Last Updated: 2008-09-16 20:15:52 UTC
by donald smith (Version: 1)
We received two reports of fake UPS invoice tracking Trojan zip files.
This is similar to other invoice Trojans we have seen.
Here is one of the email bodies notice that while this appears to be a two way conversation it was really just the spammer who created the whole thing. The victim did not send UPS an email.
Subject: Re: missing package
From: John Henry <email@example.com>
Mr./Mrs. Victims First and Last name
I am sorry for this late reply, but we have good news.
We managed to track your package, and we have attached the
invoice you asked for to this reply.
The invoice contains the correct tracking# , since the one
you gave us was invalid.
You can use it on the ups website to track your shipment.
UPS Customer Care Department
From: victim’s name and email address
Subject: missing package
Date: Monday, September 8 , 2008, 10:38 AM
I have recently used UPS to send a package to my cousin but
he never received it.
Also , the tracking number doesn't check on the website, and
I lost the invoice.
Can you forward me a copy?
Here you have the tracking# : 03073332100016836200
Original File Name: invoice.zip
9/36 of the virus engines at VT recognized it.
AntiVir 184.108.40.206 2008.09.16 TR/Crypt.FKM.Gen
Authentium 220.127.116.11 2008.09.16 W32/Heuristic-VFM!Eldorado
BitDefender 7.2 2008.09.16 MemScan:Trojan.Spy.Delf.NQT
CAT-QuickHeal 9.50 2008.09.16 (Suspicious) - DNAScan
F-Prot 18.104.22.168 2008.09.16 W32/Heuristic-VFM!Eldorado
Ikarus T22.214.171.124.0 2008.09.16 BehavesLike.Win32.Malware
Thanks TomG for submitting this one.
Last Updated: 2008-09-16 15:26:54 UTC
by donald smith (Version: 1)
A coworker (Matt) and I wanted a shorter name for ssh brute force password guessing and we combined ssh shell and phishing into SShellPhishing.
We continue to see ssh brute force password guessing attempts. Occasionally we see large increases. We have seen the attacks switch from one host attempting lots of passwords to lots of hosts that appear to share a dictionary attempting a few password username combinations (coordinated and distributed).
That was the direct result of limiting the number of times an ip could attempt to login
(fail2ban, bruteforceblocker, denyhosts, sshdfilter, pam_abi, ...).
So the cyberwar arm’s race continues with the bad guys developing tools and methods to get around common mitigation methods.
I recently wanted to validate some SShellPhishing reports I received.
One of the validation steps I used was to check those reported ip addresses against this SShellPhishing blacklist run by Daniel Gerzo. It has nearly 3k entries.
I spot checked about 40 IP addresses with other SShellPhishing lists also but every ip I checked also appears on Daniel’s list. So while I didn’t get a chance to validate his work in my previous diary https://isc.sans.org/diary.html?storyid=3529
I am now willing to say that I believe Daniel’s list has a very low false positive rate. I saw no false positives so the percentage has to be near 0%. If anyone else has the time and wishes to validate portions of his list I would appreciate any feedback.
This diary had a fairly large list ssh brute force password guessing mitigations and tools.
Combining some of those mitigation recommendations for a defense in depth approach is a good idea.
I recommend moving your ssh from port 22 as we have yet to see a single report of SShellPhishing against a port other then 22. For those of you that think that is simply security via obscurity I would agree with the following caveat forcing the bad guys to scan all 64k ports on a system prior to attacking to find the ssh port adds to the time it takes to compromise systems. It buys system owners time to react potentially preventing compromise. It buys ISPs time to notify compromised customers and it is fairly noisy.
Last Updated: 2008-09-16 13:28:48 UTC
by Joel Esler (Version: 2)
Since I posted the Apple update 10.5.5/Security Update 2008-006 earlier, I thought I might go ahead and put all the Apple Updates that have come out in the past week
1) iTunes 8.0 -- Security related updates here.
5) Quicktime update 7.5.5 -- Security related updates here.
I recommend applying all of these, obviously, as there are some pretty vital updates buried in here.
-- Joel Esler http://www.joelesler.net