Crimeware on the Net The Behind the scenes of the new web economy - PowerPoint PPT Presentation

Crimeware on the Net The “Behind the scenes” of the new web economy Iftach Ian Amit Director, Security Research – Finjan BlackHat Europe, Amsterdam 2008

Who Am I ? (iamit) • Iftach Ian Amit – In Hebrew it makes more sense… • Director Security Research @ Finjan • Various security consulting/integration gigs in the past – R&D – IT • A helping hand when needed… (IAF) 2 BlackHat Europe – Amsterdam 2008

Today’s Agenda • Terminology • Past vs. Present – 10,000 feet view • Business Impact • Key Characteristics – what does it look like? – Anti-Forensics techniques – Propagation methods • What is the motive (what are they looking for)? • Tying it all up – what does it look like when successful (video). • Anything in it for us to learn from? – Looking forward on extrusion testing methodologies 3 BlackHat Europe – Amsterdam 2008

Some Terminology • Crimeware – what we refer to most malware these days is actually crimeware – malware with specific goals for making $$$ for the attackers. • Attackers – not to be confused with malicious code writers, security researchers, hackers, crackers, etc… These guys are the Gordon Gecko‟s of the web security field. The buy low, and capitalize on the investment. • Smart (often mislead) guys write the crimeware and get paid to do so. 4 BlackHat Europe – Amsterdam 2008

How Do Cybercriminals Steal Business Data? Criminals’ activity in the cyberspace Federal Prosecutor: “Cybercrime Is Funding Organized Crime” 5 BlackHat Europe – Amsterdam 2008

The Business Impact Of Crimeware Criminals target sensitive business data using crimeware • Gain access to employee financial Employee information • Steal Identity information Data • Discover passwords Sophisticated • Steal financial statements Financial and Organized • Steal money through online accounts • Steal proprietary data Data Criminals • Gain customer record information • Brand damage • Access customer accounts Customer • Steal customer identities • Financial theft • Impair customer relationships Data • Data theft • Password theft • Identity theft • Compromised computers to steal resources • Employee productivity loss Federal Prosecutor: “Cybercrime Is Funding Organized Crime” 6 BlackHat Europe – Amsterdam 2008

The Business Impact Of Crimeware How much is business data worth to criminals? BlackHat Europe – Amsterdam 2008

Key Characteristics of Crimeware Financially motivated criminals are utilizing new methods to infect PCs with crimeware that steals sensitive data Propagation Methods Anti-Forensic Methods Hosted on compromised legitimate and Evade signature-based detection by Web 2.0 sites over the globe utilizing code obfuscation and controlled with frequent location changes exploits visibility in the wild URL and Reputation-based Anti-Virus signatures will not match today‟s malicious code filtering solutions will not block these sites 8 BlackHat Europe – Amsterdam 2008

Anti Forensics • Code Obfuscation – Not the one you are used to… • Single serve exploits – One per customer please • Geographical preference – More on this later when we talk $$$… 9 BlackHat Europe – Amsterdam 2008

Dynamic Code Obfuscation 10 BlackHat Europe – Amsterdam 2008

Dyn. Code Obf. – the neosploit way (2.0.15) BlackHat Europe – Amsterdam 2008

Obfuscation and IFRAMES • Have become in 2007 the main driving tools for distributing malware and malicious code in general. – They are even signatured by AV – while as we see the obfuscation or IFRAME itself may NOT be malicious… Source: top 10 web threats in 2007 http://www.sophos.com/pressoffice/news/articles/2008/01/toptendec07.html 12 BlackHat Europe – Amsterdam 2008

Crimeware Profile Google Inc. - The Ghost In The Browser Analysis of Web-based Malware Crimeware binaries and their URL locations are changing every hour 13 BlackHat Europe – Amsterdam 2008

Location, Location, Location index.php • Have you been to our fine //checks and saves user's IP hashed with browser //to avoid future browser's hangup establishment before? function CheckAddUser() { … – You can only get the $rcount=@mysql_num_rows($res); “good” stuff once… if ($rcount>0) { //found data, prevent view echo ":["; exit; } else { //not found, add $query = "INSERT INTO ".$dbstats."_users VALUES ('".$ipua."')"; mysql_query($query); • Where do you come } from? settings.php: $BlockDuplicates=1; //send exploits only once – You may not be worth $CountReferers=1; //make referrer's statistics $OnlyDefiniedCoutries=0; //send exploits only to the exposure… counties in the list $CoutryList="RU US UA"; //2-letter codes ONLY! (see readme for details) Source: Mpack 0.94 source code 14 BlackHat Europe – Amsterdam 2008

Crimeware Toolkits 15 BlackHat Europe – Amsterdam 2008

A glimpse into the code License_load: License_Verification: ... push edi push ebp push offset aNeosploit_key mov ebp, esp • lea eax, [ebp+string] Modern toolkits are push edi push eax push esi lea eax, [ebp+var_188] push ebx provided in their binary push eax sub esp, 38h call license_load mov ebx, [ebp+arg_0] form, with licensing add esp, 10h mov edi, [ebp+arg_8] test eax, eax push offset aServer_addr jz loc_8049918 call _getenv mechanisms, built in add esp, 0Ch mov [ebp+var_1C], eax obfuscation, configuration ... push 100h ; size_t call form_parse push 0 ; int lea edi, [ebp+var_38] push ebx ; void * files, user management xor eax, eax call _memset cld mov ecx, [ebp+var_1C] (for supporting multiple mov ecx, 7 add esp, 10h rep stosd xor edx, edx mov [esp+4E8h+var_4E8], 0 test ecx, ecx attackers under the same call _GeoIP_new jz short loc_804CC25 add esp, 10h kit), and DB functionality. test eax, eax mov ebx, eax online_test: ... • mov [ebp+var_20], 1 The snippets here are sub esp, 8 push edx push [ebp+timer] push 0 ; int push eax taken from a disassembly push ebx ; void * call _GeoIP_country_id_by_addr push [ebp+arg_4] ; int add esp, 10h call connect_to_homeserver of Neosploit version 2.0.15 cmp eax, 0FFh add esp, 10h jle loc_8049933 test eax, eax (first time analysis – in.cgi) jz short loc_804CDDE BlackHat Europe – Amsterdam 2008

Neosploit code ... call js_crypter_put mov [esp+4E8h+var_4E8], offset aStartquicktime call add_function push offset exp_superbuddy_is_decoded push 0D90FC7h loc_8049BE8: push 0CAh sub esp, 0Ch push offset exp_superbuddy sub esp, 8 push [ebp+timer] call decode_data push [ebp+var_7C] ; char * add esp, 18h call get_ip_hash push [ebp+var_54] ; int push 0 add esp, 10h push offset exp_superbuddy call referer_validate cmp eax, [ebp+var_468] call js_crypter_put add esp, 10h mov [esp+4E8h+var_4E8], offset aStartsuperbudd jnz loc_8049ABE test eax, eax call add_function push offset exp_audiofile_is_decoded jnz short loc_8049C07 push 0A1E716h push 145h push offset exp_audiofile call decode_data add esp, 18h push [ebp+var_84] push 0 push offset exp_audiofile push [ebp+var_2C] call js_crypter_put push offset a?o6PURU mov [esp+4E8h+var_4E8], offset aStartaudiofile lea ebx, [ebp+var_338] call add_function push ebx push offset exp_gom_is_decoded call _sprintf push 1F040Ah add esp, 0Ch push 0D9h push offset exp_gom push ebx call decode_data push offset aData add esp, 18h push offset exp_quicktime_opera push 0 push offset exp_gom call js_crypter_put mov [esp+4E8h+var_4E8], offset aStartgom sub esp, 8 call add_function push 0 push offset exp_wvf_is_decoded push [ebp+var_4AC] push 84C0B8h push 10Dh call js_crypter_put push offset exp_wvf mov eax, [ebp+var_4AC] call decode_data add esp, 18h add esp, 10h push 0 test eax, eax push offset exp_wvf call js_crypter_put mov [esp+4E8h+var_4E8], offset aStartwvf ... BlackHat Europe – Amsterdam 2008

Propagation techniques • How did THAT code turned out on THAT site – Anyone remember bankofindia.com? • Helpful HTML tags (infamous iframes…) • And of course, bling… $$$ 18 BlackHat Europe – Amsterdam 2008

On My Site? No way! 19 BlackHat Europe – Amsterdam 2008

Way… It’s all business • You can get paid to put a snippet of HTML on your site that will spur “installations” (= infections). Guaranteed high “install” rate, updated code (remember the toolkit), bypass of security measures… • “ The number of legitimate Web sites compromised by attackers has surpassed those purposefully created by attackers ” – Jan 22 nd , Websense security labs. 20 BlackHat Europe – Amsterdam 2008

Evasive attacks – increasing the infection rates 21 BlackHat Europe – Amsterdam 2008

What’s the end game? • Holy grail of web attacks: successful installation of crimeware Trojan (aka – rootkit+keylogger+otherstuff) 22 BlackHat Europe – Amsterdam 2008