USB dongle auto malwares scanning with clamav

How many of you folks use a USB dongle for his daily tasks? I think most of you, but since this blog is about security & malwares. Today, I’m going to show you a trick using a windows batch file and the portable version of clamav for arming your dongle when you have to copy/move files in a non-secure environment. For me personally, when I need to get a new/additional USB dongle, I prefer the ones that have read-write protection. This is a very effective way to protect your USB when you need to transfer files between you laptop for instance, and other machines. But suppose yours doesn’t support this feature. You need to create some kind of armor around it.

Let’s work:

1) Get the latest copy of ClamAv_Portable for Windows. Download Here (install and rename the folder to ClamWinPortable)

2) Copy the following batch and call it (scan.cmd):

@echo off
set @1=%cd%
echo Updating ClamAV definitions ...
.\ClamWinPortable\App\clamwin\bin\freshclam -v --config-file=".\ClamWinPortable\App\clamwin\bin\freshclam.conf" --datadir="\..\ClamWinPortable\Data\db"
echo Scaning USB for Malwares ...
.\ClamWinPortable\App\clamwin\bin\clamscan.exe --database=".\ClamWinPortable\Data\db" -v --show-progress -u -k --bell --remove -i --detect-broken -l scan-resultes.txt %cd%
explorer.exe %cd%
exit

3) Copy the following auto run instructions and save it as (autorun.inf):

[autorun]
shell\Open\Command=scan.cmd
ShellExecute=scan.cmd

Copy all of these files to the root of your USB dongle, then close the windows, reopen it again and see the magic.

Zlob says: You look really stupid !

Zlob trojan never give up, it's using a multi-directions strategy to infect as much as of systems. We talked recently about one of it's attacks against non-secure wireless/wired routers in the Internet which are left with default passwords. Nowadays, Zlob is trying to use some social engieering tricks, by sending spam e-mails with the subject line (You look really stupid) and the body contains a url to a fake video file with the extension (exe) !

Checklist for system admins:

1. Make sure the current antispam is updated with the latest signatures.
2. Make sure the current antivirus is deployed/updated on all machines. Verify if your vendor is already providing defintions to detect trojan.Zlob and it's variants.
3. Deploy some URL/websites filtering solution to block malicious URLs (e.g Websense). If you already have one installed, create a policy to deny access to any URL which contains video.exe/video1.exe.
4. Turn on antivirus scanning on your gateway firewall, and if it doesn't support this. It's the time to replace it by a decent UTM (e.g Fortigate / Juniper / ASA).
5. User awareness is on your side, send a periodic e-mail which talks about spams, malwares, and other Internet threats. Try to use a simple and friendly language. Also, use a cartoon that talks about computer security to add the sense of humor to it.
6. If you are already running Snort, use this signature to detect the download of the fake video executable: (You need to change the rule to detect different variants like video.exe, video1.exe, or video2.exe ...etc)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Trojan.Zlob Binary Requested (video.exe)"; flow:established,to_server; uricontent:"/video.exe"; nocase; classtype:trojan-activity; reference:url,http://www.symantec.com/security_response/writeup.jsp?docid=2005-042316-2917-99; rev:1;)

other posts about Zlob:

• Use default password, get hijacked
• IFRAME Attacks - Actions to be taken

Use default password, get hijacked

As the title says, use default password on your wireless/wired routers and wait for the new variant of the "Zlob" trojan to infect some machines, then try every default router username/password combinations from http://www.routerpasswords.com/. Or even check this text file, search for your current user/pass to make sure they are not in the list. http://blog.washingtonpost.com/securityfix/zlobpass.txt

Zlob (or as known DNSChanger) will modify the DNS settings to use other rogue DNS servers. These name servers will resolve non-existing domains (typo-squatting) to IP addresses associated with the authors to generate revenue and could potentially re-routes traffic from legitimate web sites to other suspicious web sites.

Countermeasures against DNSChanger:

1. Change your router default password to something complex. Make sure it's long, and contains symbols and numbers.
2. Configure your router to allow management access from specific machine only (e.g, Admin PC), this will prevent infected machines from reaching your router.
3. Update the current firmware to fix any security issues.
4. If possible, change the management port to something else. (e.g, port 80/443 to 555)
5. Configure Syslog/SNMP on the router to watch any configuration modifications or failed login.
6. Rename the admin account on the router, Or see next.
7. Disable/delete admin account, and create another one with different name and password.
8. Deploy an IDS on your network to detect malicious activities (e.g, router user/pass brute force attack / requests to rogue dns servers / video codec downloads )
9. Deploy an URL filtering software/appliance that filters access to any malicious websites/pages that provides codec/fake codecs.
10. Disable UPNP on your router, becuase it's not secure anymore. check here: http://www.google.com/search?hl=en&q=upnp+exploit+router
11. Block access to these IP's (85.255.116.164 / 85.255.112.81)
12. Use Purenetwork Security scan for wireless networks, http://www.purenetworks.com/securityscan/
13. Keep your machines up-to-date. Most malwares targets a specific vulnerability to reach the system.
14. Get legitimate video codecs, install them on your machines, and inform your users that their machines are ready to play any video format and there is no need to download codecs from untrusted sites. check http://www.free-codecs.com/download/K_lite_codec_pack.htm

Safe browsing ... :)

Stop malwares using device control: A real life experience

If your one of those administrators who hardly try to keep their networks clean and prevent the next malware from infecting their systems, this is definitely for you…

Spending thousands of dollars on security solutions to protect the enterprise from the outside alone is an outdated concept. If you want to ask anyone works in the security arena? What are the main sources of malwares today? He’ll probably answer this: e-mail spam, websites, and removable drives. I’ve been dealing with anti-anything (malwares, viruses, worms, rootkits) since a long time, and I used to judge on the network security from the antivirus server logs and reports. Because these logs will give a lot of details, such as the name of virus, the path on your system, from where it came, etc. And most of the time, I see viruses detected inside the removable drive root folder. And thanks to Windows “Auto Play”, which is used to inspect the type of files and choose the suitable software to open them. With this, malwares are getting executed every time you plug your flash drive in your computer. So to start talking about this, many vendors today start to provide additional module to their software which controls local system devices based on a policy. For example, Symantec Endpoint Protection 11 is my choice today to protect endpoints. I can block every single device/interface in the machine. Such as USB dongles, Bluetooth, PCMCIA, wireless, ports, com, etc. I had one customer who was struggling to stop malwares, and depending on the installed AV alone was a losing game. So I checked the daily logs of the AV server, and I was surprised due to the high number of viruses which had been detected on users' USB dongles!.

I have to admit that this customer is more happier than before, because malware infections have decreased by 70% once we blocked all insecure devices.

A replacement for using USB dongles inside corporate network is using a secure file sharing server which has multi-antivirus scanner installed to check for infected dongles and heal them. Then the user copies/moves his files to/from this server without endangering the LAN. His company has accepted this and the life is still going with/without USB dongles :)

Block malware domains using Squid

Today we'll see how we can start filtering malicious websites using Squid as an example. Squid cache is a popular open source web proxy server and web cache software. If you don't want a complex solution, you can use malwaredomains.com black lists and a small batch file to generate copy-and-pase Squid ACL's to filter the unwanted.

Let's Start:

1) Download the complete file from this link domains.txt

2) Use MS Excell to filter and save URL's:

- open domain.txt

Now select the domains in the first column and paste them into a text file, call it block.txt

3) Use this batch file to import URL's from block.txt and convert them to Squid ACL's

@echo off
for /f %%a in (c:\block.txt) do echo acl blocksites dstdomain %%a >> c:\squid-acls.txt
notepad c:\squid-acls.txt
exit /b

append the output to the squid conf file like this:

acl blocksites dstdomain koolkatalog.com

acl blocksites dstdomain prostol.com

acl blocksites dstdomain alwaysupdatednews.com

acl blocksites dstdomain cometsystems.com

acl blocksites dstdomain sdsauto.ru

acl blocksites dstdomain googkle.com

acl blocksites dstdomain loadcash.biz

http_access deny blocksites

Save and close the conf file, Restart Squid:

# /etc/init.d/squid restart

you're done ;)

Managed Security Services: the home-users edition

If you think about security problems nowadays, it would be either corporate security problems, or home-users security problems. Most security vendors are focusing on the first one, because simply there is the cash. But who will help the clueless end user, who got his new laptop or desktop and he has nothing to do with Internet security. Ok, you may tell me that OEM shipped computers come with antivirus already installed there. Stop! Norton Antivirus has to be activated before it starts working. Also, evaluation versions run for 1 month, or 2 months. Then what? It will stop updating definitions or even stop working at all. Here where the problem starts, end users have to be managed somehow by someone. The nearest one is their lovely ISP. ISPs can play an effective role here, because the user is connecting through their proxy servers, DNS servers, web filtering servers …etc. But what if we add one more server to this mix, an Antivirus server! Let their marketing departments start new campaigns (ex. AV for everyone), gain more money, and build a secure Internet users community at the same time.

Technically, it’s not more than installing a corporate edition antivirus (clients/server) and deploying the agents to the paying customers who preferred to leave the antivirus management to the ISP’s technical support. What are the advantages of such a service? Well, it will fix many issues, such as (commercial AV licensing, insecure default AV installation, corrupted AV files which may stay for ever showing bogus notifications, updating definitions using the ISP hosted server which will defeat local poisoned AV vendor’s domain record (ex. Update.symantec.com ---> 127.0.01) which makes virus definitions update is impossible.

I hope that ISPs start taking some responsibility and stand beside their users, which make them better than the others.

If you have any comment, share it with us here …

U.N site took the injection

U.N site is another victim of SQL injection attacks, when a user browses the site events page, he will get redirected to (www.nihaorr1.com/[removed]). The "1.js" redirects the user to another page "1.htm", once loaded it will try to exploit the following vulnerabilities:



Vulnerability in Kodak Image Viewer Could Allow Remote Code Execution (Critical)

http://www.microsoft.com/technet/security/Bulletin/MS07-055.mspx

Cumulative Security Update for Internet Explorer (Critical)

http://www.microsoft.com/technet/security/Bulletin/MS07-033.mspx

Vulnerabilities in Microsoft Content Management Server Could Allow Remote Code Execution

http://www.microsoft.com/technet/security/Bulletin/MS07-018.mspx

Vulnerability in Vector Markup Language Could Allow Remote Code Execution

http://www.microsoft.com/technet/security/Bulletin/MS07-004.mspx

Vulnerability in the Microsoft Data Access Components (MDAC) Function Could Allow Code Execution

http://www.microsoft.com/technet/security/Bulletin/MS06-014.mspx

The Baofeng Storm MPS.StormPlayer.1 ActiveX control heap-based buffer overflow

http://xforce.iss.net/xforce/xfdb/36543

GLChat Stack-based buffer overflow

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5722

Baidu Bar ActiveX Control Remote Command Execution

http://www.frsirt.com/english/advisories/2007/2699

Real Player RAM Download Handler ActiveX Control

http://www.frsirt.com/english/advisories/2005/0368/references

http://www.snort.org/pub-bin/sigs.cgi?sid=8383

http://www.snort.org/pub-bin/sigs.cgi?sid=8384


Finally, it will redirect the user to another two pages that serve malwares: (gg.haoliuliang.net/one/ hao8.htm?036) and (gg.haoliuliang.net/wmwm/ new.htm).

Mitigation checklist for system administrators:

1. Make sure all windows machines are up-to-date, use WSUS to distribute patches and critical updates. Use Microsoft Baseline Security Analyzer (MBSA) to scan for missed patches and vulnerable security settings.
2. Make sure all installed applications and softwares are up-to-date, you can use Secunia Network Software Inspector to check for vulnerable softwares.
3. Secure the ActiveX settings of Internet Explorer, check here IE ActiveX security 101. Also check the "ActiveX Killpit App" from Tom Liston of Intelguardians.
4. Block all http requests to http://www.nihaorr1.com/blah.js [replace blach.js with 1.js]
5. Make sure your Antivirus vendor has signatures for W32/PWStealer1!Generic; PWS:Win32/Lineage.WI.dr; Trojan-PSW.Win32.OnLineGames.ppu; Trojan.PSW.Win32.OnlineGames.GEN