大砲開講

第一場講者：Jeremiah Grossman (WhiteHat Security創辦人兼技術長、InfoWorld 2007年最傑出25位技術長)
演講題目: 未來Web資安之大挑戰：邏輯漏洞
演講內容摘要：面對Web越來越盛行，惡意的攻擊者每天都虎視眈眈想要入侵主要的網站，竊取有用的資訊，以獲取利益。在演講中，作者提出七個未來Web資安之大挑戰及解決方案(下載此文章)：

1. Winning an Online Auction
2. Interactive” T.V.
3. See Steve Jobs up close
4. Day trading contest for $1,000,000
5. The house almost always wins
6. Password Recovery
7. Making millions by trading on semi-public information

最後，作者也提到，面對這些新挑戰，防毒軟體、入侵偵測/防護系統、網頁應用程式防火牆等工具都不能偵測到這些威脅 (各位企業IT主管們，應該要覺醒了吧！不要在亂買一些無用的產品，花點小錢，好好訓練員工的技術能力吧)。

第二場講者：Daniel Hsu, 徐子文 (美國運通全球安全部東北亞區安全經理、美國產業安全學會ASIS International台灣分會會長、亞洲危機暨安全合作組織執行委員會委員)
演講題目: 從使用者的角度出發，企業的安全長要的是什麼？
演講內容摘要：工程師們，請把資安技術轉換成管理者聽得懂的語言，並想想怎麼利用最少的資源(好像不太可能喔)，替公司賺更多的錢。

第三場講者：Jack Yu, 余俊賢 (資安人雜誌主編)/Jeremy Chou, 邱銘彰 (艾克索夫實驗室創辦人兼技術長)
演講題目: 決戰實況: 中國網軍與海峽兩岸資訊戰

面對中國網軍，台灣軍方單位真的要認真考慮，如何建立一個專責單位，負責強化資訊戰的能量，否則，到時候怎麼死的，都不知道 (我個人的經驗是，現在編制人員，工作分配太雜，無法專心研究相關資安技術及演練，想要進步都很難)。

第四場講者：Mike Shema (Qualys首席資安研究員)
演講題目: Web資安–企業如何有效利用自動工具？

第五場講者：ayne Huang, 黃耀文 (OWASP台灣分會會長、阿碼科技創辦人兼執行長)
演講題目: 利用靜態檢測做好安全Web應用程式開發

事後的檢查所花費的時間與金錢是相當的可觀，即使知道問題所在，企業會馬上修補這些問題嗎？蠻令人質疑的。

Writing Secure Code 重要嗎？我想對大部分的研發人員都不重要，即使花再多的錢去訓練這些研發人員 (我不是說這種訓練沒用喔)，還是會發生同樣的問題，那問題出在哪呢？答案很多，很值得討論囉！

最後，當然希望主辦單位能把研討會的Slides分享出來囉。

延伸閱讀：
防止中國網軍襲擊 外交部強化資訊安全
外交部「實體隔離」管制防駭攻擊
調查局防止中共網軍襲擊 我外交部強化資訊安全
專訪WhiteHat CTO：Web應用使邏輯漏洞危害更大
信用卡風險控管催生IT商機

至於詳細的資訊，請參考作者網站：
http://www.gnucitizen.org/blog/google-gmail-e-mail-hijack-technique/

另外，另一個網友也在他的部落格中，展示利用 Google 的某些安全漏洞 (作者有提供驗證程式碼)，成功地達到某些目的，有興趣的人，請參考下面連結：
http://blog.beford.org/?p=3 (注意：此部落格中的展示連結，請勿在 Gmail 開啟的狀況下執行，否則，你的電子郵件會被轉寄到作者的電子郵件信箱。如要測試，最好在虛擬環境下，自行建立一個新的 Gmail 帳戶)

• Urchine 版本為 5.6.00r2、5.7.01、5.7.02、5.7.03 (之前的版本也有可能有此漏洞)。

驗證程式碼：

其他的驗證程式碼和展示影片，請參考下列的網址：http://www.gnucitizen.org/blog/google-urchin-password-theft-madnesshttp://www.youtube.com/v/wCUovL9WLVQ

另外，RSnake 在他的部落格中，也利用一個網站展示此漏洞 (如下圖)：

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[Added process]
C:\WINDOWS\system32\mswinsvcr.exe

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\flash7[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\morgan[1].htm
C:\WINDOWS\system32\mswinsvcr.exe

[Added registry]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=Microsoft
Data=mswinsvcr.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Value=Microsoft
Data=mswinsvcr.exe

到目前為止 (2007/9/24 @ 15:31)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

flash7[1].exe:
[ Trend ], “WORM_RBOT.GBG”
mswinsvcr.exe:
[ Trend ], “WORM_RBOT.GBG”
morgan.htm:
[ Kaspersky ], “Trojan-Downloader.VBS.Psyme.iq”
[ HBEDV ], “VBS/Dldr.Psyme.IQ”
[ Rising ], “Trojan.DL.Script.VBS.Agent.xgu”

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[Added process]
C:\WINDOWS\system32\rarjbtl.exe
C:\WINDOWS\system32\kaqhdaz.exe
C:\WINDOWS\system32\avwlast.exe
C:\Program Files\Common Files\Microsoft Shared\addslta.exe
C:\WINDOWS\system32\kapjbaz.exe
C:\Program Files\Common Files\System\gaebwdw.exe
C:\WINDOWS\system32\WinFormA11.exe

[DLL injection]
C:\Program Files\Common Files\Microsoft Shared\addslta.exe
C:\Program Files\Common Files\Microsoft Shared\MSInfo\SysWFGQQ2.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\SysWFGwd2.dll
C:\Program Files\NetMeeting\ravmsmon.dat
C:\Program Files\NetMeeting\ravytmon.dat
C:\Program Files\NetMeeting\ravzxmon.dat
C:\WINDOWS\system32\avwlamn.dll
C:\WINDOWS\system32\DiskMan32.dll
C:\WINDOWS\system32\kapjbzy.dll
C:\WINDOWS\system32\kaqhdaz.exe
C:\WINDOWS\system32\MsIMMs32.dll
C:\WINDOWS\system32\NVDispDrv.dll
C:\WINDOWS\system32\rarjbpi.dll
C:\WINDOWS\system32\WinFormA11.dll

[Added service]
NAME: WS2IFSL (正常)
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\14[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\18[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\22[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\hx11aaa[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\svcos[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\webxl[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\xpbd[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\12[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\16[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\20[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\Webxl[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\xp017[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\xp07[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\15[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\19[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\23[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\pps[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\qq98[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\xpkk[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\xpxl[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\13[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\17[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\21[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\ah[1].c
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\by[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\xpby[1].htm
C:\microsofts.vbs
C:\NTDETECT.EXE
C:\Program Files\Common Files\Microsoft Shared\addslta.exe
C:\Program Files\Common Files\Microsoft Shared\lpttype.inf
C:\Program Files\Common Files\Microsoft Shared\MSInfo\SysWFGQQ2.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\SysWFGwd2.dll
C:\Program Files\Common Files\System\gaebwdw.exe
C:\Program Files\Common Files\System\lpttype.inf
C:\Program Files\meex.exe
C:\Program Files\NetMeeting\ravmsmon.dat
C:\Program Files\NetMeeting\ravmsmon.exe
C:\Program Files\NetMeeting\ravytmon.dat
C:\Program Files\NetMeeting\ravytmon.exe
C:\Program Files\NetMeeting\ravzxmon.dat
C:\Program Files\NetMeeting\ravzxmon.exe
C:\WINDOWS\DiskMan32.exe
C:\WINDOWS\Fonts\chreaur.fon
C:\WINDOWS\Fonts\enhuafx.fon
C:\WINDOWS\Fonts\enpoafx.fon
C:\WINDOWS\Fonts\mswuasd.fon
C:\WINDOWS\MsIMMs32.exe
C:\WINDOWS\NVDispDrv.exe
C:\WINDOWS\system32\avwlain.dll
C:\WINDOWS\system32\avwlamn.dll
C:\WINDOWS\system32\avwlast.exe
C:\WINDOWS\system32\DiskMan32.dll
C:\WINDOWS\system32\kapjacs.dll
C:\WINDOWS\system32\kapjbaz.exe
C:\WINDOWS\system32\kapjbzy.dll
C:\WINDOWS\system32\kaqhacs.dll
C:\WINDOWS\system32\kaqhdaz.exe
C:\WINDOWS\system32\kaqhdzy.dll
C:\WINDOWS\system32\mscomm.dll
C:\WINDOWS\system32\MsIMMs32.dll
C:\WINDOWS\system32\NVDispDrv.dll
C:\WINDOWS\system32\rarjani.dll
C:\WINDOWS\system32\rarjbpi.dll
C:\WINDOWS\system32\rarjbtl.exe
C:\WINDOWS\system32\ravgjmon.dll
C:\WINDOWS\system32\WinFormA11.dll
C:\WINDOWS\system32\WinFormA11.exe
C:\WINDOWS\system32\WinFormA7.ini

[Added LSP]
ID: 1012
NAME: MSAPI Tcpip [UDP/IP]

ID: 1013
NAME: MSAPI Tcpip [TCP/IP]

[Added COM/BHO]
{1960356A-458E-DE24-BD50-268F589A56A1}-C:\WINDOWS\system32\avwlamn.dll
{2598FF45-DA60-F48A-BC43-10AC47853D52}-C:\WINDOWS\system32\rarjbpi.dll
{2A321487-4977-D98A-C8D5-6488257545A2}-C:\WINDOWS\system32\kapjbzy.dll
{47D81718-1314-5200-2597-587901018074}-C:\WINDOWS\system32\kaqhdzy.dll
{91B1E846-2BEF-4345-8848-7699C7C9935F}-C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGQQ2.dll
{F12BC423-3713-224D-3F55-32B35C62B11F}-C:\WINDOWS\system32\WinFormA11.dll

[Added registry]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=lpttype
Data=C:\Program Files\Common Files\System\gaebwdw.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=ravmsmon
Data=C:\Prog
ram Files\NetMeeting\ravmsmon.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=ravytmon
Data=C:\Program Files\NetMeeting\ravytmon.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=ravzxmon
Data=C:\Program Files\NetMeeting\ravzxmon.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=MsIMMs32
Data=C:\WINDOWS\MsIMMs32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=lvpwmgh
Data=C:\Program Files\Common Files\Microsoft Shared\addslta.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=DiskMan32
Data=C:\WINDOWS\DiskMan32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=NVDispDrv
Data=C:\WINDOWS\NVDispDrv.exe

到目前為止 (2007/9/24 @ 17:06)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

ravmsmon.exe:
[ Trend ], “TSPY_ONLINEG.HTG”
SysWFGQQ2.dll:
[ Trend ], “Possible_Infostl”
SysWFGwd2.dll:
[ Trend ], “Possible_Infostl”
addslta.exe:
[ Trend ], “Possible_MLWR-5″
DiskMan32.dll:
[ Trend ], “Possible_OLGM-4″
DiskMan32.exe:
[ Trend ], “TSPY_ONLINEG.HSY”
gaebwdw.exe:
[ Trend ], “Possible_MLWR-5″
kaqhdaz.exe:
[ Trend ], “TROJ_SYSTEMHI.JE”
meex.exe:
[ Trend ], “Possible_MLWR-5″
rarjbtl.exe:
[ Trend ], “TROJ_SYSTEMHI.JG”
ravmsmon.dat:
[ Trend ], “TSPY_ONLINEG.HOA”
ravytmon.dat:
[ Kaspersky ], “PAK:UPack”
[ Sophos ], “Mal/Packer”
[ Fortinet ], “suspicious”
[ HBEDV ], “TR/PSW.OnLineG.TF.1″
[ Norman ], “Security Risk W32/Suspicious_U.gen”
ravytmon.exe:
[ Symantec ], “Infostealer”
[ Microsoft ], “[->(Upack)]:PWS:Win32/Frethog.gen!E”
[ Kaspersky ], “PAK:PE_Patch, PAK:UPack, Trojan-PSW.Win32.OnLineGames.dky”
[ McAfee ], “New Malware.aj !!”
[ Sophos ], “Mal/Packer”
[ Panda ], “Suspicious file”
[ Nod32 ], “probably a variant of Win32/PSW.OnLineGames.NEP trojan”
[ Fortinet ], “suspicious”
[ HBEDV ], “TR/PSW.OnLineG.TF.1″
[ Norman ], “Security Risk W32/Suspicious_U.gen”
ravzxmon.dat:
[ Symantec ], “Infostealer”
[ Microsoft ], “[->(Upack)]:PWS:Win32/Frethog.gen!E.dll”
[ Kaspersky ], “PAK:UPack, Trojan-PSW.Win32.OnLineGames.dkf”
[ McAfee ], “PWS-OnlineGames.d.dll”
[ Sophos ], “Mal/Packer”
[ Panda ], “Suspicious file”
[ Nod32 ], “a variant of Win32/PSW.OnLineGames.NCU trojan”
[ Fortinet ], “W32/OnlineGames.PE!tr.dldr”
[ HBEDV ], “TR/PSW.OnLineG.TF.1″
[ Norman ], “Security Risk W32/Suspicious_U.gen”
ravzxmon.exe:
[ Symantec ], “Infostealer”
[ Microsoft ], “[->(Upack)]:PWS:Win32/Frethog.gen!E”
[ Kaspersky ], “PAK:PE_Patch, PAK:UPack, Trojan-PSW.Win32.OnLineGames.dkf”
[ McAfee ], “New Malware.aj !!”
[ Sophos ], “Mal/Packer”
[ Panda ], “Suspicious file”
[ Nod32 ], “probably a variant of Win32/PSW.OnLineGames.NEP trojan”
[ Fortinet ], “suspicious”
[ HBEDV ], “TR/PSW.OnLineG.TF.1″
[ Norman ], “Security Risk W32/Suspicious_U.gen”
WinFormA11.dll:
[ Microsoft ], “Trojan:Win32/Delf.AT!dll”
[ Kaspersky ], “Trojan-PSW.Win32.OnLineGames.dgq”
[ McAfee ], “PWS-Gamania.dll”
[ Sophos ], “Mal/Behav-136″
[ Nod32 ], “a variant of Win32/PSW.OnLineGames.NEN trojan”
[ HBEDV ], “HEUR/Malware”
[ Rising ], “Trojan.PSW.Win32.TLOnline.be”
WinFormA11.exe:
[ Microsoft ], “[->(Upack)]:Trojan:Win32/Delf.AT!dll”
[ Kaspersky ], “PAK:UPack, Trojan-PSW.Win32.OnLineGames.dgq”
[ McAfee ], “New Malware.n !!”
[ Sophos ], “Mal/Packer”
[ Nod32 ], “probably a variant of Win32/Genetik trojan”
[ Fortinet ], “W32/OnLineGames.DGQ!tr.pws”
[ HBEDV ], “TR/PSW.OnLineGames.dgq”
[ Norman ], “Security Risk W32/Suspicious_U.gen”
avwlamn.dll:
[ Symantec ], “Infostealer.Gampass”
[ Microsoft ], “Trojan:Win32/Delf.AT!dll”
[ Kaspersky ], “Trojan-Spy.Win32.Delf.aji”
[ McAfee ], “PWS-OnlineGames.a.dll”
[ Sophos ], “Mal/Gampass-A”
[ Fortinet ], “W32/OnLineGames.GC!tr.pws”
[ HBEDV ], “TR/Spy.Delf.aji”
[ Norman ], “Trojan W32/Malware.ATVI”
[ Rising ], “Trojan.PSW.Win32.WorldOnline.kz”
avwlast.exe:
[ Symantec ], “Infostealer.Gampass”
[ Microsoft ], “[->(Upack)]:Trojan:Win32/SystemHijack.gen”
[ Kaspersky ], “PAK:UPack, Trojan-Dropper.Win32.Agent.bxi”
[ McAfee ], “New Malware.n !!”
[ Sophos ], “Mal/Packer”
[ Nod32 ], “probably a variant of Win32/Genetik trojan”
[ Fortinet ], “W32/Agent.DRP!tr”
[ HBEDV ], “TR/Drop.Agent.bxi”
[ Norman ], “Security Risk W32/Suspicious_U.gen”
[ Ewido ], “Trojan.OnLineGames.cew”
kapjbaz.exe:
[ Symantec ], “Infostealer.Gampass”
[ Microsoft ], “[->(Upack)]:Trojan:Win32/SystemHijack.gen”
[ Kaspersky ], “PAK:UPack, Trojan-PSW.Win32.OnLineGames.dki”
[ McAfee ], “New Malware.n !!”
[ Sophos ], “Mal/Packer”
[ Nod32 ], “probably a variant of Win32/Genetik trojan”
[ Fortinet ], “suspicious”
[ HBEDV ], “HEUR/Malware”
[ Norman ], “Security Risk W32/Suspicious_U.gen”
kapjbzy.dll:
[ Symantec ], “Infostealer.Gampass”
[ Microsoft ], “Trojan:Win32/Delf.AT!dll”
[ Nod32 ], “probably a variant of Win32/PSW.OnLineGames.NEN trojan”
[ Fortinet ], “W32/OnLineGames.GC!tr.pws”
[ HBEDV ], “HEUR/Malware”
kaqhdzy.dll:
[ Microsoft ], “Trojan:Win32/Delf.AT!dll”
[ Kaspersky ], “Trojan-PSW.Win32.QQPass.afj”
[ Sophos ], “Mal/Behav-136″
[ Nod32 ], “a variant of Win32/PSW.OnLineGames.NEN trojan”
[ HBEDV ], “HEUR/Malware”
lpttype.inf:
[ McAfee ], “Generic!atr”
microsofts.vbs:
[ Microsoft ], “[->(UTF-16LE)]:Virus:VBS/VBSWGbased.gen”
mscomm.dll:
[ Kaspersky ], “Trojan-PSW.Win32.OnLineGames.din”
MsIMMs32.dll:
[ Microsoft ], “PWS:Win32/Frethog.gen!B”
[ Kaspersky ], “Trojan-PSW.Win32.OnLineGames.dkt”
[ Sophos ], “Mal/Gampass-A”
[ HBEDV ], “HEUR/Malware”
[ Rising ], “Trojan.PSW.Win32.Sh
anda.z”
MsIMMs32.exe:
[ Microsoft ], “[->(UPX)]:PWS:Win32/Frethog.gen!D”
[ Kaspersky ], “PAK:PE_Patch.UPX, PAK:UPX, Trojan-PSW.Win32.OnLineGames.dku”
[ Sophos ], “[FILE:0000]:Mal/Gampass-A, Mal/Dropper-P”
[ Nod32 ], “a variant of Win32/PSW.OnLineGames.YA trojan”
[ HBEDV ], “TR/Dropper.Gen”
[ Norman ], “[Heuristic Sandbox detection]:Virus W32/Malware”
NTDETECT.EXE:
[ Microsoft ], “[->(UTF-16LE)]:Virus:VBS/VBSWGbased.gen”
NVDispDrv.dll:
[ Symantec ], “Trojan.PWS.QQPass”
[ Microsoft ], “PWS:Win32/OnLineGames.COK”
[ Kaspersky ], “Trojan-PSW.Win32.OnLineGames.dgi”
[ Panda ], “Trj/Lineage.FMS”
[ HBEDV ], “HEUR/Malware”
[ Rising ], “Trojan.PSW.Win32.OnlineGames.yul”
NVDispDrv.exe:
[ Symantec ], “Trojan.PWS.QQPass”
[ Microsoft ], “[->(UPX)]:PWS:Win32/Frethog.gen!D”
[ Kaspersky ], “PAK:PE_Patch.UPX, PAK:UPX, Trojan-PSW.Win32.OnLineGames.dgi”
[ Sophos ], “Mal/Dropper-P”
[ Panda ], “Trj/Lineage.FMS”
[ Nod32 ], “a variant of Win32/PSW.OnLineGames.YA trojan”
[ Fortinet ], “W32/Dropper.DGI!tr.pws”
[ HBEDV ], “TR/Dropper.Gen”
rarjbpi.dll:
[ Microsoft ], “Trojan:Win32/Delf.AT!dll”
[ Panda ], “Suspicious file”
[ Fortinet ], “W32/OnLineGames.GC!tr.pws”
[ HBEDV ], “HEUR/Malware”
ravgjmon.dll:
[ Kaspersky ], “PAK:UPack, Trojan-PSW.Win32.OnLineGames.dkz”
[ Sophos ], “Mal/Packer”
[ Fortinet ], “suspicious”
[ HBEDV ], “HEUR/Malware”
[ Norman ], “Security Risk W32/Suspicious_U.gen”
xp07.htm:
[ Sophos ], “Mal/Iframe-A”
xpxl.htm:
[ Sophos ], “Mal/Iframe-A”
by.htm:
[ Sophos ], “Mal/Iframe-A”
pps.htm:
[ Sophos ], “Mal/Iframe-A”

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\Ms06014[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\help[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\update[1].exe
C:\WINDOWS\~Temp8573.tmp

到目前為止 (2007/9/24 @ 14:50)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

~Temp8573.tmp:
[ Trend ], “TROJ_DLOADER.PMG”
update[1].exe:
[ Trend ], “TROJ_DLOADER.PMG”
help[1].htm:
[ Sophos ], “Mal/XDwif-A”
Ms06014[1].htm:
[ Kaspersky ], “Trojan-Downloader.JS.Psyme.kf”
[ HBEDV ], “TR/Dldr.Psyme.KF.5″
[ Rising ], “Trojan.DL.JS.Agent.lio”

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Help\E4D4CA973D22.dll

[Added file]
C:\autorun.inf
C:\Documents and Settings\Administrator\Desktop\2.bat
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\m[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\gmsex[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\h[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\main[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\stat[1].htm
C:\Shell.exe
C:\WINDOWS\Help\E4D4CA973D22.dll
C:\WINDOWS\Help\E4D4CA973D22.exe

[ Added COM/BHO ]
{0EDE18B7-247D-40D2-906C-D918323BEB40}-C:\WINDOWS\Help\E4D4CA973D22.dll

到目前為止 (2007/9/24 @ 17:03)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

E4D4CA973D22.dll:
[ Trend ], “Possible_Infostl”
E4D4CA973D22.exe:
[ Trend ], “Possible_Infostl”
gmsex[1].exe:
[ Trend ], “Possible_Infostl”
Shell.exe:
[ Trend ], “Possible_Infostl”
h[1].htm:
[ Alpha_Gen ], “Heur_Infrm-1″
[ Sophos ], “Mal/Iframe-A”
m[1].htm:
[ HBEDV ], “HEUR/Exploit.HTML”
[ Rising ], “Trojan.DL.VBS.Small.eh”

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Debug\F01A4ACBB854.dll

[Added file]
C:\Documents and Settings\Administrator\Desktop\1.bat
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\qsuj[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\Ms06014[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\t[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\win[1].exe
C:\WINDOWS\Debug\F01A4ACBB854.dll
C:\WINDOWS\Debug\F01A4ACBB854.exe

[Added COM/BHO]
{02770E1C-4C49-4721-80B0-A263FFF0231E}-C:\WINDOWS\Debug\F01A4ACBB854.dll

到目前為止 (2007/9/24 @ 15:50)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

F01A4ACBB854.dll:
[ Trend ], “Possible_Infostl”
F01A4ACBB854.exe:
[ Trend ], “Possible_Infostl”
win[1].exe:
[ Trend ], “Possible_Infostl”
1.bat:
[ Kaspersky ], “Trojan.BAT.KillAV.fs”
Ms06014[1].htm:
[ HBEDV ], “JS/Dldr.Agent.bgb”
qsuj[1].htm:
[ Alpha_Gen ], “Possible_EncScr”
[ HBEDV ], “HTML/Dldr.Iframe.D”
[ Ewido ], “Downloader.Agent.fm”
t[1].js:
[ Alpha_Gen ], “Heur_Infrm-2″
[ Sophos ], “Mal/Iframe-A”

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

解碼之後為：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\system32\od3mdi.dll

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL (正常)
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\css[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\real[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\764994885[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\down1[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\main[1].js
C:\WINDOWS\rising283.exe
C:\WINDOWS\system32\drivers\KrnDigger.SYS
C:\WINDOWS\system32\lo.dll
C:\WINDOWS\system32\od3mdi.dll
C:\WINDOWS\system32\ss.exe

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP]

ID: 1013
NAME: MSAFD Tcpip [TCP/IP]

到目前為止 (2007/9/24 @ 14:37)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

down1[1].exe:
[ Trend ], “TSPY_MARAN.AFU”
real[1].exe:
[ Trend ], “TROJ_DELF.HYF”
rising283.exe:
[ Trend ], “TROJ_DELF.HYF”
yahoo.js:
[ Trend ], “JS_DLOADER.PYD”
css[1].js:
[ Alpha_Gen ], “Possible_EncScr”
[ Kaspersky ], “Trojan-Downloader.JS.Psyme.mr”
[ HBEDV ], “JS/Dldr.MarcoMedia”
KrnDigger.SYS:
[ Panda ], “Trj/Agent.GII”
[ Nod32 ], “Win32/RiskWare.PsUtils.18 application”
[ Fortinet ], “HackerTool/PsUtils”
[ HBEDV ], “SPR/Tool.PsUtils.18″
[ Rising ], “RootKit.Win32.Agent.ngr”
od3mdi.dll:
[ Alpha_Gen ], “Possible_Lineage”
[ Symantec ], “Infostealer.Phax”
[ Microsoft ], “TrojanSpy:Win32/Maran.AT”
[ Kaspersky ], “Trojan-PSW.Win32.Maran.kf”
[ McAfee ], “PWS-Maran.dll”
[ Panda ], “Trj/Maran.CG”
[ Nod32 ], “Win32/PSW.Maran.KF trojan”
[ Fortinet ], “W32/Maran.A!tr.pws”
[ HBEDV ], “TR/Drop.Ag.115200.D”
[ Rising ], “Trojan.PSW.Win32.OnlineGames.xyq”
ss.exe:
[ Kaspersky ], “PAK:PE_Patch, PAK:UPack”
[ McAfee ], “New Malware.aj !!”
[ Sophos ], “Mal/Packer”
[ Nod32 ], “Win32/RiskWare.PsUtils.18 application”
[ Fortinet ], “HackerTool/PsUtils”
[ HBEDV ], “SPR/HideProcess.B.2″
[ Norman ], “Security Risk W32/Suspicious_U.gen”

遭置換(或新增、修改)網頁：

至於詳細的資訊，請參考 zone-h (或 zone-h CN)。

遭置換(或新增、修改)網頁：

至於詳細的資訊，請參考 zone-h (或 zone-h CN)。

遭置換(或新增、修改)網頁：

至於詳細的資訊，請參考 zone-h (或 zone-h CN)。

影響系統或軟體：

• Adobe Acrobat 8.1 (Windows XP Service Pack 2+更新所有的安全修補程式，Windows Vista不受影響)。
• 其他的PDF閱讀器可能也受影響，如Apple的預覽程式。

展示影片：
http://www.gnucitizen.org/projects/0day-pdf-pwns-windows/poc.wmv

如果各位發現哪裡有驗證程式，麻煩通知一聲，感謝。