-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2006.0097 -- AUSCERT ALERT
                                   [Win]
                    Flickr site spoofed by trojan email
                              25 October 2006

===========================================================================

        AusCERT Alert Summary
        ---------------------

Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
                      Access Confidential Data
Access:               Remote/Unauthenticated


OVERVIEW:

        AusCERT has received reports and observed malicious emails currently 
        in circulation with subject lines:

        "about your photo"  or  "question about your photo"

        The emails entice users to visit a web page, using the lure:
        "I've accidentaly found your photo at a flickr"

        If a user clicks on the link and visits the page, code linked in an 
        iframe attempts to exploit browser vulnerabilities to install 
        trojan software on the user's system.


IMPACT:     

        The trojan malware intercepts web browser form data to capture 
        online banking credentials and sends the stolen data to the IP 
        address listed below. 

        Anti-virus and personal firewall products may be terminated or 
        tampered with by the trojan.

        The first component of the malicious software is detected by 
        several anti-virus products if signatures are up to date.


MITIGATION:

        Users should avoid clicking on any links in email, unless the email 
        was already expected.

        Unsolicited e-mail should always be treated with suspicion.

        System administrators may wish to consider monitoring their proxy 
        logs for access to the following URLs, or blocking them completely:

        h**p://81,95,146,106/spl/au/counter21,php

        h**p://ellensteinberg,us/flickr,html
        h**p://mitchellabell,com/flickr,html
        h**p://echo-eco,com/flickr,html
        h**p://www,urbanoutdoorliving,com,au/flickr,html
        h**p://emflamencodf,org/flickr,html
        h**p://visionquest,com,au/flickr,html
        h**p://siadtp,com/flickr,html
        h**p://kapstadt,tv/flickr,html
        h**p://sentinelpl,com,au/flickr,html
        h**p://arnegavelin,com/flickr,html
        h**p://sentinelpl,com,au/flickr,html 
        h**p://adiabetma,com/flickr,html
        h**p://costaalquileres,com/flickr,html
        h**p://dentalbruguier,com/flickr,html
        h**p://expertbonn,de/flickr,html
        h**p://experte-bonn,de/flickr,html
        h**p://lasertronicmadrid,com/flickr,html
        h**p://mvlproducts,com/flickr,html
        h**p://raulbenito,com/flickr,html
        h**p://scjpuente,edu,es/flickr,html
        h**p://servitec,info/flickr,html
        h**p://siadtp,com/flickr,html
        h**p://suedafrika,tv/flickr,html
        h**p://www.alafif,com/flickr,html

        Please note that the above urls have been intentionally modified.


DETAILS:

        The malicious email uses HTML with the following content:
        (here angle brackets have been replaced with square brackets)

        --- BEGIN EMAIL SAMPLE ---

        [BODY]
        I've accidently found [a href='http://(domain)/flickr.html']your photo[/a] at a flickr and i'm very
        interested in it.[br] Can you tell me what place i can see in the background of
        it?[br][br]
        ---[br]
        wbr, Raymundo Moss
        [/BODY]

        --- END EMAIL SAMPLE ---

        The page linked in the email appears to give a 404 not found error, but 
        is in fact active and returns the exploit code.

        The malware is installed as C:\windows\system32\ipv6monl.dll and 
        additionally installs C:\windows\ie.exe, which opens a listening 
        port on infected computers.

        Stolen data is also logged to the following files:
        C:\windows\system32\form.txt and C:\windows\system32\info.txt


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRT7tUyh9+71yA2DNAQJ96wP+JCr6LBXMddk2ZUvC1hlv7BJFF/3RRm5O
HtlLrA1zguQcG6ifJS+GIf/cqggE25h2Yd4SvsfXTkC+sRaJAREvtWld+x73sweP
MdQUD2HFhCS6qQK+SrQUxNZPdxpOtuWt1BRxkMh30xWH4+XTBFVifVKTXc+bYBWJ
91H60plr+tw=
=MDR1
-----END PGP SIGNATURE-----