« Pump-And-Dump Techniques | Main | Attention Foreign Spammers: Don't Use Babel Fish! »

June 16, 2006

This morning's inbox included a message purporting to come from an electronic greeting card company. Although the company appears to have been around for awhile, I won't mention its name because its site is an advertising nightmare: attempted popup windows, banners with jiggly and phony "Congratulations" windows urging you to claim your hourly prize, blah blah blah. It may be a legit company, but I can't stand to look at its home page.

Back to our story.

The email message begins:

A friend has sent you an ecard from [redacted].com.

To: Dear darling,

Message: i hope you like this card that i have made only for you

Send free ecards from [redacted].com with your choice of colors, words and music.

Your ecard will be available with us for the next 30 days. If you wish to keep the ecard longer, you may save it on your computer or take a print.

To view your ecard, choose from any of the following options:

I imagine that most people receiving this message would be thrilled to find out that a "secret admirer" is sending them an e-card. You couldn't stand in the way between their clicking finger and the mouse button.

And that's where everything starts to go wrong.

Clicking the supplied link with a PC takes you to a different site and immediately begins downloading a one megabyte file. But it ain't no greetin' card.

The file is an executable program (.exe extension). After safely downloading it in a non-Windows environment, I sent it through VirusTotal, which checks the file against 26 antivirus systems. This file wasn't identified as malware by any of the major antivirus programs (e.g., Symantec, McAfee, F-Prot, Sophos). Thus, if you had received this message and clicked on the link, even if you had the latest antivirus updates installed, the file would have downloaded without complaint.

I've submitted the file to the SANS Internet Storm Center for further analysis. If I hear anything back, I'll post an update here.

The bottom line, for the umpteenth time, is that clicking on links in any email message—especially a message that seems too good to be true—is like playing Russian Roulette with a live bullet in every chamber.

By the way, there were numerous additional clues in the source code of the message that this was really bad stuff. The most telling is that the actual link (not the one visible in the message, but the actual destination in the HTML tag that made the link) uses a form of URL that is increasingly used to disguise the destination. The format is known as a decimal URL. Unlike the types for which this site offers decoding tools, a decimal URL consists of a 10-digit number for the site address (the part immediately following the http:// part). For example: http://1109855782 (don't worry, it's the address of the Spam Wars site home page).

The decimal URL format is on the rise, from what I've seen. Each time I've seen it in use (again, always apparent in the message's source code, where the greatest deception and secrets lie) the destinations are used for nefarious purposes—phishing, malware installations, etc.

Interestingly, major Mac OS X browsers (Safari and Firefox tested so far) do not resolve decimal URLs. Chalk up another one for the guy on the righthand side of the screen in the current U.S. Mac TV ads. This means that Bad Guys can use decimal URLs in the kinds of messages like the one I received today to filter out those users whose machines are immune to their malware (Firefox on Windows does resolve decimal URLs). Only those who successfully follow the email message link are equipped to be infected by a zero-day infestation.

Natural selection at work perhaps.

UPDATE (19 June 2006, 08:00:00 PDT): Still nothing back from SANS yet on this (I submitted twice), but others are getting into action, as well. The site's hosting company is in denial (or their support people are as clueless as the one I chatted with earlier this week). In the meantime, "simplypeachy" has dug deeper into the file and finds some typical Trojan activity going on (e.g., setting up the PC to be controlled as a zombie via mIRC).