MacOS Users vulnerable to Blackhole exploit kit

Published: 2012-04-03. Last Updated: 2012-04-03 20:56:34 UTC
by Manuel Humberto Santander Pelaez (Version: 2)
4 comment(s)

UPDATE: Apple just released Java for OS X 2012-001 and Java for Mac OS X 10.6 Update 7, which addresses this vulnerability. You can download the new versions from http://www.apple.com/support/downloads. More information about the release notes at http://www.oracle.com/technetwork/java/javase/releasenotes-136954.html

If you own a MacOS computer, you might want to disable java for a while until Oracle develops a patch to solve CVE-2012-0507 vulnerability, because there is a Blackhole Exploit Kit version in the wild exploiting this vulnerability and it also can be exploited using metasploit.

If you want to disable java plugins in your MacOS computer, Marcus J. Carey created a video showing how to do it.

More information about this issue at https://www.f-secure.com/weblog/archives/00002341.html

Manuel Humberto Santander Peláez
SANS Internet Storm Center - Handler
Twitter: @manuelsantander
Web:http://manuel.santander.name
e-mail:msantand at isc dot sans dot org

Keywords:
4 comment(s)

Another airline scam! This time from US Airways

Published: 2012-04-03. Last Updated: 2012-04-03 20:45:40 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
5 comment(s)

Be careful with the links showed in this diary because they might still be live and could infect your computer if not handled properly

More and more scams are seen each day. I discussed in a previous diary a phishing attack sent to users so attackers can own their computers. I will show you today another attack using the same technique and the same malicious code.

I received today the following message:

US Airways SCAM

The online reservation details link pointed to the link http://somostigreros.com.ve/s3JgEpEu/index.html. The document has a javacript pointing to four different URL:

Javascript from infected page

The javascript downloaded is the same in all the four cases and points to another link:

Link to malicious code

We arrive to an obfuscated javascript. Let's see a snip of it:

Obfuscated Javascript

After decoding the script, I got the same javascript analyzed in my previous diary, which performs the following:

  • Identification of the navigator being run.
  • Identification of Adobe Flash and Adobe Reader version.
  • Shellcode execution to download malware but this time it is downloaded from http://207.210.101.44/q.php?f=4203d&e=1.
  • Malware is the same DLL discussed in my previous diary, but at this time virustotal shows 30/42 detection ratio. Mcafee detects it as Generic.bfr!em, Symantec detects it as Suspicious.Cloud and TrendMicro detects it as TROJ_SPNR.11C912.

Additional to the measures previously discussed to mitigated this kind of threats, You can be a propagation vector for malware like the one being shown if you publish to the internet vulnerable servers. Many attackers no longer want to shutdown your server but to publish malware in not-visible locations inside your webserver or web application. Please keep in mind the following:

  • Install all available patches  to your operating system and base software. If you cannot do this because your application will stop working, you definitely need to put in place additional controls like Host Intrusion Prevention System (HIDS) and Network Intrusion Prevention System (NIPS) .
  • Test your web applications for vulnerabilities before publishing them on the Internet. If you don't do this, the attackers will be happy to do it for you.
  • If you are unsure if your web server or web application have vulnerabilities, use a Web Application Firewall (WAF). I have found useful ModSecurity to place that kind of protection.

Have you received this kind of threat inside your network? Let us know using our contact form.

Manuel Humberto Santander Peláez
SANS Internet Storm Center - Handler
Twitter: @manuelsantander
Web:http://manuel.santander.name
e-mail:msantand at isc dot sans dot org

Keywords:
5 comment(s)
ISC StormCast for Tuesday, April 3rd 2012 http://isc.sans.edu/podcastdetail.html?id=2440

Comments


Diary Archives