Virus Blog

Some thoughts about the future

— Posted by zeroq @ 13:03 - 18 Jan, 2009

With the introduction of IP Version 6 getting closer and closer, the classical search, find and compromise tactics will surely fade away. Thus attackers will shift to more client side exploitation in order to compromise new machines. With this trend services like email, DNS servers, and network routing infrastructure will be the number one targets in the future. For this reason i expect SPAM to increase as it is the easiest way to reach new victims without much effort. Vulnerabilities in email clients or malicious attachments are already increasing in todays email traffic.

As IPv6 heavily relies on a working DNS infrastructure, attacks on DNS servers will increase as well. An attacker who controls a DNS server controls all clients using this server. With the help of compromised DNS servers attackers can direct victims to prepared websites exploiting vulnerabilities in browsers or harvest user credentials with the help of phishing sites. With the compromise of network infrastructure such as switches or routers things will even get worse. Thus it is of interest to develop tools to detect, monitor and understand attacks on DNS and network infrastructure as well as find a solution for the ever increasing SPAM messages filling the inboxes.



Webmail Roundcube Scanning

— Posted by zeroq @ 10:03 - 16 Jan, 2009
we are monitoring quite a few scans for the roundcube webmail software at our low-interaction honeynet running amun (latest svn version). Scans seen so far target two vulnerabilities as reported by the internet storm center as well. In the past month (october 2008 till december 2008) we saw six different IP addresses. Two from England, one from China, one from Guatemala, one from the US, and one from Germany. The two from England scanned for the html2text file, the others for the msgimport.

The first request looks like this:
HEAD /roundcube/bin/html2text.php HTTP/1.0
HEAD /mail/bin/html2text.php HTTP/1.0
HEAD /webmail/bin/html2text.php HTTP/1.0

According to CVE a vulnerability in html2text.php in roundcube versions 0.2-1 alpha and 0.2-3 beta allows arbitrary remote code execution.

The other request looks like this:
GET /roundcube//bin/msgimport HTTP/1.1
GET /bin/msgimport HTTP/1.0
GET /mail/bin/msgimport HTTP/1.0
GET /webmail/bin/msgimport HTTP/1.0

Interestingly all scans for msgimport have the user agent string set to "Toata dragostea mea pentru diavola", the other one does not have any user agent string set. Sounds like some automated tool to me.
More information on this can be found at the internet storm center.


Powered by kulando