In our latest Global Security Report, we noted malicious spam campaigns were on the increase, and roughly 1 in 10 spam messages were malicious.
There is a large scale malicious spam campaign going on that is shamelessly exploiting the Boston bombing. Subject lines are similar to the following:
Continue reading "Large scale malicious spam campaign exploiting Boston bombing" »
Yesterday we alerted people to a widespread phishing campaign misusing Trustwave’s brand. Here we go into some more detail about the campaign.
First up, I’d like to repeat, these messages did not originate from Trustwave, and at no time was there any breach of Trustwave's networks or data. Here is an image of the offending email, which purports to be a notification from a TrustKeeper vulnerability scan:
While CVE-2012-4969 isn’t new, we are still curious about the various ways this vulnerability can be exploited. Today we’ve stumbled upon a new instance of it. Let’s have a look.
That’s a rather simple version of the first half of the attack, so let’s have a look at the second.
Continue reading "CVE-2012-4969 and the Unnamed Admin Panel" »
A few days ago a new version of THE most common exploit kit was released. Unlike most exploit kit authors, who try to keep a low profile, the author of Blackhole publishes his work in Russian forums and even writes detailed information regarding his new product.
Notice, the login panel requires to enter a CAPTCHA to avoid automatic scanners that guess default passwords, this feature is not new in exploit kits, but definitely not common.
Let’s review the important changes that have been made in Blackhole Exploit Kit v2 compared to the Blackhole Exploit Kit v1:
Basically, the author of Blackhole has put a lot of effort into avoiding Anti-Viruses vendors’ and Security Researchers’ detection, and focuses less on new obfuscation techniques.
Let’s compare the new variant of Blackhole Exploit Kit with the old one:
The older version:
By comparing the code in the two screenshots above, we can see that the core of the obfuscation algorithm is the same. First, the “try/catch” technique, second is some obfuscated code loaded from the DOM using “getElementsByTagName”, and finally a set of basic math operations that opens the obfuscated code and execute it.
This is what the de-obfuscated code of Blackhole Exploit Kit v2 looks like:
According to the screenshots above the new version of Blackhole focuses on evasion techniques: For example, in the code above the PDF and the Jar files are loaded using a unique link that is generated specifically for the user and is valid only for a limited amount of time (definitely a pain in the ass…). As for the files themselves, we will publish a technical analysis of the PDF and Jar exploits served by the new version of Blackhole in a later blog post.
Let’s take a closer look at some more interesting stuff added in the new version:
Referers
This option allows the administrator to allow access to the exploit page only from specific referrers which can be configured using the control panel. The administrator can also configure whether to block access to the exploit when no referrer is present.
Bot List
Blackhole exploit kit holds a list of 132,220 bot IPs which can be automatically blocked by the engine. This way the exploit kit is not exposed to automated security crawlers.
ToR List
This feature is really annoying. Blackhole Exploit Kit v2 contains an IP list of ToR endpoint nodes, so if this flag is turned on, security researchers won’t be able to use ToR for analysis.
Upon installing the exploit kit a list of 2,147 ToR nodes are loaded into the database and are updated automatically.
Recording Mode
This one is a really cool feature: once the attack campaign is over, the administrator can switch their blackhole exploit kit v2 into a “monitoring mode” of sorts. In this stage the exploit kit is not supposed to receive any traffic, therefore, the exploit kit author assumes the incoming traffic belongs to security vendors. The IPs that are captured during that time are reported back to Blackhole author and added to the list of bots.
These captured IPs inserted into the database and published to Blackhole customers.
Now let’s view the new control panel settings:
In this new version of Blackhole exploit kit, the administrator can define when the engine will replace the current domain with a new one to avoid Anti-Virus detection. Using the “AntiVirus Check” feature, the exploit kit tests the URL of the exploitation page with underground Anti-Virus websites (VirTest and Scan4you). The administrator can control the change rate of the URL after it has been discovered by a certain number of Anti-Virus vendors.
“Threads” is pretty similar to older version of Blackhole, where the administrator can create multiple attacks with different viruses.
The significant feature added in this section is the “Traffic” feature. Unlike older version of the Blackhole Exploit Kit, the new version serves the exploit only one time per IP address. The administrator can configure a webpage or a message to users that continue to access the server more than once.
In conclusion, it is clear that this new generation of Blackhole Exploit Kit puts a lot of effort into new evasion techniques that are aimed towards making the lives of security researchers as difficult as they can be while taking the focus off obfuscation techniques, which used to be the main theme in exploit kit updates in the past. .
Needless to say, customers of Trustwave Secure Web Gateway (SWG), version 10.1 and higher, are protected by default with no need for any further update.
Thanks to my colleague Anat Davidi for her contribution to this post.
Over the past few weeks we have seen a resurgence of malicious spam with links leading off to the Blackhole exploit kit. Last week about 2% of spam hitting our traps fell into this category, which is pretty significant given that many people still consider ‘spam’ annoying but harmless. The spam typically originates from the ubiquitous Cutwail spambot variants, but other botnets are also involved. The campaigns vary widely from day to day according to the attackers’ whims. The message templates are based on mimicking high-profile brands, for example:
CenturyLink
Verizon
American Express
Windstream
AT&T
Citibank
UPS
Today, I’ll focus on a Verizon campaign. Below is a sample message, which as is typical, displays some aspect of an account bill or statement. Merely hovering over the link shows that the URL (underlined in red) is not associated with Verizon in any way:
In this case, the link simply leads directly to a site hosting the Blackhole exploit kit. (In other examples I’ve seen there are one or more redirects via other compromised hosts.) I didn’t get the screen grab in time before the site went down, but here is an identical one from a similar campaign, showing the obfuscated JavaScript typical of Blackhole:
Of course, the goal of an exploit kit is to exploit. So how successful is this campaign? As it happens, a colleague of mine happened to ‘find’ his way into the admin panel of this particular Blackhole server and take a screenshot, which reveals some interesting information indeed:
I love looking at admin panels! At a glance you can see what is driving the bad guys. If you somehow can’t read Russian, I have annotated the four columns representing Hits, Hosts, Downloads (successful exploits), and Download Rate (percentage of successful exploits). You can see the highlighted domain from the original spam message had a 10% success rate, 17 installs out of 167 unique host visits. Overall success rates for the kit were 13.06% for this particular day, and 7.77% overall. Is it just me, or does anyone else think that a 10% success rate is higher than it should be?
The bottom section displays the array of exploits used. Notably, over 75% of successful installs were accomplished using some type of PDF exploit, with over 50% resulting from an exploit targeting the Adobe Reader PDF LibTiff vulnerability (CVE-2010-0188). The “PDF ALL” refers to a bundle of known PDF exploits including GetIcon (CVE-2009-0927), CollectEmailinfo (CVE-2007-5659), printf (CVE-2008-2992), and newPlayer (CVE-2009-4324).
Some of the other exploits used in this kit are the trusty MDAC (CVE-2006-0003), Java AtomicReferenceArray (CVE-2012-0507), Microsoft Help Center URL Validation (CVE-2010-1885), and a Flash exploit, which is most likely SWF File Remote Memory Corruption (CVE-2011-0611), given past Blackhole analysis.
On the installs by country, while the United States had the lowest install rate (6.16%), it had the highest total number of installs by far (616), reflecting its higher number of hits. This is not really surprising given that the spam campaigns, and the brands used, seem specifically targeted at US users. The operator of this kit is most likely affiliated with a pay-per-install program, and these programs typically pay more for US-based computers. Another interesting stat was the 13 successful installs in Russia, representing a high 35% exploit rate. Hmmm, I wonder whether some of these are the kit operator’s test machines?
So what can we learn from this little analysis?
Trustwave Secure Web Gateway and MailMarshal Secure Email Gateway provide protection against Blackhole and other exploit kits, and these spam campaigns, respectively.
Thanks to fellow SpiderLabs colleague Daniel Chechik for his input and for wandering into this particular Blackhole kit.
This is the fifth and the last part of this series of blogs. The prior blogs described an attack which was executed by a well-organized cybercriminal group and how they managed to steal a large amount of money from innocent people.
“Catch Me If You Can” Trojan Banker Zeus Strikes Again (Part 4 of 5)
In this blog we will summarize the scale of the cyber-attack and the achievements this group managed to accomplish.
In the past year, the cybercrime gang has developed and perfected the infrastructure of this widespread attack. From July until mid-November, the gang managed to infect approximately 30,000 machines, primarily based in the U.K.
Figure 1: Infected computers map, Google Maps.
Figure 1 pinpoints the geographic location of the victims. Every group of IPs that share the same geographical coordinates is represented by a marker. On average, every marker represents approximately 40 to 50 infected machines. You will notice that only a few infected computers are located outside of the U.K.. Those computers are suspected to be Trojan test machines, or possibly users roaming outside of the U.K. During this timeframe, the cybercriminals, operating primarily in the U.K, managed to steal hundreds of thousands of Euro from innocent people.
Figure 2: Breakdown of whitelisted IP addresses, Google Maps.
Figure 2 shows the geographic location of the IP addresses whitelisted by the manager of the system, so they stay protected from infection spread by this attack. We believe that these computers belong to the affiliates/collaborators.
Figure 3: Breakdown of stolen money by Bank
According to the data we have collected, approximately €1 million have been stolen over a period of four months, from June to November 2011. With amounts that large, it goes without saying that the manager of this attack takes great pains to cover his or her tracks. The manager consistently removes the logs and money transactions to ensure that if caught, it will be much harder to prove the total amounts actually stolen.
Some information about this scam is still missing. For example, the cybercriminals operate two Trojan bankers (one is currently not active) that report to the following domains:
Interestingly, less than a year ago, users complained that while accessing bank websites, the browser also accessed the following websites:
The second server is still online and serving the malicious Java scripts that were injected into Web pages of some of the banking websites.
Trustwave SpiderLabs researchers believe that we have uncovered only a small part of this cybercrime gang’s operation. We expect to see much more in the future.
The Trustwave Secure Web Gateway (SWG) helps protect users against this attack. It blocks access to Web pages with injected content by the Blackhole exploit kit. In addition, the file with JPG extension, which is part of this attack and is actually the configuration file of the Trojan, will be blocked as spoofed content. Lastly, the Trustwave SWG would block the Trojan because it is not digitally signed.
Once again, we witness a large cybercriminal attack that is attributed to the same cybercrime gang responsible for the August 2010 Zeus Trojan that we reported in “Cybercriminals Target Online Banking Customers”[1]. These cybercriminals continually seek new techniques for spreading malware, and eventually they succeed. They have managed to bypass every security layer on both the user’s PC and the banking fraud detection system.
The Trustwave Security Web Gateway protects clients from being exploited by these cybercriminals by blocking the malicious Web pages presented in this scenario.
___________________________________________________________________________
1. Fake Facebook Friend Request Leads to ZeuS via BlackHole Exploit Kit, StopMalvertising.com, Aug. 22, 2011
2. Cybercriminals Target Online Banking Customers, M86 Security Labs, August 2010
http://www.finextra.com/news/fullstory.aspx?newsitemid=22482
http://forum.linode.com/viewtopic.php?p=38271
This is the fourth part in a series of blogs. The prior blogs describe the technical details of the tools and the techniques used by the cyber gang to gain control of the infected machines.
“Catch Me If You Can” Trojan Banker Zeus Strikes Again (Part 3 of 5)
In this blog we will examine the Zeus Trojan banker process and take a further look at its control panel and the source code of its command and control server.
Once the Zeus Trojan Banker variant is downloaded and installed on the victim’s machine, it attaches to system processes (Explorer.exe, ctfmon.exe) and copies itself into the ”Application Data” folder of the user’s personal folders. One of many registry changes made by the Trojan is adding itself to the following key:
“HKU\Software\Microsoft\Windows\CurrentVersion\Run”. This allows the Trojan to run every time the PC reboots.
Figure 1: VirusTotal results 8/42 for the packed Zeus malware
Figure 2: VirusTotal results 6/42 for the Zeus malware, after unpacking UPX
The anti-virus results are low because the Trojan is easily replaced every couple of days with a new undetected variant.
The second phase of the malware involves downloading a configuration file from secondconcert.ru (46.180.70.139), hosted in Shenyang (China) according to the GeoIP database, though the core of this cyber-criminal attack operation is located in Moldova.
Figure 3: Zeus hooks on “Explorer.exe” process and accesses its C&C server
Figure 4: Zeus accesses its C&C and downloads new encrypted configuration
This botnet works in a clean and tidy fashion, which helps it stay under the radar for several months. The Zeus first accesses a server that is unrelated to the master C&C server. Moreover, the configuration file is delivered only to machines located in the U.K. to evade unnecessary traffic, and more importantly, to bypass security research analysis using techniques like sandboxing.
Figure 5: Access of “JPG” file not from the U.K.
The screenshot above describes one of the evasive techniques driven by the cybercriminal group. Accessing the configuration file from outside of the U.K. will result in a 404 “Page not found” error.
The configuration file is downloaded by the Trojan and contains a list of websites that are monitored by the bot. The bot sends cookie and credentials information that pertain to those sites. The Trojan monitors access to approximately 30 banking websites and several leading websites; it targets the most familiar banks in U.K.
The cybercriminals develop or purchase Zeus plug-ins for each bank. In order to manipulate the transactions committed by the user, the cybercriminals prefer to avoid modifying the original Web pages using the bot, so they download a JS file instead. This way, the script is more flexible and can be modified easily without “touching” the hooked code on the browser’s processes. Once the user accesses one of the bank sites from the above list, two scripts are injected at the bottom of the Web page. One is taken from the C&C server, and the second one is JQuery API that is taken from the Google website (“googleapi.com”) and is used for auxiliary functions.
Figure 6: Code injected to one of the bank Web pages
Figure 7: Fiddler dump, describing the browser access to the hostile server
Once the user intends to transfer money from one account to another, the Zeus Trojan accesses the C&C server and requests a money mule. Money mules are people who receive transfers from compromised bank accounts and forward them to the cybercriminal group. Money mules are sometimes unaware that they play part in a crime, as the “job” is described benignly as a “Financial Agent” by the cybercriminals. We identified nearly 1,500 unique names of money mules in the server logs from this attack (for all banks combined).
The APACHE log below is taken from the original malicious web server. It shows a report sent by the Zeus Trojan running on compromised machines.
Figure 8: A report snippet from the malicious web server
The data sent from the user is base64 encoded. After decoding it shows:
Figure 9: Decoded transaction information
Decoding this content uncovers further details regarding the communication between the Trojan and the C&C server. Every request transmitted by the Trojan holds a unique ID – “uuid.” Along with its own ID, the Trojan sends a desired operation in the “action” field. The code above describes a request by the Trojan to receive money mule account information (that the money will be transferred to). It also sends the user’s account balance to the server.
The C&C server selects the appropriate money mule based on the information from the client:
Figure 10: Server side PHP code for selecting the money mule
The code from the server, shown below, includes the algorithm that calculates how to select a money mule from the database. The script determines the minimum and maximum amounts the victim can send and that the money mule can receive. Afterwards, it picks a random amount within this range and sends it back to the calling function. The script above removes irrelevant data from the “worker” object, encodes it in JSON format and sends it back to the Trojan. It locks the money mule to ensure it won’t be used at the same time by a different Trojan until the transaction is complete.
Figure 11: PHP server side code, money calculator generator.
Figure 12: Control panel, money mule tab (Worker)
The screenshot above is taken from the original control panel of the administrator. The manager adds money mules delivered by his suppliers (under “master name”), and the system pulls the money mule according to the configuration: the selected bank and the amount that can be delivered.
Using the injected JavaScript we mentioned earlier, the Zeus Trojan monitors every step taken by the user during her bank activity.
Figure 13: Snippet code from the downloaded JS file.
As shown by the marked code above, the process is divided into controlled steps, while the last step (step 4) is the actual transaction confirmation: “Your payment has been sent.”
Figure 14: A server log entry indicating a successful transaction
The Trojan updates the C&C server with every step that is committed by the user during the money transfer. The log above shows a successful transaction manipulated by the Trojan with the name of the money mule chosen to be beneficiary of the money transfer.
Figure 15: Control panel, operation section.
The manager is able to watch all the successful transactions of each Trojan, along with the amounts that were transferred to the money mules. The system used to control this scam is not part of any known malicious pack, and it seems it was built specifically for this operation. The code on the server is updated on a daily basis.
In the next and the last blog in this series, we will show the distribution and damage which was caused by this cybercrime attack.
