Category Archives: Security visualization

As networks become ever more complex, securing them becomes more and more difficult. The solution is visualization. Using today’s state-of-the-art data visualization techniques, you can gain a far deeper understanding of what’s happening on your network right now. You can uncover hidden patterns of data, identify emerging vulnerabilities and attacks, and respond decisively with countermeasures that are far more likely to succeed than conventional methods.

WordPress TimThumb Botnets Spreads Status – second edition

Security visualization, Various,

Since the discovery of the WordPress TimThumb vulnerability in August 2011 by Mark Maunder, the vulnerability has been used as botnet recruitment vector, and has now spread in multiple botnets. Hundreds of WordPress blogs have been hacked, allowing potential infection of the blogs visitors, diffusion of spam and phishing campaign, DDoS, hack of other web sites (such as About.us domain name registrar), etc, etc. Some of these infected WordPress were controlled by well-known C&C servers used and shared by black hats from around the world.

Six month after the discovery of the vulnerability I had made a first status on the WordPress TimThumb spread with some nice visualizations and graphs representing the botnet activities.

We are soon one year after the discovery of the vulnerability and a second status on the WordPress TimThumb botnets could be done. Are the botnets still active, are less WordPress blogs vulnerable, is the pick of spread over ? We will try, through an analysis of all the WordPress TimThumb vulnerability exploitation attempts against our Honey Net, to answer these questions. The data’s collected through our Honey Net are representing only a small part of the real activity of the WordPress TimThumb botnets, but these data’s could also represent an extrapolation of the real activities.

List of all detected infected domains

You can find in the following table the complete list of all detected infected domains how were called during the WordPress TimThumb RFI attack, with the domain associated IP address, the country where the blog were hosted, the number of distinct source IPs how have call the related domain during the RFI attack and the live time of the domain name.

We have a total of 473 affected domains compared to the 202 six month before. This number demonstrates that 11 months after the vulnerability discovery the botnet is still in activity and that the number of infected domains are still important. “blogger.com.dollhousedelights.com“, hosted in Taiwan (IP has moved from Vietnam to Taiwan), was the affected domain how was called by the much more distinct source IPs (265), followed by “picasa.com.xpl.be” with 167 distinct source IPs, and at the third place “blogger.com.midislandrental.com” with 110 distinct source IPs.

“picasa.com.xpl.be” has a live time of 238 days, followed by “upload.wikimedia.org.penguinet.co.ke” with a live time of 218 days, “blogger.com.sabrosaserver.com” with 211 days, “wordpress.com.airatrip.com” with 186 days and “flickr.com.bpmohio.com” with 179 days.

29 domains have a live time above 100 days and 86 domains have a live time between 30 days and 100 days.

Infected blogs countries repartition

You can find in the following graphs (Chart1 – Chart2) the geographically repartition of the infected blogs.

We have a total of 45 different countries for 473 affected domains. United States is in first position with 57% (284) of all infected blogs, followed by Canada with 5.2% (26), United Kingdom with each 4.4% (22) of all infected blogs. US is still in the first position (+155) of infected WordPress and we can see that the infected countries are quiet the same as six months ago.

Infected blogs countries repartition by number of source IPs

You can find in the following graphs (Chart3 – Chart4) the geographically repartition of the infected blogs by number of distinct source IPs how have call the infected blogs.

We have a total of 3340 distinct source IPs for 473 affected domains and 45 different hosting countries. United States is in first position with 44.3% (1480), followed by Vietnam with 8.4% (279), Chile with 4.3% (143), Romania with 4.3% (142) and Australia with 3.6% (119). US is in the first position (+639) of infected WordPress, Vietnam in second position but source IPs have drastically decrease compared to six months ago (only +36).

Timeline by day of infected blogs calls and source IPs

You can find in the following timeline (Chart5) a representation by day of the infected blogs number calls and source IPs.

From January 2012 to April 2012 the botnet spread has constantly decrease in term of number of affected hosts and source IPs, but in April 2012 the botnet has suddenly increase his activity. November 2011 was the most active month for the number of source IPs.

Geographic timeline by day of all source IPs

In this geographic time map we’re loading data’s from a Google Spreadsheet (published here). These data’s are coming from our HoneyNet and are representing the geographic WordPress TimThumb Botnet activities from 15-09-2011 to 01-07-2012.

Conclusion

WordPress TimThumb botnets, one year after the vulnerability discovery, is still continuing to infect new blogs, the pick of spread is over since November 2011. My personal opinion is that we will steal continue to hear about these botnets during second part of 2012.

WordPress TimThumb Botnets Spreads Status – first edition

Security visualization, Various,

Since the discovery of the WordPress TimThumb vulnerability in August 2011 by Mark Maunder, the vulnerability has been used as botnet recruitment vector, and has now spread in multiple botnets. Hundreds of WordPress blogs have been hacked, allowing potential infection of the blogs visitors, diffusion of spam and phishing campaign, DDoS, hack of other web sites (such as About.us domain name registrar), etc, etc. Some of these infected WordPress were controlled by well known C&C servers used and shared by black hats from around the world.

We are soon six month after the discovery of the vulnerability and a status on the WordPress TimThumb botnets could be done. Are the botnets still active, are less WordPress blogs vulnerable, is the pick of spread over ? We will try, through an analysis of all the WordPress TimThumb vulnerability exploitation attempts against our Honey Net, to answer these questions. The datas collected through our Honey Net are representing only a small part of the real activity of the WordPress TimThumb botnets, but these datas could also represent an extrapolation of the real activities.

List of all detected infected domains

You can find in the following table the complete list of all detected infected domains how were called during the WordPress TimThumb RFI attack, with the domain associated IP address, the country where the blog were hosted, the number of distinct source IPs how have call the related domain during the RFI attack and the live time of the domain name.

We have a total of 202 affected domains. “blogger.com.dollhousedelights.com“, hosted in Vietnam, was the affected domain how was called by the much more distinct source IPs (258), followed by “picasa.com.xpl.be” with 152 distinct source IPs, and at the third place “blogger.com.midislandrental.com” with 110 distinct source IPs.

“picasa.com.xpl.be” and “picasa.computergoogle.co.cc” have the longer live time with 105 days, followed by “wordpress.com.hostdail.com” and “blogger.com.pasbar.com” with 72 days.

Infected blogs countries repartition

You can find in the following graphs (Chart1 – Chart2) the geographically repartition of the infected blogs.

We have a total of 31 different countries for 202 affected domains. United States is in first position with 58.9% (129) of all infected blogs, followed by Australia, Canada and United Kingdom with each 3.7% (8) of all infected blogs.

Infected blogs countries repartition by number of source IPs

You can find in the following graphs (Chart3 – Chart4) the geographically repartition of the infected blogs by number of distinct source IPs how have call the infected blogs.

We have a total of 1734 distinct source IPs for 202 affected domains and 31 different hosting countries. United States is in first position with 48.5% (841), followed by Vietnam with 14% (243), Indonesia with 4.7% (82) and Taiwan with 4.1% (71).

Timeline by day of infected blogs calls and source IPs

You can find in the following timeline (Chart5) a representation by day of the infected blogs number calls and source IPs.

November 2011 was the most active month for the number of source IPs and that in December the number of source IPs has drastically decrease. You can see that during the first half of November the number of infected blogs calls have increase days after days, and since the 22 November the number of infected blogs is stabilized but is not decreasing.

Geographic timeline by day of all source IPs

In this geographic time map we’re loading datas from a Google Spreadsheet (published here). These datas are coming from our HoneyNet and are representing the geographic Wordpress TimThumb Botnet activities from 15-09-2011 to 03-12-2011.

AfterGlow representation of the WordPress TimThumb

By clicking on the following link, you can download an AfterGlow representation of the WordPress TimThumb botnets with links between each nodes.

Conclusion

WordPress TimThumb botnets are still continuing to infect new blogs, but the associated activities are decreasing since second half December. Maybe black hats are still in holidays 🙂 My personal opinion is that we will steal continu to hear about these botnets during complete 2012.

In Memory of FileAve.com Botnet

Security visualization, Various

Good news for every one, FileAve.com is finally down since the 18 October ! In July 2010 I have written a blog post on FileAve.com a free file hosting provider notorious for spreading thousands of malwares. FileAve.com have provide 50 MB free storage and a free sub domain for each created account (ex : http://yourname.fileave.com). FileAve.com was owned and operated by “Ripside Interactive, Inc.“, located in US, and more precisely by “Smith, Scott“, since September 2008. “Ripside Interactive, Inc.” was also owner of ripway.com, another notorious malware hoster.

FileAve.com is present in Clean MX database since the 2007-11-30, in Malc0de database since the 2010-01-11 and in our database since the 2009-02-16.

With the data’s contained in our Honeynet database, I can provide you the following statistics. FileAve.com and associated subdomains were linked to 94 other malware spreaders, but FileAve.com was the most important malware spreader in this botnet. These 95 malware spreaders were regularly contacted, by 1420 other source IP addresses, but not known for hosting malwares, in order to attempt to infect new potential vulnerable web servers or computers.

The median lifetime of the 95 malware spreaders were 5 days, with 6 of them how have a lifetime above 1 year, and 2 of the 6 with a lifetime above 2 years. On the 1420 other source IP addresses, 754 of them were directly connected to FileAve.com IP address.

43 of the malware spreaders were located in South Korea and 32 others were located in US. 837 distinct source IP addresses have contact the malware spreaders located in US and 309 others have contact malware spreaders located in South Korea.

The malware spreaders hosting country how has taken the longest time to shut down the malware spreaders is France, with only 2 malware spreaders located in this country but with an average lifetime of 184 days. The second country is China with 2 malware spreaders and with an average lifetime of 164 days. The third country is Thailand with 2 malware spreaders and with an average lifetime of 127 days. The fourth country is South Korea with 43 malware spreaders and with an average lifetime of 105 days.

FileAve.com botnet golden age have occur between March 2010 and September 2010, with the most active malware spreaders ratio, with the most source IP addresses and the most generated events.

If you are interested in more statistics about FileAve.com activities, I have written an PDF available here. Also I have create a geographic time map of all activities generated by the FileAve.com botnet.

WordPress TimThumb Botnet Visualization and Status

Security visualization,

In a previous blogpost I have demonstrate that the WordPress TimThumb RFI vulnerability is used as a botnet recruitment vector. Since this blogpost 1 month has occur, and two and half months since our HoneyNet is gathering events about this botnet.

Actually we have see 30 different domains, related to 37 different IP addresses used to infect vulnerable WordPress (see table).

These 30 different domains are for now related to 370 IP addresses how are surely infected WordPress. Here a representation on how is linked to how.

Also you can find by clicking on the following link a geo localization time map of all the related IP addresses.