-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2011.0077
        Fake emails from ATO and ABR linking to malicious websites
                             15 September 2011

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Fake emails linking to malicious websites
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution:           Mitigation
CVE Names:            CVE-2010-0840 CVE-2010-1885 
Member content until: Saturday, October 15 2011
Reference:            ASB-2010.0168
                      ESB-2010.0452
                      ESB-2010.0313.2

Comment: Currently none of the australian-business.com style domains have been
         deregistered, the secondary sites are all still up, and the malware
         has a very low detection rate.

OVERVIEW

        Fake emails pretending to come from either the ATO (Australian
        Taxation Office) or the ABR (Australian Business Register) are being
        widely circulated. These emails are lures to websites containing
        malware. 


IMPACT

        AusCERT has received well over 100 of these fake emails in the last day. 

        The following "From:" addresses have been seen in the spam emails:

           admin@ato.gov.au
           donotreply@ato.gov.au
           info@ato.gov.au
           information@ato.gov.au
           no-reply@ato.gov.au
           rules@ato.gov.au
           subscribe@ato.gov.au
           admin@abr.gov.au
           donotreply@abr.gov.au
           info@abr.gov.au
           information@abr.gov.au
           no-reply@abr.gov.au
           rules@abr.gov.au
           subscribe@abr.gov.au

        The following three email formats have been used:

        -------------------------------------------------
        Subject: Australian Taxation Office   New rules

           Australian Taxation Office informs you about the changes in the rules
           of submitting tax report.
           Please, read about the changes to Click Here.
           Important to know
           We do not offer cashier services for tax payments or refunds.
           For further information on how to pay your taxes, see How to pay.
           (http://www.ato.gov.au/content.asp?doc=/content/33696.htm)
           We are kindly asking you to keep to rules and terms of tax report
           submission to avoid penalty.
           Best regards,
           Andrew Nichols
           Australian Taxation Office
        -------------------------------------------------
        Subject: Attention for the ABN owners

           Australian Taxation Office together with Australian Business Register
           wants to inform you that starting from January, 1 2012 new rules of use
           of ABN number are being introduced.
           The changes will concern:
           - GST credits;
           - Australian domain names registration
           More detailed information about the coming changes in the rules you can
           find HERE.
           Australian Business Register
           www.abr.gov.au
        -------------------------------------------------
        Subject: Attention to all holders of TFN \ Business name

           From November 1, 2011 new rules of submitting tax returns will be
           introduced.
           See the full list of changes with explanations HERE.
           The information requested in these applications is authorised by one or
           more of the following Acts:
           - A New Tax System (Australian Business Number) Act 1999
           - Income Tax Assessment Act 1936
           - A New Tax System (Goods and Services Tax) Act 1999
           - A New Tax System (Wine Equalisation Tax) Act 1999
           - A New Tax System (Luxury Car Tax) Act 1999
           - Fuel Tax Act 2006
           - Fringe Benefits Tax Assessment Act 1986
           - Taxation Administration Act 1953
           - Superannuation Industry (Supervision) Act 1993
           The information will help us to administer those Acts and the taxation
           law.
           Very Important information about your Business Name, go to the
           following link
           Australian Business Register
        -------------------------------------------------

        The emails all contain a link directing users who click on it to one of
        the following domains/web sites which all (currently) point to the same
        IP address of 67.195.140.36:

           australian-businesssite-4u .com
           australianbusinesssite-au .com
           australian-businesssite .com
           australian-businesssite-f .com
           australianbusiness-store .com
           australian-bussines-opps .com
           australianbussiness-today .com
           australianbussinesstuff .com
           day-australianbussiness .com
           getaustralian-bussines .com
           go-australianbussines .com
           great-australianbussines.com
           greataustralian-bussines .com

        All 13 of these domains/web sites contain an iframe pointing to one of
        the following two URL's (both domains are currently pointing to an IP
        address of 88.198.76.173):

           hxxp://jj-unp-lanka .com/main.php?page=3d0ac5a298f528ea
           hxxp://jj-unp-group .com/main.php?page=60b8b4d7f98dc0cf

        These two domains/websites contain or link to various exploits and
        malware. The exploit code on the two sites differs depending on what
        user agent you vitit them with, but seems to exploit CVE-2010-1885.
        Each site contains the following:
           1) /content/worms.jar
           2) /g.php?f=25&e=6
           3) /content/2fdp.php?f=25
           4) a link to hxxp://australianbusinesssite .com/updateTax15sept.pdf.exe

        File number 1 is a Java exploit (CVE-2010-0840) that is currently detected
        by 4 out of the 44 VirusTotal AV products [1].
        
        File number 2 is a Windows executable file detected a Zbot/Zeus by 6 AV
        products on VirusTotal. [2] The numbers used for the "f" and "e"
        variables does not seem to matter.
        
        File number 3 is a PDF file that is detected by 7 AV products on
        VirusTotal. [3] The number used for the "f" variable does not
        seem to matter.
        
        File number 4 above is also Zbot/Zeus malware, but is detected by 18
        AV products on VirusTotal. [4]


MITIGATION

        Possibilities for mitigation include:
        
        Using filtering at mail gateways to block on key phrases or email
        addresses from the details above.
        
        Using web filtering to block domains and IP addresses associated with
        this attack.
        
        Monitor connections to the domains and IP's listed above, as this may
        indicate the presence of infected machines. AusCERT provides a
        blacklist feed of malware sites to members which may help with achieving
        this. [5]
        
        Inform and educate end user on this form of attack.
        
        Ensure anti-virus signatures are being kept up to date. While
        detection rates are currently low, new signatures that detect
        this trojan should be available soon.
        
        Ensure Java and PDF viewer software is kept up-to-date (along with
        web browser and other software as well as the base OS).


REFERENCES

        [1] File name: worms.jar
            http://www.virustotal.com/file-scan/report.html?id=0cc9585aec1e96f9dcc59d3ab56c36c338af2bf307d1421705411faf3823f1ca-1316029503

        [2] File name: 3a9ea770e4aa82f93b51a9b12cb2ecd8
            http://www.virustotal.com/file-scan/report.html?id=e3362ae52b6ae35d6095a8e0ed1d2ca9bc0c7844748d26ccc32f1a20d7abd935-1316045407

        [3] File name: PDF.pdf
            http://www.virustotal.com/file-scan/report.html?id=746fba8910d9b7667b96c986ecc47cf72b0a068e286f445d0797e08c97463995-1316057422

        [4] File name: 1013523
            http://www.virustotal.com/file-scan/report.html?id=44ab9f1380c6728ff78ec1997c5a5df89c0a87b7314b1ee6882e4198be622f72-1316030775

        [5] AusCERT XML Feed
            https://www.auscert.org.au/9123

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTnGFRO4yVqjM2NGpAQK6qg//R5EXUT8yF38I2zQSwOKgWPT+O1AFu8EA
yvgOCJPgbhUI6OhnipDZcmbkaerb910q0do3c4mVvDpAcpHW9H8y/nQDHTsQfLv/
DeuXASKfKr36jGNHt2QNTpuFA+gmiFERNdcFg/VFWOFPdmcIYcXgTiP8iMc8CthD
cZa5q1cFTD6RdeuccrktQUwiSk3FMTYNh/pHCT+pFvlr8usCXNTRF3++L+Dr9vcY
rGfwGqhKLZFGQdN+kecZ5D7dRrVo5vOizo7+JI19bY/h1PJ4NBRLa4j57kpAWlNL
xp5ugulWJns89iza8EI9frhvmpOxBS18mu//5D91jiWTg+nFKGAgclZ2AwwNEyFy
R0VO+LbwSggyiIFKcyJnv65JTRF/CB7fKPxNxpDYZRmnMx2BMvz4FAzJLD9Ny8nl
liMqNMkB+IrNoNgjeTD+tAu0iPPbd4hoAj1zNNf02fwo5YF3h2BoUDS9tRwUqai2
BMT7p5JvFhIvCPbAlo1apkaw9rsSIAlsHzOCY68tzf2ofTy5qEdS/57mTrD0cCki
uhUPMaysKfA9LOrUAtetMGQxE0XKKNgWuFqhGVwlRz0/dLvS7wkKwbNkEQZmHMH9
Cl9HpHumG7LNG5eYG+JKtFOBismx5caP6bahXL9Tx76OOH0FGQI/quRiL96fY39t
PSau5kVsmpE=
=T2km
-----END PGP SIGNATURE-----