RE: new internet explorer exploit (was new worm)

[Drew Copley]

=20

> -----Original Message-----
> From: Jelmer [mailto:jkuperus@planet.nl]=20
> Sent: Monday, March 29, 2004 6:36 AM
> To: full-disclosure@lists.netsys.com; bugtraq@securityfocus.com
> Subject: new internet explorer exploit (was new worm)
>=20
> The code used by this worm to exploit it's users at least=20
> partly is (i
> think) new , the vulnerability it abused has afaik not been=20
> published on
> eighter bugtraq or full-disclosure. possibly making it (one=20
> of?) the first
> worm to totally catch people offguard.

Yeah. It is a zero day worm, and it is very notable as such. =20

I can not recall a previous zero day worm. (AV is not my job, but I do
try and follow zero day.)

Hence, IE has birthed us the first zero day worm.

We should be thankful it was not coded better, because it could have
caused some really serious problems. A hundred thousand systems is
really a low target when you consider 94% of all browsers being used are
IE and the internet population is around the 400 million figure.

A zero day worm in IE:
post on Feb 19, 2004
http://www.securityfocus.com/archive/1/354447

Thor's post which archives various vendor's papers on it (Feb 25 2003):
http://www.securityfocus.com/archive/1/355149/2004-02-24/2004-03-01/0

Someone in Russia is making some nice cash. As usual. Or, something even
nastier is going down. (Nastier then the Red Mafiya??)

Hopefully, someone with a badge somewhere is investigating this. But,
looking up "bizex investigation" in google news turns up zero hits.
Maybe because "we" (all of the nations of the world) forgot to create
some kind of online police force. Doh.

Just like the Wild West. The only law is Pinkerton. How sad.

Echo... Echo...

[Void]

Just wanted to add that Norton Anti-Virus 2004 will detect this exploit and
pop up a warning, but also fails to halt its execution or protect the user
in any way.

Here is what it thinks it is:

http://securityresponse.symantec.com/avcenter/venc/data/bloodhound.exploit.6.html

So there is some measure of warning, but no real protection.


At 04:35 PM 3/29/2004 +0200, Jelmer wrote:
>The code used by this worm to exploit it's users at least partly is (i
>think) new , the vulnerability it abused has afaik not been published on
>eighter bugtraq or full-disclosure. possibly making it (one of?) the first
>worm to totally catch people offguard.
>
>It allows a mallicious person to take any action on an unsuspecting user who
>view's a specially prepared page's pc
>
>The known ingredient it uses is :
>http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2003-08/1758.html
>that has gone unpatched for over 5 months now
>
>The remainder of the exploit manages to confuse this same adodb.stream
>object enough to make it think it's being run from a local location
>
>You can protect yourself against it by running
>http://ip3e83566f.speed.planet.nl/hacked-by-chinese/fix.reg
>
>
>I attached sample code myself to illustrate the problem, because
>http-equiv's was messy :)
>This one should be more straightforward to use
>
>Instructions :
>
>1. unzip
>2. overwrite exploit.exe with the executable you wish to run, or leave it
>untoched if you want to see some nice texturemapped rotation
>3. upload the files to a webserver
>4. view exploit.htm
>
>Tested on winxp pro all patches
>
>for the lazy ones among you can also view a demonstration here :
>
>http://ip3e83566f.speed.planet.nl/security/newone/exploit.htm

[Berend-Jan Wever]

----- Original Message -----
From: "Drew Copley" <dcopley@eeye.com>
> Yeah. It is a zero day worm, and it is very notable as such.
>
> I can not recall a previous zero day worm. (AV is not my job, but I do
> try and follow zero day.)
>
> Hence, IE has birthed us the first zero day worm.
>
> We should be thankful it was not coded better, because it could have
> caused some really serious problems. A hundred thousand systems is
> really a low target when you consider 94% of all browsers being used are
> IE and the internet population is around the 400 million figure.

Just be thankfull the guy didn't take the time to find a 0day xss issues in
webbased e-mail services like hotmail/yahoo/etc... I still wonder why these
have not been exploited by email virii: They're not that hard to find (check
your archives) and it's just too easy to code a small worm in javascript for
these sites (I know from experience). The only propagation limiting problem
is that all trafic goes through centralized servers which can be easily
updated (check your archives for site-specific responds times). But if you
combine it with your regular e-mail worm techniques, you can be sure
propagation continues after that fix.

Cheers,
SkyLined

[Thor Larholm]

Drew Copley already mentioned how this is the CHM exploit that the Ibiza
exploit relied on.

K-OTiK posted about this in
http://www.securityfocus.com/archive/1/354447 and we posted details of
the Ibiza CHM exploit a few weeks before then on the Unpatched mailing
list ( http://unpatched.pivxlabs.com ).

The Bizex worm also used Unpatched IE vulnerabilities as was detailed in

http://www.securityfocus.com/archive/1/355149/2004-02-24/2004-03-01/0

Implementing proactive security measures such as locking down the My
Computer zone prevents this from having an effect. Both of these issues
were mitigated against months in advance with Qwik-Fix, which has just
been released as Qwik-Fix Pro at the Gartner Symposium/Itxpo 2004
..

http://www.pivx.com/press_releases/qwikfixpro_gartner.html



Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
Qwik-Fix
<http://www.qwik-fix.net>=20


-----Original Message-----
From: Void [mailto:void@sect.net]=20
Sent: Monday, March 29, 2004 11:15 AM
To: Jelmer; full-disclosure@lists.netsys.com; bugtraq@securityfocus.com
Subject: Re: new internet explorer exploit (was new worm)


Just wanted to add that Norton Anti-Virus 2004 will detect this exploit
and=20
pop up a warning, but also fails to halt its execution or protect the
user=20
in any way.

Here is what it thinks it is:

http://securityresponse.symantec.com/avcenter/venc/data/bloodhound.explo
it.6.html

So there is some measure of warning, but no real protection.

[Jelmer]

And even that small measure of warning is trivially defeated

if I change the url in my exploit.htm from

ms-its:mhtml:file://C:\foo.mht!${PATH}/EXPLOIT.CHM::/exploit.htm

to

&#109;s-its:mhtml:file://C:\foo.mht!${PATH}/EXPLOIT.CHM::/exploit.htm

It gives no warning whatsoever, proofing once again that you shouldn't
solely rely on virus scanners, though others might do a better job, I can't
imagine anyone doing it worse



----- Original Message -----
From: "Void" <void@sect.net>
To: "Jelmer" <jkuperus@planet.nl>; <full-disclosure@lists.netsys.com>;
<bugtraq@securityfocus.com>
Sent: Monday, March 29, 2004 9:15 PM
Subject: Re: new internet explorer exploit (was new worm)


> Just wanted to add that Norton Anti-Virus 2004 will detect this exploit
and
> pop up a warning, but also fails to halt its execution or protect the user
> in any way.
>
> Here is what it thinks it is:
>
>
http://securityresponse.symantec.com/avcenter/venc/data/bloodhound.exploit.6.html
>
> So there is some measure of warning, but no real protection.
>
>
> At 04:35 PM 3/29/2004 +0200, Jelmer wrote:
> >The code used by this worm to exploit it's users at least partly is (i
> >think) new , the vulnerability it abused has afaik not been published on
> >eighter bugtraq or full-disclosure. possibly making it (one of?) the
first
> >worm to totally catch people offguard.
> >
> >It allows a mallicious person to take any action on an unsuspecting user
who
> >view's a specially prepared page's pc
> >
> >The known ingredient it uses is :
> >http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2003-08/1758.html
> >that has gone unpatched for over 5 months now
> >
> >The remainder of the exploit manages to confuse this same adodb.stream
> >object enough to make it think it's being run from a local location
> >
> >You can protect yourself against it by running
> >http://ip3e83566f.speed.planet.nl/hacked-by-chinese/fix.reg
> >
> >
> >I attached sample code myself to illustrate the problem, because
> >http-equiv's was messy :)
> >This one should be more straightforward to use
> >
> >Instructions :
> >
> >1. unzip
> >2. overwrite exploit.exe with the executable you wish to run, or leave it
> >untoched if you want to see some nice texturemapped rotation
> >3. upload the files to a webserver
> >4. view exploit.htm
> >
> >Tested on winxp pro all patches
> >
> >for the lazy ones among you can also view a demonstration here :
> >
> >http://ip3e83566f.speed.planet.nl/security/newone/exploit.htm
>
>

[Nick FitzGerald]

Void <void@sect.net> wrote:

> Just wanted to add that Norton Anti-Virus 2004 will detect this exploit and

Of course, what you mean is "this specific exploit".

You wouldn't -- unlike the snake-oilers at Symantec (and many other AV
companies) -- want to imply that its detection of the specific exploit
instance you tested (i.e. using Jelmer's example) is any kind of
indication of NAV's (etc...) detection of any and all possible exploits
of this vulnerability now, would you??

> pop up a warning, but also fails to halt its execution or protect the user
> in any way.

Oh joy...

> Here is what it thinks it is:
>
> http://securityresponse.symantec.com/avcenter/venc/data/bloodhound.exploit.6.html
>
> So there is some measure of warning, but no real protection.

You mean, of course, "there is some level of warning against sonme
unknown portion (perhaps as small a one over ininfity) of possible
exploits of this vulnerability".

I guess the handy thing, at least historically, is that the dweebs that
have used such things in their viruses and worms have tended to copy
the PoC examples as near as damnit to the letter, so have tended to be
prematurely detected.

Of course, _this_ exploit was discovered, analysed and somewhat fully
documented by the likes of "http-equiv" and Jelmer _AFTER_ it had been
discovered by someone else, not publicized and then used in a rather
"successful" worm. So maybe the writer of that worm is not one of your
typical skiddie types and the number of not publicly known functional
exploits of this vuln that are not detected by NAV, etc is worrying
higher than usual?


--
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854