The Mask???????

      No Comments on The Mask???????

 

The Mask 1.png

最近のサイバースパイ活動は、その精巧さと専門性がたびたび明らかになっています。2 月 10 日に Kaspersky 社が報告した「The Mask（ザ・マスク）」と呼ばれるサイバースパイグループも例外ではありません。シマンテックが The Mask について調査したところ、このグループは 2007 年に活動を開始しており、きわめて高度なツールや技術を使って侵入先の標的を危殆化し、監視しながらデータを密かに引き出すことが判明しました。The Mask は非常に高度な悪用コードと巧妙に細工された電子メールを使って、無防備な犠牲者にワナを仕掛けます。The Mask のペイロードは、Windows、Linux、Macintosh など代表的なオペレーティングシステムすべてを対象にしています。

The Mask で興味深いのは、スペイン語圏を標的にしており、ツールもそれを意図して設計されているという点で、標的は主にヨーロッパや南米のユーザーのようです。

活動の息が長いこと、きわめて高度なツールを利用していること、そして的確に被害者を狙っていることから、これは熟練度も組織力も非常に高いグループであり、リソースも潤沢であることが伺えます。

標的の特定
The Mask は通常、高度な標的型電子メールで被害者に感染します。添付が確認されているのは、CV（履歴書）や政治的な内容を餌にした悪質な PDF 文書や Microsoft Word 文書です。添付ファイルに使われているファイル名の例を以下に挙げます。

  • Inspired By Iceland.doc
  • DanielGarciaSuarez_cv_es.pdf
  • cv-edward-horgan.pdf

添付ファイルを開くと、正規の文書に見える内容が表示されますが、実際には悪質なリモートアクセス型のトロイの木馬（RAT）もインストールされ、侵入を受けたコンピュータへの完全なアクセスを許してしまいます。侵入に成功すると、The Mask は追加のツールをインストールし、持続性を強化してサイバースパイ活動を続けられるようになります。

サイバースパイ – 専門的なツール類
The Mask は、自由に使える一連のツール類を所有しています。なかでも、このグループを典型的なサイバー犯罪とかけ隔てている特徴と言えるのが、Backdoor.WeevilB というツールです。これは、モジュール型の性質とプラグインアーキテクチャを備えた高度なサイバースパイツールであり、無数の設定オプションが用意されています。Duqu、Flamer、MiniDuke といった他の高度な攻撃活動を連想させますが、The Mask がそれらの活動と関連している証拠は見つかっていません。

デフォルトで、相互通信、ネットワーク盗聴、活動監視、データ抽出、ルートキット機能などに特化した 20 近いモジュールがインストールされます。

The Mask 2.png

図. The Mask のモジュールの一部

追加モジュールのダウンロードと即時のロードは、プラグインアーキテクチャによって実現されています。Backdoor.WeevilB は主要なブラウザのすべてにおける活動をログに記録し、膨大な拡張子のリストに基づいて情報を収集します。Backdoor.WeevilB の標的となる文書の種類は、以下のとおりです。

  • Word、PDF、Excel
  • 暗号化ファイル、PGP キー、暗号化キー
  • モバイルバックアップファイル
  • 電子メールアーカイブ

収集された情報は、HTTPS プロトコルを使って、攻撃者が管理するサーバーに安全に送信されます。

データを盗み出すコンポーネントが、The Mask の標的に関する手掛かりになっています。「archivos de programa」のようなスペイン語のパス名で文書を検索していることから、標的ではスペイン語のオペレーティングシステムが実行されていると考えられます。

まとめ
専門的なチームが展開するサイバースパイ活動は、増加傾向にあります。この数年の間で、Flamer、MiniDuke、Hidden Lynx といった何年間も持続するスパイ活動がいくつも明らかになってきました。The Mask も、こうした名だたるマルウェアに連なるものですが、高度な攻撃活動の標的が多様化していることも示しています。これらの攻撃と時を同じくして、スパイ活動に使われるツールを開発する企業も登場しており、Hacking Team や Gamma International といった企業が、高度な監視機能を持つリモートアクセスツール群を販売しています。こうしたことからも、地理的にも技術的にもサイバースパイ活動が広がりつつあることは明白です。

保護対策
シマンテックは、この脅威に対して以下の検出定義を提供しています。

また、次の侵入防止シグネチャでネットワーク保護も提供しています。

System Infected: Backdoor.Weevil Activity

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

How to have a Safer Internet Day everyday

      No Comments on How to have a Safer Internet Day everyday

“Let’s create a better internet together”. Today, over 100 countries celebrate Safer Internet Day by focusing on how people, including teens and kids, use connected technology and what we can all do to make things better. Since AVAST is trusted by over 200 million people worldwide to protect their devices, we asked some of them […]

Microsoft Patch Tuesday – February 2014

      No Comments on Microsoft Patch Tuesday – February 2014

Hello, welcome to this month’s blog on the Microsoft patch release. This month the vendor is releasing seven bulletins covering a total of thirty-one vulnerabilities. Twenty-five of this month’s issues are rated ’Critical’.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the February releases can be found here:
http://technet.microsoft.com/en-us/security/bulletin/ms14-feb

The following is a breakdown of the issues being addressed this month:

  1. MS14-010 Cumulative Security Update for Internet Explorer (2909921)

    Internet Explorer Elevation of Privilege Vulnerability (CVE-2014-0268) MS Rating: Important

    An elevation of privilege vulnerability exists within Internet Explorer during the validation of a local file installation and during the secure creation of registry keys.

    VBScript Memory Corruption Vulnerability (CVE-2014-0271) MS Rating: Critical

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

    Internet Explorer Cross Domain Information Disclosure Vulnerability (CVE-2014-0293) MS Rating: Important

    An information disclosure vulnerability exists in Internet Explorer that could allow an attacker to gain access to information in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted webpage that could allow an information disclosure if a user viewed the webpage. An attacker who successfully exploited this vulnerability could view content from another domain or Internet Explorer zone.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0267) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0269) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0270) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0272) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0273) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0274) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0275) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0276) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0277) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0278) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0279) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0280) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0281) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0283) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0284) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0285) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0286) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0287) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0288) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0289) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0290) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

  2. MS14-011 Vulnerability in VBScript Scripting Engine Could Allow Remote Code Execution (2928390)

    VBScript Memory Corruption Vulnerability (CVE-2014-0271) MS Rating: Critical

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  3. MS14-007 Vulnerability in Direct2D Could Allow Remote Code Execution (2912390)

    Microsoft Graphics Component Memory Corruption Vulnerability (CVE-2014-0263) MS Rating: Critical

    A remote code execution vulnerability exists in the way that affected Windows components handle specially crafted 2D geometric figures. The vulnerability could allow a remote code execution if a user views files containing such specially crafted figures using Internet Explorer. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

  4. MS14-008 Vulnerability in Microsoft Forefront Protection for Exchange Could Allow Remote Code Execution (2927022)

    RCE Vulnerability (CVE-2014-0294) MS Rating: Critical

    A remote code execution vulnerability exists in Forefront Protection for Exchange. An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the configured service account.

  5. MS14-009 Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2916607)

    POST Request DoS Vulnerability (CVE-2014-0253) MS Rating: Important

    A denial of service vulnerability exists in Microsoft ASP.NET that could allow an attacker to cause an ASP.NET server to become unresponsive.

    Type Traversal Vulnerability (CVE-2014-0257) MS Rating: Important

    An elevation of privilege vulnerability exists in the Microsoft.NET Framework that could allow an attacker to elevate privileges on the targeted system.

    VSAVB7RT ASLR Vulnerability (CVE-2014-0295) MS Rating: Important

    A security feature bypass exists in a .NET Framework component that does not properly implement Address Space Layout Randomization (ASLR). The vulnerability could allow an attacker to bypass the ASLR security feature, after which the attacker could load additional malicious code in the process in an attempt to exploit another vulnerability.

  6. MS14-005 Vulnerability in Microsoft XML Core Services Could Allow Information Disclosure (2916036)

    MSXML Information Disclosure Vulnerability (CVE-2014-0266) MS Rating: Important

    An information-disclosure vulnerability exists that could allow an attacker to read files on the local file system of a user or read content of web domains where a user is currently authenticated to when the user views specially crafted web content that is designed to invoke MSXML through Internet Explorer.

  7. MS14-006 Vulnerability in IPv6 Could Allow Denial of Service (2904659)

    TCP/IP Version 6 (IPv6) Denial of Service Vulnerability (CVE-2014-0254) MS Rating: Important

    A denial of service vulnerability exists in Windows in the IPv6 implementation of TCP/IP. An attacker who successfully exploited this vulnerability could cause the affected system to stop responding.

More information on the vulnerabilities being addressed this month is available at Symantec’s free SecurityFocus portal and to our customers through the DeepSight Threat Management System.

My (Failed) Visits to Spammers’ Offices

      No Comments on My (Failed) Visits to Spammers’ Offices

One of the most popular methods of spamming is snowshoe spam, also known as hit and run spam. This involves spam that comes from many IP addresses and many domains, in order to minimize the effect of antispam filtering. The spammer typically sends a burst of such spam and moves to new IP addresses with new domains. Previously used domains and IP addresses are rarely used again, if ever.

Some spammers like to use a similar pattern across their spam campaigns. This blog discusses a particular snowshoe spam operation that I have labeled “From-Name snowshoe”. While there are other features in the message that allow the campaigns to be grouped into the same bucket, the messages’ most distinct feature is that all of the email addresses that appear in the “from” line use real names as their usernames. 

  • From: [REMOVED] <Leila.Day@[REMOVED]>
  • From: [REMOVED] <CharlotteTate@[REMOVED]>
  • From: [REMOVED] <Diana.Pope@[REMOVED]>
  • From: [REMOVED] <SamuelLambert@[REMOVED]>
  • From: [REMOVED] <Jackson.Garza@[REMOVED]>
  • From: [REMOVED] <JohnathanParsons@[REMOVED]>
  • From: [REMOVED] <EliasTaylor@[REMOVED]>

This From-Name snowshoe campaign had two interesting traits. The first was the timing. Over the course of a few months, I have noticed that this spam operation only sent messages on weekdays.

Spammers Office 1.png

Figure 1. Over 59 million spam messages have been identified since October 16, 2013.

After further investigating this timing, we discovered that the spam is only sent between 6am and 7pm Pacific Time. Coupled with the fact that messages were only sent during weekdays, this suggested that the operation could be part of a business.

The second trait was the IP addresses that were used for this spam run. As noted above, typical snowshoe spam does not return to the same IP addresses. However, analysis into the senders’ IP addresses revealed that the messages were coming from multiple IP addresses that were owned by the same entity. This organization is called “Network Operations Center,” which is based in Scranton, Pennsylvania, and it’s a well-known spam operation.

Last month, this spam operation began to send the same type of spam messages from IP addresses owned by other entities. One of them was “Nth Air, Inc.”. 

Spammers Office 2.png

Figure 2. Spam sample sent from IP addresses owned by other entities, including “Nth Air, Inc

Spammers Office 3.png

Figure 3. Email header snippet showing Nth Air, Inc’s IP address

While a simple online search for “Network Operations Center spam” produced many results discussing spam, a similar search for Nth Air did not have as many results. In fact, the company appears to have been a legitimate WiMAX provider in the past, as seen in this press release. I was unable to find news about the company in recent times, which led me to believe that the organization may no longer exist. However, ARIN records indicated that the company was based in San Jose, California, so I decided to visit its offices in the hopes of finding out more information about the organization.

Spammers Office 4.png

Figure 4. Visiting the building with address listed on Nth Air

I went to the suite that was listed online, but another company was using it.

Spammers Office 5.png

Figure 5. Suite 70 is now occupied by Sutherland Global Services

I called the phone number listed online to no avail. My email to netops@nthair.com bounced back because, “the recipient does not exist.” Bummer.

Since my visit to “Nth Air, Inc” did not work out as planned, I turned to “LiteUp, Inc”.

Spammers Office 6.png

Figure 6. Spam sample from LiteUp, Inc’s IP address

Spammers Office 7.png

Figure 7. Email header snippet showing LiteUp, Inc’s IP address

ARIN listings indicated that the company was located in Berkeley, California, so I went there for a visit. Unfortunately, I was unable to find LiteUp at the listed address.

Spammers Office 8.png

Figure 8. Address listed by LiteUp. It was a motorcycle store instead.

So that makes two instances of spammers using IP addresses owned by companies that do not exist, at least according to ARIN records.

I was unable to meet the spammers, or those who could be assisting spammers, but we are keeping a close watch to ensure that these spam messages do not reach end users’ inboxes.

Talk to your kids on Safer Internet Day 2014

      No Comments on Talk to your kids on Safer Internet Day 2014

“Let’s create a better internet together”. Today we celebrate Safer Internet Day 2014 (SID) which promotes safer and more responsible use of online technology and mobile phones, especially among children and young people across the world. Have you ever talked to your child about making good decisions online? Here are some topics for the dinner […]

Update for Deprecation of MD5 Hashing Algorithm for Microsoft Root Certificate Program – Version: 2.0

      No Comments on Update for Deprecation of MD5 Hashing Algorithm for Microsoft Root Certificate Program – Version: 2.0

Severity Rating: Revision Note: V2.0 (February 11, 2014): Revised advisory to announce that the 2862973 update for all affected releases of Microsoft Windows is now offered through automatic updating. Customers who previously applied the 2862973 update…