Secure List feed for B2B

Syndicate content
Online headquarters of Kaspersky Lab security experts.
Updated: 13 hours 25 min ago

Spam in June 2014

Mon, 07/21/2014 - 07:00
Spam in the spotlight

In June, high-profile news events such as the FIFA World Cup and the situation in Ukraine were exploited by fraudsters to extract money and financial information from Internet users.

In the run-up to the Muslim holiday of Ramadan and Father's Day, English-language holiday-related spam offered a variety of themed products and services. The leading spam themes in June were adverts for various online dating services as well as offer for fuel cards and jewelry.

The World Cup

In June, football fans around the world finally saw the World Cup get underway. Popular sporting events like the World Cup attract the attention not only of millions of spectators but also spammers and phishers. This year, the first fraudulent mailings exploiting the World Cup theme were first registered back in November, long before it began. In June, the attackers sent out phishing emails in Portuguese offering the chance to win tickets to the opening ceremony and other World Cup matches. To do this, the user was required to click a link (which was of course fraudulent) and enter his registration data and credit card information. The fake link was directly attached to a graphic file that was displayed when the user opened the message. The phishing pages were located on the free .tk domain – the national top-level domain for the Tokelau Islands (New Zealand). To convince the user that the email was legitimate, the spammers used the domains of the Visa payment system and FIFA in the sender address.

Holiday spam

English-language spam in June was dominated by Father's Day, celebrated on the third Sunday of the month. The spammers sent out adverts for e-gadgets, replicas of designer goods and weapons from various ages trying to attract the recipient's attention with discounts, sales and low prices. In order to bypass spam filters, spammers inserted junk text at the end of the message – a quote from a literary work. They also used a popular short link service to mask the real address and redirect users to a spammer site. The name of the holiday was mentioned in the subject and text field of the email.

More secular holidays are exploited in spam than religious ones, but spammers never forget to provide users with appropriate promotional offers. The name of the Muslim holy Ramadan appears in spam traffic every year. This year was no exception: in June, we came across adverts for restaurants that contained references to Ramadan (as well as an invitation to come and watch broadcasts of World Cup matches). We also registered offers of IT services and services for sending out promotional text messages. Ramadan will continue until the end of July, and we expect the spammers will continue spreading messages exploiting this holiday.

Ukrainian 'Nigerian' spam

The political events in Ukraine were again used by "Nigerian" scams for luring money from credulous users. This time, the author of the email presented himself as a personal assistant to a Ukrainian female politician who was among the first victims of the clashes in Kiev. As is usual with these types of letter, the deceased has left her assistant millions of dollars that have to be urgently transferred from Ukraine to the account of a foreign recipient. The assistant is promised a reward and a certain amount of money to cover any fees that may arise when transferring the money.

The same "Nigerian" scam is used from year to year, only the details change. However, we would like to remind you that all "Nigerian" offers to make you rich quick are ​​merely scams to lure money from users.

Online dating

A significant part of June's spam was adverts for dating services targeting different social and ethnic groups, including Muslims, Christians as well as elderly and married people.

In June, we registered emails and mass mailings spread on behalf of people who wanted to get acquainted, via the Internet, "for serious relationships or marriage". The offers involved not only traditional but also same-sex relations. Some "senders" had attached their photo and provided their email address or a link to their page on a dating service site (which was often a veiled advertisement of such services and the emails were most probably sent on behalf of non-existent members as bait). The senders described their appearance and interests and said they wanted to start correspondence. It was often stated that the recipient's address had been provided by a mutual friend or found on a social networking site or on another dating site, which was not necessarily true.

Spammers also sent out emails promising a partner that met absolutely any criteria (age, skin color, interests and so on) within three minutes of using their "Soulmate database". To use the service, the recipient had to send a text message to a short number. In addition to the money taken from the user's mobile account the spammers got access to his contact information, in particular to his phone number.

For those more interested in meeting people in person the spammers offered lessons in seducing women ("24 laws of attracting women"), and other tips for successful relationships.

One of the mailings contained an advert for a dating spam service. The spammers offered their assistance in creating and promoting (of course, with the help of mass mailings) a new dating site which would include users from many countries. The message included an email address and an ICQ number for communication.

Jewelry

There were a lot of jewelry-themed offers in June. Most of them were promotional and bonus offers from small jewelry stores, jewelry manufacturers and firms engaged in the production and cutting of diamonds. They offered the spam recipients the chance to participate in their business and provided the price list for their products.

Fuel cards

Yet another popular theme in English-language spam was fuel cards for automatic payments at gas stations. This payment method is quite convenient for transportation companies with lots of vehicles routes that find it difficult to control the fueling process. Spam "middlemen" offer the recipients the chance to compare prices, choose the most favorable fueling company and sign a contract for a special fuel card. A specific feature of this sort of spam mass mailing was the fact that the links in the emails led to sites registered on recently created domains. And the sites are intended for calculating quotes only.

Statistics The percentage of spam in email traffic


Percentage of spam in email traffic

The percentage of spam in email traffic averaged 64.8%, which is 5 percentage points less than in May. The highest spam levels were seen during the second week of the month (65.8%), and the lowest levels were seen in the third week (63.5%).

The geographical distribution of spam sources

Previously our statistical data on the sources of spam by country was based on the information received from spam traps in different countries. However, the spam from the traps differs from the spam received by common users. For example, spam targeting specialized companies does not reach the traps. That is why we have changed the data source and now with KSN (Kaspersky Security Network) we draw statistical reports on spam based on the messages that the users of our products receive worldwide. Since the information for the statistical report in June was received from a different source, comparing the results with the statistics for the previous month would be incorrect.


Distribution of spam sources by country

At the end of June 2014, the top three sources of spam around the world included the US (13.2%), Russia (7%) and China (5.6%).

Vietnam was in fourth place (5.3%) followed by Argentina (4.1%), Germany (3.7%), Spain (3.6%), Ukraine (3.2%) and Italy (2.9%).

The Top 10 was rounded off by India, which accounted for 2.8% of the world spam.

Malicious attachments in email

The graph below shows the Top 10 malicious programs spread by email in June.


Top 10 malicious programs spread by email

As is now traditional, the list of malware spread by email is topped by Trojan-Spy.HTML.Fraud.gen. This threat appears as an HTML phishing website and sends email disguised as an important notification from banks, online stores, and other services.

Second in June was Trojan-Downloader.MSWord.Agent.z. This malicious program appears in the form of the *.doc file with the embedded macros written in Visual Basic for Applications (VBA) which is executed on opening the document. The macro itself downloads and runs the malicious program.

In June, representatives of the Bublik family occupied third, fourth, fifth and seventh places. Their main functionality is the unauthorized download and installation of new versions of malware onto victim computers.

Backdoor.Win32.Androm.elwa took sixth place. This malicious program is the modification of Andromeda – Gamarue, a universal modular bot which is a basis for building a botnet with a variety of features. The functionality of the bot is expanded using a system of plugins that are loaded by the criminals in the necessary amount at any time.

The Email-Worm.Win32.Bagle.gt worm, which ranked eighth in June, sends itself to all of the email addresses it can find on the computer. Its main objective is to download and launch files from the Internet without the victims noticing. To spread infected messages, Worm.Win32.Bagle.gt uses its own SMTP library.

Trojan-Banker.Win32.ChePro.ilc. ended the month in ninth position. This downloader appears in the form of a CPL applet (a component of the control panel) and, as is typical for this type of malware, it downloads Trojans developed to steal bank information and passwords. These banking Trojans mainly target online customers of Brazilian and Portuguese banks.

Rounding off the Top 10 was Email-Worm.Win32.Mydoom.l, a network worm with backdoor functionality that is spread as an email attachment via file sharing services and writable network resources. It harvests email addresses from infected computers so they can be used for further mass mailings. The worm also connects directly to the recipient's SMTP server.


Distribution of email antivirus detections by country

In June, Germany saw a big surge in the number of antivirus detections and topped the rating (+8.17 percentage points) having pushed the UK off top spot.

Russian reentered the Top 20 at 13th place with 2.03% of all antivirus detections.

The UAE (+0.96 percentage points) bypassed Australia, Hong Kong and Vietnam in terms of antivirus detections, while Switzerland dropped out of the Top 20.

The percentage of email antivirus detections in other countries did not change much in June.

Special features of malicious spam

The vacation season is gaining momentum: many people are still thinking over their holiday plans while those who have already decided where to go often self-book flight tickets and hotel accommodation. Besides the traditional seasonal increase of holiday spam, we have seen a growth in the number of fraudulent messages sent on behalf of various booking services, including international ones. These fake notifications appear in the form of a booking confirmation and usually contain malicious attachments imitating bills for a hotel reservation. Generally, the email includes the order number, the date of arrival/departure and the cost of the order. One of the most popular malicious programs used in the holiday spam in June was Trojan-Spy.Win32.Ursnif. This Trojan steals confidential data and sends it to a remote server. It can listen for network traffic, download and run other malicious programs, as well as disable some system applications such as the firewall.

In order to send malicious attachments, the fraudsters use not only fake notifications from major booking services, banks or online hypermarkets but also shops with more narrow specialization. For example, last month we came across a malicious mailing spread on behalf of an online pet store. The recipient was asked to download and print out the invoice for purchased goods. Should he have any questions, the email read, he could contact the support service of the pet store by clicking the link on its official website. Instead of the promised PDF file with the information about the purchase, the archive contained Trojan-Banker.Win32.Shiotob.c. This malware steals system information, user names and passwords from FTP and various sites when the user logins on to them.

Phishing

Email search sites (32.1%) again topped the rating of organizations most frequently targeted by phishers in June, with a slight drop of 0.2 percentage points from the previous month. Second came Social networks (27.7%), having increased their contribution by 3.7 percentage points from May. Financial and payment organizations (11.6%) and Online stores (10.6%) declined by 1.2 and 1.5 percentage points respectively. The percentage of attacks targeting Telephone and Internet service providers fell by 0.1 percentage points leaving this category in fifth place in the rating.


Distribution of the Top 100 organizations targeted by phishers, by category

The ranking is based on Kaspersky Lab's anti-phishing component detections that are triggered every time a user attempts to click on a phishing link, regardless of whether the link is in a spam email or on a web page.

In June, the scammers sent out fake notices on behalf of the US corporation Electronic Arts that produces and sells video games. The phishers tried to access users' personal accounts in the online store Origin owned by the company. To deceive their victims, the attackers used an old trick of sending out an email saying the online store was going to enhance protection for their customer accounts and asked the recipients to confirm they were the owner of the account. In order to make the email look legitimate the fraudsters used the Origin logo, links to the official website of the company and the usual warning not to give the password from a personal account to anybody.

Conclusion

The proportion of spam in global email traffic in June dropped 5 percentage points and averaged 64.8%. This may be a seasonal decline as summer business activity decreases and many spam bots are disabled for the vacation season.

In June, high-profile political and sporting events were used by scammers to trick users. In the run-up to the FIFA World Cup, a huge event for football fans, phishers were trying to obtain banking information from users by asking them to participate in the competition to win tickets. "Nigerian" scammers again exploited the situation in Ukraine and asked for help to transfer non-existent millions.

In June, Email search sites (32.1%) again topped the rating of organizations most frequently targeted by phishers. Second came Social networks (27.7%), having increased their contribution by 3.7 percentage points from May. This can be explained by the traditional growth in the activity of schoolchildren and students during the holidays, which is of course used by the fraudsters. Financial and payment organizations (11.6%) rounded off the Top 3 organizations most frequently targeted by phishers.

As is now traditional, the list of malware spread by email is topped by Trojan-Spy.HTML.Fraud.gen imitating notifications from banks and online stores. The holiday season has brought an increase in the number of fake notifications from various booking services containing malicious attachments. Germany (16.4%) was the country with the highest proportion of email antivirus detections.

Shylock/Caphaw malware Trojan: the overview

Mon, 07/14/2014 - 06:00

Recently Kaspersky Lab has contributed to an alliance of law enforcement and industry organizations, to undertake measures against the internet domains and servers that form the core of an advanced cybercriminal infrastructure that uses the Shylock Trojan to attack online banking systems around the globe.

Shylock is a banking Trojan that was first discovered in 2011. It utilizes man-in-the-browser attacks designed to pilfer banking login credentials from the PCs of clients of a predetermined list of target organizations. Most of these organizations are banks, located in different countries.

Kaspersky Lab products detect the Shylock malware as Backdoor.Win32.Caphaw and Trojan-Spy.Win32.Shylock.

We detected this malware generically from the end of August 2011, as Backdoor.Win32.Bifrose.fly. Specific detection of this separate family was added in February 2012. Since then we have observed a very few detections – approximately 24,000 attempts to infect PCs protected by Kaspersky Lab products worldwide.

These are very modest numbers, especially in comparison with other infamous banking malware such as ZeuS, SpyEye, Carberp which have generated (and, in the case of some of them, such as ZeuS , still generate) tens or hundreds of thousands of detections. Of course, these numbers don't tell us everything about how widespread or effective Shylock is, because Kaspersky Lab "sees" only a part of the total number of PC users - only those who use our products.

Low popularity doesn't make Shylock less dangerous though. The set of malicious techniques it utilizes is no less dangerous than that used by other similar malware. It is able to inject its body in multiple running processes, has tools to avoid detection by anti-malware software, uses several plugins which add additional malicious functions aimed at bypassing anti-malware software, collects passwords for ftp-servers, spreads itself via messengers and servers, provides remote access to the infected machine, video grabbing and of course web injection.

This last function is used to steal online banking credentials by injecting fake data entry fields into the web page loaded in the victim's browser.

During the entire period we've seen two relatively big peaks in detection rate for this malware.

The first one was in November 2012 and the second one was in December 2013.

The geography of the November 2012 peak was as follows:

United Kingdom Italy Poland Russian Federation Mexico Thailand Iran Turkey India Spain

The table above shows the top 10 countries wheremost attacks using the Shylock malware were registered. A little more than a year later, in December 2013, the picture had changed dramatically.

Brazil Russian federation Vietnam Italy Ukraine India United Kingdom Belarus Turkey Taiwan

As these tables show, the criminals behind this malware definitely stopped paying so much attention to the developed e-money markets of the UK, Italy and Poland in favor of the actively developing markets of Brazil, Russia and Vietnam. It's slso interesting that both peaks happened in the late autumn to early winter period, a traditional high retail season in many countries around the world.

According to Europol data, this malware has infected more than 30,000  PCs worldwide. This is a big enough scale to cause huge financial damage, so the disruption of the Shylock backbone infrastructure is very good news.

And even better news is that the recent operation, coordinated by the UK's National Crime Agency (NCA), brought together partners from the law enforcement and the private sector, including – besides Kaspersky Lab – Europol, the FBI, BAE Systems Applied Intelligence, Dell SecureWorks and the UK's GCHQ (Government Communications Headquarters), to jointly combat the threat. We at Kaspersky Lab were glad to add our modest contribution to this operation. Global action brings positive results – an example being the operation targeting the Shylock malware.

Microsoft Updates July 2014, etc

Thu, 07/10/2014 - 14:21

Looking past the 23 Critical Internet Explorer remote code execution vulnerabilities being patched this month by MS14-037 that require immediate attention, most interesting is CVE-2014-2783, the Internet Explorer "Extended Validation (EV) Certificate Security Feature Bypass Vulnerability". The vulnerability itself, reported by Eric Lawrence of "Fiddler" fame, is applicable in a "corner case" situation and can lead to man-in-the-middle (MiTM) attacks.

Let's narrow down the complexity of the issue for everyone's sake. What is an "EV" certificate? Well, it's a special certificate that an organization or individual would pay extra money to a certificate authority like Verisign to create and then use to "secure" their communications. Sites using them are usually handled in a special manner by the major web browsers. The address bar turns green, a special rectangle is set around the address, or some other visual image assures the user that the connection is with the right web site and encrypted. Here is an example of a web browser presenting the green bar EV visualization, please click on the image for a closeup:

The related flaw being patched this month is a tricky one. Internet Explorer versions 7 through 11 all allow for wildcard subdomains with EV Certificates, which should never be allowed. Neither Certificate Authorities nor web browsers should allow for such a flaw, but their compliance is questionable. In the past, CAs like Diginotar, Comodo, TrustwaveTurkTrust, and currently the National Informatics Centre in India, all maintained incidents of major improprieties at the CA level.

So, coupled with this flaw in IE 7,8,9,10 and 11, attackers (whether or not they are state sponsored or more traditional cybercrime organizations) could set up sites with wildcard EV certs to spoof major web properties like at google, twitter, facebook and elsewhere, and steal data from sensitive communications there. The Certificate Authority infrastructure trust model continues to show major cracks as a flawed trust model, and this "corner case" simply enables more situations like it. Potential solutions like Convergence have not been seriously pushed. At the same time, cheers to Microsoft for patching and reporting on the two current issues.

Unfortunately, these sorts of issues find their way into software products all the time. Partly, they are very tricky to understand by QA teams and developers certainly need to narrow the scope of their projects. You can't automate this sort of test, and even if it is found, it is not assigned a severity of 5 or "showstopper" because it doesn't immediately disrupt operation of the product. So they can sit unaddressed in a product for four or five versions or more even if privately known. Only an exposure because of a security researcher's work or a major public incident might push it to the front of the priority list.

All of this discussion of corner cases lays down groundwork for further discussion of the "Internet of Things". Whenever there are cross-disciplinary approaches (like heavy mathematics and communications, or internal network computing and automobiles) to solutions, there is an elevated risk of incident because of practical and theoretical issues. As the industry progresses, and as the startups generating IoT solution code are dealing with their own corner case issues, and as adoption and acquisitions move forward, IoT technologies will demonstrate on a larger scale that we are not learning from past mistakes.

New gTLDs, same attacks

Thu, 07/10/2014 - 07:11

Cybercriminals around the world have already started to point their guns and attacks at the new gTLDs, the 'generic Top Level Domains' approved by ICANN and offered by registrars to people interested in buying a new domain name. Recently we found malicious activities including malware and phishing pages registered in the top level domains .club, .berlin, .blue, .computer, .camera, .futbol, .link, .pink, .report, .travel, .vacations and .xyz.

The new gTDLS were recently approved by ICANN and registrars are already offering them as a solution to those bored with the traditional .com or .org and who want more possibilities when registering internet domains. You should be prepared to see websites like"funny.dance"or "joe.dentist"or even "my.creditcard".

According nTLDStats.com, more than 1.4 million domains have already been registered using these new gTLDs:

There are now more than 322 new top level domains granted by ICANN, among these the most popular are .xyz (designated at Feb. 2014), .berlin and .club (both designated in January 2014):

Brazilian phishers and domains squatters are particularly interested in these new gTLDs, already having registered several new domains using names of local brands such as banks, online stores, and credit card companies. For example:

  • cielo-seucartaobateumbolao.xyz
  • megasaldao-americanas.xyz
  • lojadoricardoeletro.xyz
  • hsbc.club
  • santander.club
  • bradesco.club
  • ricardoeletro.club
  • ricardoeletro.computer
  • ricardoeletro.camera

These domains were registered with the intention of being used for phishing campaigns, so it comes as no surprise that the data registered in the respective "whois" databases is completely fake:

Malware is also involved. We're aware of bad guys hosting their exploit kits in such domains – the Nuclear Exploit Pack is currently using the .blue, .pink, .futbol, and .report gTLDs, as pointed out by security researcher Frank Denis.

But Brazilian bad guys aren't the only ones interested in the new gTLDs as English-speakers have showcased similar interests by already starting a fraudulent domain that sells coins for online games such as Fifa '14 and others.

Other phishers already started their phishing campaigns, even using older TLDs such as .travel (started in 2005). As you can see in the following abused domain that hosts a phishing page aimed at a Brazilian bank:

If you're a regular user, be aware of such links appearing in email messages or in social networks – they can be just as dangerous as others links. If you're a company, it's a great idea to start a brand monitoring process to insure that your company name or brand aren't being used in campaigns involving these new TLDs.

Kaspersky users are protected against all of these attacks.

Versatile DDoS Trojan for Linux

Thu, 07/10/2014 - 04:40

In February 2014, an article was published on a popular Russian IT website under a curious title - Studying the BillGates Linux Botnet. It described a Trojan with sufficiently versatile DDoS functionality. The capability that we found the most interesting was the Trojan's ability to conduct DNS Amplification-type attacks. In addition, it followed from the article that the Trojan had a sophisticated modular structure, something we had not seen in the world of Linux malware before.

The article also provided a link for downloading all of the Trojan's files (taken directly from an infected machine) - which is what we did.

The archive that we downloaded contained the following files, which, according to the author of the article, were all modules of the same Trojan:

  • atddd;
  • cupsdd;
  • cupsddh;
  • ksapdd;
  • kysapdd;
  • skysapdd;
  • xfsdxd.

The files cupsdd and cupsddh are detected by Kaspersky Lab products as Backdoor.Linux.Ganiw.a; atddd and the remaining files are detected as Backdoor.Linux.Mayday.f.

The archive with the files also contained a configuration file for cron - the Linux task scheduler. In this case, the utility is used by the Trojan as a means of getting a foothold in the system. The Trojan uses cron to perform the following tasks:

  1. Once a minute - terminate the processes of all applications that can interfere with its operation: .IptabLes, nfsd4, profild.key, nfsd, DDosl, lengchao32, b26, codelove, node24
  2. Approximately once in ninety minutes - terminate all of its processes: kysapd, atdd, skysapd, xfsdx, ksapd
  3. Approximately once in two hours - download all of its components to the /etc folder from http://www.dgnfd564sdf.com:8080/[module_name] (module_name = name of the Trojan's module, e.g., cupsdd), after deleting these files from the /etc folder
  4. Once in ninety minutes - relaunch all of its modules
  5. Every minute - purge system logs and bash command history and execute chmod 7777 [module_name]

During subsequent analysis of the files, we did not find any code responsible for saving the config file for cron. Most likely, the file was manually downloaded to the victim machine by a cybercriminal after gaining remote access to the system.

Backdoor.Linux.Mayday.f (atddd)

The file atddd is a backdoor designed to conduct various types of DDoS attacks against the servers specified. As mentioned above, Kaspersky Lab products detect it as Backdoor.Linux.Mayday.f. The files kysapdd, skysapdd, xfsdxd, ksapdd are almost exact copies of atddd - with one exception, which is discussed later in the text.

The backdoor starts its operation by calling the function daemon(1, 0), continuing to run in the background and redirecting standard input, output and errors to /dev/null

Next, atddd collects relevant information about the system, including:

  1. system version (by calling uname())
  2. number of CPU cores and their clock rates (taken from /proc/cpuinfo)
  3. CPU load (taken from /proc/stat)
  4. network load (data for interfaces with the "eth" prefix taken from /proc/net/dev)

The information listed above is stored in the g_statBase structure.

After this, the backdoor decrypts strings defining the C&C server's IP address and port number. The encryption algorithm used is very simple: an encrypted string is taken character-by-character, with 1 added to the ASCII code of a character if its number is odd and subtracted from it if the character's number is even. As a result, the string "3/3-2/4-269-85" yields the IP-адрес "202.103.178.76", while "2/:82" stands for port number "10991".

After this, atddd reads configuration file fwke.cfg, which is located in the same folder with the malicious program. Information from the config file is saved in the g_fakeCfg structure. If the file does not exist, the backdoor attempts to create it and store the following information in it:

1st line: 0        //flag, if 1 then begin attack, if 0 then terminate attack

2nd line: 127.0.0.1:127.0.0.1        //range of outgoing IP addresses

3rd line: 10000:60000        //outgoing port range for an attack

4th line: an empty line        //domain name in the case of DNS flood (see below)

This information is subsequently sent to the C&C server and can be updated with a command from the C&C.

Next, the backdoor creates a new thread, CThreadTaskManager::ProcessMain(), in which commands to begin an attack and terminate an attack are put into the execution queue. After this, a new thread is created - CThreadHostStatus::ProcessMain(). In this thread, data on CPU and network load is updated every second and can subsequently be sent to the C&C server if requested.

After this, 20 threads are created, which read information from the task queue and, depending on the information read, launch an attack or terminate it. However, some of the threads may not be used in an attack if the relevant C&C command has a parameter (the number of threads to be used).



Then the malware enters an endless loop of processing messages from the C&C. After a connection with the C&C is established, information about system version and CPU clock rate, as well as data from the g_fakeCfg structure, is sent to the C&C every 30 seconds.

In response, the server should send 4 bytes, the first of which is the serial number of a command - from 1 to 4.



Next, if the command has parameters, the C&C sends another 4 bytes defining the amount of data that will be sent (i.e., the parameters). Then the parameters themselves are sent; their size should match the number from the previous C&C response.

About each command in greater detail:

  • 0x01. Command to launch an attack. Parameters define the attack's type and the number of threads to be used. The attack type is defined by a byte which can take values from 0x80 to 0x84. This means that 5 attack types are possible:
    • 0x80 - TCP flood. The destination port number is sent by the C&C in its response as a parameter. The source port range is defined in fwke.cfg. Each new request is sent from a new port within the range defined, in the ascending order of port numbers. The destination IP address is also defined in parameters.
    • 0x81 - UDP flood. The same as 0x80, but UDP is used as the transport layer protocol.
    • 0x82 - ICMP flood. Same as above, but via ICMP.
    • 0x83, 0x84 - two DNS flood attacks. The only difference is the domain name sent in the DNS request. In the former case, the name is generated randomly, in the second, it is defined in a parameter (the fourth line in fwke.cfg). Essentially, both attacks are similar to 0x81, except that port 53 (the default port for the DNS service) is used as destination port.
  • 0x02. Command to terminate an attack. The value in the first line of fwke.cfg is changed to 0 and the attack is terminated.
  • 0x03. Command to update the file fwke.cfg. The response also includes a structure similar to g_fakeCfg, data from which is used to create the new fwke.cfg file.
  • 0x04. Command to send the current command's execution status to the C&C server.

In addition to the above, the backdoor includes several empty methods (without any code), which have curious names: CThreadAttack::EmptyConnectionAtk, CThreadAttack::FakeUserAtk, CThreadAttack::HttpAtk. Apparently, the malware writer had plans to extend the malicious program's functionality, and this is a test version rather than a final version. The file cupsdd, which is discussed below, provides a confirmation of this.

The files kysapdd, skysapdd, xfsdxd, ksapdd are almost identical copies of atddd, with the exception that they contain different C&C server addresses: 112.90.252.76:10991, 112.90.22.197:10991, 116.10.189.246:10991 and 121.12.110.96:10991, respectively. The names of their configuration files are also different: fsfe.cfg, btgw.cfg, fake.cfg, xcke.cfg, respectively.

This means that, contrary to our expectations, the files atddd, kysapdd, skysapdd, xfsdxd, ksapdd are not modules of a single piece of malware but rather different copies of the same Trojan, each connecting to its own C&C server. However, this is not the most curious part of it by far.

Backdoor.Linux.Ganiw.a (cupsdd)

Like the files described above, this file is a backdoor designed to carry out various types of DDoS attacks. However, cupsdd is significantly more feature-rich and sophisticated than its 'colleagues', although in places its code is very similar to that found in atddd.

The backdoor starts its operation by initializing the variables it needs from the string "116.10.189.246:30000:1:1:h:578856:579372:579888" (separator - ":"), which it first decrypts using the RSA algorithm. The string contains the following variables:

g_strConnTgt=116.10.189.246 - C&C server's IP address

g_iGatsPort=30000 - C&C server's port

g_iGatsIsFx=1 and g_iIsService=1 - flags used later

g_strBillTail=h - postfix for the name of the file that will be dropped (see below)

g_strCryptStart=578856, g_strDStart=579372, g_strNStart=579888 - pointers to RSA data (encrypted string and key)

Next, the malware drops and executes a file, which is located at offset 0xb1728 from the beginning of the original file and is 335872 bytes in size, provided that the file is not already running. The malware checks whether the file is running by trying to bind a socket to 127.0.0.1:10808. If the attempt is successful, it means that the file is not running, and it needs to be dropped and executed.

If the file is already running, its process, whose PID can be found in the file /tmp/bill.lock, is terminated (kill(pid, 9)). Then the file is dropped anyway, replacing the existing copy.

The name of the file that is dropped is generated from the name of the current file that is running + postfix from the variable g_strBillTail. In our case, the file was named cupsddh and was located in the same folder with the dropper.

After this, the current process forks and the child process calls the function system("/path/to/cupsddh"), which executes the file dropped.

Next, the function daemon(1, 0) is called, for the same purpose as in the case of the sample described above (atddd).

After this, the malware handles the situation if cupsdd was executed earlier and is currently active. For this purpose, it checks whether the file /tmp/gates.lock exists. If it does exist, the current process is terminated (exit(0)). If not, the file (/tmp/gates.lock) is created and the PID of the current process is written to it.

Then, if flag g_iIsService == 1, the backdoor sets itself to run at system startup by creating the following script named DbSecuritySpt in /etc/init.d/:

#!/bin/bash
/path/to/cupsdd

The malware also creates symbolic links to the script in /etc/rc[1-5].1/S97DbSecuritySpt



Next, the malware reads the configuration file conf.n (if it exists) from the same folder as the one in which cupsdd is located. The first 4 bytes of the file define the size of the data which follows. All the data is stored in the structure g_cnfgDoing.

Then the malware reads the file containing commands - cmd.n. The format is the same as in conf.n. The data is stored in the structure g_cmdDoing.

After this, the malware obtains all the necessary information about the system, including:

  • The operating system's name and kernel version (e.g., Linux 3.11.0-15-generic), by calling uname()
  • CPU clock rate, taken from /proc/cpuinfo
  • Number of CPU cores, taken from /proc/cpuinfo, and CPU load, taken from /proc/stat
  • Network load, taken from /proc/net/dev
  • Hard drive size in megabytes, taken from /proc/meminfo
  • Information about network interfaces, taken from /proc/net/dev

All the data is stored in the structure g_statBase.

Next, a new stream, CThreadTaskGates::ProcessMain, is created, in which the following commands are processed:

  • 0x03. DoConfigCommand(). Update the configuration file conf.n.
  • 0x05. DoUpdateCommand(). Start a new thread, CThreadUpdate::ProcessMain, in which update one of its components. The command accepts a number from 1 to 3 as a parameter. Each of the numbers is associated with one of the following strings:

    1 - "Alib" - the file /usr/lib/libamplify.so
    2 - "Bill" - the dropped module (cupsddh)
    3 - "Gates" - the dropper (cupsdd)



Depending on the parameter, one of the malicious program's components is updated. An update is launched by sending 6 bytes containing the string "EF76#^" to the C&C server, followed by one of the strings described above (depending on the parameter).

The C&C responds by sending 4 bytes containing the length (in bytes) of the file that will be transferred next. Then the C&C transfers the file itself in 1024-byte packets.

First, the file is saved in the /tmp folder under a random name consisting of digits. Then, depending on the file that was received, the existing file cupsdd (or cupsddh) is replaced or the file is copied to /usr/lib/libamplify.so

Next, the temporary file is deleted from /tmp, and the chmod command is used to set 755 permissions for the resulting file. After this, in the case of updating cupsddh, the active process is terminated and the new file is launched. In the case of updating cupsdd, the final stage (starting from copying a file from /tmp) is carried out by cupsddh, to which the relevant command is sent.

  • 0x07. DoCommandCommand(). Write a new command to cmd.n.
  • 0x02. StopUpdate(). Close the current connection, which was established in order to update modules.

Next, the backdoor starts several threads, in which it simultaneously performs several additional operations:

  • CThreadClientStatus updates the data on CPU and network load in the g_statBase structure every second.
  • CThreadRecycle removes completed tasks from the queue.
  • CThreadConnSender reads commands from the queue and passes them to the cupsddh module via a TCP connection with 127.0.0.1 on port 10808. In response it receives the status of their execution.
  • CThreadMonBill checks whether the module cupsddh is running once every minute. If not, it drops and executes it again.
  • CThreadLoopCmd reads commands from g_cmdDoing (the file cmd.n) and executes them using the call system(cmd).

Next, the main thread enters the loop of receiving and processing commands from the C&C server. There are two possibilities in this case, depending on the g_iGatsIsFx flag:

  1. If the flag is set (==1), the malware simply uses the new thread to send information about the system and the current configuration from g_cnfgDoing to the C&C and waits to receive commands in response, like the sample (atddd) described above;
  2. If the flag is not set, then the communication session is initiated by the C&C. In other words, the malware waits for the C&C to connect and begins to transfer the data mentioned above only when a connection has been established.



Commands received from the C&C are divided into two queues: either for execution in the current module (in the thread CThreadTaskGates described above) or for passing to the cupsddh module (thread CThreadConnSender).

Backdoor.Linux.Ganiw.a (cupsddh)

The file is packed with UPX. After being unpacked, it calls daemon(1,0). It creates the file /tmp/bill.lock, in which it stores the PID of the current process. cupsddh stores system data in the structure g_statBase, which is identical to that used by cupsdd.

Next, it populates the structure g_provinceDns with the IP addresses of DNS servers converted to binary data in network byte order using the function inet_addr(), taking data from the string array g_sProvinceDns (offset in unpacked file: 0x8f44с, size 4608 bytes).

cupsddh executes command "insmod /usr/lib/xpacket.ko" in an attempt to load the kernel module into the kernel. However, the file is not present on 'clean' systems, and the malware does not make any attempt to download it or obtain it in any other way.



Next, data from the file /usr/libamplify.so (as it turns out, this is not a library but one more config file) is loaded into the structure g_AmpResource. The file has the following format: 1st dword is the number of dwords that follow. Apparently, it contains the list of IP addresses for DNS servers that are currently relevant, i.e., those suitable for DNS Amplification type DDoS attacks.

After this, the module creates two threads: CThreadTask and CThreadRecycle. The former executes commands from a queue comprising commands which came from the cupsdd module. The latter removes commands that have been executed. Next, the main thread binds a socket to 127.0.0.1:10808 and enters an endless loop, receiving commands from the cupsdd module and putting the commands received into the above queue.

The following commands are possible:

  • 0x01. Start an attack according to the parameters received. See a more detailed description below.
  • 0x02. Terminate the current attack, setting the relevant flag.
  • 0x03. Update the current configuration in the g_cnfgDoing structure, which is used during an attack. Also, update the current local MAC address, as well as the MAC and IP address of the current gateway in the structure g_statBase.
  • 0x05. The final stage of updating the cupsdd module (described above).

Two main attack modes are possible: normal mode and kernel mode.

Kernel mode

This mode uses pktgen, a kernel-level packet generator built into Linux. Its advantage to the attacker is that traffic is generated with the greatest speed possible for the given network interface. In addition, the packets generated in this way cannot be detected using ordinary sniffers, e.g., the standard tcpdump, since packets are generated at kernel level.



The packet generator is controlled using a set of scripts/configs in the /proc/net/pktgen folder, but the module pktgen must first be loaded into the kernel by calling the command "modprobe pktgen". However, I did not find any such calls. Apparently, the call "insmod /usr/lib/xpacket.ko" is used instead, although, as mentioned above, the file is absent from the system by default. As a result, kernel mode is not operational in this version of the malware.

Nevertheless, the malware attempts to write several files to the /proc/net/pktgen folder, namely:

  1. the file /proc/net/pktgen/kpktgend_%d for each CPU core, where %d is the core number, beginning from 0. The file's contents is as follows:

    rem_device_all
    add_device eth%d
    max_before_softirq 10000



  2. the file /proc/net/pktgen/eth%d for each CPU core, where %d is the core number, beginning from 0. The file's contents is as follows:

    count 0
    clone_skb 0
    delay 0
    TXSIZE_RND
    min_pkt_size %d
    max_pkt_size %d
    IPSRC_RND
    src_min %s
    src_max %s
    UDPSRC_RND
    udp_src_min %d
    udp_src_max %d
    dst %s
    udp_dst_min %d
    udp_dst_max %d
    dst_mac %02x:%02x:%02x:%02x:%02x:%02x        //MAC address of the gateway from g_statBase
    is_multi %d
    multi_dst %s        //if there are several addresses to be used in an attack (i.e., if the value in the previous line is not equal to 0), they are set in these lines, the number of which matches the previous parameter
    pkt_type %d
    dns_domain %s
    syn_flag %d
    is_dns_random %d
    dns_type %d
    is_edns %d
    edns_len %d
    is_edns_sec %d

    The values of most pktgen parameters are passed from cupsdd via command parameters.

  3. the file /proc/net/pktgen/pgctrl, which contains the string "start".
Normal attack mode

As in the case of atddd, normal attack mode uses raw sockets.

The following attack types are possible in this mode:

  • CAttackSyn - TCP-SYN flood.
  • CAttackUdp - UDP flood (as in the case of atddd)
  • CAttackDns - DNS flood (as in the case of atddd)
  • CAttackIcmp - ICMP flood (as in the case of atddd)
  • CAttackCc - HTTP flood.
  • CAttackAmp - DNS Amplification.

The last attack type on the list above is different in that packets are sent to vulnerable DNS servers, with the attack target specified as the sender's IP address. As a result, the cybercriminal sends a small packet with a DNS request and the DNS server responds to the attack target with a significantly larger packet. The list of vulnerable DNS servers is stored in the file libamplify.so, which is written to disk following the relevant command from the C&C.

Post Scriptum. BillGates v1.5

This version of the Trojan appeared a little later and is probably currently the latest. Essentially, this is the same cupsdd, only a little 'shaped up'. Overall, there is more logic in the code, plus there are a couple of new functions.

The most significant changes were made to the Gates module, i.e., the file cupsdd. Now it has three operating modes. The choice of mode is based on the folder from which the file is launched. Specifically, if it is launched from /usr/bin/pojie, then monitoring mode is enabled, otherwise the module operates in installation and updating mode, which is later superseded by the mode in which it controls the Bill module.

  1. Installation and updating mode.

    First, the module terminates its process working in monitoring mode, if it exists. Its PID is kept in the file /tmp/moni.lock.
    Next, it reinstalls and re-launches the Bill module.
    Next, if a process working in the 'controlling the Bill module' mode exists, that process is terminated. Its PID is kept in the file /tmp/gates.lock.
    If the flag g_iIsService is set (it is defined in the same way as in the previous version), the module sets itself to run at system startup in the same way as before (in the previous version).
    Next, the module writes its path to the file /tmp/notify.file and then copies itself to the file /usr/bin/pojie. After this, it launches its copy, which is, obviously, set to run in monitoring mode, and then changes its own operating mode to controlling the Bill module.

  2. Monitoring mode.

    Writes the PID of the current process to the file /tmp/moni.lock. Next, it starts two threads - one to monitor the Bill module and the other to monitor the Gates module operating in controlling Bill mode. If one of these processes is currently not running, the relevant file is created and launched again.

  3. Controlling the Bill module mode.

    The actions of the Gates module are exactly the same as they were in the previous version of the Trojan (after installing the Bill module and initializing the relevant variables and structures of the Trojan).

To summarize, in the new version of the Trojan its authors have added a little 'robustness' without making any significant functionality changes.

It is also worth noting that the hard-coded IP address of the C&C server has remained the same (116.10.189.246) in this version, but the port number has changed - it is now 36008 instead of 30000 in the previous version.

Cloud Services: Holes in Corporate Network Security

Wed, 07/09/2014 - 07:00

The most popular uses of cloud services include: storing image scans of passports and other personal documents; synchronization of password, contact list, and email/message databases; creating sites; storing versions of source codes, etc. When cloud-based data storage service Dropbox announced a patched vulnerability in its link generator, it once again sparked online discussions about how important it is to encrypt confidential data before uploading it to an online storage, even a private one. Well, File encryption (FLE) does indeed protect confidential information stored in the cloud, even if there are vulnerabilities in controlling access to user documents with certain cloud storage services.

It's tempting to think that you can secure yourself against all possible risks by encrypting your data before you upload it to a cloud storage service, or by foregoing cloud services altogether. But is that really true? As it turns out, no, it isn't.

The Internet is full of recommendations on how to "effectively use cloud-based storage services" including advice on how to remotely control a PC, monitor your computer while you are away, manage your torrent downloads, and many other things. In other words, users create all types of loopholes all by themselves. These loopholes can then be easily exploited by a Trojan, a worm, not to mention a cybercriminal, especially in targeted attacks.

So we asked ourselves: how likely is it that a corporate network can be infected via a cloud service?

At the Black Hat 2013 conference, Jacob Williams, Chief Scientist at CSRgroup Computer Security Consultants, gave a presentation on using Dropbox to penetrate a corporate network. While conducting a trial penetration test (pen test), Jacob used the Dropbox thin client installed on a laptop located outside of a corporate network to spread malware to devices within that network.

Jacob first used phishing to infect an employee's computer, then embedded malicious scripts into documents stored in the laptop's cloud-hosted folder. Dropbox automatically updated (synchronized) the infected documents on all the devices attached to the user's account. Dropbox is not unique in this respect: all applications providing access to popular cloud file services have an automatic synchronization feature, including Onedrive (aka Skydrive), Google Disk, Yandex Disk, etc.

When the user opened the infected document on a workstation located within the corporate network, the malicious scripts embedded in the document installed the backdoor DropSmack on that workstation - it was specifically crafted by Jacob for this pen test. As its name suggests, DropSmack's main feature is that it uses the Dropbox cloud file storage service as a channel to manage the backdoor and leak corporate documents through the corporate firewall.




Flow chart of Jacob Williams's experiment

In the pen test, Jacob used a stunningly simple method to penetrate the corporate network - it is an obvious loophole!

We also decided to check if cybercriminals are using Dropbox, OneDrive, Yandex Disk or Google Disk to spread malware for real. We collected information from KSN about instances of malware detected in cloud-based folders belonging to Kaspersky Lab product users, and found out infections like these were detected for very few users: in May this year, only 8,700 people encountered an infection in their cloud-based folder. Among Kaspersky Lab's home product users, such instances account for only 0.42% of all malware detection cases, and 0.24% for corporate product users.

We should point out one important detail: if a piece of malware is uploaded from one device, all clients connected to the infected account will download it to their devices, and they will do so via HTTPS. Even if a security solution detects the malware in the synchronization folder and deletes it, the cloud client will keep downloading it from the cloud in an endless loop.

According to the data we collected, some 30% of malware detected in cloud folders on home computers had penetrated to these computers via synchronization mechanisms. For corporate users this number reaches 50%. Thus, the infection mechanism demonstrated by Jacob Williams in his demonstration malware, does cause infections in real life. Fortunately, we have not (yet) detected targeted attacks launched using cloud-based data storage services.

If we look into the malware we detected in the cloud folders on users' computers, files for Win32, MSIL, VBS, PHP, JS, Excel, Word and Java dominate. It should be noted that there is a small difference between corporate and home users: for corporate users, infected MS Office files occur more often, while home users also face unique threats on their lists in the form of malicious Android applications.

TOP 10 verdicts:

 

Consumer Corporate 1 Email-Worm.Win32.Runouce.b Email-Worm.Win32.Brontok.dam.a 2 Email-Worm.Win32.Brontok.q Virus.Win32.Sality.gen 3 not-a-virus:AdWare.Win32.RivalGame.kr Virus.Win32.Tenga.a 4 Virus.Win32.Nimnul.a Trojan-Dropper.VBS.Agent.bp 5 Trojan-Clicker.HTML.IFrame.aga Trojan.Win32.Agent.ada 6 Exploit.Win32.CVE-2010-2568.gen Trojan.Win32.MicroFake.ba 7 Virus.Win32.Sality.gen Exploit.Win32.CVE-2010-2568.gen 8 Worm.Win32.AutoRun.dtbv Worm.Win32.AutoRun.dtbv 9 Trojan-Dropper.VBS.Agent.bp Trojan.Win32.Qhost.afes 10 Trojan.Win32.Genome.vqzz Virus.Win32.Nimnul.a

More often than not, virus writers use cloud storage as a place to host their malware rather than a platform to spread them. During the research, we did not encounter a single worm or backdoor (except DropSmack) specifically targeting cloud-based file storages. Naturally, these services try to counter malware which takes up storage room in the cloud. In addition hosting malware affects the service's reputation, although cloud services are not formally responsible for what files their clients upload to the storage. Regular scans of all files contained in the cloud will obviously require a lot of resources that the services would rather use to store data.

As a result of this research, we concluded that there is a relatively low risk of a corporate network being infected via cloud storage: over a period of a year, just 1 out of 1,000 corporate users using cloud services risks infection. It should be remembered, however, that in some cases even a single infected computer in a corporate network can lead to substantial damage.

Here are some measures that can be used to protect corporate networks:

  • Tighten up Firewall/IDS security settings, block access to popular online storage services. The big disadvantage this approach has is that it requires constant and close monitoring of new blacklist candidates as they emerge online.
  • Install a multi-purpose Security Suite. It must incorporate a heuristic and behavior-based antivirus, access restriction features (HIPS), a tool to control the functioning of the operating system (System Watcher or Hypervisor), and a tool to prevent exploitation of vulnerabilities, etc. Once installed, the product must be carefully configured.
  • Remember that even the most sophisticated Security Suite can miss an APT attack. Therefore, attention should be paid to Application Control (it should be configured at Default deny). This is perhaps one of the most reliable tools that will block any unknown software, including malware spread during a targeted attack. The most difficult task arising while deploying Application Control is to configure appropriate rules so that all permitted applications can be launched and updated without problems. To this end, the manufacturers of products which include the Application Control feature have developed dedicated tools: software updates via trusted update programs, preset software whitelists including all possible system and user files, access to huge cloud services and information databases about the entire diversity of whitelisted software.
  • In special cases, Application control should be used to restrict the use of cloud clients within the corporate network. Only trusted employees should be allowed to launch the applications with which to synchronize cloud folders.

As for networks with the most rigorous security requirements, such as those managing power plant operations and water supplies, which guard state secrets or control defense facilities - for all of these we thoroughly recommend not using cloud-based file storage services at all.

Suarez phishing 'petition' dupes users and their friends

Tue, 07/08/2014 - 04:00

At the end of last week we came across a curious method of distributing links to a phishing page that collects users’ personal data.

The FIFA World Cup in Brazil is attracting not only football fans in all parts of the world, but cybercriminals too. The phishing page is designed to imitate the FIFA website. Visitors are asked to sign a petition in defense of Luis Alberto Suárez, a forward for the Uruguayan national team. (On June 24, in a last group stage match between Uruguay and Italy, Suarez bit Italy defender Giorgio Chiellini on the shoulder. As a result, Suarez was disqualified for nine official matches for the national team and banned from all football-related activity for four months. He was also slapped with a fine).

To sign the petition, the user needs to fill out a form, entering his or her name, country of residence, mobile phone number and email address:


Phishing page asking football fans to sign a petition

The phishing page matches the design of the official website and all links on it redirect users to FIFA’s official site, fifa.com. The phishing domain was created on June 27, 2014. According to the whois database, it was registered in the name of a person residing in London. The data collection form was developed by the phishers using Google.Docs. Personal data obtained from the form can be used to send spam, phishing and SMS messages, as well as malicious apps. In addition, armed with users’ email addresses and telephone numbers the cybercriminals can conduct targeted attacks involving banking Trojans for computers and mobile devices. This technique is used to get round two-factor authentication in online banking systems in cases when a one-time password is sent via SMS.

After filling out the ‘petition’ form, victims were encouraged to share a link to the page with their friends on Facebook:


Window prompting users to share the link to the ‘petition’ with friends


Pop-up Facebook window

Unsuspecting fans shared links to the fake petition on their Facebook pages. This enabled the phishing link to spread widely across Facebook in a matter of days.


Example of an unsuspecting user sharing a link to the phishing page on a social network

Messages with links to the phishing page were also seen on dedicated forums, from which users probably reached the phishing page originally.

Miniduke is back: Nemesis Gemina and the Botgen Studio

Thu, 07/03/2014 - 04:46
A 2014 update on one of the world's most unusual APT operations

In 2013, together with our partner CrySyS Lab, we announced our research on a new APT actor we dubbed "Miniduke". It stood out from the "APT bunch" for several reasons, including:

  • Its use of a customized backdoor written in Assembler (who still writes in Assembler in the age of Java and .NET?)
  • A unique command and control mechanism that uses multiple redundancy paths, including Twitter accounts
  • Stealthy transfer of updates as executables hidden inside GIF files (a form of steganography)

We have pointed out that this threat actor used malware developed using "old-school" virus writing techniques and habits.

Our analysis was continued later by researchers from CIRCL/Luxembourg and several other AV companies. Recently, we became aware of an F-Secure publication on the same topic (under the name "CosmicDuke").

In the wake of our publications from 2013, the Miniduke campaigns have stopped or at least decreased in intensity. However, in the beginning of 2014 they resumed attacks in full force, once again grabbing our attention.

We believe it's time to uncover more information on their operations.

"Old" Miniduke in 2014

The old style Miniduke implants from 2013 are still around and being used during the current campaigns.

It still relies on Twitter accounts which contain a hardcoded C&C URL pointing to the command and control server. One such account was the following, observed in February 2014:

Although the format of the C&C URL was changed from previous variants, the encoding algorithm is the same. The line above can be decoded into the full C&C URL:

hxxp://algherolido.it/img/common/thumb/thumb.php

This decoded URL was an active C&C, from which several updates have been collected:

Update 1:

MD5 93382e0b2db1a1283dbed5d9866c7bf2 Size 705536 bytes Compilation Sat Dec 14 18:44:11 2013

This Trojan is a large package, due to the use of a custom packer. The bundle has a specific debug string inside:

C:\Projects\nemesis-gemina\nemesis\bin\carriers\ezlzma_x86_exe.pdb

The package executes a smaller Trojan module:

MD5 b80232f25dbceb6953994e45fb7ff749 Size 27648 bytes Compilation timestamp Wed Mar 05 09:44:36 2014 C&C hxxp://rtproductionsusa.com/wp-includes/images/smilies/icon_gif.php

Another update that has been observed on the C&C server was:

Update 2:

MD5 7fcf05f7773dc3714ebad1a9b28ea8b9 Size 28160 bytes Compilation timestamp Fri Mar 07 10:04:58 2014 C&C hxxp://tangentialreality.com/cache/template/yoo_cache.php

We have observed another similar Trojan, although not on the C&Cs directly:

MD5 edf7a81dab0bf0520bfb8204a010b730,
ba57f95eba99722ebdeae433fc168d72 (dropped) Size 700K, 28160 (dropped) Compilation timestamps Sat Dec 14 18:44:11 2013 (top)
Fri Jan 10 12:59:36 2014 (dropped) C&C hxxp://store.extremesportsevents.net/index.php?i=62B...[snip]

The use of the Nemesis Gemina packer in the Miniduke payloads made us look for further samples in our collection. This led us to several new findings.

The "New" Miniduke Malware (the "CosmicDuke")

After the 2013 exposure, the actor behind Miniduke appears to have switched to using another custom backdoor, capable of stealing various types of information.

The malware spoofs popular applications designed to run in the background, including file information, icons and even file size:

The main "new" Miniduke backdoor (aka TinyBaron or CosmicDuke) is compiled using a customizable framework called "BotGenStudio", which has flexibility to enable/disable components when the bot is constructed.

The components can be divided into 3 groups

  1. Persistence
  2. Reconnaissance
  3. Exfiltration
Persistence

Miniduke/CosmicDuke is capable of starting via Windows Task Scheduler, via a customized service binary that spawns a new process set in the special registry key, or is launched when the user is away and the screensaver is activated.

Reconnaissance

The malware can steal a variety of information, including files based on extensions and file name keywords:

*.exe;*.ndb;*.mp3;*.avi;*.rar;*.docx;*.url;*.xlsx;*.pptx;*.ppsx;*.pst;*.ost;*psw*;*pass*;
*login*;*admin*;*sifr*;*sifer*;*vpn;*.jpg;*.txt;*.lnk; *.dll;*.tmp;*.obj;*.ocx;*.js

Note: we believe the "*sifr*" and "*sifer*" keywords above refer to the transliteration of the English word "Cypher" in some languages.

Also, the backdoor has many other capabilities including:

  • Keylogger
  • Skype password stealer
  • General network information harvester
  • Screen grabber (grabs images every 5 minutes)
  • Clipboard grabber (grabs clipboard contents every 30 seconds)
  • Microsoft Outlook, Windows Address Book stealer
  • Google Chrome password stealer
  • Google Talk password stealer
  • Opera password stealer
  • TheBat! password stealer
  • Firefox, Thunderbird password stealer
  • Drives/location/locale/installed software harvester
  • WiFi network/adapter information harvester
  • LSA secrets harvester
  • Protected Storage secrets harvester
  • Certificate/private keys exporter
  • URL History harvester
  • InteliForms secrets harvester
  • IE Autocomplete, Outlook Express secrets harvester
  • and more...
Exfiltration

The malware implements several methods to exfiltrate information, including uploading data via FTP and three variants of HTTP-based communication mechanisms. A number of different HTTP connectors act as helpers, trying various methods in case one of them is restricted by local security policies or security software. These three methods are:

  • Direct TCP connection and HTTP session via Winsock library
  • HTTP session via Urlmon.dll
  • HTTP session via invisible instance of Internet Explorer as OLE object
Implementation Specifics

Each victim is assigned a unique ID, making it possible to push specific updates to an individual victim. As we noted, Miniduke/CosmicDuke is protected with a custom obfuscated loader which heavily consumes CPU resources for 3-5 minutes before passing execution to the payload. This not only complicates analysis of the malware but is also used to drain resources reserved for execution in emulators integrated in security software. Besides its own obfuscator, it makes heavy use of encryption and compression based on the RC4 and LZRW algorithms respectively. Implementations of these algorithms have tiny differences from the standardized code which perhaps looks like a mistake in the code. Nevertheless, we believe that these changes were introduced on purpose to mislead researchers.

One of the more technically advanced parts of Miniduke is the data storage. The internal configuration of the malware is encrypted, compressed and serialized as a complicated registry-like structure which has various record types including strings, integers and internal references.

In addition, Miniduke uses an unusual method to store the exfiltrated data. When a file is uploaded to the C&C server it is split into small chunks (~3KB), which are compressed, encrypted and placed in a container to be uploaded to the server. If the source file is large enough it may be placed into several hundred different containers that are uploaded independently. These data chunks are probably parsed, decrypted, unpacked, extracted and reassembled on the attacker' side. This method is used to upload screenshots made on the victim's machine. Creating such a complicated storage might be an overhead; however, all those layers of additional processing guarantees that very few researchers will get to the original data while offering an increased reliability against network errors.

Victim geography and profiles

Based on our analysis, the victims of Miniduke and CosmicDuke fall into these categories:

  • government
  • diplomatic
  • energy
  • telecom operators
  • military, including military contractors
  • individuals involved in the traffic and selling of illegal and controlled substances

From one of the old style Miniduke servers we were able to extract a list of victims and their corresponding countries. We were able to identify victims in three of these countries which belonged to the "government" category. Here's the list of countries affected:

  • Australia
  • Belgium
  • France
  • Germany
  • Hungary
  • Netherlands
  • Spain
  • Ukraine
  • United States

One of the CosmicDuke servers we analyzed had a long list of victims dating back to April 2012. This server had 265 unique identifiers assigned to victims from 139 unique IPs. Geographical distribution of the victims was as follows (top10):

84 Georgia 61 Russia 34 United States 14 United Kingdom 9 Kazakhstan 8 India 8 Belarus 6 Cyprus 4 Ukraine 4 Lithuania


According to our analysis, the attackers were more interested in expanding their operations and scanned IP ranges and servers in Azerbaijan, Greece and Ukraine.

Command and control server analysis and hacking tools

During the analysis, we were able to obtain a copy of one of the CosmicDuke command and control servers. It appears it was also used for other operations by the group members, including hacking into other servers on the internet.

The attackers have deployed a number of publicly available hacking tools on this server in order to scan and compromise websites of victim organizations as well as collect information for future targeted attacks.

Here is the list of hacking tools found on the server:

Hydra: "A very fast network logon cracker which support many different services"

Fierce2: "A semi-lightweight enumeration scanner that helps penetration testers locate non-contiguous IP space and hostnames for a specified domains using things like DNS, Whois and ARIN"

The Harvester: "The objective of this program is to gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN computer database"

RitX: "A Reverse IP Lookup Tool that will allows you to use an IP address or domain name to identify all currently domains hosted on a server using multiple services and various techniques"

Joomscan: "OWASP Joomla! Vulnerability Scanner"

Ncrack: "High-speed network authentication cracking tool. It allows for rapid, yet reliable large-scale auditing of multiple hosts"

Sqlmap: "An open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers"

WPScan: "A black box WordPress vulnerability scanner"

Note: tool descriptions were copied from their public websites

Attribution and Artifacts, connections with other campaigns

Although the attackers use English in several places, indicating knowledge of this language, there are certain indicators to suggest they are not native English speakers.

The following strings were discovered in a block of memory appended to the malware component used for persistence:

www.mirea.ru
e.mail.ru
gmt4
c:\documents and settings\владимир\local settings\...

The C&C hosts appear to have been compromised by the attackers, which uploaded a specific webshell.




The Miniduke attackers' webshell on hacked hosts

For the webshell, it is interesting to point to the use of Codepage 1251, which is commonly used to render Cyrillic characters. The password used to protect the shell, is checked against the MD5 hash "35c7c2d1fe03f0eeaa4630332c242a36". (BTW: can you crack it? It took us some days to solve it!)

Perhaps it is noteworthy to say that the same webshell has been observed in the operations of another advanced threat actor known as Turla, Snake or Uroburos.

Another interesting aspect is the debug path strings from the malware, which indicate several build environments or groups of "users" of the "Bot Gen Studio", "NITRO" and "Nemesis Gemina":

c:\botgenstudio\generations\fdd88801\bin\Bot.pdb
c:\botgenstudio\generations\fed14e50\bin\Bot.pdb
D:\SVA\NITRO\BotGenStudio\Interface\Generations\80051A85\bin\bot.pdb
d:\sva\nitro\botgenstudio\interface\generations\805f8183\bin\Bot.pdb
d:\production\nitro\sva\generations\80deae99\bin\Bot.pdb
C:\Projects\nemesis-gemina\nemesis\bin\carriers\ezlzma_x86_exe.pdb
C:\Projects\NEMESIS\nemesis-gemina\nemesis\bin\carriers\ezlzma-boost-kitchen_sink_x86_exe.pdb
D:\PRODUCTION\NITRO\SVA\Generations\80911F82\bin\bot.pdb

Based on the compilation timestamps, we were able to put together the following chart indicating the activity of the Miniduke/CosmicDuke attackers on a 'Day of the Week' basis:

It appears the attackers follow the Mon-Fri work week, however, they do work on the weekends from time to time.

In terms of activity hours, the attackers appear to be working between 6am and 7pm GMT. Most of the work is done between 6am and 4pm though.



Conclusions

Although they stopped or at least decreased in intensity following our announcement last year, the Miniduke attacks are now back in force. The old style Miniduke malware is still being used, deploying previously known stages packed with a new obfuscator observed with the mysterious "Bot Gen Studio" for the "NITRO" and "Nemesis Gemina" projects.

While the old style Miniduke implants were used to target mostly government victims, the new style CosmicDuke implants have a somehow different typology of victims. The most unusual is the targeting of individuals that appear to be involved in the traffic and reselling of controlled and illegal substances, such as steroids and hormones. These victims in the NITRO project have been observed only in Russia. One possibility is that "Bot Gen Studio" is a malware platform also available as a so-called "legal spyware" tool, similar to others, such as HackingTeam's RCS, widely used by law enforcement agencies. Another possibility is that it's simply available in the underground and purchased by various competitors in the pharmaceutical business to spy on each other.

At the same time, the "Nemesis Gemina" project focuses on government, diplomatic, energy, military and telecom operators.

One of the big questions here is: Are the Miniduke attackers still "elite"? Though the old malware is still in use, the new malware is no longer pure assembler; instead, it's written in C/C++.

The new samples of Miniduke/CosmicDuke use a powerful obfuscator. For almost all of the samples we analyzed, it jumps to the beginning of dynamic PE loader - always from the same "l33t" address (if memory layout allowed it during the bot construction):



Hence, you could say that CosmicDuke is still "l33t"!

Microsoft seizes 22 NO-IP domains, disrupts cybercriminal and nation state APT malware operations

Tue, 07/01/2014 - 08:00

NO-IP is one of the many Dynamic DNS providers out there, which can be used for free to register a subdomain on top of popular names such as servepics.com or servebeer.com . For a long time, this has been a favorite method for cybercriminals who wanted to register easy to update hostnames to control their malware implants. Yesterday, Microsoft moved against NO-IP and seized 22 of their domains. They also filed a civil case against Mohamed Benabdellah and Naser Al Mutairi, and a U.S. company, Vitalwerks Internet Solutions, LLC (doing business as No-IP.com), for their roles in creating, controlling, and assisting in infecting millions of computers with malicious software harming Microsoft, its customers and the public at large.

Interestingly, Microsoft cited two specific malware families which were used to infect innocent victims with the Bladabindi (NJrat) and Jenxcus (NJw0rm) family of malware . These have been used by multiple cybercriminal and activist groups to target users, including the (in-)famous Syrian Electronic Army. (stay tuned for a more detailed blog on that soon)

In addition to these, the takedown disrupted many other APT operations, which used NO-IP for their C&C infrastructure. These include:

Based on our statistics, the shutdown has affected in some form at least 25% of the APT groups we are tracking. Some of these hosts that were previously used in large and sophisticated cyberespionage operations are now pointing to what appears to be a Microsoft sinkhole, at 204.95.99.59.

Some top level domains that have been taken away from Vitalwerks and now use Microsoft's DNS infrastructure include:

  • BOUNCEME.NET
  • MYFTP.BIZ
  • MYVNC.COM
  • NO-IP.BIZ
  • NO-IP.INFO
  • REDIRECTME.NET
  • SERVEBEER.COM
  • SERVEBLOG.NET
  • SERVECOUNTERSTRIKE.COM
  • SERVEGAME.COM
  • SERVEHALFLIFE.COM
  • SERVEHTTP.COM
  • SERVEMP3.COM
  • SERVEPICS.COM
  • SERVEQUAKE.COM
  • SYTES.NET

In the meantime, NO-IP / Vitalwerks have published their answer online:

Apparently, the Microsoft infrastructure is not able to handle the billions of queries from our customers. Millions of innocent users are experiencing outages to their services because of Microsoft s attempt to remediate hostnames associated with a few bad actors.

We think yesterday s events have dealt a major blow to many cybercriminal and APT operations around the world.

In the future, we can assume these groups will be more careful on using Dynamic DNS providers and rely more often on hacked websites and direct IP addresses to manage their C&C infrastructure.

Update (2014-07-02): Microsoft published a list of over 20,000 NO-IP hosts that were used in attacks, together with other documents on a specially crafted website for this incident.

Since the publication of our blogpost, many people have contacted us and complained about disruption of their otherwise clean hosts due to the Microsoft takedown. In fact, two hosts previously used in APT attacks that we were sinkholing were also taken away from us. We were using the logs from these, together with other data from our sinkhole to notify victims in many different countries.

Update (2014-07-04): NO-IP just sent a note to their customers that all 23 domains that were seized by Microsoft are now back in their control. This appears to be true, with Microsoft DNS servers no longer controlling the domains.

Have you been affected about the NO-IP takedown? Please let us know by sharing your comments below.


Blog: Microsoft seizes 22 NO-IP domains, disrupts cybercriminal and nation state APT malware operations

Tue, 07/01/2014 - 04:09
Microsoft seized 22 domains previously owned by Vitalwerks, company behind dynamic dns service NO-IP

Spam in May 2014

Mon, 06/30/2014 - 17:08
Spam in the spotlight

In the run-up to the summer, spammers offered their potential customers seedlings and seeds for gardening. In addition, English-language festive spam in May was dedicated to Mother's Day - the attackers sent out adverts offering flowers and candies.

Holiday spam for Mom

As usual, the spammers were very busy in the run-up to the Mother's Day celebration in May, sending out adverts for flowers and candies ahead of the holiday. To get the attention of the recipient, the subject of the email contained the name of the holiday while the body of the message included colorfully decorated promises of generous discounts and prompt delivery.

However, most links in these emails redirected the user to completely different pages instead of the advertised sites. The redirects went to newly created domains which were used not only in the links in the body of the message but also as a server domain name in the sender address. Some emails also included a link which would supposedly enable recipients to unsubscribe from further mailings. In fact, this link was used to collect users' email addresses and send them new spam messages.

Spam for gardeners

It's no secret that Americans are enthusiastic about their gardens - and gardening is one of the most popular hobbies in the country. With summer fast approaching, the spammers started spreading more offers of seeds for lawns and flowers, as well as berries and fruits. Potential buyers were lured in by phrases like "special," "limited offer" and offers of a free plant for every two bought. The messages included colorful images and contained a link. Interestingly, most of the domains to which these links led had been created less than a week before launching the mass mailing.

Diplomas and degrees

In May, we came across a lot of mailings advertising schools and colleges that provided distance learning services. However, there were also mailings in which spammers invited users to simply buy a qualification. All that was required was to make a donation to a church, which would then officially award an honorary doctorate to the benefactor.

In Germany, for example, only universities and similar higher education institutions have the right to award doctorates. However, the situation is somewhat different when it comes to so-called honorary doctorate degrees that are awarded on behalf of a church. Although getting this doctorate does not entail any learning or writing of dissertations, the spam mailings used images of students and other university themes to advertise the service.

There were also many offers to help struggling graduates repay their student loans. These messages urged recipients to follow a link to a site where they would find adverts for organizations that recruit volunteers and staff for non-profit institutions. In the US it is possible to enroll in state programs that offer credits to people who do some kind of service for their community, and these credits can offset student loans. However, the mailings came from unknown accounts that regularly change their email addresses, and not from an official source. The links in the messages went to newly created websites that prompted users to submit personal data.

To get the recipient interested, such emails often contained a personal appeal: "Still can't repay your student loan? I've found an interesting program for you that is definitely worth reading. It will help significantly reduce your monthly payments".

Insuring everyone against everything

Yet another popular topic last month was insuring against different risks, mainly life insurance, although we saw offers of car insurance.

These mailings aimed to redirect users to sites where they could compare the cost of insurance cover from different insurers and choose the most favorable terms. In other cases, the links in the emails led to the spammer parked page where the visitor was offered a wider choice of the types of insurance, companies and programs. Having made his choice and clicked on one of the proposed options, the user entered another resource. The links in the messages might also lead to a site advertising one particular insurance company; typically it was a recently established medium-sized firm.

One unusual type of insurance offer that was limited to English-speaking spam, was burial insurance. In fact, it is an extended version of life insurance: a larger insurance premium means the insurance policy includes funeral services in the event of a sudden death. In May, such messages came in the form of images containing a hyperlink leading to the notorious parked page of the insurance company. These links varied from email to email, but they were always based on different domains registered by the spammers shortly before launching the mailings.

The percentage of spam in email traffic

The percentage of spam in email traffic in May averaged 69.8%, which is 1.3 percentage points less than in April. The highest spam levels were seen during the third week of the month (72.1%), and the lowest levels were seen in the middle of the month (69%).

Malicious attachments in email

The graph below shows the Top 10 malicious programs spread by email in May.

Once again Trojan-Spy.HTML.Fraud.gen tops the charts. This threat appears as an HTML phishing website and sends email disguised as an important notification from banks, online stores, and other services.

In May, representatives of the Bublik family occupied 2nd, 3rd, 5th, 7th and 10th places. In the previous month eight of the top 10 malicious programs were part of this group. Their main functionality is the unauthorized download and installation of new versions of malware onto victim computers. Once the task is fulfilled, the program does not remain active: it copies itself into the %temp% file imitating an Adobe application or document. Trojan.Win32.Bublik.cpik and Trojan.Win32.Bublik.cpil download the notorious ZeuS/Zbot. Although this malicious program is able to execute a variety of malicious actions it is most often used to steal banking information. It can also install CryptoLocker, a malicious program that encrypts user data and demands a ransom to decipher it.

Trojan-Banker.Win32.ChePro.ilc, a banking Trojan targeting the users of Brazilian banks, came fourth. As is typical for this type of malware, it steals bank information and passwords.

Ninth place was occupied by Trojan.Win32.Pakes.agxu, a piece of spyware that intercepts keystrokes, collects screenshots from victim computers and sends the harvested information to the criminal's email address.

The UK was the country with the highest proportion of email antivirus detections with 13.5% (up 3.5 percentage points from April). The US (9.9%) dropped to second. Germany (8.2%) stayed in third.

Columbia (1.83%) was a new entry to the top 20 in May while Russia dropped off the list.

The percentage of email antivirus detections in other countries did not change much in May.

Special features of malicious spam

The insurance theme did not just feature in spam advertising this month - it was also used in mass mailings that spread malicious attachments. For example, we came across German-language messages with the subject "You have not paid your monthly premium", with a warning that next month the interest rate would change. These emails contained a link to allegedly more detailed information and once the recipient clicked on it, a ZIP archive with the name 'Dokumentation' (documentation) or 'Rechnung' (bill) was downloaded on the computer. In both cases the archive contained Backdoor.Win32.Androm.dsqy. This member of the Andromeda family is a backdoor that allows attackers to control infected computers while remaining unnoticed. The infected computers often become part of a botnet.

In May, the attackers sent out fake notifications on behalf of the popular iTunes Store. The recipient was informed about the alleged purchase of an application; the email even specified the name of the product and the price. The attached file, which was supposedly the invoice, in fact contained Trojan-Banker.Win32.Shiotob.f. This family of Trojans steals passwords stored in FTP clients and monitors browser traffic to intercept login details.

Customers of energy company E.ON, which generates and supplies electricity and heating in many countries, were also targeted by a similar scam. An email with the company logo sent on behalf of E.ON read: "This email is to bring to your notice that we were unable to process your last payment. See the details in the attachment". The attached archive contained Trojan-Spy.Win32.Zbot.svvs, a representative of the popular Zbot family designed to steal personal data, especially banking information.

Phishing

In May, Email search sites (32.2%) topped the rating of organizations most frequently targeted by phishers with a slight growth of 0.5 percentage points from the previous month. Second came Social networks (23.9%), headed by Facebook. Financial and payment organizations were in third place with 12.8% (+0.2 percentage points) followed by Online stores (12.1%) whose share also grew 0.2 percentage points from April. The percentage of attacks targeting Telephone and Internet service providers fell by 0.4 percentage points compared with the previous month.The ranking is based on Kaspersky Lab's anti-phishing component detections that are triggered every time a user attempts to click on a phishing link, regardless of whether the link is in a spam email or on a web page.

Fake tax notifications are frequently sent by fraudsters in order to install various malware on users' computers. In May, we came across a fake notification supposedly sent on behalf of the State Tax Service of South Africa. The attachment contained a phishing HTML page rather than a malicious file. The attackers tried to persuade the recipient to enter his bank card details into a form on the pretext of returning overpaid tax. To make the page look legitimate the scammers used the logo of the Service and in the 'From' field they specified not only the name of the government organization but also its official address - sars.gov.za - as the server domain name.


Conclusion

The proportion of spam in global email traffic in May dropped 1.3 percentage points and averaged 69.8%.

The summer season and the end of the school year were used by spammers to spread tourism-themed spam advertising different summer vacation ideas for children, offers of help with academic work and invitations to buy ready-made qualifications from any higher education establishment. The annual increase in the quantity of tourist spam in the run-up to the holiday season is expected this summer too.

Mother's Day was actively used in English-language spam to advertise various gifts. Insurance was another popular theme in May. Most Russian-language adverts offered car insurance, while in the English-speaking segment it was mostly life insurance.

The list of malware spread by email was again topped by Trojan-Spy.HTML.Fraud.gen. There were fewer members of the Bublik family in the May ranking - just five, compared with eight in April.

In May there was no big change in the organizations most frequently targeted by phishers. Email search sites (32.2%) were in first place, followed by Social networks (23.9%). Financial and payment organizations (12.8%) completed the top three.

Analysis: Spam in May 2014

Mon, 06/30/2014 - 07:00
In the run-up to the summer, spammers offered their potential customers seedlings and seeds for gardening. In addition, English-language festive spam in May was dedicated to Mother’s Day - the attackers sent out adverts offering flowers and candies.

Blog: RECON 2014

Sun, 06/29/2014 - 19:07
Today was the last day of the REcon 2014 conference where reverse engineers from all over the world meet and share their research. The event started with trainings, where I (Nicolas) gave a 4 days training on malware reverse engineering. During those 4 days, we covered various kind of topics such as how to unpack/decrypt malware, identify cryptography algorithms, deal with obfuscated code, analyze shellcode etc.

RECON 2014

Sun, 06/29/2014 - 13:23


Today was the last day of the REcon 2014 conference where reverse engineers from all over the world meet and share their research.

The event started with trainings, where I (Nicolas) gave a 4 days training on malware reverse engineering. During those 4 days, we covered various kind of topics such as how to unpack/decrypt malware, identify cryptography algorithms, deal with obfuscated code, analyze shellcode etc.

My colleague Marta Janus did a talk explaining the various techniques used by malwares to evade detection and sandboxing, and covered a lot of obfuscations tricks used in current malware.

The presentations this year were quite interesting and a few of them directly related to what we do in the labs, including graph representation of binaries , tools to help speed up analysis and handle code obfuscation.

You can find the full schedule of the conference here

The slides and the videos of every talks will be uploaded in the future on the REcon website.

Meanwhile, you can already download some of the research tools:

PANDA is the Platform for Architecture-Neutral Dynamic Analysis. It is a platform based on QEMU 1.0.1 and LLVM 3.3 for performing dynamic software analysis, abstracting architecture-level details away with a clean plugin interface. It is currently being developed in collaboration with MIT Lincoln Laboratory, Georgia Tech, and Northeastern University.

FUNCAP is a script to record function calls (and returns) across an executable using IDA debugger API, along with all the arguments passed. It dumps the info to a text file, and also inserts it into IDA's inline comments. This way, static analysis that usually follows the behavioral runtime analysis when analyzing malware, can be directly fed with runtime info such as decrypted strings returned in function's arguments

One presentation mentioned a framework for Reverse Engineering which i consider worthy to list here.

MIASM 2 is a a free and open source (GPLv2) reverse engineering framework. Miasm aims at analyzing/modifying/generating binary programs. Abilities to represent assembly semantic using intermediate language, emulating using jit (dynamic code analysis, unpacking) and expression simplification for automatic de-obfuscation.

See you next year at RECON 2015

Twitter: @nicolasbrulez

Use the force Luuuk

Wed, 06/25/2014 - 13:14

Stealing more than half a million euro in just a week - it sounds like a Hollywood heist movie. But the organizers of the Luuuk banking fraud pulled it off with a Man-in-the-Browser (MITB) campaign against a specific European bank. The stolen money was then automatically transferred to preset mule accounts. When GReAT discovered Luuuk's control panel it immediately got in touch with the bank and launched an investigation.

On January 20th 2014 Kaspersky Lab detected a suspicious server containing several log files including events from bots reporting to a command and control web panel. The information sent seemed to be related to a financial fraud; it included details of the victims and the sums of money stolen.


Figure 1: Example of log file

After further analysis we found additional files in the server containing logs with different content and showing potentially fraudulent banking transactions, as well as source code in JavaScript related to the C2 infrastructure. This information provided valuable data about the bank that had been targeted and other details such as the money-mule system and operational details used in this scheme.


Figure 2: Source code control panel

Once we analyzed all the available data, it was clear that the C2 was the server-side portion of a banking Trojan infrastructure. We believe the fraud was being perpetrated using Man-in-the-Browser techniques and was also capable of performing automatic transactions to pre-set money mule accounts.

We decided to name this C2 luuuk after the path the administration panel used in the server:/server/adm/luuuk/

Below is a summary of the relevant information extracted from the server side component:

  • Around 190 victims, mostly located in Italy and Turkey.
  • Fraudulent transactions worth more than 500,000 € (according to logs) .
  • Fraudulent transfer descriptions.
  • Victims' and mules' IBANs.

The control panel was hosted in the domain uvvya-jqwph.eu, resolving to the IP address 109.169.23.134 during the analysis.

The fraudulent campaign targeted users of a single bank. Even though we were not able to get the malicious code used on the victims, we believe the criminals used a banking Trojan performing Man-in-the-Browser operations to get the credentials of their victims through a malicious web injection. Based on the information available in some of the log files, the malware stole usernames, passwords and OTP codes in real time.


Figure 3: Fraudulent transaction log example.

This kind of injections are very common in all the variations of Zeus (Citadel, SpyEye, IceIX, etc.) and all of these are well-known in Italy. During our investigation it was not possible to find the infection vector, however banking Trojans use a variety of methods to infect victims including spam and drive-by downloads.

The attackers used the stolen credentials to check the victim?s balance and perform several malicious transactions automatically, probably operating in the background of a legitimate banking session. That would be consistent with one of the malicious artifacts (a VNC server) we found binded to the malicious server used by the attackers.

Despite the "usual" techniques implemented to steal the users' money (user/password/OTP bypass) what is really interesting in this campaign is the classification of the predefined money mules used to transfer the stolen money.

According to the transaction logs, there were 4 different money-mule (or drop) groups:

  • 13test: The limit that the drops in this group can accept is between 40,000 and 50,000 Euros, although there are some drops that have different limits, between 20,000 and 30,000.
  • 14test: The limit that the drops in this group can accept is between 15,000 and 20,000 Euros, although there are some drops in this group that have different limits, between 45,000 and 50,000.
  • 14smallings: The limit that the drops in this group can accept is between 2,500 and 3,000 Euros.
  • 16smallings: The limit that the drops in this group can accept is between 1,750 and 2,000 Euros, although there are drops in this group that can accept a quantity between 2,500 and 3,000 Euros (as in the group 14smallings).

This could be an indicator of a well-organized mule infrastructure. Different groups have different limits on the money that can be transferred to its mules, an indicator of the levels of trust between them.

The operators of this control panel removed all the sensitive components on January 22nd, two days after our investigation started. Based on the transaction activity we believe that this could be an infrastructure change rather than a complete shutdown of the operation.

In addition, based on the fraudulent transaction activity detected in the server and several additional indicators, we believe that the criminals behind the operation are very active. Also they have shown proactive operational security activities, changing tactics and cleaning traces when discovered.

Kaspersky Lab is maintaining contacts with different LEAs and the affected financial institution in order to prosecute the criminals.

Kaspersky Fraud Prevention vs. the Luuuk

The evidence uncovered by Kaspersky Lab's experts indicates that the campaign was most probably organized by professional criminals. However, the malicious tools they used to steal money can be countered effectively by security technologies. For instance, Kaspersky Lab has developed Kaspersky Fraud Prevention - a multi-tier platform to help financial organizations protect their clients from online financial fraud. The platform includes components that safeguard client devices from many types of attacks, including Man-in-the-Browser attacks, as well as tools that can help companies detect and block fraudulent transactions.

UPDATE

After the publication of the post, our colleagues at Fox-IT InTELL sent us some potentially related information regarding this campaign. According to this new information, the Luuuk server could be related to the ZeusP2P (aka Murofet) infrastructure as we originally suspected.

We received two decrypted configuration files belonging to the ZeusP2P with a reference to the same server where Luuuk was hosted:

The configuration belongs to a botnet named "it" (for Italy). The Luuuk server is being used to host the code that is injected in the victims´ browser. It also manages the automatic transfers to a predefined set of money mules (drops) accounts.

We were also able to analyze the binaries using these configurations. The first one (c8a3657ea19ec43dcb569772308a6c2f) is a ZeusP2P (Murofet) sample that was first seen back in August 2013, months before the malicious transactions were made. It tries to connect to several of the sinkholed servers used to take down GameOver.


Sinkholed domains used by the sample.

This additional data reinforces the theory that the Zeus family is behind the Luuuk server - in this particular case it appears to be of the ZeusP2P flavor. However, this is not definitive proof that the malicious transactions in the campaign were performed by this family, as the injected code on the server was not there when we analyzed it.

Still, it would be quite unusual for two different malware campaigns to use the same server almost simultaneously to provide the necessary infrastructure. So we will continue our investigations based on the hypothesis that this Luuuk campaign used ZeusP2P samples for their infections and malicious transactions. Now we will try to get the Javascript code injected to close the circle.

We would like to thank Fox-IT for sharing this information.

Blog: Use the force Luuuk

Wed, 06/25/2014 - 02:00

HackingTeam 2.0: The Story Goes Mobile

Tue, 06/24/2014 - 13:04

More than a year has passed since the release of our last article on HackingTeam, the Italian company that develops a "legal" spyware tool known as Remote Control System, or short, RCS. In the meantime a lot has been happened, so it's time for an update on all our current research findings on the RCS malware.

Locating the command servers

One of the most important things we've uncovered during our long and extensive research is a specific feature than can be used to fingerprint the RCS command servers (C2s). We presented details of this method at the Virus Bulletin 2013 conference.

To summarize, when a special request is sent to a "harmless" HackingTeam RCS C&C server, the RCS C&C responds with the following error message:


Slide from our VB presentation with HackingTeam's C2 fingerprint

First of all, the codename 'RCS' is there, all right. What we weren't sure about was the 'Collector' referred to in the response. This probably refers to the fact that the server "collects" information from the victims. We used this particular fingerprinting method to scan the entire IPv4 space, which allowed us to find all the IP addresses of the RCS C2s around the world and plot them nicely to a map showing their locations. šWe pinpointed a grand total of 326 C2s.

Count of C2s Country name 64 UNITED STATES 49 KAZAKHSTAN 35 ECUADOR 32 UNITED KINGDOM 24 CANADA 15 CHINA 12 COLOMBIA 7 POLAND 7 NEW ZEALAND 6 PERU 6 INDONESIA 6 BRAZIL 6 BOLIVIA 6 ARGENTINA 5 RUSSIAN FEDERATION 5 INDIA 4 HONG KONG 4 AUSTRALIA 3 SPAIN 2 SAUDI ARABIA 2 MALAYSIA 2 ITALY 2 GERMANY 2 FRANCE 2 EGYPT 1 UKRAINE 1 THAILAND 1 SWEDEN 1 SINGAPORE 1 ROMANIA 1 PARAGUAY 1 MOROCCO 1 LITHUANIA 1 KENYA 1 JAPAN 1 IRELAND 1 HUNGARY 1 DENMARK 1 CZECH REPUBLIC 1 CYPRUS 1 Other 1 BELGIUM 1 AZERBAIJAN


Map showing the countries of the current HackingTeam servers’ locations

The largest amount of identified servers was in the US, Kazakhstan and Ecuador. Unfortunately, we can’t be sure that the servers in a certain country are used by that specific country’s LEAs; however, it would make sense for LEAs to put their C&Cs in their own countries in order to avoid cross-border legal problems and the seizure of servers.  Nevertheless, several IPs were identified as “government” related based on their WHOIS information and they provide a good indication of who owns them.

Mobile modules

It was a well-known fact for quite some time that HackingTeam products included malware for mobile phones. However, these were rarely seen. In particular, the Android and iOS Trojans have never been identified before and represented one of the remaining blank spots in the story. Earlier this year, we discovered a number of mobile malware modules coming from HackingTeam for the following platforms:

  • Android
  • iOS
  • Windows Mobile
  • BlackBerry

All these modules are controlled by the same configuration type, which is a good indication that they are related and belong to the same product family.


Configuration file from the RCS mobile modules

Certainly, our main interest during the analysis of the mobile modules was in iOS and Android, due to their popularity. The iOS module works only on jailbroken devices. Here is a description of the main functionality of the iOS module:

  • Control of Wi-Fi, GPS, GPRS
  • Recording voice
  • E-mail, SMS, MMS
  • Listing files
  • Cookies
  • Visited URLs
  • Cached web pages
  • Address book
  • Call history
  • Notes
  • Calendar
  • Clipboard
  • List of apps
  • SIM change
  • Live microphone
  • Camera shots
  • Support chats, WhatsApp, Skype, Viber
  • Log keystrokes from all apps and screens via libinjection


Disassembled code of the iOS module

The Android module is protected by the DexGuard optimizer/obfuscator and is therefore extremely difficult to analyze. However, we discovered (see the trace below) that the sample has all the functionality of the iOS module listed above - plus support for hijacking information from the following applications:

  • com.tencent.mm
  • com.google.android.gm
  • android.calendar
  • com.facebook
  • jp.naver.line.android
  • com.google.android.talk


Trace of an RCS Android sample

Mobile infectors

Another aspect of particular interest to us was the way the malware samples are installed on mobile devices. We discovered several modules that infect mobile devices connected to infected Windows or Mac OS X computers.

As already mentioned, the iOS module can only be used on jailbroken devices. That is why the iOS infector uses the AFP2 protocol to transfer. The "infector" has a nice GUI that enables installation if there is physical access to the victim's device or remote admin access to an infected computer.


Main window of the iOS infector

iPhone1,1 iPhone1,2 iPhone2,1 iPhone3,1 iPhone3,2 iPhone3,3 iPhone4,1 iPhone5,1 iPhone5,2 iPad1,1 iPad2,1 iPad2,2 iPad2,3 iPad2,4 iPad3,1 iPad3,2 iPad3,3 iPad3,4 iPad3,5 iPad3,6 iPhone iPhone 3G iPhone 3GS iPhone 4 iPhone 4 iPhone 4 (cdma) iPhone 4s iPhone 5 (gsm) iPhone 5 iPad iPad2 (Wi-Fi) iPad2 (gsm) iPad2 (cdma) iPad2 (Wi-Fi) iPad3 (Wi-Fi) iPad3 (gsm) iPad3 iPad4 (Wi-Fi) iPad4 (gsm) iPad4    

List of Apple devices supported by the iOS infector

After successfully connecting, the iOS infector copies several files to iOS and runs an install.sh file:


Part of the install.sh file that is run on an infected iOS device

As mentioned above, remote admin access to an infected computer is one of the possible ways for the malware to be installed on a connected mobile device. The fact that only jailbroken iOS devices are supported can be a limiting factor. However, this is not a huge problem since an attacker can also run a jailbreaking tool such as Evasi0n via the same infected computer. In this case the only thing that can protect a user from a remote jailbreak and infection is the mobile device’s passcode. However, if the device is unlocked while connected to the infected computer, it can be infected by the attacker.

Another interesting mobile infector is the one for BlackBerry devices, which uses the JavaLoader application to load malware samples on BB 4.5 and 5.0. In its disassembled code, we found a path to the PDB debug file, which appears to have been mistakenly forgotten by the authors. The original project was located in the ‘C:\HT\RCSBlackBerry\Workspace\RCS_BB_Infection_Agent\’ when this malware was created.


Part of the code of a Blackberry infector with a path to the PDB file

Summary

In this latest installment of our ongoing research, we uncovered a huge infrastructure that is used to control the RCS malware implants. Our latest research has indentified mobile modules that work on all well-known mobile platforms, including as Android and iOS. These modules are installed using infectors - special executables for either Windows or Macs that run on already infected computers. They translate into complete control over the environment in and near a victim’s computer. Secretly activating the microphone and taking regular camera shots provides constant surveillance of the target - which is much more powerful than traditional cloak and dagger operations.

The new data we are publishing on HackingTeam’s RCS is extremely important because it shows the level of sophistication and scale of these surveillance tools. We like to think that if we’re able to protect our customers from such advanced threats, then we’ll sure have no trouble with lesser, more common threats like those posed by cybercriminals.

Appendix:

MD5s of mobile infectors:

  • 14b03ada92dd81d6ce57f43889810087 - BlackBerry infector
  • 35c4f9f242aae60edbd1fe150bc952d5 - iOS infector

MD5s of Android samples:

  • ff8e7f09232198d6529d9194c86c0791
  • 36ab980a954b02a26d3af4378f6c04b4
  • a2a659d66e83ffe66b6d728a52130b72
  • 9f06db99d2e5b27b01113f78b745ff28
  • a43ea939e883cc33fc766dd0bcac9f6a
  • a465ead1fd61afe72238306c7ed048fe

MD5s of Windows samples:

  • bf8aba6f7640f470a8f75e9adc5b940d
  • b04ab81b9b796042c46966705cd2d201
  • 1be71818a228e88918dac0a8140dbd34
  • c7268b341fd68cf334fc92269f07503a

List of active C2s on 19.06.2014:

  • 50.63.180.***
  • 146.185.30.***
  • 204.188.221.***
  • 91.109.17.***
  • 106.186.17.***
  • 119.59.123.***
  • 95.141.46.***
  • 192.71.245.***
  • 106.187.99.***
  • 93.95.219.***
  • 106.187.96.***
  • 124.217.245.***
  • 23.92.30.***
  • 82.146.58.***
  • 93.95.219.***
  • 209.59.205.***

RCS modules (using Kaspersky Lab’s classification names):

  • Backdoor.OSX.Morcut
  • Rootkit.OSX.Morcut
  • Trojan.OSX.Morcut
  • Backdoor.Win32.Korablin
  • Backdoor.Win64.Korablin
  • Rootkit.Win32.Korablin
  • Rootkit.Win64.Korablin
  • Trojan.Multi.Korablin
  • Trojan-Dropper.Win32.Korablin
  • Backdoor.AndroidOS.Criag
  • Trojan-Spy.AndroidOS.Mekir
  • Trojan.Win32.BBInfector
  • Trojan.Win32.IOSinfector
  • Trojan.OSX.IOSinfector
  • Trojan-Spy.IphoneOS.Mekir
  • Trojan-Spy.WinCE.Mekir
  • Trojan-Spy.BlackberryOS.Mekir

Blog: The Rise of Cybercrime in Dubai and UAE

Mon, 06/23/2014 - 13:20
Dubai today has become a global city and a business hub, same is going for threats and malware attacks, UAE is the most attacked country in the Middle East. In this report we highlight the most popular and dangerous threats and attacks, in addition to possible solutions to handle such threats.

The Rise of Cybercrime in Dubai and UAE

Mon, 06/23/2014 - 12:35

A lot of our everyday communication and commercial activities are now taking place online, the threat from cybercrime is increasing, targeting citizens, businesses and governments at a rapidly growing rate.

Organizations and individuals are worried about the increase of Cybercrime, not just because of financial damage, but loss of privacy and intellectual property, in addition to reputation problems.

Recent statistics have shown dramatic growth in the Cybercrime in the UAE. Emerging markets have long been of interest for Cyber criminals.

Official statistics from Dubai have shown a dramatic 88% increase in the number of electronic crime cases reported in 2013 compared to the year before. The cyber investigation department of Dubai Police received a total of 1,419 reports in 2013, 792 in 2012 and 588 in 2011.

Kaspersky malware statistics in the UAE and worldwide

The increase in the number of attacks in the UAE and the region is also reflected by the number of attacks and infection attempts detected by Kaspersky Security Network in the region. The KSN cloud network uses the latest intelligence technologies to enable the reporting and analysis of threats around the world.

Kaspersky top Malware detections statistics for 2014 in the world Adware.Win32.Amonetize.heur 3,700,000+ Worm.VBS.Dinihou.r 1,800,000+ Virus.Win32.Sality.gen 1,780,000+ AdWare.Win32.BetterSurf.b 1,500,000+ AdWare.Win32.Yotoon.heur 1,500,000+ Exploit.Win32.CVE-2010-2568.gen 1,388,000+ Worm.Win32.Debris.a 1,094,000+ Trojan.Win32.Starter.lgb 1,007,000+ AdWare.Win32.Skyli.a 883,000+ Exploit.Java.Generic 850,000+ Trojan.Win32.AntiFW.b 829,000+ Virus.Win32.Nimnul.a 713,000+ Trojan.WinLNK.Runner.ea 676,000+ Why is cybercrime surging in the UAE?

The last few years have seen huge increase in the use of smart electronic devices and Internet services, all these devices are connected to the Internet.

Increasing use of online services

According to recent statistics Internet penetration has reached 92% in the UAE. Most people now use online services, including the transfer of financial and personal information to fulfill their day-to-day needs, and the most popular services are as follows:

  1. E-Government transactions, e-bills
  2. E-banking
  3. E-shopping

While the benefits of using online services are obvious, there are also threats that target user information.

Smartphone Threats

Many people in the UAE and Gulf region have smart mobile devices. These have many benefits and allow anyone to easily access services and activities online. These devices are expensive, so users often wrongly assume they have some kind of default protection.

Android is the most targeted mobile platform. At Kaspersky Lab we now have more than 10 million unique Android malware samples in our databases.

In Q1 2014, more than 99% of all mobile malware targeted Android devices. Detections over the past three months included:

  • 1 258 436 installation packages,
  • 110 324 new malicious programs for mobile devices,
  • 1 182 new mobile banking Trojans.
Financial Motivation

The huge increase in the use of online payment and e-services, in addition to the wide availability of unprotected smartphones, has encouraged cyber-criminals to target users with malware and phishing attacks affecting all types of devices.

Just like offline crime, money is a prime motive, especially when the risks of a criminal life are less apparent when you're hiding being a computer screen. The perception of low risk and high financial reward stimulates many cyber criminals to participate in identity theft and fraudulent activities.

Personal Motivation

Human beings and the crimes they commit are often motivated by personal emotions and vendettas. From irritated employees to jealous boyfriends, many crimes have their roots in powerful passions.

Ideological and Political Motivation

These kinds of attacks are carried out for moral, ideological or political reasons, damaging or disabling online services and networks to protest against individuals, corporations or governments. Anonymous group is a popular example of ideologically motivated hackers.

The most dangerous attacks on users in the UAE Banking Malware

The UAE is a country well known for its concentration of financial resources. Banking malware targets user devices to steal financial information like credit card details and bank account passwords. The criminals then use this stolen information to transfer money from the compromised accounts.

The most popular banking malware in the UAE are as follows:

  • Zeus (Windows)
  • Carberp (Windows)
  • mToken (Android)

Zeus and Carberp have long been popular malware for Windows computers and widely available public source code has enabled criminals to develop many variants of these. Zeus Gameover, the latest variant of Zeus has hit hard in the UAE, the third most affected country in the world. Zeus Gameover was taken down by the FBI and Microsoft on 2nd of June 2014.


Number of Zeus and Carberp attacks, and files blocked between 5 and 12 June 2014 in UAE

mToken was first recognized and reported by the Intercrawler organization. This is a different type of malware that mainly targets Android devices. It is used to steal banking usernames and passwords, in addition to stealing SMS token messages from the banks. There were 513,000 mToken attacks in Q1 2014 in the GCC region according to statistics from the Telecommunications Regulatory Authority. The mToken disguises itself as a banking token generator for some of the most popular banks in KSA and UAE Most of its victims are in the United Arab Emirates and the Kingdom of Saudi Arabia.

Kaspersky Lab products have detected and blocked Zeus variants since 2010 and Mtoken variants since 2012.

Ransomware: Lockers and Crypters

Lockers and Encrypters are ransomware trojans. An attack may come from several sources; one example is disguised as an authentic email attachment.

Some Lockers can be removed with no damage to the system or files, others harm files by encrypting them using RSA public-key cryptography where only the hackers have the keys to decrypt and recover the files.

The malware displays a message which offers to unlock/decrypt the device and data if a payment is made by a stated deadline (through either Bitcoin or a pre-paid coupon), and threatens to delete the key if the deadline passes.

Lockers and Encrypters mainly target Windows devices but recently we have seen versions for Android.


Number of ransomware attacks and files blocked between 5 and 12 June 2014 in UAE


Even though it is old, CashU malware is still active in the UAE


Cryptolocker encrypts your files and they can only be recovered using the hacker's key


Ransomware targeting Android devices, disguised as a protection application

The most popular attacks in the UAE

The total number of attacks from Jan-May 2014 is 12,713,890

Top 3 Adware in the UAE in 2014 AdWare.Win32.BetterSurf.b 1,228,000+ AdWare.Win32.BrainInst.u 1,189,000+ AdWare.Win32.BHO.batb 680,000+ Top 3 malware attacks in the UAE in 2014 Virus.Win32.Sality.gen 378,000+ Net-Worm.Win32.Kido.ih 348,000+ Exploit.Win32.CVE-2010-2568.gen 339,000+

Sality virus: blocks some security functions and utilities on Windows computers. It also tries to download malware from other servers. It infects Windows files and copies itself to removable and remote drives.

Kido worm: also known as conficker, is malware that targets the Windows operating system, mainly attacking the MS08-067 vulnerability; it also uses dictionary attacks on administrator passwords to spread and create a botnet.

CVE-2010-2568 is one of the most popular weaknesses in the Microsoft Operating system. When exploited by malware attacks, it allows a user to execute code via shortcut file (.lnk) that is not properly handled by the operating system.

Sality virus, Kido worm and the CVE-2010-2568 exploit are legacy attacks which were used to infect millions of machines worldwide. They are still widespread because they can easily infect new machines or they are publicly available for the criminals to use which explains the high success rates if a device is not protected.

These recent statistics suggest that the most popular malware and adware in the UAE are not new:

First Date of malware detection by Family BetterSurf adware Oct 2013 BrainInst adware Dec 2013 BHO adware Mar 2006 Sality virus Oct 2009 Kido worm Nov 2008 CVE-2010-2568 exploit Jul 2010

The main reasons why old attacks are still very successful are as follows:

  • The absence of correct patching on the user operating systems
  • The use of unlicensed software
  • The lack of security software to protect the user devices against the latest threats
  • The lack of good practices for handling smart devices, like good passwords and awareness on cyber security
Conclusion and future expectations

Most malware works in stealth mode. It doesn't announce itself on a PC or mobile device, preferring to monitor and steal information and then use it to steal your money or reveal themselves while extorting money. In most cases criminals are not very interested in the information on most personal or business computers. But this data is vital to the owner, and criminals manipulate the need for confidentiality, integrity and availability to cause financial and reputational damage to victims.

The UAE has a diverse, cosmopolitan and multicultural society and the accelerated economic growth in the region has encouraged cyber-criminals to excessively target citizens, using and adapting the latest trends in global cybercrime.

The increasing number and complexity of threats targeting users and businesses in the UAE requires better protection and awareness to defend against various cyber-threats.

You can follow me on twitter: @mahasbini