Wednesday, March 3, 2010

Anatomy of the Bablodos drive-by-download attack

Hackers have come to rely less on distributing malware via email
attachments, and have opted for infecting legitimate websites with
drive-by-downloads as the de facto way of more aggresssive
distribution. Just by loading an infected web page in a browser, a
virus can be downloaded to a computer without knowledge of the user.
The implications are often disastrous and range from reputation/brand
and revenue loss to data theft.

One particular attack stood out due to the number of exploits it
used and the number of processes it started -- it was quite "blatant".
While hackers often take steps to evade detection, Bablodos didn't
seem to bother. Based on Dasient's last malware report for 2009
the average number of extra processes initiated by hackers in Q4 '09
was just 2.8 -- enough for a downloader and perhaps one or
two pieces of malware. (As a comparison, in previous years,
a drive-by download would often initiate 10 or more
extra processes, ostensibly in an attempt to maximize the return from
each infected endpoint.) This shows us that attackers are getting
smarter about the way they structure their attacks, opting for a
smaller fingerprint on an infected machine in exchange for a greater
likelihood of evading detection.

Enter bablodos.com. This brazen attack took advantage of a large
number of different vulnerabilities on the user's computer, modified
personal firewall settings and then deleted itself off the disk after 5
seconds of starting as many as 8 processes. Obviously it wasn't trying to hide
anything and the goal was to cause as much damage as possible in a short amount of time.
Clearly, some of today's hackers aren't afraid of being detected.

So how exactly does this attack work?

STEP 1

Bablodos .com infects vulnerable sites by injecting obfuscated javascript code on their web pages.

Here is the first few bytes of the malicious JS snippet: "document.write(String.fromCharCode(60,116,97,98,108,101,32,98,111,114,100..."

This JS code sources in

bablodos .com/x/jar.jar
bablodos .com/counter/swf.swf
bablodos .com/counter/exe.php
bablodos .com/counter/pdf.php

to look for vulnerabilities in Flash and Pdf plugins and Java Runtime Environment.

STEP 2

Users visiting these victim sites get infected in the following way:

* An executable named file.exe is downloaded into the \Documents and Settings\%USER% folder, and run without the user's consent. It is classified as a downloader by many antivirus engines according to this Virustotal analysis.

* This executable bypasses the Windows Firewall by modifying the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

* Then it downloads additional malware and starts new processes as many as 8 into the temp folder that have file names comprised of 10 random character such as
SUHyAwDJUT.exe, AJvvOxjPBD.exe, YylDMSreSn.exe etc.

* To avoid detection, the downloaded malware is deleted from disk after starting execution with the command:
C:\WINDOWS\system32\cmd.exe /c timeout 5 && del %TEMP%\[10chars].exe

Since January of this year at least 50 sites have been hit by bablodos.com, some of which are:

123-real-estate-riverside .com
3rbytv .com
addisdimts .com
allmyanmar .com
ar-movies .blogspot.com
bellsnwhistles .com
cfusion .com
deskbeauty .com
dogtraininghealthcare .com
eetcorp .com
el34world .com
ericbae .com
faithfulnews .com
funinternet .net
games420 .com
ganoi .us
gdp .com
goldcoastsewing .com
goldmedaldeals .com
gospeladvocate .com
hamiltonknife .com
healthyhuman .net
hipforums .com
homeofourfathers .com
icarly-show .com
jerryswallpaper .com
jpickup .com
lyainc .com
maxeys .com
medicalartsschool .com
mideastreview .com
midorimiller .com
milwaukeenights .com
mjguide .com
mobilefull .com
npocu .org
patriotsbankmo .com
phuket-to-krabi .com
plentyofpuppies .com
pocketkittys .com
powertoolbattery .co.uk
scvan .org
shovelhead .us
tattoovirtual .com
thailandmagic .com
thailandsouthern .com
themes420 .com
travelbookingonline .com
tvgrounds .com
usa-battery .com
wallpapers2k .com

Had these sites been monitored by Dasient WAM they would have been alerted in real-time that the malware was on their site and they would have been able to contain the infection and prevent it from spreading.

55 comments:

  1. I really appreciate posts, which might be of very useful
    my Blogs: cityville cheats | how to get taller

    ReplyDelete
  2. Great post. i think i have read such an article after a long time on internet.
    sciatic nerve pain
    easy guitar songs
    easy guitar tabs
    lower ab workout

    ReplyDelete
  3. http://www.manualdirectorysubmission.co
    This brazen attack took advantage of a large
    number of different vulnerabilities on the user's computer, modified
    personal firewall settings and then deleted itself off the disk after 5 seconds of starting as many as 8 processes.

    ReplyDelete
  4. You have some really good ideas in this article. I am glad I read this. I agree with much of what you state in this article. Your information is thought-provoking, interesting and well-written. Thank you.

    MBA Dissertation to Buy

    ReplyDelete
  5. woow ! Very interesting post I like your website keep up the great posts
    Chemistry Essays Help

    ReplyDelete
  6. I was very encouraged to find this site.I definitely savored every little bit of it and I have you bookmarked to check out new stuff you post. 338a sbobet casino, bola tangkas 2, situs ion casino

    ReplyDelete
  7. His work from house company assisted fund these visits. He was not enthusiastic about gathering individual wealth; he didn’t reside in hardship, but he didn’t reside in high-class either. go here

    ReplyDelete
  8. Often it is the awesome deficiency of way of lifestyle of someone near that provides this home; and then the regularity of medical center trips and memorials gradually begins to choose up amount, like a drumbeat in the forests. criminal defense attorney

    ReplyDelete
  9. Often it is the awesome deficiency of way of lifestyle of someone near that provides this home; and then the. rumah dijual

    ReplyDelete
  10. the regularity of medical center trips and memorials gradually begins to choose up amount, like a drumbeat jual rumah

    ReplyDelete
  11. graha gading serpong Here I’ve combined one strand of the Pixie with one strand of the Cream and used the original H hook size. It makes a heart that is slightly larger than the original pattern

    ReplyDelete
  12. Thanks for ones marvelous posting! I genuinely enjoyed reading it,you are a great author. I will be sure to bookmark your blog and may come back very soon.realestateinindia |

    family-estate |

    estateguru |

    real-estate-tucson |

    elkinsestateretreat |

    oaklandreal-estate |

    piedmontreal-estate |

    browardrealestate |

    koratrealestate |

    prescott-real-estate |

    ReplyDelete
  13. The Buddhist way to all of this is quite genuine, really. Buddhism understands of that from the perspective of ego the opportunities of lack of way of life is generally difficult. Klik4D

    ReplyDelete
  14. As almost everyone’s costs experienced, many companies had to cut back on their display contribution and the variety of individuals they sent to be present at activities was significantly reduced. her explanation

    ReplyDelete
  15. One neat thing about being the first company to purchase the trucks is that Robichaud is pretty much involved in any design changes that may be made to the vehicle. overview

    ReplyDelete
  16. As we age this careful system changes. Moreover to monitoring moment-to-moment threats such as an beginning car or a decrease banister, our threat verifying starts to intuit a distant but progressively approaching dark thinking — the approaching end, the biggest boundary. www.swissphysio.co.uk

    ReplyDelete
  17. Many producers need to be more ideal and creative about how they can use their display contribution as a useful promotion. TUBE

    ReplyDelete
  18. I'll upgrade in a year or two" I'm so glad I didn't do that, I'm still just beginning but I can see how valuable having more stitch options is going to be and I've already started using some of them. top 10 quotes

    ReplyDelete
  19. As we age this careful system changes. Moreover to monitoring moment-to-moment threats such as an beginning car or a decrease banister. stumbleupon

    ReplyDelete
  20. During the encounter, not one, but two support specialists came out to the apartment to get us out of the blunder we were in. venus factor reviews

    ReplyDelete
  21. I happen to think that organization exhibitions still hold value, whether you are there to program, see market buddies, rim and deal or to walk the shelves to explore a certain item or technological innovation. click to read

    ReplyDelete
  22. I'm liking the room setup of that hotel. The simple elegance reminds me so much of the hotels in paddington I've stayed in during my business trips. next story

    ReplyDelete
  23. Spend some time while with a dynamic language and you start to wonder what the benefit of the static type system really is, other then reducing the most gross of mistakes in a project with developers who don't communicate or pay attention. use this link

    ReplyDelete
  24. Select your preferred way to display the comments and click "Save settings" to activate your changes. venus factor weight loss

    ReplyDelete
  25. After conference with Brownish lots of periods, Robichaud was marketed on the advantage to the surroundings, his business and the group. Alexei Beltyukov

    ReplyDelete
  26. However, there are restricted sources available to implement these rules, and a very portion of criminals are caught and charged. Furthermore, as copper robberies are generally resolved as transgressions, those people charged pay relatively low charges and provide brief jail conditions. Stephen Williams wine

    ReplyDelete
  27. According to Morgan Stanley, copper costs will enhance 7.6% in 2013 from last year as requirement in Chinese suppliers, the U.S. and even European countries is prediction to improve amongst a provide lack for the steel. hosted by Stephen Williams

    ReplyDelete
  28. Greater performance indicates less power intake. Less power intake indicates reduced expenses and less contamination. great interview with Dave Morin

    ReplyDelete
  29. You definitely put a new spin on a topic thats been written about for years. Great stuff, just great. more pictures of Darius Anderson

    ReplyDelete
  30. The Buddhist way to all of this is quite genuine, really. Buddhism understands of that from the perspective of ego the opportunities of lack of way of life is generally difficult. The ego cannot think about being deceased. It has no way of it. made a post

    ReplyDelete
  31. He serves as an example to others to take a risk and test new technologies. If the technology works, and in this case it seems that it does, it’s a win for everyone. http://ir.wetsealinc.com/releasedetail.cfm?releaseid=543218

    ReplyDelete
  32. It seems that many company and personal marketing emails are going on digitally these days. It is often much easier to write a quick email or send a brief written text than to get in touch with someone on the cellphone. Halpern's work in California

    ReplyDelete
  33. Show managers need to agree to online marketing, social media and other marketing emails methods of getting members and members – especially the youth. Powell Jobs invests in Hillary

    ReplyDelete
  34. The words of some Japanese participants also tell us they are acutely aware of their responsibility in the impact of the nuclear disaster on other countries as well as their own, which is more evidence of an evolving, growing sense of interconnectedness. agen judi online terpercaya

    ReplyDelete
  35. Robichaud is a fantastic example of an experienced on the cutting-edge of technological innovation. He provides as an example to others to take a risk and analyze new technological innovation. If the technological innovation performs, and in this situation it seems that it does, it’s a win for everyone. after he got the job

    ReplyDelete
  36. Was outstanding, a slice of sharp, cool iceberg almost as big as your go, lovely with a wonderful frothy Roquefort putting on. with the unique idea to

    ReplyDelete
  37. It is then our intention to start the transition at two per month. Logistically it takes time to swap out a technician to a new van and we do not want to overwhelm ourselves, although the sooner we switch the sooner we start saving. volkswagen mechanic

    ReplyDelete
  38. I lately taken up with Indicate Halligan, CEO of H+A Worldwide, Chicago, illinois, il, about the very subject of organization events. Indicate has a success of experience with preparing organization events and he has hand to create AHR the effective display that it is nowadays. truth about cellulite reviews

    ReplyDelete
  39. As we age this careful system changes. Moreover to monitoring moment-to-moment threats such as an beginning car or a decrease banister, our threat verifying starts to intuit a distant but progressively approaching dark thinking — the approaching end, the biggest boundary. old school new body pdf

    ReplyDelete
  40. I can see how valuable having more stitch options is going to be and I've already started using some of them. There wasnt a major growth but my boobs were a little more plump and full. Disappointed that it did not include a miter guide. I have even made adjustments so I can throw in a little ground flavored coffee while still using the grinder. google

    ReplyDelete
  41. Aside from just letting him chew on the links, I also used a chain of them to hook up toys to the stroller bars, so he could freely play with them but they won't drop to the floor. Just remember to buy spare filters, light bulbs and the powercable. old school new body reviews

    ReplyDelete
  42. Nixon applied guidelines from the Remaining that only a Republican would have been able to get away with applying. use this link

    ReplyDelete
  43. Great buy for the price! I received the item in a day or so and I was able to complete a photo project I had been working on! It also shuts the feeding ports when they put enough weight on the ring. agen sbobet terbaik, bola tangkas terpercaya

    ReplyDelete
  44. By publishing your execute to material databases and allowing up-dates and web sites to publish it for 100 % 100 % free, you improve the prospective wide range of visitors to your website significantly. click here

    ReplyDelete
  45. If you're in the market for new ms windows and gates, learn about the different power efficiency scores and exactly what each one indicates. Three of these, noticeable transmittance, air leak and moisture build-up or condensation level of resistance, are described here. address

    ReplyDelete
  46. I don't know what all those stitches do anyway, and then if I really get into sewing that's cheap enough that I'll upgrade. venus factor

    ReplyDelete
  47. This means when your home is marketed, your benefit becomes more compact. Many property owners ask if they can offer their home easily with little or no equity. Sell Property fast

    ReplyDelete
  48. I am launching a website soon, and your information will be very useful for me. Thanks for all your help and wishing you all the success in your business. Saran Wrap Weight Loss

    ReplyDelete
  49. Sound preparedness perform may be a immediate system in making sure that the end won't problematic fall flat, as is that the real objective behind most downfalls within the standing of an end as located by a few research conducted by The Traditional Maintenance Community. you can look here

    ReplyDelete
  50. To talk about particular item or set up difficulties with manufacturers’ technical employees. go to website

    ReplyDelete
  51. I've already started using some of them. There wasnt a major growth but my boobs were a little more plump and full. Disappointed that it did not include a miter guide. I have even made adjustments so I can throw in a little ground flavored coffee while still using the grinder. Home Buyer

    ReplyDelete
  52. Once you have recognized a company, phone and talk about your problem as particularly as it is possible to. A efficient company will make an attempt to comprehend your situation and offer you with a estimated cost. check my source

    ReplyDelete
  53. Human growth hormone is recognized to generate hypoglycemia simply because in improves the preservation and release from the blood insulin hormone. you can check here

    ReplyDelete
  54. Look for toys and games that have the same features. Lately toy remembers have been created by the CPSC due to high cause material. here

    ReplyDelete