Well I’m not actually one to squirm or shiver when it comes to ghosts and ghouls and ‘the undead’ that they say rise from the underground and comes out during the night of the 31st of October. It’s quite another thing that I’m pretty anxious about… and it’s really much more ghastly and hellish (in my point of view that is).

What I’m talking about are malwares – and those malware authors who use special events, such as the coming Halloween, as a social engineering ploy to fool unsuspecting users to say, click on a website that’s part of a search query they just made via Google, allowing a bunch of exploits, malwares and spywares to infiltrate the users’ systems – just like a whole gamut of evil spirits that will reside and continually haunt your environment… And this is just what will happen exactly if we didn’t discover the website described below and promptly released solutions for this ghoulish scheme as early as possible.

The site in question is one of the top query results when you search for “Halloween Sites”in Google. Shown below is the top banner that users will see upon entering the site.

And when users click on this link, they’ll find themselves being redirected to URLs using IFRAMEs found at the bottom of the site. These URLs, using malicious scripts, will infect systems with a devilish trojan downloader that uses the filename of win32.exe. The malicious scripts exploit known vulnerabilities which include but are not limited to:

• COM Object Instantiation Memory Corruption Vulnerability – CAN-2005-2127
  
• Microsoft Windows MDAC Vulnerability – CVE-2006-0003
  
• Cursor and Icon Format Handling Vulnerability – CAN-2004-1049
  
• Graphics Rendering Engine Vulnerability – CVE-2005-4560 (aka the WMF vulnerability)

Shown below are snapshots of one of the sites in question where the scripts are escaped and then finally decoded to reveal some of the exploits being used.

The win32.exe file, which can be classified as a variant of TROJ_GALAPOPER, downloads more ghoul codes in the form of JPEG files, which are variants of TROJ_TIBS. These files are actually also downloader executables, embedded inside a .jpg file format. All of these files will install themselves in the system, leaving the computer being compromised by a remote hacker somewhere in Russia. And what’s more, AV detection rate is quite low for the trojans described above. It’s a good thing though, that Trend Micro detects these malwares and also blocks the malicious URLs in its product implementations.

Sneaky?… Yes it is… But the term I prefer to use is Ssscary… Booooooo…

After all, it’s a Halloween Site, right? And if you are afraid of (not of ghosts or ghouls) but of exploits, malwares and spywares that will hound your system, better be careful when browsing unknown sites, this Halloween and everytime for that matter!

NOTE: The site is alive and hosting malcode up to the time of this writing and has been reported to the proper authorities for take down.

If you're new here, you may want to subscribe to our RSS feed. Thanks for visiting!

A proof of concept code for a zero-day vulnerability for myspace.com has just emerged. This vulnerability makes use of XSS fragmentation, which is a seldom used but effective technique that can be employed against social networking sites such as myspace.com.

In XSS fragmentation, script code consists of multiple chunks, instead of a whole unit. By placing the code in fragments, they are less likely to be flagged as a security threat by automated filters or firewalls. XSS fragmentation allows an attacker to inject script code into various sections in a website. In the case of myspace, an attacker could place malicious script code in the user interests section for music and film. Of course, any devious attacker can employ social engineering to maximize the impact of this vulnerability.

Myspace.com is particularly vulnerable because it allows a large volume of user-defined content to be uploaded. Unless such volume of content can be filtered thoroughly, there is always the possibility of uploading content that contains malicious code that could be executed on the user’s system via the web browser.

Darkreading provides us with the in-depth facts of this vulnerability. A working example of this proof of concept can be seen here.