Monthly Archives: November 2013

MS Windows Local Privilege Escalation Zero-Day in The Wild

| By and | Advanced Malware, Exploits, Threat Research, Vulnerabilities

FireEye Labs has identified a new Windows local privilege escalation vulnerability in the wild. The vulnerability cannot be used for remote code execution but could allow a standard user account to execute code in the kernel. Currently, the exploit appears to only work in Windows XP.

This local privilege escalation vulnerability is used in-the-wild in conjunction with an Adobe Reader exploit that appears to target a patched vulnerability. The exploit targets Adobe Reader 9.5.4, 10.1.6, 11.0.02 and prior on Windows XP SP3. Those running the latest versions of Adobe Reader should not be affected by this exploit.

Post exploitation, the shellcode decodes a PE payload from the PDF, drops it in the temporary directory, and executes it.

Mitigations

The following actions will protect users from the in-the-wild PDF exploit:
1) Upgrade to the latest Adobe Reader
2) Upgrade to Microsoft Windows 7 or higher

This post was intended to serve as a warning to the generic public. We are collaborating with the Microsoft Security team on research activities. Microsoft assigned CVE-2013-5065 to this issue.

We will continue to update this blog as new information about this threat is found.

[Update]: Microsoft released security advisory 2914486 on this issue.

Dissecting Android KorBanker

| By and | Mobile Threats, Targeted Attack, Threat Intelligence, Threat Research, Vulnerabilities

FireEye recently identified a malicious mobile application that installs a fake banking application capable of stealing user credentials. The top-level app acts as a bogus Google Play application, falsely assuring the user that it is benign.

FireEye Mobile Threat Prevention platform detects this application as Android.KorBanker. This blog post details both the top-level installer as well as the fake banking application embedded inside the top-level app.

The app targets the following banks, all of which are based in Korea.

  • Hana Bank
  • IBK One
  • KB Kookmin Bank
  • NH Bank
  • Woori Bank
  • Shinhan Bank

Once installed, the top-level application presents itself as a Google Play application. It also asks the user for permission to activate itself as a device administrator, which gives KorBanker ultimate control over the device and helps the app stay hidden from the app menu.

Continue reading »

The Need for Incident Response

| By | Business of Security, Incident Response, Security Perspective

On an average day in the UK more than 100 .co.uk domain websites are hacked according to the statistics in the Zone-h.org online database.

Website hacks are increasing the volume of targeted attacks today. If we look at industry statistics, more than 80 percent of websites have vulnerabilities that would mean they would not meet OWASP Top 10 tests (source: Veracode). In addition, the U.S. CERT believes that 75 percent of new attacks specifically target the application layer of systems in order to exploit these weaknesses.

Why does Web security matter? Website watering hole attacks are becoming increasingly popular with attackers – if they can plant an invisible iframe that redirects a user from a legitimate website, they can push a user to a compromised website hosting a cocktail of exploits to attack the client computer connecting to it. We have see some great examples in the media over recent months including high profile sites like the Council of Foreign Relations and U.S. Department of Labor.

Among the targets this year – the UK Mole Valley website in August. Why was Mole Valley website hack interesting? Continue reading »

Top Security Predictions for 2014

| By | Security Perspective

As 2013 draws to a close, FireEye researchers are already looking ahead to 2014 and the shifting threat landscape. Expect fewer Java zero-day exploits and more browser-based ones. Watering-hole attacks may supplant spear-phishing attacks. And thanks to an emerging class of mobile malware, the security landscape is about to get a lot more complicated.

Those are just a few of the predictions of the FireEye engineering and labs team, which assembled a forecast for the coming year.

We set out to get 10 predictions — but got 15. Nostradamus would be proud. (Predictions after the break…)

Continue reading »

The Changing Role of SIEM in the Enterprise Security Architecture

| By | Executive Perspectives, Security Perspective

The SIEM (Security Information and Event Management) concept is heading into the third phase of its evolution.

In the first phase, SIM (Security Information Management) products developed to collect logs from multiple sources to aid in compliance and “log review” activities.

In the second phase, SEM (Security Event Management) emerged to find security events. SEM correlated multiple items across application, host, and network security logs to help security analysts detect and respond to attacks.

These two activities have provided little value to many organizations. While they may have seemed reasonable in theory, they were not designed from the ground up to solve the business problems that organizations actually face.

The SIEM product space has spurred novel database concepts, computationally expensive correlation algorithms, and complex tools for managing large amounts of log information. But ultimately, these approaches have failed to solve the real problem customers face in managing their security. They address the wrong problem because they started by looking at the symptoms — lots of logs that produce largely meaningless information.

The real business problem is to know exactly when an incident has occurred, respond to it (ideally in a real-time, automated fashion where appropriate), and prevent it from happening again. All the device configuration, log correlation logic, data storage, compute power, and bandwidth required to correlate disparate logs into a set of possible events to investigate produces a lot of work for analysts with far too many false positives.

For this reason, we’ve started too see companies changing the way they use SIEM products. Call it the third stage of SIEM’s evolution.

Continue reading »

Monitoring Vulnaggressive Apps on Google Play

| By , , and | Mobile Threats, Threat Intelligence, Threat Research, Vulnerabilities

Vulnaggressive Characteristics in Mobile Apps and Libraries

FireEye mobile security researchers have discovered a rapidly-growing class of mobile threats represented by popular ad libraries affecting apps with billions of downloads. These ad libraries are aggressive at collecting sensitive data and able to perform dangerous operations such as downloading and running new code on demand. They are also plagued with various classes of vulnerabilities that enable attackers to turn their aggressive behaviors against users. We coined the term “vulnaggressive” to describe this class of vulnerable and aggressive characteristics. We have published some of our findings in our two recent blogs about these threats: “Ad Vulna: A Vulnaggressive (Vulnerable & Aggressive) Adware Threatening Millions” and “Update: Ad Vulna Continues”.

As we reported in our earlier blog “Update: Ad Vulna Continues”, we have observed that some vulnaggressive apps have been removed from Google Play, and some app developers have upgraded their apps to a more secure version either by removing the vulnaggressive libraries entirely or by upgrading the relevant libraries to a more secure version which address the security issues. However, many app developers are still not aware of these security issues and have not taken such needed steps. We need to make a community effort to help app developers and library vendors to be more aware of these security issues and address them in a timely fashion.

To aid this community effort, we present the data to illustrate the changes over time as vulnaggressive apps are upgraded to a more secure version or removed from Google Play after our notification. We summarize our observations below, although we do not have specific information about the reasons that caused these changes we are reporting. Continue reading »

Exploit Proliferation: Additional Threat Groups Acquire CVE-2013-3906

| By and | Exploits, Threat Intelligence, Threat Research

Last week, we blogged about a zero-day vulnerability (CVE-2013-3906) that was being used by at least two different threat groups. Although it was the same exploit, the two groups deployed it differently and dropped very different payloads. One group, known as Hangover, engages in targeted attacks, usually, against targets in Pakistan. The second group, known as Arx, used the exploit to spread the Citadel Trojan, and we have found that they are also using the Napolar (aka Solar) malware. [1]

Looking at the time of the first known use of the exploit, we noted that the Arx group appeared to have had access to this exploit prior to the Hangover group. Subsequent research by Kaspersky has found that this exploit was used in July 2013 to spread a cross-platform malware known as Janicab. Interestingly, the Janicab samples have exactly the same CreateDate and ModifyDate as the Arx samples. However, the ZipModifyDate is different. They also contain the same embedded TIFF file (aa6d23cd23b98be964c992a1b048df6f). Continue reading »

Supply Chain Analysis: From Quartermaster to Sunshop

| By and | Targeted Attack, Threat Intelligence, Threat Research

Today, we released a new report from FireEye Labs entitled Supply Chain Analysis: From Quartermaster to Sunshop.

The report details how many seemingly unrelated cyber attacks may, in fact, be part of a broader offensive fueled by a shared development and logistics infrastructure — a finding that suggests some targets are facing a more organized menace than they realize. Our research points to centralized planning and development by one or more advanced persistent threat (APT) actors. Malware clearly remains a desired cyber weapon of choice. Streamlining development makes financial sense for attackers, so the findings may imply a bigger trend towards industrialization that achieves an economy of scale.

The report is available for download here: https://www.fireeyesolution.com/resources/pdfs/fireeye-malware-supply-chain.pdf

Operation Ephemeral Hydra: IE Zero-Day Linked to DeputyDog Uses Diskless Method

| By , , and | Exploits, Targeted Attack, Threat Intelligence, Threat Research, Vulnerabilities

Recently, we discovered a new IE zero-day exploit in the wild, which has been used in a strategic Web compromise. Specifically, the attackers inserted this zero-day exploit into a strategically important website, known to draw visitors that are likely interested in national and international security policy. We have identified relationships between the infrastructure used in this attack and that used in Operation DeputyDog. Furthermore, the attackers loaded the payload used in this attack directly into memory without first writing to disk – a technique not typically used by advanced persistent threat (APT) actors. This technique will further complicate network defenders’ ability to triage compromised systems, using traditional forensics methods.

Enter Trojan.APT.9002

On November 8, 2013 our colleagues Xiaobo Chen and Dan Caselden posted about a new Internet Explorer 0-day exploit seen in the wild. This exploit was seen used in a strategic Web compromise. The exploit chain was limited to one website. There were no iframes or redirects to external sites to pull down the shellcode payload.

Through the FireEye Dynamic Threat Intelligence (DTI) cloud, we were able to retrieve the payload dropped in the attack. This payload has been identified as a variant of Trojan.APT.9002 (aka Hydraq/McRAT variant) and runs in memory only. It does not write itself to disk, leaving little to no artifacts that can be used to identify infected endpoints. Continue reading »

New IE Zero-Day Found in Watering Hole Attack

| By and | Threat Research

FireEye Labs has identified a new IE zero-day exploit hosted on a breached website based in the U.S. It’s a brand new IE zero-day that compromises anyone visiting a malicious website; classic drive-by download attack. The exploit leverages a new information leakage vulnerability and an IE out-of-bounds memory access vulnerability to achieve code execution.

Exploitation

The information leak uses a very interesting vulnerability to retrieve the timestamp from the PE headers of msvcrt.dll. The timestamp is sent back to the attacker’s server to choose the exploit with an ROP chain specific to that version of msvcrt.dll. This vulnerability affects Windows XP with IE 8 and Windows 7 with IE 9.

The memory access vulnerability is designed to work on Windows XP with IE 7 and 8, and on Windows 7. The exploit targets the English version of Internet Explorer, but we believe the exploit can be easily changed to leverage other languages. Based on our analysis, this vulnerability affects IE 7, 8, 9, and 10. This actual attack of this memory access vulnerability can be mitigated by EMET per Microsoft’s feedback.

Shellcode

This exploit has a large multi-stage shellcode payload. Upon successful exploitation, it will launch rundll32.exe (with CreateProcess), and inject and execute its second stage (with OpenProcess, VirtualAlloc, WriteProcessMemory, and CreateRemoteThread). The second stage isn’t written to a file as with most common shellcode, which usually downloads an executable and runs it from disk.

Summary

In summary, this post was intended to serve as a warning to the generic public. We are collaborating with the Microsoft Security team on research activities.

We will continue to update this blog as new information about this threat is found. FireEye would like to acknowledge and thank iSIGHT Partners for their assistance in this research.

[Update 12-20-2013]: Microsoft release a security bulletin, assigned CVE-2013-3918 and CVE-2014-0266 to this issue.