The e-mail that Bagle.AK was spammed in contains an archive named FOTO.ZIP. Inside there's an HTML file and an EXE file named FOTO.EXE. This EXE file is a dropper. It drops and activates a DLL file that kills processes belonging to updating components of several anti-virus programs.
After this it tries to connect to 131 different websites and to download a file named B.JPG from them. The URLs are hardcoded in the program's body. So far we have not been able to get the contents of that file for investigation. The sites are either down or the file is simply not there.
Cabir is able to send infected files only to devices that have their bluetooth in discoverable (visible) mode. So simply setting you phone into non-discoverable (hidden) mode is enough the prevent Cabir from tying to send you infected caribe.sis files.
Do note that we have no reports of Cabir spreading outside Philippines - and even those reports have not been confirmed
As seen from the previous blog entries we have received second-hand reports of Cabir being spotted in the Philippines.
So we decided to go into a high-security RF shielded area and do extensive study on how Cabir replicates. And what we found is interesting and changes predictions on how Cabir would spread if it's in the wild.
Operation of Cabir Worm is fully independent from the GSM side of phones based on Symbian Series 60. The worm actually starts spreading even when phone is just started and user has not entered PIN code yet.
However the Cabir worm is capable of sending infected SIS files to only one phone per activation. So when Cabir is installed for the first time or the is phone restarted, the worm will look for the first Bluetooth device it can find and keeps sending repeated messages to that, effectively locking on to that phone.
When Cabir infects another Series 60 phone, this newly infected phone will start sending messages back to the phone that sent it the SIS file, even when the phone is not in range. Thus forming a 'tar pit' so that both infected phones wont look new targets before they are rebooted.
This means that the only scenario where Cabir can spread is that the phone that sent infected SIS file to new target is out of Bluetooth range before user activates the Cabir on the new phone (answers "Yes" to the installation query). This would happen, for example, in a busy street where people walk past and are out of range before the user of the phone who received Cabir activates it.
Cabir will also try replicate to a new host every time the phone gets rebooted. So SymbOS/Cabir is capable of spreading - but not very quickly.
Cabir can infect only phones that are in discoverable mode, so setting your phone into hidden mode in Bluetooth settings will protect you from Cabir worm.
The news announcment from US Department of Justice from last night makes a fascinating read.
The DOJ has finished a three-month operation, during which they investigated a wide range of online crime, from phishing cases to DDoS extortion, botnet operations and spamming.
Some sample cases:
- Case Calin Mateias aka "Metal". A Romanian hacker who hacked Ingram Micro's online ordering system to steal hardware worth over $10 million
- A Ukrainian hacker, who was selling stolen credit card numbers by the thousands over IRC chats
- A Romanian gang selling non-existing goods in online auctions
- Mr. Jay Echouafni, the CEO of satellite receiver reseller Orbit Communication was charged for hiring hackers to launch DDoS attacks against their competitors. The idea was to take down the online ordering systems of other large satellite operators.
Things like these are really happening out there. In fact, we're currently aware of one DDoS attack apparently arranged by a company specializing in clip-art graphics (of all things) against their competitor.
We've heard rumours from two different sources that the Cabir mobile phone virus would be in the wild.
We've been unable to confirm this so far, but in any case we're recomming users of all mobile phones with a Symbian Series 60 operating system to keep their Bluetooth in non-discoverable mode. If you don't understand what this means, just turn off Bluetooth.
This includes phones from manufacturers such as Nokia, Siemes, Panasonic and Sendo.
Cabir is the first mobile phone virus in history. It was originally discovered in the middle of June 2004, but it has never been seen in the wild. It attempts to spreads over Bluetooth connections to compatible phones nearby.
We've received some questions from users on why they are seeing new streams in their files lately. Alternative Data Streams (aka ADS) are hidden data areas that can be attached to any file on a NTFS drive. They are accessed via a filename like normal-file.txt:hiddenstreamdata.
Turns out SP2 for Windows XP changes the way how Internet Explorer and Outlook tag files when you download them from the internet and save to your hard drive. They create a new stream called Zone.Identifier to the file.
Typical content of such stream would be:
You can find streams from your files with tools like /> LADS from Heysoft.
Another common stream you're likely to find is called AFP_AFPINFO. Also some picture tools like to create streams to image files.
We've received confirmation that the two websites used by Mydoom.S (richcolour.com and zenandjuice.com) have been cleaned and can't be used by the worm any more.
This means that when Mydoom.S infects system, it will still be able to spread further via email...but it will fail in downloading a spam proxy to the infected systems. Then again, if you we're hit by this proxy trojan already, you wouldn't be reading this anyway, as it blocks access to www.f-secure.com from the infected computers.
Rich, the webmaster for http://www.richcolour.com emailed us last night and confirmed he had taken down the files Mydoom.S downloads from his server. He was also surprised that no-one else had contacted him and warned him that his site was taken over. We discussed how the files might have ended there in the first place.
Our guess before that had been that the bad boys had gained access to richcolour.com and zenandjuice.com via vulnerabilities in the web-based guestbooks they were running, as some of the files had been planted to paths such as /guestbook/temp/.
So, when Rich confirmed that he was running a guestbook called "Achims Guestbook", we visited the homepage for this software:
So I guess we've found out how the spam proxy files were planted.
Mydoom.S won't install proxies anymore, but it still continues to spread...until next Friday. The email-spreading function will expire on August 20th, 2004.
In other news: Netsky.P is no longer the most common virus. It dropped to #2 slot in our virus statistics some time last night...getting replaced with Zafi.B. Netsky.P possessed the "most common virus in the world" title for over four months, from early April 2004.
There's a fairly large and global spam run going on right now, seeding out a new variant of the Mydoom email worm.
The spammed emails always seem to look like this:
From: random-email-address To: random-email-address Subject: photos
The source addresses of the spams appear to be from DSL and cable modem pools, suggesting that the Mydoom gang is using a botnet created with earlier Mydoom variants to send this one out. They've also carefully checked that none of the common antiviruses detect this new variant. We're now detecting this as Mydoom.S with F-Secure Anti-virus.
Also, if you're a sysadmin, you might want to block access to domains www.richcolour.com and zenandjuice.com from your network for a while. This variant tries to download components from these addresses (but the sites themselves have nothing to do with the virus group).
A company called Pentest has released an advisory about a major vulnerablity in widespread bluetooth software, used both on Windows PCs and PocketPC handhelds.
This vulnerability in WIDCOMM Bluetooth Connectivity Software allows arbitrary code execution with priviledges of the user that is currently logged in. Which means that in theory, using this vulnerability it would be possible for a malicious party to write a wireless worm that spreads between PCs or PDAs using Bluetooth over the air. Worms like this could spread very fast, especially in an environment like a seminar or a conference.
This vulnerability is fairly serious since WIDCOMM software is very widespread and seems to be used in most Bluetooth dongles and Bluetooth-enabled computers.
WIDCOMM has not yet released a software update that would fix the vulnerability, so in the meanwhile users are recommended to set their Bluetooth-enabled devices into non-discoverable mode and keep bluetooth switched off when you don't need it.
Yesterday in federal court in Seattle, 19-year old Jeffrey Parson pleaded guilty to writing the B variant of Blaster worm. The confession came almost exactly a year after the virus was originally spread, on 13th of August 2003.
Parson (aka "Teekid") admitted hearing about the virus in news, then downloading a copy, modifying it and unleashing it from 50 computers he had previously hacked. Blaster.B infected tens of thousands of computers around the world - but wasn't nearly as big a problem as Blaster.A was.
Parson now faces between 18 months and over three years in jail and could be ordered to pay massive compensations to affected companies. He was tracked down by FBI and Secret Service fairly quickly after the outbreak, largely because Mr. Parson had instructed the worm's backdoor to connect back to himself via his own personal website, www.t33kid.com.
The original author of the Blaster worm remains at large, with Microsoft offering $250,000 bounty for information leading to his arrest.
There have been some reports about a trojanized version of "Mosquitos" game for Symbian phones that secretly sends SMS messages to premium rate numbers.
We detect this case as Trojan.Mquito. Actually, it's not a trojanized version of the game, unlike many reports state. Turns out the hidden SMS functionality was put in the game from the beginning by the original manufacturer.
This functionality was supposed to be some kind of a copy-protecting technique, but it didn't work right and the whole functionality backfired.
According to the manufacturer, the premium rate contracts for the phone numbers have been terminated, so although old versions of the game still send hidden SMS messages, it only costs the nominal fee of sending the message itself.
Current versions of this game no longer have this hidden functionality, but "cracked" versions of Mosquitos still float in P2P network — and they still send these messages.
The Blaster (aka Lovsan) Internet worm outbreak happened a year ago, on the 11th of August, 2003. Together with Welchi, a related worm which was found few days later, this was a massive outbreak. Blaster is among the three largest Internet worm outbreaks ever (the other two being Slammer and Sasser).
Blaster also launched a DDoS attack against windowsupdate.com. Result: windowsupdate.com was taken down by Microsoft, and it's still down today (but www.windowsupdate.com works). Blaster is still in the net, scanning for vulnerable hosts. It will continue to be there for years.
Blaster's outbreak was massive, and affected Windows PCs started rebooting continuously. Many organizations were hit badly, including several banks and airlines. The seriousness of this case was probably one of the reasons why Microsoft put so much effort into SP2 for Windows XP… which was released almost exactly on the anniversary of the outbreak.
To get some impression on how serious Blaster was, read this snippet taken from the web page of CSX, one of the largest railroad operators in the USA:
The trick in this Bagle is that when user opens the attached ZIP archive, this is what he sees:
...and many users would then wrongly assume that the HTML file is just a web page and safe to click at...after all, there are no dangerous EXE files in sight. Well, that's because it's in the PRICE folder, and the PRICE.HTML will just load and run it.
Repeat after me: HTML files on your local hard drive are not safe to click at. The same file might be perfectly safe when you access it over the web (ie. surf to http://something/somefile.html) and horribly bad when you click on it locally (assuming a typical Windows user with default settings).
It looks like the Bagle gang has spammed a new variant of Bagle widely an hour or two ago. The emails contain a ZIP archive as an attachment with a name like new_price.zip, price_new.zip, price_08.zip etc.
The archive has a HTML file and a hidden EXE file inside.
Microsoft's Service Pack 2 for Windows XP is ready and the update will soon be available to end users. Which is great.
SP2 is by far the largest service pack we've seen (it's over 250MB in size and quite a download). What's more important, this SP centers around security features only.
From the antivirus point of view, the three most important features in SP2 are:
- Stack & heap protection: this will make it much harder to generate exploits for buffer overflows, such as those used by automatic network worms like Slammer, Blaster and Sasser. We had a look at how Microsoft actually implemented this, and it looks good.
- Built-in firewall. Which is enabled by default, and running right from the boot-up. It will not only prevent access from the outside but it will also warn users when local applications start to listen on specific ports. It won't warn when local applications send data to the internet, though.
- Patched versions of IE and Outlook. As these are the most common tools to access the net, it's important to have them up-to-date.
The end result will be that once patched XPs become commonplace, it will be much harder to create large network worm outbreaks. User-assisted viruses (like email worms) won't go away...and the bad boys will eventually find ways around the safeguards. But nevertheless, this is a big improvment.
As XP is already the most common operating system on the internet, this Service Pack is very important. We hope majority of XP users will apply it soon. This would benefit everybody on the internet.
As as far we know, it hasn't been seen in the wild. However, you can check if your PocketPC device is affected by checking if you have a file called "svchost" in your StartUp folder. Alternatively, you can run our antivirus.
The Mydoom and Evaman virus families are related and are likely coming from a single source. The Mydoom.Q variant we we're fighting last night is actually detected as Mydoom by some antiviruses and as Evaman by others.
We categorize it as Mydoom for now, but this might change.
THIS IS A PUBLIC MESSAGE FROM F-SECURE TO ANYBODY WHO MIGHT HAVE INFORMATION ON THE WHEREABOUTS OF THE PERSON OR PERSONS BEHIND THE MYDOOM VIRUS FAMILY
We are urging anyone who knows the party behind Mydoom variants to contant the authorities, let them know who's behind it and to collect $250,000. Microsoft offered this public bounty reward on Mydoom on March 11th. It's still valid.
If you have information on the origin of Mydoom, you're most likely connected to spamming in one way to the other (as Mydoom is used to create spam proxies). So you should be able to appreciate money. $250,000 is a lot of money. Think about it.
Report all information on the whereabouts of the virus writers behind Mydoom via the forms at Internet Fraud Complaint Center or FBI. Remember to mention that you're interested in collecting the Microsoft bounty. Feel free to report via a remailer using a fake identity and leave an E-Gold account. As long as you report. Do it now.
If you're uneasy about filling forms and sending them to FBI, just contact us. We will work with you. You can reach us at .
Two groups presented interesting antenna hardware in DEFCON last weekend. The Shmoo group premiered a gun-like WLAN antenna with a scope, dubbed "Sniper Yagi". The thing is supposed to be powerful enough to enable connecting to WLAN networks over 15km away. It also makes you look like a madman with an M16.
The Flexilis team presented a similar device for Bluethooth connections. With it, it should be able to connect to Bluetooth phones even if the owner of the phone is standing over a kilometer away.
Do note that antennas resembling assault rifles might be challening to get through airport security nowadays...