Monday, August 22, 2011

Website hijack example: from Brigham Young to Romaina and Belarus

update: I informed Brigham Young of the issue which was fixed for a time but now the cfacbeta site redirects again. I also submitted the tobmarket.com and business-download.com domains to hpHosts but soon after this the attacker changed the store front address to index-downloads.com. This is standard practice for malicious actors, as soon as a domain gets too hot it is easy to switch it a clean domain. This is what the intermediary controller at tobmarket.com is for.

As Zscalar pointed out there was a large campaign of .EDU web hijacking earlier this year. The purpose of the hijacking was to redirect users to fake online stores that purport to sell heavily discounted commercial software using techniques similar to those used to route people to fake online pharmacies. An excellent paper on the fake pharmacy problem was recently published by researches at the University of Cambridge.

Let's take a closer look at this, starting with the fake software stores. Here are some of the top 10 results from a Google search for “buy windows 7” in early August 2011. The red arrows indicate two fake stores which have made it into the top 10. The second one, cfacbeta.byu.edu, is a web hijack.


A more refined Google site search shows that many cfac.byu.edu pages are redirected.

 
cfac.byu.edu is the home page of the College of Fine Arts and Communications at Brigham Young University and from the look of the below page they have been working on upgrading their site and in the process may have inadvertently opened themselves up to an attack. 

Down the rabbit hole

A web hijack starts by an attacker compromising a web server and altering the site code so that users are unknowingly redirected to the attackers' website. Let's look at what happens when a user visits a compromised site.

If the Google result above is clicked, the below sequence of six HTTP packets is generated between the client and server. HTTP packet 2 redirects the user to tobmarket.com, a re-director/controller, which as shown in HTTP packet 4, redirects the user to business-download.com, the final shopfront site. If a user visits the cfacbeta.byu.edu site without clicking through Google they will see the actual site. The redirection is only triggered when the correct referer field and search terms are present within the HTTP GET request. The minimal string which triggers the redirect is.

Referer: http://www.google.com/search?q=windows

HTTP packet 1: Client to Server

GET /departments/tma/fulton-chair-menu HTTP/1.1
Host: cfacbeta.byu.edu
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
DNT: 1
Connection: keep-alive
Referer: http://www.google.com/search?q=buy+windows+7&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a
Cookie: SESSb3f40867ca15d6a84ab81b0c22a576f9=d4e0d99e5fe575e3ad399de82051dec2; transpass=385f37072a55969b1d8b294e88720b3e8ba49f63; has_js=1
If-Modified-Since: Mon, 15 Aug 2011 16:58:05 GMT

HTTP packet 2: Server to client, redirect to tobmarket.com via 302 Found

HTTP/1.1 302 Found
Date: Mon, 15 Aug 2011 17:14:18 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.2.10-2ubuntu6.10
Location: http://tobmarket.com/in.cgi?5&seoref=http%3A%2F%2Fwww.google.com%2Fsearch%3Fq%3Dbuy%2Bwindows%2B7%26ie%3Dutf-8%26oe%3Dutf-8%26aq%3Dt%26rls%3Dorg.mozilla%3Aen-US%3Aofficial%26client%3Dfirefox-a&parameter=$keyword&se=$se&ur=1&HTTP_REFERER=http%3A%2F%2Fcfacbeta.byu.edu%2Fdepartments%2Ftma%2Ffulton-chair-menu&default_keyword=
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html

HTTP packet 3: Client now contacts server tobmarket.com

GET /in.cgi?5&seoref=http%3A%2F%2Fwww.google.com%2Fsearch%3Fq%3Dbuy%2Bwindows%2B7%26ie%3Dutf-8%26oe%3Dutf-8%26aq%3Dt%26rls%3Dorg.mozilla%3Aen-US%3Aofficial%26client%3Dfirefox-a&parameter=$keyword&se=$se&ur=1&HTTP_REFERER=http%3A%2F%2Fcfacbeta.byu.edu%2Fdepartments%2Ftma%2Ffulton-chair-menu&default_keyword= HTTP/1.1
Host: tobmarket.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
DNT: 1
Connection: keep-alive
Referer: http://www.google.com/search?q=buy+windows+7&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a
Cookie: SL_5_0000=_1_

HTTP packet 4:Server to client, second redirect this time to business-download.com

HTTP/1.1 302 Found
Date: Mon, 15 Aug 2011 17:12:58 GMT
Server: Apache/2.2.3 (CentOS)
Set-Cookie: SL_5_0000=_1_; domain=tobmarket.com; path=/; expires=Tue, 16-Aug-2011 17:12:58 GMT
Location: http://business-download.com
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=CP-1251

<html>
<head>
<meta http-equiv="REFRESH" content="1; URL='http://business-download.com'">
</head>
<body>
document moved <a href="http://business-download.com">here</a>
</body>
</html>

HTTP packet 5:Client now contact business-download.com

GET / HTTP/1.1
Host: business-download.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
DNT: 1
Connection: keep-alive
Referer: http://www.google.com/search?q=buy+windows+7&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a
Cookie: shopsesid=1313422538StMyVnEqtxpIrywMeQTTnAAAAZjdhiIt

HTTP packet 6:Server to client, setting a cookie.

HTTP/1.1 200 OK
Server: nginx/0.8.54
Date: Mon, 15 Aug 2011 17:14:25 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.6
Set-Cookie: shopsesid=1313422538StMyVnEqtxpIrywMeQTTnAAAAZjdhiIt; path=/
Content-Encoding: gzip


Visting the site tobmarket.com directly triggers a HTTP connection:Close packet while visiting tobmarket/in.cgi triggers the redirection to business-download.com. The registrar for tobmarket.com is Ukranian firm ukrnames.com and Whois information is masked by a privacy service. As of August 2011 the domain resolves to 95.64.58.238, a machine hosted by Voxility of Romania.


Upon clicking through business-download.com to the checkout pay site, we are sent to https:private-pay.net.


As shown above they have used SSL to make the site seem more legitimate, the site is using a real certificate issued by Certificate Authority RapidSSL/GeoTrust Inc in the United States. Many Certificate Authorities do only minimal checks on their clients so the possession of a certificate really means nothing anymore. Below is RapidSSL's home page, they make it very easy to get a certificate!
 
Whois information shows that business-download.com was registered by planetdomain.com with the fake contact details below.

Owner, Administrative Contact, Technical Contact, Billing Contact:
      Isabelle Franchet (ID00467503)
      6 Rue de la Republique
      Avignon, Provence 84000
      FR
      Phone: +33.490864978
      Email: curve@cutemail.org
 
As of August 2011 business-download.com resolves to 213.152.172.90 which also hosts business-download.net,download-sale.net and luxury-customer.net and the supposed pay site private-pay.net. All of these actually host the same fake software store.

The controller/re-director domain tobmarket.com was issued by ukrnames.com of Ukraine and has anonymous Whois records. The domain is hosted at IP address 95.64.58.238 located in Romania. This IP address also hosts the-first-five-pages.com which redirects users to tobmarket.com. Whois information for the-first-five-pages.com reveals that it too was registered with ukrnames.com but this time we are given the contact details below.

Registrant:
Vitalij Shorikov mboga12@yahoo.com
Nagornaya,78
Gomel, 246015
BELARUS
+375232724839

Now for some Google searching

Search on cutemail.org

cutemail.com is a webmail service operated by SafetyNet Systems Ltd of the UK but cutemail.org does not resolve to anything though the domain is registered with FastDomain.com. A search on cutemail.org reveals that @cutemail.org addresses have been used to register numerous malware and web hijack campaign sites including recent fake AV, money mule recruitment and fake online drug stores.

Search on +33.490864978

Reveals this to be the fax number for a hotel in France!

Search on Vitalij Shorikov, mboga12@yahoo.com or +375232724839 (actually normalized to +375.232724839)

This reveals two other domain names registered using this contact information.

belkonvert.net IP address 91.226.78.9
This is a HTTrack Website Copy of belkonvert.com. Belkonvert.com is a legitimate business site for a Minsk,Belarus advertising company. No other hosts were at this address.

tdsfree.org IP address 91.217.153.46
This returns a HTTP 403 forbidden message but this IP address also hosts the following sites.

dorotydiary.org
com-watch-id181222ooo.info
casinonewsblog.org
bradpittfanclub.org

Both bradpittfanclub.org and dorotydiary.org have recently been flagged as involved in malware distribution and fake AV campaigns as the below results from Malware Domain List show.
 
And from hphosts we can find that the whole of ASN 41390 91.217.153.0/24 RN-DATA-LV RN Data, SIA is riddled with malware sites

So there we have it, clicking on a Brigham Young University page takes a visitor on a unexpected trip to Romania  and Belarus! Following the threads further has lead us right into a nest of malware domains at 91.217.153.0/24

Be careful out there on the interwebs.....

15 comments:

  1. Your style of blog presentation is very attractive.The meaningful contribution of your mind reflects on those people who are looking for new ideas and informations regarding.
    Rpeutation Management

    ReplyDelete
  2. Everest Base Camp Trekking often touted as one of the most beautiful of trekking trips in the whole world and rightly it is. Located at the lap of world's highest peak, Everest Base Camp (EBC) is rewarded as the best trip Nepal has to offer. Since 1920, Mt Everest has captivated intrepid men and women. There were some exploits of legends like Sir Edmund Hillary, George Mallory and Tenzing Norgay Sherpa to put the mighty mountains on the map. Thousands of adventurers followed them making huge sacrifices. EBC Trek is designed to fulfill the dream of many people to experience the historic route to the base of world's highest peak. Since the beginning, Everest Base Camp Route has gained massive popularity and a lot of appreciation. The highlights of Everest Base Camp Trekking are the stunning views of Mount Everest, legendary Sherpa culture, wonderful Namche Bazaar, Tengboche Monastery, the best viewpoint of Kalapatthar, and beautiful Chhukung valley among many others. We gradually ascend through the wonderful Sherpa villages enjoying the magnificent Himalayan scenery, wildlife and visit a number of Buddhist Monasteries. EBC Trek culminates with a fine opportunity to trek to both EBC and nearby peak of Kalapatthar (5545m) for spectacular views of the Everest. Savoring the high mountain views with the unique and life defining journey, EBC trip can be combined with Gokyo Chola Pass Trek, or Everest Three Passes packages as well, making the journey bit more challenging and rewarding too. Encounters Nepal has carefully devised an itinerary with a number of rest days that offers an exceptional way to acclimatize safely. Having had hit the Himalayan Trails since so long, we have learned never to rush a trek to altitude in the Himalaya. Taking an extra few days makes all the difference to really being able to enjoy the trek and trekking in Nepal.

    ReplyDelete
  3. Namaste from a Beautiful Himalaya Nepal
    Nepal Base Camp Treks is government register agency (licensed trekking guide team) in the Nepalese Himalayas Ranges… After working 18 years (since 1997) on the tough trails for several years as a mountain staff crew, and working so hard to develop our fluency in English languages, We became a guide in the year 2000 to 2002. We have spent the past 18 years as a professional Himalaya trekking guide, working for several Trek & Expedition companies in Kathmandu; we have now decided to work as an independent guide and self leading to provide all our national and international clients, who like to enjoy their Himalaya trekking holidays tour with us (www.nepalbasecamptreks.com)
    In the last 18 years working experiences, our team have become very well-known with many Trekking Destinations throughout the country, this includes: The Everest Base Camp Treks, Annapurna Regions and Langtang Valley Regions, As well as Upper Mustang Treks, Manaslu Circuit Treks, Annapurna Circuit Trek,Ganesh Himal Trek, Helambu and all non tourist regions. Our teams at Nepal Base Camp Treks have studied well the lay of the land & our knowledgeable about local flora and fauna, cultural history and environmental issues in the areas where we trek are absolutely sound today. Our guests truly appreciate our services. We are able to guide Trekkers hoping to climb high passes Chola, Renjo La, thorong La,Larke La, Kongma La and peaks, & can take them to show exclusive spots for any adventures across the Himalayas. Nepal Base Camp Treks experience also covers the well known peaks of Mera Peak climbing , Island Peak Climbing,Lobuje Peak Climbing, Phakchhermo Peak, Pisang Peak, Tent Peak Kalapathar Peak & Gokyo Peak, and we have led expeditions across many high passes in Nepal, covers some famous mountains: Manaslu Circuit Larke Pass, Ampu-lapcha Pass, Makalu sherpani col Pass, east col Pass, west col Pass, Chola Pass, Renjula Pass, Rolwaling Tashilapcha Pass, Ganjala Pass, Ganesh himal Pangsang Pass, Thorong Pass and Tilicho Pass…ON THE WAY, AFTER ALL THE TRIALS & HARDSHIPS…THE BLOOD, SWEAT & TEARS…we are now an accomplished guide team who helps our guests unleash the best experiences ever in High Himalaya and Wild Adventures under their feet
    Treks come in many forms on Nepal's rugged Himalayas: ranging from the relaxed easy trekking where you can experience Nepalese Culture and Village life,Chitwan,Dhulekhel,Kathmandu Valley, Pokhara Ghale Gaun, to tea-house trekking in popular regions, Annapurna, Everest, Lantang, to unique treks into areas of Nepal that are off the beaten path and seldom visited by foreigners or remote non-touristic area Tawal Village, Chitwan Chepang Hill. All treks offer superb scenery and viewpoints into Nepal's exotic ancient culture. With our kind of experience, we can tailor your treks to meet your conveniences in any way that's comfortable to you.
    Nepal Base Camp Treks (Pvt. Ltd.)
    Post Box: 10114, Bhagwati Bahal Mark, Thamel, Kathmandu, Nepal
    Telephone: + 977-1-4436088. Mobile: +977-9851111874
    Email: sappayesnepal@gmail.com
    info@nepalbasecamptreks.com
    URL:- www.nepalbasecamptreks.com

    ReplyDelete
  4. Nepal Everest Base camp Treks' s heartily welcome to you. Nepal Everest Base Camp Treks Pvt. Ltd. was established as a successful result of decade’s long involvement and long experienced in Nepalese tourism industry. Having had experience of operating and leading wonderful adventure Trips in some of the most captivating vistas of Nepal Himalayas successfully. we have been providing service with interesting trekking packages. i.e. Everest Base camp trekking, Everest three pass trekking, Everest trekking, Annapurna base camp trekking, Annapurna circuit trekking, Annapurna ghorepani poon hill trekking, Ghorepani poon hill trekking, ghorepani ghandrunk trekking, khayera ridge trekking, Annapurna sanctuary trekking, Poon hill trekking, Annapurna Trekking, Manaslu trekking, Manaslu circuit trekking, Manaslu Tsum valley Trekking, Langtang valley Trekking,Langtang Tamang heritage Trekking,Langtang Gosainkunda pass Trekking,Helambu Trekking,Helambu cultural trekking,langtang Ganja la pass trekking,Upper mustang Trekking,Mustang Trekking,Jomsom muktinath trekking,Upper Dolpa Trekking, Ruby valley trekking,Ganesh himal trekking etc to several kind of recreation loving tourist destinations since 2005 however we are keen of promoting our company service therefore.
    Nepal Everest Base Camp Treks Pvt. Ltd.
    Saat Ghumti Thamel, Kathmandu, Nepal
    Mobile No:+977- 9841902116
    info@nepaleverestbasecamptreks.com
    anjan99nebct@gmail.com
    www.nepaleverestbasecamptreks.com

    ReplyDelete
  5. Welcome to Base Camp Trekking Tour! Hundred percent pure lands of highest Himalaya's adventures
    Trekking in Nepal is one of the best adventure government registered company operating all adventure holidays trip to world most popular mountains Everest Base Camp Treks, Annapurna Base Camp Treks, Langtang Treks, Manaslu Treks, as well Upper mustang trek, Ganesh Himal Treks, Langtang Ganja La Pass Treks and all popular sightseeing tour of Ancients Kathmandu Valley and relaxing Chitwan Lumbini Tour on your desirable local budget for national and international travelers to Nepal.
    Nepal Base Camp Treks (P) Ltd.(www.basecamptrekkingtour.com) may be your next Trekking and Trekking Company in Nepal for any Trekking Agency in Nepal to highlander Himalayas Everest base camp, best mountain sceneries Annapurna Base Camp, recently promoting Manaslu Circuit Trek, several High passes Thorong La Annapurna Circuit,Gokyo Lake Chola Pass,Gokyo Lake Renjo La Pass, Chhukung Kongma La Pass, Rolwaling Tashilapchha Pass, Gosaikund Lake Pass, Kathmandu Valley Cultural trek and tour,Dhulekhel Namoduddha, Nagarkot trek, Bungmati Tour, Chiwan Chepang Hill Trek, Bandipur Tour,Pokhara Valley trekking tour,Ghorepani Poon Hill Trek, Annpurna Ghandruk Trek, Kanchanjanga north to south Pass,Langtang Ganja La Pass, depending small group travelers to joining group travelers on your desired budget to standard budget.
    Nepal Base Camp Treks offers you very popular non tourist destinations as remote regions of manaslu Tsum Valley Trek, Nar-Phu Valley Trek, Tamang Heritage Trail, Ghale Gaun Trek, Kanchanjanga Base Camp Trek, Rolwaling Camping Trek, Upper Mustang Cultural Trek, Lower Dolpo and Upper Dolpo Trek on very reasonable social trek in non touristic destination to better understand your holidays with our professional team
    Our team in Nepal Base Camp Treks is very profession of peak climbing experiences of most popular Island Peak, Lobuje Peak, Mera Peak, Phakchhermo Peak in Everest Region and Pisang Peak, Kanguru Peak, Chulu Peak in Annapurna Circuit Region and Tent Peak in Annapurna Base Camp.
    We guaranteed you best services and trouble less during your lifetime holidays journey with our professional mountain local team and wish you have a nice journey and see you soon in Nepal here to dream your adventure awaits you, as I remain
    Yours sincerely
    Sappa Lama (Sagar) and team
    info@basecamptrekkingtour.com
    www.basecamptrekkingtour.com

    ReplyDelete
  6. Encountersnepal.com is professional and Lengal Trekking Company in Nepal
    and Base Located Trekking Agency,
    and Most top Package is Trekking in Nepal
    With fair deal.

    ReplyDelete