Le blog sécurité de Philippe Vialle / Phil Vialle's blog

On ne le dira peut-être jamais assez, toute authentification devrait être sécurisée : au minimum, le mot de passe ne devrait pas transiter en clair sur le réseau ; et cerise sur le gâteau, il devrait être possible d'authentifier le serveur distant.

HTTPS répond à ces problématiques. Pour ce qui est des messageries grand public bien connues, l'on a vu GMail passer de HTTP à HTTPS il y a quelques temps. Et voilà que Microsoft (avec Live Mail) semble suivre le mouvement.

Jusque là, tout irait bien. Seulement, voilà le message qui apparaît quand on se connecte à un compte LiveMail non ouvert depuis quelques temps :

En utilisant HTTPS, nous pouvons sécuriser votre compte, notamment contre les pirates informatiques, si vous utilisez souvent des ordinateurs publics ou des connexions sans fil non sécurisées.

Si vous avez besoin d'une connexion HTTPS temporaire, entrez "https" devant l'adresse Web au lieu de "http".

Ainsi donc, sauf erreur ma part :

- si je force le HTTPS, alors je ne suis plus censé pouvoir utiliser les clients lourds ("intelligents" ou "paramétrables" ?) comme LiveMial (pourtant édité par Microsoft, justement)

- si je veux pouvoir continuer à utiliser LiveMail ou Outlook Hotmail Connector, il faut que je ne force pas le HTTPS, et que je le saisisse manuellement dans l'URL  (avec donc un certain risque de l'oublier...).

J'ai donc décidé de forcer le HTTPS, et ne peux que vous encourager à faire de même... et vais garder un oeil sur le sujet. Je prévois notamment un test avec Thunderbird...

A bon entendeur...!

I was just looking for Google images of an american actor of a serie. Then my browser was trapped, as one of the Google Image results lead it to:

http://www.google.fr/imgres?imgurl=http://www.celebritylatest.com/wp-content/uploads/premieres/marg_helgenberger_mr_brooks_premiere_3.jpg&imgrefurl=http://www.mainstream.fr/img/-%%%%%-dating.html&usg=__grAZHQrnfxcFdhmvNprdLlOKD70=&h=808&w=1000&sz=70&hl=fr&start=17&sig2=jTOL3-NJ0X06PCeKxHJQ0Q&zoom=1&tbnid=SBAcGCvMS_01OM:&tbnh=120&tbnw=149&ei=KJXZTYXXMoub-gbgwuHGAQ&prev=/search%3Fq%3D

and celebritylatest.com has most likely been hacked. Therefore, my browser went to: http://bervert. osa.pl/2.php 

I came to that link:

http://www1.smartyauscanner .co.cc/6zf9gss?jtkay6=jt3j2t6hsNrF1uzyw5vozMWroZeqkOTUxbZpmc7D1Oa2sci6ic3hq5aioZra1Lat6aSH1N3dntfSpsng3dLXkO3lxdxz3dPQ6Nfih9jWoKfAlM7ip6ydj6tpqpuSqaenkq2Z1tXP4trlp6WR2OKasKWYpZrt1eGwl5Keo5mjnKXQl7Jc5%2BCeo6epl6ajlpOjpovW2eHMyudz6uTYpaLswuvYxcna0srYz%2BLexqeipeWP1%2BmfyeTbyp7n1c7T2Zrdxt9z2%2BHV4pmsopqlqYagtMfX3OrQ0%2B1k4uDCoOTlhqe5lY%2Fe1tWW

There is first a nice warning, telling me my computer was at risk of being infected by a malware...

Then, whatever I do, my browser will be send to this webpage:

There is also another URL that does the same:

http://www1.powervorsoft .co.cc/j48zmy?1rdgeik=Vd%2FN1KLSzNjS3Ivn39OvpqGemqHbyKSYj8zS0emiwsm2mN%2Fio6VhqIrW2Kbi5qadx9varNTSss7moN%2FJjdDY2NvhtMfs69Tq2t%2BM15SvqrmL0tutp6mTpKmmoKSmmaJiqora2crf5eK0i%2Bnf06%2BrppmapebQpJmam6WjqJej26WrmePZsWKllJ2WmZ%2Bioq6L1uXc09zdo%2Buo6ZeV2Mrh1dHf0dbb1dfh4suinaTclcrekejg28rTs%2BLl3NjJ3KKY1szLptPk4%2BeKpbeUpLmUmLqT19bdytvfnt7qxqDm25eltZiiodrUiw%3D%3D

Now, obviously, if I click on the "remove all" button (which I do NOT recommend you to do), an exefile shows up as a download... how interesting!

Here is the real URL of the website hosting the file:

http://www2.save-mastermme .byinter.net/qjsh106_328.php?kan9=j87XprDK182Q0ofo3cmvoJ%2BdkdHXnbCUnMaPz9OwxLi5k9nYqJKeb5nQ6aKk45iZ1s7Wqs%2FErsngqODGnNCc2szlscfs4tLd0tGUnNaevLdT1tGwrJegn6CcmZKlbKGSroug4cLn6divk%2BTOz56mcKaH6tmZqpWkpJqmnp%2BW0JenX%2BfUs5ZgnZekpJmkoKSLz9DbmtzPs9yk5JSh58bo0s%2FN18XTn9jP6cpb2ZProsrnk%2BXWz8bPdubU386Q1dKZ5srYqtXZ39GTbLSGqKtSn6fV2dfo0t%2FZmdDhmqHR4opfs5Oh5M3ik%2BDazaTbnbDU29ORs8rf2Yk%3D

What does VT says for this sample, well... only 10 out of 43 engines do detect it :(  and Kaspersky Security Network did not help.

http://www.virustotal.com/file-scan/report.html?id=e8f307051d84cfc90e5d7a7973a5b9a503136771bee9137325719b840ad28ee0-1306104047

More to come (my cat reminds me time's up :) )

Update 1 (24 hours later):

Chromium does alert while trying to access the URL:

Update 2 (48 hours later):

Only 2 URL scanners do detect the URL, according to VT:

http://www.virustotal.com/url-scan/report.html?id=8a27b11a8ec194015b0bd305ca94b5b9-1306353987

And while browsing my disk drive, Kaspersky antivirus did pop up a warning regardng the file that had been downloaded after the "fake antivirus scan":

KAV did not alert by itself, I had to access the folder where the file formerly undetected is.

This proves again it is strongly recommended to let the antivirus software do a full system scan, on a regular basis (at least, very week, or more often if you have any doubt).

While surfing on the web (cf. previous post), I came to download a file that looked suspicious to me: Shopper Report (ShprRprt.exe)

Kaspersky Antivirus 2011, fully up to date, did not detect anything. But the problem is if I leave the file on my desktop, Windows Defender will detect a "adware:win32/ShopperReports"...

Anyway, I decided to put the file into the KAV's quarantine. I failed to find the button "submit sample", but... I did hope it would be submitted automatically.

Well, 48hours after I put the file into the quarantine, KAV told me "there is no danger with the file, Kaspersly suggests me to restore it!"...

Ermf... Altough KAV is up to date, and despite the fact that I accepted to be part of the Kaspersky Security Network (Cloud based antivirus analysis), KAV does not want to detect the sample...

Apparently the KSN did not help. How can a "lambda" user send a sample to the Kaspersky's labs? using GMail you may say? well no, since GMail does detect and refuses exefiles/suspicious files... and Hotmail/YahooMail tend to do quite the same.

Update:

Anyway, I found a mean to send the sample with a GMail account.

There is at the bottom of the Kaspersly labs' webpages the email address to send them a "new virus": newvirus@kaspersky.com

Then, you'll have to rename the file like: "exe" to "ex0". Then you zip it and set a password up (like "infected", very common to send samples to AV labs). Now GMail will accept the attachment. The pasword protected zip will also prevent other third party AV scanners to put the file in quarantine...

There we go!...

PS: for those that my interest, or that have a bit of VX history in mind, it seems that Shopper Report is related to 180Search Solutions, a quite well known malware I had studied in the past... It was said to be a visible part of a kindda mafia...! and there are other stories:

http://www.theinternetpatrol.com/search-marketing-company-180-solutions-sues-affiliates-over-botnet-installation-of-180solutions-software-on-users-computers/?amp;name=search-marketing-company-180-solutions-sues-affiliates-over-botnet-installation-of-180solutions-software-on-users-computers

What about right now?

PS #2: did I expose here a way to bypass GMail's filter for binary files? no way!

Update 2:

I got a reply for my email. They do provide a link to submit samples online:

http://support.kaspersky.com/virlab/helpdesk.html?LANG=en

And there is in fact a tool in the "Kasperky online user's profile", to do the same:

https://my.kaspersky.com/fr/support/viruslab 

I'm waiting for the Lab's response...

Update 3:

48h after I sent them the email, still no answer :(

Update 4 (29th of May, ToW): 

Still no answer for the sample sent by mail :(

But I've also sent a sample using the "My Kaspersky" portal (link: my.kaspersky.com), on the 27th of May, 10PM (Paris Time).

I got an answer, 29th of May 7PM:

Hello,

shprrprt.ex0 - not-a-virus:AdWare.Win32.HotBar.dh
This file is an Advertizing Tool, it is detected by extended databases set. See more info about extended databases here: http://www.kaspersky.com/extraavupdates

Regards, Ilya Simonov
Virus Analyst

Well... the thing is that their FAQ only talks about KAV version 6 and 7. Mine is 11.0.2! Anyway, I did check, and I had already selected those "extra detection features".

I tryed to force the KAV definition update. But still, no detection of my sample. Even 7 hours after I received the mail, and once again forced updates, no detection. 

My guess: the definition update for my sample has not yet been put on the KAV updates servers... but what if I was really infected at the moment?

This is why it is quite important to check if the AV update is indeed available on the vendor's download servers, once you know they created a new signature. Because if you only rely on "AV automatic updates", you may face a few problems because the signature you need is not yet known to the AV product you use, despite its update checks...

Configuration : W7 SP1, KAV 2011

Lorsque l'on imprime une facture depuis un navigateur (type Firefox 4), et via PDF Creator, alors Kaspersky émet une alerte indiquant que "pdfcreator ressemble à PDM.Invader":

Ok, alors si je ne suis pas expert en virologie, "PDM.invader" késako ?

Quel est le risque réel ?

Pourquoi alerter pour une application aussi (re)connue que PDF Creator ? S'il y a un réel problème de sécurité avec ce logiciel, autant être clair et le bloquer réellement, me semble-t-il...

Noyer l'utilisateur sous les messages d'alerte n'est pas forcément le plus efficace, en sécurité.

To those who still believe that downloading a file from "common downloadZ websites", here is (another?) kindda sample of how dangerous it can be for your computer...

First, the video file displays the following message in the Windows Media Player (or in VLC, if it's your default mediaplayer):

But at the same time, it will launch your default web browser:

The text "you are going to play a High Quality Video" seems only to be there to tempt the user...

As you can see, the link at the bottom of the page points to: freaktorrents .info/unlock/downloadvlc.

In fact, it will drive the user to:

Please note that the website will automatically translate to your language (the one of your browser).

What about the VLC they offer in "free download"?

Not only it is an obsolete version according to the filename: 

http://preview.licenseacquisition.org/48/1056428137.51143/vlc-1.0.1-win32.exe

In fact, once the download has started, the last version of VLC arrives on the computer.

But there is another file behind the "download" blue button:

http://origin-ics. clickpotato.tv/IC/GPLCPLite47/16866/0/3a9517da-aa34-46a5-ba0b-72db30c78707/VLCSetup.exe

it is not the real VLC, it is most likely a downloader, which is pretty well detected by VirusTotal! 26 engines out of 42... But surprisingly, neither Panda Cloud nor Immunet Cloud did detect the sample! 

http://www.virustotal.com/file-scan/report.html?id=0c8a5c2a1d472d2b5f7ed0a8f8c63f38acc051416967dc48e43917d88ec96717-1304978623

I find it interesting that this URL seems to appear only once... Probably they record the IP address of the visitor. Typically a VX trick.

So, please keep in mind not to download media files from untrusted websites!

Let's talk a bit more about the vlcsetup.exe:

The funny point I think is that the file is digitally signed! (Pinball Corp, what a name...)

Even legitimate software are often not digitally signed... anyway, the dark side also uses tools to drive user confidence.

Once the file is being run, here is the network traffic it creates:

One request is somewhat interesting:

POST /generate/software/?SAIRND=233525&icbrandid=10&os=5.1&browser=IE.6.0&hdid=00-03-FF-4B-E1-AF&cc=FR&chid=197164&cid=1315344&con=n&ix=gplcplite&v.installername=VLCSetup.exe&v.method=software&v.s=65536&v.rascsi=n&realplayer.code=0&rpwcdesktop.code=0&rpchrome.code=0&rpgoogletb.code=0&clickpotato.code=0&SrS3x.code=0&SrS31.code=0&SrS2x.code=0 

We can see in it, most likely:

- the browser: "IE.6.0"

- the OS (XP): "5.1"

- the MAC address (00-03-FF-4B-E1-AF): 00-03-FF-4B-E1-AF

- the country or keyboard layout: Fr!

- the filename that has been downloaded: ""VLCSetup.exe". This could probably mean the guys have various malicious files reporting to the same server...

- then comes what looks like a software inventory: realplayer.code=0: no realplayer found installed? / rpwcdesktop.code=0: I don't know :( / rpchrome.code=0: no Chrome installed? / rpgoogletb.code=0: no Google Toolbar found? / clickpotato.code=0: no "clickpotato" installed.

Well, it appears they create a profile of the computers...

Let's move on the installation procedure. If you run the file vlcsetup.exe (which I advise you no to do!), the following window will appear, it is obviously quite different from the official/real VideoLan installer!

The button "next" triggers far more than a simple software installation:

- Domain ics.clickpotato.tv

HTTP GET /Software/SrS2xParam01/434/ShprRprt.exe?rnd=2296111 

HTTP GET /Software/QuestScan/496/brand.exe?rnd=2323420 

HTTP GET /Software/ClickPotatoLiteClient01/492/ClickPotatoLiteInstaller.exe?rnd=2340385 

- domain upgrade.questscanone.com

HTTP GET /download/questscan/1_26/questscan-setup.exe 9446 1599.561490

HTTP GET /download/QuestScan/1_27/upgrade.cab?upg=path 

and last! HTTP GET /Software/VLC/466/vlc-1.1.9-win32.exe?rnd=2368105