Update to filter IP ranges in SMTP headers…

  By amen940 | June 27, 2009 - 09:48 | Information Security, Phishing, SPAM
Leave a comment

I have an email address set up that customers can send false negative SPAM to should it get through the Email gateways.  One I received the other day shows just how allowing country IP blocks to be searched would benefit anti-spam gateways to clean up the relatively few number of false negatives they let through. I blogged about that below.

 The below is a cleaned up part header of an email one of my coworkers received that was a 419 SPAM with a word attachment delivering the social engineering “payload.”  It was sent from what I believe to be a Sun OS webmail server from a large well known east coast university ( I have notified the who-is abuse contact already.)   The IP from Nigeria ( 78.138.3.237), is what directly connected to the webmail server with an account of a college user and sent the SPAM through an already trusted infrastructure.  If the college or I was able to search for Nigerian IPs anywhere in the received lines this would have been dropped or quarantined.

Received: from iron1-smtp.xx.xxxx.edu ([xxx.xxx.127.241])  by
SannetSmtp1-in.sannet.gov with ESMTP; 25 Jun 2009 10:09:32 -0700
X-SenderBase: None
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AhMJAEZMQ0qApIMj/2dsb2JhbACONYhfgkyocIc9iE6EDQU
X-IronPort-AV: E=Sophos; i=”4.42,291,1243828800“; d=”scan’208″;a=”44717911″
Received: from optimus.xx.xxxxx.edu (HELO xxxx.edu) ([xxx.xxx.131.35])  by iron1-smtp.xx.xxxxx.edu with ESMTP; 25 Jun 2009 13:09:34 -0400
Received: from [78.138.3.237] by prime.xx.xxxxx.edu (mshttpd); Thu, 25 Jun
2009 18:09:34 +0100
From: Rxxxxx Hxxxxx <rxxx@xxxxx.edu>
Message-ID: <fce1a4442b7d.4a43bd5e@xxxx.edu>
Date: Thu, 25 Jun 2009 18:09:34 +0100
X-Mailer: Sun Java(tm) System Messenger Express 6.2-7.04 (built Aug 17 2006)
MIME-Version: 1.0
Content-Language: en
Subject: Respond ASAP
X-Accept-Language: en
Priority: normal
Content-Type: text/plain; charset=”us-ascii”
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Return-Path: rxxxx@xxxx.edu

Filter Country IPs in SMTP Received Headers…

  By amen940 | May 31, 2009 - 17:28 | Information Security, Phishing, SPAM
Leave a comment

My displeasure for the “send me money” scammers has been documented in previous entries so I won’t bore you with that again, although I did want to talk about an idea I had to fight those losers.  Basically I want to write SMTP gateway Anti-SPAM policy that can filter for IP address ranges (dashed range or CIDR) in ANY received header.  I have a feature request into our vendor for this very ability and am looking forward to seeing how well it will work if they can make it happen.

My reasoning behind this is to fill in a gap that I see in the current Anti-SPAM tactics, which are mainly sender IP reputation and content matching.  419 emails seem to be best making it through those traps because the “last hop” before your SMTP server is some bot host here in US or the most commonly they are sent from a free email service directly (Yahoo, Gmail, Hotmail, etc) so sender reputation isn’t all that effective (neither is SPF, SenderID, DKIM) and since they are very businesslike text, content catching the Spammyness is also hard.   However, if I was able to look for trouble country IP ranges in any of the SMTP Received lines there’s a good chance I could catch many of these sent from or through foreign nations.

See some of the free webmail providers include this line to show the IP address of the computer that sent the through the browser.

Received: from [79.80.169.10] by web36802.mail.mud.yahoo.com via HTTP; Sun, 31 May 2009 17:00:44 PDT

Being able to filter on the CIDR ranges (countryipblocks.net or maxmind.com) in any received line, not just the last one with sender reputation, would greatly increase the granularity for keyword lists.  For example you can write a 419 keyword policy but you will get MANY false positives if you apply it to all email, whereas I’d like to check it only if the email was sent from or through for example Nigeria, China,  Romania,  Russia, or Poland IP ranges.  Pseudo policy below….

#SPAMKeywordsfromNigeria

SPAM_KeywordsInBodyorAttachment:

If (dictionary-contains (‘SPAM_Keywords_BodyorAttachments’)) AND

If (header-dictionary-received-contains (‘NigerianIPs’))

{

Quarantine (’419 from Nigeria’);

}

I’ll update my blog if I’m able to apply this and how effective it is.

AutoRun part 3 and final…

  By amen940 | May 7, 2009 - 20:31 | Information Security, Malware
Leave a comment

So I heard through SANS ISC that M$ has decided to announce through their blogs that they are going to turn off autorun by default.  They didn’t say how exactly yet but I think it’s a good thing for all the regular users who don’t realize how dangerous that innocent thumb drive really is.  Link here…. I, nor the City of San Diego, has to worry about it as I got to have part 1 and part 2′s ”learning experiences” which although frustrating were educational, and effectively turned off autorun for all PCs.

AutoRun/AutoPlay part 2…

  By amen940 | February 25, 2009 - 21:25 | Information Security, Malware
Leave a comment

This is an update to the “AutoRun/AutoPlay Disabling Confusion” blog entry below. I’ve been working with the WSUS admin and we have not gotten the KB950582 to install on machines below Vista. Not good.  I even checked several C$ machine shares and did not see the patch’s install folder, proving the “not applicable” option in screen
shot below.  Again Not good.

WSUS showing patch as either applied or not applicable..

However, just yesterday I logged onto one of my XP machines and I got a Windows update rompt, but that was odd because I was sure I was up-to-date. The prompt says you need  B967715 which is a patch that correctly disables AutoRun. Nice! So, MS did simplify the whole thing. They released Security advisory 967940 which points to patch 967715 for 2000,XP,2003. And to top it all off MS even addresses the confusion I mentioned in their FAQs. So my new suggestion is to apply the GPO and include the 967715 to your WSUS required patches and you should be good to go. Thanks for addressing the issue MS, maybe Bill Gates reads my blog?

Here are the links…

http://www.microsoft.com/technet/security/advisory/967940.mspx

http://support.microsoft.com/kb/967715

PS. If you already installed KB950582, you won’t need the KB967715 and it won’t show as needed.

Why are there two places to get this update?

These updates are available in two places due to the way the updates were originally offered. The updates that were offered in Microsoft Knowledge Base Article 953252 were not available from automatic updating (including Automatic Updates, Windows Update,
and Windows Server Update Services) and therefore required users to manually find these updates and install them. The updates that are offered in Microsoft Knowledge Base Article 967715 contain the same updates that correctly respect the registry keys values to disable Autorun as in Microsoft Knowledge Base Article 953252, but are being distributed via automatic updating.

AutoRun/AutoPlay Disabling Confusion

  By amen940 | January 22, 2009 - 21:45 | Information Security, Malware
Leave a comment

So I have been working on disabling AutoRun/AutoPlay, which I will just call AutoRun from now on, although they are technically not the same thing, as far as disabling them they are.  Microsoft, in my humble opinion, makes this confusing for no necessary reason.  Especially since malware executing from external drives (other then installed HDDs) is easily the 2nd highest vector for the bad stuff getting onto San Diego City computers. So the need to disable AutoRun is a no brainer, after all it’s been stopped for A:\ drives and can’t even be allowed if desired. What makes a USB, CD, DVD, Network Drive, etc any different? The currently spreading Downadup/Conficker worm would be very happy for system admins/users to allow the admittedly convenient AutoRun functionality despite how dangerous it is.

AutoRun has 3 parts, and they must all be disabled or you won’t be safe from it’s unchecked executing. The 3 parts are….

*  User Double Clicks (in the MyComputer view, NOT explorer or folders view)
*  Contextual Menu (Right Click menu)
*  AutoRun (Automatically run anything that is listed in autorun.inf on “new” drive)

The setting below (done through registry or GPO [steps here])

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun (set to FF or all drives)

should be all you need to do; to be AutoRun free, right? Wrong.  Turns out this will only disable the AutoRun parsing of new drives. But it will NOT disable the first 2 in my list above, which means the average user will just probably launch the malware manually. So what do you do?  Well you turn to MS to explain why they aren’t respecting the GPO you just pushed. Unfortunately you will just be met with more confusion. Here’s the link you will find for anything older then Vista/Win2008.

http://support.microsoft.com/kb/953252

So you scroll to the bottom to download the patch, but notice that it’s really a link to KB950582, that is labeled as Vista/Win2008. What the heck? Then you go to your WSUS console to download the correct patch for WinXP/2000/2003 etc. but it’s not there. Only KB950582 is, which by the way was a security patch (MS08-038) for Vista/Win2008 released back in July 08. Long story short what I’ve been able to put together is that the patch KB950582 when applied to other Windows OS’s modifies the shell in a way that allows for honoring the AutoRun registry entry for earlier OS ‘s AND repairs a vuln in Vista/Win2008. Which is why its labeled as Vista/2008 and not XP/2000/2003, but I think MS is wrong to not make it clear and simple to understand what needs to be done to disable AutoRun/AutoPlay for all the Windows OS flavors. They are usually pretty good with scanning and giving your computer the patches it needs, lets hope they decide to change their approach in the near future.

My Solution: Set the GPO for HK Local Machine in Active Directory, and then include the patch KB950582 in WSUS for all your machines.  It should push out even though it says Vista/2008.  I’ll update this blog if I find this to not be true.

UPDATE 2: So I’m still on this and it appears WSUS is NOT pushing KB950582 to non-Vista machines (see next blog post)

PS. US CERT recently released a bulletin recommending to disable AutoRun, and detailed a fix from Nick Brown (which is great for home but probably a little severe for the Enterprise, IMO). They also put in an update about what I explained above you might want to check out there short “update” paragraph at the bottom if my opinionated ramblings above didn’t make 100% sense.

http://www.us-cert.gov/cas/techalerts/TA09-020A.html

One Man’s SPAM is…

  By amen940 | October 23, 2008 - 20:06 | Information Security, SPAM
Leave a comment

As the saying goes, is another man’s Ham, or something like that. So I’m migrating the city from product OLD to product NEW, and have been anticipating getting off OLD for sometime. However, there’s been a hitch, seems NEW has a different philosophy on Marketing/Newsletter/Bulk type email. So when we made the final switch over for our test domain (250 users) we started getting complaints and samples of all this HTML type email coming in from Macy’s, EWeek, Hotwire, Management seminars, Foreclosure Auctions, etc. So in talking with reps for NEW their company has always seen that as not officially SPAM. Which I understand, clearly some of the samples were legitimate opt-in emails, however there were more then a few in that grey area; emails that were at best opt-out but more like the address being bought or used without permission. Now OLD does create many false positives (FPs) but it’s the situation our customers are used to (9 years running OLD) so no matter where the fault lies, it’s our job to continue providing that level of service to our customers. Also I’d like to give them the ability to see their own marketing mail to release/delete as they see fit (End User Quarantines). So if some guy in Iran tries to charge 2 tons of yellow cake from Nukes-R-Us on your credit card you don’t miss the notification email because it had too much HTML in it.

NEW is coming out with a feature that will allow for the identification of those type of emails so they can be tagged as SPAM. Great, but it’s not available immediately, so I had to come up with a stop gap and wanted to share that here in case anyone googles how to stop HTML ladened emails at the gateway. I created a Reg Ex used in a filter, that will trip after 5 HTML links to pictures and .asp files in an email, the filter will then add a header so that you can route it wherever you want, including the bit bucket.

I invite anyone to leave a comment on how to improve the regex as I’m not guru at writing them. I was thinking it might be more effective (ie. less expensive) to have only the possible URL characters instead of the lazy .* anyway feel free to leave a comment (I’d be my first).

http://.*\.jpg|\.gif|\.bmp|\.jpeg|\.tiff|\.png|\.asp

It is working pretty well, very low FP HAM but obviously not catching everything. I’ve quarantined 1211 emails in 24hrs to the test domain of 250 users, while seeing < 5 FPs.

UPDATE 10-29-08: In addition to the above filter I also discovered it’s a good idea to look for the header List-UnSubscribe only when List-Subscribe doesn’t exist.  This is because legitmate mailing lists (bugtraq, dshield) most often have both where bulk/marketing emails probably only have the first one. So something like this….

If header (‘List-UnSubscribe’) AND if (NOT header(‘List-Subscribe’))

{ action }

UPDATE 11-7-08:  Those marketers are still peddling their wares, so take this Opt-out suckers

http://.*\?[a-z0-9]+=\S+

That catches dynamic URLs x number or more of times.  That can be lot of FPs but it kills the bulk email big time.

Deleting Files Already in Use Remotely…

  By amen940 | August 30, 2008 - 20:23 | Defense, Information Security, Malware
Leave a comment

I had a bit of a frustrating day the other week, a machine was infected with an IRC bot that AV couldn’t detect or remove, beyond the relatively minor host file modifications. The machine was re-imaged and then even replaced, but kept getting reinfected a few hours later.  Of course 99% of the time that means a PEBCAK (google it).  It turned out to be a user’s personal infected thumb drive that was spreading the bad stuff.  Anyway since we were getting a large amount of email alerts from the IPS on outgoing IRC NICK registration to IPs in Asia, I RPDed to the machine and copied TCPview from a share to see what exe was creating the process sending the IRC traffic.  The malware was able to hide the process from taskmgr but not the sysinternals tool. It turned out to be the file run64dll.exe so I tried to stop the process and it immediately started back up, not surprising.  I tried the delete the exe but Windows complained about it being in use.  This is usually where safe mode comes into play but I was sitting miles away, so I employed a trick that is the reason I’m writing this blog entry.  Of course you will most likely have to be local Admin or have those rights on the target folder/file, but when you need to kill a file in use try changing the permissions on the file to DENY ALL (Right click file and go to permissions tab in WinExplorer).  This will then quickly stop the process you couldn’t from accessing the file and probably will allow you to delete the file.  Worked for me and hopefully it will for you.  After that I highly recommend a full re-image, you have proof that malicious software successfully ran on that machine and there is no way to know for sure how deep the infection went, don’t risk it just wipe it.

Email Scammers…

  By amen940 | July 26, 2008 - 10:03 | Information Security, Phishing, SPAM
Leave a comment

   You know it’s hard for me to talk about the 419, stock pump/dump, bank phishers and the rest, without using excessive profanity which isn’t quite appropriate for a blog.  So recently there was a customer of mine that forwarded an email through the SMTP gateways I manage that was caught in a custom word filter list.  While I tried determine if I should release the email it became apparent the scam has already been effective to the tune of 900.00.  And the Nigerian loser was trying to get an extra 300 out of the victim.  The scam involves posting a house for rent on Craig’s list, after searching for real houses for rent or sale in the area.  So if the mark drives by the address the pics match and there is a for rent or sale sign out front.  The response to the initial inquiry about the house, is usually about getting called away on business to Nigeria and needing first month’s and security deposit sent through Western Union.  I’ve been seeing more and more of these idiots trying whatever they can to steal money from others as if they are entitled to it; because they were born in a 3rd world country anything they do to “the rich” in America is justified.  I really can’t understand the upbringing these people must have had to be able to sleep at night ripping people off.  Although I know it’s not true, it’s really hard to not generalize and see the entire country of Nigeria as a bunch of cheats, crooks, and liars when you are exposed to the these emails on a daily basis. 

  Craig’s list highlights that anyone asking for payment from Western Union is a scam link.  But unfortunately people are busy and trusting when it sounds like a good deal.  All I ask is please be vigilant out there, the Internet is not only the happy joyous place social networking sites want you to believe it is. It has a dark side and like many forms of negativity it often comes with a “pretty face” and a good deal.  Here’s an example reply from one of these piece of #^%@& sons a &^%$* link

 

PS. And in case you needed more convincing here’s an article about a convicted SPAMMER that escaped from minimum security prison recently and then proceded to kill himself, his wife, and toddler.  Just goes to show the cowards these individuals really are. link

One Bad Apple…

  By amen940 | June 14, 2008 - 14:35 | Information Security
Leave a comment

First some background, google has protection mechanisms around it’s resources for automated scripts abusing its search functions.  When google detects that your search terms are malicious, manipulating page rank, or even just doing too many searches to be an actual human it redirects all future google searches from the offending IP to sorry.google.com and asks the user to fill in a captcha to proceed.  This seems legitimate and since you are using google’s product they can do whatever they want.  However, the possibility of that policy affecting many innocent users that also browse the internet with the same source address seems like some high collateral damage to me.  Some instances of this would be if all company users were behind a proxy server using NAT or a FireWall using PAT.  I recently experienced this myself.  Google doesn’t seem to give a lot of good information on exactly how they decide if you need to be throttled (although I didn’t search extensively).   But if you search for sorry.google.com you’ll find many users complaining about the very situation I described above.  So if you ever go to work one day, do your morning Google search and you are sent to sorry.google.com, you might want to call the helpdesk and make sure it’s not happening to anyone else.  If it is then search your proxy/FW logs for the client user/IP that is sending the most traffic to sorry.google.com and you will most likely have the one or more culprits that are defaming your NATTed IP and causing confused users who don’t remember there are other search engines to put in a ticket about “not being able to search the web.” :-)

CISSP…

  By amen940 | May 10, 2008 - 02:09 | Information Security
Leave a comment

Hello non-existent readers, I’m back from my study induced exile.  And luckily have passed the CISSP, yeah.  For the uninitiated you can see more here and here. It’s quite the frustrating test, with questions on broad ranging topics grouped into 10 Common Body of Knowledge (CBK) areas of interest within Information Security.  I’m hoping to add some content to my main site on my experiences, tips, and maybe even my study guide, however ISC2.org has strict rules about how much you can talk about the test, so I’ll have to run it by them first. 

PS.  I upgraded all my WordPress plugins, and WordPress it’self to 2.5.1 w/ the WordPress AutoUpdate Plugin, with no issues.  I highly recommend getting this plugin as opposed to using FTP, it simplifies the process considerably.