-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

AusCERT Update AU-2006.0019 - [Win]
Trojan authors target Australian web forums
16 June 2006        

        AusCERT Update Summary
        ----------------------

Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated

Ref:                  AL-2006.0049

OVERVIEW:

	AusCERT has received information indicating that the 'National Bank 
	bankrupt?!' messages referenced in AL-2006.0049 [1] were also widely
	posted on Australian web forums on June 12 2006.


IMPACT:

	A user visiting the referenced site may be infected with Haxdoor, as
	per [1].


MITIGATION:

	Ensure that all systems have the latest patches for both their 
	operating systems and web browsers.  The links to these malicious 
	sites were contained in web forum postings on legitimate web sites, so
	users may have visited these sites and been subsequently infected in 
	the course of normal web browsing activity.

	Systems administrators are recommended to look through their proxy
	logs for access to:

	cnruggiero.com.au
	totalfontes.net
	powwowtowel.com
	
	as well as the domains from [1]:

	suriko.net
	saltnlight-e.com

	At the time of writing, all malicious sites above have been disabled.

	Otherwise, mitigation as per [1].


DETAILS:

	Approximately fifty Australian web sites received forum postings
	linking to the following web site:

	h**p://www.cnruggiero.com.au/national.php

	which linked to:

	h**p://www,cnruggiero.com.au/cgi-bin/ie0606.cgi

	This URL attempted to exploit both Internet Explorer and Firefox
	web browsers, as per [1].  This also linked to:

	h**p://www,totalfontes,net/demo.php

	which linked through to:

	h**p://www,totalfontes,net/cgi-bin/ie0606.cgi

	All web forum postings were from a user called 'Jason Y Li', and
	contained the following text:

	-----
	Just read: people starting panic withdrawals, some of the accounts 
	were reported closed due to technical reasons, many ATMs are not 
	operating. Does it seem that one of the Australia's greatest goes 
	bankrupt?

	The full story could be found here.

	Well, hope that isn't true... Anyway I'd rather check my balance...
	-----


REFERENCES:

	[1] http://www.auscert.org.au/render.html?it=6398

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRJJYdyh9+71yA2DNAQJ8JQP/Z5Zb8q3yR5wE+vIqRWAn+Wgb0Ot6TAGN
nmRlAaJ2RYBPEZXmw17utRNwh+F8nMcjYTW+wlhctwqrMZ/gXo0uFjXLXtgIuZeD
GGorMUrs+mREMA5AtXqrqWTWNfBrAvfFLpeA4GiKRjyksxanRXIuonL3b143wHxw
ugP6z+v0Lu4=
=Fs9f
-----END PGP SIGNATURE-----