Quick Links: SpywareGuide Greynets Blog | SpywareGuide Product Database | SpywareGuide Company Database | SpywareGuide Categories
Search SpywareGuide Database & Site
Security Email Alerts & Updates
SpywareGuide powered by FaceTime Security Labs

The IM Hackers: Weapons of Choice

by Christopher Boyd

Part 1: Custom HTML Exploits

There is currently a wave of IM adware bundles that have been tracked as far back as October 2004. However, it looks like the group responsible for the current wave of these installers has been traced due to extended research by Christopher Boyd, Wayne Porter and the XBlock team, the FaceTime IMPact center, Roger Karlsson of Kephyr.com and the final piece of the puzzle, Jay Loden, who (by chance) was found by Boyd whilst conducting further research. Loden had in his possession a massive collection of files, photographs, screenshots, chatlogs and more besides, which is currently being used as exhibits A through Z in a potential police investigation.

Therefore, names, geographical locations and other personally identifiable information will not form the basis of these write-ups. The files, however, are fair game. And these articles will look to carry out in-depth studies of particular elements of this hacker group's methods, techniques and (of course) payloads.The file in question that seemingly started all this is something called "Funneh.exe", though the files recovered from the hackers are (in truth) far more interesting in terms of understanding both what they hoped to achieve, and also how Funneh.exe came to be. This time round, we'll be looking at custom HTML exploits...

The rise of Social Engineering as Webcode

Drive by installs are not the force they once were. Alternative methods are now the order of the day, and cheap tricks are employed regularly to fool end-users to click something. A case in point is in the "Hacker treasure trove", found in a recent reveal of a hacker gang found to be pushing IM installers to make money from the Adware programs. The collection includes a number of HTML pages, some custom built, some based on previously existing exploits already in the wild. Let's look at some of these....

1) The phone spam messenger

An interesting piece of code that isn't as clever as you might first imagine. No doubt designed to impress the rest of the teenage gang, this "phone spam" tool (image here) simply leeches off the genuine application located elsewhere. Code:

Phonespam code

http://usc.ztango.com/uscwmss is where the "real" messenger service resides, which is operated by Wider Than.

2) CTH.htm

Some pages in the bundle that dont make sense on their own, suddenly fit into place when activated. The CTH.htm page is slightly more advanced in this respect, and here we can see the hacker group flexing their muscles with a simple affiliate popup:

CHT popup

Allow the popup, and you get the ctf popup page with (of course) affiliate links for every URL...clicking one of the links (for example, the "Adult" link) takes you from here : clickthrutraffic.com/scripts/click.php?aff=hybridtf&si=adult to this sequence of redirects, eventually ending up at Mirago. Mirago is a UK-centric search engine.

3) GAMA.htm

This page is devastating, though for all the wrong reasons. When opening up the page, a message is displayed regarding ActiveX, and a click yes to continue box is displayed 3 times. Once it is gone, the CPU usage rockets to 100% and the PC usually dies at this point - note the massive spikes in the CPU usage history. Going back to the source code of the original GAMA page, we can find another page buried in the code - prompt.htm:

Gama code

Open up prompt.html, and we can see that it attempts to call XXX Toolbar from a flash animation. Here, we can see the group experimenting with different types of installer and realising that a basic "click the link to install" technique will not be enough.

4) LOUD.htm

The source for this page serves up the below:

Loud code

Which (in turn) presents the user with this popup when using IE. If you decline, you are presented with the same popup four times, and at the same time, a "click yes to continue" box appears repeatedly, bringing the grand total of attempted installs to eight. Viewing the EULA takes you to Blazefind / 180 Solutions, and clicking "Yes" in this case will install:

* 180search Assistant, EULA located at: http://www.180searchassistant.com/eula.aspx
* Internet Optimizer, EULA located at: http://www.internet-optimizer.com/legal/EULA/
* Golden Retriever, EULA located at: http://www.shopathomeselect.com/TermsAndConditions.asp
* WebSearch, EULA located at: http://www.websearch.com/legal/terms.aspx

5) MEH.htm

This page exploits two methods of install - the first, a Java popup from IST that will install a barrage of advertising software onto the end-user's PC. If the user declines but clicks the fake XPSP2 "information bar" at the top of the screen and accepts the install, they will be hit with the same payload. The fake information bar is created using a CSS (Cascading StyleSheet) trick which was covered some time ago both here and here. For more information on the way the Java install works, check out the "Anatomy of a Drive-By Install" link in Related Articles at the end of this writeup.

The payload delivered from the above is almost identical to the installs covered on both Vitalsecurity.org and Spywareguide.com. Here, we can chart the development of a series of techniques leading up to a massive payload. So we now have a place to begin our investigation into the genesis of Funneh.exe, and can see that the hacker group got to a certain level, then realised a webpage install wouldn't be enough. They would need something more.

But where does the transition from fake information bar to using IM as the launchpad for these installs come from? How did this particular group of script kiddies make the leap from standard webpage install, to combining Adware bundles with new variants of IM virus techniques? The answer will be revealed in Part 2...

Unless otherwise noted this article is Copyright © 2017 by FaceTime Communications, Inc. This article may not be resold, reprinted, or redistributed for compensation of any kind without prior written permission from FaceTime Communications, Inc. For reprint or media inquires please contact us with the phrase "Spyware Guide Articles" in the subject line and we will by happy to assist you. Links to this article from other websites are appreciated and encouraged. Users are also encouraged to utilize our RSS system to provide unique content and extracts for their site.

Related Articles

Read other articles (back to full list)

Help with the BUST!
Click here and give us what details you have and let our international research team take it from there. If you desire your report will remain anonymous.
Recent Blog Posts

There was an error communicating with the requested site.

Recent Modifications
2017-11-13  Adult Networks/Services
2017-2-10  Adult Hosts
2016-3-30  CoolWebSearch
2015-9-29  Malicious URLS
2015-5-19  Dialers
2015-1-5  Email Threats
2013-7-20  Date Manager
2013-4-10  BeeBus
2012-12-18  JT.Moonwalk
2012-12-18  Sadbiz
 

Site EULA | Site Map | Contact Us | About Us | Site and Spyware FAQ | Advertise | RSS Feeds  | Link To Us | SpywareGuide Japan Japanese

© Copyright 2007, FaceTime Communications, Inc. All rights reserved.