January 2008 - Posts

mayoclinic.com hit by malicious banner advert?

This incident was reported via a comment on this blog. 

We have not found the malicious advertisement yet, but we can tell you that victims who are caught by the hijack when visiting mayoclinic.com end up being redirected to:
quinquecahue.com/swf/gnida.swf?campaign=fabulistor&u=1200910285

We can also tell you that this particular campaign (fabulistor) is coded to NOT trigger when the victim's computer falls within the following IP addresses or is located in the following US States:

129.176.0.0-129.176.255.255
172.21.0.0-172.21.255.255
Minnesota, California, New York, New Jersey, Arizona, Florida

Note that mayoclinic.com's IP address is 129.176.217.6

 

Spyware Sucks is accepting donations, with thanks.


A couple more malicious banner advertisements...

The bad guys are certainly expanding their stable of advertisements.

Both lead victims to malicious quinquecahue.com URLs.  More later... 



 

expedia.com hit by malicious banner advertisement?

Expedia.com has been infiltrated by a malicious banner advertisement - a new one that I have not seen before.

Victim site Expedia.com (216.251.114.10)
SWF host media.expedia.com
SWF Source  
Target fraudware domain scanner2.malware-scan.com
Banned cities, countries and IPs 199.3.0.0-199.3.255.255
216.251.0.0-216.251.255.255
172.30.0.0-172.30.25.255 (note: expedia.com's IP is banned)

IN, IL, UK, AU, FR, IT, CN, JP, DE, ES, MX, AE

colorado, washington, california, massachusetts, ontario, texas, hawaii, missouri, illinois
Permitted cities, countries and IPS  
SWF URL media.expedia.com/ads/FXSound/728x90.swf
Special notes  
Incident reported to expedia.com
Resolution  
 

Let's have a look at the danger path:

URL Referrer
scanner2.malware-scan.com/18_swp/?tmn=null&aid=&lid=&affid=&ax=&ed=&aid=pygmalioni_
ma18_mb1t&lid=728&affid=&ax=1&ed=2&mt_info=
3958_0_1349prevedmarketing.com/?tmn=mwatmp&aid=mi1eroof&lid=728&ax=1&ed=2
&mt_info=4957_3064_2358
prevedmarketing.com//?tmn=mwatmp&aid=pygmalioni&lid=728&ax=1&ed
=2&mt_info=5337_4168_2358
blessedads.com/?cmpid=pygmalioni&adid=728quinquecahue.com/statss.php?campaign=pygmalioni&u=1200655836
quinquecahue.com/swf/gnida.swf?campaign=pygmalioni&u=1200655836
quinquecahue.com/swf/gnida.swf?campaign=pygmalioni&u=1200655836 quinquecahue.com/statsg.php?u=1200655836&campaign=pygmalioni
quinquecahue.com/statsa.php?u=1200655836&campaign=pygmalioni media.expedia.com/ads/FXSound/728x90.swf

So, let's take a look at this new name, quinquecahue.com.

Not surprisingly, the malicious domain is hosted by, you guessed it, securehost.com (190.15.64.190):
http://www.robtex.com/dns/quinquecahue.com.html

Who else might we find in that IP range...
http://www.robtex.com/cnet/190.15.64.html

Again, no surprise, we see akamahi.net, newbieadguide.com, vozemiliogaranon.com and a name I have not seen before, familyislands.com.

Check out the domains sharing nameservers with quinquecahue.com - I *know* you're going to recognise many names....

domains sharing nameservers
 
advancedcleaner.com
akamahi.net
antispywaresuite.com
antiviruspcsuite.com
antiworm2008.com
avsystemcare.com
bestsellerantivirus.com
diskretter.com
elmejorantivirus.com
erreurchasseur.com
exterminadordevirus.com
moncontenuassistant.com
schijfbewaker.com
securepccleaner.com
spyguardpro.com
storageprotector.com
systemdoctor.com
thetechnorati.com
toolsicuro.com
vozemiliogaranon.com
winspycontrol.com
yourprivacyguard.com

 subdomains
*.quinquecahue.com
ns1.quinquecahue.com
ns2.quinquecahue.com
ns3.quinquecahue.com
ns4.quinquecahue.com
 

rhapsody.com hit by malicious banner advertisement

rhapsody.com has been hit by a malicious banner advertisement - rhapsody.com is owned by RealNetworks.

 

Victim site rhapsody.com (207.188.21.32)
SWF host RealOne / Doubleclick
SWF Source  
Target fraudware domain scanner2.malware-scan.com
Banned cities, countries and IPs 207.188.0.0-207.188.255.255 (note this IP range captures rhapsody.com)
newjersey, newyork, california, washington, virginia
paris, aarhus, velizycedex, jarrestr, amsterdam, rotterdam, zaanstad, koogaandezaan, seattle
Permitted cities, countries and IPS US, NL, FR, SE, DK, NO, UA
SWF URL i.realone.com/ads/Rollingstone/1_skyauction_728x90.swf?clickTag=http: // ad.doubleclick.net/click%3Bh=v8/3652/3/0/%2a/x%3B177176445%3B0-0%3B0%3B12874614%3B3454-728/90%3B24358245/24376098/1%3B%3B%7Eaopt%3D2/1/ff/0%3B%7Esscs%3D%3fhttp: // www.skyauction.com/?id=384231
Special notes
Incident reported to Doubleclick
rhapsody.com
Resolution  

 

As always, let's work backwards from the final target site. 

URL Referrer

scanner2.malware-scan.com/9_swp/?tmn=null&aid=&lid=&affid=&ax=&ed=&aid=mi1eroof_ma9_mb1t&lid=728&affid
=&ax=1&ed=2&mt_info=3958_0_13496

prevedmarketing.com/?tmn=mwatmp&aid=mi1eroof&lid=728&ax=1&ed=2&mt_info=4957_3064_2358

blessedads.com/?cmpid=mi1eroof&adid=728

newbieadguide.com/statss.php?campaign=mi1eroof&u=23423424


newbieadguide.com/swf/gnida.swf?campaign=mi1eroof&u=23423424

newbieadguide.com/swf/gnida.swf?campaign=mi1eroof&u=23423424

newbieadguide.com/statsg.php?u=23423424&campaign=mi1eroof
newbieadguide.com/statsa.php?u=23423424&campaign=mi1eroof i.realone.com/ads/Rollingstone/1_skyauction_728x90.swf?clickTag=http: // ad.doubleclick.net/click%3Bh=v8/3652/3/0/%2a/x%3B177176445%3B0-0%3B0%3B12874614%3B3454-728/90%3B24358245/24376098/1%3B%3B%7Eaopt%3D2/1/ff/0%3B%7Esscs%3D%3fhttp: // www.skyauction.com/?id=384231
i.realone.com/ads/Rollingstone/1_skyauction_728x90.swf?clickTag=http :// ad.doubleclick.net/click%3Bh=v8/3652/3/0/%2a/x%3B177176445%3B0-0%3B0%3B12874614%3B3454-728/90%3B24358245/24376098/1%3B%3B%7Eaopt%3D2/1/ff/0%3B%7Esscs%3D%3fhttp: // www.skyauction.com/?id=384231 rhapsody.com/-search?query=U2&searchtype=RhapArtist

 

Screenshot of malicious SWF - yep, its the infamous Skyauction advertisement - again

image

akamahi, newbieadguide, thetechnorati and vozemiliogaranon move on again

The malware domains we have been featuring have moved on again - they are no longer hosted by Denit Internet Services, Amsterdam.

But it looks, this time, like the bad guys need a break from moving to host to host to host Cool

akamahi.net (190.15.64.185) (securehost.com)
newbieadguide.com (190.15.64.188) (securehost.com)
thetechnorati.com (190.15.64.191) (securehost.com)
vozemiliogaranon.com (190.15.64.192) (securehost.com)

Now remember, there is a slew of malicous domains hosted within the IP range 190.15.73 (also securehost.com), so we are not at all surprised that the bad guys have come to rest there.

To recap, first the domains were hosted by nine.ch but were dumped after the malicious advertisement that appeared on blick.ch, then they were briefly hosted by netrouting.eu, followed by FastServers, then by Denit Internet Services.

I think the next thing that we need to consider, bearing in mind the deep involvement of securehost.com in facilitating the distribution of fraudware, is to include SecureHost's upstream provider in any complaints about the hosted domains. 

Securehost may ignore complaints from the world at large, but if *their* bandwidth provider threatens to pull the pin, well that can be much harder to ignore...

Is it any surprise somebody has gotten grumpy and has been subscribing one of my public email addresses to a slew of mailing lists?  Oh well, if they want to devote valuable time to such games, then they're welcome to waste it - it will only take me only a few seconds to set up some appropriate mail rules to automatically delete the results of such shenanigans once I decide that the game is boring - there are plenty of common, yet unique, characteristics in "welcome to; you have joined; you have subscribed" email messages that make filtering too easy Geeked

 

This is too easy.....

IP 83.149.75.50 detected as subscribing one of my email addresses to a mailing list without permission.

Reduce it down to 83.149.75... do a Google search.. and what do we find?   Connections with malware.... "malwarewipe.com"????

http://board.protecus.de/t25767.htm

"http://malwarewipe.com/images/blue-gray-stripe.gif - deleted
http://83.149.75.51/count/l.php?pl=Win32&ce=true&id=rrd - deleted
http://www.surveyswages.com/img/laptop9.gif - deleted

http://dl.web-nexus.net/exclurls.php

"83.149.75." is a blocked IP.

Coincidence? 

What's cool is that I have only scratched the surface so far..... I have a mild interest in what's going on ... along the lines of "let's check this out just in case there's something newsworthy" but let's be honest... who gives two hoots about being subscribed to mailing lists... so many people have tried the "let's subscribe somebody we don't like to lots and lots of mailing lists" trick that it's a boring topic.

Let's see what happens over the next few days. Who knows, *they* may do something else mildly interesting, or something really dumb that we can giggle at, otherwise, I won't bore you with the details.

 

Oooh, look, a IP address.....

Keep 'em coming friend.  *Everything* is traceable eventually.

image

83.149.75.50 = LeaseWeb AS Amsterdam, Netherlands.... why am I not surprised?  The Netherlands has popped up several times in my recent articles about malware domains....

image

Somebody is having fun...

I admit, when I saw the following emails come in I assumed it was the typical "infected computer spewing out emails using me as a reply to" that we are all used to, and delete as a matter of course, until I saw the one from rollins.edu. That seems to be the result of an online form which requires actual input.

I confess to being disappointed... I expect my combatants to show, at the very least, a tiny glimmer of originality.

Oh well, you know what they say - small things amuse small minds.

 

That's right - this wasn't me:

 image

Nor this one...

 image

Nor this one....

image

 

Spyware Sucks is accepting donations, with thanks.

Posted by sandi with no comments
Filed under:

Unable to uninstall IE7 if Service Pack 2 is installed later on Windows Server 2003

In order to uninstall Internet Explorer 7 from this system, you can follow the steps below:

1. Uninstall Service Pack 2 for Windows Server 2003 and restart the computer.

2. Uninstall Internet Explorer 7.0 and restart the computer.

3. Reinstall Service Pack 2 for Windows Server 2003.

http://support.microsoft.com/default.aspx/kb/948093

 

Posted by sandi with no comments
Filed under:

Nice publicity for Spyware Sucks

Spyware Sucks was linked to by the MCPM (Microsoft Certified Professional Magazine and the "Redmond Security Watch" email newsletter:

http://mcpmag.com/columns/columnist.asp?columnistsid=16

"ESPN Sports Bad Code
ESPN's Soccernet site
hosted a malicious advertisement that, ultimately, led to PerformanceOptimizer.com, which in turn displayed numerous popups alleging problems with the victim's system and offering a solution.

Yep -- ad networks strike again! It simply amazes me how willing sites are to allow someone else to decide what its customers are going to see when they come to a site. That's precisely what you’re doing if you subscribe to an ad network. Revenue is a necessary component to any successful Web site, but there needs to be some additional steps taken to ensure your customers' experiences on your own site are good ones."

Cool!

Spyware Sucks is accepting donations, with thanks.



Posted by sandi with no comments
Filed under:

Best Buy sold infected digital picture frames

Source: 
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9058638&source=rss_news50

Check out what Insignia had to say in their alert:
http://www.insignia-products.com/news.aspx?showarticle=13

"It recently came to our attention that a limited number of Insignia 10.4” digital picture frames (model number NS-DPF-10A) were contaminated with  a computer virus during the manufacturing process. Once informed, we immediately pulled all units of this product from stores and retail web sites as a precautionary measure to protect our customers.  This product has been discontinued, and no additional inventory will be sold.  Please note that no other Insignia digital picture frame products are affected by this issue.
 
However, some affected units were purchased at a Best Buy store or from
www.bestbuy.com before the issue was detected. While this is an older virus which is easily  identified and removed by current anti -virus software, we are taking this situation seriously.  We apologize for the inconvenience that has been caused as a result of this incident."

I always ignore niceties such as "a limited number" - the fact that it occurred in the first place is bad enough; please don't try to make things sound better by saying "oh, but it was only a limited number".

The most glaring question I have is, if the "computer virus" is "an older virus which is easily identified and removed by current anti-virus software", then how the heck did the infection get past their own antivirus protection, and quality assurance, or is it that they don't they have any?

Insignia have not shared information about exactly what infected the frames, and I haven't been able to find any further information.

Sun Java has issued an update that includes security fixes

Source: http://blog.washingtonpost.com/securityfix/2008/01/massive_java_update_includes_s.html

I think it's worthwhile discussing a point that was raised in a comment made about the above article - specifically the comment made by the charmingly named "BelchSpeak", wherein he said:

"As a reminder, new versions of Java do not uninstall old ones automatically. This preserves some backwards compatibility issues with the software and older java applications that were version specific.

However, malware can make calls to older versions that still reside on your system, and many trojans are spread this way. Unless you know that you need an older version, you should uninstall all older versions from the system."

I am not certain that the above comment about malware being able to make calls to older versions is still correct.  I know that in the past it was an issue, but I am sure that this problem was resolved around 1.5.06 or something like that.

Ah, here we go:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1

"Prior to 5.0 Update 6, an applet could specify the version of the JRE on which it would run. With 5.0 Update 6 and later installed on the Windows platform, all applets are executed with the latest version of the JRE."

But, the advice comes with a disclaimer.  Java WebStart behaves differently.

"Prior to 5.0 Update 6, an application could specify the version of the JRE on which it would run. With 5.0 Update 6 and later installed, unsigned Java Web Start applications that specify a version other than the latest installed will trigger a warning, requiring explicit user permission before the application will run. Signed Java Web Start applications are not affected.

We should also examine this documentation:
http://java.sun.com/javase/6/webnotes/family-clsid.html

"As of JRE 5.0 Update 6, you can no longer specify the exact JRE release due to the potential misuse of static versioning. Instead, all Java applets are run using the latest version of the JRE software that is installed on the system. Note that this new behavior will not change if, after installing JRE 5.0 Update 6 or a later release, you then install an earlier JRE release. For details of the related Sun Alert, see http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1.

Because you can only use the latest version of the JRE software that is installed on the system to run Java applets, you must migrate your software to the latest JRE version as soon as possible.

This change might break existing Java applets that cannot be immediately migrated to the latest JRE version. For this reason, the JRE 5.0 Update 7 release introduces an interim solution that enables these Java applets to run with a specific JRE family version. As such, you can keep your existing deployment working while migrating your Java applets to the latest JRE version."

If I'm reading the document correctly, it is possible to work around the security introduced with 1.5.06 and specify a JRE "family" (eg: 1.4.2, JRE 5.0, or JRE 6), but not a specific version within that family.  In addition, there are "security baselines" in force  which consist of the version number of the latest release for each JRE family that is available when the latest JRE family is built.  If the latest release for the JRE family in question is installed, then that is what is used. If it is not installed, the user sees a warning, must specifically approve the applet to run, but more importantly the user is also given the opportunity to install the latest release.

So, is BelchSpeak's advice correct?  When I first read the comment, and responded, on Brian's page, my thinking was that advice is incorrect.  Now, I see that it is correct, but only with the proviso that the user must specifically approve the applet to run and ignore the prompt to update.  The most problematic versions of Java in each family are certainly below the security baseline, so there are layers of protection there.

That being said, each build of Java takes up over 100 megabytes of space on a hard drive and I generally remove old builds for just that reason.

 

Spyware Sucks is accepting donations, with thanks.



 

Windows Internet Explorer 7 to be distributed via WSUS February 12, 2008; May require administrator action to manage the rollout

It is important to highlight the change highlighted in the Knowledgebase article below because of the brouhaha that occured when, if my memory serves me right, Windows Desktop Services (Windows Desktop Search) was released as an Update Rollup.  Because of a combination of circumstances (including a non-default approval setting), WDS was auto-approved on some networks, sometimes leading to severe system slowdowns.

Some WSUS administrators started screaming blue murder, it was picked up by the popular press and Microsoft was the target of heavy criticism.

Microsoft have learned from that incident, and are warning administrators via the KB article that if they have changed their auto-approve settings for Update Rollups then their users may receive IE7.

Source: http://support.microsoft.com/default.aspx?scid=kb;EN-US;946202

"If you have configured WSUS to "auto-approve" Update Rollup packages (this is not the default configuration), Windows Internet Explorer 7 will be automatically approved for installation after February 12, 2008 and consequently, you may want to take the actions below to manage how and when this update is installed. You will need to take action if:

• You use WSUS 3.0 to manage updates in your organization. 

• You have Windows XP Service Pack 2 (SP2)-based computers or Windows Server 2003 Service Pack 1 (SP1)-based computers that have Internet Explorer 6 installed. 

• You do not want to upgrade Internet Explorer 6 machines to Windows Internet Explorer 7 at this time.

• You have configured WSUS to auto-approve Update Rollups for installation."

Ok, we have been warned.  Fingers crossed there won't be screaming from the battlements this time...

Posted by sandi with no comments
Filed under:

Akamahi, newbieadguide and thetechnorati.com move on to new hosts

It seems that FastServers may have finally acted because the malicious domains akamahi.net, newbieadguide.com and thetechnorati.com have moved on to new hosts.

That being said, according to a search conducted just a few moments ago, vozemiliogaranon.com is still hosted by FastServers.

akamahi.net  81.93.56.55 (Denit Internet Services, Amsterdam)
newbieadguide.com 81.93.56.68  (Denit Internet Services, Amsterdam)
thetechnorati.com 81.93.56.69 (Denit Internet Services, Amsterdam)
vozemiliogaranon.com 81.93.56.70 (Denit Internet Services, Amsterdam)

This time I think we will contact the US based company that is providing name servers:

NS ns1.akamahi.net 208.79.82.50 208.79.80.0/22 Tranquil Hosting, Inc
NS ns2.akamahi.net 208.79.82.66 208.79.80.0/22 Tranquil Hosting, Inc

Tranquil Hosting have terms of service that seem to apply to this situation.

Denit Internet Services do have a General Conditions which seem to apply to this situation.

So far I have found several generic contact addresses, including info@denit.net; support@denit.net; sales@denit.net; admin@denit.net; and domainreg@denit.net.

The only addresses I have found for Tranquil Hosting so far are:

domains@tqhosting.com; info@tqhosting.com; support@tqhosting.com

Emails are about to be sent to all contacts.  Watch this space for future developments.

 

FastServers - let's try again

As we know, FastServers are hosting several malicious domains and are therefore facilitating the distribution of fraudware via malicious banner advertisements.  To recap, the following domains, akamahi.net, newbieadguide.com, thetechnorati.com and vozemiliogaranon.com, all resolve to IP addressed owned by FastServers.

I wrote to FastServers on 12 January 2007 providing comprehensive historical information about malicious behaviour associated with those domains, and many links to articles on my blog.  I wrote to many different email addresses at FastServers, and did not receive any NDRs.

10 days have passed, and the status quo has not changed.  Therefore, it is time to write to FastServers again.  But this time, we have some more ammunition to add to the correspondence.

I wrote to all email addresses again tonight, so now we wait.

As I noted on my blog earlier today, the Washington Attorney General’s consumer protection bills is to be heard in committee Monday and Tuesday this week.

One bill is very pertinent to the malicious banner advertisement problem, and especially relevant to web services who host content related to fraudware.

HB 2879 would remedy loopholes and weaknesses in Washington’s Computer Spyware Statute, RCW 19.270.  The bill is scheduled for public hearing at 10 a.m. Tuesday, Jan. 22, in the Committee on Technology, Energy and Communications. First I will quote from the atg.wa.gov web site, highlighting some pertinent sections (http://www.atg.wa.gov/2008Legislation.aspx)

"Washington’s Computer Spyware Statute, RCW 19.270, has several loopholes and weaknesses. These include an intent requirement for certain violations that burdens enforcement authorities, murkiness in some of the definitions of unlawful practices, a lack of enforcement authority against those who knowingly facilitate or procure the sending of spyware, and the absence of language in the statute prohibiting deceptive conduct that has emerged since the statute was originally passed.

The Attorney General’s Office has requested legislation to remedy loopholes and weaknesses in the state’s Computer Spyware Statute.

The proposed legislation:

Removes onerous requirements that hinder ability to prove cases against violators;
Creates liability for Web hosting services who ignore violators’ use of their products or merchants who pay others to violate the law;
Adds violations for new forms of spyware; and
Clarifies the standards for proof of violations and the circumstances under which actions may be brought.
"

Now let's look at the actual Legislative Agenda:
http://www.atg.wa.gov/uploadedFiles/Home/Office_Initiatives/Legislative_Agenda/2008/Protecting_Consumers_from_Spyware.pdf

"The Attorney General’s Office has requested legislation to remedy loopholes and weaknesses in the state’s Computer Spyware Statute. The proposed legislation would do the following:

Remove the following requirements:

• parties who bring actions under the act must prove defendants “intended to deceive” for any of the following violations to have occurred:

– unauthorized modification of computer settings (i.e. settings for opening pages, search engines, bookmarks and toolbars);

– misrepresentation that computer software will be uninstalled or disabled by an owner’s action;

– misrepresentation that software is necessary for security, maintenance, repair or privacy reasons;

• “all” keystrokes must be logged in order to prove a violation, or that the information obtained through keystroke-logging be correlated with the Web sites visited by the owner or operator; and

• in order to prove a violation based on preventing a computer owner or operator from disabling or blocking the installation of software, the software must be automatically reinstalled after the attempt to block or disable it.

Create liability for:

• Web-hosting companies who know or consciously avoid knowing their services are being used to violate the statute, and who participate or ratify the unlawful activities; and

• those who procure the transmission of spyware (i.e. merchants who pay others to send spyware on their behalf).

Add violations for:

• disabling a computer software program’s ability to automatically update;

• changing the toolbars or buttons on an Internet browser;

• using the computer as part of a bonnet;

• using the computer as a proxy to send commercial email or a computer virus; and

• inducing an owner to install software by sending a message whose source is misrepresented.

Clarify:

• the standards for proof of violations by collapsing two current sections of the statute into one provision; and

• the circumstances a software provider, trademark owner and Web site owners may bring an action."

 

More stuff about TimeTrack Media

I have a copy of an email from TimeTrack Media here - you may recall that somebody wrote to me about TimeTrack a short while ago and said:

"After being tricked by proximogroup.com, we received an email from TimeTrack Media overseas. The emails we received were a little weird, so I wanted to investigate a little- lo and behold, what ad had they send us- QPad! Thanks so much for posting it on your site. I'm not sure if you're familiar with TimeTrack, but it seems like they might be another culprit."

http://msmvps.com/blogs/spywaresucks/archive/2008/01/18/1467915.aspx

To repeat what I said earlier, preliminary investigations do raise some concerns about TimeTrack Media and the SWF that was supplied.

Strike 1:
TimeTrack Media (timetrackmedia.com - IP 66.235.160.203) is registered using ESTDOMAINS, a Registrar with a strong association with various fraudware/malware web sites.   So, that is a strike against TimeTrack Media right there.

Strike 2:
The WHOIS information for TimeTrack Media is hidden behind PrivacyProtect.org, another well-known, oft used tactic used by malware/fraudware pushers.

Strike 3:
The only contact provided at the web site is a web form - no names, no email addresses.

As I noted in my other blog entry about TimeTrack Media, the above information is suspicious, but we can't make any definitive ties with malicious past behaviour.

So, now let's look at the message headers from an original email sent by an alleged Business Development Manager of TimeTrack Media - information has been redacted to protect the identity of the person sending me this information:

Received:  from clickopt.info ([66.235.160.203])  by [[REDACTED]] with ESMTP; [[REDACTED]]
Received:  from clickopt.info ([66.235.160.203]) by clickopt.info with esmtpa (Exim 4.68 (FreeBSD)) (envelope-from <rudi@timetrackmedia.com>) id [[REDACTED]]
Received:  from 66.235.160.154 (SquirrelMail authenticated user rudi@timetrackmedia.com) by clickopt.info with HTTP;[[REDACTED]]
Return-Path: <rudi@timetrackmedia.com>

Now things are getting interesting.  Who is IP address 66.235.160.154?  That IP resolves to "hotest-tgp-pics.com", and I recognise that name.

http://www.robtex.com/ip/66.235.160.154.html
http://www.robtex.com/dns/hotest-tgp-pics.com.html

A while back there was an incident with a malicious advertising campaign that hit www.whitepages.com.  This is what I quoted at the time:

"we often use whitepages.com in our work, going as far as leaving it open all day. starting yesterday our virus scanners noted several attempted malware installations. They appear to be coming from a banner ad that is in rotation. The address of the ad itself is hXXp:// hotest-tgp-pics.com / ?id= booker and that redirects to other pages that attempt to autoinstall the malware without user intervention. the 2 sites I have seen so far are hxxp:// scanner.malwarealarm.com /5/?advid= 1500 and hxxp:// scanner.spy-shredder.com /4/? advid= 1553. I sent an email to abuse@whitepages.com and webmaster@whitepages.com but have not yet received a response."

http://msmvps.com/blogs/spywaresucks/archive/2007/08/22/1128996.aspx

I also find this:

"They seem to have hacked the site wunderground.com. When you click http: // www.wunderground.com/global/stations/08181.html?bannertypeclick=miniWeather2 (apparently only the three or four first times you do running) they resend you to http : // hotest-tgp-pics.com/?id=voodsky."

http://www.spywareguide.com/product_show.php?id=2741

And this:

"When accessing a page on BSWiki just now, I ran into a very annoying advertisement. Before the page had even loaded, I was redirected to hotest-tgp-pics.com (not even in a new window or tab, so it overwrote the page I was viewing), which in turn resized my window to minuscule proportions, then put up a message box over it. Because my PC is slow, I can follow this, but on a fast PC it would seem like my browser window had disappeared. The message box was a misleading advertisement from SystemDoctor, stating there were errors in my Registry (I'm running Linux, so I don't even have a registry) and telling me to click OK if I wanted SystemDoctor to check my non-existent registry, or click Cancel if not. After clicking Cancel, I was led to SystemDoctor's download page. I used the Back button to go all the way back to BSWiki, where I finally got to view the page I was visiting in the first place. When I (voluntarily) revisited hotest-tgp-pics.com, I got a similiar advertisement from ErrorSafe, which was just as misleading and annoying as SystemDoctor's. A third visit led me to errorprotector.com, advertising (less obtrusively, though) a product similar to ErrorSafe and SystemDoctor."

http://en.battlestarwiki.org/wiki/Battlestar_Wiki:Administrators'_noticeboard/Archive5

And this:

"I did run Panda and I got a few infections that I subsequently just deleted the below files and BHO but the redirection continues:

Adware:Adware/WurldMedia Not disinfected C:\WINDOWS\system32\mobho.dll
Adware:Adware/ShoppingCommunity Not disinfected C:\WINDOWS\system32\moconfig.exe
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

//hotest-tgp-pics.com/?id=voodsky and
//errorsafe.com/pages/scanner/ind...p;ex=1&ed=2

//Mod edit to disable hot links above.//"

http://www.bleepingcomputer.com/forums/lofiversion/index.php/t86493.html

Of course, all this does is show a connection between TimeTrack Media and hotest-tgp-pics.com.  We can't draw a definitive conclusion about whether TimeTrack Media are victims, or knowing participants.  That being said, it continues to amaze me when I find historical ties that bind, and the information revealed by the email headers is certainly sufficient to cause me concern when I am considering the potential risk of an advertising campaign from such a source.

 

Malicious advertisement source - 4cetera.com

I received new intelligence overnight about a malicious advertising campaign (that has since been shut down).  I was advised that the content for the campaign in question was provided by 4cetera.com.  I haven't received permission yet to link the incident with a particular website, so will simply tell you that it happened.

So, who are 4cetera.com?  Well, I'm sure you won't be surprised by the ties that I am about to highlight.

4cetera.com's IP address, at time of writing, is 130.117.78.25 (Cogent).

It's WHOIS reveals that the registrar is YESNIC CO LTD.

First of all, 4cetera.com, at time of writing, share an IP address with none other than the now infamous proximogroup, a name that I am sure you all recognise.

But that is only the start of it.  It's when we start digging deeper that things start getting really interesting:
http://www.robtex.com/dns/4cetera.com.html

What I have done here is simply pull names that I personally recognise as having sold, or been involved in facilitating the distribution of, malicious advertising creatives and campaigns, and the fraudware domains themselves.  I *know* that my regular readers are going to recognise these names as well.

Hostnames sharing ip with a-records

proximogroup.com, adtraff.com, bucksbill.com, burnads.com, forceup.com, freetvnow.com, getfreecar.com, greyhathosting.com, netmediagroup.net, netturbopro.com, newbieadguide.com, performanceoptimizer.com, popupnukerpro.com, prizesforyou.com, traffalo.com, uniqads.com, windefender.com, workhomecentre.com, zappinads.com

Domains sharing mailservers

adtraff.com, bucksbill.com, burnads.com, forceup.com, freetvnow.com, getfreecar.com, greyhathosting.com, netmediagroup.net, netturbopro.com, newbieadguide.com, performanceoptimizer.com, popupnukerpro.com, prizesforyou.com, traffalo.com, uniqads.com, windefender.com, workhomecentre.com, zappinads.com

Domains sharing nameservers

adtraff.com, bucksbill.com, burnads.com, forceup.com, freetvnow.com, getfreecar.com, greyhathosting.com, netmediagroup.net, netturbopro.com, newbieadguide.com, performanceoptimizer.com, popupnukerpro.com, prizesforyou.com, traffalo.com, uniqads.com, windefender.com, workhomecentre.com, zappinads.com

So we see, once again, that if we do a bit of digging some familiar names appear.

My next task will be to take another look at TimeTrack Media who I mentioned on my blog the other day.

 

Attorney General’s consumer protection bills to be heard in committee Monday and Tuesday

Four bills requested by Attorney General Rob McKenna to protect Washington consumers have bipartisan support and will be heard early this week by members of the state House of Representatives.

“We’re asking for laws that would give prosecutors and victims new tools to fight identity theft, prevent homeowners facing foreclosure from falling prey to cons and allow the Attorney General’s Office to continue punishing spyware purveyors,” McKenna said.

“I want to thank legislators for hearing our proposed consumer protection bills early in the session and appreciate the bipartisan support we’ve received from Reps. Patricia Lantz, Kirk Pearson, Jeff Morris and others,” he added.

·       Shutting down spyware

HB 2879 would remedy loopholes and weaknesses in Washington’s Computer Spyware Statute, RCW 19.270.  The bill is scheduled for public hearing at 10 a.m. Tuesday, Jan. 22, in the Committee on Technology, Energy and Communications.

“The Legislature approved our Computer Spyware Statute in 2005 and since that time, the Attorney General’s Office has brought five lawsuits under the act,” McKenna said. “We’re asking legislators to update the bill to adequately address new types of deceptive behaviors and Internet businesses that permit others to send spyware.”

The proposed legislation:

·       Removes onerous requirements that hinder ability to prove cases against violators;

·       Creates liability for Web hosting services who ignore violators’ use of their products or merchants who pay others to violate the law;

·       Adds violations for new forms of spyware; and

·       Clarifies the standards for proof of violations and the circumstances under which actions may be brought.

The bill in sponsored by Speaker Pro Tempore Jeff Morris, D-Anacortes, and Reps. Doug Ericksen, R-Ferndale, Hasegawa, Morrell and Kelley.

·       Guarding consumers from identity theft


HB 2636 and HB 2638 are intended to help fight the growing problem of identity theft. Both bills are prime-sponsored by Rep. Kirk Pearson, R-Monroe, and are scheduled to be heard at 1:30 today, Jan. 21, by the Public Safety and Emergency Preparedness Committee.

“Our proposed identity theft bills would assist in the investigation and prosecution of these cases,” McKenna said. “These are recommendations from LEGIT, Washington’s Law Enforcement Group against Identity Theft, which is helping us effect positive change in this area.”

HB 2636 would create a statutory requirement for police to take reports from identity theft victims. Victims would have the option to file a report in their local jurisdiction or with the agency where the crime occurred. The bill would not require officers to investigate every reported crime, but would provide victims with documentation to help clear their name. Police reports are usually required to freeze access to an individual’s credit history, place a long-term fraud alert on a credit report and obtain records of fraudulent accounts from merchants.

Additional sponsors include Al O'Brien, D-Mountlake Terrace; Mark Ericks, D-Bothell; Charles Ross, R-Yakima;  Bob Hasegawa, D-Seattle; Kevin Van De Wege, D-Hoquiam;  Phyllis Kenney, D-Seattle; Dawn Morrell, D-Puyallup; Dan Roach, R-Sumner; Joyce McDonald, R-Puyallup, and Geoff Simpson, D-Covington.


HB 2638 would allow prosecutors to bring separate charges against an accused identity thief for each use of a particular piece of someone’s personal information. This bill reverses policy set in State v. Leyda (2006), where the Washington Supreme Court held that a defendant may only be charged once for use of someone else’s information even when that information is used in multiple locations multiple times.

Additional sponsors include Reps. O’Brien, Ericks, Ross, Van De Wege, Mike Sells, D-Everett; Tom Campbell, R-Roy; Roach and McDonald.

 

·       Protecting Washington residents from mortgage foreclosure scams


HB 2791 would help reduce foreclosure rescue schemes that include an option to allow the original homeowner to buy or lease back the property from a buyer. The House Judiciary Committee will hear the bill at 10 a.m. Tuesday, Jan. 22.

“Even if you lose your home, you may be owed money,” McKenna said. “But some desperate homeowners facing foreclosure have been lured by cons who steal that equity.”

The proposed bill is modeled after 2004 legislation enacted in Minnesota and a similar version subsequently passed in Illinois, California and several other states. The law would:

·       Require a written contract with clearly disclosed terms be completed, signed and dated by the homeowner and the purchaser prior to the property’s transfer;

·       Provide the foreclosed homeowner with the right to cancel the contract within five business days;

·       Require that the purchaser demonstrate that the foreclosed homeowner is able to meet the terms of the contract including making interest and lease payments and is capable of purchasing the property within the allowable period; and

·       Require that the homeowner must receive at least 82 percent of the difference between the property’s fair market value and the underlying mortgage in the event of a sale to a third party.

The bill in sponsored by Reps. Patricia Lantz, D-Gig Harbor; Jay Rodne, R-North Bend, and Troy Kelley, D-University Place.

More information on the Attorney General’s proposed legislative package is available online at http://www.atg.wa.gov/2008Legislation.aspx.

Remember how I wrote to FastServers? They have not responded...

As a reminder, this blog entry:
http://msmvps.com/blogs/spywaresucks/archive/2008/01/12/1458258.aspx

FastServers continue to host the malicious domains as of a few minutes ago, so what are we going to do?  Blacklist FastServer's IP range?  Complain to their upstream provider? 

What do you think?

 

Internet Explorer Knowledgebase articles

HOTFIX: The exception handler may not catch an exception in Internet Explorer 7 or in Internet Explorer 6 when you view a Web page that throws an exception from a function that is called through the expando property

You develop a Web page that throws an exception from a function. The function is called through the expando property of a DHTML object. When you use Windows Internet Explorer 7 to view the Web page, the exception handler may not catch this exception.

Note This problem also occurs in Windows Internet Explorer 6 when at least one parameter is passed to the function from which the exception is thrown. To work around this problem in Internet Explorer 6, see the "Workaround" section.

Source: http://support.microsoft.com/default.aspx/kb/944397

-----

HOTFIX:  After you reapply Internet Explorer Maintenance Group Policy settings on a computer that has Internet Explorer 7 installed, a pop-up blocker exception site that you manually added is missing

Consider the following scenario:

• On a computer that has Internet Explorer 7 installed, you apply the Internet Explorer Maintenance Group Policy settings to add a pop-up blocker exception site.
• In the Internet Options dialog box, you manually add a new pop-up blocker exception site.
• You reapply the Group Policy settings on the computer.
In this scenario, you the new pop-up blocker exception site that you manually added in the Internet Options dialog box is missing from this dialog box.

Note This problem does not occur on computers that have Internet Explorer 6 installed.

http://support.microsoft.com/default.aspx/kb/944520

-----

The "Intranet Sites: Include all local (intranet) sites not listed in other zones" policy setting does not function as expected in Internet Explorer 7

Consider the following scenario:

• You are running Windows Internet Explorer 7 on a Windows-based computer.
• In a workgroup environment, you use Group Policy to disable the Turn on automatic detection of the intranet setting and to enable the Intranet Sites: Include all local (intranet) sites not listed in other zones setting.
• You use Internet Explorer 7 to access a local intranet site.

In this scenario, the local site is displayed through the Internet zone instead of through the "Local intranet" zone as expected.

Source:  http://support.microsoft.com/default.aspx/kb/941001

 

More Posts Next page »