[Dshield] QHOSTS-1 Trojan & MSIE6 Vulnerability

Benjamin M.A. Robson ben at robson.ph
Thu Oct 2 18:13:46 GMT 2003


Since I am on a bit of a role with these postings, here's another one.

(If they are getting to be a bit much to bear let me know and I will shut-up for a while)  ;-P


Purpose:                Security Officer Alert
Subject:                Internet Explorer 6 Vulnerability and Exploit
                                Trojan: Qhosts-1
                                      (possible variant of 'Delude')
Threat Level:		Medium
Date:			3rd October 2003
Systems Affected:    Windows NT, Windows ME, Windows 2000,
                           Windows XP, Windows 9x (TBC),
                           Windows Server 2003 (TBC)


      The Internet community has recently been observing a new attack
against Microsoft Windows systems running Internet Explorer 6 (MSIE6) in
the form of a JavaScript triggered worm.  The current release of
Microsoft Internet Explorer 6 contains an un-patched vulnerability
within its ObjectData handling method(s).

      The currently detected worm carries out a range of actions upon
successfully exploiting a victim, most notable of which is the
alteration of the systems DNS settings. The result is that instead of
attempting DNS resolution via previously configured servers, the victim
host now uses an alternate set of DNS servers.  This allows the attacker
to control where users are browsing by redirecting their web browsing
and other Internet activities to alternate addresses.

      A possible scenario might be that the attacker alters the victim's
DNS settings and the user attempts to browse Amazon.com.  When their
system does a DNS lookup instead of sending the user to the correct page
the alternate DNS server may send the user to a page pretending to be
Amazon.  As a result when the user enters their credit card details to
purchase a book they may in-fact be giving them to the attacker
instead.  (This example is hypothetical in nature and not based on any
observed reality.)

      When the vulnerability within the ObjectData handling method(s) is
exploited by the now active Trojan, MSIE6 executes a contained ActiveX
object within a piece of JavaScript.  MSIE6 is programmed to check
whether this ActiveX code is 'safe' and during this process MSIE6
determines that the ActiveX code is, in fact, simple HTML/Jscript.  As a
result it does not prompt the user to save the data to disk, but instead
remembers it as HyperText Application (HTA) content and invokes the
MSHTA.EXE process to execute the 'simple HTML/Jscript' code.  This code
is x[1].hta which creates and executes AOLFIX.EXE.  AOLFIX.EXE is
downloaded in to the victim systems \temp directory, executed and
deleted.  The final result is the user's system settings being altered
and DNS settings changed.

Who is Affected:

      All users who have Microsoft Internet Explorer version 6 are
likely vulnerable to this attack.  This issue has been proven to work on
Microsoft Window ME, Windows NT, Windows 2000, and Windows XP.  It is
also considered likely to work on Microsoft Windows 9x and Windows
Server 2003.

Symptoms if Exploited or Targeted:

      Users that have been affected by this Trojan will notice a series
of changes to their system, and changes in system behaviour when
attempting to access certain web sites or domain names.  Behavioural
changes will most likely manifest themselves as pages not resolving, or
not appearing correct.

      Directories Created:


      Files Created:

                  -      Deleted immediately upon execution.
                  -      Contains the letter 'A'
                  -      Contains static DNS mappings to many IP
addresses of popular search engines.  See 'Details' section below for
list of addresses mapped.

      Registry Entries:

"r0x"="your s0x"


HKEY LOCAL MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters



      Disabling ActiveX functions withing the MSIE6 browser will not
provide any level of protection against this vulnerability.


      - Disable Active Scripting within the MSIE6 (& Outlook)
application(s).  This will prevent execution of the pages delivering the

      - Ensure firewalls (perimeter defences) are configured to block
unauthorised outbound traffic as well as inbound traffic.  This will
prevent users from using unauthorised DNS servers.  As such victim
systems will reveal themselves very quickly as they fail to look up
Internet domain names.

      - Configure host firewalls (personal firewalls) that can control
application level access to the network (such as ZoneAlarm) to deny
access to the network for MSHTA.EXE.

      - Disable HTA MIME types from within the Windows System Registry. 
To do this remove the entry
This can be restored later, once a patch is available and applied.

      - Configure IDS (intrusion detection systems) to monitor for
suspicious traffic that may alert the administrator to the attack or
victim systems.  A sample rule set for Snort might be:

             var MAL_DNS [,,]

          alert tcp any any <> $MAL_DNS 53 (msg:"Malicious DNS Traffic";
sid:900027; rev:1;)      
          alert udp any any <> $MAL_DNS 53 (msg:"Malicious DNS Traffic";
sid:900027; rev:1;)


      No patch is currently available for this issue.  The patch
MS03-032 does not address this issue.


      List of entries in hosts file;
      ------------------------------ elite www.google.akadns.net www.google.com google.com www.altavista.com altavista.com search.yahoo.com uk.search.yahoo.com ca.search.yahoo.com jp.search.yahoo.com au.search.yahoo.com de.search.yahoo.com search.yahoo.co.jp www.lycos.de www.lycos.ca www.lycos.jp www.lycos.co.jp alltheweb.com web.ask.com ask.com www.ask.com www.teoma.com search.aol.com www.looksmart.com auto.search.msn.com search.msn.com ca.search.msn.com fr.ca.search.msn.com search.fr.msn.be search.fr.msn.ch search.latam.yupimsn.com search.msn.at search.msn.be search.msn.ch search.msn.co.in search.msn.co.jp search.msn.co.kr search.msn.com.br search.msn.com.hk search.msn.com.my search.msn.com.sg search.msn.com.tw search.msn.co.za search.msn.de search.msn.dk search.msn.es search.msn.fi search.msn.fr search.msn.it search.msn.nl search.msn.no search.msn.se search.ninemsn.com.au search.t1msn.com.mx search.xtramsn.co.nz search.yupimsn.com uk.search.msn.com search.lycos.com www.lycos.com www.google.ca google.ca www.google.uk www.google.co.uk www.google.com.au www.google.co.jp www.google.jp www.google.at www.google.be www.google.ch www.google.de www.google.se www.google.dk www.google.fi www.google.fr www.google.com.gr www.google.com.hk www.google.ie www.google.co.il www.google.it www.google.co.kr www.google.com.mx www.google.nl www.google.co.nz www.google.pl www.google.pt www.google.com.ru www.google.com.sg www.google.co.th www.google.com.tr www.google.com.tw go.google.com google.at google.be google.de google.dk google.fi google.fr google.com.hk google.ie google.co.il google.it google.co.kr google.com.mx google.nl google.co.nz google.pl google.com.ru google.com.sg www.hotbot.com hotbot.com 

      Point of entry for exploit:

      The point of exploit for this vulnerability is initiated via a
banner advertisement hosted by FortuneCity.com.  This banner contains
JavaScript code which opens a self closing pop-under banner to a site
hosted by Everyone's Internet (ev1.net).  The ev1.net hosted web site
then delivers the executable code, in turn invoking the HTA ObjectData


      DShield General Discussion List:
         - wbeckham : "[Dshield] QHOSTS-1 DNS/Hosts file issues" :

      Full-Disclosure Mail List:
         - Paul Tinsley : "Re: [Snort-sigs] Re: [Full-Disclosure]
Mystery DNS Changes" : 02-10-03
         - Harris, Michael C. : "RE: [Full-Disclosure] Myster DNS
Changes" : 01-10-03

      Network Associates (www.nai.com) :

More information about the list mailing list