How to Ensure Vulnerabilities Are Not a Gateway to Blackhole Exploits

Co-Author: Peter Coogan

Earlier in 2012, a patch was issued to correct a potential vulnerability in Parallels Plesk Panel version 10.3 or earlier, helping secure unauthorized access to the website control panel. While it is believed that this potential vulnerability is now patched, administrators who have applied this fix may have already been the victim of a compromise and had their login credentials stolen. Best security practice would be for administrators using Parallels Plesk Panel 10.3 or earlier to ensure they have up-to-date patches and change any login credentials that may have been exposed as a result of this vulnerability. They can learn more by reading Securing Parallels Plesk Panel: Best Practices to Prevent Threats.

Reports stated that, following a compromise, heavily obfuscated JavaScript is injected into HTML pages on the server. Once evaluated, the deobsfucated code generates a unique iframe using the code snippets shown in the image below each time the compromised Web page is visited. This injected code is similar to code we have talked about before in a blog post about the Blackhole Exploit Kit. Symantec customers visiting these compromised Web pages containing the injected code are protected by several IPS signatures, including Web Attack: Blackhole Toolkit Website 10.


As seen in the image for generating the iframes, there is a string of ‘runforestrun’ that remains constant in all the generated iframes.

Example generated iframe domains:

Symantec’s telemetry for July 2012 alone demonstrates we have protected customers against over 68,000 unique URLs containing this string which were leading to the Blackhole Exploit Kit. The following world heatmap indicates that the U.S. has seen the most detections:


Our telemetry in total for 2012 has also identified over 17100 unique IPs for the referral URLs leading to the generated iframes detected by Symantec. While we cannot definitively say how all the servers related to these IP addresses were compromised to serve up the generated ‘runforestrun’ iframes, it does show the relative size and success of this campaign. The following world heatmap shown below indicates once again that the U.S has hosted the majority of the referral URL IPs:


The injected iframes at one time followed link to a number of sites that contained redirects and forwards in order to deliver the final payload of Downloader.Parshell (a small executable that contains a hardcoded URL to effectively download additional malware onto the unsuspecting user’s computer). Among the additional malware downloaded are Trojan.FakeAV and Trojan.Maljava. Protection against a new variant of this Downloader is also available as Downloader.Parshell!gen1.

Symantec customers who use our Network-Based Protection Technology are proactively protected from the Blackhole Exploit Kit. If you are concerned that you may have been compromised after visiting a website, you can download Symantec’s free Power Eraser tool to aid in the removal of any infections.

Password “8861” Used in Targeted Attacks

Symantec has continuously observed targeted attacks in the wild since around mid-July that utilize password-protection of malicious Excel spreadsheet files. Coincidentally, all of the samples that we have analyzed so far use the 4-digit password “8861”, which is provided within the body of the email containing the Excel file attachment.  So why “8861”, you may ask? I couldn’t figure out if it has any meaning, but if someone out there is aware of the significance of this number, please send us a note. The name of the file, the content of the spreadsheet, and the malware that is dropped onto the computer all vary from sample to sample.

This is not the first time that passwords have been used for targeted attacks. In fact, back in December 2011, I blogged about document files using the same tactic. However, I cannot recall any attacks that have continuously used the same password over and over to target a variety of organizations around the globe.

The purpose of the attacker using the password is most likely to enable malware to evade detection, whether on the gateway or on the desktop, since the password feature encrypts the files. It may also make security researchers’ work or automatic analysis difficult since the password is required to decrypt the file before investigation can be performed. The usage of the password might also make the recipients feel safe about the file as passwords are generally used for security measures. Let’s think about it for a moment. The password for the attached Excel spreadsheet is given in the email that contains the actual attachment. Typically, passwords are communicated in a different form or at least in a separate email—otherwise the password protection of the file is meaningless.

The attacks themselves are no different from typical targeted attacks except for the use of the password. Although scanning the typical password-protected file is not possible, security products can still prevent infection by detecting the dropped or downloaded files just like with other types of targeted attacks. With the implementation of multi-layered defense, one should not be in more danger than someone being attacked by typical targeted attacks.

It is now more common to see password-protected malware attached to emails, so users need to watch out not only for Excel files, but any type of files with passwords that are attached to unsolicited emails. The Excel spreadsheet files discussed in this blog are detected as Trojan.Mdropper and the dropped files include: Trojan Horse, Backdoor.Darkmoon, and Backdoor.Trojan.

Sophos Offers Free Android Antivirus App

Sophos seems to be a lot more aggressive recently when it comes to the consumer market, they used to be a hardcore enterprise only solution when they first started out. I guess they’ve realized where the money is. Back in 2010 they one of the first to come out with a free Antivirus solution for [...] The post Sophos Offers Free Android...

Read the full post at