Malware « The GANSEC Security Weblog

Anonymous supporters voluntarily installed infected tool,leaking banking and email credentials

By Sven Olensky,on March 4th,2012%

Symantec reports that

[...] In the wake Anonymous member arrests this week,it is worth highlighting how Anonymous supporters have been deceived into installing Zeus botnet clients purportedly for the purpose of DoS attacks. The Zeus client does perform DoS attacks,but it doesn’t stop there. It also steals the users’online banking credentials,webmail credentials,and cookies.
[...] The deception of Anonymous supporters began on January 20,2012,the day of the FBI Megaupload raid. An attacker took a popular PasteBin guide,used by Anonymous members for downloading and using the DoS tool Slowloris,and modified it. In this modified version,the attacker changed the download link to a Trojanized version of the Slowloris tool with matching text
[...]
Not only will supporters be breaking the law by participating in DoS attacks on Anonymous hacktivism targets,but may also be at risk of having their online banking and email credentials stolen. The joining of malicious financial and identity fraud malware,Anonymous hacktivism objectives,and Anonymous supporter deception is a dangerous development for the online world.

Always be careful what you download. Think twice before participating in ‘campaigns’against ‘the Man’. You can’t trust anyone on the Internet.

As a business,you may be responsible for fraudulent charges,not your bank

By Sven Olensky,on June 9th,2011%

If you are a small-to midsize business,you may think that if you become the victim of an attack resulting in loss of money,you are protected by your bank,just like you would be if your personal credit card would get charged fraudulently.

Well,you may be wrong. You may be on the hook for the entire amount yourself.

DarkReading reports,

A recent ruling by a U.S. District Court of Maine magistrate in favor of a bank being sued by a construction company that had money stolen from its account by hackers highlights how vulnerable small to midsize business owners are to online fraud.
Unlike consumer bank accounts that come with fraud-reversal protection,businesses are left on the hook for fraudulent transfers —a fact that many remain ignorant about,but of which hackers are well-aware,say security experts.
“They don’t get the same kind of protection that an individual consumer gets,but they don’t get much more attention than an individual consumer [from banks],so they are very vulnerable from that standpoint,”says Terry Austin,CEO of Guardian Analytics. “And the criminals figured this out. A lot of the action a couple years ago was in retail banking,and we still see fraud there,but the big,really significant fraud attacks have been against the small-business community. There are hundreds of thousands of dollars,sometimes up to million-dollar attacks on these small businesses.”

This is very disconcerting. So what can you do?

You need to make sure that you are as secure as you can be.

The article continues,

But SMBs must also do their part to secure their machines. Often small-business owners assume that if they’re ever hit by bank-stealing malware,the bank will reverse charges because this is what they are conditioned to believe due to their retail banking experiences. But banks rarely extend the same fraud reversal for business accounts as they do for consumer accounts. So SMBs at the very least need to start with the most basic principles of installing security software,establishing strong passwords,and limiting access to banking credentials across the organizations. Many experts also believe that small businesses should consider buying a dedicated machine solely for online banking.
“One thing I recommend to every small business is to not bank from a computer you use for anything else,period. Just don’t do it,”says Chet Wisiniewski,senior security adviser at Sophos. “Don’t ever search the Web,don’t go to Google,don’t go to Facebook. Because of the Web risk,simply visiting an infected site puts you at risk. Do you really want to take that chance if you can buy the perfect banking netbook for $200? An alternative to that,too,is to use a live CD Linux distribution that’s not writable.”
Additionally,SMBs need to know to ask the right questions when they’re looking for a bank,Austin says.
“These small businesses don’t know how to ask their banks the right questions about their fraud policies,”Austin says,explaining that companies need to ask about what their liability is in the event of an attack,what kind of authentication the bank uses,how the bank monitors activity to look for anomalous behavior,whether the bank utilizes risk-detection technology with behavioral analytics,and what the processes are when fraud is detected.

Good advice.

Over 50 Android apps infected with Malware

By Sven Olensky,on March 6th,2011%

Last week,over 50 Android apps that were infected with malware were taken off the Android Market platform.

Outlets such as MSNBC reported,

[...] more than 50 apps in the official Android Market have been discovered containing malware that could have compromised sensitive and personal data. While Google has already yanked the apps from the Market,this first big infection highlights the inherent vulnerability of Android’s openness to developers.
[...]
Lookout,a smart phone security company that monitors apps on Android,Blackberry and Windows Mobile,posted a list of the infected apps on its blog. The company pegged the culprit as the DroidDream malware,which snuck into apps released under developers “Kingmall2010,”“we20090202,”and “Myournet.”
“DroidDream is packaged inside of seemingly legitimate applications posted to the Android Market in order to trick users into downloading it,a pattern we’ve seen in other instances of Android malware such as Geinimi and HongTouTou,”said Lookout CTO Kevin Mahaffey. “Unlike previous instances of malware in the wild that were only available in geographically targeted alternative app markets,DroidDream was available in the official Android Market,indicating a growing need for mainstream consumers to be aware of the apps they download and to actively protect their smart phones.”

Security tools like Lookout can catch and eliminate infected apps. See an article I posted about that application for more information.

Check + Fix Browser and Plug-in Vulnerabilities –Neat Tool by Qualys

By Sven Olensky,on February 17th,2011%

Qualys released a new tool,BrowserCheck,that tests your browser for vulnerabilities. It also checks any plugins you may have installed and tests if they are vulnerable and pose a risk to your infrastructure.

What items are detected by Qualys BrowserCheck?
The Qualys BrowserCheck tool checks your browser as well as browser plugins and add-ons to identify insecure and out-of-date versions that put you at risk. It also checks if your Windows operating system is supported by Microsoft. Microsoft security updates cannot be installed on unsupported operating system versions. These items are detected:
Windows Mac Linux
OS support expiration
(IE,Firefox,Chrome) X
Web Browser used to scan X X X
Adobe Flash Player X X X
Adobe Reader 5.x and above X X X
Adobe Shockwave Player X X
Apple Quicktime X X
BEA JRockit X X X
DivX Web Player X X
Foxit Reader
(IE,Firefox,Chrome) X
Flip4Mac Windows Media plugin X
Microsoft Silverlight X X
Microsoft Windows Media Player
(IE,Firefox,Chrome) X
Novell Moonlight X
Real Player X
Java Runtime X X X
Totem Media Player X
VLC Media Player X X X
Yahoo! BrowserPlus X X
Windows Presentation Foundation plug-in
(Firefox,Chrome) X

If you see any issues,follow the ‘Fix it’links and update your applications.

Kudos to Qualys,very neat.

Check your Stuff Here.

BBC Sites Injected with Malware –You wouldn’t realize you were infected –How to Secure Your PC

By Sven Olensky,on February 17th,2011%

Several sites,one of them Darkreading,reported yesterday that some BBC-owned sites were injected with malware. You would not have to click anywhere to get infected,simply pulling up the site would be enough to get you in trouble.

As Darkreading reports,

Two websites operated by the BBC have been infected by iFrame attacks and could be serving up malware,according to researchers
The BBC-6 Music site and areas of the BBC 1Xtra radio station site are affected,according to a blog by researchers at Websense.
The injected iFrame occurs at the foot of the BBC 6 Music Web page,and loads code from a site in the .co.cc top-level domain,Websense says. The iFrame injected into the Radio 1Xtra Web page leads to the same malicious site.
“If an unprotected user browsed to the site,they would be faced with drive-by downloads,meaning that simply browsing to the page is enough to get infected with a malicious executable,”Websense says.
The payload is delivered to the end user only once,and the initial visit is being logged by the malware authors,Websense says. The code that is delivered to end users utilizes exploits delivered by the Phoenix exploit kit. Only about 20 percent of antivirus products would detect this file,the researchers say.
[...] “The drive-by on the BBC website takes advantage of an exploit against Adobe PDF reader;among other exploits it delivers a drive-by-download that infects users’machines and has them join the Bredolab botnet.”[...]

This shows:

You don’t have to open a ‘bad site’to get infected.
You need to keep your computers always patched up to the most current versions.
Patching Windows alone (through Windows Update) is NOT ENOUGH. You also need to make sure that any other applications on your machines are current as well,as third party vulnerabilities can also lead to a compromise of your infrastructure.

I wrote an article on things to consider in order to keep your computers as safe as possible. Feel free to read it here.

How your iPhone can be hacked in less than 6 minutes,with free tools

By Sven Olensky,on February 10th,2011%

Researchers at the Fraunhofer Institute released a report yesterday describing on how hackers can access your lost iPhone,reveal certain passwords on it and they don’t need your passcode for it at all.

From their press release:

Passwords are not secure on iPhones that are lost. This is the result of tests carried out at Fraunhofer Institute SIT in Darmstadt. Within six minutes the institute’s staff was able to render the iPhone’s encryption void and decipher many passwords stored on it. If the iPhone is used for business purposes then the company’s network security may be at risk as well. The flawed security design affects all iPhone and iPad devices containing the latest firmware. Written documentation and a video about the attack are available below. Only companies prepared for such an attack will be able to reduce their risk.
[...]
Any device using the iOS operating system can be attacked in such a way,irrespective of the user’s password. As soon as attackers are in the possession of an iPhone or iPad and have removed the device’s SIM card,they can get a hold of e-mail passwords and access codes to corporate VPNs and WLANs as well. Control of an e-mail account allows the attacker to acquire even more additional passwords:For many web services such as social networks the attacker only has to request a password reset. Once the respective service returns the new password to the user’s e-mail account,the attacker has it as well.
Companies wanting to protect themselves against the consequences of such attacks should educate their staff accordingly and introduce appropriate emergency procedures. Not only should employees who have lost their iPhone change all their passwords,the company should change the respective network identifications as quickly as possible as well. “

Apparently,one can reveal passwords from applications like Google Mail,MS Exchange (corporate email) accounts,LDAP accounts (corporate domain),voicemail,VPN group passwords,WiFi passwords and some App passwords.

The video demonstrating the attack can be freely accessed on Youtube.

This is VERY disconcerting,considering how smartphones are spreading,even in the workplace.

Malware coming to your Android –it can be forced to join botnets

By Sven Olensky,on January 3rd,2011%

Researchers found that newer malware for Android (Google) phones have embedded remote control abilities:they can be ordered to connect to a centrally controlled botnet infrastructure from remote.

From the article (original post by the people at Lookout Mobile Security):

A new,more sophisticated Trojan for Android devices has been spotting lurking on third-party Chinese Android app markets –the first ever piece of Android malware that has the capability to receive instructions from a remote server and thus become part of a botnet.
Dubbed “Geinimi”,the Trojan is attached to (obviously compromised) versions of legitimate applications –mostly games such as Monkey Jump 2,Sex Positions,President vs. Aliens,City Defense and Baseball Superstars 2010.
So far,it has only been spotted being distributed through third-party Chinese app stores. Versions of these applications on the official Google Android Market have not been compromised.
When the affected application is installed on the device,it requires the user to give more permissions that it would usually need. Geinimi them kicks into action,harvests the device’s location coordinates,the IMEI and IMSI (unique identifiers for the device and the SIM card),and transmits that information to a remote server via a number of hard-coded domain names.
[...]
But users in general should suspect their devices of being infected by mobile malware if the phone presents unusual behavior such as automatic SMS sending to unknown recipients,automatic phone calls,stealthy installation of unknown applications,etc.
An occasional check of outbound calls and SMSs and of installed applications should become a habit for users.

Good advise. In addition to that I would recommend:

do not install applications that are not important. Installing apps just to try them out carries the inherent risk of exposure
do not install apps from untrusted sources. However,even apps that are downloadable from known sources can be infected as well.

Over Two Million US PCs Are Part of Botnets

By Sven Olensky,on November 21st,2010%

A Microsoft report reveals that in the first part of 2010,more than 2.2 million PCs in the USA were recruited to be members of botnets,against their will.

Read the full report here,a summary can be found on BBC news.

More than 2.2 million US PCs were found to be part of botnets,networks of hijacked home computers,in the first six months of 2010,it said.
“Most people have this idea of a virus and how it used to announce itself,”[...] “Few people know about botnets.”
[...]
Hi-tech criminals use botnets to send out spam,phishing e-mails and launch attacks on websites. Owners of botnets also scour infected machines for information that can be sold on the underground auction sites and markets found online.
Botnets start when a virus infects a computer,either through spam or an infected web page. The virus puts the Windows machine under the control of a botnet herder.
[...]

That is a large number. Pretty scary. And it is fairly easy to make sure that your PC is not part of one,but do you keep it secure?

The GANSEC Security Weblog

Anonymous supporters voluntarily installed infected tool,leaking banking and email credentials

Over 50 Android apps infected with Malware

Check + Fix Browser and Plug-in Vulnerabilities –Neat Tool by Qualys

What items are detected by Qualys BrowserCheck?

BBC Sites Injected with Malware –You wouldn’t realize you were infected –How to Secure Your PC

How your iPhone can be hacked in less than 6 minutes,with free tools

Malware coming to your Android –it can be forced to join botnets

Over Two Million US PCs Are Part of Botnets

DarkReading

Blog Archive

SANS News

Recent Posts

Post Overview