Slashdot Log In
Trojan Analysis Leads To Russian Data Hoard
Posted by
kdawson
on Thu Mar 22, 2007 08:40 AM
from the Gozi-dissected dept.
from the Gozi-dissected dept.
Stolen Identity writes "An attack by a single Trojan variant compromises thousands, circumvents SSL, and uploads the results to a Russian dropzone server. A unique blow-by-blow analysis reveals evidence of cooperation between groups of malware specialists acting as service providers and points to the future of malware's growing underground economy."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
What About Firefox Users? (Score:5, Interesting)
- Steals SSL data using advanced Winsock2 functionality
- State-of-the-art, modularized trojan code
- Spread through IE browser exploits
- etc
...
When I read the Slashdot summary, I was initially concerned that I may be at risk. But then I noticed the above three lines and realized there was no risk since I don't use IE.But, in the end, if this is an exploit utilizing the very basic network DLL that windows provides for socket connections (Winsock2--which is what I assume all network applications eventually link against in Windows) then why aren't other browsers at risk?
I know Firefox is awesome & more secure & all that jazz but I haven't done enough network programming to know the nitty gritty details of it. Does anyone know why, if this trojan is exploiting the basic socket connection library that the Windows API provides, all browsers aren't potential victims?
I mean, it makes sense to introduce some sort of security that never ever lets anything but the browser's code access the interfaces to these libraries
Re:What About Firefox Users? (Score:5, Funny)
+2 funny
Parent
Re: (Score:3, Interesting)
Seriously, though, several things struck me. One was that a screenshot of the (malware) author's webpage showed that Firefox "support" was expected in a new release. Of course, I browse with NoScript enabled on a Macintosh which has been significantly tightened down. I regularly complain to sites that require users to have javascript enabled to do business with them and generally get favorable responses, especially when referring them to r
Speads!=Affects (Score:3, Informative)
Re: (Score:2)
Re:What About Firefox Users? (Score:5, Informative)
Parent
Re: (Score:3, Informative)
Well, it uses an IE browser exploit to get in, so if you don't uses IE, you're at low risk. But far be it from anyone to think that these crooks won't find a way to deliver the Trojan in another manner if their IE route dries up. Everyone will have to remain vigilant, because if it gets on your system, it can theoretically corrupt any browser.
Re:What About Firefox Users? (Score:5, Informative)
FireFox uses basic sockets and encrypts data using standalone SSL library.
Parent
M$ is just trouble. (Score:2)
The further away you get from M$, the better off you are. IE is the pits but other browsers on the platform will use M$'s flawed underlying code at times for compatibility. There are lots of IE specific bones on this one but once the machine is compromised anything is possible. You keep IE around for that one page that needs it, right? All it takes is a rotten banner ad to blow you out that one time you use it. M$'s internet services are starting to mirror their PC performance when it comes handing out [slashdot.org]
Re: (Score:2)
Would you like to cite an example of this, or are you just talking shite as usual? If you don't reply then it'll be fairly clear that it's the latter.
Examples where Mozilla uses M$. (Score:2, Informative)
The one I'm most familiar with is to get mail from Outlook to Thunderbird. M$'s own interface is terrible and forces the user to save each message as text one at a time with poor control of output location. Mozilla automates the use of the program called, but still uses the program.
You might also look at Mozilla's ActiveX [wikipedia.org]. While I'm sure it's much saner than the controls which were exploited in this threads topic, it's still a use of M$'s unsafe machinery.
Finally, even good code is more dangerous on Wi
Re: (Score:3, Interesting)
Monster of an article, so I don't blame anyone for not catching the details on this. What it boils down to is that IE exploits are the main propagation vector of Gozi, but its actual performance of nastiness does not necessarily rely on IE. Once it's installed and running, it will intercept and leak to its "mothership" any and all HTTP POSTs that go through WinSock2, no matter what browser they come from, because it manages to register itself as a "Layered Service Provider" sitting between the browser and t
Re: (Score:2)
The page included in this last IFRAME contained JavaScript code using XMLHTTP and ADODB (ActiveX Data Objects) functions to download and run an EXE file which was hosted on the same server.
Any browser with similar JS, XMLHTTP, and ADODB capability is susceptible as an infection vector. The system put in place by the EXE relies on common OS infrastructure.
The code reveals that calls to functions in ws2_32.dll are used to establish itself as an LSP (layered service provider) using the Winsock2 SPI (Service Provider Interface). It "goes in between" Internet Explorer and the socket used to send the data.
Do other browsers qualify for this? I see no objection.
This technique captures the data sent by Internet Explorer only. Many new authentication systems use AJAX, where JavaScript objects are used to create another HTTP session, send requests, and receive responses. This is implemented in code elsewhere, where the SSL sniffer component cannot see it. To capture this valuable data, Gozi includes a "grabs" module that hooks into the JavaScript engine...That page uses XMLHTTP to send form field data via an SSL-protected connection to the bank's authentication without having to refresh the page. The IE sniffer cannot see that, but the JavaScript sniffer can.
Okay, there's the exception. If you use IE then your data is nabbed. If your bank uses AJAX then your data is nabbed.
Note that because this trojan includes the capability to download and execute arbitrary code from untrusted sources, a complete rebuild of the infected PC is the only absolute way to ensure 100% confidence and trust in data and system integrity.
Unless it hides itself in auxiliary BIOSs as well.
Re: (Score:3, Insightful)
So the sense of security is the security risk there.
Re: (Score:2)
Go ahead. Call me a shill. But this is a massive handwave - what evidence is there that this executable was installed by a remote exploit? Is that evidence in any way bigger or more reliable than the usual "I don't know where that came from! I didn't download it!" from the machine's owner?
"Hey, Bob. All of your problems seem to ha
IP traceback (Score:2, Insightful)
Re:IP traceback (Score:4, Informative)
Parent
Possible solution... (Score:3, Funny)
I'm sure there are a million flaws in this idea, but it's a start.
Re:Possible solution... (Score:4, Insightful)
Parent
Re: (Score:3, Interesting)
I guess the major flaw would be that I could write code and report it ?
That had occurred to me; the reward, however, would likely not be enough to warrant writing a piece of genuinely new code.
If the case was genuine and one guy had written all the code, he would be getting paid for writing the code (by Mr. Big, presumably) *and* for blowing the lid on the whole thing (by the AV company). If someone writes the code for use by themselves, they either have to report it before it becomes prominent (and hence they don't make much money from the use of the code), or if they wait
headline strike again! (Score:5, Funny)
So the analysis led the the hoarding? Everybody stop analyzing NOW!
Re: (Score:3, Funny)
Hmm.. smth does not compute (Score:2, Interesting)
Where Russia came from?
Re: (Score:2, Informative)
I don't think so.. (Score:2)
inetnum: 81.95.144.0 - 81.95.147.255
role: RBusiness Network Registry
address: RBusiness Network
address: The Century Tower Building
address: Ricardo J. Alfari Avenue
address: Panama City
address: Republic of Panama
phone: +1 401 369 8152
e-mail: noc@rbnnetwork.com
admin-c: JK4668-RIPE
tech-c: JI424-RIPE
nic-hdl: RNR4-RIPE
mnt-by: RBN-MNT
Re: (Score:2)
I remember evil BBS guys were using hacked phone lines other side of Earth to do dirty jobs.
If I was an American black hat, I would learn Russian language or hire a Russian and act like Russia based which will provide another layer of security. I guess we have right to go paranoid in such issue
i'm in awe (Score:4, Insightful)
the mind boggles at what these men (or women) of such high craft could achieve were they to devote their genius to good efforts rather than bad. as it is, in the business they are in, they will probably very rapidly come under the thumb of the russian mafia, if they aren't already. then their life will be on a short leash, that, if they attempt to tug, will land them with a swift reprimand from guys you don't want to know what a swift reprimand from is like
sad. these are no script kiddies here. these are smart blokes. and they are also doomed to a life under the thumb of men a thousand times more evil than their devilish and brillaint exploits ever could be
Re: (Score:2)
Re: (Score:3, Interesting)
With a relatively small local software market as well as relatively small outsourcing market Russia (and to lesser extent Bulgaria and Romania) are ripe for the picking by the mafia. Most of the qualified software engineers who do this kind of work will very happily work on an outsourcing contract instead. Further to this, they are likely to deliver considerably better quality code than most Indian outsourcing shops (I have seen code and projects from both so this statement is b
that is sad (Score:2)
i ask in complete innocence, but sitting here in new york city, where we are n
Re: (Score:3, Informative)
Most Russian coders [in russia] are assholes and lazy, I am russian and grew up in Canada. I went to russia to work for a while, to see how it is. After all wages in moscow are 2000$+ so it I wasn't just surviving.
I was little dismayed at the experience being in russia, finding that while there are alot of brilliant coders, many are lazy and have too few team skills to be usable in a company. Another thing, russians are daring, so this sort of stuff comes up all the time. They
Re: (Score:2)
Re: (Score:3, Interesting)
Now I'm supposed to accept that these evil geniuses suddenly got retarded when it came to the common sense risks with their new business? They've developed a real cracker jack exploit of commercial quality able to mass infect systems, avoid tracing, the whole nine yards. They then market this to organized crime syndic
zzz (Score:3, Interesting)
however, i
Re: (Score:2)
Henry Hill: [narrating] Now the guy's got Paulie as a partner. Any problems, he goes to Paulie. Trouble with the bill? He can go to Paulie. Trouble with the cops, deliveries, Tommy, he can call Paulie. But now the guy's gotta come up with Paulie's money every week no matter what. Business bad? Fuck you, pay me. Oh, you had a fire? Fuck you, pay me. Place got hit by lightning huh? Fuck you, pay me."
thank you, and fgood quote (Score:2)
the problem with this world is the naive and clueless, yet full of bravado, happily waltzing into a world of crime, extremely confident in their ability to take care of themselves and to handle any bad news guys they encounter
they have no fucking clue
they simply wind up trapped and under the thumb of a guy who has no problem killing their wife or children or girlfriend or parents. and, trapped under that thumb, they sit their silently rueing their younger dumber selves, a yo
Re: (Score:2)
Sure. It's from Goodfellas [imdb.com], probably the best mafia film ever made. The commentary track on the DVD features the real Henry Hill talking about his life as dramatised by Scorcese in the film. He comes to the same conclusion you do for the same reasons - it's no kind of life for anyone.
Re: (Score:2)
Let me guess, you REALLY like cartoons?
Re: (Score:2)
Also in awe (Score:2)
reading that article is like looking at the blueprint for a neutron bomb: beautiful, magnificent, and pure evil
Indeed. Whoever wrote that (both the trojan and the article) knew quite a bit about the internal structures of Windows.
Check this out:
The malware opened the named pipe "\\.\PIPE\lsarpc" and the "C:\autoexec.bat" file, but the tools did not log any writes.
The tools were "a Windows XP VMware virtual machine with tools designed for behavioral analysis". A little further down:
Upack stub code is executed from the memory allocated for the executable's PE header. However, as it executes, that code changes, making normal breakpoints -- those set for certain code at certain addresses -- ineffective.
Whoever wrote that binary also knew quite a bit about the way the overall architecture of the x86 series running the Windows kernel can be used to hide between the cracks.
SecureWorks Senior Security Researcher Joe Stewart wrote OllyBonE (Break on Execute), a plug-in for OllyDbg that would be very useful. To use it, the malware executable would have to be moved out of the virtual machine and debugged on native hardware. A 750 MHz Pentium III and 512 MB RAM was loaded with a default install of Windows XP Professional SP2 in an isolated environment. OllyDbg, Joe's OllyBone plug-in, and the malware executable were copied to the system.
Now we're getting to the point:
After dismissing the error, execution is paused in ntdll.dll code. Upack must go back to the PE header for the working EXE file at some point, so bringing up the memory map (ALT+M) and right-clicking on that memory range brings up a context menu, where "Set breakpoint on execute" can be selected.
Single stepping.
There's an entire internet full o
Re: (Score:2)
http://news.com.com/2009-1017-250870.html [com.com]
http://www.f-secure.com/v-descs/hybris.shtml [f-secure.com]
When you look at detail, it is much more advanced than this trojan which does amazing things such as finding out the e-mail addresses via watching the communications just like Ethereal.
The genius of old time DOS viruses is IMHO
Who's the target customer? (Score:4, Insightful)
Re: (Score:2)
Eg. you are using a zombie computer, trying to check your balances. I get the data from the 100 zombies and I have your login data for your bank but about 50 other persons' data, I check your account see that 'you Americans' makes 20x as much as I do in a month.
I transfer 50x your paycheck to my 'business' account, I get all the money off the same day, close the 'bu
Re: (Score:2, Interesting)
What kind of customer would pay for access to such a broad set of data?
That's one of the points the article is trying to make, as a sea change in this sort of malware: Because the data is so broad and voluminous, the providers could have a quite varied customer base. It's been commoditized. Data mined from this store could be of use to unscrupulous folks ranging from simple carders, to account drainers, to mob bosses, to terrorists. Notice that the data was not just credentials for banking and shopping sites, but included access to law enforcement and other government applica
Very Interesting article (Score:2)
Very pro deconstruction though. I usually just whipe the little buggers.
Point (Score:2)
While infected, the xx_id value remains the same. Upon "cleaning" and re-infections, it changes; therefore it doesn't appear to be tied to globally unique identifiers (GUIDs).
What they've written suggests that it was tied to GUIDs of the most meticulous kind--a data set constructed to be as resilient as possible against swamping the data pool with false grouping. This is indicative of a specific desire to track people individually even if it means assigning them a new number.
very nice article, one correction (Score:2)
# create object associated with price list
$price = 'pesdato!';
Undernet, is that you? (Score:3, Interesting)
Obligatory joke (Score:2)
Sorry, we'd just gotten well into commenting without a decent Russian reversal yet.
Re: (Score:2)