to a Persistent Threat Jagadeesh Chandraiah DeepSec 2011 Agenda - - PowerPoint PPT Presentation

▶
to a persistent threat
SMART_READER_LITE
LIVE PREVIEW

to a Persistent Threat Jagadeesh Chandraiah DeepSec 2011 Agenda - - PowerPoint PPT Presentation

May 24, 2023 266 likes •799 views

Fake Antivirus- Journey from Trojan to a Persistent Threat Jagadeesh Chandraiah DeepSec 2011 Agenda FakeAV Trends Infection Vectors Packer Evolution How do they work ? DeepSec 2011 Introduction Fake AntiVirus (FakeAV) is a

slide-1
SLIDE 1

Fake Antivirus- Journey from Trojan to a Persistent Threat

DeepSec 2011

Jagadeesh Chandraiah

slide-2
SLIDE 2

DeepSec 2011

Agenda

  • FakeAV Trends
  • Infection Vectors
  • Packer Evolution
  • How do they work ?
slide-3
SLIDE 3

DeepSec 2011

Introduction

Fake AntiVirus (FakeAV) is a malware which displays fake warnings to the users to trick them to buy illegitimate software.

slide-4
SLIDE 4

DeepSec 2011

Introduction

slide-5
SLIDE 5

FakeAV Trends

DeepSec 2011 Analyse the major events over the last three and half years.

slide-6
SLIDE 6

DeepSec 2011

  • Dramatic Rise of FakeAV in 2009
  • Black Hat SEO was heavily used.
  • Popular websites were used to serve FakeAV.
  • ex: New York Times news paper Website in 2009.
  • Government Embassy website Attacks.
  • Social Networking Sites were used (Facebook and Twitter).

FakeAV Trends

slide-7
SLIDE 7

DeepSec 2011

  • More Spam redirects to FakeAV.
  • More unpatched PDF and Java Vulnerabilities were used to deliver

FakeAV.

  • Black Hat SEO on hot topics, still remained the popular infection

method.

FakeAV Trends

2010 continued to see the spike in FakeAV detections.

slide-8
SLIDE 8

DeepSec 2011

  • Mac users were infected with Mac Defender in big scale around May

2011.

FakeAV Trends

Significant events in 2011.

slide-9
SLIDE 9

DeepSec 2011

  • Sharp Decline in FakeAV detections, due to law enforcement actions in

Aug 2011.

Sharp Decline

Significant events in 2011.

slide-10
SLIDE 10

Sharp Decline

DeepSec 2011

  • ChronoPay’s server were compromised and details were reported
  • nline.
  • Several FakeAV programs had credit card processing issues.
slide-11
SLIDE 11

FakeAV is down, but still active

DeepSec 2011 Sophos Top Five FakeAV Detection rate between Mar-Oct 2011.

slide-12
SLIDE 12

FakeAV is down, but still active

DeepSec 2011 FakeAV infection between 1st Quarter of 2010 and 2nd Quarter of 2011, according to Microsoft Security Intelligence Report.

slide-13
SLIDE 13

Infection Methods

DeepSec 2011 We will analyse popular Infection methods and how they work.

slide-14
SLIDE 14

Black Hat SEO

DeepSec 2011 Poisoning search engine optimization.

  • Illegitimate way of increasing search engine ranking.
slide-15
SLIDE 15

Black Hat SEO

Pictorial Representation of Black Hat SEO attack DeepSec 2011

slide-16
SLIDE 16

Black Hat SEO

DeepSec 2011

  • Step1: Identify and compromise legitimate websites.
  • Step2: Upload multifunctional PHP script to the compromised

website.

  • Step3: Feed crawlers with specially stuffed webpage with keywords.
  • Step4: Redirect users coming through search engine to FakeAV

website.

slide-17
SLIDE 17

Malvertising

DeepSec 2011 Serving FakeAV through Advertising networks.

slide-18
SLIDE 18

Malvertising

JavaScript used in New York Times newspaper website. DeepSec 2011

slide-19
SLIDE 19

Cold Calling

DeepSec 2011 Fake tech support centre’s are used to scam users.

slide-20
SLIDE 20

Spam Campaigns

DeepSec 2011 FakeAV served through email attachments and drive by download links.

slide-21
SLIDE 21

DeepSec 2011

Spam Campaigns

slide-22
SLIDE 22

DeepSec 2011

Fake Codecs

Users are social engineered to download FakeAV as Codecs.

slide-23
SLIDE 23

Exploit Kit

DeepSec 2011 Use Blackhole Exploit kit as an example to see how exploit kit works.

slide-24
SLIDE 24

Exploit Kit

Black Hole Exploit Kit panel showing Infections by country and vulnerabilities.

slide-25
SLIDE 25

Exploit kit

Blacklisting mechanism used by Black Hole. DeepSec 2011

slide-26
SLIDE 26

Exploit Kit

Infection mechanism using Exploit kit. DeepSec 2011

slide-27
SLIDE 27

Exploit Kit

Obfuscated Black Hole Exploit Script DeepSec 2011

slide-28
SLIDE 28

Decrypted Exploit script checking version and creating Iframe element. DeepSec 2011

Exploit Kit

slide-29
SLIDE 29

Packer Evolution

DeepSec 2011

  • Anti Emulation API
  • Process Environment Block
  • Thread Information Block
  • Kuser Shared Data
slide-30
SLIDE 30

FakeAV without packed layer DeepSec 2011

Packer Evolution

slide-31
SLIDE 31

Anti Emulation

DeepSec 2011

  • Emulator is a piece of Software used to simulate the behaviour of a

system.

  • Windows X86 emulator is used to simulate the behaviour of X86

processor.

  • Malware authors use tricks to break emulation.
slide-32
SLIDE 32

Anti Emulation API

DeepSec 2011

slide-33
SLIDE 33

Anti Emulation API

DeepSec 2011

slide-34
SLIDE 34

FS:30

DeepSec 2011 Process Environment Block

slide-35
SLIDE 35

FS:18

DeepSec 2011 Thread Information Block

slide-36
SLIDE 36

KUSER_SHARED_DATA

  • Usually mapped at 0x7FFE0000
  • Checking the presence of value at 0x7FFE0004 (TickCountMultiplier).
  • Values at this structure are also known to be used in obfuscated calls

and decryption strings.

DeepSec 2011

slide-37
SLIDE 37

Understand Packing using a Polymorphic Cryptor. DeepSec 2011

How is this Done ?

slide-38
SLIDE 38

Click icon to add table

Packer Evolution

Cryptors available in underground forums. DeepSec 2011

slide-39
SLIDE 39

Packer Evolution

Crum Polymorphic Cryptor DeepSec 2011

slide-40
SLIDE 40

Packer Evolution.

Crum Polymorphic Cryptor with different icons. DeepSec 2011

slide-41
SLIDE 41

Packer Evolution

DeepSec 2011 Testing Crum Polymorphic Cryptor

slide-42
SLIDE 42

Packer Evolution

DeepSec 2011 Testing Crum Polymorphic Cryptor

slide-43
SLIDE 43

Packer Evolution

DeepSec 2011 Anti Emulation stuff inserted by Crum Polymorphic Cryptor

slide-44
SLIDE 44

What Drives FakeAV ?

DeepSec 2011

slide-45
SLIDE 45

What Drives FakeAV ?

DeepSec 2011

slide-46
SLIDE 46

What Drives FakeAV ?

DeepSec 2011

slide-47
SLIDE 47

What Drives FakeAV ?

DeepSec 2011

  • FakeAV developers use affiliate networks to distribute and advertise

FakeAV.

  • Affiliates in turn recruit meta affiliates to distribute FakeAV links and

binaries.

  • Money is paid in Pay per Install scheme, for driving traffic to FakeAV

Landing Pages and FakeAV purchases.

  • University of California research study reveals that FakeAV business

earned more than 130 million dollars.

slide-48
SLIDE 48

AV vs FakeAV

DeepSec 2011

slide-49
SLIDE 49

Conclusion

DeepSec 2011

  • FakeAV is still one of the big threats actively infecting users.
  • Better understanding of operations used.
  • Able to study the different tricks used by FakeAV code.
  • Use this knowledge to better protect users from FakeAV Infection.
slide-50
SLIDE 50

Acknowledgements

DeepSec 2011

slide-51
SLIDE 51

DeepSec 2011