Forum Moderators: phranque
The U.S. Computer Emergency Readiness Team said computer users also could protect themselves by disabling JavaScript in their Web browser software. However, that "may also degrade the appearance and functionality of some Web sites that rely upon JavaScript," the team noted.
This from the same agency that recommended everyone buy duct tape and plastic sheeting to protect against chemical attacks.
And no, I don't want to start a "why we should all disable javascript" argument on this thread.
[isc.sans.org...]
If your SERVER was compromised, you will observe:* All files sent by the web server will include the javascript. As the javascript is delivered by the web server as a global footer, images and other documents (robots.txt, word files) will include the javascript as well.
* The files on your server will not be altered. The javascript is included as a global footer and appended by the server as they are delivered to the browser.
* You will find that the global footer is set to a new file.
We do not know at this point how the affected servers have been compromised. The SSL-PCT exploit is at the top of our list of suspects.
If you visited an affected page, and your BROWSER is compromised:* you may see a warning about a javascript error. But it depends on how the attack code interfers with other javascript on the respective page, and many users disable these javascript warnings.
* Disconnect the system from the network as soon as possible.
* run a thorough virus check with up to date virus definitions. Many AV vendors released new definitions as recently as last night.
* If you are able to monitor traffic to the infected host, you may see attempts to contact 217.107.218.147 on port 80.
* AV software will detect the javascript as 'JS.Scob.Trojan'.
Reports indicate that Web servers running Windows 2000 Server and IIS that have not applied update 835732, which was addressed by Microsoft Security Bulletin MS04-011, are possibly being compromised and being used to attempt to ]b]infect users of Internet Explorer[/b] with malicious code.
If this is a javascript file that does the dirty work, couldn't other browsers be affected as well?
If this is a javascript file that does the dirty work, couldn't other browsers be affected as well?
From ISC:
The javascript uses a so far unpatched vulnerability in MSIE to download and execute the code. No warning will be displayed. The user does not have to click on any links. Just visiting an infected site will trigger the exploit.
So it's MSIE-only if I understand it correctly.
So it's MSIE-only if I understand it correctly.
Yup. This affects ALL Windows Internet Explorer versions, even when fully patched. There is no patch to fix this as Microsoft has been twiddling its thumbs. And the list of websites being used to install this exploit now includes personal websites and banks.
So, the only way to surf safely with Internet Explorer right now *IS* to disable Javascript.
Or you could go and get yourself a REAL browser :-)
[mozilla.org...]
JS/Scob-A downloads a file from a Russian website, this website is no longer accessible.
From Security Focus [securityfocus.com]:
Time to Dump Internet Explorer
...It could be possible for an attacker who exploited this vulnerability to run arbitrary code on a user's system. If a user visited an attacker's Web site, it would be possible for the attacker to exploit this vulnerability without any other user action.
That article was written Jun 17 2004, 1 week before this exploit was discovered.
I'd agree, time to dump IE, or at least turn off all active x/javascripting. Microsoft has had plenty of time to deliver a secured browser/ web server, there is no reason for the market or consumers to put up with this kind of nonsense, either IIS or IE, just dump all that garbage.
Installing constant security patches is not a solution, it's an indication of how serious the problem is.
[edited by: isitreal at 5:24 pm (utc) on June 25, 2004]
I'll have to spend my weekend and most of next week rebuilding a site so as noneone will panic and think it was me ....
And this was the first sunny weekend we've had here in the last 3 weeks ...:(
[edited by: tedster at 4:50 am (utc) on July 1, 2004]
Bit of a non-starter: JS/Scob-A
Can anyone confirm that the hacked websites were all running IIS? It's not clear in the information provided so far...
The ones being reported on are IIS, simply because IIS is the easiest to crack. Realistically, it doesn't matter the server you hack as long as you get your payload delivered.
And just because that Russian site is offline doesn't mean you're safe. Anyone can install anything they want into IE with their own website. It could be a zombie, a simple trojan, something to erase your hard drive... ANYTHING they want!
Microsoft has known of this vulnerability for quite some time. It was already being exploited by a spyware company to automatically install porn popup software. It isn't new. This is just a new way of exploiting it... combining the weakness of IE with the weakness of IIS.
Modifies the configuration of IIS Web sites on the infected computer to make one of the iisXXX.dll files the document footer.
This is an IIS only exploit, apparently.
Here is the MS security update [microsoft.com].
More stuff on itvibe [itvibe.com]
And on f-secure:
[f-secure.com]
Accoding to reports, the script has not been appeded by modifying the actual files on the server but using the so called footer feature from Microsoft's Internet Information Server.... there has been reports that this downloader has been used to install variants of Padodor backdoor. Further information about Padodor is available at: [f-secure.com...]
Russia may be the home of spam these days but that sort of hacking will likely be considered as crossing the line - BIG TIME.
Kaled.
At least with MS you get updates. If this kind of attack was happening on linux it would take a while to get a fix and it would not be automatic.
We're not actually talking about a zero-day exploit here: the current analysis by the security folk is saying that the vulnerability is to do with something called the "adodb.stream" (I'm not a security person, so I can't go into any more detail). Problems with the adodb.stream were found ten months ago. There is still no patch, no workaround, nothing. Only last week, there was a real zero-day exploit in the Linux kernel, and only last night, I downloaded and installed a patched kernel with a one-line command.
What are Microsoft's billions buying you?
This is categorically not script-kiddie stuff going on. The people behind this are true, old-fashioned professional criminals. They don't hold grudges against Microsoft or anyone else, they just look for the easiest path. In this case, the easiest path was via Windows servers running IIS.
More information from Symantec here [tms.symantec.com]. To quote:
The malicious JavaScript in question is designed to compromise client systems through multiple known, but unpatched vulnerabilities in Internet Explorer.
He wanted to know why, and I responded "Because there is no way you can guarantee me even reasonable security for my account online, and you require IE to access your services, and IE is a buggy, hacker magnet, POS."
My account manager went on an on about security measures they take, and that he uses IE all the time an rarely has any propblems...
I laughed at him and called him a naiive fool. The conversation went downhill from there.
I think I'll e-mail him a link to that Security Focus article, and to the F-Secure weblogs.
Anyone who keeps defending IE and MS after this, is a deluded "extremist" who'll never learn.
I feel no pity for banks and large instituions who feel the wrath of this or other similar IE and MS server related issues. They're big boys, and they should do their research and act accordingly.
I DO, however, feel sorry for all the "Aunt Tilly" types out there. They just want convenience, reliability, and security, without having to become a geek and do endless research.
IMHO: Microsoft should be fined out of existence by the government.
MS twiddles its thumbs over known vulnerabilities (this is a vulnerability that has been known about in security circles for well over a year), and these vulnerabilities place the public's financial well being at the mercy of criminals.
If a Bank was as careless with our money, then the Securities and Exchange Commission would shut them down in a heartbeat and divide up its assets among more reliable instituions.
[62.131.86.111...]
(an analysis of the attached code on the IIs servers)
This is NOT a pure javascript hole. It's using activex to install the malware.
It's using the "adodb.stream" activex issue that was reported to Microsoft on Aug 26 2003.
All you have to do is block activex and you are set. No need to block javascript as a solution which is overkill.
MSJava and activex are the devastating issues in IE, not javascript.
Rip out MSJava with microsoft's uninstall tool, and block activex in your settings.
Kk32.dll and
Surf.dat
"somewhere" I guess what they mean is a random location at target boxes.
Any mention of that somewhere else for a second opinion?
[edited by: tedster at 4:53 am (utc) on July 1, 2004]
This is NOT a pure javascript hole. It's using activex to install the malware.It's using the "adodb.stream" activex issue that was reported to Microsoft on Aug 26 2003.
All you have to do is block activex and you are set. No need to block javascript as a solution which is overkill.MSJava and activex are the devastating issues in IE, not javascript.
Rip out MSJava with microsoft's uninstall tool, and block activex in your settings.
Right on the explanation, but what are the settings to block it? I haven't seen any short of disabling Active Scripting that will.
Set these across all 4 security zones:
Download Signed ActiveX Controls: Disabled
Download Unsigned ActiveX Controls: Disabled
Initialize and Script ActiveX Controls Not Marked As Safe: Disabled
Run ActiveX Controls and Plugins: Disabled
Script ActiveX controls marked safe for scripting: Disabled
Java Permissions: Disabled
Then try the exploit test (a harmless graphics program)
Guess what? Still works. So disabling ActiveX and Java doesn't solve the problem.
[62.131.86.111...]
I get around this problem as my firewall can turn off activex entirely for IE (ATGuard, or newer bloated version from Norton as NIS) but I realize this isn't an answer for the mainstream users.
I'll have to use IE to check my site, but otherwise...
MS Blamers:
Reports indicate that Web servers running Windows 2000 Server and IIS that have not applied update 835732, which was addressed by Microsoft Security Bulletin MS04-011, are possibly being compromised and being used to attempt to infect users of Internet Explorer with malicious code.
Important Customers who have deployed Windows XP Service Pack 2 RC2 are not at risk.Check http:/*www.microsoft.com/security/incident/download_ject.mspx
IE Users: If you allow ActiveX regardless, then it is you to blame
My mom has no idea what activeX is and I am sure never will. So if there are fundamental security flaws that fault lies with the manufacturer. Not because a novice can not figure out how or why to use the advanced security options.
anyone seen GG smiling when reading this thread, and hiding from gembarrasing threads
But seriously the people that do ecommerce should thank their lucky stars that media really did not pick up what happened and what sites were hit. This is the type of stuff that can do very serious damage to ecommerce.
