-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


AusCERT Update AU-2006.0010 - [Win]
'Falling Dollar' trojan email exploiting Internet Explorer createTextRange
vulnerability
30 March 2006

        AusCERT Update Summary
        ----------------------

Product:           Internet Explorer
Operating System:  Windows
Impact:            Execute Arbitrary Code/Commands
                   Denial of Service
Access:            Remote/Unauthenticated
CVE Names:         CVE-2006-1359
Member-only until: Monday, April 03 2006

Ref:               AL-2006.0021
                   AA-2006.0023

OVERVIEW:

        The Internet Explorer vulnerability previously described in AusCERT
        AA-2006.0023[1] is now being actively exploited within a recent spam
        mailout.


IMPACT:

	Following the link included in the spam emails (see DETAILS below)
	leads to a malicious web page that will attempt to exploit the
	createTextRange vulnerability in Internet Explorer. This may lead
	to the download and installation of a credential-stealing trojan.
	Such a trojan may allow an attacker to steal electronic funds from
	infected victims.

        The trojan may also allow other programs (including anything it
        itself downloads) to bypass Windows Firewall, effectively disabling
        it. Windows Firewall will continue to run however, and the user will
        not receive a security warning.

        Once the trojan is fully active, it will attempt to capture 
        identification information from sites with a domain or title that
        includes:

            ANZ Internet Banking - Logon
            ANZ E*Trade
            commbank.com.au
            Westpac online
            ib.national.com.au
            Business Online
            hsbc
            bank
            online

        It may also pop up a window with the text:

            Dear Internet Bank User!

            We recognize the importance of protecting your personal and
            financial information and for security purposes we have entered
            additional checking. The personal information that we obtain about
            you assists us in servicing your account.  Your personal
            information is used primarily as a way of authenticating you as
            the proper owner of your account and as the person who can made
            payments.  We protect your account information. That's why you
            have to enter a unique MEMORABLE INFORMATION.  Please input your
            MEMORABLE INFORMATION.


MITIGATION:

        Using an alternate browser until such time as this vulnerability is
        fixed will effectively block this attack.

        If Internet Explorer is required for functionality purposes, Active
        Scripting should be turned off - these emails use similar exploits to
        the ones described in AusCERT AL-2006.0021[2] and as such require
        Active Scripting to successfully activate.

        System administrators may wish to monitor for connections to the 
        domains listed in the DETAILS section.

	
DETAILS:

        The emails in question have subjects such as:

            Dollar's fall suggests recession
            Dollar's fall! Breaking news!
            Why has the dollar suddenly fallen?

        although this is probably not a definitive list.

        The body mentions fluctuations in the euro, yen and US dollar, and
        contains a link to (link has been sanitised):

            h**p://www businessguide4u net/news-bbc.htm.

        Victims may also see connections being made to:

            h**p://www rati-pro com.

        While AusCERT is endeavouring to have these sites removed they are
        still active at the time of writing.

        The initial downloaded executable identifies in some antivirus
        products as 'Troj/Small' or 'Troj/Dropper'. While these are generic
        trojan identifiers they can still be used as signs of infection.

        The secondary binary (the actual payload of the trojan) identifies
        in some antivirus products as 'Bancos' or 'Banker' or variations
        thereof.


REFERENCES:

        [1] AusCERT AA-2006.0023
            http://www.auscert.org.au/6155

        [2] AusCERT AL-2006.0021
            http://www.auscert.org.au/6156

        [3] Protecting Your Computer from Malicious Code
            http://www.auscert.org.au/3352

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (FreeBSD)
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRCyOcyh9+71yA2DNAQK7sgP/RWYVr3o/MDsfBrwPT04PCc7gnaj9cEe0
gIhwOZq2omVg5ZAmFhNjQevNSP2O21In2Ru9O9u2gzh7ciVVpgU6dlsaKKRrbHH3
RK0JmJDDHekdgECaxVZVQeymNVTvbFqnvPVAuJTzqqX+S70usdz7MbzfNDkdxc+F
bLxFVQGM3WM=
=7jrU
-----END PGP SIGNATURE-----