Tag: malware

Virus definition update on the F-Secure rescue CD

So, a co-worker from the office asked me to clean their personal laptop from one of those anti-virus application that install themselves and creates a bunch of pop-ups telling you you are infected. Obviously, I didn’t want to connect that machine to our corporate LAN, so I figured I should use a rescue CD of some sort that does AV scans. I was highly recommended to use F-Protect’s rescue CD for this type of malware in my SANS 504 course that I just took last week.

So, a co-worker from the office asked me to clean their personal laptop from one of those anti-virus application that install themselves and creates a bunch of pop-ups telling you you are infected.  Obviously, I didn’t want to connect that machine to our corporate LAN, so I figured I should use a rescue CD of some sort that does AV scans.  I was highly recommended to use F-Protect’s rescue CD for this type of malware in my SANS 504 course that I just took last week.

A quick Google search returned a very useful page from techmixer.com titled FREE Bootable AntiVirus Rescue CDs Download List.  This page lists seven freely available Antivirus rescue CD options.  So I downloaded the ISO for F-Protect and burned it to a CD.  Obviously, you want to make sure you are scanning with the latest virus definition update, but since the CD is a read-only media, you can’t update the virus definition on it.  The ISO contains a virus definition file from July 2009, but that’s way to old to be useful.  I tried to follow the instructions that were on the techmixer.com page about F-Protect to use the updates on a USB stick, but without success.  When all else fails, read the instructions.  😉

I downloaded the PDF manual from http://www.f-secure.com/linux-weblog/files/rescue_cd_user_guide.20090717.pdf and those instructions, unlike the ones on the techmixer.com ones, instructed to create a fsecurerescuecd folder on your USB stick.  That way, the virus definition gets expanded to the rescuecd folder as well as the results of the scan is saved in a reports folder.  The trick is to use a USB drive that has nothing else on it.  Why they had to do it that way, I’m not sure.  I wished that it wasn’t so because I would rather carry only one stick instead of dedicating one to having the F-Secure virus definition file.

For those of you who prefer bullets and get ‘er done, here is a step-by-step how-to:

  1. Download the ISO  from the F-Secure web site.  As of this writing, version 3.11 is current.
  2. Burn the ISO to a CD.
  3. Have a FAT formated USB thumb drive with nothing on it.
  4. Create a fsecure folder at the root of the drive.
  5. Create a rescuecd folder in the fsecure folder.
  6. Download the latest virus definition file from F-Secure from http://download.f-secure.com/latest/fsdbupdate9.run
  7. Copy the fsdbupdate9.run to the root of your USB drive.
  8. Plug-in the USB drive on the sick computer and then boot the rescue CD.

F-Secure picked-up that I had a USB drive connected and used the virus definition for the scan.  Simply follow the on-screen instructions and your computer will be cleaned up.

Perimeter defense is useless!

I think it is well known by security experts that the old perimeter defense model just does not work any more. A firewall does give some protection, but users are constantly asking that ports be opened so that they can access services outside of the corporate network. Not only that, but there is not much to prevent malicious traffic to go through your ports that are already opened. Should we ditch the firewall? No, but you should add more layers to your defense. In this post, I will list of the defenses you should have in your environment.

I think it is well known by security experts that the old perimeter defense model just does not work any more. A firewall does give some protection, but users are constantly asking that ports be opened so that they can access services outside of the corporate network.  Not only that, but there is not much to prevent malicious traffic to go through your ports that are already opened.  Should we ditch the firewall?  No, but you should add more layers to your defense.  In this post, I will list of the defenses you should have in your environment.

Whenever such a user requests to have yet another port to be opened, you should make sure that you restrict as much as possible the end-points that can make use of that port you are opening up. For example, John asks that a port be opened so he can establish a VNP connection from the corporate LAN to a business partner, you should make sure that only John’s IP address is allowed to use that port and that there is only one outside IP address that John can reach on that port.

Firewall management is not what keeps me up at night though. What keeps my up at night is the fact that it is so easy to create tunnels from inside my network to the outside over well known ports, such as port 80 or 443 in order to access anything that you would normally block at the firewall. That plus the fact that now you cannot browse most web sites with first installing such things as Flash player and Adobe PDF reader.

A recently vulnerability in Adobe Reader for which there is no patch as of now (Adobe said they will release one on March 11th) is a rather scary one.  This type of vulnerability can be exploited without the user even opening the malicious PDF! How can you defend yourself against that?!  You should have as many layers as possible in order to prevent that malicious PDF from succesfully penetrate your network.  The Verison Business Security Blog has a very good list of steps that can be taken to protect yourself against that threat.  of course, you could always drop Abode Reader altogether.

In general though, that approach can be applied against any threats.  Here are the different layers you should have in place in order of priority:

  1. A firewall.  I would venture to guess that everyone out there has that one in place.  Make sure that a regular review of what rules you have in place is done.
  2. Intrusion Detection (IDS) or better yet, Intrusion Prevention (IPS).  If you can affort it, TippingPoint is probably a leader in that field and works great.  At the very least, you should have Snort in your network.
  3. Don’t allow your users to be local administrators.  Most of the people that get infected with malware  and virus are logged on with local administrator rights.  That’s a very bad idea.  Lock down those users!
  4. Anti-Virus on every machines.  AV is not perfect as it is a reactive technology, but it will catch a lot of what is out there.  Anti-Virus products now can do more than just detecting and cleaning virus.  The can block use of certain ports on your hosts (such as port 25 for e-mails or ports typically used for IRC).
  5. Host-based Intrusion Detection System (HIDS).  This technology is starting to catch on in corporate environments.  This is basically the equivalent of having ZoneAlarm on each desktop, but centrally managed by the corporate IT.
  6. Last but not least, patching!  Make sure that you are current in your OS patches and your application patches.  That is not always easy in corporate environment since it sometimes requires careful testing and planning.

In my experience, the mobile users are the weak links.  Once they take their laptops outside of the corporate LAN, many of those defensive layers, such as IPS and the firewall, are no longer there to protect them.  That’s why you need to have strong defenses on the workstations, such as disk encryption and HIDS.

Can anyone think of other layers that should be in place?

Disection of a web based infection

This post describes how compromised web sites try to infect your pc.

Gone are the days where you actually had to convince someone to open your malicious e-mail attachment to get malicious software installed. Now all you need is to browse a compromised web site and you can become a victim in a matter of seconds. This post will dissect the home page of such a web site and explain the different ways that bad guys are trying to install their malicious software onto your computer.

I was alerted to this compromised web site when our anti-virus console sent me an e-mail because it blocked a trojan on a user’s machine. This e-mail also included the URL of the compromised web site. The trojan is known as JS/Obfuscated by McAfee or JS.Obfuscated.Gen by Bit Defender. The anti-virus actually is able to detect the way the code on the web page has been obfuscated by the author.  This web page only got a 12.83% coverage amongst 39 different AV engines according to Virus Total.  I can only hope that the AV that did not catch that compromised web page will catch whatever the web page will download on the user’s computer before it causes real damage.

You would think that it would be easy to convince the owner of the web site to take action.  Unfortunately, it is not so.  I phoned them personally on Wednesday, Feb. 11.  I actually got a call back on Tuesday, Feb. 17.  I gave the details to the web master.  As of right now (Feb. 21), the site is still has the malicious JavaScript on its home page.  The site is at www dot airdrietrailer dot com and you should not browse it with Internet Explorer on Windows.  You are likely to get infected (especially if you do not keep up with patches).  I took a closer look at the malicious code and it tries to infect you through multiple attack vector, but those are specifically targeting IE.  The nice lady at Airdri Trailer Sales told me that she had already received calls from other people also telling her that their web site is infecting people, but their webmaster could not find what the problem was.

Here is a quick summary of how the infection works:

  1. The web site is somehow compromised and web page(s) modified to inject iFrame into each page on the site.
  2. A user browse the web site, the injected JavaScript code is executed, creating the iFrame which connect to a malicious site to download more code.
  3. The downloaded code is executed and tries multiple attack vectors in order to write to your hard drive.  If one of those vulnerabilities work, a payload is downloaded and executed on your computer.

And voila!  You have been p0wned.

Dissecting the attack

The malicious code is tacked at the bottom of the web page. The code is in two <script></script> blocks.  It is obfuscated by having a bunch of gibberish assigned to variables.  There is actually a bit of code visible in that gibberish, just enough to remove the obfuscation, which is rather simple.  Using the Malzilla tool, it makes it easy to see the code.  The first block reveals how it will de-obfuscate the code.  There are four block of codes that will be de-obfuscated by doing a string substition.  Here are some of the string that are replaced.

  1. Replace aHM with a % character
  2. Replace Zm with the D character
  3. Replace ouG with a % character
  4. Replace tr4 with a 3 character
  5. Replace %P5 with a 2 character
  6. there are more such substitions

All of those strings are then unescaped, and passed to the eval() function to be executed.  That’s where the real action is.

  1. The first block inserts a <BODY> </BODY> and a <DIV> tag into the web page if it finds that the body is empty.
  2. The second block gets a pointer to that DIV and saves it to a variable.  As well, it creates an iFrame element and sets it to a size of 1×1 and sets the source to point to a malicious web site (store16 dot looneytoons dot cc).  Doing a whois on that site reveals that it is a legitimate site registered by Warner Brothers.  Although there is a web server there, it does not return anything as of right now.
  3. Finally, the third block set the iFrame to hidden, gives it an id and appends it to the DIV created in the first block of code.

Since the iframe src attribute is pointing to malicious site, it populates itself with new HTML wich includes more JavaScript.  At that point, the code tries a few number of things in order to gain access to the operating system to enable to write files to your hard drive.  In fact, some of the code looks very much like it was borrowed from the Metasploit framework.  Here are all of the attack vectors that this code tries to exploit:

  1. Flash ActiveX if the version less than 9.0.124
  2. Adobe Reader
  3. Microsoft Office snapshot viewer ActiveX exploit (MS08-041 will protect you)
  4. AOL SB.SuperBuddy ActiveX code found in AOL Client Software 9.0 Security
  5. QuickTime
  6. Microsoft DirecAnimation ActiveX (MS06-067 will protect you)
  7. An oldie but goodie, Microsoft DDS Library Shape Control which was part of Visual Studio 2002 (MS05-052 will protect you)
  8. Windows Sell Remote Code Execution Vulnerability (MS06-57 will protect you)

Bottom line, if you are up to date on patches, you will not have problems.  The trick is to update not only Windows, but all your software you have on your computer.  Not so easy as most people do not really know what actually have installed over time.  The best thing you can do is to visit Secunia Software Scanning and use their scanner.  It will tell you all the software you have installed that requires updates.  If you actually download and install their software, it will keep track of what you have and let you know when there are new updates.

I do have the JavaScript saved, let me know if you would like to see it.