Common Vulnerabilities and Exposures (CVE)number
This post is to be continued..
CVE-2009-4324
CVE-2009-0927
CVE-2008-2992
Friday, November 26, 2010
CVE-2009-4324 CVE-2009-0927 CVE-2008-2992 regional security in east asia.pdf
File regional security in east asia.pdf
Monday, November 22, 2010
APT IPs
These 200+ IP addresses and IP ranges were used for targeted attacks, APT malware C&Cs and targeted malware distributions (many thanks to Anon and CJ for their additions).
Please note that the dates are AS registration dates for the blocks, not the attacks. Attacks are mostly from 2010 and some from 2009
Please note that the dates are AS registration dates for the blocks, not the attacks. Attacks are mostly from 2010 and some from 2009
| 4134 | | | 114.221.79.181 | | | 114.221.0.0/16 | | | CN | | | apnic | | | 6/24/2008 | | | CHINANE | No.31,Jin- | Street | |||||||
| 38661 | | | 115.92.107.178 | | | 115.92.104.0/22 | | | KR | | | apnic | | | 7/24/2008 | | | HCLC-AS- | HCLC | ||||||||
| 4134 | | | 116.21.179.130 | | | 116.21.128.0/17 | | | CN | | | apnic | | | 3/7/2007 | | | CHINANE | No.31,Jin- | Street | |||||||
| 4837 | | | 117.11.158.98 | | | 117.8.0.0/13 | | | CN | | | apnic | | | 5/25/2007 | | | CHINA169 | CNCGROU | China169 | Backbone | ||||||
| 4134 | | | 117.88.248.10 | | | 117.88.128.0/17 | | | CN | | | apnic | | | 7/4/2007 | | | CHINANE | No.31,Jin- | Street | |||||||
| 4134 | | | 117.89.37.193 | | | 117.89.0.0/16 | | | CN | | | apnic | | | 7/4/2007 | | | CHINANE | No.31,Jin- | Street | |||||||
| 38186 | | | 119.47.80.0 | | | 119.47.80.0/24 | | | HK | | | apnic | | | 1/14/2008 | | | FTG-AS-A | Forewin | Telecom | Group | Limited, | ISP | at | HK | ||
| 17858 | | | 119.68.7.79 | | | 119.68.0.0/14 | | | KR | | | apnic | | | 1/15/2008 | | | KRNIC-AS | KRNIC | ||||||||
| 13938 | | | 12.33.114.0 | | | 12.33.114.0/24 | | | US | | | arin | | | 8/23/1983 | | | SSNC-AS | - | SS&C | Technolo | Inc. | |||||
| 27440 | | | 12.33.114.0 | | | 12.33.114.0/24 | | | US | | | arin | | | 8/23/1983 | | | SSNC-CHI | - | SS&C | Technolo | Inc. | |||||
| 9931 | | | 122.155.7.194 | | | 122.155.0.0/20 | | | TH | | | apnic | | | 1/8/2007 | | | CAT-AP | The | Communi | Authoity | of | Thailand, | CAT | |||
| 9981 | | | 122.199.123.8 | | | 122.199.120.0/21 | | | KR | | | apnic | | | 6/7/2006 | | | SAERONE | Saero | Network | Service | LTD | |||||
| 4808 | | | 123.125.156.137 | | | 123.125.128.0/18 | | | CN | | | apnic | | | 1/29/2007 | | | CHINA169 | CNCGROU | IP | network | China169 | Beijing | Province | Network | ||
| 4808 | | | 123.125.156.138 | | | 123.125.128.0/18 | | | CN | | | apnic | | | 1/29/2007 | | | CHINA169 | CNCGROU | IP | network | China169 | Beijing | Province | Network | ||
| 4808 | | | 123.125.156.151 | | | 123.125.128.0/18 | | | CN | | | apnic | | | 1/29/2007 | | | CHINA169 | CNCGROU | IP | network | China169 | Beijing | Province | Network | ||
Sunday, November 21, 2010
Hello World
Cheers,
-Mila
Tuesday, November 16, 2010
Links and resources for malware samples
Malware links.
Here are good resources, links, download locations for malware. Use caution.
In addtion, there is a full list collected and published at kernelmode.info (many thanks to Evilcry, Jaxryley, markusg, EP_X0FF, Meriadoc, CloneRanger, Brookit and gigaz) The original list is here
Here are good resources, links, download locations for malware. Use caution.
- http://forums.malwarebytes.org/index.php?s=cf9a0929d1a028394c8933e8dc4c0059&showforum=51 newest malware threats
- http://forums.malwarebytes.org/index.php?s=cf9a0929d1a028394c8933e8dc4c0059&showforum=30 newest rogue threats
- http://www.kernelmode.info/forum/viewforum.php?f=16 malware section. Registration required
- http://tuts4you.com/download.php?list.89
- contagiodump.blogspot.com - email milaparkour () gmail for password scheme
- Mobile Malware samples - sign up for Mobile Malware Group, they share samples
- Mobile Malware samples - Take a sample, leave a sample. Mobile malware mini-dump
- samples of Jan. 2011 URL:- http://cramitin.us/hhdmz2rufgot - 7000 files
- http://ivanlef0u.fr/repo Also other RCE info
In addtion, there is a full list collected and published at kernelmode.info (many thanks to Evilcry, Jaxryley, markusg, EP_X0FF, Meriadoc, CloneRanger, Brookit and gigaz) The original list is here
- http://www.malwaredomainlist.com/mdl.php
- http://support.clean-mx.de/clean-mx/viruses.php
- http://malc0de.com/database/
- http://lineage.paix.jp/guide/security/virus-lastmodified.html
- https://zeustracker.abuse.ch/monitor.php?browse=binaries
- https://spyeyetracker.abuse.ch/monitor.php?browse=binaries
- http://www.sacour.cn/showmal.asp?month=8year=2010
- http://www3.malekal.com/exploit.txt
- http://blog.urlvoid.com/new-list-of-dangerous-websites-to-avoid
- http://www.freepcsecurity.co.uk/
- http://www.scumware.org/
- http://secuboxlabs.fr/
- http://www.threatlog.com/
- NovCon Twitter EXE Parsing provides links to live sites; may include benign files
Monday, November 15, 2010
Nov 14 Java/Boonana-A Facebook OSX Trojan
Malware Type
Secure Mac: Trojan horse [.] that affects Mac OS X, including Snow Leopard (OS X 10.6), the latest version of OS X. The trojan horse, trojan.osx.boonana.a, is spreading through social networking sites, including Facebook, disguised as a video. The trojan is currently appearing as a link in messages on social networking sites with the subject "Is this you in this video?"
General File Information
File jnana.tsa (v 11.7) and jnana.jar (v 11.8)
MD5 7a04e9185daf9551edd90e7bff2daa8e and 2533F62C321117C46D6DF6122C3009BD (unpacked)
File size : 171980 bytesType: PDF
Distribution: Facebook
Source: kernelmode.info (many thanks to xhandsome) and www.kaldata.com (many thanks to Васил)
Read about versions here Malware Diaries: Jnana, Boonana: as many names as variants? Image from Malware Diaries
Wednesday, November 10, 2010
CVE-2010-3654 Adobe Reader 0 day + CVE-2010-2883 Flash 10.1.102.64 + Reader 9.4.0.195 PDF Federal Benefits
Common Vulnerabilities and Exposures (CVE)number
CVE-2010-3654 Adobe Flash Player 10.1.85.3 and earlier on Windows, Mac OS X, Linux, and Solaris and 10.1.95.2 and earlier on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.
CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
Update 6, Nov 16 2010-------------------------------------------------------------------------------------------
After yesterday tweets (snowfl0w and sempersecurus), GoDaddy took notice and suspended mysundayparty.com domain
here is the email
Registrant:
debby ryan
411 N. 6th Street, Emery, SD
Emery, SD
sd, shen zhen 90002
China
Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: MYSUNDAYPARTY.COM
Created on: 15-Sep-10
Expires on: 15-Sep-11
Last Updated on: 15-Sep-10
Administrative Contact:
ryan, debby g.debbei_@yahoo.com
411 N. 6th Street, Emery, SD
Emery, SD
sd, shen zhen 90002
China
+86.9801455 Fax --
Technical Contact:
ryan, debby g.debbei_@yahoo.com
411 N. 6th Street, Emery, SD
Emery, SD
sd, shen zhen 90002
China
+86.9801455 Fax --
Domain servers in listed order:
NS1.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
NS2.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
Update 5, Nov 15 2010-------------------------------------------------------------------------------------------
mysundayparty.com domain is still active. resent the message below to abuse@godaddy.com
Update 4, Nov 13 2010-------------------------------------------------------------------------------------------
mysundayparty.com domain is still active
The message that was sent to GoDaddy abuse department on Nov 10, 2010 read
After yesterday tweets (snowfl0w and sempersecurus), GoDaddy took notice and suspended mysundayparty.com domain
here is the email
---------- Forwarded message ----------Here is current Whois
From: GoDaddy Abuse Department
Date: Tue, Nov 16, 2010 at 11:16 AM
Subject: RE: reminder - mysundayparty.com complaint
To: Mila
Dear Mila Parkour,
Thank you for bringing this situation to our attention. We have gone
ahead and suspended the domain name in question.
Please let us know if you find any other domain names connected to C&C
servers or other malware distribution.
Regards,
Joe
GoDaddy.com
Spam and Abuse Department
24/7 Abuse Department Hotline: 480-624-2505
ARID1003
Registrant:
debby ryan
411 N. 6th Street, Emery, SD
Emery, SD
sd, shen zhen 90002
China
Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: MYSUNDAYPARTY.COM
Created on: 15-Sep-10
Expires on: 15-Sep-11
Last Updated on: 15-Sep-10
Administrative Contact:
ryan, debby g.debbei_@yahoo.com
411 N. 6th Street, Emery, SD
Emery, SD
sd, shen zhen 90002
China
+86.9801455 Fax --
Technical Contact:
ryan, debby g.debbei_@yahoo.com
411 N. 6th Street, Emery, SD
Emery, SD
sd, shen zhen 90002
China
+86.9801455 Fax --
Domain servers in listed order:
NS1.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
NS2.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
Update 5, Nov 15 2010-------------------------------------------------------------------------------------------
mysundayparty.com domain is still active. resent the message below to abuse@godaddy.com
24.248.182.214
Hostname: wsip-24-248-182-214.ph.ph.cox.net - Is it C&C or someone's sinkhole? Anybody?Update 4, Nov 13 2010-------------------------------------------------------------------------------------------
mysundayparty.com domain is still active
The message that was sent to GoDaddy abuse department on Nov 10, 2010 read
Dear GoDaddy Abuse Department,
mysundayparty.com has been C&C for 0-days malware
and used in targeted attacks described above.
Please take action asap
Thanks
Monday, November 8, 2010
Nov 3 CVE-2010-4091 Adobe 0 Day "printSeps()" xpl.pdf PoC From scup () hushmail com
Common Vulnerabilities and Exposures (CVE)number. Vendor Advisories
CVE-2010-4091 The EScript.api plugin in Adobe Acrobat Reader 9.4.0, 8.1.7, and probably other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF document that triggers memory corruption, involving the printSeps function. NOTE: some of these details are obtained from third party information.
November 8, 2010 Update: We plan to resolve this issue in the update for Adobe Reader and Acrobat 9.4 and earlier 9.x versions scheduled for release during the week of November 15, 2010, mentioned in Security Advisory APSA10-05. We have assigned CVE-2010-4091 to this issue. As of today, Adobe is not aware of any exploits in the wild or public exploit code for this issue.
--------------------------------
November 4, 2010 Adobe
is aware of a potential issue in Adobe Reader posted publicly today on
the Full Disclosure list. A proof-of-concept file demonstrating a Denial
of Service was published. Arbitrary code execution has not been
demonstrated, but may be possible. We are currently investigating this
issue. In the meantime, users of Adobe Reader 9.2 or later and 8.1.7 or
later can utilize the JavaScript Blacklist Framework to prevent the
issue by following the instructions below. Note that Adobe Acrobat is
not affected by this issue.
Vupen Adobe Acrobat and Reader "printSeps()" Heap Corruption Vulnerability
General File Information
MD5 d000e74163e34fc65914676674776284
SHA1 94358cebc08f6677df9b28e5b893dce71003081a
File Name: xpl_pdf.pdf
File size : 1928 bytes
Type: PDF
Source: Wed, 03 Nov 2010 [0dayz] Acrobat Reader Memory Corruption Remote Arbitrary Code Execution Full Disclosures
CVE-2010-2883 PDF An invitation to the Nobel Prize ceremony of Liu Xiaobo
Common Vulnerabilities and Exposures (CVE)number
CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information
General File Information
File invitation.pdf
MD5 : 29db2fba7975a16dbc4f3c9606432ab2
SHA1 : 5d65e6984e521936707b32219b39388efb4296fa
File size :344218 bytes
Type: PDF
Distribution: Email attachment
Post Updates
Nov 8, 2010 Post by Mikko H. Hyppönen on F-Secure blog - Case Nobel
- Nov 10, 2010 CPJ. Committee to Protect Journalists. That Nobel invite? Mr. Malware sent it -- By Danny O'Brien/CPJ Internet Advocacy Coordinator
- Nov 10, 2010 Computerworld (Norway) New attack against Nobel Prize by Ole Petter Baugerød Stokke (Google Translated)
- Nov 10, 2010 Le Figaro*fr Nobel: new computer attack (Google translated)
- Nov 10, 2010 APF Google New cyber attack linked to Nobel Peace Prize
- Nov. 13 Infowar Monitor Nobel Peace Prize, Amnesty HK and Malware by Nart
More about similar attacks
- Oct 22, 2010 Infowar Monitor Command and Control in the Cloud
- Aug 19, 2010 Infowar Monitor Human Rights and Malware Attacks
Oct 29 CVE-2009-4324 Bulletin No. 32 Sino-US from ythtzxd@gmail.com
Common Vulnerabilities and Exposures
CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
General File Information
File ATT29632.pdf
MD5 bd4d584dffedcdeb0efc0b362ff73db8
SHA1 7d018cab3201ec8810bf2a438cbfbe42caa458eFile size 278987 bytes
Type: PDF
Distribution: Email attachment
Subscribe to:
Posts (Atom)