Comments
yourfanat wrote: I am using another tool for Oracle developers - dbForge Studio for Oracle. This IDE has lots of usefull features, among them: oracle designer, code competion and formatter, query builder, debugger, profiler, erxport/import, reports and many others. The latest version supports Oracle 12C. More information here.
Cloud Expo on Google News
SYS-CON.TV
Cloud Expo & Virtualization 2009 East
PLATINUM SPONSORS:
IBM
Smarter Business Solutions Through Dynamic Infrastructure
IBM
Smarter Insights: How the CIO Becomes a Hero Again
Microsoft
Windows Azure
GOLD SPONSORS:
Appsense
Why VDI?
CA
Maximizing the Business Value of Virtualization in Enterprise and Cloud Computing Environments
ExactTarget
Messaging in the Cloud - Email, SMS and Voice
Freedom OSS
Stairway to the Cloud
Sun
Sun's Incubation Platform: Helping Startups Serve the Enterprise
POWER PANELS:
Cloud Computing & Enterprise IT: Cost & Operational Benefits
How and Why is a Flexible IT Infrastructure the Key To the Future?
Click For 2008 West
Event Webcasts
Breaking Down a Phishing Campaign | @CloudExpo #Cloud #Security
Our research shows that this page is in fact a harvester for valid Adobe credentials

This week we came across an interesting phishing campaign. Users receive a file named "paymentxxx.pdf." The file is a recently created PDF v1.5 made with Microsoft Word 2007, which can be opened by any PDF reader-Adobe or any other. The PDF is a single-page document and contains a hyperlink (http://rogerrodd.com/BJ/payment.htm).

pdf_is_secure

The design of the PDF employs trust-generating mechanisms commonly used in phishing schemes, including a bold header stating, "PDF Is Secured," and an image of a lock and tick mark with "100% SECURE" written across it. The creator also tries to generate trust by providing a benign-looking link to view the "Quotation Order" online, a method considered safe by many of us.

The problem starts when a user clicks the link. The PDF has embedded code to find and open the user's default browser (on a typical installation of Windows in an enterprise network where installation of third-party software requires IT department/administrator permissions, the default browser is usually Internet Explorer). When the link is clicked, the default browser is launched and the site is opened to a page where the user is asked to confirm his or her identity. The page includes an "Adobe PDF Online" logo, a "stay signed in" check box, and an "Adobe Corporation" copyright notice-all typical phishing campaign strategies where attackers try to give an impression of authenticity.

adobe_pdf_online

Our research shows that this page is in fact a harvester for valid Adobe credentials. Note that this website is over HTTP; any form or website which asks for credentials should be over HTTPS (however it is not guaranteed that all websites using HTTPS are legitimate). The webpage also downloads some of its images from other suspicious websites.

When the user clicks the "View Document" button on the webpage, a document from Google Drive is served. Here is another sign of suspicious activity: the webpage requests credentials for Adobe PDF Online, but the document is served from Google Drive. This document is not malicious, but the attackers' intentions to get your Adobe Online credentials have succeeded. Imagine the loss you might suffer if you use Adobe PDF Online for official purposes-you just handed over all your documents to the attacker.

As soon as this website is accessed, Eastwind Breach Detection indicates that it is not benign. As the PDF itself is not malicious, this type of threat will not have been detected or blocked by any AV engines.

eastwind_networks_dashboard

The other websites from which the images were downloaded are also flagged. These have a higher threat rating and have already been suspended by the web hosting service.

As we mentioned previously, the PDF document contains code to open the webpage in the user's default browser. Some browsers, such as Google Chrome or Mozilla Firefox, will show a warning that the page is a phishing website.  Others, such as Internet Explorer, do not indicate that the page is a phishing website.

It should also be noted that creation of such documents and even webpages is extremely easy. Each little change in the document or webpage will result in a different hash, thus defeating detection by traditional signature- and heuristics-based detection systems. In real time, Eastwind Breach Detection consults Eastwind Labs findings and other leading industry URL reputation engines to get the reputation of each and every URL that was accessed. This makes it extremely easy to catch such threats and alert on them. The above PDF was analyzed by Eastwind Labs and was found to have been created just 3 days beforeEastwind Labs saw it.

Eastwind Breach Detection sends an email and an alert to your iOS app as soon as any such activity is detected. The threat is analyzed in real time and you will be alerted within minutes. Then you can just change your passwords.

Recommendations:

  1. Block access to this URL (http://rogerrodd.com/BJ/payment.htm).
  2. Do NOT open attachments from untrusted sources.
  3. Do NOT click on any links inside documents.
  4. Get Eastwind Breach Detection, the missing piece in your network and data security. Always Watching. Always There.

 

This network activity was captured by Eastwind Labs and shows the target webpage (http://rogerrodd.com/BJ/payment.htm) fetching additional resources in the form of images and CGI scripts from other websites. Of these, earthmovingattachments.com.au is a blacklisted domain. The following images show the network traffic related to the HTML requests made by the malicious webpage.

http_request

 

wireshark_requests

 

About Paul Kraus
Paul has more than 25 years of experience in security, including VP Engineering at Blue Coat Systems and Solera Networks, and Director of Engineering roles at Adobe, VERITAS and Symantec.

In his current role as President and CEO for Eastwind, Paul is helping define and execute the company’s mission of providing enterprise-grade network security to SMBs.

Latest Cloud Developer Stories
"Storpool does only block-level storage so we do one thing extremely well. The growth in data is what drives the move to software-defined technologies in general and software-defined storage," explained Boyan Ivanov, CEO and co-founder at StorPool, in this SYS-CON.tv interview at...
You know you need the cloud, but you’re hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected ...
Is advanced scheduling in Kubernetes achievable?Yes, however, how do you properly accommodate every real-life scenario that a Kubernetes user might encounter? How do you leverage advanced scheduling techniques to shape and describe each scenario in easy-to-use rules and configura...
As Marc Andreessen says software is eating the world. Everything is rapidly moving toward being software-defined – from our phones and cars through our washing machines to the datacenter. However, there are larger challenges when implementing software defined on a larger scale - ...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices ...
Subscribe to the World's Most Powerful Newsletters
Subscribe to Our Rss Feeds & Get Your SYS-CON News Live!
Click to Add our RSS Feeds to the Service of Your Choice:
Google Reader or Homepage Add to My Yahoo! Subscribe with Bloglines Subscribe in NewsGator Online
myFeedster Add to My AOL Subscribe in Rojo Add 'Hugg' to Newsburst from CNET News.com Kinja Digest View Additional SYS-CON Feeds
Publish Your Article! Please send it to editorial(at)sys-con.com!

Advertise on this site! Contact advertising(at)sys-con.com! 201 802-3021



SYS-CON Featured Whitepapers
ADS BY GOOGLE