Tag Archives: Security Response

TorLocker ransomware variant designed to target Japanese users

Hacker Medic December 15, 2014 No Comments

New file-encrypting ransomware variant is the first to specifically target Japanese users.

Twitter Card Style:

summary

Ransomware is nothing new to Japan. Symantec’s research has found that Japan ranks among the regions that are the most affected by global ransomware attacks. However, no attacks specifically targeting Japanese users have ever been confirmed. That is, until now. In the recent weeks, Symantec has observed a ransomware variant in the wild that was designed to target users who speak Japanese.

Torlocker 1.png
Figure 1. Ransomware attacks in November 2014 by region

The ransomware threat in question is a localized variant of TorLocker. The malware encrypts files with certain file extensions on the compromised computer and demands that the user pays in order to decrypt the files. Symantec has confirmed multiple variants of this particular Japanese ransomware threat.

TorLocker has been used in ransomware attacks around the world. The threat is part of an affiliate program, where the program’s operator gives participants the builder to create custom ransomware, access to the TorLocker control panel to track infections, and miscellaneous files to be used in conjunction with the malware. In return, the participants give a portion of the profit from the attack to the affiliate program’s operator.

Infection
The localized variant’s attacks on Japanese users have occurred on compromised websites that commonly host blogs. However, it is also possible that the attacker is renting an exploit kit to automatically compromise victims’ computers by exploiting software vulnerabilities. In one case, a recently compromised site owned by a Japanese publishing company redirected traffic to several domains hosting the Rig exploit kit. This may have ultimately served the ransomware as a payload.

In another case in late November, a blog site was compromised to display a fake Adobe Flash Player installer page.

Torlocker 2.png
Figure 2. Fake Adobe Flash Player installer page

If the user clicks on the yellow install button, they are prompted to download and execute a setup file to install the plugin. However, the file does not contain the typical icon used in Flash Player installers. The file is not digitally signed either, which suggests that the installer is a phony.

Torlocker 3.png
Figure 3. Icon of the installer downloaded from the fake Flash Player page

Once the setup file is executed, it does not install Flash Player. Instead, it encrypts certain files and displays a message in Japanese in popup window, stating that the computer has been locked. The message then asks the user to pay in order to unlock their files. The demanded ransom ranges from 40,000 yen to 300,000 yen (approximately US$500 to US$3,600).

Figure 4. Pop-up window of the TorLocker ransomware variant targeting Japanese-speaking users

Stay protected
Japan is approaching its week-long New Year holiday. The long break is a perfect opportunity for the attacker to perform its campaign, as many users will likely surf the internet during the time off. Symantec has the following recommendations to avoid or mitigate ransomware infections:

Update the software, operating system, and browser plugins on your computer to prevent attackers from exploiting known vulnerabilities.
Use comprehensive security software, such as Norton Security, to protect yourself from cybercriminals.
Regularly back up any files stored on your computer. If your computer has been compromised with ransomware, then these files can be restored once the malware is removed from the computer.
Never pay the ransom. There’s no guarantee that the attacker will decrypt the files as promised once they receive payment.

Symantec and Norton products detect all of the ransomware variants discussed in this blog as Trojan.Cryptlocker.

?????????????: ????????????????????????

Hacker Medic December 15, 2014 No Comments

最近の大規模なデータ侵害を経て、アンダーグラウンド市場では活況を呈しています。盗まれた電子メールアカウントの価格は大幅に下落したものの、その他の違法な商品やサービスの価格は安定したままです。

Twitter Card Style:

summary_large_image

休暇シーズンには、最高の贈り物を最良の条件で求める買い物客がインターネットを探し回ります。この時期にお買い得品を探し求めるのは、一般消費者だけではありません。多くのサイバー犯罪者が、他人のお金で買い物をするとともに、アンダーグラウンド市場を利用して違法な商品やサービスを売買しようとしています。盗難データ、侵害されたオンラインアカウント、カスタムのマルウェア、攻撃サービスや攻撃インフラ、不正バウチャーなど、多種多様なものが購入できてしまうのです。

違法な商品やサービスの種類によって価格は大きく変動しますが、予算が非常に厳しいサイバー犯罪者にさえもお買い得品が存在します。攻撃者は、盗難データや侵害されたアカウントを 1 ドル未満で入手可能です。攻撃インフラなど大規模なサービスは、100 ドルから数千ドルで売買されています。それでも、こうしたインフラを利用して得られる利益を考えれば、初期投資に見合う価値があるのでしょう。

過去 12 カ月に発生したさまざまなデータ侵害や店頭レジ端末（POS）マルウェアの事案を考えると、アンダーグラウンド市場には盗難データがあふれていて、価格が下落していると思うかもしれません。ところが興味深いことに、市場で売買されている違法な商品の場合、これは当てはまらないようです。

アンダーグラウンドでの買い物
公衆インターネットで閲覧できる違法市場がある一方で、今年はアンダーグラウンドのサイトに関する報道が増えたため、多くの詐欺師たちがインターネットの暗部に移動することを余儀なくされました。たとえば、一部のフォーラムは隠しサービスとして匿名の Tor ネットワーク上でホストされています。また、招待者のみがアクセス可能で、かつ最近盗まれたばかりのクレジットカード情報 100 件など、金銭や商品の取引実績が必要とされる市場や、プライベートのチャットルームで運営され、新規ユーザーには厳しい審査手続きのある市場もあるのです。このような閉じたサークル内では通常、より多くの商品やサービスがより安い価格で取引されています。

販売されている盗難データ
データの販売価格は、電子メールアカウントなど一部については下落してきましたが、オンラインバンクの口座情報など利益が大きい情報については安定しています。2007 年には、盗まれた電子メールアカウントに 4 ドルから 30 ドルの値段が付いていました。2008 年には 0.10 ドルから 100 ドルの間で揺れ動き、2009 年には 1 ドルから 20 ドルの間を推移しています。現在は、盗まれた電子メールアカウント 1,000 件が 0.50 ドルから 10 ドルで入手可能です。この最新価格は、今や供給過剰となった状況が市場に反映されていることを示しています。

一方、クレジットカード情報の価格は、この数年下落していません。2007 年には、1 枚当たり 0.40 ドルから 20 ドルと広告されていました。カードのブランド、発行国、カードに関連するメタデータの量、大量購入割り引き、盗まれた時期など、さまざまな要因によって価格は変動します。2008 年、クレジットカード情報の平均的な希望価格は 0.06 ドルから 30 ドルとわずかに高くなり、同年の後半には 0.85 ドルから 30 ドルに上昇しました。現在では、0.50 ドルから 20 ドルです。クレジットカード情報の価格は、全般的にこの数年でわずかに下がっています。サイバー犯罪者が大量取引を行う場合は特にそうです。

もちろん、取引の詳細が闇の中であるため、どれだけの買い手が価格範囲内の高値を実際に支払っているかは不明です。また、一部の売り手は、古いデータを販売しようとしたり同じデータを何度も再販しようとしたりするなど、盗品の状態にも疑問があります。販売者の口座が有効かどうかや、クレジットカードが利用停止になっていないかどうかを確認する追加サービスが盛況なのは、このことが原因かもしれません。多くのアンダーグラウンド市場では、データの新鮮ささえも保証していて、クレジットカードが利用停止になっていたら購入後 15 分以内に交換することすら可能です。予想されるとおり、需要があるところには誰かが参入して、市場のギャップを埋めるのでしょう。

雇われの攻撃サービス
サービスとして提供されるクライムウェアも、アンダーグラウンド市場での人気が高くなっています。攻撃者は、ボットネットやその他のオンライン詐欺の実行に必要なインフラをまるごと簡単にレンタルすることが可能です。新規参入した犯罪者が攻撃活動を自力で実行する技術力を持たない場合でも、容易にサイバー犯罪を実行できてしまいます。

ドライブバイダウンロード Web ツールキットが、年中無休 24 時間のサポートと更新を含めて、1 週間あたり 100 ドルから 700 ドルでレンタルすることができます。オンラインバンクを狙うマルウェア SpyEye（Trojan.Spyeye として検出）の 6 カ月リース価格は 150 ドルから 1,250 ドル、分散型サービス拒否（DDoS）攻撃の 1 日あたりの価格は 10 ドルから 1,000 ドルです。買い手の金銭的利益に直結するあらゆる商品やサービスの市場価格は、安定を保持しています。

不正バウチャーやチケットで利益をあげる
サイバー犯罪者は、利益をあげるための新しい手口を常に考え出します。現在多く利用されているのはバウチャーやオンラインギフトカードで、これはオンラインで簡単に売買できるからです。攻撃者は、バウチャーやオンラインギフトカードを、盗難クレジットカードを使用して購入したり、乗っ取ったオンラインストアアカウントから作成したりします。その後、正規価格の 50% から 65% で販売するのです。また、ホテル、航空機、電車のチケットを本来の希望価格の約 10% で販売することもできます。もちろん、このようなチケットを購入するのは非常に危険です。先日、国際的な摘発作戦によって、偽造チケットを使用したか、または盗難クレジットカード情報を入手して航空券を購入した疑いで 118 名が逮捕されました。航空業界では、不正チケットによって年間 10 億ドル前後の損失が発生していると考えられています。

代理人が商品を転送するなどの古い手口は、あまり使われなくなってきています。盗難クレジットカードで購入した高価な商品を無関係の協力者に発送し、受け取った協力者が攻撃者の匿名私書箱に転送するという手口です。多くの小売店では発送先をクレジットカードに登録された自宅住所に限っているため、この方法は難しくなりつつあります。このため一部の攻撃者は、商品をどこかに配送させるのではなく、近所の店舗で商品を受け取るようになってきたようです。

拡大するアンダーグラウンド市場
アンダーグラウンド市場で販売されているのは、これらにとどまりません。次のような商品やサービスも販売されています。

身元詐称に利用できるパスポート現物のスキャン画像（1 ドルから 2 ドル）
価値の高いバーチャルアイテムを取得可能できる盗難ゲームアカウント（10 ドルから 15 ドル）
ビットコインの支払先を攻撃者に書き換えて盗み取るツールなど、カスタムのマルウェア（12 ドルから 3,500 ドル）
ソーシャルネットワークのフォロワー 1,000 名（2 ドルから 12 ドル）
コマンド & コントロール（C&C）サーバーのホストに利用できる盗難クラウドアカウント（7 ドルから 8 ドル）
確認済みの電子メールアドレス 100 万件宛てにスパムを送信（70 ドルから 150 ドル）
登録済みで有効化済みのロシアの携帯電話 SIM カード（100 ドル）

保護対策
アンダーグラウンド市場が活況を呈していることから、自分自身のデータや ID を保護することが一層重要になっています。さもないと、この休暇シーズンに個人情報がサイバー犯罪者の買い物に悪用されることにもなりかねません。

シマンテックは、次の基本的なセキュリティ対策を講じることをお勧めします。

常に強力なパスワードを使用し、決して複数の Web サイトで使いまわさない。
すべてのデバイス上のソフトウェアを定期的に更新して、攻撃者が既知の脆弱性を悪用することを防止する。
個人情報や口座情報を入力する際は、アドレスバーで鍵アイコンまたは「HTTPS」が使われていることを確かめ、その Web サイトがセキュアソケットレイヤー（SSL）証明書で暗号化されていることを確認する。疑わしい動作があったら、重要な情報をオンラインで送信する前に報告する。
ノートンセキュリティなどの総合的なセキュリティソフトウェアを使用して、自分自身をサイバー犯罪から保護する。
電子メールで送られてきたリンクや、ソーシャルネットワークに掲載されているリンクがどんなに魅力的でも不用意にクリックしない。嘘のようなうまい話には、たいてい裏がある。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Mercado negro oculto: Cresce por meio de dados roubados, malware e serviços de ataque

Hacker Medic December 10, 2014 No Comments

O mercado negro continua a properar após as grandes violações de dados. O preço de contas de e-mail roubadas caiu significativamente, mas o valor de outros bens e serviços ilegais se manteve estável.

Read More

Underground black market: Thriving trade in stolen data, malware, and attack services

Hacker Medic December 10, 2014 No Comments

The underground market is still booming after recent major data breaches. The price of stolen email accounts has dropped substantially, but the value of other illegal goods and services has remained stable.

Twitter Card Style:

summary

During the holiday season, shoppers scour the internet to find the best deals for the perfect gifts. Ordinary consumers aren’t the only ones looking for bargains at this time of year. A host of cybercriminals are looking to shop at other people’s expense and use underground marketplaces to buy and sell illegal goods and services. Stolen data, compromised online accounts, custom malware, attack services and infrastructure, fraudulent vouchers, and much more can be bought if you know where to go.

Prices for illegal goods and services can vary widely, depending on what’s offered, but bargains exist even for cybercriminals on the tightest budgets. Attackers can pick up stolen data and compromised accounts for less than a dollar. Larger services, such as attack infrastructure, can cost anything from a hundred dollars to a few thousand. However, considering the potential gains that attackers could make by using this infrastructure, the upfront cost may be worth it for them.

Considering all of the data breaches and point-of-sale (POS) malware incidents that occurred in the last 12 months, you may think that underground markets are flooded with stolen data, causing prices to drop. Interestingly enough, this does not seem to be the case for all illegal goods on these marketplaces.

Shopping in the underground
While some illegal marketplaces are viewable on the public internet, news coverage around underground sites has increased this year, forcing many scammers to move to darker parts of the internet. For example, some forums are now hosted on the anonymous Tor network as hidden services. Other markets are only accessible with an invitation and require a buy-in, which could involve money or goods—like 100 freshly stolen credit cards. Other markets are run on private chat rooms and have rigid vetting procedures for new users. In these closed circles, prices are usually much lower and the traded amount of goods or services is higher.

Stolen data for sale
Prices have dropped for some of the data offered, such as email accounts, but they remain stable for more profitable information like online bank account details. In 2007, stolen email accounts were worth between US$4 and $30. In 2008, prices fluctuated between $0.10 and $100. In 2009, the price hovered between $1 and $20. Today, you can get 1,000 stolen email accounts for $0.50 to $10. The latest pricing is a good indication that there is now oversupply and the market has adjusted accordingly.

Credit card information, on the other hand, has not decreased in value in recent years. In 2007, this information was advertised at between $0.40 and $20 per piece. How much you pay can depend on a number of factors, such as the brand of the card, the country it comes from, the amount of the card’s metadata provided, volume discounts, and how recently the card data was stolen. In 2008, the average asking price for credit card data was slightly higher–$0.06 to $30–and later in the year it rose to from $0.85 to $30. Today, prices for stolen credit card information range between $0.50 and $20. In general, credit card data prices have fallen slightly over the last few years, especially in cases where cybercriminals trade in bulk volumes.

Of course, we have no visibility into transactions and do not know how many buyers actually pay the upper end of the price range. The quality of the stolen goods is also questionable, as some sellers try to sell old data or resell the same data multiple times. This may also explain why there has been a boom in additional service offerings that verify that the seller’s accounts are still active or that a credit card has not yet been blocked. Most underground marketplaces even provide a guarantee for the data’s freshness and replace blocked credit cards within 15 minutes of purchase. As expected, where there is demand, someone will step in and address the gap in the market.

Attack services for hire
Crimeware-as-a-service has also become popular on underground marketplaces. Attackers can easily rent the entire infrastructure needed to run a botnet or any other online scams. This makes cybercrime easily accessible for budding criminals who do not have the technical skills to run an attack campaign on their own.

A drive-by download web toolkit, which includes updates and 24/7 support, can be rented for between $100 and $700 per week. The online banking malware SpyEye (detected as Trojan.Spyeye) is offered from $150 to $1,250 on a six-month lease, and distributed denial-of-service (DDoS) attacks can be ordered from $10 to $1,000 per day. Any product or service directly linked to monetary profit for the buyer retains a solid market price.

Cashing out with fraudulent vouchers and tickets
Cybercriminals are always coming up with new strategies to cash out their profits. Vouchers and online gift cards are currently in vogue, as they can easily be traded or sold online. Attackers pay for them using stolen credit cards or generate them from hijacked online retailer accounts. They then sell the vouchers and online gift cards for 50 to 65 percent of the nominal value. Cybercriminals can also sell hotel, airline, and train tickets for approximately ten percent of the original asking price. Of course, this is very risky for the people who buy these tickets. Recently, 118 people were arrested in a global operation on suspicion of using fake tickets or obtaining stolen card data to purchase airline tickets. The airline industry believes that fraudulent tickets are costing it around $1 billion annually.

Older methods such as packet re-sending agents have declined in popularity. This method involved buying expensive goods with stolen credit cards and having them shipped to an uninvolved volunteer, who then reships the goods to the attacker’s anonymous PO box. This is getting harder to do, as many shops will only ship to the registered home address of the credit card. This also led to some attackers picking up the items in a physical store nearby, rather than shipping them somewhere first.

The expansive underground marketplace
These examples aren’t the only goods and services on offer on underground marketplaces. Also for sale are:

Scans of real passports ($1 to $2), which can be used for identity theft purposes
Stolen gaming accounts ($10 to $15), which can yield valuable virtual items
Custom malware ($12 to $3,500), for example tools for stealing bitcoins by diverting payments to the attackers
1,000 followers on social networks ($2 to $12)
Stolen cloud accounts ($7 to $8), which can be used for hosting a command-and-control (C&C) server
Sending spam to 1 million verified email addresses ($70 to $150)
Registered and activated Russian mobile phone SIM card ($100)

Protection
The booming underground marketplace is another reason it’s important to protect your data and identity. Otherwise, you may find your personal information in the shopping basket of a cybercriminal during this holiday season.

Symantec recommends the following basic security guidelines:

Always use strong passwords, and never reuse them across other websites.

Update the software on all of your devices regularly to prevent attackers from exploiting known vulnerabilities.
When entering personal or financial information, ensure that the website is encrypted with a Secure Sockets Layer (SSL) certificate by looking for the padlock icon or “HTTPS” in the address bar. Report any suspicious behavior before submitting sensitive information online.
Use comprehensive security software, such as Norton Security, to protect yourself from cybercriminals.
Exercise caution when clicking on enticing links sent through emails or posted on social networks. If something looks too good to be true, then it likely is.

¿Cuánto cuestan los datos robados y servicios de ataque en el mercado clandestino?

Hacker Medic December 10, 2014 No Comments

Como resultado de las numerosas fugas de datos registradas en los últimos meses, el mercado clandestino de información sigue en auge y, si bien el precio de las cuentas de correo electrónico robadas ha bajado de forma importante, el valor de otros datos y

Twitter Card Style:

summary_large_image

Durante la temporada de vacaciones, los compradores buscan en Internet las mejores ofertas para encontrar el regalo perfecto. Sin embargo, los compradores en línea no son los únicos que buscan gangas en esta época del año; los ciberdelincuentes también, aunque ellos, a expensas de los demás. Los delincuentes de Internet utilizan el mercado clandestino para comprar y vender bienes y servicios ilegales, como datos robados, cuentas comprometidas en línea, malware personalizado, servicios e infraestructura de ataque, cupones fraudulentos y mucho más.

Los precios de los bienes y servicios ilegales llegan a variar ampliamente dependiendo de lo que se ofrece pero pueden satisfacer a los ciberdelincuentes que tengan poco presupuesto, ya que, por ejemplo, se pueden obtener datos robados y cuentas comprometidas por menos de un dólar. Servicios más grandes, tales como infraestructuras de ataque, pueden costar desde unos cientos de dólares hasta miles de ellos. Sin embargo, considerando los beneficios potenciales que los atacantes podrían tener mediante el uso de esta infraestructura, el costo inicial puede valer la pena para ellos.

Tomando en cuenta todas las fugas y violaciones de datos, así como los incidentes relacionados con malware en puntos de venta (PoS) que han tenido lugar en el último año, se podría pensar que el mercado clandestino está inundado con información robada, haciendo que los precios bajen, pero, curiosamente, este no parece ser el caso para todos los bienes ilegales que se anuncian en dicho mercado.

Compras clandestinas

Mientras que algunos mercados ilegales son visibles en el Internet público, la cobertura de noticias en la prensa sobre los sitios clandestinos ha aumentado este año, lo que ha obligado a muchos estafadores a moverse a lugares más oscuros de la web. Por ejemplo, algunos foros están alojados en la red anónima Tor como servicios ocultos. Otros mercados solo son accesibles a través de una invitación y requieren un pago inicial, lo que podría implicar dinero o bienes como 100 tarjetas de crédito recién robadas. Algunos más se ejecutan en salas de chat privadas que realizan investigación de antecedentes para que los usuarios puedan unirse. En estos círculos cerrados, los precios son generalmente mucho más bajos y el monto negociado de bienes o servicios es mayor.

Datos robados a la venta

Los precios han caído para cierta información que se vende, tal como las cuentas de correo electrónico; otras se mantienen estables para obtener información más rentable como detalles de cuentas bancarias en línea. En 2007, las cuentas de correo electrónico robadas valían entre $4 y $30 dólares (en Estados Unidos). Para el año siguiente, los precios fluctuaron entre $0.10 y $ 100 dólares. Ya en 2009, las ofertas estaban entre $1 y $20 dólares; hoy en día, se pueden conseguir 1,000 cuentas de correo electrónico robadas por $0.50 a $10 dólares. El rango de precios más reciente es un buen indicador de que hay un suministro abundante de datos robados disponibles, por lo que el mercado se ha ajustado.

La información de tarjetas de crédito, por otro lado, no ha disminuido en valor en los últimos años. En 2007, esta información se anunciaba entre $0.40 y $20 dólares por pieza. El precio depende de diferentes aspectos, como la marca de la tarjeta, el país de origen, la cantidad de metadatos proporcionados, descuentos por volumen y cómo fueron robados los datos de la tarjeta.

En 2008, el precio promedio de venta de datos de tarjetas de crédito era un poco más alto – $0.06 a $30 dólares – y más tarde subió a $0.85 y $30 dólares. Actualmente, el rango de precios para la información de tarjetas de crédito robadas es de entre $0.50 y $20 dólares. En general, los precios se han reducido ligeramente en los últimos años, especialmente en los casos en que los cibercriminales comercian paquetes de datos a granel.

Por supuesto, no sabemos si estas ventas realmente suceden o cuántos compradores pagan el extremo más alto de la escala de precios. Sin embargo, la calidad de los bienes robados es cuestionable, ya que algunos anunciantes tratan de vender datos antiguos o revender los mismos datos varias veces. Esto también puede explicar por qué se ha producido un auge en la oferta de servicios adicionales que verifican que las cuentas del vendedor están todavía activas o que la tarjeta de crédito no haya sido bloqueada. La mayoría de los mercados clandestinos incluso ofrecen una garantía de vigencia de los datos y reemplazo de tarjetas de crédito bloqueadas dentro de los primeros 15 minutos después de la compra. Como era de esperarse, en donde existe una demanda de algo, habrá alguien que lo venda.

Renta de servicios de ataque

El crimeware-como-servicio también se ha vuelto popular en los mercados clandestinos. Los atacantes pueden alquilar fácilmente toda la infraestructura necesaria para armar un botnet o cualquier otro tipo de ataque o estafa en línea. Esto hace que la delincuencia informática sea de fácil acceso para los cibercriminales que no tienen la capacidad técnica para generar una campaña de ataque por su propia cuenta.

Por ejemplo, un manual descargable drive-by, que incluye actualizaciones y soporte 24/7, se puede alquilar por entre $100 y $700 dólares por semana. El malware para banca en línea, SpyEye (detectado como Trojan.Spyeye) se ofrece a partir de $150 y hasta $1,250 dólares en un contrato de arrendamiento de seis meses y ataques de negación de servicio (DDoS) se pueden pedir a partir de $10 a $1,000 dólares por día. Esto demuestra que cualquier producto o servicio directamente vinculado a un beneficio monetario para el comprador, sigue siendo un objeto de deseo con un precio sólido en el mercado.

Obteniendo dinero con cupones y boletos fraudulentos

Los criminales cibernéticos están siempre creando nuevas estrategias para cobrar las ganancias de sus ataques. Cupones y tarjetas de regalo en línea son las más comunes para este propósito, ya que pueden cambiarse o venderse fácilmente en Internet. Los atacantes pagan por ellos con tarjetas de crédito robadas o las generan desde cuentas de tiendas secuestradas en línea. Después, ofrecen los cupones y/o las tarjetas de regalo en Internet, al 50% o 65% del valor nominal. Los cibercriminales también venden boletos de hotel, tren o avión a 10% del precio original. Por supuesto, esto es muy riesgoso para las personas que compran estos boletos. Hace algunos días, 118 personas fueron detenidas en todo el mundo bajo la sospecha de uso de boletos falsos y/o por obtener datos de tarjetas robadas para comprar boletos de avión. La industria aérea sospecha que, al año, los boletos fraudulentos están causando cerca de mil millones de dólares en daños y perjuicios para las aerolíneas.

La popularidad de métodos más antiguos, tales como agentes de re-envío de paquetes ha disminuido. Este método consiste en la compra de productos caros con tarjetas de crédito robadas, que los delincuentes envían a un voluntario no involucrado, quien manda de vuelta las mercancías al apartado postal anónimo del atacante. Sin embargo, esto se ha vuelto algo complicado de realizar, ya que muchas tiendas sólo envían al domicilio registrado o asociado con la tarjeta de crédito, lo que ha generado que algunos atacantes prefieran pasar por los artículos en una tienda física cercana, en lugar de enviarlos a otra dirección.

Mercado clandestino en crecimiento

Los ejemplos y datos de los que hemos hablado, no son los únicos bienes y servicios que se ofrecen en el mercado clandestino, también se han identificado:

Pasaportes reales escaneados que pueden ser utilizados con fines de robo de identidad ($1 a $2 dólares)
Cuentas de juegos en Internet que pueden llevar a obtener artículos virtuales valiosos ($12 a $3,500 dólares)
Malware personalizado para robar bitcoins, reemplazando carteras en la memoria
1,000 seguidores en las redes sociales ($2 a $12 dólares)
Cuentas en la nube robadas para hospedar un servidor de comando y control (C&C) ($7 a $8 dólares)
Enviar spam a 1 millón de direcciones de correo electrónico verificadas ($70 a $150 dólares)
Registrar y activar la tarjeta SIM de un teléfono móvil ruso ($100 dólares)

¿Cómo protegerse?

El auge del mercado clandestino es una razón más que pone en evidencia la importancia de proteger nuestros datos y nuestra identidad. De lo contrario, posiblemente nuestra información personal quede a disposición de un criminal cibernético durante esta temporada de vacaciones o en cualquier época del año.

Por eso, Symantec recomienda los siguientes lineamientos básicos de seguridad:

Utilizar siempre contraseñas seguras y únicas, nunca reutilizarlas en otros sitios web
Actualizar el software en todos nuestros dispositivos con regularidad para evitar que los atacantes exploten vulnerabilidades conocidas
Al teclear o dar información personal o financiera, hay que asegurarse de que el sitio web está encriptado con un SSL (Secure Sockets Layer), verificando el ícono del candado o “https” en la barra de direcciones. Se recomienda reportar cualquier comportamiento sospechoso antes de enviar información confidencial en línea.
Usar software de protección integral, más allá de un antivirus, como por ejemplo Norton Security, para reducir los riesgos de un ataque de la ciberdelincuencia.
Tener cuidado al hacer clic en enlaces o ligas enviadas a través de correos electrónicos o publicadas en redes sociales. Si algo parece demasiado bueno para ser verdad, entonces probablemente no lo sea.

Infograph DatosMercadoClandestino LR.jpg

?? ?? ????? ???? ???? ?? ???, ?? ??, ?? ???

Hacker Medic December 10, 2014 No Comments

최근 대형 데이터 유출 사고에도 불구하고 지하 경제 시장은 여전히 호황을 누리고 있습니다. 훔쳐낸 이메일 계정은 값이 대폭 하락했지만, 다른 불법 상품 및 서비스는 여전히 안정적인 가격으로 거래되고 있습니다.

Read More

Microsoft Patch Tuesday – December 2014

Hacker Medic December 9, 2014 No Comments

This month the vendor is releasing seven bulletins covering a total of 24 vulnerabilities. Thirteen of this month’s issues are rated ‘Critical’.

Twitter Card Style:

summary

Hello, welcome to this month’s blog on the Microsoft patch release. This month the vendor is releasing seven bulletins covering a total of 24 vulnerabilities. Thirteen of this month’s issues are rated ’Critical’.

As always, customers are advised to follow these security best practices:

Install vendor patches as soon as they are available.
Run all software with the least privileges required while still maintaining functionality.
Avoid handling files from unknown or questionable sources.
Never visit sites of unknown or questionable integrity.
Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the December releases can be found here:
http://technet.microsoft.com/en-us/security/bulletin/ms14-dec

The following is a breakdown of the issues being addressed this month:

MS14-075 Vulnerabilities in Microsoft Exchange Server Could Allow Security Feature Bypass (3009712)

Outlook Web Access Token Spoofing Vulnerability (CVE-2014-6319) MS Rating: Moderate

A token spoofing vulnerability exists in Exchange Server when Microsoft Outlook Web Access (OWA) fails to properly validate a request token.

OWA XSS Vulnerability (CVE-2014-6325) MS Rating: Important

An elevation of privilege vulnerability exists when Microsoft Exchange Server does not properly validate input. An attacker who successfully exploited this vulnerability could run script in the context of the current user.

OWA XSS Vulnerability (CVE-2014-6326) MS Rating: Important

An elevation of privilege vulnerability exists when Microsoft Exchange Server does not properly validate input. An attacker who successfully exploited this vulnerability could run script in the context of the current user.

Exchange URL Redirection Vulnerability (CVE-2014-6336) MS Rating: Important

A spoofing vulnerability exists in Microsoft Exchange when Microsoft Outlook Web Access (OWA) fails to properly validate redirection tokens.
MS14-080 Cumulative Security Update for Internet Explorer (3008923)

Internet Explorer Memory Corruption Vulnerability (CVE-2014-6327) MS Rating: Critical

A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

Internet Explorer Memory Corruption Vulnerability (CVE-2014-6329) MS Rating: Critical

A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

Internet Explorer Memory Corruption Vulnerability (CVE-2014-6330) MS Rating: Critical

A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

Internet Explorer Memory Corruption Vulnerability (CVE-2014-6366) MS Rating: Critical

A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

Internet Explorer Memory Corruption Vulnerability (CVE-2014-6369) MS Rating: Critical

A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

Internet Explorer Memory Corruption Vulnerability (CVE-2014-6373) MS Rating: Critical

A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

Internet Explorer Memory Corruption Vulnerability (CVE-2014-6374) MS Rating: Critical

A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

Internet Explorer Memory Corruption Vulnerability (CVE-2014-6375) MS Rating: Critical

A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

Internet Explorer Memory Corruption Vulnerability (CVE-2014-6376) MS Rating: Critical

A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

Internet Explorer Memory Corruption Vulnerability (CVE-2014-8966) MS Rating: Critical

A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

XSS Filter Bypass Vulnerability in Internet Explorer (CVE-2014-6328) MS Rating: Important

An XSS filter bypass vulnerability exists in the way Internet Explorer disables an HTML attribute in otherwise appropriately filtered HTTP response data. This vulnerability could allow initially disabled scripts to run in the wrong security context, leading to information disclosure.

XSS Filter Bypass Vulnerability in Internet Explorer (CVE-2014-6365) MS Rating: Important

An XSS filter bypass vulnerability exists in the way Internet Explorer disables an HTML attribute in otherwise appropriately filtered HTTP response data. This vulnerability could allow initially disabled scripts to run in the wrong security context, leading to information disclosure.

Internet Explorer ASLR Bypass Vulnerability (CVE-2014-6368) MS Rating: Important

A security feature bypass vulnerability exists when Internet Explorer does not use the Address Space Layout Randomization (ASLR) security feature, allowing an attacker to more reliably predict the memory offsets of specific instructions in a given call stack. This vulnerability could allow an attacker to bypass the Address Space Layout Randomization (ASLR) security feature.

VBScript Memory Corruption Vulnerability (CVE-2014-6363) MS Rating: Critical

A remote code execution vulnerability exists in the way that the VBScript engine, when rendered in Internet Explorer, handles objects in memory. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
MS14-081 Vulnerabilities in Microsoft Word and Microsoft Office Web Apps Could Allow (3017301)

Index Remote Code Execution Vulnerability (CVE-2014-6356) MS Rating: Critical

A remote code execution vulnerability exists in the way that Microsoft Word does not properly handle objects in memory while parsing specially crafted Office files. System memory may be corrupted in such a way that an attacker could execute arbitrary code.

Use After Free Word Remote Code Execution Vulnerability (CVE-2014-6357) MS Rating: Critical

A remote code execution vulnerability exists in the way that Microsoft Word does not properly handle objects in memory while parsing specially crafted Office files. System memory may be corrupted in such a way that an attacker could execute arbitrary code.
MS14-082 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3017349)

Microsoft Office Component Use After Free Vulnerability (CVE-2014-6364) MS Rating: Important

A remote code execution vulnerability exists in the context of the current user that is caused when Microsoft Word does not properly handle objects in memory while parsing specially crafted Office files.
MS14-083 Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (3017347)

Global Free Remote Code Execution in Excel Vulnerability (CVE-2014-6360) MS Rating: Important

A remote code execution vulnerability exists in the way that Microsoft Excel does not properly handle objects in memory while parsing specially crafted Office files. System memory may be corrupted in such a way that an attacker could execute arbitrary code.

Excel Invalid Pointer Remote Code Execution Vulnerability (CVE-2014-6361) MS Rating: Important

A remote code execution vulnerability exists in the way that Microsoft Excel does not properly handle objects in memory while parsing specially crafted Office files. System memory may be corrupted in such a way that an attacker could execute arbitrary code.
MS14-084 Vulnerability in VBScript Scripting Engine Could Allow Remote Code Execution (3016711)

VBScript Memory Corruption Vulnerability (CVE-2014-6363) MS Rating: Critical

A remote code execution vulnerability exists in the way that the VBScript engine, when rendered in Internet Explorer, handles objects in memory. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
MS14-085 Vulnerability in Microsoft Graphics Component Could Allow Information Disclosure (3013126)

Information Disclosure Vulnerability (CVE-2014-6355) MS Rating: Important

An information disclosure vulnerability exists in the Microsoft Graphics Component that could allow an attacker to more reliably predict the memory offsets of specific instructions in a given call stack. The vulnerability is caused when the Microsoft Graphics Component improperly handles the decoding of JPEG images in memory. An attacker could use this information disclosure vulnerability to gain information about the system that could then be combined with other attacks to compromise the system.

More information on the vulnerabilities being addressed this month is available at Symantec’s free SecurityFocus portal and to our customers through the DeepSight Threat Management System.

Destover: ???????????????????????????

Hacker Medic December 9, 2014 No Comments

Destover のいくつかのサンプルは Volgmer と C&C サーバーを共用しており、Jokra や Shamoon との類似点も見られます。

Twitter Card Style:

summary

Destover 1 edit.jpg

FBI は先週、Backdoor.Destover という破壊的なマルウェアに対する緊急警告を発表しました。Destover には、韓国を標的とした過去の攻撃といくつか共通点が見られます。Destover のいくつかのサンプルで使われているコマンド & コントロール（C&C）サーバーは、韓国内の標的を攻撃するために作成された、Trojan.Volgmer のあるバージョンで使われていたものと同じです。C&C サーバーが共用されていることで、この 2 つの攻撃の背後に同じグループが存在する可能性が浮上します。

Volgmer は標的型のマルウェアです。おそらく単一のグループが第 1 段階の偵察ツールとして限定的な攻撃に使用していると思われ、システム情報を収集し、さらに別のファイルをダウンロードして実行することができます。重要なのは、Destover と C&C サーバーを共用するバージョンの Volgmer は、特に韓国の標的を攻撃するよう設定されていて、韓国語版のコンピュータ上でのみ実行されることです。

また、Destover では、2013 年に発生した韓国に対する Jokra 攻撃と同じ手口やコンポーネント名も使われています。しかし、現時点では、これらの攻撃のつながりを示す確かな証拠は見つかっておらず、模倣犯である可能性も捨てきれません。さらには、Shamoon 攻撃との共通点も見られ、どちらの攻撃でも市場で入手可能な同一のドライバが利用されています。しかし、両者の背後に同一のグループが存在する可能性はきわめて低く、むしろ Destover 攻撃が Shamoon 攻撃の手口を真似たのでしょう。

Destover の活動
Destover は、特に大きな破壊力を備えたマルウェアであり、感染先のコンピュータの内容を完全に消去することが可能です。FBI の緊急警告でもこのことに触れられており、ある目立った攻撃において、少なくとも 1 つの Destover の亜種が利用されたと考えられています。

Destover に関する FBI の報告書には、いくつかの悪質なファイルが記載されています。

diskpartmg16.exe
net_ver.dat
igfxtrayex.exe
iissvr.exe

感染したコンピュータで最初に作成されるファイルが diskpartmg16.exe で、このファイルが実行されると、net_ver.dat および igfxtrayex.exe が作成されます。

「diskpartmg16.exe」は、実行されると、ある IP アドレス範囲内で特定の多数の IP アドレスに接続するとともに、「USSDIX[コンピュータ名]」という形式のコンピュータ名に接続します。つまり、この Destover の亜種は無差別な攻撃を意図したものではなく、特定の組織に所属するコンピュータのみを攻撃するよう設定されているのです。

Destover の破壊的なペイロードは igfxtrayex.exe によって配信され、igfxtrayex.exe は、実行されると、次のような操作を実行する場合があります。

固定ドライブおよびリモートドライブ上のすべてのファイルを削除する
パーティションテーブルを改ざんする
追加モジュール（iissvr.exe）をインストールする
ポート 8080 と 8000 で多数の IP アドレスに接続する

一方、Iissvr.exe は、ポート 80 で待機するバックドアです。攻撃者が侵入先のコンピュータに接続したときに、次のメッセージを表示します。

“We’ve already warned you, and this is just a beginning.

We continue till our request be met.

We’ve obtained all your internal data including your secrets and top secrets.

If you don’t obey us, we’ll release data shown below to the world.

Determine what will you do till November the 24th, 11:00 PM(GMT).

Post an email address and the following sentence on your twitter and facebook, and we’ll contact the email address.

Thanks a lot to God’sApstls [sic] contributing your great effort to peace of the world.

And even if you just try to seek out who we are, all of your data will be released at once.”

（今まで警告してきたが、これは始まりに過ぎない。

要求が叶えられるまで攻撃を継続する。

機密情報や極秘情報など、あらゆる内部データを入手済みだ。

要求に従わない場合、以下のデータを全世界に公開する。

11 月 24 日午後 11 時（GMT）までに、どうするか決めろ。

電子メールアドレスと次の文章を Twitter と Facebook に投稿すれば、こちらからメールで連絡する。

世界平和のために多大な貢献をした God’sApstls（原文ママ）に深く感謝する。

我々の身元を詮索しようとしただけでも、全データをただちに公開する）

Volgmer とのつながり
Destover のいくつかのサンプルは、過去に Trojan.Volgmer の複数の亜種によって使われた C&C サーバーに接続します。シマンテックは数カ月にわたって Trojan.Volgmer を追跡してきました。Volgmer は、感染先のコンピュータでバックドアを開く機能を備えているため、C&C サーバーと通信して、システム情報の取得、コマンドの実行、ファイルのアップロード、ファイルのダウンロードと実行などの操作を行うことができます。

興味深いことに、Destover と C&C サーバーを共用する Volgmer の亜種は、侵入先のコンピュータの地域設定が「韓国」でない場合には実行を停止するよう設定されています。

Jokra とのつながり
Destover の攻撃者が使用しているファイル名などのコンポーネントや手口は、2013 年に発生した韓国に対する Jokra 攻撃と類似しています。Jokra 攻撃では韓国の銀行や放送局などのサーバーが停止したほか、通信会社の Web サイトが改ざんされました。

Jokra 攻撃で使われたマルウェアに含まれているコードは、指定した期間が経過するまではハードディスクドライブの消去を開始しません。Destover もまた、時間を置いてデータ消去を実行するよう設定されています。さらに、韓国での報道によると、2 つの攻撃で類似する多数のファイル名が利用されているようです（リンク先は韓国語）。

Shamoon 攻撃との類似点
また、Destover には、Shamoon 攻撃との共通点もいくつか見られ、Destover と Shamoon の攻撃者によって使われているマルウェア（W32.Disttrack）は、一部のドライバを共用しています。これらは悪質なファイルではなく、市場で入手可能なドライバです。Destover と Disttrack はどちらも破壊的なマルウェアですが、両者の背後に同一のグループが存在することを示す証拠はありません。

シマンテックの保護対策
シマンテック製品およびノートン製品は、この脅威を Backdoor.Destover として検出します。

Mind the gap: Are air-gapped systems safe from breaches?

Hacker Medic December 5, 2014 No Comments

Recent research has suggested several ways air-gapped networks could be compromised, but how realistic are these attack scenarios?

Twitter Card Style:

summary

Contributor: Candid Wueest

Industries that deal with sensitive information rely heavily on air-gapped systems to protect their critical data. However, while these systems are more secure than most others, there are ways to compromise them, potentially allowing attackers to steal the affected organizations’ highly sensitive data. From radio signal-emitting graphics cards to computers communicating through their speakers, are air gaps, once considered the Fort Knox of security measures, beginning to show cracks?

An air gap is a security measure that protects critical data by keeping one or more computers isolated from other unsecured networks, such as the internet, for example. System administrators may choose to air gap military systems, computerized medical systems, and control centers of critical infrastructure in order to protect data from attacks. Unfortunately, no system is 100 percent secure and there will always be a way to chip away at defenses. Several research reports have been making the news recently concerning ways in which air-gapped systems can be breached. Although some of the methods sound like they were taken straight out of a science fiction story, security researchers have definitely taken up the challenge of bridging the air gap.

Problems for would-be attackers
If an attacker wishes to breach an air-gapped system, they face three major hurdles:

Compromising a computer within the isolated network
To breach an air-gapped system, the attacker needs to infect at least one of the air-gapped computers with malware. This could be done by using an insider in the targeted firm or an outsider, such as a consultant, who may be able to get access to the isolated area and use a malware-infected USB drive to compromise the computer. Air-gapped computers could also be compromised in supply chain attacks, where the computer’s components are intercepted and tampered with during the manufacturing or shipping processes.
Sending commands to the compromised computer
Once a computer has been compromised, the attacker has to figure out how to send commands and updates to the malware. Normally, this would be conducted over the internet; however, anyone interested in taking on an air-gapped system needs to use a little more creativity.
Exfiltrating data from the compromised computer
Unless the attacker only wants to cause some damage, they’ll need to find a way to exfiltrate the stolen data from the air-gapped network.

Let’s get creative
In light of these challenges, let’s take a look at some of the recent air-gap attack research reports and talk about how much of a realistic threat, if any, each method poses and what can be done to stay protected.

Turn on, tune in, get the data out
Researchers have recently proved how it’s possible to exfiltrate data from an air-gapped network by using FM radio signals sent from a computer’s graphics card. The researchers’ created proof-of-concept malware called AirHopper that uses the computer’s video display adapter to broadcast FM-compatible radio signals to a device with an FM receiver. The researchers were able to create an image pattern that generates a carrier wave modulated with a data signal. The image sent to the computer monitor looks indistinguishable from regular visual output but contains extra data that is transmitted as FM radio signals.

Attackers using this technique could infect computers with malware using USB devices or by way of supply-chain tampering. As for the receiver, this could be any modern smartphone, as most contain built-in FM receivers. The smartphone could belong to someone involved in the attack or someone who has had their device compromised. As smartphones are connected to the internet, they would be easier to compromise than a computer in an air-gapped network through a range of techniques like compromised websites or malicious emails.

The receiver needs to be within eight yards (seven meters) of the broadcasted radio signals in order to work. The researchers say they can transmit about 13 to 60 bytes a second in their tests, which is more than enough data to include login credentials and other sensitive information. For instance, an attacker with a receiver would only need to be in range of the compromised computer’s monitor for roughly eight seconds to download a 100-byte password file.

The technique is similar to how TEMPEST attacks are carried out; however, a TEMPEST attack only allows the attacker to spy on what is being displayed on the computer’s monitor.

Real world implications and mitigation
This technique is the most plausible for data exfiltration. Compromising smartphones is something that is well within the capabilities of cybercriminals and nation states, so exfiltrating the stolen data would not be a major hurdle. When it comes to mitigation, banning the use of mobile devices within a certain range of the air-gapped system may be one solution. However, if that is impractical, the use of electromagnetic shielding would stop any signals being transmitted from the isolated network.

Whispering malware
A recent research report detailed a system that uses inaudible sound as a means of communication, allowing data to be passed between computers that have no network connection. The researchers developed a proof-of-concept program that uses the built-in microphones and speakers found in many computers to transmit small amounts of data over a distance of roughly 65 feet (20 meters). However, this distance could be extended by a great deal using what the researchers call an acoustical mesh network of compromised computers that effectively relay the data to each other.

As most adults can hear sounds between 100Hz and 20kHz, anything outside of this range should be inaudible. According to the researchers, most commercial soundcards operate at a frequency of 48kHz though in their tests, most speakers wouldn’t work above 23kHz. This meant that the researchers needed to transmit at a frequency somewhere in the rage of 20kHz to 23kHz.

The scientists experimented with several different methods to send data between two laptops using only sound. The most effective method used a system originally developed to acoustically transmit data under water, called the adaptive communication system (ACS) modem. Bridging air-gapped systems using this method, however, only provides a bitrate of about 20 bits per second. As with the other method described in this blog, this relatively tiny transmission rate rules out the exfiltration of large files such as documents and images but does feasibly allow for sensitive data to be sent, such as passwords or encryption keys.

Real world implications and mitigation
Depending on whether or not computers within the air-gapped network are fitted with speakers and microphones, this technique could pose a moderate threat. However, as the researchers themselves note, there are several possible ways in which this type of attack vector can be mitigated. Disabling audio output and input devices is perhaps the most obvious countermeasure. The researchers recommend that system administrators should not fit air-gapped computers with audio output hardware to begin with. If needed, users could use headphones; however, these would need to be disconnected when not in use as they too can be used to transmit.

Operators could employ the use of audio filtering to block sound in a specific frequency range on air-gapped computers to avoid attacks. Finally, the researchers suggest the use of an audio intrusion detection guard that would analyze audio input and output and raise a red flag if it detects anything suspicious.

A more elaborate air-gap compromise: Dots, dashes, drones, and printers
Recent research presented at the 2014 Black Hat Europe conference showed how a malware-infected computer on an air-gapped network could receive and send attack commands through a multi-function printer’s scanner that the computer is connected to. To transmit data, an attacker would need to shine light, visible or infrared, into the room where the scanner is and while a scan is in progress.

The researchers devised a system to send and receive binary data using Morse code and say that several hundred bits can be sent during one scan, plenty to contain commands for the malware. Detecting the light from far away would be a problem but the researchers say this can be made easier with the use of a quadcopter drone.

An attacker could use a laser to send data from up to five kilometers away, although the researchers only tested the method up to 1,200 meters. An infected computer could be made to initiate a scan at a certain time or the attacker could wait until someone uses the scanner.

Real world implications
This method doesn’t pose much of a threat to air-gapped networks as it relies on several conditions being just right for it to work. Firstly, a successful breach would rely on there being a multifunction printer with a scanner connected to the isolated network and secondly, the scanner would need to be open or at least in use. But the most glaring problem with this attack technique is that if there is no window in the room where the isolated system is contained, it’s back to the drawing board for our would-be attackers.

Mind the gap
Air gaps are considered to be a reliable way to secure sensitive data and systems but no system is without its weaknesses. The examples discussed in this blog are all related to work carried out by security researchers in an effort to raise awareness around potential security weaknesses in air-gapped networks. Luckily, these researchers present their work to the public so that relevant measures can be put in place to protect against the weaknesses they highlight. Unfortunately, cybercriminals don’t publish their work in scientific journals or give talks at security conferences, so we have no way of countering their attack techniques until they’re uncovered. If there’s one thing we can be sure of, it’s that the bad guys are always hard at work figuring out new ways to get to the stuff we don’t want them to reach.

??? ?? ?? ?? Destover? ???? ??? ??? ???

Hacker Medic December 4, 2014 No Comments

Destover의 일부 샘플이 Volgmer와 동일한 C&C 서버를 사용하며 Jokra 및 Shamoon과도 유사점이 있는 것으로 파악되었습니다

Twitter Card Style:

summary

Destover 1 edit.jpg

12월 첫 째주 FBI 긴급 경고(Flash Warning) 대상이었던 파괴력 강한 악성 코드 Backdoor.Destover와 앞서 한국에서 발생했던 공격 간에 몇 가지 공통점이 있습니다. 일부 Destover 샘플이 리포팅하는 C&C(명령 및 제어) 서버가 한국의 표적을 공격하기 위해 개발되었던 Trojan.Volgmer의 한 버전에서도 사용된 것입니다. 이러한 C&C 공유는 동일 조직이 두 공격의 배후에 있을 가능성을 시사합니다.

Volgmer는 일종의 표적 악성 코드로 단일 조직에서 사용하는 것으로 보입니다. 일부 한정된 공격에 동원되었으며 1단계 정찰 툴 역할을 담당하는 것 같습니다. 이 악성 코드는 시스템 정보를 수집하고 추가 실행 파일을 다운로드하는 데 이용될 수 있습니다. 특히 Destover와 동일한 C&C를 사용하는 Volgmer 버전은 한국의 표적을 공격하도록 구성되었으며 한국에 있는 시스템에서만 실행됩니다.

Destover는 2013년에 한국에서 발생한 Jokra 공격과도 몇 가지 기술 및 구성 요소 이름이 동일합니다. 그러나 아직 이들을 연결시킬 만한 명확한 증거는 없으며, 모방 범죄의 가능성도 배제할 수 없습니다. Shamoon 공격과도 연관성이 있는데, 두 공격에서 모두 동일한 상용 드라이버를 사용한 것입니다. 두 공격의 배후 조직이 동일할 가능성은 낮지만, Destover 분석을 통해 확인된 공격 기법은 Shamoon에서 사용된 기법들을 모방한 것처럼 보일 정도로 유사합니다.

Destover 현황
Destover는 감염된 시스템을 완전히 지울 수 있기 때문에 큰 피해를 야기시키는 악성 코드 유형입니다. 이 악성 코드의 변종 중 하나 이상이 잘 알려진 공격에 사용된 것으로 확인되자 FBI는 지난 주에 긴급 경보를 발효하기도 했습니다.

아래와 같은 몇 가지 악성 파일이 FBI Destover 보고서에서 언급된 내용과 연관되어 있습니다.

diskpartmg16.exe
net_ver.dat
igfxtrayex.exe
iissvr.exe

Diskpartmg16.exe는 감염된 시스템에서 맨 처음 생성되는 파일입니다. 이 파일이 실행되면 net_ver.dat와 igfxtrayex.exe라는 파일이 만들어집니다.

“diskpartmg16.exe”가 실행되면서 일련의 IP 범위에 속하는 다수의 특정 IP 주소 및 “USSDIX[시스템 이름]” 형식의 시스템 이름과 연결됩니다. 따라서 이 Destover 변종은 무차별적 공격을 위한 것이 아니며 어느 한 조직의 시스템만 공격하도록 구성된 악성 코드임을 알 수 있습니다.

Destover의 파괴적인 페이로드는 igfxtrayex.exe에 의해 전달됩니다. 실행 시 경우에 따라 아래와 같은 결과가 나타납니다.

고정 드라이브 및 원격 드라이브의 모든 파일 삭제
파티션 테이블 수정
추가 모듈(iissvr.exe) 설치
포트 8080 및 8000에서 다수의 IP 주소에 연결

한편 Iissvr.exe는 백도어로서 포트 80에서 수신 기능을 수행합니다. 공격자가 감염된 시스템과 통신하기 시작하면 이 파일은 아래와 같은 메시지를 표시합니다.

“우리는 이미 너희에게 경고했으며 이것은 시작일 뿐이다.

우리는 우리의 요구가 관철될 때까지 공격을 계속할 것이다.

우리는 너희의 비밀과 최고 기밀을 포함한 모든 내부 데이터를 확보했다.

우리의 요구를 따르지 않으면 아래와 같은 데이터를 세상에 공개할 것이다.

11월 24일, 11:00 PM(GMT)까지 어떻게 할 것인지 결정하라.

Twitter와 Facebook에 이메일 주소 하나와 다음 문장을 게재하면 그 주소로 연락하겠다.

세계 평화에 크게 이바지하는 God’sApstls(원문 그대로 표기)에게 감사한다.

우리의 정체를 밝히려는 시도만으로도 모든 데이터가 당장 공개될 것이다.”

Volgmer와의 연관성
시만텍이 분석한 일부 Destover 샘플은 과거 여러 Trojan.Volgmer 변종에서 사용했던 C&C 서버와 연관성이 있습니다. 시만텍은 몇 개월간 Trojan.Volgmer를 추적했습니다. Volgmer는 감염된 시스템의 백도어를 열 수 있는 보안 위협으로, 이를 통해 악성 코드가 C&C 서버와 통신하면서 시스템 정보를 검색하고 명령을 실행하며 파일을 업로드하고 실행 파일을 다운로드합니다.

흥미로운 것은 Destover와 같은 C&C 서버를 사용하는 Volgmer 변종이 감염된 시스템의 국가가 “한국”이 아닐 경우 실행을 종료하도록 구성되었다는 점입니다.

Jokra와의 연관성
Destover 공격자는 2013년에 한국에서 발생한 Jokra 공격과 유사한 기법과 구성 요소(예: 파일 이름)를 사용합니다. Jokra는 한국의 몇몇 은행과 방송사에서 서버 장애를 일으키고 한 한국 통신사의 웹 사이트를 손상시키기도 했습니다.

Jokra 공격에 이용된 악성 코드에는 지정된 기간이 만료되어야 하드 드라이브 지우기를 시작하는 코드가 들어 있었습니다. 또한 Destover는 시간차를 두고 지우기를 수행하도록 구성되었습니다. 그 외에도 한국 언론 보도에 따르면, 두 공격에서 다수의 유사한 파일 이름이 사용되었습니다.

Shamoon 공격과의 유사점
Destover는 Shamoon 공격과도 몇 가지 공통점이 있습니다. Destover와 Shamoon 공격에 사용된 악성 코드(W32.Disttrack)는 몇몇 동일한 드라이버를 사용합니다. 이는 악성 파일이 아닌 상용 드라이버입니다. Destover와 Disttrack 모두 파괴적인 악성 코드이지만 두 공격의 배후 조직이 같다는 증거는 없습니다.

시만텍의 보호 방안
시만텍 및 노턴 제품은 이 보안 위협을 Backdoor.Destover로 탐지합니다.