The Counter eCrime Operations Summit VII (CeCOS VII) engages questions of operational challenges and the development of common resources for the first responders and forensic professionals who protect consumers and enterprises from the electronic-crime threat every day.

The annual event, organized by the Anti-Phishing Working Group (APWG) is this time held in Buenos Aires, Argentina.

While many are still in shock after the Boston Marathon bombings on 16 April, it didn't take long for cyber criminals to abuse that tragic incident for their dirty deeds.

Today we already started receiving emails containing links to malicious locations with names like "news.html". These pages contain URLs of non-malicious youtube clips covering the recent event. After a delay of 60 seconds, another link leading to an executable file is activated.

The malware, once running on an infected machine, tries to connect to several IP addresses in Ukraine, Argentina and Taiwan.
Kaspersky Lab detects this threat as "Trojan-PSW.Win32.Tepfer.*".

MD5sums of some of the collected samples:
5EA646FFDC1E9BC7759FDFC926DE7660
959E2DCAD471C86B4FDCF824A6A502DC

Our thoughts and prayers are with our colleagues in Massachusetts and others affected by the tragic events in Boston.

After having handled thousands and thousands of phishing emails/webpages, they usually don’t actually reach me in any way or form. They are processed and added to our detection list in what is now a merely routine task. But recently I got a mail which was different because it appeared to be sent from my bank.

”The 15th Cyber Crime Symposium, Shirahama" with theme "Cloud Security" was held on May 26th - 28th at the "Big U" Information Exchange Center in Wakayama Prefecture, Japan. Approximately 220 people, including government delegates, information security researchers, lawyers, law enforcement and academia attended the event. Experts were presenting about topics like benefits and security risks of cloud computing as well as other related technical matters.

Besides the presentations in the official program, there was also plenty of chance for human networking, with the venue surrounded by beautiful nature and cultural heritage, hot springs and delicious Japanese cuisine.

During the presentations, which were also broadcasted via ustream, tweets tagged with #sccs2011 were shown cycling on a separate screen. This yearly event is targeting Japanese audience and no translation services were offered. If you plan to attend this event in the future, be sure to brush up your Japanese, it most certainly is worth it. Past content of the same event covered themes like “Threat of Malware/Virus” (2009) and “How can we protect the children and ourselves from harmful contents” (2010).

The earthquake and tsunami related crisis in Japan is still far from over - so is the appearance of new cyber threats trying to exploit that same crisis.
Tens of thousands of people in Japan have lost their homes, and many their loved ones too. On top of that, radiation leaks are still a major concern for the country and its observers , while new tremors remind everyone of nature’s power on an almost daily basis. (At time of writing, a Magnitude 6.2 quake shook the place!).

Today we investigated another malicious webpage. This one states in Portuguese: "Novo tsunami atinge a região de Sendai e Japão declara estado de emegência em usina nuclear", which roughly translated means "New tsunami reaches the area of Sendai, Japan declares state of emergency at nuclear power plant".

As was predicted by many, email scams soliciting donations for Japan are appearing in user’s inboxes. We took a closer look at one of these messages and identified the following details:

Since the beginning of August, our Japan office has seen 900+ mails of a certain kind in their spam traps.

We noticed two common patterns in all of the mail. First, the links in these spammed messages all point to compromised servers. Also, the file names of the redirectors are all dictionary words followed by two digits. The files redirect the users to online pharmacy sites and fake watch stores. Here is a screen capture of a directory hosted on one of these online sites:

You might wonder why this caught our attention. The answer is simple: about half of these files contained links to 'gumblar.x' servers.

The upper red link points to a pharmacy site, the lower one is a gumblar.x URL.

So basically an unsuspecting (and unprotected) user who will click these links in their mail will experience a typical 'gumblar-attack' while browsing a pill catalog. The recent peak of such hybrid attacks may be a sign that the cybercriminal(s) who’ve been slowly but surely growing the Gumblar botnet worldwide, and who up until now have been keen to fly under the radar, are now starting to monetize it. The first test runs of mixed pharmacy/gumblar pages were actually identified by our experts as early as April 2010, when we noticed a few mails of this kind, with subjects like "Twitter 61-213".

On further investigation of the involved servers, it turned out that plenty of them have additional malicious code injected directly into their www root. We counted mostly gumblar.x but also some 'pegel.*' and other obfuscated code containing iframers or other redirectors.

Additionally, almost ALL of these domains contained a link to 'hxxp://nuttypiano.com/*.js' at the end of the file.

There are more than 300 different .js files in circulation on such servers, the content of these is obfuscated and similar to known 'pegel' threats. To make our researchers' task more difficult, the malicious code will only be sent once to the same IP address. However, we have managed to download several samples from the same locations and identified polymorphic-like structures.

These are redirecting to other :8080 locations, which in turn try to push more malware onto the victim's machine.

Here is a quick summary of such injected sites, sorted by country: #1 is the US, followed by FR, DE, TR and JP. Affected webmasters should consider changing their compromised ftp credentials, clean the machines which led to the leak, and investigate their server logs for more details.

Over the last couple of days we've been noticing a few pharmacy spam mails which are a bit different. Somebody seems to have replaced the original graphical content with an alert highlighting that such messages are malicious.

So far we have counted three (ab)used image hosting services for this spam:

1. imageshack.us
2. imgur.com
3. myimg.de

A quick analysis of these showed that #1 currently serves all the replaced images, #2 serves all original spammers images and #3 seems to have removed the offensive content immediately, good work!

At the moment, we don't have any further information about the source/background of the warning replacements - this gives us plenty of opportunity to use our imaginations when thinking about what's actually going on. A few of the key words and concepts we're considering are: white hats, rival spammers, compromised hosting service(s). Not an exhaustive list, but more of a launch pad for further theories and research!

In recent spam mails we have often noticed links to *.html files with random names. Another trend is that the cybercriminals do not even bother to register domains for their dirty deeds, but simply plant their malicious code on compromised hosts. "Simply?" one may ask, and sadly the answer seems to be "yes" based on our observations.

For example, we have collected some hundred mails of a certain type promoting online software shops - a small portion is shown in the animated gif image below.

All of the samples stick out by virtue of the fact that they contain colored text/links which point to compromised legitimate websites. The links also show that the locations of the files are directly on the root URLs and not in a subfolder of some vulnerable application as we usually see.

We can assume that the intruders have ‘write’ access, at least to the www root of the involved sites - a very worrying fact. We have also confirmed that in many cases not only were the abovementioned spam links stored on the victim’s servers, but additionally, malicious iframes or javascript snippets were injected into the main content of the sites.

Another sample reaching us today just confirms that the cybercriminals are not sparing with the domains they abuse, and indeed seem to have a pool of unknown quantity at their disposal. The capture below shows a spam mail where each of the 12 links in the mail body points to a unique site. All of these sites also contain malicious code in their root which we detect as 'Trojan-Clicker.JS.Agent.*'

Please do not attempt to visit these links shown if you are not sure of what you are doing.

Looking up definitions for 'iframe' does indeed give results about "... a constraint of the H.264 codec specified by Apple to ensure ease of consumer video editing.". Such iframes do contain all necessary rendering information and serve as reference to construct other frames. But here we discuss the other kind of iframes - HTML tags. Iframes can have several attributes and we often encounter them when analysing malicious sites. They are often used in a hidden way to construct drive-by downloads of malware. To hide even more, simple encryption (also called 'obfuscation') is often used, web browsers decrypt that on the fly. Knowing that, we can search for interesting websites. For example doing a web search for "#64#6f#63#75#6d#65#6e#74#2e#77#72#69#74#65" (which decodes to 'document.write'), we instantly get 10,000+ results.

The first entry in our search results is a link to a torrent site where users discuss a malicious package. Ironically in between these search results we also noticed what seems to be an 'infected podcast' hosted at itunes.apple.com - which brings us back to the initial talk about iframes. The injected code contains an iframe redirecting to moshonken(dot)com, a host known for having spread exploits in the past. Currently that host appears to be not operational but malicious code trying to access it is still injected in many legitimate sites, as our search results showed. We detect this code as 'HEUR:Trojan.Script.Iframer' and have reported the problem via Apple's feedback form.