SlideShare a Scribd company logo

Threat report h1_2013

Комсс Файквэе, profile picture
Комсс Файквэе

The document provides an overview of cybersecurity threats in the first half of 2013. Key points include: - Exploit attacks targeting known Java vulnerabilities accounted for about half of all detections, focusing on CVE-2013-1493 and CVE-2011-3544. - The ZeroAccess botnet was active spreading via exploit kits and Java exploits, with potential monthly profits from Bitcoin mining estimated at over $50,000. - Ransomware called "Anti Child Porn Spam Protection" circulated in March and April. - APT attacks often use specially crafted documents as bait targeting people in specific organizations or fields. - The first Android malware spread through spam emails was

Technology
1 of 50
Downloaded 23 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
Threat Report Protecting the irreplaceable | www.f-secure.com H1 2013
F-Secure Labs At the F-Secure Response Labs in Helsinki, Finland, and Kuala Lumpur, Malaysia, security experts work around the clock to ensure our customers are protected from the latest online threats. At any given moment, F-Secure Response Labs staff are on top of the worldwide security situation, ensuring that sudden virus and malware outbreaks are dealt with promptly and effectively. Protection around the clock Response Labs’ work is assisted by a host of automatic systems that track worldwide threat occurrences in real time, collecting and analyzing hundreds of thousands of data samples per day. Criminals who make use of virus and malware to profit from these attacks are constantly at work on new threats. This situation demands around the clock vigilance on our part to ensure that our customers are protected.
3 f-secure | h1 2013 threat report In 2008, a mathematician called Satoshi Nakamoto (a pseudonym) submitted a technical paper for a cryptography conference. The paper described a peer-to-peer network, where participating systems would do complicated mathematical calculations on something called a “blockchain.” This system was designed to create a completely new currency — a crypto currency — which is based on math. The paper was titled “Bitcoin: A Peer-to-Peer Electronic Cash System.” Since Bitcoin is not linked to any existing currency, its value is purely based on the value people believe it’s worth. And since it can be used to do instant transactions globally, it does have value. Sending Bitcoins around is very much like sending e-mail. If I have your address, I can send you money. I can send it to you instantly, anywhere, bypassing exchanges, banks and the tax man. In fact, crypto currencies make banks unnecessary for moving money around. Which is why banks hate the whole idea. The beauty of the algorithm behind Bitcoin is solving the two main problems of crypto currencies by joining them — how do you confirm transactions, and how do you inject new units of currency into the system without causing inflation. Since there is no central bank in the system, the transactions need to be confirmed somehow. Otherwise one could fabricate fake money. In Bitcoin, the confirmations are done by other members of the peer-to-peer network. At least six members of the peer- to-peer network have to confirm the transactions before they go through. But why would anybody confirm transactions for others? Because they get rewarded for it: the algorithm issues new Bitcoins as a reward to users who have been participating in confirmations. This is called “mining.” When Bitcoin was young, mining was easy and you could easily make dozens of Bitcoins on a home computer. However, as Bitcoin value grew, mining became harder since there were more people interested in doing it. Even though the dollar-to-BTC exchange rate has fluctuated, the fact remains that in the beginning of 2013, one Bitcoin was worth USD 8 and by the fall they were worth USD 130. So Bitcoins now have real-world value. Today, there are massively large networks of computers mining Bitcoins and other competing crypto currencies (such as Litecoin). The basic idea behind mining is easy enough: if you have powerful computers, you can make money. Unfortunately, those computers don’t have to be your own computers. So, you’d have an infected home computer of a grandmother in, say, Philadelphia, running Windows XP at 100% utilization around the clock as it is mining coins for a Russian cyber crime gang. As detailed in this Threat Report, the second largest botnet in the world is already doing this. We estimate them to make over $50,000 a day by mining Bitcoins on infected computers. If such operations are already happening today, it’s easy to see that such mining botnets will become very popular for online criminals in the future. foreword “The basic idea behind mining crypto currencies is easy enough: if you have powerful computers, you can make money.“ Mikko HyppÖnen Cro, f-secure labs http://twitter.com/mikko FOREWORD
4 f-secure | h1 2013 threat report Executive Summary executive summary Applying security patches can be compared to putting locks on your doors and windows upon hearing the news of burglars lurking around town. But the problem is there are so many burglars out there and you have so many doors and windows to secure - you don’t know which exact way they will enter your house. You can patch the holes one after another, but the burglars will keep on trying. It sounds like a plot of a thriller movie but it is not a farfetched story considering our dependence on computer devices nowadays. The bad guys are always on the lookout for any vulnerabilities - the holes in the wall that can be exploited. Exploit attacks against known vulnerabilities are everywhere and Java-targeted ones are leading the pack. In the previous half-year, Java-targeted exploits accounted for about one- third of the detections reported to our cloud-based telemetry systems from our protected clients; in the first half of this year, they made up almost half of the detections reported. The Java exploits mostly targeted the CVE-2013-1493 and CVE-2011-3544 vulnerabilities, while an exploit for the Windows TrueType Font vulnerability CVE-2011-3402 makes up 10% of the Top 10 Detections reported globally (a 4% increase for the same exploit from H2 2012). We also look into the exploit kits being used to facilitate most of these attacks, particularly Blackhole, SweetOrange and Cool. The whole point of carrying out an exploit-based attack is to install malware onto a system - be it ransomware, bots, banking trojans or backdoors. We noted that “Anti Child Porn Spam Protection” ransomware was circulating during March and April this year. The ZeroAccess botnet was quite active as well during the same period, even though our statistics seem to show the number of ZeroAccess infections drastically declining. This is probably due to the effectiveness of our Majava detections, which successfully prevented attacks that would otherwise have delivered ZeroAccess. With the recent peak in Bitcoin’s exchange rate, we tried making an educated guesstimation of ZeroAccess’s potential monthly profit from Bitcoin mining activity. And the number is huge. One exploitation method used Advanced Persistent Threat (APT) attacks involves specially crafted‘bait’documentsenttotargetedpersonsinanorganizationorfield.Ananalysisofsuch APT documents reveals, among other things, that the most common subjects are political, corporate, and military in nature. On the mobile threats side, Android is still the most popular target, as almost all mobile malware that we encountered during this half-year period operate on this platform. A technically interesting mobile threat we cover in this report is Stels, the first Android malware to be distributed via spam e-mails, and a bot that uses Twitter to update its command and control (C&C) server addresses. On the Mac side of things, during H1 2013 we encountered an interesting malware called Kumar in the Mac (KitM). It is the first Mac malware signed with a valid developer ID. Talk about arrogance. More details on page 40 More details on page 14 More details on page 18 More details on page 34 More details on page 26 More details on page 36 More details on page 30 More details on page 23
5 f-secure | h1 2013 threat report This Threat Report highlights trends and new developments seen in the malware threat landscape by analysts in F-Secure Labs during the first half of 2013. Also included are case studies covering selected noteworthy, highly-prevalent threats from this period. Contents contents foreword3 Executive Summary 4 Contents5 Incidents Calendar 6 In Review 7 Of Note 10 watering holes 11 Case Studies 13 Stels14 Android18 APT Attacks 23 Ransomware26 Crypto currency Mining 30 Exploit KITS 34 Vulnerability Exploitation 36 Kumar in the Mac (KitM) 40 Phishing44 Sources47 contributing AUTHORS Broderick Aquilino Karmina Aquino Christine Bejerasco Edilberto Cajucom Su Gim Goh Alia Hilyati Timo Hirvonen Mikko Hypponen Sarah Jamaludin kamil leoniak Chin Yick Low Jarno Niemela ZIMRY ONG Mikko Suominen Sean Sullivan ANTTI TIKKANEN
6 f-secure | h1 2013 threat report Incidents Calendar incidents calendar Sources: see page 47-48 Feb Mar Apr May Jun FBI Microsoft take down Citadel botnet Jan Wiper malware attacks reported in South Korea NSA PRISM program leaked Red October infrastructure shut down Stels Android trojan spread by Cutwail botnet US jails LulzSec hacker for Sony breach Cool/Blackhole exploit kit author purchasing exploits Interpol shuts down ransomware network Twitter, Apple, Facebook others hacked Hacks Espionage Android SMS trojans target South Koreans Spam site targets only mobile devices Syrian Electronic Army hacks the Onion Evernote hacked CVE-2013-2423 exploit in the wild CVE-2013-1347 exploit in the wild Yahoo! Japan data breach suspected Twitter offers multi-factor login UK jails 3 LulzSec hackers for “50 days of lulz” SafeNet espionage reported Microsoft offers standing bug bounty Op’ NetTraveler espionage reported US FCC approves Anti-bot Code for ISPs Naikon attacks in Asia reported Advanced Obad Android trojan reported US, UK Vietnam break up credit card fraud ring mobile malware development Taiwan CIB arrests 1 for Ghost RAT attack Spamhaus hit with massive DDOS attack Spamhaus DDOS suspect extradited to Netherlands security Enforcement Android malware in targeted attack on Tibetan activists Miniduke malware exploits CVE-2013-0640 CVE-2013-0634 exploit in the wild Malware development Signed Mac malware discovered at conference NYT attacks linked to China hackers
7 f-secure | h1 2013 threat report In review Updates in the threat landscape The first half of 2013 mostly saw the continued development of familiar threats we noted in our previous reports. Of special interest this half year: the increasing use of exploit-based attacks facilitated by exploit kits, particularly those targeted against the Java development platform; Bitcoin mining and its ramifications; increasing sophistication in mobile threats; the discovery of the first signed Mac malware; and profiling of phishing sites. Beyond the technical developments, cyber espionage, hacks and privacy concerns became big news during this period, as major news sites and tech companies reported significant infiltration attempts and revelations about the covert data-gathering programs by the United States’ National Security Agency (NSA) raised questions about online privacy. Based on the statistics from our cloud-based telemetry systems, which monitors detections globallyreportedfromclientsprotectedbyourproducts,themajorityoftheTop10Detections seen in the past six months (see page 9) involved exploits. Geographically, the United States and France saw the most exploit-based attacks. Nearly 60% of the Top 10 Detections involved attacks that used exploits, and 80% of those were targeted against the Java development platform. The statistics illustrate the increasing focus of attackers on exploiting Java to gain access to the user’s machines. Since it’s a hugely popular application, Java is almost certainly found in organizations involved in software development, and an even better real-world illustration of the platform’s ubiquitousness and its role as a entrypoint for attackers is the large-scale attack that took place during February this year, when various tech companies, including Twitter and Facebook, were reportedly hacked via a Java exploit [1] . Almost half of the exploit-based attacks reported by our clients were blocked by our heuristic Majava detections, which prevented the attacks from infiltrating the system and installing malware.Interestinglyenough,Majava’seffectivenesshadacuriousimpactonthestatisticsfor ZeroAccess detections reported by our clients, which when compared against the statistics for the same malware in the second half of 2012, saw a noticeable decline. Based on the very active developments we’ve seen for the ZeroAccess family during the last six months however, it would not be a stretch to assume that had those exploit attacks successfully occurred, most of the malware they dropped would have been ZeroAccess-related. Where we did see ZeroAccess-related detections being reported, they mostly occurred in the United States, France, Sweden and Italy. Mostexploit-basedattackswe’veseenarefacilitatedbyasmallhandfulofexploitkits,with70% of them being attributed to these five: BlackHole, SweetOrange, Crimeboss, Styx and Cool. The exploit kit development space has been highly active in the last few months, as we’ve observed at least one new (or revamped) exploit kit being created each month on average. The top five kits are also undergoing active development, with their authors constantly adding new exploits targeting recently announced vulnerabilities. Older vulnerabilities, for which security patches have already been issued, also continued to trouble users. Almost five years after the Downadup/Conficker outbreak, we still find it lingering on in Brazil. And even though our specific detection for exploits targeting the CVE- 2011-3402 vulnerability was created in 2011, two years on the number of clients reporting it haven’t reduced at all. In fact, it grew from 6% of all reported detections in the last half 2012 to 10% in this period (mostly in France, Germany and Sweden). The continuing detection of exploit threats that were discovered and addressed years ago again brings into question the effectiveness of current patching procedures, which too often leave users at the mercy of attacks against old, known loopholes. Anotherfieldthatcontinuestothrivedespiteusingknowntricksisphishing.Withconstruction kits now available that simplify the production of phishing sites, it has become even easier In Review CVE-2011-3402 A vulnerability in the Windows TrueType font parsing engine, which first gained notoriety when exploited by the Duqu malware in November 2011. More details on page 34 More details on page 36 Downadup/Conficker A worm that exploited a network service vulnerability in various versions of Windows to spread. More details on page 11
8 f-secure | h1 2013 threat report in review for phishers to operate, typically by using spam emails to lure victims onto these automatically created sites, where their personal details or money can be stolen. In a profiling of known phishing sites, we saw that the most common type of portals these sites mimic involve payment services, banks and gaming, with fake PayPal sites making make up almost 73% of the phishing sites we analyzed. Ransomware continues to make the rounds and in March and April this year we noted cases of ransomware particularly targeting corporate clients in countries such as Spain and Italy. Almost all the ransomware cases we saw during this half-year fell into two broadly different types: encrypting and police-themed, of which the latter is more common. As Mikko mentioned in his foreword, Bitcoin and Litecoin mining is one of the big money-making options for cyber-criminals. ZeroAccess’s on-and-off again relationship to Bitcoin has been interesting. Though the malware originally contained a module for Bitcoin mining, it was removed from samples we found last September. In April this year, the samples we saw had their Bitcoin payload reinstated, coincidentally just when Bitcoin’s monetary value went over USD 200 [2] . Since late April however, the malware’s mining facility has again been pulled. Why that is so is something of a mystery, though some speculate it is due to the high maintenance cost of private pool servers and the heavy computing power needed for Bitcoin mining, which makes the malware harder to hide on infected machines. We tried making an educated guesstimate* of ZeroAccess’ potential monthly profit from Bitcoin mining and came up with a figure of USD 1.8 million. On the Mac front, the February attacks were interesting because they also targeted Mac users, particularly employees of the Apple company, via a compromised mobile developer site [1] . Though attacks against Mac users aren’t unheard of, until now they had mostly been targeted against political activists—case in point, the signed Mac spyware found on an activist’s Mac at the Oslo Freedom forum in May[3] . Perhaps not coincidentally then, of the 33 new Mac malware families or variants we saw in H1 2013, 57.6% were backdoors. Given the scope and scale of the February attacks, and the speculations about its intended objective, they could arguably be considered Advanced Persistent Threat (APT) attacks. More commonly though, APT attacks involve bait documents, which are carefully crafted to appeal to usersinthetargetedorganization.Giventhenatureofthesefiles,mosttargetsareunderstandably reticent to share them with outsiders. An analysis of bait documents we were able to obtain allowed us make generalizations about their contents: for example, that the most common type of content related to political (65%), corporate (14%) and military (11%) subjects, while the most common languages were English, Chinese and Arabic. The analysis allows us to build a sketchy profile of the type of individual the documents were meant to lure. On the mobile threats scene, Google’s Android continues to be the most targeted mobile operating system, accounting for 96% of all new mobile malware families or variants we saw in H1 2013. Google’s Play Store also officially superseded Apple’s App Store this half-year to become the largestappmarket,surpassingtheonemillionappsmarkinJuly.Despitelingeringquestionsabout the Play Store’s security, it remains by far the safest Android app market around, as the majority of new Android malware we saw were found on non-Play Store sites. In terms of functionality, most of the mobile threats we’ve seen were either banking-trojans or were involved in malvertising. Banking-trojans, which typically steal Mobile Transaction Authentication Numbers (mTans), appear to be increasing as more banks shift to using this form of authentication to verify online transactions. In the last few months we’ve also noticed increased instances of malvertising— advertisementsleadingtositesthatdistributemobilemalware—bothin-appandonsitesaccessed during mobile web browsing sessions. And finally, of all the mobile threats we saw this half year, of particular technical note is Stels, the first (but probably not the last) Android malware to be spread via United States Internal Revenue Service (IRS)-themed spam distributed by the Cutwail botnet. Advanced Persistent Threat attack A stealthy, sophisticated and targeted infiltration of selected organization(s), often with a longer-term objective in mind. More details on page 44 More details on page 26 More details on page 30 More details on page 40 More details on page 23 More details on page 18 More details on page 14 * based on a conservative assumption that 5% of victims have systems powerful enough to perform Bitcoin mining. SOURCES 1. F-Secure Weblog; Sean Sullivan; Timeline: Hacks Related to Apple; published 20 February 2013: http://www.f-secure.com/weblog/archives/00002507.html 2. Bitcoin Charts; http://bitcoincharts.com/charts/mtgoxUSD 3. F-Secure Weblog; Sean Sullivan; Mac Spyware Found at Oslo Freedom Forum; published 16 May 2013; http://www.f-secure.com/weblog/archives/00002554.html
9 f-secure | h1 2013 threat report 45+14+12+10+7+7+2+1+1+1+t in review TOP 10 DETECTIONS AND THEIR TOP 10 COUNTRIES IN H1 2013, BY PERCENTAGE UnitedArabEmirates Spain Slovenia Taiwan Denmark UnitedKingdom Belgium Brazil Malaysia Romania Canada Philippines Kenya Algeria Indonesia Poland 17 36 9 34 16 13 14 27 38 All other countries 5% UnitedStates France Finland Sweden Germany Netherlands India Turkey Tunisia Italy Japan Majava, 45 Ramnit, 1 Sality, 1 CVE-2013-3544 exploits, 1 CVE-2013-1493 exploits, 2 ZeroAccess, 7 Autorun, 7 CVE-2011-3402 exploit, 10 Web-based attacks, 12 Downadup / Conficker, 14 % 28
Of Note watering holes 11
11 f-secure | h1 2013 threat report watering holes ofnote The most notable information security occurrence of early 2013 is undoubtedly the hacking and breach of several Internet giants (Twitter, Facebook, Apple, Microsoft) and of numerous other Silicon Valley companies via a watering hole at iPhone Dev SDK [6,7] . Significant, and yet, the general public appears to have learned few lessons regarding watering hole attacks as a result. Quite possibly because the companies involved kept and have continued to keep important details tightly under wraps. So what happened? The story started on February 1st with a blog post by Bob Lord, Twitter’s Director of Information Security, called: Keeping our users secure [2] . “…attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/ salted versions of passwords – for approximately 250,000 users.” Lord stated that passwords and tokens were being reset – normal breach operating procedure. But then, at the end of his post, Lord suggested “users to disable Java on their computers in their browsers” and stated the attack was not the work of “amateurs”. Lord’s post heavily suggested the cause of Twitter’s breach was due to a Java exploit via a browser. Knowing that Twitter has a high concentration of Mac users among its employees – we asked Apple for any related samples used in the attack – and were told that “Twitter hasn’t shared any samples”. And then… The story continued on February 15th when Facebook published a blog post called: Protecting People On Facebook[3] . “…Facebook Security discovered that our systems had been targeted in a sophisticated attack. This attack occurred when a handful of employees visited a mobile developer website that was compromised.” Compromised by a zero-day Java exploit via a mobile developer website – which was later revealed to be iPhone Dev SDK. Facebook security chief, Joe Sullivan, stated in an interview with Ars Technica that several other companies were affected. On the same day as Facebook’s post, Apple shared back door code (with no context) to an antivirus research mailing list. But the context seemed clear to us and we began to seek confirmation that the back door was related to the Facebook breach. On February 19th, Reuters broke the news [4] that Apple itself had been hacked which was later followed on the 22nd by Microsoft’s blog post called: Recent Cyberattacks [5] . Definition: Watering Hole attack [1] The attacker wants to attack a particular group (organization, industry, or region). The attack consists of three phases: Relying on websites the group trusts makes this strategy efficient even with groups that are resistant to spear phishing and other forms of phishing. www 1. Guess which websites the group often uses. 2. Infect one or more of these websites with malware. 3. Eventually, some member of the targeted group will get infected. of note
12 f-secure | h1 2013 threat report ofnote SOURCES 1. Wikipedia; Watering Hole; last modified 8 May 2013; http://en.wikipedia.org/wiki/Watering_Hole 2. Twitter, Bob Lord; Keeping our users secure; published 1 February 2013; https://blog.twitter.com/2013/keeping-our-users-secure 3. Facebook; Protecting People On Facebook; published 15 February 2013; https://www.facebook.com/notes/facebook-security/protecting-people-on-facebook/10151249208250766 4. Reuters; Jim Finkle and Joseph Menn; Exclusive: Apple, Macs hit by hackers who targeted Facebook; published 19 February 2013; http://www.reuters.com/article/2013/02/19/us-apple-hackers-idUSBRE91I10920130219 5. Microsoft; Recent Cyberattacks; published 22 February 2013; http://blogs.technet.com/b/msrc/archive/2013/02/22/recent-cyberattacks.aspx 6. NYTimes; Nicole Perlroth; Apple Computers Hit by Sophisticated Cyberattack; published 19 February 2013; bits.blogs.nytimes.com/2013/02/19/apple-computers-hit-by-sophisticated-cyberattack/ 7. F-Secure Weblog; Sean Sullivan; Timeline: Hacks Related to Apple; published 20 February 2013; http://www.f-secure.com/weblog/archives/00002507.html 8. F-Secure Weblog; Sean Sullivan; NASDAQ’s Community Forum; published 23 August 2013; http://www.f-secure.com/weblog/archives/00002595.html Criminals – but not crimeware The key takeaway from all of the breach disclosures should have been this: a dedicated group of criminals had managed to hack numerous Internet companies via a watering hole. The attack was targeted and required human labor – it wasn’t automated crimeware. But it didn’t need to be. For targets as valuable as Twitter, Facebook, Apple and Microsoft – the attackers were apparently more than willing to put in the man-hours. What have we learned? At this point, whenever we learn a website has been hacked – we ask ourselves this – was it just a regular data breach? Or would the site make for a good watering hole? But that doesn’t seem to be a question the public at large is asking. At least not based on the recent news of NASDAQ’s community forum being hacked[8] – but then… the news broke during the summer. Perhaps there’s more to that story. Time will almost certainly tell. of note
Case Studies Stels14 Android18 APT Attacks 23 Ransomware26 Crypto currency Mining 30 Exploit KITS 34 Vulnerability Exploitation 36 Kumar in the Mac (KitM) 40 Phishing44
14 f-secure | h1 2013 threat report Stels mobile Stels is an Android trojan that serves multiple purposes—it can turn an infected device into a bot that becomes a part of a larger botnet, and it can act as a banking trojan that steals mobile Transaction Authentication Numbers (mTANs). Stels made its debut in November 2012 and since then, different major versions of the trojan have been discovered in the wild. F-Secure has identified over 1,300 unique Stels samples that can be divided into three major variants. The samples of each variant were first seen on 15th November, 28th November and 9th December 2012 respectively. Each variant was identified by looking into the package name used in the original source code: ru.beta, ru.stels2, and ru.stels4. The internal version numbers found in the code and configuration files further verify that the ru.beta variant is version 1 and ru.stels2 is indeed version 2. The newer versions of Stels do not appear to be replacing the old ones as all three variants have been encountered simultaneously. Table 1: Backdoor commands seen in version 1 of Stels Command Functionality botId Change bot identifier catchSms Set which incoming SMS messages will be stolen (based on source phone number and message content) deleteSms Set which incoming SMS messages will be deleted (based on source phone number and message content) httpRequest Make an HTTP request makeCall Make a phone call notification Show a status bar notification openUrl Open a URL in the web browser removeAllCatch- Filters Stop intercepting incoming SMS messages removeAllSmsFil- ters Stop deleting incoming SMS messages sendContactList Collect contacts from the phonebook and send them to the CC server sendPackageList Collect the list of installed applications from the phone and send it to the CC server sendSMS Send an SMS message sendSMSLog Get SMS messages from inbox and sent messages folders and send them to the CC server server Change CC server address subPref Change the suffix added to SMS messages sent by the trojan twitter Update the name of the Twitter account used to distribute a new CC server infor- mation update Download and install an application uninstall Uninstall an application wait Wait for a specified time before contacting the server again to receive new commands Stels Main functionality The three Stels variants carry the same primary function, triggeredwhenthetrojanfetchescommandsfromacommand and control (CC) server. The commands are communicated via HTTP connection, and delivered in encrypted JavaScript Object Notification (JSON) files, which will be decrypted and parsed by the trojan later. Different commands provide different methods for the bot owner to profit from, e.g., sending premium-rate SMS messages and stealing device information. Stels’ ability to intercept incoming SMS messages allows it to steal the mTANs that banks send to their customers via SMS messages, thus defeating the two-factor authentication method used to validate an online banking transaction. The full list of commands seen in version 1 of Stels can be seen in Table 1. With the exception of ‘sendSmsLog,’ the same exact commands can be seen in version 2 of Stels, but in version 3 the commands appear to have undergone some changes, as can be seen in Table 2. While commands such as ‘subPref’ and ‘botId’ are not always present, all variants of Stels support commands relating to major functions, such as those that enable SMS theft and SMS sending. Table 3 shows the list of CC servers that Stels samples have been found to be communicating with. Each server is only in contact with one version of Stels, with a vast number of them contacting variants in version 2. There are probably several authors behind the different versions and variants of Stels, or at least more than one botnet with different owners. In addition to contacting the CC server, some variants of version 2 also use emails to keep in touch with the botnet owner. Once a week, these variants will email the following information to the attacker: • CC server’s URL • Name of the backup Twitter account • International Mobile Equipment Identity (IMEI) number • International Mobile Subscriber Identity (IMSI) number
15 f-secure | h1 2013 threat report stels mobile Table 2: Backdoor commands seen in version 3 of Stels Command Functionality call Make a phone call clearDeleteFilters Stop deleting incoming SMS messages clearListenFilters Stop intercepting incoming SMS messages deleteSMS Set which incoming messages will be stolen (based on the source phone number and message content) httpRequest Send an HTTP request install Download and install an application listenSMS Set which incoming messages will be de- leted (based on source phone number and message content) message Show a message dialog to open a URL notify Show a status bar notification openUrl Open a URL in the web browser run Start an already installed application sendContactList Collect contacts from the phonebook and send them to CC server sendDeviceInfo Send device information to the CC server (phone number, operating system version, phone model and manufacturer, operator, if the device is rooted) sendPackageList Collect the list of installed applications from the phone and send them to the CC server sendSMS Send an SMS message uninstall Uninstall an application Table 3: CC server addresses for different Stels versions version 1 version 2 kitherbin[dot]com 33files[dot]info a1paybill[dot]net androidfan[dot]name bot[dot]mobiportal[dot]net version 3 bot[dot]moblife[dot]org droidad[dot]net istorhol[dot]ru steamads[dot]info marhc-nikolay[dot]info mobiportal [dot]net play-google[dot]mobi ponelnet[dot]info serviseru[dot]ru skladchik[dot]in ynfdbdybdd1[dot]freeiz [dot] com • Phone number • Device model • Device manufacturer • Operating system version The e-mail is sent via the webpage http://[...]anonymouse. org/[...]/cgi-bin/anon-email.cgi to the address app[dot] stels2@gmail[dot]com. Social media as CC backup A problem with centralized botnets is that if the owner loses control of his CC server, he also loses the ability to control the bots. The Stels author(s) attempt to combat this issue by setting up a few Twitter accounts for the bots check with to obtain a new CC server address if the old one is no longer available. In the first implementation, the Stels trojan parses the Twitter page, looking for encrypted messages that might contain the new CC server address. In a later implementation, the encrypted messages are searched from the account description. The usernames ‘Vaberg1’ and ‘app36005565’ have been found to be used for the Twitter accounts used as part of the backup CC system. However, the accounts do not appear to have been used before. Figure 1: Twitter account meant to provide instructions to Stels In the version 3 of Stels, Twitter has been replaced by the Russian microblogging site, Juick. Stels will parse the RSS feed of the account set up by the botnet author by searching the web page, http://rss[dot]juick[dot]com/ACCOUNTNAME/ blog for the strings description![CDATA[ that mark the beginning of messages. The Stels trojan then decrypts the messages and sets the decrypted string as the new CC address. In May 2013, the botnet owner lost control of one of his CC domains, droidad.net. He was forced to resort to the backup channel of a Juick account called ‘droidad.’ Figure 2 shows the account sending an encrypted message that relays a new CC server address for version 3 of Stels trojan on May 24th. Once decrypted, the new domain was revealed to be steamads[dot] info.
16 f-secure | h1 2013 threat report mobile Figure 2: Stels botmaster sending a new CC server location via a backup Juick account Distribution Android malware has thus far been mostly spread through third-party marketplaces, and Stels’ approach is no different. It has been found distributed through spaces.ru, a popular social network service that targets mobile device users in Russia, where it was repackaged with clean applications to lure victims. Bait applications that Stels author(s) use are mostly games. An interesting discovery was made during Q1 where Stels was found distributed via IRS-themed spam sent by the Cutwail botnet (http://www.secureworks.com/cyber- threat-intelligence/threats/stels-android-trojan-malware- analysis/). A user who clicked on the link on an Android device was directed to a web page asking him to update the Flash Player application. The ‘update’ which the user ended up with is actually the Stels trojan. In addition to using Flash Player’s name,Stelsmayalsouseafakeupdateunderthename‘Google updater.’ Figure 3 shows an example of a Stels infection when looking at the installed application list. Conclusion Stels is a flexible bot that offers the owner a fleet of different monetization avenues such as SMS messages, phone calls, software installation, or even acting as a banking trojan component that intercepts mTANs. The trojan is designed to last a long time, since the author has included a backup method for changing CC server addresses in case the old servers become unavailable. We have seen instances where malware uses spam as a distribution method and uses social media as part of the CC infrastructure, but those are Windows malware. The fact that Stels is using the same method is evidence that Android malware is advancing closer to reach the level of highly developed Windows threats. Figure 3: Stels trojan masquerading as a Google updater 76 +24+v 3+m5+m7+m7 +m1+m 8 7 5 3 1 Uzbekistan United Arab Emirates Turkey Kenya 132 other countries 76 Russia % geographic distribution of stels detections, by percentage* *Based on F-Secure’s client telemetry data for H1 2013. stels
358 Android symbian ios windows phoneblackberry j2me palm pocketpc 16 0 793 598 4 0 41 20 2 1 0 0 0 00 New families or variants found, H1 2013 platform Total families or variants found, 2000 to H1 2013 total count of families or variants per platform 2010 2011 2012 2013 total count of android application packages (APKS), 2010 to H1 2013 July 2013 Total: 405,140 Malware: 257,443 March 2013 Total: 225,591 Malware: 103,565 January 2013 Total: 170,659 Malware: 73,084 Total (malware, spyware, adware) Malware only H1 2014 50,000 100,000 150,000 200,000 250,000 300,000 350,000 400,000 450,000 Since late 2011, we’ve seen a sharp increase in the total number of mobile device-targeted files or programs being distributed on all platforms. This is particularly true for Android applications (above), which saw a significant spike in the total number of APKs detected from March onwards, indicating an accelerating rate of new APKs being created for this platform. Thoughsimplycountingthetotalnumberofprogramsweencounterproduces impressive numbers, most of the files seen are simply replicas of a handful of unique families (programs that are grouped together based on similar codes or behaviors and detected using these shared characteristics). As such, a more meaningful gauge of significant development is to count the number of unique new families found on a platform, or new variants for known families, found within a year (left and below). These figures then allow us to, among other things, determine where malware developers are concentrating their efforts. mobile malware 20122011201020092008200720062005 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 2013 H12004 running total of families or variants found on symbian android platforms, 2004 to h1 2013 Symbian Android +358 +16
18 f-secure | h1 2013 threat report Android android mobile Android continues to dominate Android continues to maintain its dominant position in the smartphone operating system market, with the International Data Corporation (IDC) reporting that the platform accounted for 79.3% of all smartphone shipments in the second quarter of this year [1] . The next most popular platform is, unsurprisingly, iOS, which accounted for 13.2% of all new phones shipped in the same period. More surprisingly, this past quarter saw the Windows Phone platform overtake BlackBerry (3.7% to 2.9%) forthefirsttimetobecomethethirdmostpopularsmartphone operatingsystem.Allotherplatformswereunabletogaineven as much as a 1% toehold in the market this quarter. Given these numbers, little wonder then that malware development has focused on the Android operating system, with 96% of new malware families or variants we saw in the first half of 2013 found on that platform. In the second quarter of the year, 99% of new mobile threats we saw were on Android and on pages 20 to 21, we profile 6 of the most interesting malware we encountered during that period. Google Play Store While Apple’s App Store continues to be the strongest app market in terms of revenue generation [2] for its developers, it lost the title of the largest app market in July 2013, when Google announced that its Play Store had approved its 1 millionth app, surpassing Apple’s 900,000 total apps count at the time. That number doesn’t include the multitude of apps available on various third-party sites catering to Android users. Unfortunately, while the sheer volume of apps and markets available offers a a range of choices for Android users, the dark side is that it also offers attackers an abundance of legitimate apps to compromise and trojanize, as well as varied ways to distribute their malwares. In 2012, the Play Store introduced security measures that, among other things, identified malicious apps uploaded to the market. Though this has reportedly been effective, it doesn’t entirely eradicate risk - for instance, it doesn’t eliminate apps we would classify as Adware or Riskware, and is ineffective in blocking advertisements (either in the Play Store [3] or in the apps themselves) that users may consider unwanted, risque or outrightly malicious. The intersection of advertising, privacy and security remains a grey area for Android, given the open ecosystem of the platform,thedefactouseofadvertisingtomonetizethemainly free apps in the market and the lack of a viable reputation- The Android platform continues to dominate the attention of mobile malware authors, with increasing interest in finding ways to target Android users while bypassing the Google Play Store. In this article, we take a look at trends we saw in malware developments on this platform in the second quarter of 2013. new families or variants in h1 2013, by type Trojans Trojan-Spies Backdoors Trojan-Downloaders Riskware Monitoring-Tools Hack-Tools Application Adware SpywareGarbage 50 100 % checking system for the advertising modules used in most of the programs. Despite the occasional hiccups however, thus far the Play Store is still considered the safest source for finding clean Android applications. Beyond the Play Store We believe the increased hardening of the Play Store has led to an increase in Android malware being distributed using other attack vectors. During Q2 2013, we discovered 205 new Android families or new variants of existing families, the majority of them from non-Play Store sources. Beyond the boundaries of the policed app market, malware developments of particular interest at the moment are: malvertising; drive-by downloads and mobile banking-trojans.
19 f-secure | h1 2013 threat report android mobile is the new malware family or variant profit-motivated? 23+77+B Yes No 77 23 % SOURCES 1. International Data Corporation; Apple Cedes Market Share in Smartphone Operating System Market as Android Surges and Windows Phone Gains, According to IDC; published 7 August 2013; http://www.idc.com/getdoc.jsp?containerId=prUS24257413 2. Forbes; Chuck Jones; Apple Still Dominates Tablet And App Store Usage But Android Is Gaining Ground; published 31 May 2013; http://www.forbes.com/sites/chuckjones/2013/05/31/apple-still-dominates-tablet-and-app-store-usage-but-android-is-gaining-ground/ 3. F-Secure Weblog; Sean Sullivan; Google Play: Potentially Unwanted; published 11 March 2013; http://www.f-secure.com/weblog/archives/00002521.html 4. F-Secure Weblog; Sean Sullivan; Fake Antivirus Scan Scam Via Google Play App Ads; published 13 June 2013; http://www.f-secure.com/weblog/archives/00002567.html 5. FSLabs Youtube Channel; Drive-by Android Malware; published 3 May 2013; http://www.youtube.com/watch?v=aYFX8V7EXbA 6. The Age; Liam Tung; Fake CommBank Android security app targets mobile customers; published 16 July 2013; http://www.theage.com.au/it-pro/security-it/fake-commbank-android-security-app-targets-mobile-customers-20130716-hv0w0.html “Malvertising”: advertising malware Malvertising seems to be increasingly used to distribute mobile malware, likely due to its ease of implementation and the wide reach it offers. This distribution method so far has typically involved either a compromised a site injected with a malicious links or code, or simpler still, use of a third-party advertisement network to promote links to the malicious products, where the advertisements themselves may be taken and displayed in good faith. One advertising strategy that leverages the reputation of the Play Store while avoiding the actual market’s security measures involves the use of fake Play Store advertisements. This social engineering technique uses a link or advertisement on a website that appears to be for an app in the market, but when clicked instead opens a non-Play Store site in the web browser. We’ve also seen advertisements displayed during web surfing sessionsonmobiledevicesthatpromotefake‘mobileantivirus’ scams [4] - basically the mobile equivalent of similar efforts to distribute PC-based rogues. We also saw another ad-based technique used by Trojan:Android/Badnews.A, where in-app advertisements promote what turned out to be a fraudulent app for a premium SMS subscription. Mobile drive-by downloads We’ve also encountered drive-by downloads of mobile malware while browsing compromised sites on an Android device [5] . Unlike PC-based drive-by downloads, these attacks are still relatively visible to the user, as they automatically trigger a notification message asking whether the user wants to install the app (and providing an opportunity for the user to delete the unwanted program). Again, since this attack vector involves either compromising a legitimate site or redirecting users to a malicious site (both activities likely to be familiar to any malware distributor with prior experience spreading PC-based malware), we expect to continue seeing malware distribution using this method in the future. Mobile banking trojans A more direct threat to users comes in the form of mobile banking-trojans - typically malware that attempt to steal SMS messages containing Mobile Transaction Authentication Numbers (mTans). The proliferation in this type of mobile malware has been in response to a general shift by banks providing online shopping facilities to take two-factor security authentication into use. This ties in with the discovery this quarter of Trojan:Android/Pincer.A, which we believe to be related to fake banking security apps that were reported in July targeting users of the Commonwealth Bank [6] , as well as Trojan:Android/FakeKRBank.A, which we saw targeting users in Korea. And finally, in Q2 2013, we observed more mobile banking- trojan toolkits - that is, programs that automate the process of creating these malware - are now being sold in the underground markets. As such, we expect to see more of this kind of threat in the near future and perhaps evolve further.
The following 6 Android malware were selected as representative of the mobile threats discovered during Q2 2013. The count of known unique samples is used to provide a meaningful idea of how large a given malware family may be. In addition, where available, the Protection Network Count counts the times a device protected by F-Secure’s Mobile Security reported blocking an attempted malware installation to our cloud-based telemetry systems during Q2 and Q3 of 2013. Comparing the low rate of blocked mobile infections to the vastly greater rate of blocked infections for PC-based threats can arguably indicate both the currently rare nature of mobile infections and the effectiveness of mobile antivirus solutions in protecting a device from infection. Trojan:Android/VmVol.A Count of Known Unique Samples: 43 Oldest Known Sample Date: 2013-03-28 Distribution: Unconfirmed in Google Play, records shows it was removed. Summary Once installed, VMVol.A sends the device’s phone number and International Mobile Equipment Identity (IMEI) number to a remote server. It also sends a copy of the messages sent, including the message content and the receiver’s number. Trojan:Android/Badnews.A Count of Known Unique Samples: 113 Oldest Known Sample Date: 2013-03-03 Distribution Badnews variants have been found on the following online app markets: Google Play, Opera, Baidu, Anzhi and Liqucn Summary Badnews variants are fraudulent premium SMS-trojans. On installation, the app displays advertisements for a premium-SMS subscription. android threats highlights, q2 2013 Trojan-Dropper:Android/FakeKRBank.A, Trojan:Android/FakeKRBank.A Count of Known Unique Samples: 64 Oldest Known Sample Date: 2013-05-20 Distribution Unknown Summary Once installed, Fakekrbank intercepts SMS messages and forwards the messages via URL POST to a remote server, together with the device’s name and number. Protection Network Count Protection Network Count Protection Network Count apr may jun jul aug sep apr may jun jul aug sep apr may jun jul aug sep 10 10 10
Trojan:Android/FakeDefender.A Count of Known Unique Samples: 14 Oldest Known Sample Date: 2013-03-24 Distribution: Seen advertised in third-party advertisements displayed on mobile devices. Summary Similar to rogue antispyware programs found on PCs, Fakedefender is a rogue anti- spyware program for the mobile device. The program does not provide the scanning or malware removal functionalities claimed. Protection Network Count Trojan:Android/Pincer.A Count of Known Unique Samples: 11 Oldest Known Sample Date: 2013-03-19 Distribution This app is known to be distributed either on phishing sites (typically imitating a bank site) or via malicious links in SMS messages. It may also be distributed as part of the payload of a PC malware. Summary Once installed, Pincer forwards SMS messages to a remote Command and Control (CC) server. It is also able to function as an mTan-stealing banking-trojan, as well as carrying out instruction given remotely by the CC server. Trojan:Android/Obad.A Count of Known Unique Samples: 6 Oldest Known Sample Date: 2013-05-16 Distribution Obad variants were observed being advertised on a malicious website while browsing on an Android device and is likely to arrive on a client device via a mobile drive-by download. Summary Once installed on the device, Obad variants gain administrator privileges and uses a exploit to break through the Android operating system’s security layer. Obad collects and sends the following details about the device to a remote CC server: the Media Access Control (MAC) address and IMEI, the operator name, the time and root access. The CC server is also able to issue the commands to the installed application, including to send SMS messages, make the device act as a proxy or a remote shell, launch a URL in the mobile browser, download and install additional components, get the Contacts list as well as further details of a specific installed app and send a file via Bluetooth. apr may jun jul aug sep 10 apr may jun jul aug sep 10 20 Protection Network Count
3. Set up call or message barring Most operators allow users to set up a call or SMS barring service to block the device from sending unwanted calls or messages. Also known as ‘premium-rate blocking’, this is particularly useful for parents who want to prevent their children’s devices from inadvertently incurring unnecessary charges. To set up this service, contact your phone operator for more details. Some services also provide a PIN number or other method that allows the user to selectively remove the barring, if they desire. Securing the device Today most people have their email accounts (personal and/ or work) and other critical services on their mobile devices. This convenience also means that if your device is lost or stolen, your losses could involve more than just the physical device. And despite concern about online-based attacks, the easiest way for malware to get on a device is still for someone to manually install it while the device is in their possession. In other words, protect your device’s physical security first. 1. Lock the device Locking your device prevents anyone else from meddling with its settings and installing an app (such as a monitoring-tool or spyware) while it is out of your possession. For the lock to be effective, make sure the password/passcode/pattern is unique, and preferably memorable for you without being easy for someone else to guess. 2. Set up anti-theft protection Anti-theft protection typically provides you the ability to remotely wipe the data on your phone, including on any memory cards installed, if you decide your phone is irretrievable. Some anti-theft solutions also include features such as location mapping or sounding the alarm, to help when attempting to locate the device. 1. F-Secure Weblog; Sullivan, Sean; Post-PC Attack Site: Only Interested in Smartphones/Tablets; published 19 June 2013; http://www.f-secure.com/weblog/archives/00002569.html sources recommendations: Protecting against mobile malware 7. Use web browsing protection To avoid stumbling onto a malicious site while surfing on a mobile device, use web browsing protection (available from most antivirus solutions) to block known harmful sites. While online As websites have evolved to cater for visitors browsing from mobile devices, we’ve also seen malicious sites follow suit[1] . When dowloading apps Once your device’s physical security has been addressed, you can also take the following steps when downloading an app. 6. Scan apps with a mobile antivirus Once downloaded onto your device, use a reputable mobile antivirustoscantheapp.Youcanthinkofthisasacheckonthe app’s ‘silent’ behavior—permissable actions that are implied in the app’s permissions list (for example, sending the device’s details to a remote server) but may cause users concern. If the verdict from the mobile antivirus is acceptable to you, then you can proceed to install the app. 4.Download apps only from the Play Store By default, Android devices block installation of apps from any source other than the Play Store. You can check to make sure your device only allows Play Store apps by looking in Setting Applications Unknown sources. If the checkbox is checked, non-Play Store apps can be installed. Uncheck this. 5. Check the apps’ permission requests Whether you’re downloading from the Play Store or other sources, make sure to read the app’s list of requested permissions (the ones that typically raise eyebrows due to security or privacy concerns are listed below right). If the permissions requestedseemexcessive or unrelated to the app’s purpose—for example, a casual game asks to send SMS messages—you can check the developer’s references for more details, as reputable developers usually explain why the permissions are needed. If the use appears justified to you, then you may elect to download the app. Incidentally, apps such as PocketPermissions, LBE Privacy or PermissionDog can be useful guides for explaining the sometimes-obscure permissions. Some also include features to restrict permissions used by installed apps, though such functionality is often intended for advanced users. • Services that cost you money • Make phone calls • Send SMS or MMS • Your location • Your personal information Blocking unwanted services Lucrative profit-generating mechanisms for mobile malware are to silently send premium rate SMS messages, subscribe the user to continuous premium services, or to force the device to call premium-rate numbers. Blocking premium calls or messages is one way to minimize financial losses, even if malware does get installed. This also provides protection against non-malware billing fraud by “operators” who silently subscribe users to premium services and forward billing requests to the user’s mobile operator, hoping to have the charges quietly added to the user’s bill.
23 f-secure | h1 2013 threat report aptattacks apt attacks national focus of apt documents, mapped * *Onlynationsthatweretargetedbymorethanone APT document in the sample set are mapped. Tibet 2 China 16 USA 10 India 8 Iran 5 Japan 2France 2 Advanced Persistent Threat (APT) attacks typically involve a carefully crafted exploit document being delivered (usually through some form of social engineering) to a user, or users, in a targeted organization or industry. During 2012 and 2013 there was a lot of talk about various individual APT campaigns and significant individual cases. While these individual cases are interesting, we felt that it would be useful to gain an overall picture of the kind of victims various APT attackers are targeting. In order to gain insight into the larger picture, we randomly selected and analyzed 100 APT documents from our sample collection. The sample documents were categorized by language, topic of the document and if identifiable, the national focus - that is, the country it appeared to be addressing. While the contents of an APT document do not directly identify the attacker, the information gathered from its analysis gives a good indication of the kind of victims being targeted, as the document must be sufficiently interesting bait for the potential victim in order for the attack to succeed. Languages other than English were translated with computer translation,resultinginalessthanperfectunderstandingofthe documents; this was however good enough for classification purposes. We also extracted text from the first pages of all the sample documents and visualized the text in a word cloud (see page 24) to give an overview of the most common words used in the ATP documents. Based on the statistics generated from our analysis, we can see that English is the most common language in APT documents, which makes sense both from the attacker’s and victim’s perspective, as English is commonly used in international Vietnamese 1 French 2 Russian 2 Persian 3 Arabic 5 Chinese 12 English 75 language used in apt documents business and politics, so that the attacker need not produce lure documents in the victim’s own, potentially non-English language. Political attacks As can be seen from both the word cloud and statistics derived from our analysis, the most common type of content in ATP documents is political, usually in the form of a report of some politically interesting event, development or longer term review. All in all, the content of APT bait documents look like the type of content one would expect to be interesting to an embassy officer, government employee or otherwise politically active or aware figure. The most common topic in the political documents deal either with China or India; USA-related topics are also very APT Attacks
24 f-secure | h1 2013 threat report apt attacks aptattacks content of apt documents 14+11+8+2+65+z Political 65 Corporate 14 Military 11 Academic 8 Unknown 2 % prominent. When reading the documents, it seems that many of them mostly cover relations between USA and China, or India and China. Extrapolating from that, it seems that the most common target for a politically-motivated APT attack is someone who is from or has some form of affiliation to the USA or India, and is interested in China. Corporate attacks Corporate users are mostly targeted with bait documents that look like conference proceedings or reports. This does make sense as conference proceedings are normally propagated by e-mail as part of standard business practices anyway, making them easy for the attackers to obtain, modify and pass on as ‘revised’ editions. The second most common type of corporate-targeted ATP documents were reports, which are also relatively easy to obtain and are easily passable as credible business material. As can be seen from the corporate word cloud, the aerospace and energy sectors seem to be of most interest to the spies. As with political documents, the corporate-targeted documents commonly contain references to China or other Asian countries, which would indicate that attackers are interested about targets that operate in the aerospace or energy sector and have some form of contact with Asian countries. Military attacks As with other victim categories, a large portion of ATP documents targeted to the military were reports on topics that would be of interest to military personnel. What was interesting however was that in addition to strictly military- related topics, a major portion of these documents related to the personal finances of service members, such as tax information or military pension details. In these cases, the wordcloud of most common words in apt documents Credit: Tagul.com politicalCorporatemilitary
25 f-secure | h1 2013 threat report apt attacks aptattacks Diplomatic car ad 2 Banking 2 List of contacts 2 Report 40 Letter 7 Conference 6 Service related finances 4 Aerospace 4 Activist 3 Sex scandal 3 Curriculum Vitae 3 Topics appearing in more than one apt document attackers attempted to attack victims using documents of personal rather than professional interest, which is an angle that we have not seen with any other category. Academic attacks The number of ATP documents in our sample set targeted to academics was too small and scattered to draw any major conclusions. Based on the handful of samples however, it does seem that either the attackers are trying to lure victims with either material related to a particular academic field or administrative topics such as curriculum vitaes, memos or forms. Conclusion In order to be able to publish results for this report, we used APT documents that were obtained from public sources, which means that our sampling is most likely biased as it is very likely that many corporate targets consider any APT material they encountered to be so sensitive that they either do not share the documents or share them confidentially, thus preventing their use for a public study. Even so, based on the material we are able to share, we can construct a basic profile for the people targeted for APT attacks: primarily those working with political material, especially those whose work includes contact with China or other major players in the Southeast Asian region. While corporations, the military and academia receive less attention, it is still true that as long as you possess information of interest, it is likely that you may be a potential target for APT attack.
26 f-secure | h1 2013 threat report Ransomware ransomware Two types of ransomware It is useful to compare the two different types of ransomware that are currently infecting users. The only common factor between these two types is the concept of extorting money from victims by holding something valuable — data or the computer itself — hostage. Everything else is very different, as we will soon discover. The first type is called the encrypting ransomware. When this malware infects a computer, it encrypts the user’s data and leaves a ransom note that asks for money in exchange for a cryptographic decryption key needed to restore the files. The second type is a police-themed ransomware, often simply referred to as police ransomware. On an infected computer, this malware shows a “lock screen” which requests for a ransom payment for the computer to be unlocked. The lock screen is simply a dialog box that fills the whole computer screen. It prevents the user from closing the box and quitting the malware. Encrypting ransomware Encrypting ransomware’s infection happens in an unusual way. Most malware infect a computer through a drive-by exploit, where they infiltrate the machine by abusing a vulnerable application like Java. Their target is often a personal computer, especially the users with poor browsing habits. Encrypting ransomware, on the other hand, often targets corporate Windows servers, where it encrypts all data files and asks the company to make a payment in order to decrypt them. These servers are not meant to be used for browsing and reading e-mails. In many infection cases, the server was found to be running a Remote Desktop (RDP) service and the user accounts were guarded by weak passwords. The attackers employed a password guessing attack and managed to log in using the RDP service. Ransomware is a type of malware that uses extortion to get money from victims whose computers have been infected. The malware typically takes control of the victims’ data or computer and demands a payment for the victims to reclaim their possesion. We last wrote about ransomware problem in our H1 2012 Threat Report. Since then and during the first half of 2013, this threat has remained very active. Geographical focus Since the infection is not fully automatic and the attackers manually break into the servers, the amount of encrypting ransomware infections is small compared to police ransomware. During the first half of 2013, F-Secure Labs saw “waves” of encrypting ransomware attacks that targeted servers in one country, then moved onto another country. The “Anti Child Porn Spam Protection” ransomware targeted corporate clients in countries such as Spain and Italy actively in March and April. Other similar encrypting ransomware have been actively used as well. Payload The payload of encrypting ransomware is usually very simple. Once the attacker has gained access to the corporate server, hemanuallyexecutesthemalware.Themalwarewillenumerate files on the server, encrypting all data files but skipping any system files to avoid making the system unbootable. The encryption is done using strong cryptography, and once the operation is completed, the encryption key will be securely erased. Every file on the network shares is also encrypted; if backups are accessible to the server, these are also encrypted. Payment mechanism To decrypt the files, a decryption key is needed. The victims will receive information on how to deliver the payment to the attacker in exchange for the key. In many cases, the payment is made using online payment system such as Moneypak, Paysafecard or Ukash. The amounts go from USD 500 onwards. ransomware Figure 1: Snapshot of an “Anti-Child Porn Spam Protection” ransomware
27 f-secure | h1 2013 threat report In a typical situation, the attacker will ask the victim to send the encrypted file, which will be returned in a decrypted format. The victim is also required to send a proof of payment over e-mail. Since the attacker has to keep track of the victims and the keys used to decrypt their files (each victim is assigned a different key), the manual work involved in this correspondence limits the amount of victims that can be targeted simultaneously. Attacking a million targets at once is not possible. This limitation may explain the “waves” of attacks — the attackers target a limited set of servers in one country and then move on to the next one. Police ransomware Police ransomware gets its name from the “lock screen” that appears on an infected computer. The lock screen displays a message allegedly coming from the local law enforcement, claiming the computer’s involvement in illegal activities such as copyright violations and child pornography distribution. A handful of families are behind most of police ransomware infections. Two of the most notable ones during the past six months are Reveton and Urausy. Both families infect users via exploit kits when they are browsing the web. The users will be redirected to a web server that automatically infects the computer using an exploit. There have been cases where malicious advertisements (malvertising) wereusedonpopularwebsitessuchasMSNItaly to redirect users to exploit kits serving ransomware. The most common method still seems to be malicious advertisements on adult websites. ransomware Figure 2: Localized police ransomware Geographical focus Police ransomware uses localized messages to convince infected users. Both Reveton and Urausy target several countries such as the US, Germany, France, Saudi Arabia and Italy (see Figure 2). Unlike encrypting ransomware, the lock screen on police ransomware is localized with the national law enforcement logo and often translated to the local language. The current list of localization that Urausy supports include: vs.Encrypting ransomware Police ransomware Encrypt user data and demand a ‘ransom’ in exchange of the decrypting key. Display a ‘lock screen,’ pretending to be a local law enforcement. Demand a ‘fine’ to unlock. Corporate Windows servers running a Remote Desktop (RDP) service. General users’ computers. infection target Perform password guessing attacks to break in and log in using RDP. Redirect users to servers hosting exploit kits; users’ computers will be automatically infected.infection method Manual. Keep track of proofs of payment and decrypting keys via emails. Automated. Send PIN code automatically to command and control (CC) servers. payment mechanism Enumerates all files on the server, encrypting all data files except for system files. Encryption key is securely erased after the operation is completed. Has a launch point in registry that starts malware automatically after system restart, usually in ‘safe mode.’ The lock screen shows up immediately. payload ransomware
28 f-secure | h1 2013 threat report ransomware ransomware Argentina, Australia, Austria, Belgium, Bolivia, Canada, Croatia, Cyprus, Czech Republic, Denmark, Ecuador, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Jordan, Latvia, Lebanon, Luxembourg, Malta, Mexico, Morocco, Netherlands, New Zealand, Norway, Palestine, Poland, Portugal, Romania, Saudi Arabia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, United Arab Emirates, United Kingdom, United States and Uruguay The cost involved in localizing the malware may have caused the ransomware families to steal the design of the lock screens from each other, thus, making it difficult to tell one family’s infection apart from the other by looking at the screen. Payload Similar to encrypting malware, the payload for police ransomware is quite simple too. After infecting a computer, the malware will wait for several minutes before displaying the lock screen. This delay makes it more difficult for the victims to identify which visited website might have been responsible for the infection. The malware has a launch point in the registry to make sure that the malware starts its payload automatically when the computer is restarted, usually in “safe mode.” The locked screen will show up immediately after restart, making removal difficult. The Reveton ransomware also includes a second payload that allows the attacker to benefit from victims who refuse to fall prey to paying for the ransom. As an insurance, the second payload automatically steals any username and password that has been saved in the web browser, FTP clients and other places. The attackers may then use or resell these credentials for financial benefit. Payment mechanism Unlike encrypting ransomware, nearly all police ransomware families have a fully automated payment collection. On the lock screen, the victim will be asked to input a PIN code for an online payment system like Moneypak, Paysafecard or Ukash. This PIN code is then automatically sent to a command and control (CC) server for verification. The CC infrastructure consists of several proxy servers in an attempt to hide the criminals’ track. Because of the level of automation, criminals using this type of ransomware are able to target thousands of victims and handle the payment without any difficulty. infected corporate server @ payment email address attacker Correspond with victim s Collectpaym ents Breaksin byrem ote log in Payment and receiving of decrypting key attacker CC serverCC Proxy serverinfected Computerexploit kit Infects with exploits Payment code sent Forwarded to hidden server Collects paymentsMaintains kits Encrypting ransomware vs. police ransomware operation flowchart Police ransomware Encrypting ransomware • Enable Browsing Protection and DeepGuard in your F-Secure product to stay safe from malicious websites • Keep software up-to-date to stay safe from exploit kits • Uninstall Java if not needed, or keep it installed in a secondary browser that is not used for general web browsing • If infected with police ransomware, change all passwords that were saved on the computer • Make regular backups to recover from encrypting ransomware. Make sure the backups are not accessible from the server itself How to protect against ransomware:
29 f-secure | h1 2013 threat report ransomware Ransomware and BitCoin in Asia For the most part, most of the ransomware cases we detected were in Europe, the Middle East and most parts of the United States. However, around the Asian region, there have not been too many cases of exploits utilizing ransomware to extort money from victims, most likely since the region has a lack of convenient and anonymous payment systems such as Ukash, Moneypak and Paysafecard. In Europe, these systems make it easy for a victim to obtain a prepaid card from a convenient store to pay the ransom (while not informing the authorities of the extortion, especially in cases of police-themed ransomware). The receiving party on the other end can also be easily trained without much personal or unique information being given out, and with automation, is able to collect the ransom from hundreds and even thousands of victims. In Asia however, most countries have not been set up with this sort of electronic payment system (probablyduetothefactthatmuch fraud occurs in this part of the world) and most victims so far have relied on online banking methods to transfer funds electronically. In future however, with Bitcoin on the rise and its acceptance in Asia due to the pseudo-anonymous nature of the currency, could it possibly drive malware writers to conquer this part of the world with ransomware attacks tailored for collection of the ransom using Bitcoin? China is currently the second biggest and fastest growing Bitcoin market in the world today, second only to the United States. China is no stranger to virtual currencies, as they were exposed to the Q coin in the mid-2000s by Tencent (which all started with avatar purchases online) and online gaming. Because China’s strict cross-border financial controls make it difficult to spend money in stores abroad, Bitcoin could be the perfect virtual currency for Chinese Bitcoin owners, as they can convert them into currencies that sites like Paypal and Amazon would accept. Since Bitcoin is so decentralized, it would be extremely difficult for the government to handle any issues related to Bitcoin use, as they cannot track it, block it or crack down on it. It would be the perfect way for cybercriminals to safely move and launder money collected from ransomware and evade authorities. The PC isn’t the only platform likely to suffer from ransomware in the future. The increase in Android users, especially in Asia, has lured malware writers into branching out from the PC to the mobile platform, leading to increasing sophistication and maturityinthemalwaretargetingAndroidusers.Mostrelevant istheincreaseinfakeantivirusandransomwareattacksmaking theirwayontothemobileplatform.Oncerogueantivirusesare installed on your mobile device, they display a false malware detection in an effort to con the user into paying for software that would supposedly remove the infection, making them at least spiritually similar to ransomware. Given that Asia is one of the largest markets of smartphone users and a major market for free apps downloaded through third-party stores, it is likely that in future the region will see an increase in malware writers finding more creative ways to introduce fake antivirus or ransomware onto a user’s mobile device. ransomware Bitcoin’s increasing value against the US dollar
30 f-secure | h1 2013 threat report Crypto currency Mining bitcoin Bitcoin Malware Timeline, 2008–2012 Back in 2008, a mathematician named Satoshi Nakamoto (a pseudonym) submitted a technical paper for a cryptography conference. In the paper titled “Bitcoin: A Peer-to-Peer Electronic Cash System,” he described a peer-to-peer network where participating systems would perform complex mathematical calculations on something called a “blockchain.” The goal is to create a completely new currency —crypto currency — that is based on math. Bitcoin is not linked to any existing currency; therefore, its value is purely based on how much people believe it is worth. Some vendors do accept Bitcoin as a form of payment. To send Bitcoin to another party is similar to sending an e-mail. All it needs to transfer money instantly, bypassing exchanges, banks and taxes, is an address linked to somebody’s wallet file. In a way, crypto currency would make banks completely unnecessary for moving money around, which is why banks hate the whole idea of Bitcoin. In 2010, when Bitcoin had just started to get adopted by enthusiasts, its initial price was listed at merely several dollars. At that price, many doubted that it would make a good investment. But over time, as the media started to pick up on the subject, its price began to shoot up. This undoubtedly caught the attention of the bad guys. The first batch of Bitcoin malware, which utilized infected computers’CPUforproof-of-workcalculations,wasdiscovered in 2011. The calculations, also referred to as “mining,” rewarded the malware authors with coins. However, such tactic did not provide enough income as the authors had originally hoped. By Q2 2011, those malware had lessened in number. The authors figured out that it would be more profitable to simply sell access to infected machines rather than mine the coins themselves. Within a short period of time, the malware authors managed to adapt the code to enable a more efficient way of mining. In Q4 2011, some malware families, such as the Trojan.Badminer reported by Symantec[1] , began to utilize third-party mining programs that specialize in GPU-accelerated hash calculations. Using the GPU is 50 times more profitable than using a top- Crypto currency mining operations have been running for years. The top two currencies, Bitcoin and Litecoin, have become a holy grail to cyber-criminal organizations that need a stream of hard-to-trace income. As a decentralized/peer-to-peer currency, Bitcoin is exactly what they have been waiting for. notch CPU, and it soon became the most common mining method amongst cyber-criminals. Commonly used mining programs include bfgminer/cgminer, cudaminer and Ufasoft’s Coin. These programs are all open source and the malware authors stick to using the public builds as much as possible to evade targeted signature detections. Some cyber-criminal gangs opt to use a custom mining tool, often delivered by a third-party developer who prefers to stay in the “grey zone.” Examples of these tools are Silent Miner, Chrome Miner and Insidious Miner. Silent Miner still has an up and running website, where it is being sold for money through PayPal or Bitcoins via Mt. Gox. Bitcoin Malware Timeline, H1 2013 In2013,differentBitcoinmalwarebegantoemerge,asreported by various anti-virus companies. The most remarkable ones are as follows: • April 2013 - A scam message containing a malicious link spread out amongst Skype users. The link led to a malicious executable that would download additional components from a command and control server. One of the identified components was a Bitcoin miner tool that would run silently in the background. • May 2013 - Bitcoin malware leveraged a Proxy Auto- Configuration (PAC) file to redirect infected victims to a fake Mt. Gox website. The victim’s Internet browser would contact the criminal’s proxy server as defined in the PAC. So, when visiting the original Mt. Gox website, the victims would instead be directed to the fake website hosted on the criminal’s server [2] . crypto currency mining Figure 1: Custom stealth mining tool for sale
31 f-secure | h1 2013 threat report • June 2013 - Cyber-criminals distributed spear-phishing spam that led to a fake Mt. Gox website. The URL of the fake site contained a similar second-level domain name “mtgox” but different top-level domain names - “.org,” “.net,” “.co.uk” and “.de.” This trick was easier to recognize compared to a malicious PAC [3] . • Late June 2013 - Researchers from Webroot uncovered the latest DIY Bitcoin mining tool in an underground market. The Bitcoin miner generated by this DIY tool was claimed to be stealthy and invisible. Based on our analysis of the sample, the criminals were using the Ufasoft Bitcoin miner, which was freely available on the official website [4] . ZeroAccess Botnet Estimated Profits Up to this day, the largest botnet mining operation was carried out by the ZeroAccess family. The malware consists of a powerful rootkit to hide its presence and so-called “plugins.” While slower computers are useful enough for fraudulent pay- per-click operation, the faster ones will occasionally receive an additional plugin to perform mining tasks. To calculate how much profit the mining operation can bring, let’s consider these few assumptions: • According to a survey conducted by Valve Corporation in May 2013 [5] , the most common graphic cards among gamers are NVIDIA 400/500/600 series and AMD 5000/6000 series, which produce ~225 Mhash/s [6] out of a typical gamer’s PC. • Close to 100,000 PCs are suspected of being infected by ZeroAccess daily. Monthly, the botnet consists of ~3 to 5 million active installations; there could be ~2 million machines directly involved in the mining operation (half of the botnet) on a certain time frame. • If 5% of these (probably more) are gamers’ machines, a simple calculation gives us 22,500,000 Mhash/s (2x106 ) (0.05) (225 Mhash/s) = 22.5x106 Mhash/s bitcoin crypto currency mining • At the current price of USD 100=BTC 1 [7] and mining difficulty of 19,339,258, attackers could be earning the following sum of money: table 1: Estimated profit from zeroaccess mining USD ($) BTC (฿) Daily profit 58,913 585 Weekly profit 412,295 4,095 Monthly profit 1,790,976 17,787 With a monthly profit of USD 1.7 million out of 5% top victims, ZeroAccess-powered mining operation is undoubtedly a very lucrative option to cyber-criminals. ZeroAccess Bitcoin Plugins Back-to-Back Update ZeroAccess’ botnet operator has recently been performing multiple updates on the plugins responsible for carrying out Bitcoinminingpayloads.Interestingly,eventhoughtheBitcoin plugin is still actively updated and pushed to infected peers, the Bitcoin mining payloads do not exist in the binary file. Based on the samples that exist in our backend systems, we have come up with an update history of the Bitcoin plugin binary file. The release date of the binary is presumably determined from the timestamp of the binary compilation update. An update is usually released every month, but there are a few instances where the botnet operator only releases a new binary after two months. And it uses its own private pool server to distribute a cryptography block for its workers— infected PCs running the mining plugin—to solve. The pool server used by the Bitcoin plugin released in August 2012 was identified as “google-updaete[dot]com.” From September 2012 to April 2013, the botnet operator released a plugin binary that does not contain the mining payloads. countries hit by bitcoin plugin released in april 2013
32 f-secure | h1 2013 threat report bitcoin crypto currency mining com.” This plugin binary, with the mining payloads, did not last long. The screenshot in Figure 3 shows the comparison between the older and the latest version of the Bitcoin plugin built in the same month. The file on the right shows the latest plugin, which was built on 23rd April 2013. The yellow highlighted rectangle shows that the embedded UPX packed Ufasoft’s Coin miner binary has disappeared. In other words, starting from 23rd April 2013 until today (at the time this article iswritten),ZeroAccessdoesnotcarryBitcoinminingpayloads. The absence of the mining payloads however, does not mean that the botnet operator has stopped generating revenue from its botnets. The click fraud payloads that reside in the same plugin binary file are still functioning. The reason why the botnet operator stopped Bitcoin mining payload despite the lucrative BTC exchange rate is a mystery. But here are some table 2: Bitcoin plugin release date summary Binary Compilation Date Contains Bitcoin payloads? YES NO August 2012 x September 2012 x November 2012 x December 2012 x February 2013 x March 2013 x April 2013 x On 2nd April 2013, the botnet operator released a new Bitcoin plugin binary and reintroduced the Bitcoin mining payloads using a different private pool server, “ooyohrmebh9qfof[dot] Figure 2: Comparison of older and new version of BitCoin miner plugin countries hit by bitcoin plugin released in august 2012
33 f-secure | h1 2013 threat report bitcoin crypto currency mining assumptions that can be made: • It is too expensive to setup and maintain its own private pool server • It is too invasive and noisy to run a Bitcoin mining operation on an infected machine • It is not easy to mine a Bitcoin without using a dedicated machine, especially when the botnet operator turns off GPU mining by default Conclusion It is hard to estimate the worldwide infection rate due to the use of commonly available mining tools, which may or may not be installed with the users’ consent. But we have managed to take a total count of incoming Bitcoin mining-related samples for every month in the first half of 2013. Not surprisingly, the graph matches (with slight delay) with the BTC trade prices reported by Mt. Gox exchange. Since the introduction of Bitcoin in 2009, there has been two types of Bitcoin malware attacks. The first one involves malware variants that steal Bitcoin wallet files from infected victims. The second type involves variants that run legitimate Bitcoin mining tools on infected machines, allowing cyber criminals to collect Bitcoin without paying for hardware or electricity. Apparently, the cyber criminals gave up the first type of Bitcoin malware attack because of the extra security featureimplementedintheBitcoinclient.Thefeatureencrypts the “wallet.dat” file, making it valueless to cyber criminals that did not “key-log” the password key. Based on the current trend, it is not surprising to see more malware leveraging the type-2 method in the future to earn a penny. However, it is hard to estimate the profits as they spread differently and often utilize “p2pool mining” where each infected PC is kind of “solo-mining” to a specified wallet address. Typical infection vectors that may be utilized by the malware include Skype or other instant messaging services, e-mail, drive-by-downloads and exploits. bitcoin malware growth Source: virustotal.com Source: mtgox.com
34 f-secure | h1 2013 threat report Exploit KITS exploit Top-5 exploit kits According to F-Secure’s telemetry data, 70% of all exploit-kit related detections encountered by our clients in the first half of 2013 are the work of 5 exploit kits: Blackhole, SweetOrange, Crimeboss, Styx and Cool. 28 other exploit kits account for the remaining 30% of exploit-kit detections. Of the top five kits, Blackhole by itself was responsible for 31% of all exploit-kit related detections globally reported to our cloud-based systems during this period. This exploit kit’s behavior was first detailed in our H1 2012 Threat Report and one year on, has changed little except for incorporating exploits for recently announced vulnerabilities, such as CVE- 2013-2423 and CVE-2013-0422 (see Vulnerability Exploitation article on page 36), and tweaks to the URL patterns used for its exploit sites. Of the other exploit kits in the top five, SweetOrange is the closest competitor to Blackhole, accounting for a comparatively low 11% of all exploit-kit related detections seen worldwide. The geographic distribution of the clients that saw these detections (chart at right) indicates that though most of thetopfivekitshadsomepresenceineveryregion(particularly Blackhole, which is practically omnipresent), the Crimeboss exploit kit focused almost exclusively on the Americas, where it accounted for 31% of all exploit-kit detections there. New entrance In the span of six months, we saw seven new exploit kits emerge (see timeline at bottom), as well as the updating of an older kit, CritXPack aka SafePack aka FlashPack, with new names. Though these kits have had relatively modest success compared to Blackhole or even SweetOrange, the increasing In the last couple years, exploit kits have become a popular, convenient tool for attackers and malware distibutors to efficiently find and compromise new victims. in H1 2013, we saw increasing development and competition among exploit kits, as new contenders emerged and older, established toolkits expanded their capabilities with new vulnerability targets and new tricks to avoid detection. number of active kits in play has simply given more options for malware distributors to carry out their work. Of particular note among the new batch is Whitehole, which focuses on exploiting the Java development platform. 30+11+10+10+9+30+V19+6+31+6+4+10+10+14+T GLOBAL Am ericas 19 31 11 10 10 9 631 6 4 36+12+17+6+29+R Europe 36 7 17 12 36+20+14+2+28+M APA C 36 2 14 20 29342828% geographic distribution of top 5 Exploit kits in h1 2013, By Percentage 30= Blackhole 30= SweetOrange 30= Cool 30= Others 30= Crimeboss 30= Styx In H1 2013, 31% of our clients worldwide reported a Blackhole-related detection, making it the most globally prevalent exploit kit. new exploit kits encountered in h1 2013, By date of first encounter Jan feb mar apr may jun RedDot Whitehole Flimkit SafePack FlashPackCritXPack changednameto changednameagainto Neutrino DotkaChef PrivateRawin In H1 2013, we saw a series of new exploit kits appearing in the wild. exploit kits
35 f-secure | h1 2013 threat report Targeting recently publicized vulnerabilities It’s been noted before that exploit kit authors have been very prompt in including new exploits for recently announced vulnerabilities into their products, and H1 2013 has been no different. Case in point involved the Java vulnerability CVE-2013-2423; a Metasploit module targeting this was first published on April 20th, and a day later we noticed in-the- wild attacks against it had already gotten underway by the CrimeBoss exploit kit. We also saw a new exploit kit, Private, become the first to target the CVE-2013-1347 vulnerability in version 8 of Internet Explorer. This particular vulnerability gained public notice due to a US Department of Labor website compromise in early May 2013; a patch was released by Microsoft just days later. The following month, we encountered the Private Pack exploit kit on June 11, already busy targeting this vulnerability. As of July 2013, at least 5 vulnerabilties which were only publicly announced during the past half year have been incorporated into various exploit kits. Four of the five vulnerabilities—CVE- 2013-0422, CVE-2013-0431, CVE-2013-1493 and CVE-2013-2423 —have been related to the Java development platform. These exploits are identified by various detections in our security products, including the specific detections Exploit:Java/CVE- 2013-2423.A and Exploit:Java/CVE-2013-2423.B, and a powerful generic detection, Exploit:Java/Majava.C. New tricks employed Given the consistent focus of multiple kits on exploiting Java, during this six month period Oracle has unsurprisingly been busy releasing updates to close the vulnerabilities under attack and to generally increase the security of the product. Of particularnotewastheJava7Update11,whichnotonlypatched the CVE-2013-0422 vulnerability but also changed the default JavaSecurityLevelfrom‘Medium’to‘High’.Thischangemeans that a security warning dialogue appears requiring the user to click ‘Run’ before an applet is able to execute. In response, attackers are now changing their methods and bypassing this feature by loading either serialized applets or Java Network Launch Protocol files (jnlp). 400+130+80+390=Blackhole 540+140+130+190=SweetOrange 330+310+200+160=Crimeboss 400+110+110+380=Styx 180+170+180+470=Cool 100%0% 81% 84% 62% 61% 51% top 3 host countries in h1 2013 for exploit sites per kit, % of total exploit sites 13 20+11+8 1413 33+18+11 16 17 Ukraine Romania Lithuania Latvia Germany France Netherlands 14 13 31Luxembourg 31 17 16 33 18 11 20 13 811 54+40+40US 54 40 40 top 3 host countries in h1 2013 for exploit sites per kit, Mapped as percentages (%) per country
36 f-secure | h1 2013 threat report exploit exploit kits / vulnerability exploitation Another new trick we saw introduced in H1 2013 is that a number of exploit kits, such as Neutrino, Sakura and Redkit, have started encrypting their binary payloads using XOR or AES encryption to evade detection. Exploit site hosting Users typically encounter exploit kits during online browsing, either by stumbling onto a compromised site injected with an exploit kit, or by being hijacked or redirected to a malicious attack site. Most of the websites distributing exploit kits are hosted in the United States and Europe. 3 countries in particular—the US, Germany and the Netherlands—host a significant portion of all exploit sites. Some exploit kits favor hosting their attack sites in specific countries. For Crimeboss, 84% of its exploit sites are hosted in just 3 countries—Germany, Luxembourg and the Netherlands. Meanwhile, the US hosted 54% of the sites known to distribute the SweetOrange exploit kit, as well as 40% of both Blackhole and Styx sites. Tracing the IP addresses associated with the Following on the trend from 2012, in H1 2013 vulnerability exploitation continues to be a popular way for malware distributors and attackers to gain access to a machine, whether it’s to plant malware on the system or to perform some other nefarious action. In this article, we look at some of the interesting trends we noted in exploiting vulnerabilities during the first six months of 2013. Focusing on zero-days Throughout most of 2012, we observed attacks mainly being targeted against vulnerabilities that had been publicly known for some time, often years. For example, throughout 2012, one of the most commonly attacked vulnerability was CVE-2010- 0288—a vulnerability in Adobe Reader and Acrobat that had been discovered fully two years earlier. In 2013 however, we noticed a shift and an increasing focus on exploiting zero-day vulnerabilities, which had not yet had patches released by the affected application’s vendor. During this period, our telemetry data indicated that an astonishing 95% of detections reported to our systems identifying attacks against specific vulnerabilities were targeted against only five vulnerabilities; and of the five most targeted, three were vulnerabilities that had only been publicly announced within the last six months. Not coincidentally, all the top five vulnerabilities are known targets for various exploit kits (see Exploit Kits article on page 34). kits also turned up a handful of ASNs involved in hosting the exploit sites. For example, 14% of Blackhole’s IP addresses, 12% of Styx’s and 7% of Cool’s were all tracked back to AS16276 OVH Systems. Protecting against exploit kits Themostcommonlycitedadviseforprotectingagainstexploit kits involves speeding patching of affected systems soon as updates are issued by vendors. When zero-day exploits are involved however, the most effective defense would be to reduce the attack surface of any system connected to the Internet. This requires a multi-faceted, ‘defense in depth’ approach to security, and includes such elements as web browser security, web traffic scanning, email filtering, well- implemented intrusion detection/prevention systems and more. For suggestions on how to protect a system against exploit kits, see Recommendations on page 39. Vulnerability Exploitation CVE-2011-3402 — the most targeted vulnerability Far and away the most commonly targeted vulnerability in H1 2013 was the CVE-2011-3402 Truetype font vulnerability in Windows. This vulnerability first came to prominence when it was used by the Duqu malware in a targeted attack campaign in early 2012; by late 2012, the exploit for the vulnerability had been added to various exploit kits. Since then, attacks against this single vulnerability have skyrocketed and in the past six months, CVE-2011-3402 alone accounted for an amazing 69% of all eploit-related detections reported. Java — second most targeted program Of the top five most targeted vulnerabilities, four are found in the Java development platform, either the Runtime Environment (JRE) or the browser plug-in. This is hardly surprising since next to the Windows operating system (also a popular target for exploits), Java is probably the second- most ubiquitous program in an organization’s IT setup. In H1 2013 however, the security issues related to Java received unwelcome attention from a series of widespread and
37 f-secure | h1 2013 threat report Unfortunately, removing either the runtime or plug-in may not be a feasible option for companies that use Java in business-critical instances. For organizations faced with such a dilemma, the alternative involves hardening their system’s or network’s attack surface against exploitation — a more effective, but also more complicated solution than just simply uninstalling a program. Possible mitigation strategies for these companies would likely involve some combination of tweaking Java’s security settings, configuring web browser settings to minimize unwanted applet execution (or installing other third- party plug-ins to do so) and monitoring network traffic. Geographical distribution of vulnerability attacks Perhaps unsurprisingly, the country that reported the most vulnerability-based attacks was the United States, where according to our telemetry data, approximately 78 out of every 1,000 users saw a detection identifying an exploit of a specific vulnerability within the last six months. successful corporate attacks on major technology and news companies such as Facebook, Twitter, Apple and NBC, some of whom have confirmed that the breach in their systems was traced to a zero-day exploit against Java. To counter the successive security issues that have been cropping up, Oracle has been busy issuing security updates over the last six months, as well as increasing the default Java security setting to ‘High’. Oracle itself has recommended that these patches be applied as soon as possible, given the critical nature of many of the vulnerabilities addressed in the patches. In addition, various security companies (as well as the United StatesDepartmentofHomelandSecurity)haverecommended thatusersandorganizationsremoveunnecessaryJavaruntime installations to safeguard their machines from intrusion — or at the very least, remove or disable the associated Java web browser plug-in, which is the first point of entry that exploits target to gain access to the program. exploit CVE Affects Notes 2011-3402 Windows OS Targeted by by multiple exploit kits, particularly Cool 2013-1493 Java Only affects Java in web browsers 2011-3544 Java Targeted by by multiple exploit kits, particularly Blackhole 2013-2423 Java Targeted by multiple exploit kits 2013-0422 Java Only affects JRE 7 69 +12+8+4+2+5 ALL OTHER CVES CVES ACCOUNT FOR OF ALL ATTACKS 95%5 Top 5 Exploited Vulnerabilities 95% of all vulnerability-related attacks reported by our clients in the first half of 2013 involved 5 vulnerabilities, 4 of them in Java. Top 10 Countries Based on the Exploit Prevalence Rate*, users in the United States, Germany and Belgium encountered the most vulnerability-related attacks in H1 2013. *Exploit Prevalence Rate, per 1000 users: calculated by dividing the total number of vulnerability exploit detections by the number of clients in the country, then multiplying by 1,000 Vulnerability exploit detections in h1 2013, summary 3+14+23+34+38+38+55+60+60+78 78 6060 383834 USDEBENLITSEFRDKFIGB 55 23 14 3 H1 2013 2012 2011-3402 2011-3402 2013-1493 2010-0188 2011-3544 2010-0188 2013-2423 2012-5076 2013-0422 2012-0507 Out with the old 3 of the top 5 targeted vulnerabilities (marked in blue) were discovered within the last 6 months.
38 f-secure | h1 2013 threat report Germany also saw a relatively high amount of vulnerability attacks, with approximately 60 out of every 1,000 users reporting a hit in the same time span. Of the top 10 most targetedcountries,allexcepttheUnitedStateswereinEurope. Market for exploits expanding For years now, a largely overlooked aspect of security has involved the way vulnerability disclosures are handled, especially for zero-days in popular applications. Security researchers and application vendors have long debated whether the best way to handle such issues was to keep the information secret (with or without payment), or publicly disclose it to force developers to fix the security problems. This has been of particular concern with the increasing activity in the rapidly growing ‘exploit sales’ market [1] , which essentially monetizes vulnerability research by selling the results to the highest bidder. In addition to the application vendor concerned, other players (government contractors, other researchers and malware authors) become potential buyers of information that was once released for free, or for a token sum. Though legal, exploit sales have typically been clandestine in nature. As vulnerability exploitation has become more widely used in both targeted attacks and malware distribution however, it seems to be becoming more prominent, if not exactly open. In early 2013, there was a report [2] of the Blackhole/Cool exploit kit author posting a notice in a Russian cybercrime forum, offering to purchase exploits. According to the reported translation of the notice, the ‘exclusive program’ offered by the author also included payment for “improvements to existing public exploits and also any good solutions for improving the rate of exploitation”. Government agencies and contractors have also reportedly been involved in purchasing software exploits, purportedly for use in offensive cyberattacks [3] , despite burgeoning concerns that this activity would ultimately damage the security and civil liberty of their own citizens [4] . Though no government has openly stated they are actively engaging in exploit purchasing, most reports implicate agencies in the United States and China of doing so. Countering exploits sales InH12013,Microsoftlauncheditsown‘bugbounty’programto encourageresearcherstoresponsiblydisclosevulnerabilitiesin its products. The company joins a small handful of technology entities (Facebook and the HP-affiliated Zero Day Initiative among them) trying to counter the lure of the ‘exploits-for- sale’ market by offering payment for vulnerability information. These initiatives faces stiff competition however; reports indicate that some government players are willing to pay six- figure sums for both the critical information and an agreement to keep the vulnerability private, essentially guaranteeing the buyer a secret access point to the program of interest. Government interest in exploit sales has also extended to tentative talk of introducing legislation to regulate the market[5] , at least in the European Union. Until that becomes a reality though, the market in exploit sales is likely to keep growing. What this means for the future state of cybersecurity is anyone’s guess, but at a minimum, organizations should certainly pay more attention to defending their networks and systems from vulnerability exploitation. SOURCES 1. Forbes; Bruce Schneier; The Vulnerabilities Market and the Future of Security; published 30 May 2012; http://www.forbes.com/sites/bruceschneier/2012/05/30/the-vulnerabilities-market-and-the-future-of-security/ 2. Krebs on Security; Brian Krebs; Crimeware Author Funds Exploit Buying Spree; published 7 Jan 2013; https://krebsonsecurity.com/2013/01/crimeware-author-funds-exploit-buying-spree/ 3. NY Times; Nicole Perlroth and David E. Sanger; Nations Buying as Hackers Sell Flaws in Computer Code; published 13 July 2013; http://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computer-flaws.html 4. Reuters; Joseph Menn; Special Report: U.S. cyberwar strategy stokes fear of blowback; published 10 May 2013; http://www.reuters.com/article/2013/05/10/us-usa-cyberweapons-specialreport-idUSBRE9490EL20130510 5. Slate; Ryan Gallagher; Cyberwar’s Gray Market: Should the secretive hacker zero-day exploit market be regulated?; published 16 January 2013; http://www.slate.com/articles/technology/future_tense/2013/01/zero_day_exploits_should_the_hacker_gray_market_be_regulated.html vulnerability exploitation exploit
recommendations: Protecting against exploits 1 Apply security updates Apply security patches for affected programs as soon as they are released by the application vendors. It would go a long way towards preventing a wide range of exploit kits from successfully compromising a machine. In addition to a consistent patch cycle (particularly if patches are problematic to push out), companies can protect their systems against vulnerability exploitation with an Intrusion Detection and Prevention System (IDS/IPS) running up-to-date signatures. top 15 most targeted vulnerabilities in h1 2013, listed by cve number 2 Minimize attack surface Security updates and intrusion detection are effective against known threats to already-patched vulnerabilities. But for zero-day exploits which do not yet have fixes, the most effective protection is to minimize the attack surface (the various vectors through which malicious code can be run) of any system connected to the Internet. For most end users, ‘reducing the attack surface’ translates simply enough to securing the web browser. This is particularly true in cases where uninstalling the Java web browser plug-in, currently a favored attack vector for multiple exploit kits, is not an option. In such cases, the user can instead increase the security of the web browser by: CVE Affects Patch Released 2013-2423 Java 16 April 2013 2013-1493 Java 4 March 2013 2013-1331 Microsoft Office 11 June 2013 (MS13-051) 2013-0809 Java 4 March 2013 2013-0422 Java 13 January 2013 2012-5076 Java 16 October 2012 2012-4681 Java 30 Aug 2012 2012-1723 Java 12 June 2012 2012-0507 Java 17 May 2012 2011-3544 Java 18 October 2011 2011-3402 Windows OS 8 May 2012 (MS12-034) 2010-0188 Adobe Reader Acrobat 23 February 2010 2010-0840 Java 30 March 2010 2010-1885 Windows OS 10 June 2010 (MS10-042) 2007-5659 Adobe Reader Acrobat 6 May 2008 (i) Updating Java In the Java 7 update 11 release, the default security level setting for Java was increased to High. This configuration means that users need to expressly authorize an applet execute (whether they are unsigned or self-signed). (ii) Disabling the Java browser plug-in If updating Java isn’t an option, user can focus on managing the Java browser plug-in by disabling the plug-in and only enabling it when needed. This can be done via a handy, one-click option in the Control Panel (available in the Java 7 update 10 release) or via the web browser’s settings. The instructions for disabling Java in various web browsers are available at: http://www.java.com/en/download/help/disable_browser.xml (iii) Using two browsers Rather than fiddling with security settings, the user may opt for a two-browser strategy, in which one browser with the Java plug-in enabled is dedicated solely to using the website or program that demands it. All other web browsing is done on a separate browser without the plug-in. (iv) Enabling Click to Play For Java-enabled web browsers, an additional touch of security comes from the plug-in blocking feature built into most browsers. In Firefox and Opera, it’s known as ‘Click to Play’ while Chrome has a ‘Block all’ option for plug-ins in its Contents Settings page. This functionality prevents automatic execution of plug-ins (not just Java) and requires the user to click on the plug-in of interest before it will run. (v) Using third-party apps Another possibility is to use third-party programs to block plug-ins from automatically running on page load, unless the user chooses otherwise. The most popular of such programs is NoScript, which blocks multiple types of active content in Mozilla-based browsers, though there are a handful of other applications available that perform a similar function. !! Zero-day exploits Even with fully patched programs and a locked down web browser, companies concerned about vulnerability-based attacks against their systems may also need to consider and counter the possibility of an undisclosed vulnerability being used.Insuchcases,thelastlineofdefenseisawell-implemented IDS/IPS setup, or an equivalent system capable of identifying suspicious activity on the machines in the protected network. Though general recommendations are less useful here, ideally, such a protection system would be a unique combination of network monitoring, firewall, white- and blacklisting solutions that suits the normal needs and production environment of the end users.
40 f-secure | h1 2013 threat report Kumar in the Mac (KitM) mac Lastyear,AppleintroducedasecurityfeaturecalledGatekeeper to OS X. Gatekeeper restricts running of applications to only those from identified developers as a default protection. This helps prevent users from unwittingly running malwares since malwares are generally not signed. Malware authors would not want their malicious work linked back to them, wouldn’t they? Ironically, this is exactly what a malware author did. To pass through the defense introduced by Apple, the malware was signed using an Apple Developer ID in the name of Rajinder Kumar (see Figure 1), hence the name KitM or “Kumar in the Mac.” KitM is our designation for samples signed by the affected Apple Developer ID. Figure 2: LinkedIn hits for Rajinder Kumar It is not clear whether Rajinder Kumar is the actual person behind the malware. A quick search of the name in LinkedIn returned at least 468 hits (see Figure 2). The name might as well be the “John Smith” equivalent of India. It might be just a disposable name cleverly chosen by the attackers to get an Apple Developer ID[1] . Regardless, Apple was swift in revoking the said ID to prevent any future infection of the malware. kumar in the mac (kitm) During the first half of 2013, we saw the first Mac malware signed with a valid Apple Developer ID. For those unfamiliar with code signing, the Apple Developer ID is like a signature in digital form. Just like a handwritten signature, which identifies a document to its author, a digital signature identifies a code to its developer. The malware was discovered by an independent researcher, Jacob Appelbaum. He found two spyware variants on the Mac machine of an Angolan activist during a workshop in the Oslo Freedom Forum. The first variant was an application bundle having a file called “FileBackup”. After the discovery, we startedminingourbackend system for samples having the same filename, and found one that dated back to April 21, 2012 [2,3] . The sample not only share the same filename but also its internal structures such as classes, methods, etc., which led us to conclude that it was indeed an earlier variant. This sample also contained build paths that revealed to us that the malware is actually a repurposed version of an open source online backup utility called FileBackup (see Figure 3). The utility uses a configuration file called “FileBackup.ini” to determine which files to backup (based on extensions) and where to upload the backup (based on a drop URL). Naturally, we tried to locate the corresponding configuration file. We found one that was shared to us by an AV partner at the same time as the sample mentioned earlier[4] . We found that the configuration file specified a domain (see Figure 4) similar to that in newer variants, which you will see later in Table 1. This confirmed that the sample is not just some benign utility but is indeed used maliciously. This also confirmed that the APT has been going on since much earlier than anyone has expected. Figure 1: Digital certificate of KitM Figure 3: Downloaded project called “FileBackup-1” Figure 4: Drop URL and extensions specified in a configuration file
41 f-secure | h1 2013 threat report mac kumar in the mac (kitm) The other variant discovered by Appelbaum is something we have never seen before. This variant takes screenshots instead of collecting files. Analysis of the sample revealed that it shared a lot of codes with the file-stealing variant, some of which were not even used. From this we deduced that the screen-grabbing variant is a development branch of the file- stealing variant. Since then, other cases have been reported which lead to the discovery of other earlier variants[5] . Some of the file-stealing variants have a downloader capability. In most cases, only the file stealer was used. In one case however, the file stealer downloaded a companion application, which turned out to be identical to the screen grabber discovered by Appelbaum. We therefore believe that most likely this is also the case for the Angolan activist. To summarize the attack (see Figure 5), the victim receives a spear phishing email containing the file stealer as an attachment. Take note that some of the file stealer variants have a downloader ability. The attachment, which is an application, poses as a document, image or other types of media. After the victim falls for the social engineering trick and get himself infected, the attackers may choose to introduce additional malware depending on the purpose of the attack. For now, only the screen grabber is know to be used but do not be surprised when a key logger or backdoor variant pops out in the future. It is not uncommon for APT attacks to have such components. Security researchers have linked the cases to a larger espionage effort known as Operation Hangover[6] . The operation is known to have been employing freelance developers[7] . Interestingly, a path containing the name “Elance” (see Figure 6) was found on an unused remnant file (login.scpt—see Table 1) of some of the file- stealing variants. Elance here may be a reference to the online freelance recruitment site[8] . Figure 6: Project for Elance @ Spear phishing email with the file stealer/ downloader as an attachment Attacker use the file stealer/downloader to install additional malware as necessary Figure 5: KitM attack summary KitM attack summary attack period unknown (received on apr 2012) dec 2012 h1 2013 may 2013 Signed by Rajinder Kumar (KitM) No Yes Yes Yes Designated malware family Hackback Hackback Hackback Undesignated Filename / AppDelegate-prefix FileBackup FileBackup FileBackup macs / macps Functionality Collect files Collect files Collect files / downloader Take screenshots Uses “FileBackup.ini” Yes No No No Uses “login.scpt” Yes No No No Comes with “login.scpt” Yes Yes Yes No Domain of Drop URL liveapple[dot]eu liveapple[dot]eu liveapple[dot]eu; securitytable[dot]org securitytable[dot]org Domain of secondary payload URL n/a n/a liveapple[dot]eu; torqspot[dot]org n/a Remnant domain found in sample researcherzone[dot]net (used as fallback) None None docsforum[dot]info Table 1: Sample development summary
42 f-secure | h1 2013 threat report mac Sources 1. Twitter; Sean Sullivan; published 16 May 2013; https://twitter.com/5ean5ullivan/status/334987332556054528 2. Twitter; Sean Sullivan; published 16 May 2013; https://twitter.com/5ean5ullivan/status/335055459859980290 3. Sample; sha1 hash: 93decbdc89e52d5c5bde5d443f131f001e2b49d7 4. Sample; sha1 hash: 55374f3a281bd81e70ae1be8857085906cc87204 5. F-Secure Weblog; Sean Sullivan; Mac Spyware Bait: Lebenslauf für Praktitkum; published 23 May 2013; http://www.f-secure.com/weblog/archives/00002559.html 6. F-Secure Weblog; Sean Sullivan; Big Hangover; published 21 May 2013; http://www.f-secure.com/weblog/archives/00002557.html 7. Dark Reading; Kelly Jackson Higgins; ‘Hangover’ Persists, More Mac Malware Found; published 18 July 2013; http://www.darkreading.com/attacks-breaches/hangover-persists-more-mac-malware-found/240158537 8. Elance; http://www.elance.com/ We have summarized the major sample developments of the attacks in Table 1. You may notice that during the majority of the operation, the attackers used “liveapple[dot] eu” as the command and control (CC), which lasted until early H1 2013 (February). However the remnant domain “researcherzone[dot]net” was found on the April 2012 sample. This may indicate that there are yet undiscovered earlier samples using that domain as CC. During later H1 2013 (April), the CC changed to “securitytable[dot]org” for the drop URL and “torqspot[dot] org” for the secondary payload URL. We all know that the secondary payload hosted in “torqspot[dot]org” was the screen grabber discovered by Appelbaum. However no one has found a sample yet that is supposed to be the secondary payload hosted in “liveapple[dot]eu” when it was live. The authors have implemented the downloader capability long before the “securitytable[dot]org”/”torqspot[dot]org” variant, which almost guaranteed that such sample exists. This sample should be something that is not a file stealer, perhaps an earlier variant of the screen grabber or another type of malwarelikeabackdoororkeyloggerthatuses“liveapple[dot] eu” as its drop URL domain. Finally the remnant domain “docsforum[dot]info” found in the screen grabber may indicate that there are undiscovered secondary payload samples using that domain as CC. Whichever is the case, users can be assured that their AV will most likely be able to detect if not protect infection from those possible in-between variants. This is because it is known that the attackers have always used a file-stealing malware that belongstoanalreadywell-knownfamily,atleastbynow,called Hackback as the initial payload. For those missing secondary payloads, we know that the attackers have been signing their work long before they started using secondary payloads, which means these missing variants will also be signed. For F-Secure users, these variants will be identified as Kumar in the Mac (KitM). kumar in the mac (kitm)
1/2 Rootkit 1/2 Virus 57+43+z57.6% backdoor 19/33 36+64+z36.4% trojan 12/33 6+94+z6% others 2/33 1/4 Virus apr 3/4 backdoor 4/5 trojan-spy may 1/5 backdoor jun 1/5 trojan 2/5 backdoor 1/5 trojan-Dropper 1/5 trojan-spy 2/2 backdoor jan 4/14 trojan-spy feb 10/14 backdoor 1/3 trojan-spy mar 1/3 backdoor 1/3 rootkit ** The number shown is the count of unique variants detected. This means repackaged installers are not counted and multiple component malware only have 1 count. 33families + variants of Mac malware TOTAL COUNT (Jan-Jun 2013) = Mac malware H1 2013 30 20 10 0 jan feb mar apr may jun 5543 14 2 2 19 23 28 33 Running total New Families and variants 16
44 f-secure | h1 2013 threat report Phishing webreputation When the word phishing comes to mind, we usually think of our bank accounts and the credentials needed to access them. But in the age of one-time passwords and multiple-factor authentications, a lowly phishing webpage rarely stands a chance against such sophisticated protection. As such, more advanced banking trojans have emerged to take on the challenge of breaking into online- accessible bank accounts. This does not mean that phishing has been rendered obsolete however; it only means that phishing has to be less discriminating regarding its catch. Nowadays, every person who spends time online has something that phishers can steal and attempt to sell. In an age where all online information is fair game, the melody has become: if it has a username and password, then it can be a phishing target—if it’s not already. This means everything from Google, Yahoo, AOL or Live accounts used for e-mails and online storage, to social networking and media accounts such as Facebook and Twitter, used to keep abreast with the latest updates from various connections. Even dating websites are not immune. Match. com and SeniorPeopleMeet are only a few of the names targeted in the dating scene. And how about gaming sites and gaming portals? Battle.net, Steam, Runescape, Habbo, anyone? Sourcing and reaching targets The most visible place where users run into phishing URLs are spam e-mails. The recipients for these unsolicited mails can be bought in bulk from underground markets or even various websites that offer e-mail addresses for sale (see Figure 1). After the e-mail addresses are obtained, the spamming begins. Despite the low click-through rate associated with spam, the sheer volume of spam sent out worldwide results in enough traffic going to the phishing sites to make this method a mainstay of the phisher’s business model. Once the users click the link in the spam e-mail, they are taken to the phishing site, which is usually crafted with a particular target in mind. Types of phishing sites We profiled 71% of all the phishing URLs we gathered during the first half of this year and found that they are of two types: direct phishes and indirect phishes. Figure 1: Websites selling e-mail addresses Figure 2: A direct phishing site (left); an indirect phishing site (bottom)
45 f-secure | h1 2013 threat report webreputation Direct phishing straightforwardly involves displaying a fake webpage mimicking the target site, which is used to steal login credentials and possibly other information for that site (see Figure 2, top left). This type of phishing has been around since phishing has existed and has not really changed much, except perhaps for the improving ‘look and feel’ of the phishing sites. When it comes to the overall coverage though, direct phishes still trump indirect phishes 99 to 1. Indirect phishes are pretty recent and involve displaying a fake webpage mimicking a secondary ‘bait’ site, which is used to steal the credentials for another site, which is the real target. For instance, the ‘bait’ site may be a tax filing site linked to various banks, and the phishing site copying the bait may include a new ‘feature’ that requires the users of the associated banks to enter their username and password for “account verification” (see Figure 2, bottom). Indirect phishes are mostly, though not exclusively, targeting sites in the real estate, taxation and logistics categories. Phishing Sites Distribution When it comes to sorting out what is the most valuable information that phishers are aiming for, PayPal credentials top the charts—the online payment service is the target of 73% of all phishing sites we profiled, with all other organizations sharing the remaining 27%. It’s pretty obvious why that information is easy to sell, it’s essentially free money. Also, since usage of the service is so widespread, phishers can get victims from everywhere. Phishing, being less discriminating nowadays, necessarily covers a wide range of categories (the type of targets they attack), though the top 10 most targeted categories are, unsurprisingly, usually in some way related to online commerce. The phishing sites are also expanding by targeting brands in various regions and countries (quite aside from the fact that many of these brands also have an international presence). The geographical distribution of the phishing sites and their categories are listed on the next page. Automated Phishing and Scattershot Phishing Since phishing kits (toolkits that automate the production of phishing sites) have become quite common, setting up phishing pages for anything that will take the bait has become easier, and everyone is now a potential victim. These kits make it easier for the miscreants to generate different pages for potentially different targets. Although this article does not go into detail dissecting individual phishing kits, one point worth noting is the similarity in the format many phishing links, which points to the pages being automatically generated, which in turn indicates the phishing is being facilitated by the use of a phishing kit. Another notable trend in the phishing sites we’ve seen is scattershot phishing, which involves multiple financial institutions, as well as other targets, getting phished from a single domain. This technique allows the phisher to target potential victims at a fraction of the cost, as multiple domains don’t need to be created to address multiple targets. Above is an example of scattershot phishing. Selling the Harvest Once the phishers have gained their victim’s information, they can sell their ‘wares’ in underground markets or websites. The details can be sold on a per-item basis or in batches, depending on the site and the sellers’ preferences. Below are examples of two sites that cater to this underground market in stolen credentials. single domains phishing for multiple organizations Figure 3: Underground markets and sites selling credentials harvested from phishing hxxp://ahmadmachinery.com/parts/yphimail/yh.html (YahooMail) hxxp://ahmadmachinery.com/irs.gov/(IRS)hxxp://ahmadmachinery.com/gtbank/ (GTBank)
46 f-secure | h1 2013 threat report phishing webreputation top 10 categories for phished sites, by percentage Banks Gaming Credit cards Real estate ISPs Utilities Online shopping Online portals Social media All other types 1 % Payment services targeted brands per region, by percentage 28+72+W23+77+V22+78+U13+87+S6+94+R4+96+L4+96+z Europe Global North America South America Oceania Africa Asia 28 2322 136 4 4 % 992663901145351324 Payment Gaming Banks Credit cards Online shopping 10 60 Online portals 132775Real estate 421 31ISPs 383088Social media 48 100Utilities 6320Électricité de France (EDF) Facebook Twitter SFR Vodafone Remax Coldwell Banker AOL Yahoo! Ebay Cielo Visa Poste Italiane Banco Bradesco Battle.net Runescape Paypal top phished brands per category, by percentage All other brands 100500 % ISPs 82 13 11 4 4 4 56 6 7 Banks Online shopping Credit cards Online portals Real estate Dating sites Gaming Social media tax agencies number of targeted brands per category, top 10 Coldwell Banker, Homeaway, Loopnet, Remax, Sotheby Realty, US Property categories brands targeted for indirect phishes, by percentage 80+19+1Real estate agencies Logistics companies 1 % 19 80 Tax agencies 0 100 HMRC, IRS, SARS, SKAT Direct Logistics
47 f-secure | h1 2013 threat report Sources Sources h1 2013 incidents calendar (page 6) Malware Development [1] Krebs on Security; Krebs, Brian; Crimeware Author Funds Exploit Buying Spree; published 7 January 2013; http://krebsonsecurity.com/2013/01/crimeware-author-funds-exploit-buying-spree/ [2] Securelist; GReAT; The MiniDuke Mystery: PDF 0-day Government Spy Assembler 0x29A Micro Backdoor; published 27 February 2013; http://www.securelist.com/en/blog/208194129/The_MiniDuke_Mystery_PDF_0_day_Government_Spy_Assembler_0x29A_Micro_Backdoor [3] F-Secure Weblog; Aquino, Karmina; Flash Exploit Targets Uyghur Website; published 13 March 2013; http://www.f-secure.com/weblog/archives/00002524.html [4] F-Secure Weblog; Aquino, Karmina; CVE-2013-2423 Java Vulnerability Exploit ITW; published 23 April 2013; http://www.f-secure.com/weblog/archives/00002544.html [5] Microsoft; Microsoft Security Tech Center; Microsoft Security Advisory (2847140); published 14 May 2013; http://technet.microsoft.com/en-us/security/advisory/2847140 [6] The Register; Thomson, Iain; Mac malware found with valid developer ID at freedom conference; published 17 May 2013; http://www.theregister.co.uk/2013/05/17/mac_malware_steals_screenshots/ Hacks Espionage [1] Arstechnica; Goodin, Dan; Red October espionage platform unplugged hours after its discovery; published 19 January 2013; http://arstechnica.com/security/2013/01/red-october-espionage-platform-unplugged-hours-after-its-discovery/ [2] New York Times; Perlroth, Nicole; Hackers in China Attacked The Times for Last 4 Months; published 30 January 2013; http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html [3] F-Secure Weblog; Sullivan, Sean; Timeline: Hacks Related to Apple; published 20 February 2013; http://www.f-secure.com/weblog/archives/00002507.html [4] F-Secure Weblog; Sullivan, Sean; Evernote Hacked: 50 Million E-mail Addresses Exposed; published 4 March 2013; http://www.f-secure.com/weblog/archives/00002516.html [5] Guardian UK; Branigan, Tania; South Korea on alert for cyber-attacks after major network goes down; published 20 March 2013; http://www.guardian.co.uk/world/2013/mar/20/south-korea-under-cyber-attack [6] Arstechnica; Bright, Peter; Spamhaus DDoS grows to Internet-threatening size; published 28 March 2013; http://arstechnica.com/security/2013/03/spamhaus-ddos-grows-to-internet-threatening-size/ [7] Onion Inc.’s Tech Blog; Onion Inc.’s Tech Team; How the Syrian Electronic Army Hacked The Onion; published 8 May 2013; http://theonion.github.io/blog/2013/05/08/how-the-syrian-electronic-army-hacked-the-onion/ [8] Wired UK; Shubber, Kadhim; Millions of users’ data hacked in Yahoo Japan security breach; published 20 May 2013; http://www.wired.co.uk/news/archive/2013-05/20/yahoo-japan-hacked [9] Trend Micro; Wilhoit, Kyle; Hiding in Plain Sight: A New Targeted Attack Campaign; published 17 May 2013; http://www.guardian.co.uk/technology/2013/jun/07/uk-gathering-secret-intelligence-nsa-prism [10] Guardian; Hopkins, Nick; UK gathering secret intelligence via covert NSA operation; published 7 June 2013; http://www.guardian.co.uk/technology/2013/jun/07/uk-gathering-secret-intelligence-nsa-prism [11] Securelist; GReAT; “NetTraveler is Running!” - Red Star APT Attacks Compromise High-Profile Victims; published 4 June 2013; http://www.securelist.com/en/blog/8105/NetTraveler_is_Running_Red_Star_APT_Attacks_Compromise_High_Profile_Victims [12] Trend Micro; Aquino, Marhalito; RARSTONE found in Targeted Attacks; published 13 June 2013; http://www.guardian.co.uk/technology/2013/jun/07/uk-gathering-secret-intelligence-nsa-prism
48 f-secure | h1 2013 threat report Sources Mobile Malware Development [1] McAfee; Zhang, Michael; SMS Trojan Targets South Korean Android Devices; published 25 February 2013; http://blogs.mcafee.com/mcafee-labs/sms-trojan-targets-south-korean-android-devices [2] Dell SecureWorks; Stone-Goss, Brett; Stels Android Trojan Malware Analysis; published 22 March 2013; http://www.secureworks.com/cyber-threat-intelligence/threats/stels-android-trojan-malware-analysis/ [3] Arstechnica; Gallagher, Sean; First targeted attack to use Android malware discovered; published 27 March 2013; http://arstechnica.com/security/2013/03/first-targeted-attack-to-use-android-malware-discovered/ [4] The Register; McAllister, Neil; Sneaky new Android Trojan is WORST yet discovered; published 7 June 2013; http://www.theregister.co.uk/2013/06/07/android_obad_trojan/ [5] F-Secure Weblog; Sullivan, Sean; Post-PC Attack Site: Only Interested in Smartphones/Tablets; published 19 June 2013; http://www.f-secure.com/weblog/archives/00002569.html Security Enforcement [1] Europol; Europol; Police dismantle prolific ransomware cybercriminal network; published 13 February 2013; https://www.europol.europa.eu/content/police-dismantle-prolific-ransomware-cybercriminal-network [2] SCMagazine; Colon, Marcus; New anti-bot code of conduct approved by FCC; published 28 March 2013; http://www.scmagazine.com/new-anti-bot-code-of-conduct-approved-by-fcc/article/233756/ [3] Reuters; Accused LulzSec hacker gets year in prison over Sony breach; published 18 April 2013; http://uk.reuters.com/article/2013/04/18/usa-lulzsec-hacker-idUKL2N0D521220130418 [4] The Register; Leyden, John; British LulzSec hackers hear jail doors slam shut for years; published 16 May 2013; http://www.theregister.co.uk/2013/05/16/lulzsec_sentencing/ [5] ZDNet; van Blommestein, Michiel; Spamhaus DDoS suspect extradited, faces Dutch court; published 9 May 2013; http://www.zdnet.com/spamhaus-ddos-suspect-extradited-faces-dutch-court-7000015120/ [6] Arstechnica; Gallagher, Sean; Twitter launches two-factor authentication, too late to save The Onion; published 23 May 2013; http://www.zdnet.com/spamhaus-ddos-suspect-extradited-faces-dutch-court-7000015120/ [7] BBC; FBI and Microsoft take down $500m-theft botnet Citadel; published 6 June 2013; http://www.bbc.co.uk/news/technology-22795074 [8] FBI; Leader in $200 Million International Stolen Data Ring Charged in New Jersey as Part of Worldwide Takedown; published 5 June 2013; http://www.fbi.gov/newark/press-releases/2013/leader-in-200-million-international-stolen-data-ring-charged-in-new-jersey-as-part-of- worldwide-takedown [9] ZDNet; Whittaker, Zack; Microsoft unleashes bug bounty program — for betas, too; published 19 June 2013; http://www.zdnet.com/microsoft-unleashes-bug-bounty-program-for-betas-too-7000016956/ [10] Trend Micro; Aquino, Marhalito; Targeted Attack in Taiwan Uses Infamous Gh0st RAT; published 23 June 2013; http://blog.trendmicro.com/trendlabs-security-intelligence/targeted-attack-in-taiwan-uses-infamous-gh0st-rat/
F-Secure has been protecting the digital lives of consumers and businesses for over 20 years. Our Internet security and content cloud services are available through over 200 operators in more than 40 countries around the world and are trusted in millions of homes and businesses. In 2012, the company’s revenues were EUR 157 million and it has over 900 employees in more than 20 offices worldwide. F-Secure Corporation is listed on the NASDAQ OMX Helsinki Ltd. since 1999. F-Secure in Brief
Protecting the Irreplaceable F-Secure proprietary materials. © F-Secure Corporation 2013. All rights reserved. F-Secure and F-Secure symbols are registered trademarks of F-Secure Corporation and F-Secure names and symbols/logos are either trademark or registered trademark of F-Secure Corporation. Protecting the irreplaceable | f-secure.com

More Related Content

PDF
Your money or your files
Roel Palmaers
 
PDF
Hacking 10 2010
Felipe Prado
 
PDF
Bot software spreads, causes new worries
UltraUploader
 
PPTX
Security weekly september 28 october 4, 2021
Roen Branham
 
PDF
On How the Darknet and its Access to SCADA is a Threat to National Critical I...
Matthew Kurnava
 
PDF
Qrator Labs annual report 2017
Qrator Labs
 
DOC
14 cyber threats
mahesh43211
 
PDF
Secureview 2q 2011
Felipe Prado
 
Your money or your files
Roel Palmaers
 
Hacking 10 2010
Felipe Prado
 
Bot software spreads, causes new worries
UltraUploader
 
Security weekly september 28 october 4, 2021
Roen Branham
 
On How the Darknet and its Access to SCADA is a Threat to National Critical I...
Matthew Kurnava
 
Qrator Labs annual report 2017
Qrator Labs
 
14 cyber threats
mahesh43211
 
Secureview 2q 2011
Felipe Prado
 

What's hot (20)

PDF
Cybercrime: An Analysis from Positive Law Perspective
Associate Professor in VSB Coimbatore
 
PDF
Sophos security-threat-report-2014-na
Andreas Hiller
 
PDF
Cybercrime, cyber war, infowar - what's this all about from an hacker's persp...
ClubHack
 
DOCX
Cyber crime
Ranjana Adhikari
 
PPTX
chapter 3 ethics: computer and internet crime
muhammad awais
 
DOCX
How_effective_are_policies_which_increas
Ivan Rainovski
 
PDF
Sophos Security Threat Report 2014
- Mark - Fullbright
 
PPSX
Unit 2
Jigarthacker
 
PDF
MainPaper_4.0
varun4110
 
PDF
A Joint Study by National University of Singapore and IDC
Microsoft Asia
 
PPT
Cyber Wars And Cyber Terrorism
Ganesh DNP
 
DOCX
Final Copy Cyber Crime Research Essay
Callum Craigie
 
PDF
AECF: A Look into Cyber Crime - Doomsday Preppers for the Naked and Afraid
Phil Agcaoili
 
PPTX
Cyber terrorism
KaustubhPathak11
 
PPTX
Cyber terrorism
Savigya Singh
 
PPTX
Ransomware Review 2017
Dryden Geary
 
PDF
Getting users to care about security
Alison Gianotto
 
PPTX
cyber attacks in May , breaches in May
Sathish Kumar K
 
PDF
How Safe is your Data?
Michael Soltys
 
DOC
Report of cyber crime
Alisha Korpal
 
Cybercrime: An Analysis from Positive Law Perspective
Associate Professor in VSB Coimbatore
 
Sophos security-threat-report-2014-na
Andreas Hiller
 
Cybercrime, cyber war, infowar - what's this all about from an hacker's persp...
ClubHack
 
Cyber crime
Ranjana Adhikari
 
chapter 3 ethics: computer and internet crime
muhammad awais
 
How_effective_are_policies_which_increas
Ivan Rainovski
 
Sophos Security Threat Report 2014
- Mark - Fullbright
 
Unit 2
Jigarthacker
 
MainPaper_4.0
varun4110
 
A Joint Study by National University of Singapore and IDC
Microsoft Asia
 
Cyber Wars And Cyber Terrorism
Ganesh DNP
 
Final Copy Cyber Crime Research Essay
Callum Craigie
 
AECF: A Look into Cyber Crime - Doomsday Preppers for the Naked and Afraid
Phil Agcaoili
 
Cyber terrorism
KaustubhPathak11
 
Cyber terrorism
Savigya Singh
 
Ransomware Review 2017
Dryden Geary
 
Getting users to care about security
Alison Gianotto
 
cyber attacks in May , breaches in May
Sathish Kumar K
 
How Safe is your Data?
Michael Soltys
 
Report of cyber crime
Alisha Korpal
 
Ad

Viewers also liked (6)

PDF
2016 Symantec Internet Security Threat Report
RapidSSLOnline.com
 
PPTX
Correct the most common web development security mistakes - Eric Vanderburg
Eric Vanderburg
 
PPTX
Preventing Fraud from Top to Bottom - Vanderburg, Gaddamanugu - Information S...
Eric Vanderburg
 
PDF
Symantec Website Security Threat Report 2014 - RapidSSLOnline
RapidSSLOnline.com
 
PPTX
Eradicate the Bots in the Belfry - Information Security Summit - Eric Vanderburg
Eric Vanderburg
 
PPTX
Cloud Storage and Security: Solving Compliance Challenges
Eric Vanderburg
 
2016 Symantec Internet Security Threat Report
RapidSSLOnline.com
 
Correct the most common web development security mistakes - Eric Vanderburg
Eric Vanderburg
 
Preventing Fraud from Top to Bottom - Vanderburg, Gaddamanugu - Information S...
Eric Vanderburg
 
Symantec Website Security Threat Report 2014 - RapidSSLOnline
RapidSSLOnline.com
 
Eradicate the Bots in the Belfry - Information Security Summit - Eric Vanderburg
Eric Vanderburg
 
Cloud Storage and Security: Solving Compliance Challenges
Eric Vanderburg
 
Ad

Similar to Threat report h1_2013 (20)

PPTX
Cyber security and current trends
Shreedeep Rayamajhi
 
DOCX
Discuss similarities and differences between and Trojan.docx
write12
 
PDF
Cyberterrorism
Buy A Paper Gallatin
 
PDF
Cyber Terrorism
Buy Cheap Papers Clarkson University
 
PDF
File000145
Desmond Devendran
 
PPTX
Cybercrime: A Seminar Report
Arindam Sarkar
 
PPTX
220715_Cybersecurity: What's at stake?
Spire Research and Consulting
 
PDF
wp-understanding-ransomware-strategies-defeat
Robert Leong
 
PDF
Invesitigation of Malware and Forensic Tools on Internet
IJECEIAES
 
PDF
Cyberterrorism Essays
Help With Papers Tacoma
 
PDF
A Review Paper on Cyber-Security
IRJET Journal
 
PDF
Cyber crime and security
Muhammad Hamza
 
PDF
Cyber Terrorism Essay
Custom Paper Services
 
PDF
Global Technologies and Risks Trends
Charles Mok
 
PDF
Honeypots for Network Security
Kirubaburi R
 
PPTX
Security Trends to Watch in 2010 - A Mid-Year Status Check
Symantec
 
PDF
Cyber crime
Debayon Saha
 
PDF
BLURRING BOUNDARIES
- Mark - Fullbright
 
PDF
Terrorist Cyber Attacks
Write My Paper One Day Mercy College
 
DOCX
Running headEMERGING THREATS AND COUNTERMEASURES .docx
rtodd599
 
Cyber security and current trends
Shreedeep Rayamajhi
 
Discuss similarities and differences between and Trojan.docx
write12
 
Cyberterrorism
Buy A Paper Gallatin
 
Cyber Terrorism
Buy Cheap Papers Clarkson University
 
File000145
Desmond Devendran
 
Cybercrime: A Seminar Report
Arindam Sarkar
 
220715_Cybersecurity: What's at stake?
Spire Research and Consulting
 
wp-understanding-ransomware-strategies-defeat
Robert Leong
 
Invesitigation of Malware and Forensic Tools on Internet
IJECEIAES
 
Cyberterrorism Essays
Help With Papers Tacoma
 
A Review Paper on Cyber-Security
IRJET Journal
 
Cyber crime and security
Muhammad Hamza
 
Cyber Terrorism Essay
Custom Paper Services
 
Global Technologies and Risks Trends
Charles Mok
 
Honeypots for Network Security
Kirubaburi R
 
Security Trends to Watch in 2010 - A Mid-Year Status Check
Symantec
 
Cyber crime
Debayon Saha
 
BLURRING BOUNDARIES
- Mark - Fullbright
 
Terrorist Cyber Attacks
Write My Paper One Day Mercy College
 
Running headEMERGING THREATS AND COUNTERMEASURES .docx
rtodd599
 

More from Комсс Файквэе (20)

PDF
Ksb 2013 ru
Комсс Файквэе
 
PDF
Rp quarterly-threat-q3-2013
Комсс Файквэе
 
PDF
Rp data breach-investigations-report-2013-en_xg
Комсс Файквэе
 
PDF
Apwg trends report_q2_2013
Комсс Файквэе
 
PDF
Mobile threat report_q3_2013
Комсс Файквэе
 
PDF
Scimp paper
Комсс Файквэе
 
PDF
Ey giss-under-cyber-attack
Комсс Файквэе
 
PDF
Hta t07-did-you-read-the-news-http-request-hijacking
Комсс Файквэе
 
PDF
Analitika web 2012_positive_technologies
Комсс Файквэе
 
PDF
B istr main-report_v18_2012_21291018.en-us
Комсс Файквэе
 
PDF
B intelligence report-08-2013.en-us
Комсс Файквэе
 
PDF
Dtl 2013 q2_home.1.2
Комсс Файквэе
 
PDF
Rp quarterly-threat-q1-2012
Комсс Файквэе
 
PDF
Kaspersky lab av_test_whitelist_test_report
Комсс Файквэе
 
PDF
The modern-malware-review-march-2013
Комсс Файквэе
 
PDF
Dtl 2012 kl-app_ctl1.2
Комсс Файквэе
 
PDF
Panda labs annual-report-2012
Комсс Файквэе
 
PDF
H02 syllabus
Комсс Файквэе
 
PDF
Course reader-title
Комсс Файквэе
 
PDF
Rp threat-predictions-2013
Комсс Файквэе
 
Ksb 2013 ru
Комсс Файквэе
 
Rp quarterly-threat-q3-2013
Комсс Файквэе
 
Rp data breach-investigations-report-2013-en_xg
Комсс Файквэе
 
Apwg trends report_q2_2013
Комсс Файквэе
 
Mobile threat report_q3_2013
Комсс Файквэе
 
Scimp paper
Комсс Файквэе
 
Ey giss-under-cyber-attack
Комсс Файквэе
 
Hta t07-did-you-read-the-news-http-request-hijacking
Комсс Файквэе
 
Analitika web 2012_positive_technologies
Комсс Файквэе
 
B istr main-report_v18_2012_21291018.en-us
Комсс Файквэе
 
B intelligence report-08-2013.en-us
Комсс Файквэе
 
Dtl 2013 q2_home.1.2
Комсс Файквэе
 
Rp quarterly-threat-q1-2012
Комсс Файквэе
 
Kaspersky lab av_test_whitelist_test_report
Комсс Файквэе
 
The modern-malware-review-march-2013
Комсс Файквэе
 
Dtl 2012 kl-app_ctl1.2
Комсс Файквэе
 
Panda labs annual-report-2012
Комсс Файквэе
 
H02 syllabus
Комсс Файквэе
 
Course reader-title
Комсс Файквэе
 
Rp threat-predictions-2013
Комсс Файквэе
 

Recently uploaded (20)

PDF
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
PDF
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
PPTX
Cloud computing and distributed systems.
kkkkkhan
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
PPTX
A Presentation on Artificial Intelligence
memembruh336
 
PDF
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
PPT
Teaching material agriculture food technology
LiaRayya
 
PDF
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
PDF
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
PPTX
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
PDF
KodekX | Application Modernization Development
KodekX
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
MYSQL Presentation for SQL database connectivity
Swati270511
 
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
Cloud computing and distributed systems.
kkkkkhan
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
A Presentation on Artificial Intelligence
memembruh336
 
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
Teaching material agriculture food technology
LiaRayya
 
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
KodekX | Application Modernization Development
KodekX
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 

Threat report h1_2013

  • 1. Threat Report Protecting the irreplaceable | www.f-secure.com H1 2013
  • 2. F-Secure Labs At the F-Secure Response Labs in Helsinki, Finland, and Kuala Lumpur, Malaysia, security experts work around the clock to ensure our customers are protected from the latest online threats. At any given moment, F-Secure Response Labs staff are on top of the worldwide security situation, ensuring that sudden virus and malware outbreaks are dealt with promptly and effectively. Protection around the clock Response Labs’ work is assisted by a host of automatic systems that track worldwide threat occurrences in real time, collecting and analyzing hundreds of thousands of data samples per day. Criminals who make use of virus and malware to profit from these attacks are constantly at work on new threats. This situation demands around the clock vigilance on our part to ensure that our customers are protected.
  • 3. 3 f-secure | h1 2013 threat report In 2008, a mathematician called Satoshi Nakamoto (a pseudonym) submitted a technical paper for a cryptography conference. The paper described a peer-to-peer network, where participating systems would do complicated mathematical calculations on something called a “blockchain.” This system was designed to create a completely new currency — a crypto currency — which is based on math. The paper was titled “Bitcoin: A Peer-to-Peer Electronic Cash System.” Since Bitcoin is not linked to any existing currency, its value is purely based on the value people believe it’s worth. And since it can be used to do instant transactions globally, it does have value. Sending Bitcoins around is very much like sending e-mail. If I have your address, I can send you money. I can send it to you instantly, anywhere, bypassing exchanges, banks and the tax man. In fact, crypto currencies make banks unnecessary for moving money around. Which is why banks hate the whole idea. The beauty of the algorithm behind Bitcoin is solving the two main problems of crypto currencies by joining them — how do you confirm transactions, and how do you inject new units of currency into the system without causing inflation. Since there is no central bank in the system, the transactions need to be confirmed somehow. Otherwise one could fabricate fake money. In Bitcoin, the confirmations are done by other members of the peer-to-peer network. At least six members of the peer- to-peer network have to confirm the transactions before they go through. But why would anybody confirm transactions for others? Because they get rewarded for it: the algorithm issues new Bitcoins as a reward to users who have been participating in confirmations. This is called “mining.” When Bitcoin was young, mining was easy and you could easily make dozens of Bitcoins on a home computer. However, as Bitcoin value grew, mining became harder since there were more people interested in doing it. Even though the dollar-to-BTC exchange rate has fluctuated, the fact remains that in the beginning of 2013, one Bitcoin was worth USD 8 and by the fall they were worth USD 130. So Bitcoins now have real-world value. Today, there are massively large networks of computers mining Bitcoins and other competing crypto currencies (such as Litecoin). The basic idea behind mining is easy enough: if you have powerful computers, you can make money. Unfortunately, those computers don’t have to be your own computers. So, you’d have an infected home computer of a grandmother in, say, Philadelphia, running Windows XP at 100% utilization around the clock as it is mining coins for a Russian cyber crime gang. As detailed in this Threat Report, the second largest botnet in the world is already doing this. We estimate them to make over $50,000 a day by mining Bitcoins on infected computers. If such operations are already happening today, it’s easy to see that such mining botnets will become very popular for online criminals in the future. foreword “The basic idea behind mining crypto currencies is easy enough: if you have powerful computers, you can make money.“ Mikko HyppÖnen Cro, f-secure labs http://twitter.com/mikko FOREWORD
  • 4. 4 f-secure | h1 2013 threat report Executive Summary executive summary Applying security patches can be compared to putting locks on your doors and windows upon hearing the news of burglars lurking around town. But the problem is there are so many burglars out there and you have so many doors and windows to secure - you don’t know which exact way they will enter your house. You can patch the holes one after another, but the burglars will keep on trying. It sounds like a plot of a thriller movie but it is not a farfetched story considering our dependence on computer devices nowadays. The bad guys are always on the lookout for any vulnerabilities - the holes in the wall that can be exploited. Exploit attacks against known vulnerabilities are everywhere and Java-targeted ones are leading the pack. In the previous half-year, Java-targeted exploits accounted for about one- third of the detections reported to our cloud-based telemetry systems from our protected clients; in the first half of this year, they made up almost half of the detections reported. The Java exploits mostly targeted the CVE-2013-1493 and CVE-2011-3544 vulnerabilities, while an exploit for the Windows TrueType Font vulnerability CVE-2011-3402 makes up 10% of the Top 10 Detections reported globally (a 4% increase for the same exploit from H2 2012). We also look into the exploit kits being used to facilitate most of these attacks, particularly Blackhole, SweetOrange and Cool. The whole point of carrying out an exploit-based attack is to install malware onto a system - be it ransomware, bots, banking trojans or backdoors. We noted that “Anti Child Porn Spam Protection” ransomware was circulating during March and April this year. The ZeroAccess botnet was quite active as well during the same period, even though our statistics seem to show the number of ZeroAccess infections drastically declining. This is probably due to the effectiveness of our Majava detections, which successfully prevented attacks that would otherwise have delivered ZeroAccess. With the recent peak in Bitcoin’s exchange rate, we tried making an educated guesstimation of ZeroAccess’s potential monthly profit from Bitcoin mining activity. And the number is huge. One exploitation method used Advanced Persistent Threat (APT) attacks involves specially crafted‘bait’documentsenttotargetedpersonsinanorganizationorfield.Ananalysisofsuch APT documents reveals, among other things, that the most common subjects are political, corporate, and military in nature. On the mobile threats side, Android is still the most popular target, as almost all mobile malware that we encountered during this half-year period operate on this platform. A technically interesting mobile threat we cover in this report is Stels, the first Android malware to be distributed via spam e-mails, and a bot that uses Twitter to update its command and control (C&C) server addresses. On the Mac side of things, during H1 2013 we encountered an interesting malware called Kumar in the Mac (KitM). It is the first Mac malware signed with a valid developer ID. Talk about arrogance. More details on page 40 More details on page 14 More details on page 18 More details on page 34 More details on page 26 More details on page 36 More details on page 30 More details on page 23
  • 5. 5 f-secure | h1 2013 threat report This Threat Report highlights trends and new developments seen in the malware threat landscape by analysts in F-Secure Labs during the first half of 2013. Also included are case studies covering selected noteworthy, highly-prevalent threats from this period. Contents contents foreword3 Executive Summary 4 Contents5 Incidents Calendar 6 In Review 7 Of Note 10 watering holes 11 Case Studies 13 Stels14 Android18 APT Attacks 23 Ransomware26 Crypto currency Mining 30 Exploit KITS 34 Vulnerability Exploitation 36 Kumar in the Mac (KitM) 40 Phishing44 Sources47 contributing AUTHORS Broderick Aquilino Karmina Aquino Christine Bejerasco Edilberto Cajucom Su Gim Goh Alia Hilyati Timo Hirvonen Mikko Hypponen Sarah Jamaludin kamil leoniak Chin Yick Low Jarno Niemela ZIMRY ONG Mikko Suominen Sean Sullivan ANTTI TIKKANEN
  • 6. 6 f-secure | h1 2013 threat report Incidents Calendar incidents calendar Sources: see page 47-48 Feb Mar Apr May Jun FBI Microsoft take down Citadel botnet Jan Wiper malware attacks reported in South Korea NSA PRISM program leaked Red October infrastructure shut down Stels Android trojan spread by Cutwail botnet US jails LulzSec hacker for Sony breach Cool/Blackhole exploit kit author purchasing exploits Interpol shuts down ransomware network Twitter, Apple, Facebook others hacked Hacks Espionage Android SMS trojans target South Koreans Spam site targets only mobile devices Syrian Electronic Army hacks the Onion Evernote hacked CVE-2013-2423 exploit in the wild CVE-2013-1347 exploit in the wild Yahoo! Japan data breach suspected Twitter offers multi-factor login UK jails 3 LulzSec hackers for “50 days of lulz” SafeNet espionage reported Microsoft offers standing bug bounty Op’ NetTraveler espionage reported US FCC approves Anti-bot Code for ISPs Naikon attacks in Asia reported Advanced Obad Android trojan reported US, UK Vietnam break up credit card fraud ring mobile malware development Taiwan CIB arrests 1 for Ghost RAT attack Spamhaus hit with massive DDOS attack Spamhaus DDOS suspect extradited to Netherlands security Enforcement Android malware in targeted attack on Tibetan activists Miniduke malware exploits CVE-2013-0640 CVE-2013-0634 exploit in the wild Malware development Signed Mac malware discovered at conference NYT attacks linked to China hackers
  • 7. 7 f-secure | h1 2013 threat report In review Updates in the threat landscape The first half of 2013 mostly saw the continued development of familiar threats we noted in our previous reports. Of special interest this half year: the increasing use of exploit-based attacks facilitated by exploit kits, particularly those targeted against the Java development platform; Bitcoin mining and its ramifications; increasing sophistication in mobile threats; the discovery of the first signed Mac malware; and profiling of phishing sites. Beyond the technical developments, cyber espionage, hacks and privacy concerns became big news during this period, as major news sites and tech companies reported significant infiltration attempts and revelations about the covert data-gathering programs by the United States’ National Security Agency (NSA) raised questions about online privacy. Based on the statistics from our cloud-based telemetry systems, which monitors detections globallyreportedfromclientsprotectedbyourproducts,themajorityoftheTop10Detections seen in the past six months (see page 9) involved exploits. Geographically, the United States and France saw the most exploit-based attacks. Nearly 60% of the Top 10 Detections involved attacks that used exploits, and 80% of those were targeted against the Java development platform. The statistics illustrate the increasing focus of attackers on exploiting Java to gain access to the user’s machines. Since it’s a hugely popular application, Java is almost certainly found in organizations involved in software development, and an even better real-world illustration of the platform’s ubiquitousness and its role as a entrypoint for attackers is the large-scale attack that took place during February this year, when various tech companies, including Twitter and Facebook, were reportedly hacked via a Java exploit [1] . Almost half of the exploit-based attacks reported by our clients were blocked by our heuristic Majava detections, which prevented the attacks from infiltrating the system and installing malware.Interestinglyenough,Majava’seffectivenesshadacuriousimpactonthestatisticsfor ZeroAccess detections reported by our clients, which when compared against the statistics for the same malware in the second half of 2012, saw a noticeable decline. Based on the very active developments we’ve seen for the ZeroAccess family during the last six months however, it would not be a stretch to assume that had those exploit attacks successfully occurred, most of the malware they dropped would have been ZeroAccess-related. Where we did see ZeroAccess-related detections being reported, they mostly occurred in the United States, France, Sweden and Italy. Mostexploit-basedattackswe’veseenarefacilitatedbyasmallhandfulofexploitkits,with70% of them being attributed to these five: BlackHole, SweetOrange, Crimeboss, Styx and Cool. The exploit kit development space has been highly active in the last few months, as we’ve observed at least one new (or revamped) exploit kit being created each month on average. The top five kits are also undergoing active development, with their authors constantly adding new exploits targeting recently announced vulnerabilities. Older vulnerabilities, for which security patches have already been issued, also continued to trouble users. Almost five years after the Downadup/Conficker outbreak, we still find it lingering on in Brazil. And even though our specific detection for exploits targeting the CVE- 2011-3402 vulnerability was created in 2011, two years on the number of clients reporting it haven’t reduced at all. In fact, it grew from 6% of all reported detections in the last half 2012 to 10% in this period (mostly in France, Germany and Sweden). The continuing detection of exploit threats that were discovered and addressed years ago again brings into question the effectiveness of current patching procedures, which too often leave users at the mercy of attacks against old, known loopholes. Anotherfieldthatcontinuestothrivedespiteusingknowntricksisphishing.Withconstruction kits now available that simplify the production of phishing sites, it has become even easier In Review CVE-2011-3402 A vulnerability in the Windows TrueType font parsing engine, which first gained notoriety when exploited by the Duqu malware in November 2011. More details on page 34 More details on page 36 Downadup/Conficker A worm that exploited a network service vulnerability in various versions of Windows to spread. More details on page 11
  • 8. 8 f-secure | h1 2013 threat report in review for phishers to operate, typically by using spam emails to lure victims onto these automatically created sites, where their personal details or money can be stolen. In a profiling of known phishing sites, we saw that the most common type of portals these sites mimic involve payment services, banks and gaming, with fake PayPal sites making make up almost 73% of the phishing sites we analyzed. Ransomware continues to make the rounds and in March and April this year we noted cases of ransomware particularly targeting corporate clients in countries such as Spain and Italy. Almost all the ransomware cases we saw during this half-year fell into two broadly different types: encrypting and police-themed, of which the latter is more common. As Mikko mentioned in his foreword, Bitcoin and Litecoin mining is one of the big money-making options for cyber-criminals. ZeroAccess’s on-and-off again relationship to Bitcoin has been interesting. Though the malware originally contained a module for Bitcoin mining, it was removed from samples we found last September. In April this year, the samples we saw had their Bitcoin payload reinstated, coincidentally just when Bitcoin’s monetary value went over USD 200 [2] . Since late April however, the malware’s mining facility has again been pulled. Why that is so is something of a mystery, though some speculate it is due to the high maintenance cost of private pool servers and the heavy computing power needed for Bitcoin mining, which makes the malware harder to hide on infected machines. We tried making an educated guesstimate* of ZeroAccess’ potential monthly profit from Bitcoin mining and came up with a figure of USD 1.8 million. On the Mac front, the February attacks were interesting because they also targeted Mac users, particularly employees of the Apple company, via a compromised mobile developer site [1] . Though attacks against Mac users aren’t unheard of, until now they had mostly been targeted against political activists—case in point, the signed Mac spyware found on an activist’s Mac at the Oslo Freedom forum in May[3] . Perhaps not coincidentally then, of the 33 new Mac malware families or variants we saw in H1 2013, 57.6% were backdoors. Given the scope and scale of the February attacks, and the speculations about its intended objective, they could arguably be considered Advanced Persistent Threat (APT) attacks. More commonly though, APT attacks involve bait documents, which are carefully crafted to appeal to usersinthetargetedorganization.Giventhenatureofthesefiles,mosttargetsareunderstandably reticent to share them with outsiders. An analysis of bait documents we were able to obtain allowed us make generalizations about their contents: for example, that the most common type of content related to political (65%), corporate (14%) and military (11%) subjects, while the most common languages were English, Chinese and Arabic. The analysis allows us to build a sketchy profile of the type of individual the documents were meant to lure. On the mobile threats scene, Google’s Android continues to be the most targeted mobile operating system, accounting for 96% of all new mobile malware families or variants we saw in H1 2013. Google’s Play Store also officially superseded Apple’s App Store this half-year to become the largestappmarket,surpassingtheonemillionappsmarkinJuly.Despitelingeringquestionsabout the Play Store’s security, it remains by far the safest Android app market around, as the majority of new Android malware we saw were found on non-Play Store sites. In terms of functionality, most of the mobile threats we’ve seen were either banking-trojans or were involved in malvertising. Banking-trojans, which typically steal Mobile Transaction Authentication Numbers (mTans), appear to be increasing as more banks shift to using this form of authentication to verify online transactions. In the last few months we’ve also noticed increased instances of malvertising— advertisementsleadingtositesthatdistributemobilemalware—bothin-appandonsitesaccessed during mobile web browsing sessions. And finally, of all the mobile threats we saw this half year, of particular technical note is Stels, the first (but probably not the last) Android malware to be spread via United States Internal Revenue Service (IRS)-themed spam distributed by the Cutwail botnet. Advanced Persistent Threat attack A stealthy, sophisticated and targeted infiltration of selected organization(s), often with a longer-term objective in mind. More details on page 44 More details on page 26 More details on page 30 More details on page 40 More details on page 23 More details on page 18 More details on page 14 * based on a conservative assumption that 5% of victims have systems powerful enough to perform Bitcoin mining. SOURCES 1. F-Secure Weblog; Sean Sullivan; Timeline: Hacks Related to Apple; published 20 February 2013: http://www.f-secure.com/weblog/archives/00002507.html 2. Bitcoin Charts; http://bitcoincharts.com/charts/mtgoxUSD 3. F-Secure Weblog; Sean Sullivan; Mac Spyware Found at Oslo Freedom Forum; published 16 May 2013; http://www.f-secure.com/weblog/archives/00002554.html
  • 9. 9 f-secure | h1 2013 threat report 45+14+12+10+7+7+2+1+1+1+t in review TOP 10 DETECTIONS AND THEIR TOP 10 COUNTRIES IN H1 2013, BY PERCENTAGE UnitedArabEmirates Spain Slovenia Taiwan Denmark UnitedKingdom Belgium Brazil Malaysia Romania Canada Philippines Kenya Algeria Indonesia Poland 17 36 9 34 16 13 14 27 38 All other countries 5% UnitedStates France Finland Sweden Germany Netherlands India Turkey Tunisia Italy Japan Majava, 45 Ramnit, 1 Sality, 1 CVE-2013-3544 exploits, 1 CVE-2013-1493 exploits, 2 ZeroAccess, 7 Autorun, 7 CVE-2011-3402 exploit, 10 Web-based attacks, 12 Downadup / Conficker, 14 % 28
  • 11. 11 f-secure | h1 2013 threat report watering holes ofnote The most notable information security occurrence of early 2013 is undoubtedly the hacking and breach of several Internet giants (Twitter, Facebook, Apple, Microsoft) and of numerous other Silicon Valley companies via a watering hole at iPhone Dev SDK [6,7] . Significant, and yet, the general public appears to have learned few lessons regarding watering hole attacks as a result. Quite possibly because the companies involved kept and have continued to keep important details tightly under wraps. So what happened? The story started on February 1st with a blog post by Bob Lord, Twitter’s Director of Information Security, called: Keeping our users secure [2] . “…attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/ salted versions of passwords – for approximately 250,000 users.” Lord stated that passwords and tokens were being reset – normal breach operating procedure. But then, at the end of his post, Lord suggested “users to disable Java on their computers in their browsers” and stated the attack was not the work of “amateurs”. Lord’s post heavily suggested the cause of Twitter’s breach was due to a Java exploit via a browser. Knowing that Twitter has a high concentration of Mac users among its employees – we asked Apple for any related samples used in the attack – and were told that “Twitter hasn’t shared any samples”. And then… The story continued on February 15th when Facebook published a blog post called: Protecting People On Facebook[3] . “…Facebook Security discovered that our systems had been targeted in a sophisticated attack. This attack occurred when a handful of employees visited a mobile developer website that was compromised.” Compromised by a zero-day Java exploit via a mobile developer website – which was later revealed to be iPhone Dev SDK. Facebook security chief, Joe Sullivan, stated in an interview with Ars Technica that several other companies were affected. On the same day as Facebook’s post, Apple shared back door code (with no context) to an antivirus research mailing list. But the context seemed clear to us and we began to seek confirmation that the back door was related to the Facebook breach. On February 19th, Reuters broke the news [4] that Apple itself had been hacked which was later followed on the 22nd by Microsoft’s blog post called: Recent Cyberattacks [5] . Definition: Watering Hole attack [1] The attacker wants to attack a particular group (organization, industry, or region). The attack consists of three phases: Relying on websites the group trusts makes this strategy efficient even with groups that are resistant to spear phishing and other forms of phishing. www 1. Guess which websites the group often uses. 2. Infect one or more of these websites with malware. 3. Eventually, some member of the targeted group will get infected. of note
  • 12. 12 f-secure | h1 2013 threat report ofnote SOURCES 1. Wikipedia; Watering Hole; last modified 8 May 2013; http://en.wikipedia.org/wiki/Watering_Hole 2. Twitter, Bob Lord; Keeping our users secure; published 1 February 2013; https://blog.twitter.com/2013/keeping-our-users-secure 3. Facebook; Protecting People On Facebook; published 15 February 2013; https://www.facebook.com/notes/facebook-security/protecting-people-on-facebook/10151249208250766 4. Reuters; Jim Finkle and Joseph Menn; Exclusive: Apple, Macs hit by hackers who targeted Facebook; published 19 February 2013; http://www.reuters.com/article/2013/02/19/us-apple-hackers-idUSBRE91I10920130219 5. Microsoft; Recent Cyberattacks; published 22 February 2013; http://blogs.technet.com/b/msrc/archive/2013/02/22/recent-cyberattacks.aspx 6. NYTimes; Nicole Perlroth; Apple Computers Hit by Sophisticated Cyberattack; published 19 February 2013; bits.blogs.nytimes.com/2013/02/19/apple-computers-hit-by-sophisticated-cyberattack/ 7. F-Secure Weblog; Sean Sullivan; Timeline: Hacks Related to Apple; published 20 February 2013; http://www.f-secure.com/weblog/archives/00002507.html 8. F-Secure Weblog; Sean Sullivan; NASDAQ’s Community Forum; published 23 August 2013; http://www.f-secure.com/weblog/archives/00002595.html Criminals – but not crimeware The key takeaway from all of the breach disclosures should have been this: a dedicated group of criminals had managed to hack numerous Internet companies via a watering hole. The attack was targeted and required human labor – it wasn’t automated crimeware. But it didn’t need to be. For targets as valuable as Twitter, Facebook, Apple and Microsoft – the attackers were apparently more than willing to put in the man-hours. What have we learned? At this point, whenever we learn a website has been hacked – we ask ourselves this – was it just a regular data breach? Or would the site make for a good watering hole? But that doesn’t seem to be a question the public at large is asking. At least not based on the recent news of NASDAQ’s community forum being hacked[8] – but then… the news broke during the summer. Perhaps there’s more to that story. Time will almost certainly tell. of note
  • 13. Case Studies Stels14 Android18 APT Attacks 23 Ransomware26 Crypto currency Mining 30 Exploit KITS 34 Vulnerability Exploitation 36 Kumar in the Mac (KitM) 40 Phishing44
  • 14. 14 f-secure | h1 2013 threat report Stels mobile Stels is an Android trojan that serves multiple purposes—it can turn an infected device into a bot that becomes a part of a larger botnet, and it can act as a banking trojan that steals mobile Transaction Authentication Numbers (mTANs). Stels made its debut in November 2012 and since then, different major versions of the trojan have been discovered in the wild. F-Secure has identified over 1,300 unique Stels samples that can be divided into three major variants. The samples of each variant were first seen on 15th November, 28th November and 9th December 2012 respectively. Each variant was identified by looking into the package name used in the original source code: ru.beta, ru.stels2, and ru.stels4. The internal version numbers found in the code and configuration files further verify that the ru.beta variant is version 1 and ru.stels2 is indeed version 2. The newer versions of Stels do not appear to be replacing the old ones as all three variants have been encountered simultaneously. Table 1: Backdoor commands seen in version 1 of Stels Command Functionality botId Change bot identifier catchSms Set which incoming SMS messages will be stolen (based on source phone number and message content) deleteSms Set which incoming SMS messages will be deleted (based on source phone number and message content) httpRequest Make an HTTP request makeCall Make a phone call notification Show a status bar notification openUrl Open a URL in the web browser removeAllCatch- Filters Stop intercepting incoming SMS messages removeAllSmsFil- ters Stop deleting incoming SMS messages sendContactList Collect contacts from the phonebook and send them to the CC server sendPackageList Collect the list of installed applications from the phone and send it to the CC server sendSMS Send an SMS message sendSMSLog Get SMS messages from inbox and sent messages folders and send them to the CC server server Change CC server address subPref Change the suffix added to SMS messages sent by the trojan twitter Update the name of the Twitter account used to distribute a new CC server infor- mation update Download and install an application uninstall Uninstall an application wait Wait for a specified time before contacting the server again to receive new commands Stels Main functionality The three Stels variants carry the same primary function, triggeredwhenthetrojanfetchescommandsfromacommand and control (CC) server. The commands are communicated via HTTP connection, and delivered in encrypted JavaScript Object Notification (JSON) files, which will be decrypted and parsed by the trojan later. Different commands provide different methods for the bot owner to profit from, e.g., sending premium-rate SMS messages and stealing device information. Stels’ ability to intercept incoming SMS messages allows it to steal the mTANs that banks send to their customers via SMS messages, thus defeating the two-factor authentication method used to validate an online banking transaction. The full list of commands seen in version 1 of Stels can be seen in Table 1. With the exception of ‘sendSmsLog,’ the same exact commands can be seen in version 2 of Stels, but in version 3 the commands appear to have undergone some changes, as can be seen in Table 2. While commands such as ‘subPref’ and ‘botId’ are not always present, all variants of Stels support commands relating to major functions, such as those that enable SMS theft and SMS sending. Table 3 shows the list of CC servers that Stels samples have been found to be communicating with. Each server is only in contact with one version of Stels, with a vast number of them contacting variants in version 2. There are probably several authors behind the different versions and variants of Stels, or at least more than one botnet with different owners. In addition to contacting the CC server, some variants of version 2 also use emails to keep in touch with the botnet owner. Once a week, these variants will email the following information to the attacker: • CC server’s URL • Name of the backup Twitter account • International Mobile Equipment Identity (IMEI) number • International Mobile Subscriber Identity (IMSI) number
  • 15. 15 f-secure | h1 2013 threat report stels mobile Table 2: Backdoor commands seen in version 3 of Stels Command Functionality call Make a phone call clearDeleteFilters Stop deleting incoming SMS messages clearListenFilters Stop intercepting incoming SMS messages deleteSMS Set which incoming messages will be stolen (based on the source phone number and message content) httpRequest Send an HTTP request install Download and install an application listenSMS Set which incoming messages will be de- leted (based on source phone number and message content) message Show a message dialog to open a URL notify Show a status bar notification openUrl Open a URL in the web browser run Start an already installed application sendContactList Collect contacts from the phonebook and send them to CC server sendDeviceInfo Send device information to the CC server (phone number, operating system version, phone model and manufacturer, operator, if the device is rooted) sendPackageList Collect the list of installed applications from the phone and send them to the CC server sendSMS Send an SMS message uninstall Uninstall an application Table 3: CC server addresses for different Stels versions version 1 version 2 kitherbin[dot]com 33files[dot]info a1paybill[dot]net androidfan[dot]name bot[dot]mobiportal[dot]net version 3 bot[dot]moblife[dot]org droidad[dot]net istorhol[dot]ru steamads[dot]info marhc-nikolay[dot]info mobiportal [dot]net play-google[dot]mobi ponelnet[dot]info serviseru[dot]ru skladchik[dot]in ynfdbdybdd1[dot]freeiz [dot] com • Phone number • Device model • Device manufacturer • Operating system version The e-mail is sent via the webpage http://[...]anonymouse. org/[...]/cgi-bin/anon-email.cgi to the address app[dot] stels2@gmail[dot]com. Social media as CC backup A problem with centralized botnets is that if the owner loses control of his CC server, he also loses the ability to control the bots. The Stels author(s) attempt to combat this issue by setting up a few Twitter accounts for the bots check with to obtain a new CC server address if the old one is no longer available. In the first implementation, the Stels trojan parses the Twitter page, looking for encrypted messages that might contain the new CC server address. In a later implementation, the encrypted messages are searched from the account description. The usernames ‘Vaberg1’ and ‘app36005565’ have been found to be used for the Twitter accounts used as part of the backup CC system. However, the accounts do not appear to have been used before. Figure 1: Twitter account meant to provide instructions to Stels In the version 3 of Stels, Twitter has been replaced by the Russian microblogging site, Juick. Stels will parse the RSS feed of the account set up by the botnet author by searching the web page, http://rss[dot]juick[dot]com/ACCOUNTNAME/ blog for the strings description![CDATA[ that mark the beginning of messages. The Stels trojan then decrypts the messages and sets the decrypted string as the new CC address. In May 2013, the botnet owner lost control of one of his CC domains, droidad.net. He was forced to resort to the backup channel of a Juick account called ‘droidad.’ Figure 2 shows the account sending an encrypted message that relays a new CC server address for version 3 of Stels trojan on May 24th. Once decrypted, the new domain was revealed to be steamads[dot] info.
  • 16. 16 f-secure | h1 2013 threat report mobile Figure 2: Stels botmaster sending a new CC server location via a backup Juick account Distribution Android malware has thus far been mostly spread through third-party marketplaces, and Stels’ approach is no different. It has been found distributed through spaces.ru, a popular social network service that targets mobile device users in Russia, where it was repackaged with clean applications to lure victims. Bait applications that Stels author(s) use are mostly games. An interesting discovery was made during Q1 where Stels was found distributed via IRS-themed spam sent by the Cutwail botnet (http://www.secureworks.com/cyber- threat-intelligence/threats/stels-android-trojan-malware- analysis/). A user who clicked on the link on an Android device was directed to a web page asking him to update the Flash Player application. The ‘update’ which the user ended up with is actually the Stels trojan. In addition to using Flash Player’s name,Stelsmayalsouseafakeupdateunderthename‘Google updater.’ Figure 3 shows an example of a Stels infection when looking at the installed application list. Conclusion Stels is a flexible bot that offers the owner a fleet of different monetization avenues such as SMS messages, phone calls, software installation, or even acting as a banking trojan component that intercepts mTANs. The trojan is designed to last a long time, since the author has included a backup method for changing CC server addresses in case the old servers become unavailable. We have seen instances where malware uses spam as a distribution method and uses social media as part of the CC infrastructure, but those are Windows malware. The fact that Stels is using the same method is evidence that Android malware is advancing closer to reach the level of highly developed Windows threats. Figure 3: Stels trojan masquerading as a Google updater 76 +24+v 3+m5+m7+m7 +m1+m 8 7 5 3 1 Uzbekistan United Arab Emirates Turkey Kenya 132 other countries 76 Russia % geographic distribution of stels detections, by percentage* *Based on F-Secure’s client telemetry data for H1 2013. stels
  • 17. 358 Android symbian ios windows phoneblackberry j2me palm pocketpc 16 0 793 598 4 0 41 20 2 1 0 0 0 00 New families or variants found, H1 2013 platform Total families or variants found, 2000 to H1 2013 total count of families or variants per platform 2010 2011 2012 2013 total count of android application packages (APKS), 2010 to H1 2013 July 2013 Total: 405,140 Malware: 257,443 March 2013 Total: 225,591 Malware: 103,565 January 2013 Total: 170,659 Malware: 73,084 Total (malware, spyware, adware) Malware only H1 2014 50,000 100,000 150,000 200,000 250,000 300,000 350,000 400,000 450,000 Since late 2011, we’ve seen a sharp increase in the total number of mobile device-targeted files or programs being distributed on all platforms. This is particularly true for Android applications (above), which saw a significant spike in the total number of APKs detected from March onwards, indicating an accelerating rate of new APKs being created for this platform. Thoughsimplycountingthetotalnumberofprogramsweencounterproduces impressive numbers, most of the files seen are simply replicas of a handful of unique families (programs that are grouped together based on similar codes or behaviors and detected using these shared characteristics). As such, a more meaningful gauge of significant development is to count the number of unique new families found on a platform, or new variants for known families, found within a year (left and below). These figures then allow us to, among other things, determine where malware developers are concentrating their efforts. mobile malware 20122011201020092008200720062005 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 2013 H12004 running total of families or variants found on symbian android platforms, 2004 to h1 2013 Symbian Android +358 +16
  • 18. 18 f-secure | h1 2013 threat report Android android mobile Android continues to dominate Android continues to maintain its dominant position in the smartphone operating system market, with the International Data Corporation (IDC) reporting that the platform accounted for 79.3% of all smartphone shipments in the second quarter of this year [1] . The next most popular platform is, unsurprisingly, iOS, which accounted for 13.2% of all new phones shipped in the same period. More surprisingly, this past quarter saw the Windows Phone platform overtake BlackBerry (3.7% to 2.9%) forthefirsttimetobecomethethirdmostpopularsmartphone operatingsystem.Allotherplatformswereunabletogaineven as much as a 1% toehold in the market this quarter. Given these numbers, little wonder then that malware development has focused on the Android operating system, with 96% of new malware families or variants we saw in the first half of 2013 found on that platform. In the second quarter of the year, 99% of new mobile threats we saw were on Android and on pages 20 to 21, we profile 6 of the most interesting malware we encountered during that period. Google Play Store While Apple’s App Store continues to be the strongest app market in terms of revenue generation [2] for its developers, it lost the title of the largest app market in July 2013, when Google announced that its Play Store had approved its 1 millionth app, surpassing Apple’s 900,000 total apps count at the time. That number doesn’t include the multitude of apps available on various third-party sites catering to Android users. Unfortunately, while the sheer volume of apps and markets available offers a a range of choices for Android users, the dark side is that it also offers attackers an abundance of legitimate apps to compromise and trojanize, as well as varied ways to distribute their malwares. In 2012, the Play Store introduced security measures that, among other things, identified malicious apps uploaded to the market. Though this has reportedly been effective, it doesn’t entirely eradicate risk - for instance, it doesn’t eliminate apps we would classify as Adware or Riskware, and is ineffective in blocking advertisements (either in the Play Store [3] or in the apps themselves) that users may consider unwanted, risque or outrightly malicious. The intersection of advertising, privacy and security remains a grey area for Android, given the open ecosystem of the platform,thedefactouseofadvertisingtomonetizethemainly free apps in the market and the lack of a viable reputation- The Android platform continues to dominate the attention of mobile malware authors, with increasing interest in finding ways to target Android users while bypassing the Google Play Store. In this article, we take a look at trends we saw in malware developments on this platform in the second quarter of 2013. new families or variants in h1 2013, by type Trojans Trojan-Spies Backdoors Trojan-Downloaders Riskware Monitoring-Tools Hack-Tools Application Adware SpywareGarbage 50 100 % checking system for the advertising modules used in most of the programs. Despite the occasional hiccups however, thus far the Play Store is still considered the safest source for finding clean Android applications. Beyond the Play Store We believe the increased hardening of the Play Store has led to an increase in Android malware being distributed using other attack vectors. During Q2 2013, we discovered 205 new Android families or new variants of existing families, the majority of them from non-Play Store sources. Beyond the boundaries of the policed app market, malware developments of particular interest at the moment are: malvertising; drive-by downloads and mobile banking-trojans.
  • 19. 19 f-secure | h1 2013 threat report android mobile is the new malware family or variant profit-motivated? 23+77+B Yes No 77 23 % SOURCES 1. International Data Corporation; Apple Cedes Market Share in Smartphone Operating System Market as Android Surges and Windows Phone Gains, According to IDC; published 7 August 2013; http://www.idc.com/getdoc.jsp?containerId=prUS24257413 2. Forbes; Chuck Jones; Apple Still Dominates Tablet And App Store Usage But Android Is Gaining Ground; published 31 May 2013; http://www.forbes.com/sites/chuckjones/2013/05/31/apple-still-dominates-tablet-and-app-store-usage-but-android-is-gaining-ground/ 3. F-Secure Weblog; Sean Sullivan; Google Play: Potentially Unwanted; published 11 March 2013; http://www.f-secure.com/weblog/archives/00002521.html 4. F-Secure Weblog; Sean Sullivan; Fake Antivirus Scan Scam Via Google Play App Ads; published 13 June 2013; http://www.f-secure.com/weblog/archives/00002567.html 5. FSLabs Youtube Channel; Drive-by Android Malware; published 3 May 2013; http://www.youtube.com/watch?v=aYFX8V7EXbA 6. The Age; Liam Tung; Fake CommBank Android security app targets mobile customers; published 16 July 2013; http://www.theage.com.au/it-pro/security-it/fake-commbank-android-security-app-targets-mobile-customers-20130716-hv0w0.html “Malvertising”: advertising malware Malvertising seems to be increasingly used to distribute mobile malware, likely due to its ease of implementation and the wide reach it offers. This distribution method so far has typically involved either a compromised a site injected with a malicious links or code, or simpler still, use of a third-party advertisement network to promote links to the malicious products, where the advertisements themselves may be taken and displayed in good faith. One advertising strategy that leverages the reputation of the Play Store while avoiding the actual market’s security measures involves the use of fake Play Store advertisements. This social engineering technique uses a link or advertisement on a website that appears to be for an app in the market, but when clicked instead opens a non-Play Store site in the web browser. We’ve also seen advertisements displayed during web surfing sessionsonmobiledevicesthatpromotefake‘mobileantivirus’ scams [4] - basically the mobile equivalent of similar efforts to distribute PC-based rogues. We also saw another ad-based technique used by Trojan:Android/Badnews.A, where in-app advertisements promote what turned out to be a fraudulent app for a premium SMS subscription. Mobile drive-by downloads We’ve also encountered drive-by downloads of mobile malware while browsing compromised sites on an Android device [5] . Unlike PC-based drive-by downloads, these attacks are still relatively visible to the user, as they automatically trigger a notification message asking whether the user wants to install the app (and providing an opportunity for the user to delete the unwanted program). Again, since this attack vector involves either compromising a legitimate site or redirecting users to a malicious site (both activities likely to be familiar to any malware distributor with prior experience spreading PC-based malware), we expect to continue seeing malware distribution using this method in the future. Mobile banking trojans A more direct threat to users comes in the form of mobile banking-trojans - typically malware that attempt to steal SMS messages containing Mobile Transaction Authentication Numbers (mTans). The proliferation in this type of mobile malware has been in response to a general shift by banks providing online shopping facilities to take two-factor security authentication into use. This ties in with the discovery this quarter of Trojan:Android/Pincer.A, which we believe to be related to fake banking security apps that were reported in July targeting users of the Commonwealth Bank [6] , as well as Trojan:Android/FakeKRBank.A, which we saw targeting users in Korea. And finally, in Q2 2013, we observed more mobile banking- trojan toolkits - that is, programs that automate the process of creating these malware - are now being sold in the underground markets. As such, we expect to see more of this kind of threat in the near future and perhaps evolve further.
  • 20. The following 6 Android malware were selected as representative of the mobile threats discovered during Q2 2013. The count of known unique samples is used to provide a meaningful idea of how large a given malware family may be. In addition, where available, the Protection Network Count counts the times a device protected by F-Secure’s Mobile Security reported blocking an attempted malware installation to our cloud-based telemetry systems during Q2 and Q3 of 2013. Comparing the low rate of blocked mobile infections to the vastly greater rate of blocked infections for PC-based threats can arguably indicate both the currently rare nature of mobile infections and the effectiveness of mobile antivirus solutions in protecting a device from infection. Trojan:Android/VmVol.A Count of Known Unique Samples: 43 Oldest Known Sample Date: 2013-03-28 Distribution: Unconfirmed in Google Play, records shows it was removed. Summary Once installed, VMVol.A sends the device’s phone number and International Mobile Equipment Identity (IMEI) number to a remote server. It also sends a copy of the messages sent, including the message content and the receiver’s number. Trojan:Android/Badnews.A Count of Known Unique Samples: 113 Oldest Known Sample Date: 2013-03-03 Distribution Badnews variants have been found on the following online app markets: Google Play, Opera, Baidu, Anzhi and Liqucn Summary Badnews variants are fraudulent premium SMS-trojans. On installation, the app displays advertisements for a premium-SMS subscription. android threats highlights, q2 2013 Trojan-Dropper:Android/FakeKRBank.A, Trojan:Android/FakeKRBank.A Count of Known Unique Samples: 64 Oldest Known Sample Date: 2013-05-20 Distribution Unknown Summary Once installed, Fakekrbank intercepts SMS messages and forwards the messages via URL POST to a remote server, together with the device’s name and number. Protection Network Count Protection Network Count Protection Network Count apr may jun jul aug sep apr may jun jul aug sep apr may jun jul aug sep 10 10 10
  • 21. Trojan:Android/FakeDefender.A Count of Known Unique Samples: 14 Oldest Known Sample Date: 2013-03-24 Distribution: Seen advertised in third-party advertisements displayed on mobile devices. Summary Similar to rogue antispyware programs found on PCs, Fakedefender is a rogue anti- spyware program for the mobile device. The program does not provide the scanning or malware removal functionalities claimed. Protection Network Count Trojan:Android/Pincer.A Count of Known Unique Samples: 11 Oldest Known Sample Date: 2013-03-19 Distribution This app is known to be distributed either on phishing sites (typically imitating a bank site) or via malicious links in SMS messages. It may also be distributed as part of the payload of a PC malware. Summary Once installed, Pincer forwards SMS messages to a remote Command and Control (CC) server. It is also able to function as an mTan-stealing banking-trojan, as well as carrying out instruction given remotely by the CC server. Trojan:Android/Obad.A Count of Known Unique Samples: 6 Oldest Known Sample Date: 2013-05-16 Distribution Obad variants were observed being advertised on a malicious website while browsing on an Android device and is likely to arrive on a client device via a mobile drive-by download. Summary Once installed on the device, Obad variants gain administrator privileges and uses a exploit to break through the Android operating system’s security layer. Obad collects and sends the following details about the device to a remote CC server: the Media Access Control (MAC) address and IMEI, the operator name, the time and root access. The CC server is also able to issue the commands to the installed application, including to send SMS messages, make the device act as a proxy or a remote shell, launch a URL in the mobile browser, download and install additional components, get the Contacts list as well as further details of a specific installed app and send a file via Bluetooth. apr may jun jul aug sep 10 apr may jun jul aug sep 10 20 Protection Network Count
  • 22. 3. Set up call or message barring Most operators allow users to set up a call or SMS barring service to block the device from sending unwanted calls or messages. Also known as ‘premium-rate blocking’, this is particularly useful for parents who want to prevent their children’s devices from inadvertently incurring unnecessary charges. To set up this service, contact your phone operator for more details. Some services also provide a PIN number or other method that allows the user to selectively remove the barring, if they desire. Securing the device Today most people have their email accounts (personal and/ or work) and other critical services on their mobile devices. This convenience also means that if your device is lost or stolen, your losses could involve more than just the physical device. And despite concern about online-based attacks, the easiest way for malware to get on a device is still for someone to manually install it while the device is in their possession. In other words, protect your device’s physical security first. 1. Lock the device Locking your device prevents anyone else from meddling with its settings and installing an app (such as a monitoring-tool or spyware) while it is out of your possession. For the lock to be effective, make sure the password/passcode/pattern is unique, and preferably memorable for you without being easy for someone else to guess. 2. Set up anti-theft protection Anti-theft protection typically provides you the ability to remotely wipe the data on your phone, including on any memory cards installed, if you decide your phone is irretrievable. Some anti-theft solutions also include features such as location mapping or sounding the alarm, to help when attempting to locate the device. 1. F-Secure Weblog; Sullivan, Sean; Post-PC Attack Site: Only Interested in Smartphones/Tablets; published 19 June 2013; http://www.f-secure.com/weblog/archives/00002569.html sources recommendations: Protecting against mobile malware 7. Use web browsing protection To avoid stumbling onto a malicious site while surfing on a mobile device, use web browsing protection (available from most antivirus solutions) to block known harmful sites. While online As websites have evolved to cater for visitors browsing from mobile devices, we’ve also seen malicious sites follow suit[1] . When dowloading apps Once your device’s physical security has been addressed, you can also take the following steps when downloading an app. 6. Scan apps with a mobile antivirus Once downloaded onto your device, use a reputable mobile antivirustoscantheapp.Youcanthinkofthisasacheckonthe app’s ‘silent’ behavior—permissable actions that are implied in the app’s permissions list (for example, sending the device’s details to a remote server) but may cause users concern. If the verdict from the mobile antivirus is acceptable to you, then you can proceed to install the app. 4.Download apps only from the Play Store By default, Android devices block installation of apps from any source other than the Play Store. You can check to make sure your device only allows Play Store apps by looking in Setting Applications Unknown sources. If the checkbox is checked, non-Play Store apps can be installed. Uncheck this. 5. Check the apps’ permission requests Whether you’re downloading from the Play Store or other sources, make sure to read the app’s list of requested permissions (the ones that typically raise eyebrows due to security or privacy concerns are listed below right). If the permissions requestedseemexcessive or unrelated to the app’s purpose—for example, a casual game asks to send SMS messages—you can check the developer’s references for more details, as reputable developers usually explain why the permissions are needed. If the use appears justified to you, then you may elect to download the app. Incidentally, apps such as PocketPermissions, LBE Privacy or PermissionDog can be useful guides for explaining the sometimes-obscure permissions. Some also include features to restrict permissions used by installed apps, though such functionality is often intended for advanced users. • Services that cost you money • Make phone calls • Send SMS or MMS • Your location • Your personal information Blocking unwanted services Lucrative profit-generating mechanisms for mobile malware are to silently send premium rate SMS messages, subscribe the user to continuous premium services, or to force the device to call premium-rate numbers. Blocking premium calls or messages is one way to minimize financial losses, even if malware does get installed. This also provides protection against non-malware billing fraud by “operators” who silently subscribe users to premium services and forward billing requests to the user’s mobile operator, hoping to have the charges quietly added to the user’s bill.
  • 23. 23 f-secure | h1 2013 threat report aptattacks apt attacks national focus of apt documents, mapped * *Onlynationsthatweretargetedbymorethanone APT document in the sample set are mapped. Tibet 2 China 16 USA 10 India 8 Iran 5 Japan 2France 2 Advanced Persistent Threat (APT) attacks typically involve a carefully crafted exploit document being delivered (usually through some form of social engineering) to a user, or users, in a targeted organization or industry. During 2012 and 2013 there was a lot of talk about various individual APT campaigns and significant individual cases. While these individual cases are interesting, we felt that it would be useful to gain an overall picture of the kind of victims various APT attackers are targeting. In order to gain insight into the larger picture, we randomly selected and analyzed 100 APT documents from our sample collection. The sample documents were categorized by language, topic of the document and if identifiable, the national focus - that is, the country it appeared to be addressing. While the contents of an APT document do not directly identify the attacker, the information gathered from its analysis gives a good indication of the kind of victims being targeted, as the document must be sufficiently interesting bait for the potential victim in order for the attack to succeed. Languages other than English were translated with computer translation,resultinginalessthanperfectunderstandingofthe documents; this was however good enough for classification purposes. We also extracted text from the first pages of all the sample documents and visualized the text in a word cloud (see page 24) to give an overview of the most common words used in the ATP documents. Based on the statistics generated from our analysis, we can see that English is the most common language in APT documents, which makes sense both from the attacker’s and victim’s perspective, as English is commonly used in international Vietnamese 1 French 2 Russian 2 Persian 3 Arabic 5 Chinese 12 English 75 language used in apt documents business and politics, so that the attacker need not produce lure documents in the victim’s own, potentially non-English language. Political attacks As can be seen from both the word cloud and statistics derived from our analysis, the most common type of content in ATP documents is political, usually in the form of a report of some politically interesting event, development or longer term review. All in all, the content of APT bait documents look like the type of content one would expect to be interesting to an embassy officer, government employee or otherwise politically active or aware figure. The most common topic in the political documents deal either with China or India; USA-related topics are also very APT Attacks
  • 24. 24 f-secure | h1 2013 threat report apt attacks aptattacks content of apt documents 14+11+8+2+65+z Political 65 Corporate 14 Military 11 Academic 8 Unknown 2 % prominent. When reading the documents, it seems that many of them mostly cover relations between USA and China, or India and China. Extrapolating from that, it seems that the most common target for a politically-motivated APT attack is someone who is from or has some form of affiliation to the USA or India, and is interested in China. Corporate attacks Corporate users are mostly targeted with bait documents that look like conference proceedings or reports. This does make sense as conference proceedings are normally propagated by e-mail as part of standard business practices anyway, making them easy for the attackers to obtain, modify and pass on as ‘revised’ editions. The second most common type of corporate-targeted ATP documents were reports, which are also relatively easy to obtain and are easily passable as credible business material. As can be seen from the corporate word cloud, the aerospace and energy sectors seem to be of most interest to the spies. As with political documents, the corporate-targeted documents commonly contain references to China or other Asian countries, which would indicate that attackers are interested about targets that operate in the aerospace or energy sector and have some form of contact with Asian countries. Military attacks As with other victim categories, a large portion of ATP documents targeted to the military were reports on topics that would be of interest to military personnel. What was interesting however was that in addition to strictly military- related topics, a major portion of these documents related to the personal finances of service members, such as tax information or military pension details. In these cases, the wordcloud of most common words in apt documents Credit: Tagul.com politicalCorporatemilitary
  • 25. 25 f-secure | h1 2013 threat report apt attacks aptattacks Diplomatic car ad 2 Banking 2 List of contacts 2 Report 40 Letter 7 Conference 6 Service related finances 4 Aerospace 4 Activist 3 Sex scandal 3 Curriculum Vitae 3 Topics appearing in more than one apt document attackers attempted to attack victims using documents of personal rather than professional interest, which is an angle that we have not seen with any other category. Academic attacks The number of ATP documents in our sample set targeted to academics was too small and scattered to draw any major conclusions. Based on the handful of samples however, it does seem that either the attackers are trying to lure victims with either material related to a particular academic field or administrative topics such as curriculum vitaes, memos or forms. Conclusion In order to be able to publish results for this report, we used APT documents that were obtained from public sources, which means that our sampling is most likely biased as it is very likely that many corporate targets consider any APT material they encountered to be so sensitive that they either do not share the documents or share them confidentially, thus preventing their use for a public study. Even so, based on the material we are able to share, we can construct a basic profile for the people targeted for APT attacks: primarily those working with political material, especially those whose work includes contact with China or other major players in the Southeast Asian region. While corporations, the military and academia receive less attention, it is still true that as long as you possess information of interest, it is likely that you may be a potential target for APT attack.
  • 26. 26 f-secure | h1 2013 threat report Ransomware ransomware Two types of ransomware It is useful to compare the two different types of ransomware that are currently infecting users. The only common factor between these two types is the concept of extorting money from victims by holding something valuable — data or the computer itself — hostage. Everything else is very different, as we will soon discover. The first type is called the encrypting ransomware. When this malware infects a computer, it encrypts the user’s data and leaves a ransom note that asks for money in exchange for a cryptographic decryption key needed to restore the files. The second type is a police-themed ransomware, often simply referred to as police ransomware. On an infected computer, this malware shows a “lock screen” which requests for a ransom payment for the computer to be unlocked. The lock screen is simply a dialog box that fills the whole computer screen. It prevents the user from closing the box and quitting the malware. Encrypting ransomware Encrypting ransomware’s infection happens in an unusual way. Most malware infect a computer through a drive-by exploit, where they infiltrate the machine by abusing a vulnerable application like Java. Their target is often a personal computer, especially the users with poor browsing habits. Encrypting ransomware, on the other hand, often targets corporate Windows servers, where it encrypts all data files and asks the company to make a payment in order to decrypt them. These servers are not meant to be used for browsing and reading e-mails. In many infection cases, the server was found to be running a Remote Desktop (RDP) service and the user accounts were guarded by weak passwords. The attackers employed a password guessing attack and managed to log in using the RDP service. Ransomware is a type of malware that uses extortion to get money from victims whose computers have been infected. The malware typically takes control of the victims’ data or computer and demands a payment for the victims to reclaim their possesion. We last wrote about ransomware problem in our H1 2012 Threat Report. Since then and during the first half of 2013, this threat has remained very active. Geographical focus Since the infection is not fully automatic and the attackers manually break into the servers, the amount of encrypting ransomware infections is small compared to police ransomware. During the first half of 2013, F-Secure Labs saw “waves” of encrypting ransomware attacks that targeted servers in one country, then moved onto another country. The “Anti Child Porn Spam Protection” ransomware targeted corporate clients in countries such as Spain and Italy actively in March and April. Other similar encrypting ransomware have been actively used as well. Payload The payload of encrypting ransomware is usually very simple. Once the attacker has gained access to the corporate server, hemanuallyexecutesthemalware.Themalwarewillenumerate files on the server, encrypting all data files but skipping any system files to avoid making the system unbootable. The encryption is done using strong cryptography, and once the operation is completed, the encryption key will be securely erased. Every file on the network shares is also encrypted; if backups are accessible to the server, these are also encrypted. Payment mechanism To decrypt the files, a decryption key is needed. The victims will receive information on how to deliver the payment to the attacker in exchange for the key. In many cases, the payment is made using online payment system such as Moneypak, Paysafecard or Ukash. The amounts go from USD 500 onwards. ransomware Figure 1: Snapshot of an “Anti-Child Porn Spam Protection” ransomware
  • 27. 27 f-secure | h1 2013 threat report In a typical situation, the attacker will ask the victim to send the encrypted file, which will be returned in a decrypted format. The victim is also required to send a proof of payment over e-mail. Since the attacker has to keep track of the victims and the keys used to decrypt their files (each victim is assigned a different key), the manual work involved in this correspondence limits the amount of victims that can be targeted simultaneously. Attacking a million targets at once is not possible. This limitation may explain the “waves” of attacks — the attackers target a limited set of servers in one country and then move on to the next one. Police ransomware Police ransomware gets its name from the “lock screen” that appears on an infected computer. The lock screen displays a message allegedly coming from the local law enforcement, claiming the computer’s involvement in illegal activities such as copyright violations and child pornography distribution. A handful of families are behind most of police ransomware infections. Two of the most notable ones during the past six months are Reveton and Urausy. Both families infect users via exploit kits when they are browsing the web. The users will be redirected to a web server that automatically infects the computer using an exploit. There have been cases where malicious advertisements (malvertising) wereusedonpopularwebsitessuchasMSNItaly to redirect users to exploit kits serving ransomware. The most common method still seems to be malicious advertisements on adult websites. ransomware Figure 2: Localized police ransomware Geographical focus Police ransomware uses localized messages to convince infected users. Both Reveton and Urausy target several countries such as the US, Germany, France, Saudi Arabia and Italy (see Figure 2). Unlike encrypting ransomware, the lock screen on police ransomware is localized with the national law enforcement logo and often translated to the local language. The current list of localization that Urausy supports include: vs.Encrypting ransomware Police ransomware Encrypt user data and demand a ‘ransom’ in exchange of the decrypting key. Display a ‘lock screen,’ pretending to be a local law enforcement. Demand a ‘fine’ to unlock. Corporate Windows servers running a Remote Desktop (RDP) service. General users’ computers. infection target Perform password guessing attacks to break in and log in using RDP. Redirect users to servers hosting exploit kits; users’ computers will be automatically infected.infection method Manual. Keep track of proofs of payment and decrypting keys via emails. Automated. Send PIN code automatically to command and control (CC) servers. payment mechanism Enumerates all files on the server, encrypting all data files except for system files. Encryption key is securely erased after the operation is completed. Has a launch point in registry that starts malware automatically after system restart, usually in ‘safe mode.’ The lock screen shows up immediately. payload ransomware
  • 28. 28 f-secure | h1 2013 threat report ransomware ransomware Argentina, Australia, Austria, Belgium, Bolivia, Canada, Croatia, Cyprus, Czech Republic, Denmark, Ecuador, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Jordan, Latvia, Lebanon, Luxembourg, Malta, Mexico, Morocco, Netherlands, New Zealand, Norway, Palestine, Poland, Portugal, Romania, Saudi Arabia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, United Arab Emirates, United Kingdom, United States and Uruguay The cost involved in localizing the malware may have caused the ransomware families to steal the design of the lock screens from each other, thus, making it difficult to tell one family’s infection apart from the other by looking at the screen. Payload Similar to encrypting malware, the payload for police ransomware is quite simple too. After infecting a computer, the malware will wait for several minutes before displaying the lock screen. This delay makes it more difficult for the victims to identify which visited website might have been responsible for the infection. The malware has a launch point in the registry to make sure that the malware starts its payload automatically when the computer is restarted, usually in “safe mode.” The locked screen will show up immediately after restart, making removal difficult. The Reveton ransomware also includes a second payload that allows the attacker to benefit from victims who refuse to fall prey to paying for the ransom. As an insurance, the second payload automatically steals any username and password that has been saved in the web browser, FTP clients and other places. The attackers may then use or resell these credentials for financial benefit. Payment mechanism Unlike encrypting ransomware, nearly all police ransomware families have a fully automated payment collection. On the lock screen, the victim will be asked to input a PIN code for an online payment system like Moneypak, Paysafecard or Ukash. This PIN code is then automatically sent to a command and control (CC) server for verification. The CC infrastructure consists of several proxy servers in an attempt to hide the criminals’ track. Because of the level of automation, criminals using this type of ransomware are able to target thousands of victims and handle the payment without any difficulty. infected corporate server @ payment email address attacker Correspond with victim s Collectpaym ents Breaksin byrem ote log in Payment and receiving of decrypting key attacker CC serverCC Proxy serverinfected Computerexploit kit Infects with exploits Payment code sent Forwarded to hidden server Collects paymentsMaintains kits Encrypting ransomware vs. police ransomware operation flowchart Police ransomware Encrypting ransomware • Enable Browsing Protection and DeepGuard in your F-Secure product to stay safe from malicious websites • Keep software up-to-date to stay safe from exploit kits • Uninstall Java if not needed, or keep it installed in a secondary browser that is not used for general web browsing • If infected with police ransomware, change all passwords that were saved on the computer • Make regular backups to recover from encrypting ransomware. Make sure the backups are not accessible from the server itself How to protect against ransomware:
  • 29. 29 f-secure | h1 2013 threat report ransomware Ransomware and BitCoin in Asia For the most part, most of the ransomware cases we detected were in Europe, the Middle East and most parts of the United States. However, around the Asian region, there have not been too many cases of exploits utilizing ransomware to extort money from victims, most likely since the region has a lack of convenient and anonymous payment systems such as Ukash, Moneypak and Paysafecard. In Europe, these systems make it easy for a victim to obtain a prepaid card from a convenient store to pay the ransom (while not informing the authorities of the extortion, especially in cases of police-themed ransomware). The receiving party on the other end can also be easily trained without much personal or unique information being given out, and with automation, is able to collect the ransom from hundreds and even thousands of victims. In Asia however, most countries have not been set up with this sort of electronic payment system (probablyduetothefactthatmuch fraud occurs in this part of the world) and most victims so far have relied on online banking methods to transfer funds electronically. In future however, with Bitcoin on the rise and its acceptance in Asia due to the pseudo-anonymous nature of the currency, could it possibly drive malware writers to conquer this part of the world with ransomware attacks tailored for collection of the ransom using Bitcoin? China is currently the second biggest and fastest growing Bitcoin market in the world today, second only to the United States. China is no stranger to virtual currencies, as they were exposed to the Q coin in the mid-2000s by Tencent (which all started with avatar purchases online) and online gaming. Because China’s strict cross-border financial controls make it difficult to spend money in stores abroad, Bitcoin could be the perfect virtual currency for Chinese Bitcoin owners, as they can convert them into currencies that sites like Paypal and Amazon would accept. Since Bitcoin is so decentralized, it would be extremely difficult for the government to handle any issues related to Bitcoin use, as they cannot track it, block it or crack down on it. It would be the perfect way for cybercriminals to safely move and launder money collected from ransomware and evade authorities. The PC isn’t the only platform likely to suffer from ransomware in the future. The increase in Android users, especially in Asia, has lured malware writers into branching out from the PC to the mobile platform, leading to increasing sophistication and maturityinthemalwaretargetingAndroidusers.Mostrelevant istheincreaseinfakeantivirusandransomwareattacksmaking theirwayontothemobileplatform.Oncerogueantivirusesare installed on your mobile device, they display a false malware detection in an effort to con the user into paying for software that would supposedly remove the infection, making them at least spiritually similar to ransomware. Given that Asia is one of the largest markets of smartphone users and a major market for free apps downloaded through third-party stores, it is likely that in future the region will see an increase in malware writers finding more creative ways to introduce fake antivirus or ransomware onto a user’s mobile device. ransomware Bitcoin’s increasing value against the US dollar
  • 30. 30 f-secure | h1 2013 threat report Crypto currency Mining bitcoin Bitcoin Malware Timeline, 2008–2012 Back in 2008, a mathematician named Satoshi Nakamoto (a pseudonym) submitted a technical paper for a cryptography conference. In the paper titled “Bitcoin: A Peer-to-Peer Electronic Cash System,” he described a peer-to-peer network where participating systems would perform complex mathematical calculations on something called a “blockchain.” The goal is to create a completely new currency —crypto currency — that is based on math. Bitcoin is not linked to any existing currency; therefore, its value is purely based on how much people believe it is worth. Some vendors do accept Bitcoin as a form of payment. To send Bitcoin to another party is similar to sending an e-mail. All it needs to transfer money instantly, bypassing exchanges, banks and taxes, is an address linked to somebody’s wallet file. In a way, crypto currency would make banks completely unnecessary for moving money around, which is why banks hate the whole idea of Bitcoin. In 2010, when Bitcoin had just started to get adopted by enthusiasts, its initial price was listed at merely several dollars. At that price, many doubted that it would make a good investment. But over time, as the media started to pick up on the subject, its price began to shoot up. This undoubtedly caught the attention of the bad guys. The first batch of Bitcoin malware, which utilized infected computers’CPUforproof-of-workcalculations,wasdiscovered in 2011. The calculations, also referred to as “mining,” rewarded the malware authors with coins. However, such tactic did not provide enough income as the authors had originally hoped. By Q2 2011, those malware had lessened in number. The authors figured out that it would be more profitable to simply sell access to infected machines rather than mine the coins themselves. Within a short period of time, the malware authors managed to adapt the code to enable a more efficient way of mining. In Q4 2011, some malware families, such as the Trojan.Badminer reported by Symantec[1] , began to utilize third-party mining programs that specialize in GPU-accelerated hash calculations. Using the GPU is 50 times more profitable than using a top- Crypto currency mining operations have been running for years. The top two currencies, Bitcoin and Litecoin, have become a holy grail to cyber-criminal organizations that need a stream of hard-to-trace income. As a decentralized/peer-to-peer currency, Bitcoin is exactly what they have been waiting for. notch CPU, and it soon became the most common mining method amongst cyber-criminals. Commonly used mining programs include bfgminer/cgminer, cudaminer and Ufasoft’s Coin. These programs are all open source and the malware authors stick to using the public builds as much as possible to evade targeted signature detections. Some cyber-criminal gangs opt to use a custom mining tool, often delivered by a third-party developer who prefers to stay in the “grey zone.” Examples of these tools are Silent Miner, Chrome Miner and Insidious Miner. Silent Miner still has an up and running website, where it is being sold for money through PayPal or Bitcoins via Mt. Gox. Bitcoin Malware Timeline, H1 2013 In2013,differentBitcoinmalwarebegantoemerge,asreported by various anti-virus companies. The most remarkable ones are as follows: • April 2013 - A scam message containing a malicious link spread out amongst Skype users. The link led to a malicious executable that would download additional components from a command and control server. One of the identified components was a Bitcoin miner tool that would run silently in the background. • May 2013 - Bitcoin malware leveraged a Proxy Auto- Configuration (PAC) file to redirect infected victims to a fake Mt. Gox website. The victim’s Internet browser would contact the criminal’s proxy server as defined in the PAC. So, when visiting the original Mt. Gox website, the victims would instead be directed to the fake website hosted on the criminal’s server [2] . crypto currency mining Figure 1: Custom stealth mining tool for sale
  • 31. 31 f-secure | h1 2013 threat report • June 2013 - Cyber-criminals distributed spear-phishing spam that led to a fake Mt. Gox website. The URL of the fake site contained a similar second-level domain name “mtgox” but different top-level domain names - “.org,” “.net,” “.co.uk” and “.de.” This trick was easier to recognize compared to a malicious PAC [3] . • Late June 2013 - Researchers from Webroot uncovered the latest DIY Bitcoin mining tool in an underground market. The Bitcoin miner generated by this DIY tool was claimed to be stealthy and invisible. Based on our analysis of the sample, the criminals were using the Ufasoft Bitcoin miner, which was freely available on the official website [4] . ZeroAccess Botnet Estimated Profits Up to this day, the largest botnet mining operation was carried out by the ZeroAccess family. The malware consists of a powerful rootkit to hide its presence and so-called “plugins.” While slower computers are useful enough for fraudulent pay- per-click operation, the faster ones will occasionally receive an additional plugin to perform mining tasks. To calculate how much profit the mining operation can bring, let’s consider these few assumptions: • According to a survey conducted by Valve Corporation in May 2013 [5] , the most common graphic cards among gamers are NVIDIA 400/500/600 series and AMD 5000/6000 series, which produce ~225 Mhash/s [6] out of a typical gamer’s PC. • Close to 100,000 PCs are suspected of being infected by ZeroAccess daily. Monthly, the botnet consists of ~3 to 5 million active installations; there could be ~2 million machines directly involved in the mining operation (half of the botnet) on a certain time frame. • If 5% of these (probably more) are gamers’ machines, a simple calculation gives us 22,500,000 Mhash/s (2x106 ) (0.05) (225 Mhash/s) = 22.5x106 Mhash/s bitcoin crypto currency mining • At the current price of USD 100=BTC 1 [7] and mining difficulty of 19,339,258, attackers could be earning the following sum of money: table 1: Estimated profit from zeroaccess mining USD ($) BTC (฿) Daily profit 58,913 585 Weekly profit 412,295 4,095 Monthly profit 1,790,976 17,787 With a monthly profit of USD 1.7 million out of 5% top victims, ZeroAccess-powered mining operation is undoubtedly a very lucrative option to cyber-criminals. ZeroAccess Bitcoin Plugins Back-to-Back Update ZeroAccess’ botnet operator has recently been performing multiple updates on the plugins responsible for carrying out Bitcoinminingpayloads.Interestingly,eventhoughtheBitcoin plugin is still actively updated and pushed to infected peers, the Bitcoin mining payloads do not exist in the binary file. Based on the samples that exist in our backend systems, we have come up with an update history of the Bitcoin plugin binary file. The release date of the binary is presumably determined from the timestamp of the binary compilation update. An update is usually released every month, but there are a few instances where the botnet operator only releases a new binary after two months. And it uses its own private pool server to distribute a cryptography block for its workers— infected PCs running the mining plugin—to solve. The pool server used by the Bitcoin plugin released in August 2012 was identified as “google-updaete[dot]com.” From September 2012 to April 2013, the botnet operator released a plugin binary that does not contain the mining payloads. countries hit by bitcoin plugin released in april 2013
  • 32. 32 f-secure | h1 2013 threat report bitcoin crypto currency mining com.” This plugin binary, with the mining payloads, did not last long. The screenshot in Figure 3 shows the comparison between the older and the latest version of the Bitcoin plugin built in the same month. The file on the right shows the latest plugin, which was built on 23rd April 2013. The yellow highlighted rectangle shows that the embedded UPX packed Ufasoft’s Coin miner binary has disappeared. In other words, starting from 23rd April 2013 until today (at the time this article iswritten),ZeroAccessdoesnotcarryBitcoinminingpayloads. The absence of the mining payloads however, does not mean that the botnet operator has stopped generating revenue from its botnets. The click fraud payloads that reside in the same plugin binary file are still functioning. The reason why the botnet operator stopped Bitcoin mining payload despite the lucrative BTC exchange rate is a mystery. But here are some table 2: Bitcoin plugin release date summary Binary Compilation Date Contains Bitcoin payloads? YES NO August 2012 x September 2012 x November 2012 x December 2012 x February 2013 x March 2013 x April 2013 x On 2nd April 2013, the botnet operator released a new Bitcoin plugin binary and reintroduced the Bitcoin mining payloads using a different private pool server, “ooyohrmebh9qfof[dot] Figure 2: Comparison of older and new version of BitCoin miner plugin countries hit by bitcoin plugin released in august 2012
  • 33. 33 f-secure | h1 2013 threat report bitcoin crypto currency mining assumptions that can be made: • It is too expensive to setup and maintain its own private pool server • It is too invasive and noisy to run a Bitcoin mining operation on an infected machine • It is not easy to mine a Bitcoin without using a dedicated machine, especially when the botnet operator turns off GPU mining by default Conclusion It is hard to estimate the worldwide infection rate due to the use of commonly available mining tools, which may or may not be installed with the users’ consent. But we have managed to take a total count of incoming Bitcoin mining-related samples for every month in the first half of 2013. Not surprisingly, the graph matches (with slight delay) with the BTC trade prices reported by Mt. Gox exchange. Since the introduction of Bitcoin in 2009, there has been two types of Bitcoin malware attacks. The first one involves malware variants that steal Bitcoin wallet files from infected victims. The second type involves variants that run legitimate Bitcoin mining tools on infected machines, allowing cyber criminals to collect Bitcoin without paying for hardware or electricity. Apparently, the cyber criminals gave up the first type of Bitcoin malware attack because of the extra security featureimplementedintheBitcoinclient.Thefeatureencrypts the “wallet.dat” file, making it valueless to cyber criminals that did not “key-log” the password key. Based on the current trend, it is not surprising to see more malware leveraging the type-2 method in the future to earn a penny. However, it is hard to estimate the profits as they spread differently and often utilize “p2pool mining” where each infected PC is kind of “solo-mining” to a specified wallet address. Typical infection vectors that may be utilized by the malware include Skype or other instant messaging services, e-mail, drive-by-downloads and exploits. bitcoin malware growth Source: virustotal.com Source: mtgox.com
  • 34. 34 f-secure | h1 2013 threat report Exploit KITS exploit Top-5 exploit kits According to F-Secure’s telemetry data, 70% of all exploit-kit related detections encountered by our clients in the first half of 2013 are the work of 5 exploit kits: Blackhole, SweetOrange, Crimeboss, Styx and Cool. 28 other exploit kits account for the remaining 30% of exploit-kit detections. Of the top five kits, Blackhole by itself was responsible for 31% of all exploit-kit related detections globally reported to our cloud-based systems during this period. This exploit kit’s behavior was first detailed in our H1 2012 Threat Report and one year on, has changed little except for incorporating exploits for recently announced vulnerabilities, such as CVE- 2013-2423 and CVE-2013-0422 (see Vulnerability Exploitation article on page 36), and tweaks to the URL patterns used for its exploit sites. Of the other exploit kits in the top five, SweetOrange is the closest competitor to Blackhole, accounting for a comparatively low 11% of all exploit-kit related detections seen worldwide. The geographic distribution of the clients that saw these detections (chart at right) indicates that though most of thetopfivekitshadsomepresenceineveryregion(particularly Blackhole, which is practically omnipresent), the Crimeboss exploit kit focused almost exclusively on the Americas, where it accounted for 31% of all exploit-kit detections there. New entrance In the span of six months, we saw seven new exploit kits emerge (see timeline at bottom), as well as the updating of an older kit, CritXPack aka SafePack aka FlashPack, with new names. Though these kits have had relatively modest success compared to Blackhole or even SweetOrange, the increasing In the last couple years, exploit kits have become a popular, convenient tool for attackers and malware distibutors to efficiently find and compromise new victims. in H1 2013, we saw increasing development and competition among exploit kits, as new contenders emerged and older, established toolkits expanded their capabilities with new vulnerability targets and new tricks to avoid detection. number of active kits in play has simply given more options for malware distributors to carry out their work. Of particular note among the new batch is Whitehole, which focuses on exploiting the Java development platform. 30+11+10+10+9+30+V19+6+31+6+4+10+10+14+T GLOBAL Am ericas 19 31 11 10 10 9 631 6 4 36+12+17+6+29+R Europe 36 7 17 12 36+20+14+2+28+M APA C 36 2 14 20 29342828% geographic distribution of top 5 Exploit kits in h1 2013, By Percentage 30= Blackhole 30= SweetOrange 30= Cool 30= Others 30= Crimeboss 30= Styx In H1 2013, 31% of our clients worldwide reported a Blackhole-related detection, making it the most globally prevalent exploit kit. new exploit kits encountered in h1 2013, By date of first encounter Jan feb mar apr may jun RedDot Whitehole Flimkit SafePack FlashPackCritXPack changednameto changednameagainto Neutrino DotkaChef PrivateRawin In H1 2013, we saw a series of new exploit kits appearing in the wild. exploit kits
  • 35. 35 f-secure | h1 2013 threat report Targeting recently publicized vulnerabilities It’s been noted before that exploit kit authors have been very prompt in including new exploits for recently announced vulnerabilities into their products, and H1 2013 has been no different. Case in point involved the Java vulnerability CVE-2013-2423; a Metasploit module targeting this was first published on April 20th, and a day later we noticed in-the- wild attacks against it had already gotten underway by the CrimeBoss exploit kit. We also saw a new exploit kit, Private, become the first to target the CVE-2013-1347 vulnerability in version 8 of Internet Explorer. This particular vulnerability gained public notice due to a US Department of Labor website compromise in early May 2013; a patch was released by Microsoft just days later. The following month, we encountered the Private Pack exploit kit on June 11, already busy targeting this vulnerability. As of July 2013, at least 5 vulnerabilties which were only publicly announced during the past half year have been incorporated into various exploit kits. Four of the five vulnerabilities—CVE- 2013-0422, CVE-2013-0431, CVE-2013-1493 and CVE-2013-2423 —have been related to the Java development platform. These exploits are identified by various detections in our security products, including the specific detections Exploit:Java/CVE- 2013-2423.A and Exploit:Java/CVE-2013-2423.B, and a powerful generic detection, Exploit:Java/Majava.C. New tricks employed Given the consistent focus of multiple kits on exploiting Java, during this six month period Oracle has unsurprisingly been busy releasing updates to close the vulnerabilities under attack and to generally increase the security of the product. Of particularnotewastheJava7Update11,whichnotonlypatched the CVE-2013-0422 vulnerability but also changed the default JavaSecurityLevelfrom‘Medium’to‘High’.Thischangemeans that a security warning dialogue appears requiring the user to click ‘Run’ before an applet is able to execute. In response, attackers are now changing their methods and bypassing this feature by loading either serialized applets or Java Network Launch Protocol files (jnlp). 400+130+80+390=Blackhole 540+140+130+190=SweetOrange 330+310+200+160=Crimeboss 400+110+110+380=Styx 180+170+180+470=Cool 100%0% 81% 84% 62% 61% 51% top 3 host countries in h1 2013 for exploit sites per kit, % of total exploit sites 13 20+11+8 1413 33+18+11 16 17 Ukraine Romania Lithuania Latvia Germany France Netherlands 14 13 31Luxembourg 31 17 16 33 18 11 20 13 811 54+40+40US 54 40 40 top 3 host countries in h1 2013 for exploit sites per kit, Mapped as percentages (%) per country
  • 36. 36 f-secure | h1 2013 threat report exploit exploit kits / vulnerability exploitation Another new trick we saw introduced in H1 2013 is that a number of exploit kits, such as Neutrino, Sakura and Redkit, have started encrypting their binary payloads using XOR or AES encryption to evade detection. Exploit site hosting Users typically encounter exploit kits during online browsing, either by stumbling onto a compromised site injected with an exploit kit, or by being hijacked or redirected to a malicious attack site. Most of the websites distributing exploit kits are hosted in the United States and Europe. 3 countries in particular—the US, Germany and the Netherlands—host a significant portion of all exploit sites. Some exploit kits favor hosting their attack sites in specific countries. For Crimeboss, 84% of its exploit sites are hosted in just 3 countries—Germany, Luxembourg and the Netherlands. Meanwhile, the US hosted 54% of the sites known to distribute the SweetOrange exploit kit, as well as 40% of both Blackhole and Styx sites. Tracing the IP addresses associated with the Following on the trend from 2012, in H1 2013 vulnerability exploitation continues to be a popular way for malware distributors and attackers to gain access to a machine, whether it’s to plant malware on the system or to perform some other nefarious action. In this article, we look at some of the interesting trends we noted in exploiting vulnerabilities during the first six months of 2013. Focusing on zero-days Throughout most of 2012, we observed attacks mainly being targeted against vulnerabilities that had been publicly known for some time, often years. For example, throughout 2012, one of the most commonly attacked vulnerability was CVE-2010- 0288—a vulnerability in Adobe Reader and Acrobat that had been discovered fully two years earlier. In 2013 however, we noticed a shift and an increasing focus on exploiting zero-day vulnerabilities, which had not yet had patches released by the affected application’s vendor. During this period, our telemetry data indicated that an astonishing 95% of detections reported to our systems identifying attacks against specific vulnerabilities were targeted against only five vulnerabilities; and of the five most targeted, three were vulnerabilities that had only been publicly announced within the last six months. Not coincidentally, all the top five vulnerabilities are known targets for various exploit kits (see Exploit Kits article on page 34). kits also turned up a handful of ASNs involved in hosting the exploit sites. For example, 14% of Blackhole’s IP addresses, 12% of Styx’s and 7% of Cool’s were all tracked back to AS16276 OVH Systems. Protecting against exploit kits Themostcommonlycitedadviseforprotectingagainstexploit kits involves speeding patching of affected systems soon as updates are issued by vendors. When zero-day exploits are involved however, the most effective defense would be to reduce the attack surface of any system connected to the Internet. This requires a multi-faceted, ‘defense in depth’ approach to security, and includes such elements as web browser security, web traffic scanning, email filtering, well- implemented intrusion detection/prevention systems and more. For suggestions on how to protect a system against exploit kits, see Recommendations on page 39. Vulnerability Exploitation CVE-2011-3402 — the most targeted vulnerability Far and away the most commonly targeted vulnerability in H1 2013 was the CVE-2011-3402 Truetype font vulnerability in Windows. This vulnerability first came to prominence when it was used by the Duqu malware in a targeted attack campaign in early 2012; by late 2012, the exploit for the vulnerability had been added to various exploit kits. Since then, attacks against this single vulnerability have skyrocketed and in the past six months, CVE-2011-3402 alone accounted for an amazing 69% of all eploit-related detections reported. Java — second most targeted program Of the top five most targeted vulnerabilities, four are found in the Java development platform, either the Runtime Environment (JRE) or the browser plug-in. This is hardly surprising since next to the Windows operating system (also a popular target for exploits), Java is probably the second- most ubiquitous program in an organization’s IT setup. In H1 2013 however, the security issues related to Java received unwelcome attention from a series of widespread and
  • 37. 37 f-secure | h1 2013 threat report Unfortunately, removing either the runtime or plug-in may not be a feasible option for companies that use Java in business-critical instances. For organizations faced with such a dilemma, the alternative involves hardening their system’s or network’s attack surface against exploitation — a more effective, but also more complicated solution than just simply uninstalling a program. Possible mitigation strategies for these companies would likely involve some combination of tweaking Java’s security settings, configuring web browser settings to minimize unwanted applet execution (or installing other third- party plug-ins to do so) and monitoring network traffic. Geographical distribution of vulnerability attacks Perhaps unsurprisingly, the country that reported the most vulnerability-based attacks was the United States, where according to our telemetry data, approximately 78 out of every 1,000 users saw a detection identifying an exploit of a specific vulnerability within the last six months. successful corporate attacks on major technology and news companies such as Facebook, Twitter, Apple and NBC, some of whom have confirmed that the breach in their systems was traced to a zero-day exploit against Java. To counter the successive security issues that have been cropping up, Oracle has been busy issuing security updates over the last six months, as well as increasing the default Java security setting to ‘High’. Oracle itself has recommended that these patches be applied as soon as possible, given the critical nature of many of the vulnerabilities addressed in the patches. In addition, various security companies (as well as the United StatesDepartmentofHomelandSecurity)haverecommended thatusersandorganizationsremoveunnecessaryJavaruntime installations to safeguard their machines from intrusion — or at the very least, remove or disable the associated Java web browser plug-in, which is the first point of entry that exploits target to gain access to the program. exploit CVE Affects Notes 2011-3402 Windows OS Targeted by by multiple exploit kits, particularly Cool 2013-1493 Java Only affects Java in web browsers 2011-3544 Java Targeted by by multiple exploit kits, particularly Blackhole 2013-2423 Java Targeted by multiple exploit kits 2013-0422 Java Only affects JRE 7 69 +12+8+4+2+5 ALL OTHER CVES CVES ACCOUNT FOR OF ALL ATTACKS 95%5 Top 5 Exploited Vulnerabilities 95% of all vulnerability-related attacks reported by our clients in the first half of 2013 involved 5 vulnerabilities, 4 of them in Java. Top 10 Countries Based on the Exploit Prevalence Rate*, users in the United States, Germany and Belgium encountered the most vulnerability-related attacks in H1 2013. *Exploit Prevalence Rate, per 1000 users: calculated by dividing the total number of vulnerability exploit detections by the number of clients in the country, then multiplying by 1,000 Vulnerability exploit detections in h1 2013, summary 3+14+23+34+38+38+55+60+60+78 78 6060 383834 USDEBENLITSEFRDKFIGB 55 23 14 3 H1 2013 2012 2011-3402 2011-3402 2013-1493 2010-0188 2011-3544 2010-0188 2013-2423 2012-5076 2013-0422 2012-0507 Out with the old 3 of the top 5 targeted vulnerabilities (marked in blue) were discovered within the last 6 months.
  • 38. 38 f-secure | h1 2013 threat report Germany also saw a relatively high amount of vulnerability attacks, with approximately 60 out of every 1,000 users reporting a hit in the same time span. Of the top 10 most targetedcountries,allexcepttheUnitedStateswereinEurope. Market for exploits expanding For years now, a largely overlooked aspect of security has involved the way vulnerability disclosures are handled, especially for zero-days in popular applications. Security researchers and application vendors have long debated whether the best way to handle such issues was to keep the information secret (with or without payment), or publicly disclose it to force developers to fix the security problems. This has been of particular concern with the increasing activity in the rapidly growing ‘exploit sales’ market [1] , which essentially monetizes vulnerability research by selling the results to the highest bidder. In addition to the application vendor concerned, other players (government contractors, other researchers and malware authors) become potential buyers of information that was once released for free, or for a token sum. Though legal, exploit sales have typically been clandestine in nature. As vulnerability exploitation has become more widely used in both targeted attacks and malware distribution however, it seems to be becoming more prominent, if not exactly open. In early 2013, there was a report [2] of the Blackhole/Cool exploit kit author posting a notice in a Russian cybercrime forum, offering to purchase exploits. According to the reported translation of the notice, the ‘exclusive program’ offered by the author also included payment for “improvements to existing public exploits and also any good solutions for improving the rate of exploitation”. Government agencies and contractors have also reportedly been involved in purchasing software exploits, purportedly for use in offensive cyberattacks [3] , despite burgeoning concerns that this activity would ultimately damage the security and civil liberty of their own citizens [4] . Though no government has openly stated they are actively engaging in exploit purchasing, most reports implicate agencies in the United States and China of doing so. Countering exploits sales InH12013,Microsoftlauncheditsown‘bugbounty’programto encourageresearcherstoresponsiblydisclosevulnerabilitiesin its products. The company joins a small handful of technology entities (Facebook and the HP-affiliated Zero Day Initiative among them) trying to counter the lure of the ‘exploits-for- sale’ market by offering payment for vulnerability information. These initiatives faces stiff competition however; reports indicate that some government players are willing to pay six- figure sums for both the critical information and an agreement to keep the vulnerability private, essentially guaranteeing the buyer a secret access point to the program of interest. Government interest in exploit sales has also extended to tentative talk of introducing legislation to regulate the market[5] , at least in the European Union. Until that becomes a reality though, the market in exploit sales is likely to keep growing. What this means for the future state of cybersecurity is anyone’s guess, but at a minimum, organizations should certainly pay more attention to defending their networks and systems from vulnerability exploitation. SOURCES 1. Forbes; Bruce Schneier; The Vulnerabilities Market and the Future of Security; published 30 May 2012; http://www.forbes.com/sites/bruceschneier/2012/05/30/the-vulnerabilities-market-and-the-future-of-security/ 2. Krebs on Security; Brian Krebs; Crimeware Author Funds Exploit Buying Spree; published 7 Jan 2013; https://krebsonsecurity.com/2013/01/crimeware-author-funds-exploit-buying-spree/ 3. NY Times; Nicole Perlroth and David E. Sanger; Nations Buying as Hackers Sell Flaws in Computer Code; published 13 July 2013; http://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computer-flaws.html 4. Reuters; Joseph Menn; Special Report: U.S. cyberwar strategy stokes fear of blowback; published 10 May 2013; http://www.reuters.com/article/2013/05/10/us-usa-cyberweapons-specialreport-idUSBRE9490EL20130510 5. Slate; Ryan Gallagher; Cyberwar’s Gray Market: Should the secretive hacker zero-day exploit market be regulated?; published 16 January 2013; http://www.slate.com/articles/technology/future_tense/2013/01/zero_day_exploits_should_the_hacker_gray_market_be_regulated.html vulnerability exploitation exploit
  • 39. recommendations: Protecting against exploits 1 Apply security updates Apply security patches for affected programs as soon as they are released by the application vendors. It would go a long way towards preventing a wide range of exploit kits from successfully compromising a machine. In addition to a consistent patch cycle (particularly if patches are problematic to push out), companies can protect their systems against vulnerability exploitation with an Intrusion Detection and Prevention System (IDS/IPS) running up-to-date signatures. top 15 most targeted vulnerabilities in h1 2013, listed by cve number 2 Minimize attack surface Security updates and intrusion detection are effective against known threats to already-patched vulnerabilities. But for zero-day exploits which do not yet have fixes, the most effective protection is to minimize the attack surface (the various vectors through which malicious code can be run) of any system connected to the Internet. For most end users, ‘reducing the attack surface’ translates simply enough to securing the web browser. This is particularly true in cases where uninstalling the Java web browser plug-in, currently a favored attack vector for multiple exploit kits, is not an option. In such cases, the user can instead increase the security of the web browser by: CVE Affects Patch Released 2013-2423 Java 16 April 2013 2013-1493 Java 4 March 2013 2013-1331 Microsoft Office 11 June 2013 (MS13-051) 2013-0809 Java 4 March 2013 2013-0422 Java 13 January 2013 2012-5076 Java 16 October 2012 2012-4681 Java 30 Aug 2012 2012-1723 Java 12 June 2012 2012-0507 Java 17 May 2012 2011-3544 Java 18 October 2011 2011-3402 Windows OS 8 May 2012 (MS12-034) 2010-0188 Adobe Reader Acrobat 23 February 2010 2010-0840 Java 30 March 2010 2010-1885 Windows OS 10 June 2010 (MS10-042) 2007-5659 Adobe Reader Acrobat 6 May 2008 (i) Updating Java In the Java 7 update 11 release, the default security level setting for Java was increased to High. This configuration means that users need to expressly authorize an applet execute (whether they are unsigned or self-signed). (ii) Disabling the Java browser plug-in If updating Java isn’t an option, user can focus on managing the Java browser plug-in by disabling the plug-in and only enabling it when needed. This can be done via a handy, one-click option in the Control Panel (available in the Java 7 update 10 release) or via the web browser’s settings. The instructions for disabling Java in various web browsers are available at: http://www.java.com/en/download/help/disable_browser.xml (iii) Using two browsers Rather than fiddling with security settings, the user may opt for a two-browser strategy, in which one browser with the Java plug-in enabled is dedicated solely to using the website or program that demands it. All other web browsing is done on a separate browser without the plug-in. (iv) Enabling Click to Play For Java-enabled web browsers, an additional touch of security comes from the plug-in blocking feature built into most browsers. In Firefox and Opera, it’s known as ‘Click to Play’ while Chrome has a ‘Block all’ option for plug-ins in its Contents Settings page. This functionality prevents automatic execution of plug-ins (not just Java) and requires the user to click on the plug-in of interest before it will run. (v) Using third-party apps Another possibility is to use third-party programs to block plug-ins from automatically running on page load, unless the user chooses otherwise. The most popular of such programs is NoScript, which blocks multiple types of active content in Mozilla-based browsers, though there are a handful of other applications available that perform a similar function. !! Zero-day exploits Even with fully patched programs and a locked down web browser, companies concerned about vulnerability-based attacks against their systems may also need to consider and counter the possibility of an undisclosed vulnerability being used.Insuchcases,thelastlineofdefenseisawell-implemented IDS/IPS setup, or an equivalent system capable of identifying suspicious activity on the machines in the protected network. Though general recommendations are less useful here, ideally, such a protection system would be a unique combination of network monitoring, firewall, white- and blacklisting solutions that suits the normal needs and production environment of the end users.
  • 40. 40 f-secure | h1 2013 threat report Kumar in the Mac (KitM) mac Lastyear,AppleintroducedasecurityfeaturecalledGatekeeper to OS X. Gatekeeper restricts running of applications to only those from identified developers as a default protection. This helps prevent users from unwittingly running malwares since malwares are generally not signed. Malware authors would not want their malicious work linked back to them, wouldn’t they? Ironically, this is exactly what a malware author did. To pass through the defense introduced by Apple, the malware was signed using an Apple Developer ID in the name of Rajinder Kumar (see Figure 1), hence the name KitM or “Kumar in the Mac.” KitM is our designation for samples signed by the affected Apple Developer ID. Figure 2: LinkedIn hits for Rajinder Kumar It is not clear whether Rajinder Kumar is the actual person behind the malware. A quick search of the name in LinkedIn returned at least 468 hits (see Figure 2). The name might as well be the “John Smith” equivalent of India. It might be just a disposable name cleverly chosen by the attackers to get an Apple Developer ID[1] . Regardless, Apple was swift in revoking the said ID to prevent any future infection of the malware. kumar in the mac (kitm) During the first half of 2013, we saw the first Mac malware signed with a valid Apple Developer ID. For those unfamiliar with code signing, the Apple Developer ID is like a signature in digital form. Just like a handwritten signature, which identifies a document to its author, a digital signature identifies a code to its developer. The malware was discovered by an independent researcher, Jacob Appelbaum. He found two spyware variants on the Mac machine of an Angolan activist during a workshop in the Oslo Freedom Forum. The first variant was an application bundle having a file called “FileBackup”. After the discovery, we startedminingourbackend system for samples having the same filename, and found one that dated back to April 21, 2012 [2,3] . The sample not only share the same filename but also its internal structures such as classes, methods, etc., which led us to conclude that it was indeed an earlier variant. This sample also contained build paths that revealed to us that the malware is actually a repurposed version of an open source online backup utility called FileBackup (see Figure 3). The utility uses a configuration file called “FileBackup.ini” to determine which files to backup (based on extensions) and where to upload the backup (based on a drop URL). Naturally, we tried to locate the corresponding configuration file. We found one that was shared to us by an AV partner at the same time as the sample mentioned earlier[4] . We found that the configuration file specified a domain (see Figure 4) similar to that in newer variants, which you will see later in Table 1. This confirmed that the sample is not just some benign utility but is indeed used maliciously. This also confirmed that the APT has been going on since much earlier than anyone has expected. Figure 1: Digital certificate of KitM Figure 3: Downloaded project called “FileBackup-1” Figure 4: Drop URL and extensions specified in a configuration file
  • 41. 41 f-secure | h1 2013 threat report mac kumar in the mac (kitm) The other variant discovered by Appelbaum is something we have never seen before. This variant takes screenshots instead of collecting files. Analysis of the sample revealed that it shared a lot of codes with the file-stealing variant, some of which were not even used. From this we deduced that the screen-grabbing variant is a development branch of the file- stealing variant. Since then, other cases have been reported which lead to the discovery of other earlier variants[5] . Some of the file-stealing variants have a downloader capability. In most cases, only the file stealer was used. In one case however, the file stealer downloaded a companion application, which turned out to be identical to the screen grabber discovered by Appelbaum. We therefore believe that most likely this is also the case for the Angolan activist. To summarize the attack (see Figure 5), the victim receives a spear phishing email containing the file stealer as an attachment. Take note that some of the file stealer variants have a downloader ability. The attachment, which is an application, poses as a document, image or other types of media. After the victim falls for the social engineering trick and get himself infected, the attackers may choose to introduce additional malware depending on the purpose of the attack. For now, only the screen grabber is know to be used but do not be surprised when a key logger or backdoor variant pops out in the future. It is not uncommon for APT attacks to have such components. Security researchers have linked the cases to a larger espionage effort known as Operation Hangover[6] . The operation is known to have been employing freelance developers[7] . Interestingly, a path containing the name “Elance” (see Figure 6) was found on an unused remnant file (login.scpt—see Table 1) of some of the file- stealing variants. Elance here may be a reference to the online freelance recruitment site[8] . Figure 6: Project for Elance @ Spear phishing email with the file stealer/ downloader as an attachment Attacker use the file stealer/downloader to install additional malware as necessary Figure 5: KitM attack summary KitM attack summary attack period unknown (received on apr 2012) dec 2012 h1 2013 may 2013 Signed by Rajinder Kumar (KitM) No Yes Yes Yes Designated malware family Hackback Hackback Hackback Undesignated Filename / AppDelegate-prefix FileBackup FileBackup FileBackup macs / macps Functionality Collect files Collect files Collect files / downloader Take screenshots Uses “FileBackup.ini” Yes No No No Uses “login.scpt” Yes No No No Comes with “login.scpt” Yes Yes Yes No Domain of Drop URL liveapple[dot]eu liveapple[dot]eu liveapple[dot]eu; securitytable[dot]org securitytable[dot]org Domain of secondary payload URL n/a n/a liveapple[dot]eu; torqspot[dot]org n/a Remnant domain found in sample researcherzone[dot]net (used as fallback) None None docsforum[dot]info Table 1: Sample development summary
  • 42. 42 f-secure | h1 2013 threat report mac Sources 1. Twitter; Sean Sullivan; published 16 May 2013; https://twitter.com/5ean5ullivan/status/334987332556054528 2. Twitter; Sean Sullivan; published 16 May 2013; https://twitter.com/5ean5ullivan/status/335055459859980290 3. Sample; sha1 hash: 93decbdc89e52d5c5bde5d443f131f001e2b49d7 4. Sample; sha1 hash: 55374f3a281bd81e70ae1be8857085906cc87204 5. F-Secure Weblog; Sean Sullivan; Mac Spyware Bait: Lebenslauf für Praktitkum; published 23 May 2013; http://www.f-secure.com/weblog/archives/00002559.html 6. F-Secure Weblog; Sean Sullivan; Big Hangover; published 21 May 2013; http://www.f-secure.com/weblog/archives/00002557.html 7. Dark Reading; Kelly Jackson Higgins; ‘Hangover’ Persists, More Mac Malware Found; published 18 July 2013; http://www.darkreading.com/attacks-breaches/hangover-persists-more-mac-malware-found/240158537 8. Elance; http://www.elance.com/ We have summarized the major sample developments of the attacks in Table 1. You may notice that during the majority of the operation, the attackers used “liveapple[dot] eu” as the command and control (CC), which lasted until early H1 2013 (February). However the remnant domain “researcherzone[dot]net” was found on the April 2012 sample. This may indicate that there are yet undiscovered earlier samples using that domain as CC. During later H1 2013 (April), the CC changed to “securitytable[dot]org” for the drop URL and “torqspot[dot] org” for the secondary payload URL. We all know that the secondary payload hosted in “torqspot[dot]org” was the screen grabber discovered by Appelbaum. However no one has found a sample yet that is supposed to be the secondary payload hosted in “liveapple[dot]eu” when it was live. The authors have implemented the downloader capability long before the “securitytable[dot]org”/”torqspot[dot]org” variant, which almost guaranteed that such sample exists. This sample should be something that is not a file stealer, perhaps an earlier variant of the screen grabber or another type of malwarelikeabackdoororkeyloggerthatuses“liveapple[dot] eu” as its drop URL domain. Finally the remnant domain “docsforum[dot]info” found in the screen grabber may indicate that there are undiscovered secondary payload samples using that domain as CC. Whichever is the case, users can be assured that their AV will most likely be able to detect if not protect infection from those possible in-between variants. This is because it is known that the attackers have always used a file-stealing malware that belongstoanalreadywell-knownfamily,atleastbynow,called Hackback as the initial payload. For those missing secondary payloads, we know that the attackers have been signing their work long before they started using secondary payloads, which means these missing variants will also be signed. For F-Secure users, these variants will be identified as Kumar in the Mac (KitM). kumar in the mac (kitm)
  • 43. 1/2 Rootkit 1/2 Virus 57+43+z57.6% backdoor 19/33 36+64+z36.4% trojan 12/33 6+94+z6% others 2/33 1/4 Virus apr 3/4 backdoor 4/5 trojan-spy may 1/5 backdoor jun 1/5 trojan 2/5 backdoor 1/5 trojan-Dropper 1/5 trojan-spy 2/2 backdoor jan 4/14 trojan-spy feb 10/14 backdoor 1/3 trojan-spy mar 1/3 backdoor 1/3 rootkit ** The number shown is the count of unique variants detected. This means repackaged installers are not counted and multiple component malware only have 1 count. 33families + variants of Mac malware TOTAL COUNT (Jan-Jun 2013) = Mac malware H1 2013 30 20 10 0 jan feb mar apr may jun 5543 14 2 2 19 23 28 33 Running total New Families and variants 16
  • 44. 44 f-secure | h1 2013 threat report Phishing webreputation When the word phishing comes to mind, we usually think of our bank accounts and the credentials needed to access them. But in the age of one-time passwords and multiple-factor authentications, a lowly phishing webpage rarely stands a chance against such sophisticated protection. As such, more advanced banking trojans have emerged to take on the challenge of breaking into online- accessible bank accounts. This does not mean that phishing has been rendered obsolete however; it only means that phishing has to be less discriminating regarding its catch. Nowadays, every person who spends time online has something that phishers can steal and attempt to sell. In an age where all online information is fair game, the melody has become: if it has a username and password, then it can be a phishing target—if it’s not already. This means everything from Google, Yahoo, AOL or Live accounts used for e-mails and online storage, to social networking and media accounts such as Facebook and Twitter, used to keep abreast with the latest updates from various connections. Even dating websites are not immune. Match. com and SeniorPeopleMeet are only a few of the names targeted in the dating scene. And how about gaming sites and gaming portals? Battle.net, Steam, Runescape, Habbo, anyone? Sourcing and reaching targets The most visible place where users run into phishing URLs are spam e-mails. The recipients for these unsolicited mails can be bought in bulk from underground markets or even various websites that offer e-mail addresses for sale (see Figure 1). After the e-mail addresses are obtained, the spamming begins. Despite the low click-through rate associated with spam, the sheer volume of spam sent out worldwide results in enough traffic going to the phishing sites to make this method a mainstay of the phisher’s business model. Once the users click the link in the spam e-mail, they are taken to the phishing site, which is usually crafted with a particular target in mind. Types of phishing sites We profiled 71% of all the phishing URLs we gathered during the first half of this year and found that they are of two types: direct phishes and indirect phishes. Figure 1: Websites selling e-mail addresses Figure 2: A direct phishing site (left); an indirect phishing site (bottom)
  • 45. 45 f-secure | h1 2013 threat report webreputation Direct phishing straightforwardly involves displaying a fake webpage mimicking the target site, which is used to steal login credentials and possibly other information for that site (see Figure 2, top left). This type of phishing has been around since phishing has existed and has not really changed much, except perhaps for the improving ‘look and feel’ of the phishing sites. When it comes to the overall coverage though, direct phishes still trump indirect phishes 99 to 1. Indirect phishes are pretty recent and involve displaying a fake webpage mimicking a secondary ‘bait’ site, which is used to steal the credentials for another site, which is the real target. For instance, the ‘bait’ site may be a tax filing site linked to various banks, and the phishing site copying the bait may include a new ‘feature’ that requires the users of the associated banks to enter their username and password for “account verification” (see Figure 2, bottom). Indirect phishes are mostly, though not exclusively, targeting sites in the real estate, taxation and logistics categories. Phishing Sites Distribution When it comes to sorting out what is the most valuable information that phishers are aiming for, PayPal credentials top the charts—the online payment service is the target of 73% of all phishing sites we profiled, with all other organizations sharing the remaining 27%. It’s pretty obvious why that information is easy to sell, it’s essentially free money. Also, since usage of the service is so widespread, phishers can get victims from everywhere. Phishing, being less discriminating nowadays, necessarily covers a wide range of categories (the type of targets they attack), though the top 10 most targeted categories are, unsurprisingly, usually in some way related to online commerce. The phishing sites are also expanding by targeting brands in various regions and countries (quite aside from the fact that many of these brands also have an international presence). The geographical distribution of the phishing sites and their categories are listed on the next page. Automated Phishing and Scattershot Phishing Since phishing kits (toolkits that automate the production of phishing sites) have become quite common, setting up phishing pages for anything that will take the bait has become easier, and everyone is now a potential victim. These kits make it easier for the miscreants to generate different pages for potentially different targets. Although this article does not go into detail dissecting individual phishing kits, one point worth noting is the similarity in the format many phishing links, which points to the pages being automatically generated, which in turn indicates the phishing is being facilitated by the use of a phishing kit. Another notable trend in the phishing sites we’ve seen is scattershot phishing, which involves multiple financial institutions, as well as other targets, getting phished from a single domain. This technique allows the phisher to target potential victims at a fraction of the cost, as multiple domains don’t need to be created to address multiple targets. Above is an example of scattershot phishing. Selling the Harvest Once the phishers have gained their victim’s information, they can sell their ‘wares’ in underground markets or websites. The details can be sold on a per-item basis or in batches, depending on the site and the sellers’ preferences. Below are examples of two sites that cater to this underground market in stolen credentials. single domains phishing for multiple organizations Figure 3: Underground markets and sites selling credentials harvested from phishing hxxp://ahmadmachinery.com/parts/yphimail/yh.html (YahooMail) hxxp://ahmadmachinery.com/irs.gov/(IRS)hxxp://ahmadmachinery.com/gtbank/ (GTBank)
  • 46. 46 f-secure | h1 2013 threat report phishing webreputation top 10 categories for phished sites, by percentage Banks Gaming Credit cards Real estate ISPs Utilities Online shopping Online portals Social media All other types 1 % Payment services targeted brands per region, by percentage 28+72+W23+77+V22+78+U13+87+S6+94+R4+96+L4+96+z Europe Global North America South America Oceania Africa Asia 28 2322 136 4 4 % 992663901145351324 Payment Gaming Banks Credit cards Online shopping 10 60 Online portals 132775Real estate 421 31ISPs 383088Social media 48 100Utilities 6320Électricité de France (EDF) Facebook Twitter SFR Vodafone Remax Coldwell Banker AOL Yahoo! Ebay Cielo Visa Poste Italiane Banco Bradesco Battle.net Runescape Paypal top phished brands per category, by percentage All other brands 100500 % ISPs 82 13 11 4 4 4 56 6 7 Banks Online shopping Credit cards Online portals Real estate Dating sites Gaming Social media tax agencies number of targeted brands per category, top 10 Coldwell Banker, Homeaway, Loopnet, Remax, Sotheby Realty, US Property categories brands targeted for indirect phishes, by percentage 80+19+1Real estate agencies Logistics companies 1 % 19 80 Tax agencies 0 100 HMRC, IRS, SARS, SKAT Direct Logistics
  • 47. 47 f-secure | h1 2013 threat report Sources Sources h1 2013 incidents calendar (page 6) Malware Development [1] Krebs on Security; Krebs, Brian; Crimeware Author Funds Exploit Buying Spree; published 7 January 2013; http://krebsonsecurity.com/2013/01/crimeware-author-funds-exploit-buying-spree/ [2] Securelist; GReAT; The MiniDuke Mystery: PDF 0-day Government Spy Assembler 0x29A Micro Backdoor; published 27 February 2013; http://www.securelist.com/en/blog/208194129/The_MiniDuke_Mystery_PDF_0_day_Government_Spy_Assembler_0x29A_Micro_Backdoor [3] F-Secure Weblog; Aquino, Karmina; Flash Exploit Targets Uyghur Website; published 13 March 2013; http://www.f-secure.com/weblog/archives/00002524.html [4] F-Secure Weblog; Aquino, Karmina; CVE-2013-2423 Java Vulnerability Exploit ITW; published 23 April 2013; http://www.f-secure.com/weblog/archives/00002544.html [5] Microsoft; Microsoft Security Tech Center; Microsoft Security Advisory (2847140); published 14 May 2013; http://technet.microsoft.com/en-us/security/advisory/2847140 [6] The Register; Thomson, Iain; Mac malware found with valid developer ID at freedom conference; published 17 May 2013; http://www.theregister.co.uk/2013/05/17/mac_malware_steals_screenshots/ Hacks Espionage [1] Arstechnica; Goodin, Dan; Red October espionage platform unplugged hours after its discovery; published 19 January 2013; http://arstechnica.com/security/2013/01/red-october-espionage-platform-unplugged-hours-after-its-discovery/ [2] New York Times; Perlroth, Nicole; Hackers in China Attacked The Times for Last 4 Months; published 30 January 2013; http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html [3] F-Secure Weblog; Sullivan, Sean; Timeline: Hacks Related to Apple; published 20 February 2013; http://www.f-secure.com/weblog/archives/00002507.html [4] F-Secure Weblog; Sullivan, Sean; Evernote Hacked: 50 Million E-mail Addresses Exposed; published 4 March 2013; http://www.f-secure.com/weblog/archives/00002516.html [5] Guardian UK; Branigan, Tania; South Korea on alert for cyber-attacks after major network goes down; published 20 March 2013; http://www.guardian.co.uk/world/2013/mar/20/south-korea-under-cyber-attack [6] Arstechnica; Bright, Peter; Spamhaus DDoS grows to Internet-threatening size; published 28 March 2013; http://arstechnica.com/security/2013/03/spamhaus-ddos-grows-to-internet-threatening-size/ [7] Onion Inc.’s Tech Blog; Onion Inc.’s Tech Team; How the Syrian Electronic Army Hacked The Onion; published 8 May 2013; http://theonion.github.io/blog/2013/05/08/how-the-syrian-electronic-army-hacked-the-onion/ [8] Wired UK; Shubber, Kadhim; Millions of users’ data hacked in Yahoo Japan security breach; published 20 May 2013; http://www.wired.co.uk/news/archive/2013-05/20/yahoo-japan-hacked [9] Trend Micro; Wilhoit, Kyle; Hiding in Plain Sight: A New Targeted Attack Campaign; published 17 May 2013; http://www.guardian.co.uk/technology/2013/jun/07/uk-gathering-secret-intelligence-nsa-prism [10] Guardian; Hopkins, Nick; UK gathering secret intelligence via covert NSA operation; published 7 June 2013; http://www.guardian.co.uk/technology/2013/jun/07/uk-gathering-secret-intelligence-nsa-prism [11] Securelist; GReAT; “NetTraveler is Running!” - Red Star APT Attacks Compromise High-Profile Victims; published 4 June 2013; http://www.securelist.com/en/blog/8105/NetTraveler_is_Running_Red_Star_APT_Attacks_Compromise_High_Profile_Victims [12] Trend Micro; Aquino, Marhalito; RARSTONE found in Targeted Attacks; published 13 June 2013; http://www.guardian.co.uk/technology/2013/jun/07/uk-gathering-secret-intelligence-nsa-prism
  • 48. 48 f-secure | h1 2013 threat report Sources Mobile Malware Development [1] McAfee; Zhang, Michael; SMS Trojan Targets South Korean Android Devices; published 25 February 2013; http://blogs.mcafee.com/mcafee-labs/sms-trojan-targets-south-korean-android-devices [2] Dell SecureWorks; Stone-Goss, Brett; Stels Android Trojan Malware Analysis; published 22 March 2013; http://www.secureworks.com/cyber-threat-intelligence/threats/stels-android-trojan-malware-analysis/ [3] Arstechnica; Gallagher, Sean; First targeted attack to use Android malware discovered; published 27 March 2013; http://arstechnica.com/security/2013/03/first-targeted-attack-to-use-android-malware-discovered/ [4] The Register; McAllister, Neil; Sneaky new Android Trojan is WORST yet discovered; published 7 June 2013; http://www.theregister.co.uk/2013/06/07/android_obad_trojan/ [5] F-Secure Weblog; Sullivan, Sean; Post-PC Attack Site: Only Interested in Smartphones/Tablets; published 19 June 2013; http://www.f-secure.com/weblog/archives/00002569.html Security Enforcement [1] Europol; Europol; Police dismantle prolific ransomware cybercriminal network; published 13 February 2013; https://www.europol.europa.eu/content/police-dismantle-prolific-ransomware-cybercriminal-network [2] SCMagazine; Colon, Marcus; New anti-bot code of conduct approved by FCC; published 28 March 2013; http://www.scmagazine.com/new-anti-bot-code-of-conduct-approved-by-fcc/article/233756/ [3] Reuters; Accused LulzSec hacker gets year in prison over Sony breach; published 18 April 2013; http://uk.reuters.com/article/2013/04/18/usa-lulzsec-hacker-idUKL2N0D521220130418 [4] The Register; Leyden, John; British LulzSec hackers hear jail doors slam shut for years; published 16 May 2013; http://www.theregister.co.uk/2013/05/16/lulzsec_sentencing/ [5] ZDNet; van Blommestein, Michiel; Spamhaus DDoS suspect extradited, faces Dutch court; published 9 May 2013; http://www.zdnet.com/spamhaus-ddos-suspect-extradited-faces-dutch-court-7000015120/ [6] Arstechnica; Gallagher, Sean; Twitter launches two-factor authentication, too late to save The Onion; published 23 May 2013; http://www.zdnet.com/spamhaus-ddos-suspect-extradited-faces-dutch-court-7000015120/ [7] BBC; FBI and Microsoft take down $500m-theft botnet Citadel; published 6 June 2013; http://www.bbc.co.uk/news/technology-22795074 [8] FBI; Leader in $200 Million International Stolen Data Ring Charged in New Jersey as Part of Worldwide Takedown; published 5 June 2013; http://www.fbi.gov/newark/press-releases/2013/leader-in-200-million-international-stolen-data-ring-charged-in-new-jersey-as-part-of- worldwide-takedown [9] ZDNet; Whittaker, Zack; Microsoft unleashes bug bounty program — for betas, too; published 19 June 2013; http://www.zdnet.com/microsoft-unleashes-bug-bounty-program-for-betas-too-7000016956/ [10] Trend Micro; Aquino, Marhalito; Targeted Attack in Taiwan Uses Infamous Gh0st RAT; published 23 June 2013; http://blog.trendmicro.com/trendlabs-security-intelligence/targeted-attack-in-taiwan-uses-infamous-gh0st-rat/
  • 49. F-Secure has been protecting the digital lives of consumers and businesses for over 20 years. Our Internet security and content cloud services are available through over 200 operators in more than 40 countries around the world and are trusted in millions of homes and businesses. In 2012, the company’s revenues were EUR 157 million and it has over 900 employees in more than 20 offices worldwide. F-Secure Corporation is listed on the NASDAQ OMX Helsinki Ltd. since 1999. F-Secure in Brief
  • 50. Protecting the Irreplaceable F-Secure proprietary materials. © F-Secure Corporation 2013. All rights reserved. F-Secure and F-Secure symbols are registered trademarks of F-Secure Corporation and F-Secure names and symbols/logos are either trademark or registered trademark of F-Secure Corporation. Protecting the irreplaceable | f-secure.com