Monthly Archives: August 2013

Njw0rm - Brother From the Same Mother

| By and | Advanced Malware, Threat Research

FireEye Labs has discovered an intriguing new sibling of the njRAT remote access tool (RAT) that one-ups its older “brother” with a couple of diabolically clever features. Created by the same author as njRAT —a freelance coder who goes by the moniker njq8 — the new njw0rm malware has the ability to spread using removable computer storage and can steal login credentials to a popular dynamic DNS service.

The older njRAT was first documented about a year ago by FireEye as Backdoor.LV. Most of the command-and-control (CnC) infrastructure associated with njRAT, like many of its targets, were based in the Middle East. The CnC servers associated with njw0rm are also based in the Middle East, though we have not yet seen njw0rm used in targeted attacks. Continue reading »

Syria 1982, Syria 2013: A Tale of Two Revolutions

| By | Uncategorized

Today, as international intervention in the Syrian conflict is fast approaching, the phenomenon of the world’s “patriotic hackers” (see Chechnya, Kosovo, Estonia, Georgia, etc.) continues to grow, with the pro-government “Syrian Electronic Army” believed responsible for attacks on Twitter and the New York Times.

The Internet has changed everything, including our geopolitical “battlespace.” In 1982, during a previous Syrian uprising in the city of Hama, the government obliterated parts of the city with artillery fire and killed “many thousands” of civilians. But because the government had “cut all telephone and road communication with the city” (according to renowned Syria expert Robert Fisk) it was many weeks before the extent of the atrocity was discovered. I visited Hama in 1988, and the entire story was recounted to me by a complete stranger as we strolled past countless buildings strewn with bullet holes. Continue reading »

Security Consolidation: Leveraging Business Intelligence

| By | Business of Security, Executive Perspectives, Security Perspective

With business intelligence moving to the top of the priority stack followed by updating legacy systems, we must wonder when the same forward looking view will be applied to security strategies. All too commonly, we see overly complex security controls that have evolved into an ugly kludge, where the same focus is applied generically across the business.

If we can see the value that business intelligence has to focus the business, then surely the same should apply to our business processes and the security controls that enable them. We must be able to define core processes and information and the technology that wraps around them. Then, we must allocate relevant security controls based on the business value of those processes. Typically, security is far from being operationally efficient. If anyone is in the process of reviewing the modernization of legacy systems, then security would be one key aspect that is due for a face lift.

Operation Molerats: Middle East Cyber Attacks Using Poison Ivy

| By , and | Threat Intelligence, Threat Research

Don’t be too hasty to link every Poison Ivy-based cyber attack to China. The popular remote access tool (RAT), which we recently detailed on this blog, is being used in a broad campaign of attacks launched from the Middle East, too.

First, some background:

In October 2012, malware attacks against Israeli government targets grabbed media attention as officials temporarily cut off Internet access for its entire police force and banned the use of USB memory sticks. [1] Security researchers subsequently linked these attacks to a broader, yearlong campaign that targeted not just Israelis but Palestinians as well. [2] — and as discovered later, even the U.S. and UK governments. [3] Further research revealed a connection between these attacks and members of the so-called “Gaza Hackers Team.” We refer to this campaign as “Molerats.” Continue reading »

Poison Ivy: Assessing Damage and Extracting Intelligence

| By | Targeted Attack, Threat Intelligence, Threat Research

Today, our research team is publishing a report on the Poison Ivy family of remote access tools (RATs) along with a package of tools created to work as a balm of sorts — naturally, we’re calling the package “Calamine.”

In an era of sophisticated cyber attacks, you might wonder why we’re even bothering with this well-known, downright ancient pest. As we explain in the paper, dismissing Poison Ivy could be a costly mistake.

RATs may well be the hacker’s equivalent of training wheels, as they are often regarded in IT security circles. But despite their reputation as a software toy for novice “script kiddies,” RATs remain a linchpin of many sophisticated cyber attacks and are used by numerous threat actors. Continue reading »

The Sunshop Campaign Continues

| By | Exploits, Targeted Attack, Threat Intelligence, Threat Research

We recently detected what we believe is a continuation of the Sunshop campaign that we first revealed on May 20, 2013.

This follow-on to the Sunshop campaign started on July 17, 2013. In this latest wave the attackers inserted malicious redirects into a number of websites – at least two of which were also compromised in the May 2013 edition of this campaign. The most prominent sites compromised in this round of the campaign were maintained by a Human Rights organization and an organization involved in science and technology policy development. Continue reading »

Cyber Insurance – the Chicken and the Egg

| By | Business of Security, Executive Perspectives, Security Perspective

Today, one of the most common discussions I have is “How do I qualify the cyber security risk to my board?” The security industry is very good at being able to define the type and scale of threats active today, and indeed with projects such as CISP, companies are starting to share intelligence with each other about the attributes of real time attacks they are seeing. Yet, we still have a major hurdle to tackle, which is the business impact that comes from incidents. While we continue to see any breach as a failure we will continue to keep the business impact of an attack a closely guarded secret. Legislation, such as the disclosure laws in the U.S. (which the EU is looking to repeat at some level in the proposed Network and Information Security directive) mandate the disclosure of what personally identifiable data was taken, yet this is not the impact, simply one of the potential catalysts of impact. Continue reading »

Survival of the Fittest: New York Times Attackers Evolve Quickly

| By and | Threat Intelligence, Threat Research

The attackers behind the breach of the New York Times’ computer network late last year appear to be mounting fresh assaults that leverage new and improved versions of malware.

The new campaigns mark the first significant stirrings from the group since it went silent in January in the wake of a detailed expose of the group and its exploits — and a retooling of what security researchers believe is a massive spying operation based in China [1].

The newest campaign uses updated versions of Aumlib and Ixeshe. Continue reading »

Breaking Down the China Chopper Web Shell - Part II

| By , and | Botnets, Targeted Attack, Threat Intelligence, Threat Research

Part II in a two-part series. Read Part I.

Introduction

In Part I of this series, I described China Chopper’s easy-to-use interface and advanced features — all the more remarkable considering the Web shell’s tiny size: 73 bytes for the aspx version, 4 kilobytes on disk. In this post, I’ll explain China Chopper’s platform versatility, delivery mechanisms, traffic patterns, and detection. My hope is that armed with this information, you can eradicate this pest from your environment.

Platform

So what platform can China Chopper run on? Any Web server that is capable of running JSP, ASP, ASPX, PHP, or CFM. That’s the majority of the Web application languages out there. What about operating systems? China Chopper is flexible enough to run transparently on both Windows and Linux. This OS and application flexibility makes this an even more dangerous Web shell. Continue reading »

Breaking Down the China Chopper Web Shell - Part I

| By , and | Botnets, Targeted Attack, Threat Intelligence, Threat Research

Part I in a two-part series.

China Chopper: The Little Malware That Could

China Chopper is a slick little web shell that does not get enough exposure and credit for its stealth. Other than a good blog post from security researcher Keith Tyler, we could find little useful information on China Chopper when we ran across it during an incident response engagement. So to contribute something new to the public knowledge base — especially for those who happen to find the China Chopper server-side payload on one of their Web servers — we studied the components, capabilities, payload attributes, and the detection rate of this 4 kilobyte menace.

Components

China Chopper is a fairly simple backdoor in terms of components. It has two key components:the Web shell command-and-control (CnC) client binary and a text-based Web shell payload (server component). The text-based payload is so simple and short that an attacker could type it by hand right on the target server — no file transfer needed.

Continue reading »