A TOOL TO LINK THE MALICIOUS WEB Agenda Introduction Fireshark - - PowerPoint PPT Presentation

▶
a tool to link the
SMART_READER_LITE
LIVE PREVIEW

A TOOL TO LINK THE MALICIOUS WEB Agenda Introduction Fireshark - - PowerPoint PPT Presentation

Nov 24, 2022 488 likes •1.49k views

Stephan Chenette Principal Security Researcher Websense Labs FIRESHARK A TOOL TO LINK THE MALICIOUS WEB Agenda Introduction Fireshark Details Web Communities Malicious Web Communities Mass Injection Analysis Redirection

slide-1
SLIDE 1

FIRESHARK A TOOL TO LINK THE MALICIOUS WEB

Stephan Chenette Principal Security Researcher Websense Labs

slide-2
SLIDE 2

Agenda

  • Introduction
  • Fireshark Details
  • Web Communities
  • Malicious Web Communities

 Mass Injection Analysis  Redirection Chaining  DeobfuscationAnalysis  Content Profiling

  • Conclusion

2

slide-3
SLIDE 3

Why you should care

URL Injection attacks are increasing

225% increase in the number of new compromised legitimate websites in the last 12 months Source: Websense Security Labs, State of Internet Security, Q3-Q4 2009 Report

3

slide-4
SLIDE 4

Why you should care

  • The deobfuscation tools are NOT sufficient
  • Emulators are meant for products not

researchers

  • Mass Injection attacks are hard to correlate

e.g. nine-ball, beladen (~40k compromises)

  • A need exist that satisfied both the high level

view of an attack + low level content profiling

  • Fireshark.

4

slide-5
SLIDE 5

Connecting the dots

Mass Injections examples

  • Gumblar ~60,000 compromises
  • Beladen ~40,000 compromises
  • Nine-ball ~20,000 compromises

5

slide-6
SLIDE 6

Public Tools Available today

Websites:

  • Wepawet
  • Anubis
  • ZeusTracker
  • BLADE (*new*)
  • Robtex
  • Unmask Parasites
  • Malwaredomainlist.com
  • Badwarebusters.org
  • VirusTotal.com

Tools:

  • Malzilla
  • Rhino Debugger
  • FF JavaScript Deobfuscator
  • DS’s SpiderMonkey
  • Jsunpack
  • Caffeine Monkey
  • NJS

6

slide-7
SLIDE 7

Malzilla vs the Pheonix Exploit Kit

7

slide-8
SLIDE 8

JSUNPACK VS. Phoenix

8

slide-9
SLIDE 9

Spidermonkey/ CaffeineMonkey

  • Lacks DOM features + Only a JavaScript

engine

9

slide-10
SLIDE 10

Obfuscated Content

  • Iframe/script injection (compromised pages)
  • Crimepack exploit kit
  • Eleonore exploit kit
  • Phoenix exploit kit
  • YES exploit kit
  • SEO sploit pack
  • Fragus exploit kit
  • Neosploit kit
  • More…

10

slide-11
SLIDE 11

Crimepack 2.8 (released before Easter)

Exploits include:

 Adobe Acrobat Reader Exploits (including CVE-2010-0188) (ALL)  JRE (GSB & SERIALIZE) (ALL)  MDAC (IE)  MS09-032 (IE)  MS09-002 (IE)  CVE-2010-0806 (IE)

11

slide-12
SLIDE 12

Crimepack 2.8 Anti-Analysis

Features include:

  • 1. Undetected from AV Scanners (JavaScript &

PDF/JAR/JPG files)

  • 2. Random PDF Obfuscation (Not using static pdf file like
  • ther packs)
  • 3. Blacklist checker & AutoChecker
  • 4. Prevent Wepawet, Jsunpack and other JavaScript

unpackers to decode your page

12

slide-13
SLIDE 13

Crimepack 2.8 Changes

  • Added CVE-2010-0806
  • Added CVE-2010-0188
  • Added more ip's to block
  • IFrame generator
  • Redirector for non-vulnerable traffic
  • New JS cryptor
  • Anti-Kaspersky emulation

13

slide-14
SLIDE 14

Problems with emulation DOM Always behind

  • document.body is undefined
  • document.title is undefined
  • document.forms is undefined
  • document.documentElement is undefined
  • document.URL is undefined
  • document.getElementsByTagName is not

a function

14

slide-15
SLIDE 15

Problems with emulation DOM Always behind

  • window.location.search
  • window.addEvent is not a function
  • window.onDomReady is not a function
  • window.parent is undefined
  • window.screen is undefined
  • window.top is undefined
  • screen is not defined
  • top is not defined
  • parent is not defined
  • self is not defined
  • location.protocol

15

slide-16
SLIDE 16

Problems with emulation External scripts

  • jQuery is not defined
  • urchinTracker is not defined
  • SWFObject is not defined

16

slide-17
SLIDE 17

What about crawlers??

  • Wget
  • Curl
  • Selenium
  • Use a web proxy like fiddler
  • Redirection Chains? Sort of.
  • Content Profiling? Not really.

17

slide-18
SLIDE 18

You dare doubt me?? Me!!!?? =]

18

slide-19
SLIDE 19

FireShark Introduction

  • Firefox plugin
  • Accepts commands to crawl compromised

websites

  • Stores events and data sets.
  • Post-data analysis correlates data
  • End result = better understanding of URL

injection attacks

19

slide-20
SLIDE 20

Send URLs to FireShark

20

Malicious URL Feed

slide-21
SLIDE 21

FireShark Architect (Two Modes)

  • Network Mode

 Used in an automated manor  Alert/Auto-Categorize

  • Single-user mode

 Manual Inspection  Injection Research

21

slide-22
SLIDE 22

Single-User Mode Demo

22

slide-23
SLIDE 23

Local FireShark Demo

23

slide-24
SLIDE 24

Now Parse the Log file

  • Fireshark Log
  • What comes next

is up to you… A few scripts provided e.g:

  • Graphmaker.pl
  • InOut.pl

24

slide-25
SLIDE 25

Post-Run Analysis

  • Log is analyzed manually or automatically via

post-analysis correlation process

25

slide-26
SLIDE 26

Monitoring communities

26

slide-27
SLIDE 27

Monitoring communities

27

slide-28
SLIDE 28

Mass Injection Attack

  • Example of a Injection attack community

28

slide-29
SLIDE 29

The Importance of Data correlation

29

slide-30
SLIDE 30

The Importance of Data correlation

30

slide-31
SLIDE 31

31

slide-32
SLIDE 32

“Web Communities”

32

slide-33
SLIDE 33

Top 25 Global Alexa List (mid-Feb 2010)

google.com facebook.com youtube.com yahoo.com live.com wikipedia.org blogger.com baidu.com msn.com qq.com yahoo.co.jp twitter.com google.co.in google.cn sina.com.cn myspace.com google.de wordpress.com microsoft.com amazon.com taobao.com google.co.uk bing.com ebay.com google.fr

33

slide-34
SLIDE 34

Visiting youtube.com

34

  • This is all the content your browser is feed when

visiting youtube.com

slide-35
SLIDE 35

35

slide-36
SLIDE 36

36

slide-37
SLIDE 37

37

slide-38
SLIDE 38

38

slide-39
SLIDE 39

39

slide-40
SLIDE 40

40

slide-41
SLIDE 41

41

slide-42
SLIDE 42

42

slide-43
SLIDE 43

43

slide-44
SLIDE 44

Major Ad Networks

  • Doubleclick (Google)
  • Yield Manager (Yahoo)
  • Fastclick (ValueClick)

44

slide-45
SLIDE 45

Top 100 Global Alexa List (mid-Feb 2010)

45

slide-46
SLIDE 46

Top 100 Global Alexa List (mid-Feb 2010)

46

slide-47
SLIDE 47

Victims of “Malvertisements” (2009)

  • The Drudge Report
  • Horoscope.com
  • Lyrics.com
  • slacker.com
  • Eweek.com
  • The New York Times
  • Philadelphia Inquirer
  • Expedia, Rhapsody

47

slide-48
SLIDE 48

Horoscope.com Economy

48

slide-49
SLIDE 49

“Malicious Web Communities”

49

slide-50
SLIDE 50

Down the Rabbit hole

  • Analysis of Three exemplary Injection

campaigns

  • Injection campaigns occur daily
  • A breadth view analysis helps us gain a better

understanding of the malicious webscape

50

slide-51
SLIDE 51

Down the Rabbit hole

51

Injection Example #1

slide-52
SLIDE 52

Injection Example #1

  • (Nov/Dec 2009)
  • 13k matches/24hrs

52

slide-53
SLIDE 53

Injection Example #1

  • (Nov/Dec 2009)
  • 13k matches/24hrs

53

slide-54
SLIDE 54

Injection Example #1

  • Step 1) Analyze a subset (500/13k)
  • Breadth

 Popular campaign will emerge

 Injections into unique websites will lead to same hosts

  • Depth

 Details of the attack

 Screen Shots  Source code, Deobfuscted DOM, Network traffic

54

slide-55
SLIDE 55

Bird’s Eye View of 500 Compromised Websites

55

slide-56
SLIDE 56

Breadth – Popularity of Request connection

56

slide-57
SLIDE 57

Breadth – Popularity of Request connection

57

slide-58
SLIDE 58

Breadth – Popularity of Request connection

58

slide-59
SLIDE 59

Down the Rabbit hole

59

Injection Campaign #1: 93.186.127.49

slide-60
SLIDE 60

“W93.186” Injection Campaign

60

slide-61
SLIDE 61

“W93.186” Injection Campaign

61

slide-62
SLIDE 62

“W93.186” Injection Campaign Screen Shot

62

slide-63
SLIDE 63

Observations from 93.186.127.49 attack

63

Operation b49

slide-64
SLIDE 64

Rascop.com…a familiar foe?

64

slide-65
SLIDE 65

65

slide-66
SLIDE 66

Infamous Rascop.com

66

rascop.com = NXD (feb 10’) Waledac Fast-flux domain

slide-67
SLIDE 67

Rascop.com and friends say goodbye but landing pages here to stay

  • Waladec domains were NXD in the takedown
  • Landing pages were still online though

67

slide-68
SLIDE 68

Injection Example #2

68

Attack #2: ru:8080

slide-69
SLIDE 69

Breadth – Popularity of Request connection

69

slide-70
SLIDE 70

Breadth – Popularity of Request connection

  • 250/5k URLs lead to homesalesplus.ru

70

slide-71
SLIDE 71

Polymorphic Injected Code Variation #1

71

slide-72
SLIDE 72

Polymorphic Injected Code Variation #2

72

slide-73
SLIDE 73

Polymorphic Injected Code Variation #3

73

slide-74
SLIDE 74

Depth – Diff DOM/SRC

74

slide-75
SLIDE 75

Depth – Script link in DOM

75

slide-76
SLIDE 76

Polymorphic Injected Code Variation #3

76

slide-77
SLIDE 77

DOM View

  • DOM ==> Mutable Memory representation

(Final View of DOM after JS/events)

77

slide-78
SLIDE 78

Log Analysis

  • Further Analysis showed variations:

1.

hxxp://clicksor-com.eastmoney.com.mobile- de.homesaleplus.ru:8080/ocn.ne.jp/ocn.ne.jp/class mates.com/linkhelper.cn/google.com/

2.

hxxp://chip-de.ggpht.com.deezer- com.viewhomesale .ru:8080/google.com/google.com/timeanddate.co m/avg.com/zshare.net/

78

slide-79
SLIDE 79

ru:8080 URL Injection Campaign

Similarities between infected sites:

  • Port 8080
  • Various changing .ru domains
  • Legitimate content on port 80 served by Apache
  • Malicious domains are mapped to 5 different IPs
  • Malicious IP addresses are on hosting providers

Leaseweb (Netherlands) and OVH.com (France)

  • Landing domains were NXD Dec 09’/Jan 10’

79

slide-80
SLIDE 80

The Never-ending story

  • Where one ends, another begins

80

slide-81
SLIDE 81

Observations from ru:8080 Injection attack

  • Compromised websites can and are updated

automatically

  • Compromised websites are injected with multiple

redirectors

  • Sharing of stolen FTP credentials

e.g. Many infected sites also led to Gumblar infected domains, indicating that attackers perhaps had shared stolen FTP credentials

81

slide-82
SLIDE 82

Injection Example #3

  • Mass Injection #3
  • ~5700 infected pages
  • ~5300 unique hosts

82

slide-83
SLIDE 83

Breadth – Popularity of Response connection

83

slide-84
SLIDE 84

Breadth – Popularity of Response connection

  • sportgun.pl.ua sends a response back to 50+ hosts

84

slide-85
SLIDE 85

85

slide-86
SLIDE 86

Connection Request/No Response

Src: hxxp://sportgun.pl.ua/st/go.php?sid=2& Dst: hxxp://uplevelgmno.vn.ua/111/sv777/index.php

86

slide-87
SLIDE 87

Round #2 Connection Request/Response

  • Success!

87

slide-88
SLIDE 88

Fetches Exploits

  • Fetches PDF and Java Exploits

88

  • connection:

type: response src: hxxp://uplevelgmno.vn.ua/111/sv777/pdf.php dst: hxxp://uplevelgmno.vn.ua/111/sv777/index.php status: 200

  • connection:

type: response src: hxxp://uplevelgmno.vn.ua/111/sv777/dev.s.AdgredY.class dst: hxxp://uplevelgmno.vn.ua/111/sv777/index.php status: 200

slide-89
SLIDE 89

PDF VirusTotal Results

89

slide-90
SLIDE 90

Eleonore Exploits Pack

hxxp://uplevelgmno.vn.ua/111/sv777/stat.php

90

slide-91
SLIDE 91

Obfuscated Chunk in Source Code

  • howtofindmyip.com obfuscation

91

slide-92
SLIDE 92

Deobfuscated DOM

  • howtofindmyip.com deobfuscated

92

slide-93
SLIDE 93

Exploit Kit

  • uplevelgmno.vn.ua

93

slide-94
SLIDE 94

Observations from Injection attack #3

  • The bad guys are tracking/hiding, redundancy redirectors

are common

  • Exploits that are being used are current e.g. all

platforms/browsers are targeted

  • Exploit kits are easily attainable, setup is quick
  • Many kits serve user polymorphic exploits/malware, thus

traditional AV signatures are always behind

94

slide-95
SLIDE 95

Fireshark vs Phoenix (works!)

95

slide-96
SLIDE 96

Conclusion

96

slide-97
SLIDE 97

Conclusions/Take-away

  • Compromised websites:

 Increase of 225% over the last 12 months  Frequently updated to contain fresh links  iframe/script tags & direct malicious code

injection

 Exploits target various OS/applications

  • Use Fireshark for:

 Mass Injection Analysis  Redirection Chaining  Content Profiling

97

slide-98
SLIDE 98

Download Fireshark – fireshark.org

98

slide-99
SLIDE 99

Questions?

Contact: Stephan Chenette, schenette@websense.com Addition thanks to:

  • Websense Security Labs team
  • Wladimir Palant (AdBlockPlus FireFox Plugin)

99