a matter or urgency. If you don't run phpBB and are looking at running a forum then I've got to say.. try something else.

It looks like some version of the Zlob trojan is being served up, see here and here for more details. (Thanks sowhatx). Detection rates seem to be patchy. It's possible that the injected code is using some sort of geotargetting as the destination sites are not consistent.

free.hostpinoy.info is 209.51.196.254 (XLHost.com)
xprmn4u.info is 217.199.217.9 (Mastak.ru)

Updated: A brief analysis of some of the impacted sites shows a mix of high traffic forums and long-dead ones. Some of these forums are hit with multiple exploits and massive amounts of spam, which indicates that they are running a very out of date version of phpBB.. so folks, if you have a forum which you don't use any more, do everyone a favour and delete it.