Technical Tidbits™

As you may remember from several of my previous posts - RUBotted Popup and Microsoft Bulletins and Botnets,  just to name a few – that I use Trend Micro’s RUbotted regularly and recommend using it.

I’ve noticed that there is a continuous false positive appearing on my pop-up message every time I visit a specific forum I belong to on Bravenet.

Specifically, I receive this message:

(Click to see larger image)

Not only do I receive the “Botnet found” pop-up message when visiting the forum, I get the reported results that Trend Micro RUBotted has, “detected DNS query of malicious domain” without giving a IP address or a malicious domain to verify what’s up with that.

Since I’m running Trend Micro Internet Security, I don’t click the message to run House Call.  But I did run all my other tools to check for some kind strange botnet-like behavior on my machine.  And that included checking all my open connections on my computer to see if there was something running in the background that I wasn’t aware of.

But, alas and alack, there was nothing.

So that led me to start researching what the heck this message might be related to.  I researched the message, “detected DNS query of malicious domain” only to find others experiencing the same kind of problem but on different sites.

I then started looking for the trigger point of this message on the forum I belong to – which has led me to the conclusion that this is a false positive for me.

Now don’t get me wrong, there are sites that will trigger this because an advertisement or hidden code in the site page programming could be triggering it. So don’t assume that all the “detected DNS query of malicious domain” messages are all false positives. THEY ARE NOT!

For those of you who are bit more technically inclined than others, let me explain how I researched this so you can do your own bot check on a site triggering the RUBotted pop-up.

Once I was in the forum on Bravenet and I received the pop-up message that there was a botnet found, I accessed the View Page Source to see the coding behind the page I was seeing.  I looked at every single link to see if there was some outside IP address or outside website that this would trigger. All references in the links on the page referred to the forum at bravenet’s website.

However, on certain pages, there are links to websites from people writing in the forum and upon researching one of those links, I found that it had been listed as a potential malware site.  So, it isn’t necessarily the site you’re visiting that creates the false positive, it could be something on the page itself, or a link to a potential or known malware site.

There are also questions raised out there that Bravenet itself is a malicious site, but because it hosts FREE forums on the site, there’s no doubt in my mind that someone may have set up a forum with the intent of directing people to a malicious site.  But I went to Bravenet the dot com and did not receive the RUBotted message pop-up. So it was definitely not that site that was the malicious domain.

The take away point of this post is, sometimes you will get false positives.

When in doubt, assume the worse unless you know with all certainty that the site you are on is indeed safe.  In my case, the forum I belong to is an invitation only forum of professional people.

Remember, advertisements such as Google ads and others can alternate malware advertisers on a site that would trigger RUBotted. So if the site you’re visiting is heavily laden with advertising, you can safely assume that it was an ad that triggered the query of a malicious domain.

As I say repeatedly, ALWAYS err on the side of caution when it comes to security!  And I think Trend Micro’s RUBotted does that.

I hope this has helped resolve some of the confusion out there.

You may remember my earlier post: On Botnets, Lie and Corporate BullS#&t, or perhaps you saw the New Trend in Trend post where I discussed the fact that not only were mal-ads being served up through the ad servers, but that my Trend Micro was actually blocking them!

Well, alas and alack, this weekend there were some interesting developments along these lines.

I’ve been a bit of a funk lately and took the weekend off to play my online games and catch up on some personal reading. I have this tendency to leave my MySpace Mafia Wars* open in one tab, while I go look at other sites so I can wait until my 3 hours are up to collect on my Cuba Business! Those of you who play Mafia Wars know what I’m talking about! (GRIN)

Anyway, I had Mafia Wars open on one tab and then opened Tarot.com on the other so I could read my horoscope and find the SuperKC for the day. (Don’t ask! But if you’re interested: Click here for a FREE Tarot Reading**) I walked away from the computer to grab a cup of coffee or something, and when I returned, my Tarot page was switched to the following:

(Click to View Full Size Image)

Now, you might say, Debbie, how do you know it’s tarot.com that delivered the malware? Glad you asked that! Because, other people were reporting the same in the forums!

(Click to view larger image)

I also tried for several hours to reproduce the behavior as I was running my screen capture program and here’s what I discovered!

It’s very difficult – if not impossible – to catch this bugger in the act because of the way the many ads and ad programs they are running rotates. I was able to capture at least 11 different ad servers that were rotating on that site. Specifically:

• a367.yahoofs.com
• ads.lucidmedia.com
• ad.reduxmedia.com
• pixel.quantserve.com
• s7.addthis.com
• m1.2mdn.net
• doubleclick.net
• googleads
• ak.imgfarm.com
• clk.atdmt.com
• img.mediaplex.com

As I would refresh the page trying to get the mal-ad to show up again, these 11 ad servers (and more) would rotate on the page and also rotate the ads they were showing. Therefore, there are hundreds, if not millions of different possible ads that could show up at any given time on that site and individual pages!

I spent nearly 2 hours refreshing the various pages to no avail. I could not capture the mal-ad again.

But this clearly demonstrates how slick this method of pushing malware through the ad servers is!

In case you do not remember, the anti-virus scanner is one of those Trojan downloaders – AKA Drive-by downloads – that are so hard to get rid of!

If you are using Firefox – make sure your options are set correctly to help avoid these drive-bys. The first setting is to adjust your Main tab to show the download and always ask you where to save it. This gives you the heads-up that the drive-by is trying to install, AND, you can then cancel it before it installs or saves itself to your temporary folder. IE saves a copy to your temp folder long before you ever get a pop-up notice that it even blocked it. By then, it’s too late!

See the section with the red line around it below to adjust yours as I have mine adjusted:

(Click to view larger image)

Also, allow Firefox to protect you by blocking known bad sites by altering your Security options as follows:

(Click to view larger image)

If you are still stupid enough – AND YES, I CALLED YOU STUPID – to be using Internet Explorer, and you get caught with this drive-by download, (because there are other sites still dishing it out!) then go to MalwareBytes.org and download their free tool to remove it.  I am not an affiliate of this company, I don’t make any money off recommending their program to you, I just know that I’ve used it to remove these drive-bys from my clients machines. And to be honest, it’s the only thing I found that works!

Now, one final point of clarity, if this is the first time you’re reading about any of this information and you just now found our blog, then I do apologize for calling you stupid. You’re not. You are in fact very smart for finding us!

However, for the numerous amount of readers that we have on a repeat basis, if you are still using IE after I’ve preached, and shown you how dangerous it is, then you fit the stupid category! Strong words, Yes. But I don’t know what else to do to get you to listen to me!

These problems perpetuate because you are not protecting yourself! You are not educating yourself! You owe it to every other Internet citizen to stop the insanity by making this kind of behavior unprofitable to the people who send this crap out!

Okay, I’ll get off my soapbox now. Enough said?

*Please feel free to add me as a friend if you play MySpace Mafia Wars!

**TIIM This is my affiliate link to tarot.com. I earn Karma Coins if you sign up.

CORRECTION ADDED 10/11/09 Addthis.com is not an ad server! Thank you Joel for setting the record straight and thank you for letting us know!

Do you remember those e-mails that go around listing the Darwin Awards for stupidity? Well, here’s my first award nomination to what I think is the stupidest phisher I’ve ever seen!

The whole idea behind phishing is to look like such a legitimate e-mail that you get the person to click on your link and perform the requested task – which is usually to enter a username and password or your credit card information.

I had to include a full copy of the e-mail for you to appreciate the genius behind the phishing e-mail!

(Click to view larger image)

Where’s the link I’m supposed to click on so I can give you my username and password?

And thank you for  “the time in expense”????  Are you NOT from the U.S.? In which case, we could not fault you on the butchering of our language. But if you are from the U.S. then you deserve a second Darwin award!

Also, stupid phisher person, if you said you’re updating your database don’t give a second lame excuse in the next paragraph that says you’re doing something else! Pick a reason!

And my God! Learn how to spell and use English correctly if you want to phish in this country!

That being said, anyone recognizing the e-mail address or the IP for this phishing e-mail needs to take some action!

The Headers are as follows:

Delivery-date: Sat, 17 Jan 2009 06:29:38 -0800
Received: from smtp.andrew.cmu.edu ([128.2.10.159])
	by [mymail.serverremoved.com] with esmtps
	(Exim 4.69)
	(envelope-from <error@webupdate.com>)
	id 1LOCB2-0001uN-HN
	for [Myemailremoved]; Sat, 17 Jan 2009 06:29:38 -0800
Received: from webmail.andrew.cmu.edu (WEBMAIL8.andrew.cmu.edu [128.2.10.55])
	(user=anniel mech=GSSAPI (56 bits))
	by smtp.andrew.cmu.edu (8.13.8/8.13.8) with ESMTP id n0HESGRo002727;
	Sat, 17 Jan 2009 09:29:25 -0500
Received: from 41.211.223.254
        (SquirrelMail authenticated user anniel@ANDREW.CMU.EDU);
        by webmail.andrew.cmu.edu with HTTP;
        Sat, 17 Jan 2009 09:29:29 -0500 (EST)
Message-ID: <13098.41.211.223.254.1232202569.squirrel@41.211.223.254>
Date: Sat, 17 Jan 2009 09:29:29 -0500 (EST)
Subject: Confirm Your Webmail Account
From: "Webmail Account  Support Team" <error@webupdate.com>
Reply-To: surportteam55@mail2webmaster.com
User-Agent: SquirrelMail/1.5.1 [CVS]

So this gets way better!

I looked up the first IP address: 41.21..223.254 and it’s some broadband  location in Sapele, Nigeria!

But I also looked up andrew.cmu.edu and here’s what the website says this is:

The www.andrew.cmu.edu server provides a place for members of the Carnegie Mellon community to publish course, organization, and user web pages.

Then! I looked up the 128.2.10.55 and guess what??? It’s definitely Carnegie Mellon’s webmail!

So, it looks like you might have to clean up your servers Carnegie Mellon! Someone may have a botnet on their machines!

And in case you’re wondering why I’m getting such a big freaking kick of busting out Carnegie Mellon, guess what they run?

CERT! Computer Emergency Response Team and they’re the one’s issuing all kinds of security advisories all the time! Check it out! They are also a part of Homeland Security!

http://www.kb.cert.org/vuls/

But hey, what do I know!?  Certainly not as much as they do!  Do you think I’ll get the men in black on my doorstep if I nominate them for a Darwin Award too?

ROFLMAO