RE: udp and dst port 1026

From: Lawrence Baldwin (baldwinL_at_mynetwatchman.com)
Date: 12/04/03

Next message: Jeff Kell: "Re: Flood of bad DNS queries"

Previous message: Mike Lyman: "Re: Flood of bad DNS queries"
In reply to: Ockey: "Re: udp and dst port 1026"
Next in thread: Jeff Bryner: "RE: udp and dst port 1026"
Reply: Jeff Bryner: "RE: udp and dst port 1026"
Reply: jamesworld_at_intelligencia.com: "RE: udp and dst port 1026"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: <incidents@securityfocus.com>
Date: Thu, 4 Dec 2003 09:00:59 -0500

I notice that when surf to:
http://www.popadstop.com

I have constant clipboard activity...if I try to cut/paste something (from
any app) all I get pasted is a single blank space. If I bring up clipboard
viewer, the screen is flashing like crazy. Is it possible to do something
like this with javascript?

I've also installed Popadstop on a test system (with direct Internet
access). I've been running a full packet trace for about 12 hours, all I
see it do is what *appears* to be a call-home version check. I haven't seen
any inbound attempts to communicate, the app also does NOT appear to open
any port listeners, so if it is a trojan it's command/control is likely via
outbound HTTP.

I also contacted Mabry Software which developed the HTTPx ActiveX components
that this app uses, it appears that NewStuff *did* purchase a license for
the components used in this app...this I did not expect.

Lawrence Baldwin
myNetWatchman.com

Also, here is a response from a site we notified about this activity:

Hi Lawrence,

| Re:
| http://www.mynetwatchman.com/ListIncidentActivity.asp?IncidentId=63115458
|
|>The program PopAdStop.exe was installed on this machine via
|
| PopAdStop-Setup[1].exe. This program stops pop-ups, but generates them
| elsewhere...
|
| I noticed your comments posted to the incident we reported...we are
noticing
| that other systems that are emitting Messenger spam have this "utility"
| installed on it as well, however, how did you come to the conclusing that
| the above .exe. is reponsible for it??

Simple: After the utility was installed the machine started emitting
packets to 1026/UDP and 1030/UDP. When we removed this utility again
(BTW, do *not* use uninstall from the menu; it points to GPInstall.exe
and not uninstall.exe) the packets stopped.

This seems to be a Trojan which works like this:
1. vulnerable PC gets bombarded by pop-up ads, and also ads which tell
them that they are vulnerable to these pop-up "attacks" and that the
should download their wonderful free! tool to stop this. What nice
people! Telling us about our vulnerabilities and offering us a solution;
they just *have* to be trustworthy, so let's download the program!
2. People download the tool from the website www.popadstop.com, which
does not always work, see below.
3. People install the tool and the pop-ups stop. Yes! But now, other
people get more and more pop-ups...

When people cannot reach the website this means domain name
www.popadstop.com is removed from their DNS servers. A couple of hours
later, it is accessible again! What seems to be the case: the domain
www.popadstop.com is removed every now and then from their DNS server to
~ regulate traffic flows. A couple of hours later, when DNS caches are
flushed on many DNS servers, it is put in again. This way, this domain
is never known on all DNS servers at the same time. Also, when visiting
the PopAdStop site, it tries to use a MS IE exploit my colleague found
out; which one I don't know right now, because he is out of the office
today.

On the machine we researched we found PopAdStop.exe and
PopAdStop-Setup[1].exe in the Internet cache. When you install this
tool, the following files are copied:

%programfiles%\PopAdStop
~ block.dat
~ PopAdStop.exe
~ UnInst.log
~ Uninstall.exe
~ versdata.dat
~ versinfo.dat

%systemroot%\
~ GPInstall.exe

%systemroot%\System32\
~ HttpX.dll
~ HttpX.ocx
~ MabryObj.dll
~ mscomctl.ocx
~ mswinsck.ocx

It also puts "PopAdStop.exe /s" in the registry under the following key:
"HKEY_Current_User\Software\Microsoft\Windows\CurrentVersion\Run".

I Hope yhis information helps. And not to forget: a big thank you to my
colleague xxxxxxxxx for researching PopAdStop.

-----Original Message-----
From: Ockey [mailto:mail@ockey.net]
Sent: Wednesday, December 03, 2003 19:14
To: incidents@securityfocus.com
Subject: Re: udp and dst port 1026

----- Original Message -----
From: "Thomas Preissler" <tomjohn@gmx.de>
To: <incidents@securityfocus.com>
Sent: Wednesday, December 03, 2003 12:19 PM
Subject: Re: udp and dst port 1026

> I decrypted it a little bit, these are the unscape-chars:
>
> s='';
> for (i=0;i<dddss.length;i++){
> a=l.indexOf(dddss.charAt(i));
> if (a==1) a=9;
> if (a==2) a=10;
> if (a==3) a=13;
> if (a==4) a=34;
> if (a<=31 & a>=14){
>
off=s.length-(l.indexOf(dddss.charAt(++i))-36+90*(l.indexOf(dddss.charAt(++i
))-35))-1;
> lp=off+a-14+4;
> s=s+s.substring(off,lp);}
> else { if (a>=41) a=a-1; s=s+l.charAt(a);}};document.write(s);
>
> I downloaded the index.html and replaced the "eval()" with
> "prompt()". Then I copied the shown Java-Script code.
>
> Hm, then I inserted that code instead of the "eval()". I got the
> really decrypted code, but how can I show it properly? Using
> "prompt()" is not a solution, that's too much code...

I'm sure there is an easy way to do this by inserting the correct HTML tags,
but I couldn't get it to work.

I resorted to using a spammers trick... inserting characters so that words
are not interpreted properly (e.g. V.I.A.G.R.A ). In this case, replaced the
document.write(s) with the following loop:

for (i=0;i<s.length;i++) {
document.write(s.charAt(i) + "~$");
}

This inserts the string "~$" between each character of the decrypted code so
that the browser doesn't intrepret it as Javascript. I then copied the
output into a text editor where I could easily remove the extra characters
(assuming that the string "~$" doesn't appear in the decrypted code). Not
exactly efficient, but it did the job!

The decrypted code is pasted below. Correct indenting is left as an exercise
for the reader.

Regards,

Ockey.

---------------------------------------------------------------------------
----------------------------------------------------------------------------

Next message: Jeff Kell: "Re: Flood of bad DNS queries"

Previous message: Mike Lyman: "Re: Flood of bad DNS queries"
In reply to: Ockey: "Re: udp and dst port 1026"
Next in thread: Jeff Bryner: "RE: udp and dst port 1026"
Reply: Jeff Bryner: "RE: udp and dst port 1026"
Reply: jamesworld_at_intelligencia.com: "RE: udp and dst port 1026"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

Re: ClickOnce Nightmares
... your app need to install the settings. ... LAN) you could create a logon script that will automatically install the ... DownloadOptions options, ServerInformation& serverInformation) ... FileAccess access, Boolean asyncHint) ...
(microsoft.public.dotnet.framework)
Re: Saving Back-End Data As mdf
... complete code of a VB.NET console app. ... It's just an example to illustrate how a connection string is used. ... so it doesn't appear to be a problem with how or what I install. ... you access to the Microsoft Office Online Beta site'. ...
(microsoft.public.access.formscoding)
Re: Run 10.20 App on 11.00 ?
... installed on both machines using the vendor's install scripts. ... > if the app links in libc.a then you basically up the creek because you have ... Use chatr to see what the dependent libraries are. ... an industrial control system made by Fisher Control Systems. ...
(comp.sys.hp.hpux)
Re: Windows XP auto updates stinks!!
... just use one exploit whereas you have to test all patches. ... you needn't install them. ... so I ignore any updates to it. ... you install an incompatible app ...
(microsoft.public.windowsxp.general)
RE: udp and dst port 1026
... That and other clipboard security issues can be somewhat mitigated by: ... Custom Level> Scripting> Allow paste operations via script. ... People install the tool and the pop-ups stop. ... >www.popadstop.com is removed from their DNS servers. ...
(Incidents)