Spammers Kickoff Sale for United States Independence Day

Independence Day in the United States is a federal holiday, commonly known as the 4th of July. It is traditionally celebrated with various political speeches, ceremonies, fireworks, and parades. Spammers are exploiting the holiday by sending numerous s…

Fake Application Found on Amazon Appstore for Android

Keeping an app store free of malicious applications can be a hard task as we have discussed in our previous blogs. Fake or misleading applications, in particular, are often the hardest to spot because it is not always obvious whether they do what they …

4 Hot Apps Parents Need to Download Today

It’s no secret, kids retreat when parents begin to crowd their private space. Have you noticed when you look for your son or daughter on Facebook, you are greeted by the sound of crickets? Don’t worry your teen is just as active in social networks, just not the ones where they will run into you. Read more…

The Java Autorun Worm, Java.Cogyeka (2 of 3)

Obfuscations
In my previous blog, I discussed some stealth techniques Java.Cogyeka uses. These stealth techniques are not effective at deceiving users or security researchers, but their use proves that Java malware is continuously improving.

Aside from the stealth techniques, Java.Cogyeka is designed to evade security researchers through various obfuscation techniques. Some are effective, some are overdone. Overdone obfuscation techniques will often cause malware to be less effective.

Java.Cogyeka uses three obfuscation techniques:

1. Autorun.inf obfuscation
The autorun.inf file helps Java.Cogyeka spread through removable drives. This file is made up of three parts:

  1. Action
  2. Icon
  3. ShellExecute

It must contain a ShellExecute function in order to execute itself in the removable drive Recycler folder. As I wrote in my previous blog, Java.Cogyeka employs a folder icon and also displays the message “Open folder to view files.”

Java.Cogyeka uses an obfuscation technique to ensure that security scanners do not detect autorun.inf. The obfuscation technique inserts garbage between entries. The garbage consists of a control character between 0x00 and 0x1F. This obfuscation technique is often found in malicious .inf or .html files.

Figure1_3.png

Figure 1. Obfuscation technique fills in garbage

Uppercase and lowercase capitalization is used randomly in the ASCII characters to create inconsistency. The volume of the garbage is between 0 and 50 bytes and it is in clusters located alongside the tokens in a crafted autorun.inf file. Symantec detects the autorun.inf file crafted by Java.Cogyeka as Java.Cogyeka!autorun.

2. Zelix obfuscation tool
This Java malware spreads itself as a JAR file with 15 class files (a.class to o.class). Originally, these classes may have been named based on the functionality of each class. The Java obfuscation tool—named Zelix KlassMaster—modifies class names, method names, Java byte codes, and strings.

Figure2_1.png

Figure 2. Zelix bitmap of encrypted and decrypted strings with XOR table

The Java obfuscation tool is not malware but rather a legitimate tool. Java developers may want to hide important data and code in Java class files. It is difficult to decompile a Java class file if Zelix obfuscation has been applied.

Java.Cogyeka is not the only object to use this tool; many malicious Java applets that exploit Java vulnerabilities, for instance, are also use this tool.

3. Network connection obfuscation
Determine server name and port number

To download an additional module from the command-and-control (C&C) server, Java.Cogyeka has to connect to it. However, it is difficult to successfully connect an existing server while also attempting to connect many fake servers. It takes a long time to download an additional module this way. The difficulty results from the complicated server name and port number.

The C&C server’s host name is made up of five to eight random letters and the randomly selected domain is based on a dynamic DNS. A random seed based on the time the malware is run is used to select the random letters. The domain is selected from 22 famous dynamic services by the same random seed used to obtain the random letters.  The port number is also randomly generated by the same random seed. The seed number is based on a 64-bit integer.

Figure3_1.png

Figure 3. Random seed used to determine host name, domain name, and port number

There is a possibility that the generated C&C server name is the same as a legitimate one hosted by another user in the dynamic DNS service. If so, the malware tries to connect the server name with a generated TCP port number. If the server denies connection with the port the connection will be closed immediately, but the malware has to wait until it knows the connection cannot be established.

Negotiation
The protocol used to download an additional module is the original one, but it is obfuscated. The protocol will likely establish a secure connection because it uses a stream cipher created by a pseudo-random generator.

Java.Cogyeka and the server program have the same random seed and pseudo-random generator. The malware negotiates by exchanging two byte streams.

Figure4_1.png

Figure 4. Java.Cogyeka and server program negotiation

Java.Cogyeka generates the first byte stream, and its length, with a pseudo-random generator and then sends it to the server through a TCP connection. The server then receives the data. If the server was created by the malware author, the server program runs and has the same random seed and pseudo-random generator as the malware. The server can verify the byte stream, and the length, by using the same generator. To perform a double check, the server creates a second byte stream. The malware receives the second byte stream and verifies the data with a byte stream it has generated.

If the negotiation is successful, the malware has confirmed the server has the same random seed and pseudo-random generator.

Downloading a module
After a successful negotiation Java.Cogyeka downloads the settings, including the size of the module to download, but the settings are encrypted by the stream cipher. After obtaining the size, it downloads a module encrypted by the stream cipher. The settings include a hash value of the downloaded module. The malware can make sure the download is successful by using SHA-512.

Made with a purpose
I discussed three obfuscation techniques used by Java.Cogyeka. The obfuscation techniques used by the malware are somewhat complicated, but the autorun.inf file in the malware should be easy to detect by security scanners. Part of the obfuscation technique used for the server name and port number is ineffective because of too much obfuscation. The streaming cipher may be effective against network-type security scanners. This obfuscation technique demonstrates that this malware was not created as a hobby, but instead, made with a specific purpose.

To be concluded…
The third and final blog in this series will show the purpose of the malware as well as what information it obtains and how it obtains it.

Java Autorun ??? Java.Cogyeka?? 1 ??

Java.Cogyeka
最近、Java の脆弱性が大きく注目を集めています。脆弱性がマルウェア作成の引き金になる経緯も話題になっていますが、マルウェアが存在するには必ずしも脆弱性が必要なわけではないことに注意してください。Java.Cogyeka がまさにそのケースです。Java.Cogyeka は、Java の脆弱性こそ悪用していませんが、それ自体は Java で書かれており、多くの悪質な活動を実行します。このブログシリーズでは、その悪質な活動について詳しく説明します。

Java.Cogyeka は 2012 年 6 月に発見され、今もなお活動中です。このマルウェアには以下のように 5 つの機能があり、それぞれについて解説します。

  1. autorun.inf を通じた拡散
  2. ステルス技術
  3. ダウンローダ機能
  4. 不明瞭化
  5. Infostealer 機能

これまでに見られた他の Java マルウェアでも、悪質な機能がここまで複合していた例はありません。悪質なプログラムで Java を見かける場合、その唯一の目的は他のマルウェアをダウンロードすることであり、それ以降の悪質な処理は他のマルウェアによって実行されるのが一般的です。ところが、Java.Cogyeka はそれ自体が悪質なプログラムであり、独自の目的も持っています。追加の悪質なモジュールを必要とせず、Java コード自体が悪質な活動の実行に使われます。これまでに見てきた Java マルウェアの中で、Java.Cogyeka が最も総合的なマルウェアと言えるのはこのためです。

今回は、3 回シリーズの第 1 回目として、この Java.Cogyeka の以下の特徴について説明します。

  • autorun.inf ファイルを通じた拡散
  • ステルス技術
  • ダウンローダ機能

残りの機能、不明瞭化と Infostealer 機能については、次回以降のブログで説明します。

autorun.inf ファイルを通じた拡散
上述のように、このワームは autorun.inf を使って拡散し、以下の形式のファイル名でリムーバブルドライブに自身をコピーしようとします。

  • %DriveLetter%:\RECYCLER\[SID]\[ランダムなファイル名].[ランダムな 3 文字の拡張子]

次に、リムーバブルドライブのルートフォルダに autorun.inf ファイルをコピーしようとします。これは、リムーバブルドライブが他のコンピュータに接続されたとき常にワームを実行するためです。

技術的には、リムーバブルドライブ上に autorun.inf ファイルを作成するときには問題が発生します。設計上、Java はサンドボックス内で動作し、オペレーティングシステムのリソースと直接やり取りすることができないためです。そのため、Java アプリケーションが直接リムーバブルドライブのドライブ名を決定することはできず、JNI(Java Native Interface)を利用してこの問題を解決します。Java.Cogyeka ワームが autorun.inf ファイルを保存して実際に利用するには、リムーバブルドライブのドライブ名を知る必要があります。この問題を解決するために、Java.Cogyeka はネイティブ WIN32 API の GetDriveType メソッドを呼び出そうとします。このとき使われるのは、マルウェア作成者がこのために特別に作成した Windows バイナリ DLL ファイルです。次に、JNI を利用する Java コードが、この DLL に間接的にアクセスします。シマンテックは、この悪質な DLL ファイルも Java.Cogyeka として検出します。

Determining_the_name_of_removable_drives_243px.png

図 1. リムーバブルドライブの名前の決定

ステルス技術
Java.Cogyeka は、コンピュータに侵入するとき一種のステルス技術を使います。と言っても、それらの技術が侵入先のコンピュータのユーザーを本当に欺くものかどうかは疑わしく、またセキュリティ製品を欺けるかどうかも疑問です。この脅威で用いられているステルス技術は 3 つあります。

リムーバブルドライブのアイコンの偽装
このマルウェアに侵入されたリムーバブルドライブは、ドライブのアイコンがフォルダアイコンに変更されます。ドライブのアイコンを変えるのは簡単で、このマルウェアも autorun.inf ファイルに “icon=[アイコン画像のパス]” という文字列を追加しているだけです。このマルウェアは、shell32.dll ファイルのフォルダアイコンを利用しています。

Java_Cogyeka_1_of_3_1_edit.png

図 2. アイコンが変更されたリムーバブルドライブ

偽装の手口としては、実行可能ファイルのアイコンを変更する方法が有名です。実行可能ファイルが Microsoft Office Word や Adobe PDF のような文書ファイルのアイコンになっていると、ユーザーはそれを文書ファイルと信じてしまいます。しかし、リムーバブルドライブのアイコンを変更するというのは話が別です。このマルウェアがリムーバブルドライブのアイコンを変更する理由はわかりませんが、これも無意味なステルス技術のひとつにすぎません。侵入先のコンピュータでこのようなアイコンが見つかった場合に、マルウェアに感染した証拠になるくらいでしょう。

コピーではなく再圧縮
このマルウェアは自身をコピーすると述べましたが、それは正確ではありません。実際には、自身を以下の場所に再圧縮します。

  • %Temp%\jar_cache[ランダムな数字].tmp

Java.Cogyeka は、JAR ファイルとして自身を拡散します。具体的には、ランダムなバイトを追加して JAR ファイルのハッシュ値を変更しようとする場合があります。JAR のファイル形式は Zip 形式に類似しており、Java のクラスを 1 つのファイルに圧縮するときに使われます。Java.Cogyeka は Zip ヘッダーの追加フィールドにランダムなバイトを追加しようとしますが、最近ではセキュリティソフトウェアのウイルススキャン機能によって Zip ファイルが解凍され、アーカイブ内のファイルもスキャンされます。そのため、JAR ファイル内の悪質な .class ファイルもスキャンされるので、たとえ JAR ファイルのハッシュ値が変更されていても検出されることになります。

したがって、JAR ファイルのハッシュ値を変更するという手口も意味がありません。

システムプロセスではなく java.exe
Java.Cogyeka は、java.exe を以下の場所にコピーします。

  •  %Temp%\hsperfdata_[ユーザー名]\[システム実行可能ファイル名].exe

システム実行可能ファイル名として、以下のいずれかが使われます。

  • csrss
  • explorer
  • lsass
  • services
  • smss
  • svchost
  • winlogon

explorer.exe 以外のプロセスは、たとえ管理者権限があったとしても、ユーザーが終了することはできません。マルウェアは、ワームが実行されているプロセスをユーザーには終了できないようにすることを狙っているのです。ところが、シマンテックの脅威情報に記載されているとおり、Java.Cogyeka は StubPath レジストリのサブキーで “javaw” を使っており、上記のいずれかのプロセスを表す “システムファイル名” を指定した “[システムファイル名].exe” を使っていません。このマルウェアがシステムプロセスとして実行されていることを発見した場合に、Windows のタスクマネージャを使ってマルウェアのプロセスを手動で停止することはできませんが、サードパーティ製のソフトウェアを使えばプロセスを終了できます。また、Symantec Endpoint Protectionノートン インターネットセキュリティノートン 360 は、起動後すぐにこのプロセスを自動的に終了することにも注目してください。

マルウェアの作成者はユーザーが手動でこのプロセスを終了することを妨げているつもりですが、その手口もとうてい成功しているとは言えません。

ダウンローダ機能
コンピュータに侵入した Java.Cogyeka は、サーバーに接続して追加のモジュールをダウンロードしようと試みます。このモジュールは明らかに JAR ファイルです。JAR ファイルをダウンロードしてクラスファイルをメモリ空間に解凍し、ClassLoader Java クラスを使ってロードします。任意のクラスをロードすれば、マルウェアの作成者は侵入先のコンピュータを制御できるようになります。Java.Cogyeka は、自身と他のモジュールの新機能を持つ更新もダウンロードできます。

次回は…
今回は、Java.Cogyeka の概要と、コンピュータに侵入するときの仕組みについて説明しました。次回は、このワームが使っている不明瞭化の手口と、そのメインモジュールについて説明します。

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Tinder: Spammers Flirt with Popular Mobile Dating App

Over the last few years, we’ve reported on a number of spam campaigns spreading through various social networking sites and applications. As with any social service, as it becomes popular, spammers look for ways to take advantage of this populari…

Phishers Target College Candidates in China

After the annual National College Entrance Examination (NCEE), Chinese high school graduates are now busy choosing a college and filling out college applications. The college picks are no trivial matter; it determines matriculation.

Phishers also do not want to miss out on this event and the opportunity to profit. If a candidates’ personal information is stolen by phishers, the victim and their parents can expect to receive a large number of spam messages or annoying phone calls—including civil college and overseas educational agencies advertising, or even attempts at financial fraud. Phishing websites may even make a candidate mistakenly think they have completed an application to a college—but, actually, they did not—which directly affects the candidate’s future at this important juncture in their life. In addition, the candidate’s information will be sold for profit to overseas educational agencies, fake credentials makers, or re-application services.

Phishers may use the following tricks:

Clone an educational website
The fake Web page is almost identical with the real one, except it includes embedded malicious script or the university contact information is fake. The links on this fake page will mimic the real one. When a candidate searches for a university through a search engine, the link of a fake Web page may appear in the search results. If the candidate clicks any links, they may be lead to a malicious phishing page.

pic1.png.jpg
Figure 1. Phishing site, “Beijing Economic Management Institute”

 

pic2.png
Figure 2. Legitimate site

Scam “smart” cards
This trick entices candidates to buy a “college entrance application smart card”. This fake offer usually claims the smart card is used for completing the college entrance applications forms. The smart card is promoted to also provide access to learning skills like how to choose a college, or offer participation in a skills assessment along with helpful practice forms for college application. However, real college applications can only be achieved through legitimate educational websites of provinces, not any other way. These so-called “college entrance application smart cards” are just traps to fool people and obtain money them.

pic3.png.jpg
Figure 3. “College entrance application smart card” scam

Fake enrollment guidance service
This kind of website phishing entices candidates to pay for a service. However, when the user actually pays they will not get any guidance at all, just a loss of their money.

pic4.png
Figure 4. Fake enrollment guidance service

Alternative application process
Some websites may claim they can supply a “short cut” to admission for candidates who do not score highly in the college entrance exams. These websites display a notification asking users to submit their personal information for the application. If users fill out the form with their personal information, phishers will have stolen it for profit.

pic5.png
Figure 5. Fake “short cut” application for college admission

Most of the phishing websites use search engines, forums, or education advisory websites to promote these scams. We suggest candidates and their parents not click any suspicious URLs and be especially cautious during applications to college.

EncryptFree and Other Tools to Help Consumers Dodge Web Snooping

Just like in the offline world, you leave a virtual paper trail behind you on the web. Information about the websites you’ve visited and information you’ve entered on those sites is captured and used by many parties – from web advertisers to social media platforms (for instance, when Facebook recommends people you may know) to Read more…

The Java Autorun Worm, Java.Cogyeka (1 of 3)

Java.Cogyeka
Recently there has been a lot of attention drawn to the vulnerabilities in Java and how they can lead to malware being created. However, it is worth noting that a vulnerability is not always required for malware to exist, as is the case with Java.Cogyeka. While this threat does not exploit any vulnerability in Java itself, it is written in the Java language and performs numerous malicious activities, which I intend to explore throughout this series of blogs.

Java.Cogyeka was discovered in July 2012 and is still active now. This malware has five features, which I have broken down into the following categories:

  1. Propagation through autorun.inf
  2. Stealth techniques
  3. Downloader functionality
  4. Obfuscation
  5. Infostealer functionality

Other Java malware we have seen does not have this combination of malicious features. Typically, when we encounter Java in a malicious program, its only purpose is to download other malware, which then performs further malicious actions. However, Java.Cogyeka is a malicious program in its own right and with its own purpose—the Java code itself is being used to perform malicious activities without requiring an additional malicious module. This makes it the most comprehensive Java-only malware that I have ever come across.

This is the first in a series of three blogs on Java.Cogyeka and in this blog I will discuss the following features:

  • Propagation through an autorun.inf file
  • Stealth techniques
  • Downloader functionality

The remaining functions, Obfuscation and Infostealer functionality, will be discussed in future blogs.

Propagation through an autorun.inf file
As previously mentioned, this worm uses autorun.inf to spread and attempts to copy itself to a removable drive using a file name in the following format:

  • %DriveLetter%:\RECYCLER\[SID]\[RANDOM FILE NAME].[THREE RANDOM LETTERS FILE EXTENSION]

It then attempts to copy an autorun.inf file to the root folder of the removal drive in order to execute the worm whenever the removable drive is inserted into another computer.

Technically, a problem exists when creating the autorun.inf file on the removable drive. By design, Java operates within a sandbox and cannot interact directly with the resources of the operating system. Because of this, a Java application cannot directly determine the drive letter of a removable drive, but the Java Native Interface (JNI) offers a possible solution to this problem. The worm needs to know the drive letter of a removable drive in order to store and use the autorun.inf file effectively. To solve this problem, it attempts to call a native WIN32 API method GetDriveType through a Windows binary DLL file that the malware author made specifically for this purpose. This DLL is then accessed indirectly by the Java code using JNI. Symantec also detects the malicious DLL file as Java.Cogyeka.

Determining_the_name_of_removable_drives_243px.png

Figure 1. Determining the name of the removable drive

Stealth techniques
Java.Cogyeka uses certain stealth techniques when compromising a computer. It is doubtful that these techniques successfully trick users of the compromised computer or fool security products for that matter. The threat uses three stealth techniques.

Compromised removable drive icon
The removable drive that is compromised by this malware has its drive icon changed to a folder icon. It is easy to change a drive icon, the malware simply adds “icon=[PATH OF ICON IMAGE]” to the autorun.inf file. This malware uses the folder icon from the shell32.dll file.

Java_Cogyeka_1_of_3_1_edit.png

Figure 2. Removable drive with changed icon

Changing the icon of an executable file is a well-known camouflage technique. If an executable file has a document file icon, like Microsoft Word or Adobe PDF, users may misidentify the executable file as a document file. However, changing the icon of a removable drive is a slightly different case. I do not know why the malware changes the icon of the removable drive, but this is one of the malware’s meaningless stealth techniques. If found on the compromised computer, it can be seen as a sign that the malware may be present.

Repacked, not copied
Previously, I stated that the malware copies itself, but this is not entirely accurate. The malware actually repacks itself to the following location:

  • %Temp%\jar_cache[RANDOM DIGITS].tmp

The malware spreads itself as a JAR file. It may try to change the hash value of the JAR file by adding random bytes. The JAR format is like a Zip format that is used to pack Java classes into one file. The malware attempts to add random bytes to an extra field in the Zip headers. However, most security vendor virus scanners can extract Zip files to scan files contained in the archive. They do this so that they can scan the malicious .class file within the JAR file and detect it even though the hash value of the JAR file has changed.

As a result, the malware’s modification of the hash value of the JAR file is meaningless.

java.exe instead of a system process
The malware copies java.exe to the following location:

  •  %Temp%\hsperfdata_[USER NAME]\[SYSTEM EXECUTABLE FILE NAME].exe

It uses one of the following system executable file names:

  • csrss
  • explorer
  • lsass
  • services
  • smss
  • svchost
  • winlogon

Users, even if they have administrator privileges, cannot end these processes, except for the explorer.exe process. The malware aims to deter users from ending the process that the worm is running on. However, it uses “javaw” in the StubPath registry subkey, as described in our detection write-up, instead of “[SYSTEM FILE NAME].exe” with “SYSTEM FILE NAME” representing one of the processes listed above. Users who find this malware running as a system process cannot manually end the malware process by using Windows Task Manager. Third-party software, however, can be used to end the process.  It is also worth noting that Symantec Endpoint Protection and Norton Internet Security/Norton 360 products will end this process automatically as soon as it starts.

While the malware author makes it inconvenient for users to end this process manually, the technique used is far from successful.

Downloader functionality
After the malware compromises a computer, it attempts to connect to a server in order to download an additional module. Apparently, this module is a JAR file. It downloads and extracts class files into its memory space and then loads them with the ClassLoader Java class. Through any class loading, a malware author can gain control of the compromised computer. The malware can also download updates with new features for itself or other modules.

To be continued…
This blog is an overview of Java.Cogyeka and how it works to compromise computers. The next blog in the series will discuss obfuscation techniques used by the worm as well as its main module.

Go AVAST go!

      No Comments on Go AVAST go!

Football is fun! It’s exciting, it brings us together… to share, to enjoy, to be proud (or ashamed?) of our favorite teams. Simply put, it creates a spirit of community. And we at AVAST Software realize how important community is. We also know that AVAST has a community of 22,000,000 users in Brazil. Given the […]