<![CDATA[[SecurityRatty] tag: valentine]]> http://securityratty.com/tag/valentine Tue, 15 Jan 2008 18:01:01 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Over 80 percent of Storm Worm Spam Sent by Pharmaceutical Spam Kings]]> http://securityratty.com/article/ea68adf4b019a71c0112661ffc8d8bf1 http://securityratty.com/article/ea68adf4b019a71c0112661ffc8d8bf1
It used to be a case where a botnet would be used for a single purpose, spamming, phishing, or malware spreading. At a later stage, the steady supply of malware infected allowed botnet masters more opportunities to "sacrifice" the clean IP reputation and engage in several malicious activities simultaneously - today's underground multitasking improving the monetization of what used to be commodity goods and services.

Today, a botnet will not only be sending out phishing emails, automatically SQL inject vulnerable sites across the web, but also, provide fast-flux infrastructure to money mule recruitment services, all of this for the sake of optimizing the efficiency provided by the botnet in general. This optimization makes it possible for a single botnet to be partitioned and access it it sold and resold so many times, that it would be hard to keep track of all the malicious activities it participates in. Cybercrime in between on multiple fronts using a single botnet is only starting to take place as concept.

That's the case with Stormy Wormy, according to IronPort whose "Researchers Link Storm Botnet to Illegal Pharmaceutical Sales" :

"Our previous research revealed an extremely sophisticated supply chain behind the illegal pharmacy products shipped after orders were placed on botnet-spammed Canadian pharmacy websites. But the relationship between the technology-focused botnet masters and the global supply chain organizations was murky until now," said Patrick Peterson, vice president of technology at IronPort and a Cisco fellow. "Our research has revealed a smoking gun that shows that Storm and other botnet spam generates commissionable orders, which are then fulfilled by the supply chains, generating revenue in excess of (US)$150 million per year."

Murky until now? I can barely see in the room due to all the smoke coming from the smoking guns of who's what, what's when, and who's done what with who, especially in respect to Storm Worm whose multitasking on different fronts in the first stages of their appearance online made it possible to establish links between several different malware groups and the "upstream hosting providers", until the botnet scaled enough making it harder to keep track of all of their activities.

The Storm Worm-ers themselves aren't sending out pharma spam, the customers to whom they've sold access to parts of Storm Worm are the ones sending the pharma spam. Here's a brief analysis published in May - "Storm Worm Hosting Pharmaceutical Scams". What's in it for the scammers? Income based on a revenue-sharing affiliate program, a pharmacy affiliate program has been around for several years :

"This criminal organization recruits botnet spamming partners to advertise their illegal pharmacy websites, which receive a 40 percent commission on sales orders. The organization offers fulfillment of the pharmaceutical product orders, credit card processing and customer support services"

What's coming out of Storm Worm's botnet isn't necessarily coming from the hardcore Storm Worm-ers whose job today is more of a campaign-rotation related in order to ensure new bots are added, what's coming out of Storm Worm is coming from those using the access they've purchased to a part of the botnet.

Related posts:
Storm Worm Hosting Pharmaceutical Scams
All You Need is Storm Worm's Love
Social Engineering and Malware
Storm Worm Switching Propagation Vectors
Storm Worm's use of Dropped Domains
Offensive Storm Worm Obfuscation
Storm Worm's Fast Flux Networks
Storm Worm's St. Valentine Campaign
Storm Worm's DDoS Attitude
Riders on the Storm Worm
The Storm Worm Malware Back in the Game
]]> Mon, 28 Jul 2008 23:29:54 +0000 storm worm storm worm malware storm hardcore storm worm-ers storm worm-ers malware botnet botnet masters botnet spam Over 80 percent of Storm Worm Spam Sent by Pharmaceutical Spam Kings <![CDATA[Storm Worm's U.S Invasion of Iran Campaign]]> http://securityratty.com/article/686d338a8ac6a206c4c3d47b2722c28e http://securityratty.com/article/686d338a8ac6a206c4c3d47b2722c28e The Storm Worm-ers are keeping themselves busy, with two campaigns in less than a week, following the latest on the 4th of July. Now, they are spreading rumors of a U.S invasion in Iran :

"Just now US Army's Delta Force and U.S. Air Force have invaded Iran. Approximately 20000 soldiers crossed the border into Iran and broke down the Iran's Army resistance. The video made by US soldier was received today morning. Click on the video to see first minutes of the beginning of the World War III. God save us."

The campaign is using the following domains :
statenewsworld .com
morenewsonline .com
dailydotnews .com
dotdailynews .com
newsworldnow .com

All registered by the same individual :
ONLINE  CO REANIMATOR (dfgdgf@gmail.com)
REVA 13-27 Deribaska 3565,198346 DZ Tel. +321.3568872

Sample detection rate :
iran_occupation.exe
Scanners Result: 4/33 (12.13%)
File size: 118273 bytes
MD5...: 19ab8f1dddb743c1dc2924cb61d3f877
SHA1..: e0915f377020479ba95ffed0fcb07a2b2aec72f4

Storm Worm domains used in recent campaigns, still parked on infected hosts :

superlovelyric .com
bestlovelyric .com
makingloveworld .com
statenewsworld .com
wholoveguide .com
gonelovelife .com
loveisknowlege .com
lovekingonline .com
lovemarkonline .com
wholefireworksonline .com
morenewsonline .com
makingadore .com
greatadore .com
yourfireworksstore .com
loveoursite .com
dayfireworkssite .com
musiconelove .com
knowholove .com
whoisknowlove .com
theplaylove .com
lovelifecash .com
wantcherish .com
shelovehimtoo .com
makeloveforever .com
bellestarfireworks .com
yourfireworks .com
worldbestfireworks .com
greatfireworkslaws .com
dailydotnews .com
dotdailynews .com
wholovedirect .com
newsworldnow .com
thefireworksjuly .com
grupogaleria .cn
polkerdesign .cn   
nationwide2u .cn
activeware .cn
grupogaleria .cn
likethisone1 .com
lollypopycandy .com
nationwide2u .cn
polkerdesign .cn
verynicebank .com
thefireworksjuly .com
wholefireworksonline .com
worldbestfireworks .com
yourfireworks .com
bellestarfireworks .com
dayfireworkssite .com
greatfireworkslaws .com
yourfireworksstore .com

The "best" is yet to come.

Related posts :
Storm Worm Hosting Pharmaceutical Scams
All You Need is Storm Worm's Love
Social Engineering and Malware
Storm Worm Switching Propagation Vectors
Storm Worm's use of Dropped Domains
Offensive Storm Worm Obfuscation
Storm Worm's Fast Flux Networks
Storm Worm's St. Valentine Campaign
Storm Worm's DDoS Attitude
Riders on the Storm Worm
The Storm Worm Malware Back in the Game
]]> Tue, 08 Jul 2008 16:07:39 +0000 storm worm storm worm malware storm worm-ers storm worm domains iran campaign iran occupation domains malware Storm Worm's U.S Invasion of Iran Campaign <![CDATA[Hacker pleads guilty to attacking anti-phishing group]]> http://securityratty.com/article/b672dc8fd9963474c546570401a895da http://securityratty.com/article/b672dc8fd9963474c546570401a895da Mon, 09 Jun 2008 20:00:00 +0000 web site offline hacker guilty computer attack valentine california fairfield day Hacker pleads guilty to attacking anti-phishing group <![CDATA[Storm Worm Hosting Pharmaceutical Scams]]> http://securityratty.com/article/136b48ef6b52e1780fe22ec1ff8f39d6 http://securityratty.com/article/136b48ef6b52e1780fe22ec1ff8f39d6 With Storm's recent SQL injection and introduction of several new domains within, the very latest additions to their domain portfolio are the following domains (naturally in a fast-flux provided by already infected hosts) hosting pharmaceutical scams :

producemorning.com
pressrose.com
posestory.com
picturewest.com
lowsmell.com
catsharp.com
printlength.com

All of the domain's DNS entries are set to update every 2 minutes, meaning they every 2 minutes another 20 different and infected IPs will be hosting the domains, which on the other hand logically have identical WHOIS entry records :

Administrative Contact:
WenFeng NO.397,zhuquedadao street,xian
City,shanxi Province xi an Shanxi 710061 CN
tel: 298 5228188
fax: 298 5393585
 yayun22@163.com

It's also worth pointing out how they emphasize on the benefits of SSL based transactions, when none of the sites is supporting SSL, but is doing something a great number of phishers do - they've changed the favicon to a key lock looking one, since maintaining a SSL infrastructure on the infected hosts is both, unpragmatic, and a bit unnecessary if they social engineer the visitor :

"SSL Encryption or Https is a technique used to safeguard private information which is sent via Internet. To prove the site's legitimacy, the SSL encryption uses a PKI (Public Key Infrastructure) - public/private key, to encrypt IDs, documents, or messages to securely transmit the information in the World Wide Web. In order to show that our transmission is encrypted, most browsers will display a small icon that would look like a pad "lock" or a key and the URL begins with "https" instead of "http". SSL Encryption or https from a digital certification authority will helps the secure web site with confidential information on web. "

With pharma masters increasingly using fast-flux to increase the survivability of their domains participating in affiliation based pharmaceutical affiliate programs, Storm Worm is anything but lacking behind programs that connect scammers and (infected) infrastructure providers.

Related posts:
All You Need is Storm Worm's Love
Social Engineering and Malware
Storm Worm Switching Propagation Vectors
Storm Worm's use of Dropped Domains
Offensive Storm Worm Obfuscation
Storm Worm's Fast Flux Networks
Storm Worm's St. Valentine Campaign
Storm Worm's DDoS Attitude
Riders on the Storm Worm
The Storm Worm Malware Back in the Game
]]> Fri, 30 May 2008 10:50:06 +0000 storm worm storm storm worm malware malware ssl encryption ssl lock key lock key Storm Worm Hosting Pharmaceutical Scams <![CDATA[All You Need is Storm Worm's Love]]> http://securityratty.com/article/3b6740ad1fcc1396cba8a4c6dbd8cb18 http://securityratty.com/article/3b6740ad1fcc1396cba8a4c6dbd8cb18 The Storm Worm malware launched yet another spam campaign promoting links to malware serving hosts, in between a SQL injection related to Storm Worm.

These are Storm Worm's latest domains where the infected hosts try to phone back :

cadeaux-avenue.cn (active)
polkerdesign.cn (active)
tellicolakerealty.cn (active and SQL injected at vulnerable sites)
Administrative Email for the three emails : glinson156 @ yahoo.com

Related DNS servers for the latest campaign :

ns.orthelike.com
ns2.orthelike.com
ns3.orthelike.com
ns4.orthelike.com
ns.likenewvideos.com
ns2.likenewvideos.com
ns3.likenewvideos.com
ns4.likenewvideos.com

Storm Worm related domains which are now down :

centerprop.cn
apartment-mall.cn
stateandfed.cn
phillipsdminc.cn
apartment-mall.cn
biggetonething.cn
gasperoblue.cn
giftapplys.cn
gribontruck.cn
ibank-halifax.com
limpodrift.cn
loveinlive.cn
newoneforyou.cn
normocock.cn
orthelike.com
supersameas.com
thingforyoutoo.cn

One of the domains that is injected as an iFrame is using ns.likenewvideos.com as DNS server, whereas likenewvideos.com is currently suspended due to "violating Spam Policy". Precisely.

Related posts:
Social Engineering and Malware
Storm Worm Switching Propagation Vectors
Storm Worm's use of Dropped Domains
Offensive Storm Worm Obfuscation
Storm Worm's Fast Flux Networks
Storm Worm's St. Valentine Campaign
Storm Worm's DDoS Attitude
Riders on the Storm Worm
The Storm Worm Malware Back in the Game
]]> Tue, 20 May 2008 03:46:40 +0000 storm worm storm worm malware malware likenewvideos campaign valentine campaign orthelike domains sql injection All You Need is Storm Worm's Love <![CDATA[Friday Squid Blogging: Valentine Squidograms in Second Life]]> http://securityratty.com/article/dd3ab8e7b250dcc13374b975be4c23e2 http://securityratty.com/article/dd3ab8e7b250dcc13374b975be4c23e2 A day late: Cuddlefish Junction Kissing Squidograms.

]]> Fri, 15 Feb 2008 13:53:54 +0000 cuddlefish junction squidograms day Friday Squid Blogging: Valentine Squidograms in Second Life <![CDATA[Fools rush in to virus writers' love trap]]> http://securityratty.com/article/ba652a4d12c2d9ceaa8d33d6201d65b5 http://securityratty.com/article/ba652a4d12c2d9ceaa8d33d6201d65b5 Thu, 14 Feb 2008 11:24:25 +0000 virus writers seek exploit romantics valentine day heads lovers hearts Fools rush in to virus writers' love trap <![CDATA[This Cupid I don't need]]> http://securityratty.com/article/2d93e511671f1c814b3c3583624f523e http://securityratty.com/article/2d93e511671f1c814b3c3583624f523e
With this weeks festive Valentine's Day celebration upon us, the social engineers are back at work. These folks come up with new and innovative ways to get you to open email and then own your machine. The payload is usually the eponymous Storm worm, so be on your guard. You can get more details about what the FBI thinks is in store for the rest of this week.

Don't fall for it. By using the tactics discussed in Security Mike's Guide you are reasonably protected, but there is nothing that substitutes for good old common sense.

I'm sure you have plenty of secret admirers, hopefully they'll send you flowers. Email solicitations to click on links, you don't need. If it seems too good to be true, it is. If it's a love note from someone that doesn't love you, don't open it.

The best way to protect yourself online is constant vigilance. Expect the worst from folks on the Internet, they rarely let you down.

Cupid image originally uploaded by Shoeless Joe/64.
]]> Tue, 12 Feb 2008 12:45:00 +0000 email solicitations love note email love weeks festive valentine eponymous storm worm day celebration secret admirers shoeless joe64 This Cupid I don't need <![CDATA[Storm Worm's St. Valentine Campaign]]> http://securityratty.com/article/57c45e5425e3601a89d313b02adcb94b http://securityratty.com/article/57c45e5425e3601a89d313b02adcb94b The Riders on the Storm Worm started riding on yet another short term window of opportunity as always - St. Valentine's day with a mass mailing email campaign linking to two files with_love.exe and withlove.exe, using an already infected host as a propagation vector itself in the very same fashion they've been doing so far.

Detection rate : 3/32 (9.38%)
File size: 114689 bytes
MD5: 31ac9582674cad4c8c8068efb173d7c7
SHA1: cee93d3021318a34e188b8fae812aa929cb2bc9c

NOD32v2 - a variant of Win32/Nuwar
Prevx1 - Stormy:All Strains-All Variants
Webwasher-Gateway - Win32.Malware.gen!88 (suspicious)

The binary drops burito.ini (MD5 - A65FA0C23B1078B0758B80B5C0FD37F3) and burito1205-67d5.sys (MD5 - C4B9DD12714666C0707F5A6E39156C11), and creates the following registry entries :

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BURITO1205-67D5 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BURITO1205-67D5\0000 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\burito1205-67d5 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\burito1205-67d5\Security

Surprisingly, there are no client-side vulnerabilities used in last two campaigns.
]]> Tue, 15 Jan 2008 18:01:01 +0000 hkey local burito1205-67d5 hkey local burito1205-67d5 storm worm binary drops burito short term window md5 propagation vector email campaign Storm Worm's St. Valentine Campaign