Search Logger
Archives for May, 2008.

Archive for May, 2008

When SQL Injections Go Awry, Incident Case Study

3:37 am - May 31, 2008 in Anti-Malware Engineering Team

It seems to be the "in-thing" these days - using an automated tool to perform SQL injections against vulnerable sites across multiple domains. Although the attack method isn't new, some sites are hit multiple times, as evident by a corruption of the injection code when one attacker overwrite a previously injected record. Below, you can see cached search results when searching for a specific known script injection:


image_1
Image 1: Search results indicating embedded scripts - multiple attacks


In the above highlighted portion, note the beginning of an original script tag injection being superimposed with another script tag injection. Below, you can see the effect of multiple attacks on another site and as evident in the page source:

 

image_2
Image 2: HTML source indicating multiple embedded script tags from various SQL injection attacks
 

Speaking of SQL injections however, one has to wonder - what's all the hype? What are attackers after or what is their motive? It would seem that there are several motives, but one motive that may (or not) be surprising is the uprising in injecting code that executes multiple exploits in an attempt to download and execute game password stealers. Let me say that again - game password stealers.

We continue to monitor injected scripts, and add detections to cover various iterations - the threats are detected as "Trojan:JS/Redirector":


image
Image 3: Microsoft Forefront Client (FCS) Security Warning alert

 

Our friends over at ShadowServer have compiled a list of offending domains that are either compromised and don't know it, or are under control of an attacker and are hosting (or did host) malicious scripts or executables. Below is a list as of May 14 2008 of domains, courtesy of this link:
http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20080514

Domain

nihaorr1.com
free.hostpinoy.info
xprmn4u.info
nmidahena.com
winzipices.cn
sb.5252.ws
aspder.com
11910.net
bbs.jueduizuan.com
bluell.cn
2117966.net
s.see9.us
xvgaoke.cn
1.hao929.cn
414151.com
cc.18dd.net
yl18.net
kisswow.com.cn
urkb.net
c.uc8010.com
rnmb.net
ririwow.cn
killwow1.cn
qiqigm.com
wowgm1.cn
wowyeye.cn
9i5t.cn
computershello.cn
z008.net
b15.3322.org
direct84.com
caocaowow.cn
qiuxuegm.com
firestnamestea.cn
a.ka47.us
a188.ws
qiqi111.cn

Approximate # of
Pages Injected
468,000
444,000
369,000
140,000
75,000
69,000
62,000
47,000
44,000
44,000
39,000
39,000
33,000
20,000
17,000
15,000
15,000
13,000
13,000
9500
7000
6000
4000
3600
3500
2800
2500
2300
1600
1200
1100
900
800
700
600
500
230

 

I was reviewing the 'qiqi111.cn' attack and learned that the malicious script requested files from these domains: 'pigzd.cn' and 'dota11.cn'. I decided to follow the white rabbit, taking the first domain and I began to retrieve the malicious script 'am6.htm' (identified already as "Exploit:JS/Repl.B").

The script 'am6.htm' contains a handful of attack methods, attempting exploits to download and execute more code:

image_4  
Image 4: Source code of 'am6.htm' illustrating the attack methods


I know what you're saying, "what the heck, what are all these iframes?", so let's take a quick look at them:

  1. This attack focuses on systems that have not applied Microsoft Security Bulletin MS06-014. The attack specifically targets a Microsoft Data Access Components (MDAC) ADO ActiveX Control "RDS.DataSpace" in order to execute arbitrary code, or in this case, another Web hosted script - identified as "TrojanDownloader:JS/Psyme.BA" - it tries to retrieve and execute an online game password stealer as a file named "mm.exe" (from the domain 'gf.ccves.cn')
  2. This attack executes the ActiveX control for RealPlayer - this method also allows execution of code - identified as "Exploit:HTML/Repl.D"
  3. This attack exploits a 0 day vulnerability in an Avatar ActiveX control for Ourgame GLWorld named "C:\Program Files\GlobalLink\Game\Share\GLAvatar.ocx" and referenced by its control "GLAVATAR.GLAvatarCtrl.1" - when the ActiveX control executes, it loads a script that contains a vulnerability against another ActiveX Control contained in 'GLIEDown2.dll', a library component of GLWorld; there isn't yet a CVE (Common Vulnerabilities) ID for this vulnerability, thus it's considered "0 day". It was issued a Bugtraq ID 29118, and as of the time of this writing there, public awareness of the vulnerability seems somewhat low, and not well discussed other than this blog entry, and one from Trend Micro - the HTML file 'axlz.htm' is identified as "Exploit:JS/Gdow.A"

    Incidentally, there are other known exploits components of GLWorld (www.ourgame.com):
    * Multiple Buffer Overflow Vulnerabilities within "HanGamePluginCn18.dll" referenced by this control:
    HanGamePluginCn18.HanGamePluginCn18.1

    * Stack-based Buffer Overflow Vulnerability within "GLChat.ocx" referenced by this control:
    GLCHAT.GLChatCtrl.1

    * Ourgame 'GLIEDown2.dll' ActiveX Control Remote Code Execution Vulnerability referenced by this control:
    GLIEDown.GLIEDown.1
  4. This attack exploits a vulnerability in Baofeng Storm StormPlayer ActiveX control - identified as "Exploit:Win32/Senglot.J"
  5. This last method is an attack against an ActiveX control for Xunlei Thunder DapPlayer - this file was not available at the time of this writing

So with five opportunistic attacks, the odds increase in favor of acquiring some Internet nasties and we will continue to monitor these attacks.

Additional Resources

During our research, we analyzed some of the malicious scripts. More details about these scripts are available at our Microsoft Malware Protection Center Encyclopedia:
http://www.microsoft.com/security/portal/Entry.aspx?Name=Trojan:JS/Redirector.H
http://www.microsoft.com/security/portal/Entry.aspx?Name=Trojan:JS/Redirector.I
http://www.microsoft.com/security/portal/Entry.aspx?Name=Trojan:JS/Redirector.J
http://www.microsoft.com/security/portal/Entry.aspx?Name=Trojan:JS/Redirector.K
http://www.microsoft.com/security/portal/Entry.aspx?Name=Trojan:JS/Redirector.L
http://www.microsoft.com/security/portal/Entry.aspx?Name=Trojan:JS/Redirector.M
http://www.microsoft.com/security/portal/Entry.aspx?Name=Trojan:JS/Redirector.N


Additional resources and recommendations are available from the Security Vulnerability Research & Defense team: http://blogs.technet.com/swi/archive/2008/05/29/sql-injection-attack.aspx 


and from Bala Neerumalla, Microsoft Corporation, who discusses common coding mistakes in ASP code that can lead to SQL Injections in the following article:  http://msdn.microsoft.com/en-us/library/cc676512.aspx

 

 -- Patrick Nolan

 

Uninterrupted Viewing Experience

5:43 pm - May 30, 2008 in Google Video Blog


We know a lot of you are committed multi-taskers, and hey, who doesn't love the TV view for efficient video searching? To make you even better multi-taskers, we've added a feature that allows you to browse through multiple results pages, sort, filter or refine your search query- all without interrupting the video you're watching. The list and grid views also inherit this feature.

We hope that this feature will make your video searching and viewing more enjoyable.

Follow these steps to check it out:

1. Conduct a search using any query and click on a result to play a video.
2. While the video is playing, scroll to the bottom of the results and click back and forth between the pages of results. For example, click "Next" or "Previous", or click on the page number.
3. You can also go to the search box at the top and perform a new search. New results will be displayed, but the current video keeps playing.


 

All swickis up and running

10:45 am - May 30, 2008 in Eurekster Blog

We're happy to let you know that our service has been fully restored and all your swickis should be back up and running again. Again, sorry for any inconvenience and thank you so much for your patience with us! In case you experience any further issues, please contact us at swickifeedback (at) eurekster.com or visit our user network swicki shoutouts.

 

Neo Geo Blog

7:20 pm - May 28, 2008 in Google Maps API Blog

I have good news and bad news. Let's start with the bad.

The bad: After 2 years, 6 months, and 14 days of dedicated developer community service, the Official Google Maps API Blog is being retired. That's right... the blog you're reading right now, right here, is no more, starting today. No more news will be posted here.

The good: All is not lost! A new blog is taking this blog's place: The Google Geo Developers Blog. Hop on over there to see the first post and get the full story on the change.

So if you're reading this post in an RSS reader, be sure to subscribe to the new blog's feed. And if you're reading this post right on blogger itself, be sure to update your bookmark. Because there will still be plenty of continued Maps API news... you just won't be able to catch it here.

See you all over at the new blog!

 

App Engine, Local Search, & Maps: Making Static Maps… Interactive?

12:50 pm - May 28, 2008 in Google Maps API Blog

JavaScript and Flash are great for putting Google Maps on your website, but sometimes they just won't do. For mobile browsers or users with dial-up connections, simpler is better. So I wrote an open source non-JavaScript version of Google Maps which is designed to show how easy it is to write an application on App Engine that makes use of two new APIs from Google: The Static Maps API and the Local Search API's REST interface. It doesn't have advanced features like street view and public transportation, but it gives you a searchable map that you can zoom in/out on as well as save locations. It also automatically saves your last map view so that every time you go back to the site it will show you what you were last looking at. Check out the source code.

It uses App Engine to store saved points, the AJAX LocalSearch REST API for search functionality, and the Static Maps API to display maps. App Engine is easy to learn and the data store is useful for this kind of application. The REST API for LocalSearch is also very simple. For more information on it, go here.

To use the Static Maps API, you just need to create a URL with the proper parameters for your desired map view. Keep in mind that you need to set the zoom level (unless you are specifying multiple points — then it's calculated for you). In the vast majority of cases, this is completely fine. In my case, though, I needed to know what the zoom level was, so that I could give the user the option to zoom in/out. That meant coming up with calculations of the zoom both for the multiple points and single point case, and that was the trickiest part of the app.

If you use the AJAX Local Search and it returns one result then there will be a viewport object returned with it. This viewport contains the Northeast and Southwest latitude/longitude bounds that are optimal for displaying this point. However, Static Maps only accept zoom levels and center points. Here's the Python to generate that information:

viewport = json['responseData']['viewport']
mercator_projection = MercatorProjection(18) # Checkout the MercatorProjection class
southwest = [float(viewport['sw']['lat']),float(viewport['sw']['lng'])]
northeast = [float(viewport['ne']['lat']),float(viewport['ne']['lng'])]
bounds = [southwest, northeast]
zoom_level = mercator_projection.CalculateBoundsZoomLevel(bounds, MAP_SIZE)
At this point you will have everything you need to construct the map: the center point (the Local Search point), zoom level, marker point.

Then there's the case where you have multiple points returned by the AJAX Local Search. Since we will have a collection of latitudes and longitude points that we want to display we can just find the min/maxes, do some rounding, and voilà you get a bounding box. With a bounding box and a calculated center point, you can repeat the same steps as before.

mercator_projection = MercatorProjection(18)
bounds = CalcBoundsFromPoints(lats, lngs)
center_point = CalcCenterFromBounds(bounds)
zoom_level = mercator_projection.CalculateBoundsZoomLevel(bounds, MAP_SIZE)

From line 121 to about 285 you'll find all the necessary functions for the situations described above. Try using this code to create your own interactive version of Static Maps, and let us know in the forum if you have questions or just want to show off your nifty app.

 

Join a new Windows Live user community.

10:21 pm - May 27, 2008 in Inside Windows Live Messenger:

 

 aaron posted by Aaron

We here at Windows Live love to create software that makes keeping in touch with your personal community fun and exciting. If you love to chat on Windows Live Messenger, use Windows Live Writer to post to your Windows Live Spaces page and post photos from Windows Live Photo Gallery then we have just the community for you.

We are looking for people to share their stories, tips or tricks, or product reviews of Windows Live with others. We’ll show the world what amazing things you can do with Windows Live.

You can start by taking this quick survey so we know where to get you plugged in.

Thanks for being part of our Windows Live community!

 

Bloglines Continues to Lead Google Reader

10:12 pm - May 26, 2008 in Bloglines | News
Heather Hopkins of Hitwise has a new post for all you Blogliners out there. She's a VP of Research at Hitwise, a leading web analytics firm. She writes, "It (Bloglines) is the most popular web-based feed reader based on share of US visits." Or in other words, Bloglines is beating Google Reader in the U.S. In an interview done by RW/W on August of 2007, I said it was a "2 horse race." It still is.

Heather goes onto write about the differences between the user bases.

  • Bloglines users are also more inclined toward Photography websites, while Google Reader users are more inclined to visit Television websites.
  • ...Bloglines users are 24% more likely to continue on to a retail (Shopping & Classifieds) website.

It would be interesting to hear from Blogliners on your blogs to see if you really do track more photography websites. We launched a Flickr feed module in Bloglines Beta for our photography enthusiasts. We hope you liked the feature and also like Bloglines Beta.

Enjoy!

- Eric Engleman and the Bloglines Team

 

Search Personas – Evolving the Design

3:26 am - May 26, 2008 in Trexy Search Engine
Meg and I are starting to build up "search user personas" for the next phase of the design of Trexy. We're actively looking for people to tell us how they use search engines and what motivates them. Why? So we can tune in the 'interaction design' for the next version of Trexy. We want Trexy to 'scratch an itch' and hit the mark for blog publishers, topic-specific search engines and search users.

We've picked up a lot from attending conferences, the Flag & Bell, and witnessing the sins of search so we already have many pieces of the puzzle but this is a tricky design problem - fortunately we're still having fun solving it!
 

geo search 2.0: Data In, Data Out

12:05 pm - May 22, 2008 in Google Maps API Blog

Last week during the geo madness of Where2.0 and WhereCamp, we announced two enhancements in geo search to make it both easier for developers to get their data into our geo search index and easier for developers to get data back out of the index:

  • Geo Sitemaps: Sitemaps are a protocol that bots use to index content from websites. Last year, we announced the ability to include KML/GeoRSS files in regular sitemaps just like a normal web resource. This year, we announce a special extension for sitemaps that adds geo-specific tags and makes it easier for us to index. To get your geo content indexed as fast as possible, just submit the sitemap to Google Webmaster Central. For more information on creating a KML file to include in a sitemap, read this article in the KML documentation. An example geo sitemap listing a KML and a GeoRSS file is shown below:
  • <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
            xmlns:geo="http://www.google.com/geo/schemas/sitemap/1.0">
    <url>
       <loc>http://www.example.com/download?format=kml</loc>
       <geo:geo>
           <geo:format>kml</geo:format>
       </geo:geo>
    </url>
    <url>
       <loc>http://www.example.com/download?format=georss</loc>
       <geo:geo>
           <geo:format>georss</geo:format>
       </geo:geo>
    </url>
    </urlset>
    
  • Geo search in the API: The Local Search API has traditionally been used to return business listings and address geocodes. As of last week, it can now be used to retrieve any of the content we have in our geo index. There are a couple different ways to do this, depending on how you use the API. If you're using the LocalSearchControl, here's some sample code (and live example) that will return blended results:
  • var options = {
      listingTypes : GlocalSearch.TYPE_BLENDED_RESULTS
    }
    map.addControl(new google.maps.LocalSearch(options));
    
    If you're using the Local Search API from Javascript, here's some sample code to return only results from indexed geo files:
    var ls = new GlocalSearch();
    ls.setRestriction(GSearch.RESTRICT_TYPE, GlocalSearch.TYPE_KMLONLY_RESULTS);
    
    And finally, if you're using the Local Search API from somewhere other than Javascript - for example, with our new nifty Maps API for Flash - here's some sample AS3 code (and live example) to return only results from indexed geo files PLUS add a site restrict operator to limit it to results from platial.com:
    service.url = 'http://ajax.googleapis.com/ajax/services/search/local';
    service.request.q = "site: platial.com" + " " +  address.text;
    service.request.mrt = "kmlonly";
    service.addEventListener(ResultEvent.RESULT, onServerResponse);
    service.send();
    

There are (atleast) two really cool consequences of this news: 1) you'll be able to enable users of your mashups to instantly find international results where previously none existed, and to be able to find results for non-standard searches (e.g. "dog parks"), and 2) by indexing your content, waiting a few weeks, and then using the local search with a "site:yourdomain.com" appended to the query, you get to leverage the power of google search on your own content with barely any code of your own.

So what are you waiting for? Give us your geo sitemap, use our API calls, and let us know what you think in the Maps API, KML, or AJAX API forums.

 
 
 
 
 
 
It's All About Search | © clsc.net |
2010.03.1222:16
Tech used here: Valid HTML - Valid CSS - Valid RSS - JavaScript - PHP - Smarty - MySQL - and a partridge in a pear tree.