The answer to your question is Yes. There was code that used Dcom and ran it on Elevated privileges ..so it was not necessary to be running as admin.

In a second incident investigated – The malicious code executed on simply right clicking the exe file. It is so common for admins to right click a file and try to look at the properties to see if its signed etc before taking the next step …

@nart

You mention Hydraq as the possible malware currently used , in the incidents i investigated it appeared to be Hupigon . Would you have any means to know if hydraq and hupigon share similar code ?

Also the registry entry created had obfuscated the path to the executable to avoid detection from tools

It never appeared that there was a specific information they were targeting – it always appeared as a grab all that you can get! .. This makes one issue clear that the front line attacker is pulling files out and someone else in the back is sifting thru it for further use

Thanks for your reply. Its certainly a very interesting topic to discuss, so thanks for your time.

You note an interesting point: “The local user had local admin priv”. Sure the local user was tricked by the malicious email, and sure the malicious code is very sophisticated, but is the core problem simply that the user is running as admin? Or to put it another way, if the victim was not running as admin, could the malware have achieved anything more significant than toasting the user’s account and associated data?

I don’t mean to labor this point; I’m just trying to understand what advice I can give people which is both realistic and satisfactory.

Thanks again,
Tim.

silly, all states engage in espionage to some degree or another. It isn’t necessarily an activity ordered by the leader of that state. See Enercon for example and someone at the NSA passing their tech to a US firm via super-secret spy satellites. Not to get political, but… the “what is yours, is ours” is an attitude that many people would identify much more strongly as being expressed by the US, not by China.

You do raise an important issue of over simplification but on the contrary the points you listed are very easy to get past, in fact they hardly play a role in a windows pc. Do read on as you may find this interesting. I have personally been involved in one such investigation more than a year ago.

The trojan arrived by a socially engineered email
The exe name of the file was wupdmgr – antiviruses have an exclusion or exceptions defined on this file name – first weakness
The local user had local admin priv – most common with home users and small to mid companies who do not have a large it budget
Upon execution of wupdmgr – it created firewall exceptions and registered it self as a service – the communication back to command center had already started
If u see the services list nothing looks out of the ordinary – this service was called Internet Connection Manager – under normal circumstances there is no such service – even a good eye may not catch it
The level of sophistication was just unbelievable – they directly elevated dcom privileges and ran
Interestingly once the backdoor was in place – more sophisticated tools arrived to the pc – one such tool took the lm hash of the domain admin – used the hash and injected directly to spwan a cmd shell – they could then map c$ d$ on servers

If you look at the overall scenario – it simply preys on the fact that the pc is never ever secure and will never be given the kind of IT budgets these end users have or the small orgs that nat is referring to – it also shows how blind sided Msoft is as well

@nat great article and yeomen work

Also, if you read McAfee’s assessment of the new IE 0day you can see how bad it can be — fully up-to-date OS/IE and no AV detection. That’s pretty bad, if you click the link an attacker sends you’re gonna get whacked. That’s why I was emphasizing the part about tricking the user, that’s the most important part.

Great blog!

One quick question on the quote from Mikko:

> If the user open that attachment with a vulnerable version
> of Adobe Reader or Microsoft Office their computer
> will be compromised.

Is that not oversimplifying the situation. For the computer to be compromised, don’t a couple of other requirements also need to be met including:

1) Running with privileges that allow the malware to open ports, modify OS settings, etc.

2) Have no outgoing firewall protection, so that the malware can open its backdoor ports.

3) In the Acroread case, have Javascript enabled; I’m not sure what the scripting requirements are for IE.

Could I ask your opinion please?

Thanks,
Tim.