IEEE Internet Computing - Dissecting the State of Underground Enterprise

Our paper on "Dissecting the State of Underground Enterprise" is finally out in IEEE Internet Computing.

Abstract: "Cybercrime's tentacles reach deeply into the Internet. A complete, underground criminal economy has developed that lets malicious actors steal money through the Web. The authors detail this enterprise, showing how information, expertise, and money flow through it. Understanding the underground economy's structure is critical for fighting it."

Its available here: http://www.computer.org/csdl/mags/ic/2013/01/mic2013010060-abs.html.

Hack In The Box (HitB) Magazine : A Journey of Learning and Sharing

I finally get some time to talk my ( and other team members) journey as a contributor and author for Hack-in-the-Box (HitB) magazine. At this point, HitB ezine has completed more than two years. It's been a great time working with the HitB crew especially Zarul and Dhillon. In addition, Mateusz “j00ru” Jurczyk
Gynvael Coldwind is also contributing a lot. I have been writing for this magazine right from the first edition. It has been a great time of sharing and learning in the last two years. I want to talk about the content that I have written in the last nine editions with a support from my different colleagues.

Edition 1: (Paper) - Malware Obfuscation: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-001.pdf - The first edition was released in January 2010. In this edition, I wrote a paper with Wayne Huang of Armorize on malware obfuscation tactics with an additional support from Fyodor Yarochkin. We discussed several malware obfuscation tactics and how to deobfuscate them manually.

Edition 2: (Paper) - Open Redirect Wreck Off - Web Traffic Forwards: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-002.pdf - The second edition was released in April 2012. In this edition, I presented the complete details of traffic redirection in web applications and websites using real time code snippets collected during open research.

Edition 3: (Paper) - Chinese Malware Factory - Paradox of MS Office Based Malware: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-003.pdf - The third edition came out in July 2010. In this edition, I wrote about my research on MS office based Chinese malware that uses word, excel, etc. files to spread malicious code by exploiting inherent vulnerabilities in the requisite software component.    

Edition 4: (Paper) - Notorious Data-center Support Systems: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-004.pdf - The fourth edition came out in October 2010. In this edition. I wrote a collaborative paper with my colleague Rohit Bansal on vulnerabilities present in the support center web applications that can directly result in gaining access to different virtual hosts.

Edition 5: (Paper) - Exploiting Web Virtual Hosting - Malware Infections: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-005.pdf - The fifth edition was released in February 2011. In this paper, I wrote a paper collaboratively with my colleague Rohit Bansal and my adviser Dr. Enbody and presented about the techniques of infecting virtual hosts present on the same host.

Edition 6: (Paper) - Botnet Resistant Coding: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-006.pdf - The sixth edition came out in June 2011. I released a paper with my colleagues Peter Greko, Fabian and my adviser Dr. Enbody to present on the concept of botnet resistant coding.  In this edition, we talk about a generic approach of coding to subvert the automated log harvesting process in C&C panels.

Edition 7: (Paper) - Extending SQL Injections using Buffer Overflows: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-007.pdf - The seventh edition was released in October 2011. In this edition, I wrote another paper collaboratively with my colleague Rohit Bansal and my adviser Dr. Enbody on the issue of exploiting blind sql injections in web applications that encounter 500 error by using buffer overflow technique. This tactic was developed by Rohit itself.

Edition 8: (Paper) - Exploit Distribution Mechanism in Browser Exploit Packs: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-008.pdf - The eighth edition came out in April 2012. In this edition, I wrote collaboratively with Dr. Enbody on the techniques of exploit distribution in browser exploit packs such as BlackHole, Phoenix, etc.

Edition 9: (Paper) - Game of Windows 32/64 System Takeover - Bot Wars : http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-009.pdf - The ninth edition was released in November 2012. I detailed on the concept of bot wars in which one bot kills other to gain complete access of the infected system.

HitB Magazine is a great place to talk about hacking techniques. I hope this continues and I wish to contribute more in the coming time.

So, Hack the Box. Cheers ! 

Virus Bulletin Papers Added to Respository

We have added the papers to our repository. The newly added ones are:

1. ICE IX Analysis: http://secniche.org/released/VB_ICE_IX.pdf

2. Winlocker Ransomware Analysis: http://secniche.org/released/VB_WINLOCKER.pdf

3. Malware Strategies - Part 1: http://secniche.org/released/VB_MAL_DET_STR_PART1.pdf

4. Malware Strategies - Part 2: http://secniche.org/released/VB_MAL_DET_STR_PART2.pdf

Enjoy !

Elsevier Network Security : Abusing Glype Proxies

Update : 29th April 2014

Download : Paper available here: http://www.slideshare.net/adityaks/abusing-glype-proxies-exploits-and-defences

Our paper on "Abusing Glype Proxies: Attacks, Exploits and Defenses" are out in Elsevier Network Security.

Abstract: Proxies play a critical privacy role because these are widely used for anonymous surfing and identity cloaking on the Internet. In addition, proxies also assist in traffic filtering, traffic management, log auditing, access policies and surfing restricted sites. There are several types of proxies available, but the Glype HTTP proxy is used extensively.

The Glype open-source HTTP proxy is used extensively. However, proxies can be transformed into attack platforms for exploitation. 

Fetch: http://www.sciencedirect.com/science/article/pii/S1353485812701125.

Enjoy!

HITB EZine : Bot Wars - The Game of Win32/64 TakeOver

Botnets have been in existence for years. Third Generation Botnets (TGB’s) use sophisticated attack vectors to infect users at a large scale. Botnets are cyber weapons that can jeopardize the integrity and security of the critical infrastructure on the Internet. There is an insidious war going among different generations’ of botnets to exploit the target systems. This concept is termed as bot wars. This article explores the details of bot wars and how the bots kill each other to control the infected systems.

The paper is out in the 9th edition of HITB Ezine. Fetch the magazine from here: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-009.pdf

Attribution - Team Cyberthack and The Game of Facebook Phishing Attack - Tracking Back

This Facebook case study is an interesting one and based on the ongoing Facebook phishing attack leading to malware. Interestingly, the attack seems to be launched by the Indonesian and Spanish hackers considering the languages used in the deployed code. Our team came across a Facebook phishing email embedded with a video and other malicious links. Every single URL pointed to a same domain. The Facebook message embedded in the email carried a notification message that says something as follows:

""Miiiii lindoooo! Ahahahaha this videoo muestrezzz not what to nadiesss = $ $ $ $ ZIII? Tiii is for! Because? Yoooo muxiiiisisisisizimoooo amoooo you! Muxo like me will I require your videooo montonezzzz!! porfiz when estez at ............ "Read more This video was ranked No one under 18." 

The original message is presented below:

"Miiiii lindoooo!!! ahahahaha este videoo no se lo muestrezzz a nadiesss =$$$$ ziii ?? es solo para tiii!! porque ? yoooo te amoooo muxiiiisisisisizimoooo!!! me gusto muxo tu videooo te requiero montonezzzz!!!! porfiz cuando estez en. ..... . ....." Leer mas

Este video fue clasificado Prohibido para menores de 18 años .

The phishing email was structured like as shown below:

Before looking into the kind of malware served by this phishing attack, let's dissect the other relevant information gathered from this malicious domain. The facts are discussed as follows:

1. The domain was compromised by the Cyberthack Team.

2. On analyzing further, we got an information that was embedded somewhere in the web pages about the profile of a user. We cannot say this profile is legitimate or fake at this point of time but, it is worthwhile to look into this. The profile is presented below:

3. Some of the JavaScripts that are used in this malware domain are taken from the - http://cirebon-cyber4rt.blogspot.com/. Guys, tt is always good to remove the comments when you are doing this kind of job.

4. Again, a configuration flaw in the web server running on this malicious domain allowed us to access the
a custom statistics page that pointed out the visitors visiting that link. It is shown below:

The language used in this page is Spanish. It is easy to decipher the number of visitors that visited this page

5. The malicious link downloaded facebook.exe executable on the victim machine. Some of the facts

    are listed below:

5.1 The malicious program is written in Visual Basic.

5.2 No packer is used to pack the critical sections. No code obfuscation is used.

5.3 The malicious program used a reference to TortoiseBlame -http://tortoisesvn.tigris.org/blame.html. 

      It seems like the malware tries to look legitimate.

5.4 The malware executes silently in the system and on successful installation, opens facebook.com web 

      page.

5.5 The malware creates wincal.exe in the %systemroot% folder and uses registry to load it. It is again a 

      Visual Basic file. 

For additional check, the virus total analysis is here: https://www.virustotal.com/file/a64c6d344626ca983979042485a2b8b271ae08f1e411511227700591c2418ac1/analysis/

Stay secure. 

Note: This attack is still active.

Did You Order HDTV from Amazon? - Yes | No, Phishers Targeting Amazon Brand !

The concept is the same so as the attack. This time attackers are using Amazon brand to spread infections on the Internet. The phishing email is drafted really well and shows that an order of ne product (HDTV) has been processed.  The email looks like as follows:

 

The browser is redirected to the web page showing the notification as follows:

The script looks like as shown below:

The deobfuscation results in the following code.

Again, the iframe loads content from third-party domain hosting Browser Exploit Pack (BEP). The interesting fact is that, we received a number of emails within a span of time. Every new phishing email has a new embedded URL as follows:

hxxp://shuraki.com/wp-admin/hdtvamazon.html [WordPress]

hxxp://swishmedia.ca/clients/amazinhdtv.html [Generic]

hxxp://tainguyenso.com/admincp/amazinhdtv.html [V Bulletin]

These emails look very genuine and authentic. It is highly advised that to be paranoid and think twice before interacting with these emails.

Check previous post about LinkedIn Phishing Attack - http://secniche.blogspot.com/2012/08/linekedin-invitation-phishing-blackhole.htmlhttp://secniche.blogspot.com/2012/08/linekedin-invitation-phishing-blackhole.html

Elsevier's Computer Network Journal - Understanding the Design of SpyEye Botnet

We have contributed a paper on complete details of SpyEye design in Elsevier's Computer Network journal.

Abstract: "Botnet malware is improving with the latest (3rd) generation exemplified by the SpyEye and Zeus botnets. These botnets are important to understand because they target online financial transactions, primarily with banks. In this paper, we analyze the components from multiple generations of the SpyEye botnet in order to understand both how it works and how it is evolving. SpyEye is a sophisticated piece of malware with a modular design that eases the incorporation of improvements. We will discuss in detail the complete framework of SpyEye botnet consisting of the Bot Development Kit (BDK), the plugin architecture, the backend storage server, the bot design and the web-based Command and Control (C&C) management system. In addition, we also examine the techniques used by SpyEye to steal money."

The paper is still in press but can be found at: http://www.sciencedirect.com/science/article/pii/S1389128612002666.

Enjoy!

Insidious Banking Malware and Proxy-auto Config (PAC) - A Step towards Mal-Proxying

Recently, our team came across an interesting sample of banking malware which exploits the proxy-auto-config (PAC) functionality in the browsers. Let's see what we have:-

What is PAC?
PAC is a technique to implement proxy configurations based on the rules provided in the configuration file. The browser chooses the appropriate proxy server for the configured URLs. PAC is implemented in a sandbox and few JavaScript functions are allowed to be used in the PAC files. For more details about PAC, the excellent resource is here - http://findproxyforurl.com/why-pacwpad/ . PAC uses FindProxyForURL() function to implement this functionality. Have a look at one of the example listed here: http://findproxyforurl.com/example-pac-file/.

Why malware uses PAC?
The concept is straightforward. On the infected machine, the malware downloads the obfuscated PAC file from the server. This allows the malware authors to force the rules defined in the PAC file on the active browsers. It means the malware can push the browser to choose a proxy server based on the URL rules configured in the PAC file. In simpler terms, if a user tries to open a banking website, the browser connects to the proxy server and the traffic is routed through it.

Let's look into the PAC file used by the banking malware:

The file contained an array of elements in the hexadecimal format. The next step is to see what is hidden behind this. Removing "\x" and applying hexadecimal to ASCII converter, we get the elements as shown below:

So as expected, we get the domains configured in the PAC file. Whenever, a user opens the domain listed above, the browser connects to the given proxy server and routes the web traffic through it. Interesting !. Let's look at the implementation of FindProxyForURL() function.

The above-referenced code uses shExpMatch - which attempts to match hostname or URL to a specified shell expression, and returns true if matched. More details can be found here: http://findproxyforurl.com/pac-functions/. 

var _0x355ax4=_0x4919[0] : refers to the first element in the array which is the "PROXY 46.23.77.172".

if(shExpMatch(_0x355ax3,_0x355ax6)){return _0x355ax4;}; - you know what it means :) . If the domain is matched then force the browser to connect to the given proxy server. The same process goes for the rest of the provided rules.

This shows that how exactly the malware uses the PAC concept for malicious operations.

Enjoy!.

Malicious Domain Attribution - The Criticality of Timing

In this post, we are going to talk about the importance of time factor in attribution of malicious domain. The  "malicious domain attribution": it means the different set of characteristics that are mapped or analyzed to gain control of the malicious domain. It is very critical from analysis perspective. Yesterday, we had a very interesting case about the malicious domain attribution. There are certain facts that are required to be understood for executing reverse attacks on the malicious domains. We have found that timing plays a crucial role in successfully attributing the malicious domains. What happened exactly ?

Step 1: We received a FedEx Phishing email embedded with some malicious links.
Step 2: The source of the phished email was analyzed and related information was collected.
Step 3: The links were traced to understand the source of the problem.
Step 4: The browser was redirected to malicious domain (First Hop) having obfuscated code in it.
Step 5: The obfuscated code was deobfuscated and we were served with a dynamic iframe code.
Step 6: On tracing the source in malicious iframe, the browser fetched an obfuscated code from      
             the BlackHole - Browser Exploit Pack (BEP) hosted on other domain (Second Hop).
Step 7: The code served by BlackHole BEP was again obfuscated, which on deobfuscation provided
             a plugin detection JavaScript that fingerprinted the versions of various installed plugins.
Step 8: A malicious JAR was framed inline during fingerprinting of the browser plugins.
Step 9: On successful exploitation of a Java vulnerability, an executable file was served.

Actors - BlackHole, Cridex Trojan.
Compromised Domains - Word Press website.

The communication flow is presented below:

Interesting Technique: HTTP Parameter Iteration
It is a simple technique in which HTTP parameters are iterated with different numbers to see if we get a different output or not. For example:- this technique is fruitful when the analyst wants to verify that a malicious link allows different files to be downloaded from the same URL. Sometimes this technique is worth giving a shot. We followed the same process and got same executables with different names as shown below:

We have the executable files, the JAR files and other information. At this point, the complete infection scenario is presented. What else? Do we have to stop here after the analysis? We don't believe so. What should be the target now? Exactly- finding vulnerabilities in the server hosting malicious websites. Fortunately, we found a vulnerability in the server that allow us to access a PHP shell on the server as follows:

We started looking for configuration files as shown below:

After all this point, we had an access to server (First Hop) hosting the initial infection page. But, this process did not came out to be that fruitful as we were expected.  We were in hurry to find the access information or other critical data that provided us with complete control. Unfortunately, this time the attacker was still active on the malicious domain. As a result, within no time, we were getting forbidden messages ( no further access to the server). Ofcourse, the attacker came to know that the server has been compromised.  The attacker removed the content from the server. The result is shown below:

That's the complete information of the case that we encountered recently. Now the questions, thinking points and lessons to be learned are as follows:

1. Time window plays a critical role in these types of cases. 
    Do we have to act stealthy? Should we wait for sometime if we get an access to the malicious
    server?

2. The time gap (window) or reaction time definitely impacts the analysis.
    Is this right to explore the malicious server right away without waiting?

At this point, we believe that it is a problem of choice, a kind of double edged sword.But for sure, we made a choice not to wait further and act in a dormant manner. Our decision was not that fruitful but it helped us to learn the importance of time window in performing attribution of malicious domains.

If you have other views, please share :) We will be more than happy to discuss our experiences.