Re: winxp-antivir-on-line-scan in Security http://www.dslreports.com/forum/r21074091 en Wed, 11 Nov 2009 06:04:02 EDT Wed, 11 Nov 2009 06:04:02 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21092311 Kayrac : Happy digging kuk ;)

-Brian]]> http://www.dslreports.com/forum/remark,21092311 Thu, 11 Sep 2008 06:42:46 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21088590 anon : Thanks for the reply & link at CastleCops. Seems like this is the same discussion. I'll see what I can dig up from the hosted website based on the Dave Taylor article linked above.]]> http://www.dslreports.com/forum/remark,21088590 Wed, 10 Sep 2008 14:42:20 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21087067 katarina : I would have .. but don't have an account set up there and don't really want to set one up. Too many things to keep track of. :(

I tried posting as a guest, but couldn't get past the squiggly letters.]]> http://www.dslreports.com/forum/remark,21087067 Wed, 10 Sep 2008 10:05:13 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21087050 Kayrac :
said by katarina See Profile :

Here's what appears to be another of the same type thing at Castle Cops.

»www.castlecops.com/p1111767-Anti···rch.html
Gave them a nudge in the right direction ;)]]> http://www.dslreports.com/forum/remark,21087050 Wed, 10 Sep 2008 10:02:10 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21087003 katarina : Here's what appears to be another of the same type thing at Castle Cops.

»www.castlecops.com/p1111767-Anti···rch.html]]> http://www.dslreports.com/forum/remark,21087003 Wed, 10 Sep 2008 09:51:52 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21080443 Kayrac :
said by papafz :

hey there... i am getting this on one of my client's sites. Going nuts trying to figure it out, but all of your observations about are exactly the same as mine (except i didnt get as far as u did in figuring out what caused it).

try searching for 'Kenny Meez'

If I go directly to KennyMeez.com i do not get the popup.. if i go from a Google result, i do but usually only the first time.

any help would be greatly appreciated.
»www.google.com/search?hl=en&q=%2···aq=f&oq=

(thats a google link for the /in blahblah that the exploit uses) the first link is macafee site advisor, the second is this thread, the next are ways to fix it

happy hunting ;)

-Brian]]> http://www.dslreports.com/forum/remark,21080443 Tue, 09 Sep 2008 06:03:10 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21080074 mysec : Thanks - while I knew from previous exploits that the problem is on the server, I didn't know specifically how these things work.


---]]> http://www.dslreports.com/forum/remark,21080074 Tue, 09 Sep 2008 01:26:07 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21079732 therube : Another light bulb just went on ...

The exploit only working 1 time, & clearing the cache ...

The exploit only works 1 time so long as you HAVE visited the legitimate site after the initial attempt. The reason is because the legit site is now in your cache & that is what loads on subsequent visits to the site.

The exploit will work multiple consecutive times if you HAVE NOT visited the legitimate site.

So if you go to Google, click their link to KennyMeez, you get malware. Click the Google link again & again, & each time you still get malware. After 1024 clicks on the Google link, if you then go directly to KennyMeez.com, the Google link will work correctly, because at that point you are actually loading the legit site from your browser /cache/.

As Kayrac's post pointed out the referrer it is looking for is of type *msn.*, but it looks to be even more general, *msn* (no dot needed). So setting the referrer as h ttp://abc123msnabc123/ also triggers the malware site to load.

("Legit site". I'm kind of saying it wrong. The site is & has been "legit". The Google link is "legit". It is just that there exists an exploit on the sites' server, a server-side exploit, that causes the malware page to load when specific referrers are found.)

EDIT: Oops, I misread the regular expression. .*msn.* will trigger on any (referrer) URL that has the chars msn in it. (At first I disregarded the opening .* & then mistook the closing .* to mean literally msn(dot)* - I was thinking the Windows way :uhh:.

And I might also say I know nothing of Apache servers or server scripts or ... so what I'm saying while very likely not totally accurate, is accurate in principle.]]> http://www.dslreports.com/forum/remark,21079732 Mon, 08 Sep 2008 23:50:46 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21079553 mysec : It looks like the same exploit. Clearing the cache usually lets you connect a second time.

Contact the server which hosts the site.


---]]> http://www.dslreports.com/forum/remark,21079553 Mon, 08 Sep 2008 23:22:31 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21079477 anon : hey there... i am getting this on one of my client's sites. Going nuts trying to figure it out, but all of your observations about are exactly the same as mine (except i didnt get as far as u did in figuring out what caused it).

try searching for 'Kenny Meez'

If I go directly to KennyMeez.com i do not get the popup.. if i go from a Google result, i do but usually only the first time.

any help would be greatly appreciated.]]> http://www.dslreports.com/forum/remark,21079477 Mon, 08 Sep 2008 23:11:16 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21079117 therube : So it is a server side exploit.

That makes a whole lot more sense to me compared the the 302. Not to mention it was far easier to read ;-).

So Google is not hacked, the web page itself is not hacked, it is the server that has been hacked.

But the 302 is still relevant I suppose (not that I know what 200's or 302's are or mean).]]> http://www.dslreports.com/forum/remark,21079117 Mon, 08 Sep 2008 22:06:34 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21079072 therube : At first I was going to say "explain more, what?".

I guess I could have explained more. I think I tried, but OFTEN the workings of this forum confuse me.

Anyhow, originally I was just going to describe the screenshots saying that they confirm what has been posted so far.

Further to that, & to explain a bit more ... I cleared my cache, & loaded davies directly - the 1st shot.

Note Data size: 9563, the size of the cached html file. And the response, 200 OK.

Cleared my cache again, but this time loaded davies, & also spoofed the referrer as msn.com - the 2nd shot.

This time Data size: 0, & the response, 302 Found. Not to mention the Location:.]]> http://www.dslreports.com/forum/remark,21079072 Mon, 08 Sep 2008 21:59:38 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21076896 anon : Said by mysec:
"Another thing - why doesn't the last URL 66.232.126.192 appear in that code?"

This might help explain it...
»www.robtex.com/ip/66.232.126.192.html#a4]]> http://www.dslreports.com/forum/remark,21076896 Mon, 08 Sep 2008 15:06:57 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21075577 mysec :
said by Kayrac See Profile :

Basically looks like they change a few things on their server(after breaking in) so it changes over to the malicious website when visiting from a search engine referrer, no malicious content is on davieshardware page

This is what turned up in the 2007 SloanTreeFarm Redirect exploit I posted earlier. Their page was clean, but the server which hosted them had been compromised.


---]]> http://www.dslreports.com/forum/remark,21075577 Mon, 08 Sep 2008 10:53:51 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074789 Kayrac : I posted this over on another forum, MDL

within 5 minutes i had my answer :)

»www.askdavetaylor.com/how_people···les.html

credits to sowhat-x and sysadmini ;)

-Brian

Basically looks like they change a few things on their server(after breaking in) so it changes over to the malicious website when visiting from a search engine referrer, no malicious content is on davieshardware page

I couldn't figure it out myself, had to call in the professionals :P]]> http://www.dslreports.com/forum/remark,21074789 Mon, 08 Sep 2008 07:32:23 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074636 katarina : Thank you all for checking this out. It's fascinating to watch the discussion, but much of it is way over my head.

All I know is that when I run into this stuff I do not click on anything and use task manager to end any running applications.

It is nice to have confirmed that it is not downloading without those "clicks."]]> http://www.dslreports.com/forum/remark,21074636 Mon, 08 Sep 2008 05:10:02 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074384 Its a Secret : The second and fourth jpg's show the 'GET' command, and I'd hazard that's where the breach happened. One and three hit the actual page.

FYI - It looks like jpg 2 shows a different response-head that may well point to the actual target in jpg 4.
--
"In the future, that which is not mandatory will be illegal"]]> http://www.dslreports.com/forum/remark,21074384 Mon, 08 Sep 2008 01:28:45 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074375 mysec : Can you explain more?


---]]> http://www.dslreports.com/forum/remark,21074375 Mon, 08 Sep 2008 01:24:48 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074364 therube : Two shots, one direct, one spoofed.
]]> http://www.dslreports.com/forum/remark,21074364 Mon, 08 Sep 2008 01:21:09 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074361 Its a Secret :
said by mysec See Profile :

Another thing - why doesn't the last URL 66.232.126.192 appear in that code?
Maybe why? It looks like it self-refers to the doc (page) in question...maybe?


if(self.parent.frames.length!=0){self.parent.location=document.location}

--
"In the future, that which is not mandatory will be illegal"]]> http://www.dslreports.com/forum/remark,21074361 Mon, 08 Sep 2008 01:19:08 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074341 mysec : Thanks -- very clever in covering tracks, don't you think?

Another thing - why doesn't the last URL 66.232.126.192 appear in that code?


---]]> http://www.dslreports.com/forum/remark,21074341 Mon, 08 Sep 2008 01:09:40 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074316 Its a Secret :
said by mysec See Profile :

Now, can someone explain how these images are loaded onto my browser screen and there is no html file cached?
It may be here in the code:
HTTP/1.x 200 OK
Date: Mon, 08 Sep 2008 03:46:27 GMT
Server: Apache/1.3.41 (Unix) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
----------------------------------------------------------
--
"In the future, that which is not mandatory will be illegal"]]> http://www.dslreports.com/forum/remark,21074316 Mon, 08 Sep 2008 01:01:34 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074295 mysec :
said by therube See Profile :

Maybe someone can make sense of this.
And as I thought, you are going to davies, but then sent to malware site.

Yes, just like the old Google exploit. Here are the firewall alerts:

First, to google search:

[att=1]

Then clicking on the link to davieshardware.com:


[att=2]

Then a page 302 error redirects to the site that calls out for the WinAntiVir files. From therube's code:

hxxp://87.248.180.90/in.html?s=ipw2

[att=3]

WhoIS:


said by Its a Secret See Profile :

It looks to me like the referrer link has been encrypted/ scrambled so you can't see where it's pointed to. I may be wrong, but I don't think so.
Probably - I don't see a URL in therube's code but the firewall shows:

[att=4]

WhoIS:


Not much info - can someone else search for this?

Now we are at the cleverest part of the exploit because no html page is cached in IE. (I cannot get the exploit to run in Opera).

Only the .gif files and the .js files are cached which do the work:

[att=5]

If you look at the screen after everything is loaded, it is a series of .gif files but no html file and no source code.

But if I load directly into the browser:

hxxp://87.248.180.90/in.html?s=ipw2

I get the the html file and can watch the code loading everything (thanks therube See Profile for getting that URL):


Now, can someone explain how these images are loaded onto my browser screen and there is no html file cached?

---
 
 
 
 
 
]]> http://www.dslreports.com/forum/remark,21074295 Mon, 08 Sep 2008 00:54:46 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074258 therube : »www.msn.com/ works to.

So by using a spoofer, simply by setting the URL & the Referrer, I can get the malware site to load.


I've tried a number of other "likely" search engines as the referrer (including www.live.com & ask.com) but only Google, Yahoo, & MSN seem to make it click.

Now, mysec's link mentions 302's & so do my captures, HTTP/1.x 302 Found.

Note that /cache/ or cookies may have an affect on what you see or don't see. Like if a page is in /cache/ & I resend the spoof, I can't capture it again, until I clear /cache/.

(I see a "koma3504" to the left of this post. Does anyone else? What does it mean?)]]> http://www.dslreports.com/forum/remark,21074258 Mon, 08 Sep 2008 00:36:46 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074227 therube : Ok, looks like it is going to be related to the search engine?

I manually open up davies.
I click the Product Line link, the & product.html page opens.

I manually open up davies.
I manually change the URL line to read davies/product.html (but do not press return).
I spoof the referrer to, »search.yahoo.com/.
The malware page opens.

Note that many times, after first doing this, it is not repeatable.]]> http://www.dslreports.com/forum/remark,21074227 Mon, 08 Sep 2008 00:26:55 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074164 therube : I'm not finished reading it yet, but it appears that we should see discrepancy in the listed search engine (green) URL & the actual website URL? But in this case, they are the same?]]> http://www.dslreports.com/forum/remark,21074164 Mon, 08 Sep 2008 00:08:29 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074138 Its a Secret : It looks to me like the referrer link has been encrypted/ scrambled so you can't see where it's pointed to. I may be wrong, but I don't think so.

Opinions on this?

PS - I used to use code like this to protect my private js from being nicked.
--
"In the future, that which is not mandatory will be illegal"]]> http://www.dslreports.com/forum/remark,21074138 Sun, 07 Sep 2008 23:59:44 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074091 therube : Maybe someone can make sense of this.
And as I thought, you are going to davies, but then sent to malware site.

]]> http://www.dslreports.com/forum/remark,21074091 Sun, 07 Sep 2008 23:49:25 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074077 Its a Secret : Was this from a 'sponsored' link, or a regular link? That may provide another clue...
--
"In the future, that which is not mandatory will be illegal"]]> http://www.dslreports.com/forum/remark,21074077 Sun, 07 Sep 2008 23:45:55 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074063 mysec :
said by therube See Profile :


Yes, it can be exploited in other search engines. See

»clsc.net/research/google-302-page-hijack.htm]]> http://www.dslreports.com/forum/remark,21074063 Sun, 07 Sep 2008 23:43:34 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074057 ravencajun : you wanted the link to malwarebytes?

[Mod Note: Removed! No .exes! »Posting Rules - Security ]

edit: Opps I am so sorry I grabbed the direct link instead of the site link which is what I meant to post, was definitely a mistake on my part. :(]]> http://www.dslreports.com/forum/remark,21074057 Sun, 07 Sep 2008 23:42:08 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21074012 therube : Why?

It is not Google, cause you can get the same results if you perform the search on Yahoo & open the site from there.

So if it is not Google & not Yahoo, then what?

And why is it that (sometimes) only the first time you attempt it, you are redirected.

davies has to be hacked, doesn't it?
Perhaps from a "gif"? Perhaps dealing with this line, onLoad="MM_preloadImages('images/sales_off-over.gif', ...

There are also various "MM" functions, like, function MM_preloadImages(). Their usage (in general, I don't know about on this site) appear legit.

That part of the code is run by JavaScript.

But you are redirected in SeaMonkey with NoScript blocking JavaScript, so that makes me believe it has something to do with the onLoad & a "gif"?]]> http://www.dslreports.com/forum/remark,21074012 Sun, 07 Sep 2008 23:32:43 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21073671 Millenniumle : If you load Davies Hardware directly, then use the Google link, Davies loads instead of the bogus site.

XP Pro IE6 SP3, scripts disabled.]]> http://www.dslreports.com/forum/remark,21073671 Sun, 07 Sep 2008 22:20:20 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21073647 mysec : AT least this exploit is not remote code execution, and brings up the File Download Box:

[att=1]

said by katarina See Profile :

Edit: You have to actually click on the link from the Google Search results to make it happen. If you type the address in the IE address bar, you arrive at the proper site.

This is reminiscent the Google Referer exploit from last summer. In that one, the exploit worked by remote code execution: no download prompt. See here for an analysis.

»www.urs2.net/rsj/computing/tests/redirect

---
]]> http://www.dslreports.com/forum/remark,21073647 Sun, 07 Sep 2008 22:15:14 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21073467 katarina :
said by Doctor Four See Profile :

... while using Firefox with NoScript will stop nearly all of them.

Just in case something does get installed, Malware Bytes
Anti Malware seems to do a good job at removing these.
I was looking at NoScript today. I just haven't done it yet. I was also looking for Malware Bytes but was looking for a link to a valid download site. I'm always afraid that when I search with Google for security software that a copy cat site will lead me astray and I will land in the wrong place and download the wrong thing.

edit: for clarification]]> http://www.dslreports.com/forum/remark,21073467 Sun, 07 Sep 2008 21:44:25 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21073239 katarina : Search for "davieshardware"

Hudson Valley Commercial Hardware - Davies HardwareSupplier of commercial, industrial architectural and residential hardware. Serving Dutchess and surrounding counties for over 100 years.
xxx.davieshardware.com/ - 10k - Cached - Similar pages

Edit: You have to actually click on the link from the Google Search results to make it happen. If you type the address in the IE address bar, you arrive at the proper site.]]> http://www.dslreports.com/forum/remark,21073239 Sun, 07 Sep 2008 21:06:04 EDT Re: winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21073203 Doctor Four : Not all AV software can detect fraudware site redirects, or
their install attempts. And the scan attempts are always
bogus, anyway.

And as long as you didn't click on anything, you're probably
OK. There was likely a hijacked ad on the search results, or
it could have been a spammed or fake blog that matched on
the search results. Best thing to do when one of these comes
up is to use the Task Manager to kill IE.

A hosts file will prevent many of these redirects, while
using Firefox with NoScript will stop nearly all of them.
Just in case something does get installed, Malware Bytes
Anti Malware seems to do a good job at removing these.

What site did you click on the Google search? If you could,
post the URL as hxxp...etc like the other one.
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Robot)
]]> http://www.dslreports.com/forum/remark,21073203 Sun, 07 Sep 2008 21:00:16 EDT winxp-antivir-on-line-scan http://www.dslreports.com/forum/remark,21072962 katarina : Clicking on a Google search result took me to the following site instead of the expected site.

hxxp://winxp-antivir-online-scan.com/1/?id=20586

There was not a peep from either Avast or Windows Defender. I disconnected from the internet and ended the tasks from task manager.

Should there have been some type of notice from one or the other when it "appeared" that my system was being scanned?

XP Home SP2
IE 7
Click for full size
]]> http://www.dslreports.com/forum/remark,21072962 Sun, 07 Sep 2008 20:10:33 EDT