Targeted Cyber Attacks Book - Syngress !

Update: A very insightful review of the book published in Network Security.

Network Security : Book Review : Targeted Cyber Attacks : Aditya K Sood

I started sketching this book about a year ago when I was invited by Syngress for this project based on my previous work on crimeware research. Thanks to the Syngress and Elsevier team for this step. Due to my ongoing job and commitments,  the project got delayed but eventually the book is about to be published on 18th April. The first edition of the book is dedicated to the readers who are interested in understanding the artifacts of targeted cyber-attacks and associated components. Personally, I would like to thank all the researchers and journalists who reviewed the book and provided positive feedback.

Introduction: Cyber-crime increasingly impacts both the online and offline world, and targeted attacks play a significant role in disrupting services in both. Targeted attacks are those that are aimed at a particular individual, group, or type of site or service. Unlike worms and viruses that usually attack indiscriminately, targeted attacks involve intelligence-gathering and planning to a degree that drastically changes its profile.
Individuals, corporations, and even governments are facing new threats from targeted attacks. Targeted Cyber Attacks examines real-world examples of directed attacks and provides insight into what techniques and resources are used to stage these attacks so that you can counter them more effectively.

The book is available to be ordered at following places:

• Amazon: http://www.amazon.com/Targeted-Cyber-Attacks-Multi-staged-Exploits/dp/0128006048
• Kindle Edition: http://www.amazon.com/Targeted-Cyber-Attacks-Multi-staged-Exploits-ebook/dp/B00JRVB3UY
• Elsevier: http://store.elsevier.com/Targeted-Cyber-Attacks/Aditya-Sood/isbn-9780128006047/
• Barnes and Noble: http://www.barnesandnoble.com/w/targeted-cyber-attacks-aditya-sood/1118602703?ean=9780128006047

Note: Elsevier Store will offer electronic versions that are readable on Kindles in PDF and MOBI format.

Enjoy !

Malware Retrospective - Infected Chinese Servers Deploy Metasploit Exploits

It's been a time that our team blogged about malware and other interesting information. Today, we got some time to talk about one of the case that we analyzed while testing a few tools of our own. We prefer to construct custom scripts and tools to automate the process of web malware analysis. Recently, we tested our tool, a simple parser which fetches the scripts, iframes, embed tags present in the remote web pages for faster analysis. We came across a set of malicious domains that were serving an exploit which used JavaScript heap spraying technique to execute payload using drive-by download attack. Well, that's a common technique of silent browser exploitation. But, what was not common is the issue that is discussed below.

The malware domain was hosting an exploit for MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption. More details can be read here: MS12-043. Without any surprise, the IP address of that domain belonged to China as shown below:

Our surprise did not end here. As the exploit of this vulnerability was released last year, it raised our interest to check how the exploit code is structured.  When the exploit code was traced, it was nothing more than a sweet shock. The Chinese domain used the same exploit code hosted on the Metasploit repository for the concerned vulnerability. Now the question: Is it possible that Chinese malware authors simply deploy Metasploit exploits for easy infection process? It could be. Who knows whether the domain was infected by Chinese or it belonged to others. In addition, it is hard to say who hosted that malware but clearly, the servers were present in China.

The exploit for this vulnerability can be found in Metasploit here: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb.

A simple check on the one of the code snippet used in the malware domain and legitimate Metasploit repository is shown below:

   

The exploit code was used in conjunction with the JS code hosted here: http://js.users.51.la/15240615.js.

This code dynamically generates the information about the visitor and creates log details for statistical purposes.

We remember that a few traces have been detected earlier where Phoenix exploit kit used the one of  the same exploit present in the Metasploit. Refer: Gangsterware. 

The conclusive points are:

• Metasploit provides neat exploits which are easy to deploy and use.
• The evidence shows that malware authors are using Metasploit exploits.

Well, Reality bites !