Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Worms

Chinese Hackers Waking up to Malware 65

Posted by Zonk from the geopolitics-has-nothing-to-do-with-it dept.
An anonymous reader writes "An increase in malware originating from China has not gone unnoticed by security researchers, according to the site ITWeek. The aggravating software has been increasing over the last three months, to the point where some unlucky persons may be getting some every day. Individuals interviewed for the article are seeing an increasing sophistication and independent use of rootkits, new to the Chinese malware scene. 'China has traditionally been a hotbed of password stealers who go after log-in names and passwords for online games such as World of Warcraft. The criminals are after virtual currencies and goods which can be sold on auction websites.' These new types of software are actually encrypted, and can prove hard to dismantle."
This discussion has been archived. No new comments can be posted.

Chinese Hackers Waking up to Malware More

Chinese Hackers Waking up to Malware

Comments Filter:
  • Maybe the sony rootkit was a front to steal national secrets?

  • Pretty cool stuff, actually (Score:5, Interesting)

    by shrapnull ( 780217 ) on Saturday March 17, 2007 @01:55PM (#18387873)
    This article is interesting because a) I've seen it firsthand this past week, and b) Some of these are actually very sophisticated attacks.

    One of our buildings was going through an antivirus upgrade over AD when it got hit. Every machine in the building was getting an iframe in the web browser from some Chinese ISP (usa.d3a.us) that would bracket the computers web browsing session throughout its duration. The iframe contained javascript designed to capture passwords from gmail and other public websites, in essence a browser-based keylogger. Of course, blocking the offending domains through our filter got rid of the iframe, but it still affected websites because now they all had broken source code (wonderful XML render errors on just about every website, including google).

    Then the hunt was on.

    The 'sophistication' I witnessed comes from the fact that no matter how many of these boxes we cleaned and patched, the iframe source code kept popping up everywhere. I ran a Wireshark on it and discovered something rather interesting (to me anyways). The software was attacking the router's ARP table, by feeding it a bogus mac address (one of the infected machines) in essence redirecting all network traffic to a software-based proxy. Tracking down machines via MAC address and patching them eventually resolved the issue long enough to update the antivirus on the network, but I left the place somewhat in awe of what I had just seen, having most of my network antivirus experience involve easily blockable/patchable worms and viruses.

    While an ARP attack isn't all that uncommon, the presence of Chinese characters on every infected machine was a dead giveaway. Not exactly something I'd ever seen from a country more historically known for installing local keyloggers to steal WoW accounts.

    But or a good hour or two, I was getting my ass handed to me, and I had to completely disconnect the building from the WAN. In addition, our AV (very big-name corporate AV firm), didn't do shit on it. After the update I had to submit samples to the AV company to get a permanent patch upstream.

    • Firewall? (Score:2, Insightful)

      by khasim ( 1285 )
      The MAC addresses of your router shouldn't matter. They're LOCAL machines.

      So the "proxy" you describe would have to have been a local machine, too.

      How did they get through your firewall to establish a local proxy?
      • Sorry if I wasn't clear enough, the local machine was acting as a proxy via the ARP flood of the router's MAC address.

        Example
        Such as: who has 10.0.0.1 (router IP), tell 10.0.0.x
        Response: XX:XX:XX:XX has 10.0.0.1 (local machine pretending to be router announcing every 2 seconds)

        • That's still local. (Score:4, Informative)

          by khasim ( 1285 ) <brandioch.conner@gmail.com> on Saturday March 17, 2007 @02:47PM (#18388383)
          The MAC address and ARP broadcasts are only used for local delivery. Some machine on that local segment had to have already been cracked.

          There was a cracked machine sitting inside your firewall and broadcasting on your internal network.

          How it was cracked is the first issue.

          Using it as a proxy is just weird. It would be more efficient and effective to use it to scan other machines to see if they're vulnerable and to run attacks on your administrator passwords.

          Better yet, upload the BIOS info and see if a rootkit can be installed on the motherboard.

          It is a strange attack because it doesn't match any of the standard reasons for attacking.

          #1. Bandwidth - this for for spam and DDoS attacks.
                1a. Crack one machine and upload the address book and anything that appears to be an email address so infected emails can be sent to those addresses.
                1b. Crack one machine and scan that range to see if any other machines are vulnerable.

          #2. Information - compromise one machine / router / whatever and use that to attack important internal machines via worms or password attacks.

          The attack you describe is just ... weird. Why attempt to compromise multiple workstations via an outside site? That is too easily noticed. Suddenly all of your workstations are hitting this one site? That's a huge flag in the logs. Even if you hadn't noticed it on the workstations.

          And they wouldn't get any more bandwidth from the attack (case #1) nor would they get information that wasn't more easily available (and less noticeable) via other routes (case #2).

          • Re: (Score:3, Insightful)

            by shrapnull ( 780217 )
            I'm not going to criticize what it COULD have done. Obviously, there are some machines on that portion of the network that are not sufficiently hardened and that will be dealt with. The delivery mechanism of the malware had to be an internal user with overblown desktop privs, but having inhereted this 5,000 node network 4 months ago that's an issue we're addressing with the AD and antivirus rollout.

            As to what would make sense for them to hack, I think it would make MORE sense for them to try to capture we

          • Re: (Score:2, Insightful)

            by Anonymous Coward
            You just don't get it. With a MAC address attack, as long as any machine on the local network is compromised, they control all traffic on that network. You have to resort to non-networked methods of fixing machines. Additionally, you can have that one machine process things locally to minimize the much more likely to be noticed internet traffic. After scraping some information, let the arp poisoning expire and they can sit undetected for a long time until they decide to wake up again.

            As long as any mach
    • That's interesting cause I had the exact same experience here two or three weeks ago. There are lots of chinese students in this university network, I guess that's the reason why we had to deal with it serveral times.
      It always occured to us first when arpwatch was going mad.

      And as you said: AV Vendor had no signatures whatsoever, only after submitting samples S***** came up with new signatures.
      In fact S***** was installed on those computers and quite happy with a completely overtaken machine sniffing the ne

    • Re: (Score:2, Insightful)

      by anubi ( 640541 )
      Yeh, although its the "criminal" who does these things... criminals exist - and we should know that by now.

      Criminal activity, like fire and corrosion, has existed for as long as we have been here on earth. We should know by now how to intelligently mitigate the ill effects.

      Its dangerous not to understand fire and light one. Its dangerous to expose your machine to the internet and not know exactly what its doing.

      Your experience mirrors exactly what I studied at an internet security class...

      "The iframe c

      • Re: (Score:2)

        by Tony-A ( 29931 )
        ...I find it very scary when I am held hostage to enforced ignorance ... It could be as simple as a farmer seeing his corn field on fire, yet not being allowed to know that if he turned his irrigation system on, it would put it out.

        It is similar to turning off the streetlights in a high crime area so you can't see the crime.

        Closed and gizmo happy --- it WILL be insecure.
        Open and obvious works like the Unix Honor Virus --- it doesn't seem to go anywhere. (although I think somebody had a very cute very sma

        • Re: (Score:1)

          by anubi ( 640541 )
          "Closed and gizmo happy --- it WILL be insecure."

          You are so right.

          For years, until this MSIE "proprietary" crap came along, I was used to going to "view document source" if anything didn't render correctly. I could usually spot in a few minutes of seeing the HTML tags what went wrong.

          At least I KNEW the worst any webmaster could possibly do to me is give me a page that would not render.

          No matter what he did, I could at least see anything he sent me in a text editor, such as if his ad overlaid the tex

    • Can you provide more infos, for example IP address of the host, md5 of the .exe, the name of the malware as recognized by the AV, a link to more detailed info.... thanks
    • the same problem is happening with us... we have tried many htings, the strange thing is that this virus/worm/spyware wht ever it is is not detectble by anvtivirus program, i have tried many diffrents antivurs programs but nohting works, i still see the "usa.d3a.us" link in status bas every time i open anypage, our netwrok is widely spread with atlest 800 users, i woul like to request some one here to help uss in finding a solution to this as this is really getting on our nerves,we have also installed route

  • It will be short lived (Score:5, Interesting)

    by JRHelgeson ( 576325 ) on Saturday March 17, 2007 @01:56PM (#18387885) Homepage Journal
    This subject is worthy of a book, however, I'll try to convey some level 5 thoughts and hopefully it'll make sense:

    The Chinese government will reign in the criminal elements. They can't afford them damaging their economy. There is too much business to be done in order to keep their economy afloat that if we threatened to cut their internet access, they would go out and put the criminals in prison for life.

    China has bred themselves into a crisis. With their 1 child per couple law that has been in effect for decades, they now have 1 child that is supporting 2 parents who supports 4 granparents as they all move into retirement age. This is a monumental economic problem and is the reason why their economic policy is evolving at a rate that far outpaces the political evolution. External influences are what are changing the Chinese government, causing them to adopt rule sets and make changes that would never come internally.

    Example: SARS...

    People started flying out of China with this illness (SARS). Communist China denied the problem even existed. The World Health Organization stepped in and grounded all flights departing from specific regions of China, causing a panic in the Business world supporting the Chinese economy. This forced China to recognize the problem and adopt new information sharing rules whereby we now know about the Asian Bird Fru YEARS before it becomes a global pandemic (if it ever does). This is an external change that never would have come internally from their own country.

    China monitors their internet very closely, they know who the criminals are. They will be shut down soon because to let them continue would 1) be an embarassment to China, and 2) could have disasterous economic consequences.

    As a simple reference: The United States currently consumes 40 Quadrillion BTU's of energy per year from all sources. China consumes 7 QBTU and needs to get to 14 QBTU within the next 10 years in order to keep their economy from collapsing. They have a lot of work to do and they're not going to let malware authors derail their country. If they get derailed, they're going to be headed in the same direction as the Soviet Union. China will do anything to prevent that from happening, including invading their neighbors. China is a nation of pride, there is no way they're going to let their nation fail.

    When the Soviet Union collapsed, the citizens didn't much care because at least the Vodka was still cheap!

    • Re: (Score:2, Insightful)

      by BillyGee ( 981263 )
      Many, if not most, of the "citizens" of the Soviet Union didn't care because the collapse was something they had been hoping for ever since Russia occupied their countries. It meant they could actually buy food in stores, cross the border and not have to support the ethnic russian population. Nevermind the fact that the Soviet Union made Hitler seem relatively harmless considering the number of people murdered or sent to prison camps.
    • If you don't know what is this [china.com], you know nothing about the online world of China.
      • Then please, state what symboling is so the rest of the ignorant masses can now. The first impression is a pyro panda.
        • This is the logo of a recent worm/virus widely spread in China. It infects .exe, .com, .pif, .src, .html, .asp, .jsp, .php..., if the infected html stuff appeared on the server, IE users who browse the web page also got infected, also it stopped the antivirus software and firewall, deleted backup and did other smart things. There were more than 1 million computers got infected in China since last October. Although the author of this virus left the name of the city he was living in the code, the police didn

          • Re: (Score:2)

            by khallow ( 566160 )
            And what "idea" am I supposed to get from your story? Aside from the claim that "China knows who its criminals are" is wrong. It doesn't seem that illuminating to me.

    • One Child Law... (Score:4, Informative)

      by eklitzke ( 873155 ) on Saturday March 17, 2007 @04:54PM (#18389649) Homepage

      I mostly agree with what you had to say. The part about the one child law is not that accurate however, so I wanted to comment on it.

      China has bred themselves into a crisis. With their 1 child per couple law that has been in effect for decades, they now have 1 child that is supporting 2 parents who supports 4 granparents as they all move into retirement age. This is a monumental economic problem and is the reason why their economic policy is evolving at a rate that far outpaces the political evolution. External influences are what are changing the Chinese government, causing them to adopt rule sets and make changes that would never come internally.

      This hasn't really been in effect for as long as you think. My girlfriend and I are both 20, and her parents were both born well before the one child law. So probably the very first people born under this law have started to have children. I was also told by her family (not sure if this is 100% accurate) that the law works every other generation. So if you were a single child, you can have two children -- and they can have a single child, and their children can have two children, and so forth. In addition to all of this, it is worth mentioning that the population of China is still (slowly) growing, which indicates that the one child law isn't as strictly enforced as you might think.

      With respect to the rest of what you said, I agree with a lot of it. External influences dictate a huge amount of the national policy in the country. To even keep up the pace of growth that they have been sustaining for as long as they have shows that they are hugely more aware of international and economic policy than many people give them credit for. At the end of the day, China will do what it needs to do to keep their economy strong and safe.

  • Slashdot crowd is safe! (Score:3, Funny)

    by mi ( 197448 ) <slashdot-2017q4@virtual-estates.net> on Saturday March 17, 2007 @02:02PM (#18387929) Homepage Journal

    to the point where some unlucky persons may be getting some every day.

    That's not us. For better or worse...

  • Without intellectual property laws, is it even technically illegal to steal passwords in China? I mean, the downsides are obvious, but I don't think that Chinese law is prepared for this sort of thing.
    • I'm not an expert, but I wouldn't call a password 'intellectual property'. It's an authentication device, the electronic equivalent of a physical key. Surely they have locks on their doors in China? And surely stealing a key, or copying it without authorization and then using the copy to gain entry would be a crime?

  • Oh hmm. (Score:2, Funny)

    by romland ( 192158 )
    ...to the point where some unlucky persons may be getting some every day.

    TFS makes it sound as if that is a bad thing.

    Welcome to Slashdot, I guess. :)
  • use linux and this wouldnt be happening
  • Why aren't Microsoft or Windows mentioned in the headline or summary, since they are the enablers of this entire phenomenon?

    • Re: (Score:1, Insightful)

      by Anonymous Coward
      You might want to read this comment before you start the usual MS bashing:
      http://it.slashdot.org/comments.pl?sid=227013&cid= 18388731 [slashdot.org]
      Quote:

      It was a very weird attack. My nUbuntu laptop was affected by the iframe which was one of the instant alerts that this had to do with MAC or IP hijacking rather then just a simple virus like a worm.

      Web application security is the new "buffer overflow" of the security world.If you think only MS products are affected by this , have a good time getting pwned...

      • So there were Linux boxen and Firefox browsers on the inside as well, and they were effected by the attack in the third or fourth wave.

        Did you miss that part about there having to be a box (still) pwned on the inside? Yeah, once there's a bot on the inside, no standard browser is safe, but how did that bot get in?

        Sure, it _might_ have been a Linux box poorly administered, but then again it might have been just about _any_ MSWindows box.

        Odds? Come on, be serious.

        The culprit is Bill Gates for insisting on sel
        • OK, so who sold us the first cup of koolaid? was it the 6502 people, or was it intel 4004. The pace has increased continually since there were computers that were smaller than a room.

          • Re: (Score:1)

            by anubi ( 640541 )
            I think the first "koolaid" was the definable ANSI escape codes. No sooner than those were out, the first "ANSI bombs" appeared. I learned right then and there the danger of letting people run executables in my machine.

            I believe the "koolaid of the day" today is Javascript, Media players, and Instant Messenger apps.

            Javascript was used to do this particular one. If javascript had not been present here, this would not have happened. I see Javascript to secure computing much as I see a spilled puddle of

            • Funny you would mention the escape sequences :-) Several weeks ago my main Windows XP MCE computer, with hundreds of gigabytes of stuff (none pirated) stored on it had an incident. I had cygwin loaded and updated. I had developed a simple c++ (gnu) program to create html web pages. I was in a cygwin bash window, and I accidentally cat'ed the binary (a.out) of my c++ page generator. Several lines of binary goop appeared on the screen and then the computer froze up. I meant seriously frozen, including the c

              • Re: (Score:1)

                by anubi ( 640541 )
                WOW!!!

                I have NEVER seen an ansi bomb do THAT much destruction!

                Although the embedded "echo 'y' | format c:" came close. Remember that one? Deadly.

                I had renamed my format and fdisk command names to mitigate those.

                I long for those days where if someone came and messed up my machine, seeing what they did and cleaning up after them was about as simple as mitigating my dog's accidents. It was obvious where the mess was, one just got out the mop or backup disk and cleaned it up. Didn't have to beg someone

  • so whats the sense of chinese wall?

Slashdot Top Deals

Ocean: A body of water occupying about two-thirds of a world made for man -- who has no gills. -- Ambrose Bierce

Close