AplusWebMaster
Topic Starter
FYI…
Nine-Ball - mass injection, malicious site, malicious code
- http://securitylabs.websense.com/content/Alerts/3421.aspx
06.16.2009 - "Websense… has detected another large mass injection attack in the wild after the Beladen and Gumblar attacks. We are calling this mass compromise Nine-Ball because of the final landing site. We have been tracking the Nine-Ball mass compromise since 6/03/2009. To date, over 40,000 legitimate Web sites have been compromised with obfuscated code that leads to a multi-level redirection attack, ending in a series of drive-by exploits that if successful install a trojan downloader on the user's machine… If a user visits one of the infected sites, they are redirected through a series of different sites owned by the attacker and brought to the the final landing page containing the exploit code (the redirection path is shown below). The final landing page records the visitors's IP address. When visited for the first time, the user is directed to the exploit payload site. But when visited again from the same IP address, the user is directed to the benign site of ask.com… After redirection, the exploit payload site returns highly obfuscated malicious code. The malicious code attempts to exploit MS06-014 (targeting MDAC) and CVE-2006-5820 (targeting AOL SuperBuddy), as well as employing exploits targeting Acrobat Reader and QuickTime. The MS06-014 exploit code will download a Trojan dropper with low AV detection rate*. This dropper drops a dll with the name SOCKET2.DLL to Windows' system folder. This file is used to steal user information. The malicious PDF file, served by the exploit site, also has very low AV detection rate**…"
* http://www.virustotal.com/analisis/62254bf…68f7-1245137075
File l.php … Result: 7/40 (17.50%)
** http://www.virustotal.com/analisis/f956507…d894-1245160253
File PDF.php … Result: 3/41 (7.32%)
(Screenshot available at the Websense URL above.)
<_<
Nine-Ball - mass injection, malicious site, malicious code
- http://securitylabs.websense.com/content/Alerts/3421.aspx
06.16.2009 - "Websense… has detected another large mass injection attack in the wild after the Beladen and Gumblar attacks. We are calling this mass compromise Nine-Ball because of the final landing site. We have been tracking the Nine-Ball mass compromise since 6/03/2009. To date, over 40,000 legitimate Web sites have been compromised with obfuscated code that leads to a multi-level redirection attack, ending in a series of drive-by exploits that if successful install a trojan downloader on the user's machine… If a user visits one of the infected sites, they are redirected through a series of different sites owned by the attacker and brought to the the final landing page containing the exploit code (the redirection path is shown below). The final landing page records the visitors's IP address. When visited for the first time, the user is directed to the exploit payload site. But when visited again from the same IP address, the user is directed to the benign site of ask.com… After redirection, the exploit payload site returns highly obfuscated malicious code. The malicious code attempts to exploit MS06-014 (targeting MDAC) and CVE-2006-5820 (targeting AOL SuperBuddy), as well as employing exploits targeting Acrobat Reader and QuickTime. The MS06-014 exploit code will download a Trojan dropper with low AV detection rate*. This dropper drops a dll with the name SOCKET2.DLL to Windows' system folder. This file is used to steal user information. The malicious PDF file, served by the exploit site, also has very low AV detection rate**…"
* http://www.virustotal.com/analisis/62254bf…68f7-1245137075
File l.php … Result: 7/40 (17.50%)
** http://www.virustotal.com/analisis/f956507…d894-1245160253
File PDF.php … Result: 3/41 (7.32%)
(Screenshot available at the Websense URL above.)
<_<