Monthly Archives: March 2014

Android.MisoSMS : Its Back! Now With XTEA

| By and | Advanced Malware, Mobile Threats, Threat Research |
Comments
0

FireEye Labs recently found a more advanced variant of Android.MisoSMS, the SMS-stealing malware that we uncovered last December — yet another sign of cybercriminals’ growing interest in hijacking mobile devices for surveillance and data theft.

Like the original version of the malware, the new variant sends copies of users’ text messages to servers in China. But the newest rendition adds a few features that make it harder to detect, including a new disguise, encrypted transmissions, and command-and-control (CnC) communications that are handled natively rather than over email.

FireEye Mobile Threat Prevention customers are already protected from both variants.

Continue reading »

A Little Bird Told Me: Personal Information Sharing in Angry Birds and its Ad Libraries

| By , and | Mobile Threats, Threat Research |
Comments
0

Many popular mobile apps, including Rovio’s ubiquitous Angry Birds, collect and share players’ personal information much more widely than most people realize.

Some news reports have begun to scratch the surface of the situation. The New York Times reported on Angry Birds and other data-hungry apps last October. And in January, the newspaper teamed up with public-interest news site ProPublica and U.K. newspaper the Guardian for a series of stories detailing how government agencies use the game (and other mobile apps) to collect personal data. Even the long-running CBS show 60 Minutes reported earlier this month that Rovio shares users’ locations.

The Android version of Angry Birds in the Google Play store, updated on March 4, continues to share personal information. In fact, more than a quarter billion users who create Rovio accounts to save their game progress across multiple devices might be unwittingly sharing all kinds of information—age, gender, and more — with multiple parties. And many more users who play the game without a Rovio account are sharing their device information without realizing it.

Once a Rovio account is created and personal information uploaded, the user can do little to stop this personal information sharing. Their data might be in multiple locations: Angry Birds Cloud, Burstly (ad mediation platform), and third-party ad networks such as Jumptap and Millennial Media. Users can avoid sharing personal data by playing Angry Birds without Rovio account, but that won’t stop the game from sharing device information.

In this blog post, we examine the personal information Angry Birds collects. We also demonstrate the relationships between the app, the ad mediation platform, and the ad clouds — showing how the information flows among the three. We also spell out the evidence, such as network packet capture (PCap) from FireEye Mobile Threat Prevention (MTP), to support our information flow chart. Finally, we reveal how the multi-stage information sharing works by tracking the code paths from the reverse-engineered source code.

Continue reading »

Spear Phishing the News Cycle: APT Actors Leverage Interest in the Disappearance of Malaysian Flight MH 370

| By and | Advanced Malware, Targeted Attack, Threat Intelligence, Threat Research |
Comments
0

While many advanced persistent threat (APT) groups have increasingly embraced strategic Web compromise as a malware delivery vector, groups also continue to rely on spear-phishing emails that leverage popular news stories. The recent tragic disappearance of flight MH 370 is no exception. This post will examine multiple instances from different threat groups, all using spear-phishing messages and leveraging the disappearance of Flight 370 as a lure to convince the target to open a malicious attachment.

“Admin@338” Targets an APAC Government and U.S. Think Tank

The first spear phish from group “Admin@338” was sent to a foreign government in the Asian Pacific region on March 10, 2014 – just two days after the flight disappeared. The threat actors sent a spear-phishing email with an attachment titled, “Malaysian Airlines MH370.doc” (MD5: 9c43a26fe4538a373b7f5921055ddeae). Although threat actors often include some sort of “decoy content” upon successful exploitation (that is, a document representing what the recipient expected to open), in this case, the user is simply shown a blank document.

The attachment dropped a Poison Ivy variant into the path C:\DOCUME~1\admin\LOCALS~1\Temp\kav.exe (MD5: 9dbe491b7d614251e75fb19e8b1b0d0d), which, in turn, beaconed outbound to www.verizon.proxydns[.]com. This Poison Ivy variant was configured with the connection password “wwwst@Admin.” The APT group we refer to as Admin@338 has previously used Poison Ivy implants with this same password. We document the Admin@338 group’s activities in our Poison Ivy: Assessing Damage and Extracting Intelligence paper. Further, the domain www.verizon.proxydns[.]com previously resolved to the following IP addresses that have also been used by the Admin@338 group:

IP Address First Seen Last Seen
103.31.241.110 2013-08-27 2013-08-28
174.139.242.19 2013-08-28 2013-08-31
58.64.153.157 2013-09-03 2014-03-07
59.188.0.197 2014-03-07 2014-03-19

Continue reading »

From Windows to Droids: An Insight in to Multi-vector Attack Mechanisms in RATs

| By , , and | Mobile Threats, Threat Research |
Comments
0

FireEye recently observed a targeted attack on a U.S.-based financial institution via a spear-phishing email. The payload used in this campaign is a tool called WinSpy, which is sold by the author as a spying and monitoring tool. The features in this tool resemble that of many other off-the-shelf RATs (Remote Administration Tools) available today. We also observed a second campaign by a different attacker where the WinSpy payload was implanted in macro documents to attack various other targets in what appears to be a spam campaign.

The command-and-control (CnC) infrastructure used in the attack against the financial institution is owned and controlled by author of WinSpy. This does not necessarily mean the author is behind attack as the author provides the use of his server for command and control as well as to store the victim data as the default option in the WinSpy package. This feature allowing shared command-and-control infrastructure advertently or inadvertently provides another level of anonymity and deniability for the attacker.

While analyzing the windows payloads for WinSpy we discovered that it also had Android spying components, which we have dubbed GimmeRat. The Android tool has multiple components allowing the victim’s device to be controlled by another mobile device remotely over SMS messages or alternatively through a Windows-based controller. The Windows-based controller is simplistic and requires physical access to the device. The recent surge in Android-based RATs such as Dendroid and AndroRAT shows a spike in the interest of malicious actors to control mobile devices. GimmeRAT is another startling example of malicious actors venturing into the Android ecosystem. Continue reading »

Clarifying the Origins of FireEye

| By | Business of Security, Security News, Security Perspective |
Comments
0

Today, Bloomberg Businessweek reported on the methods hackers used to steal millions of credit card numbers from Target. In the report, FireEye was mentioned as having discovered the attack prior to the broad discovery by Target as well as providing services to the CIA. It is FireEye policy to not publically identify our customers and, as such, we cannot validate or comment on the report’s claims that Target, the CIA, or any other companies are customers of FireEye.

Additionally, certain follow-on media coverage has reported that the CIA was involved with the founding of FireEye. These claims are not true. To clear any misconceptions in the market, we wanted to provide more information about how FireEye was founded. Continue reading »

A Detailed Examination of the Siesta Campaign

| By and | Targeted Attack, Threat Intelligence, Threat Research |
Comments
0

Executive Summary

FireEye recently looked deeper into the activity discussed in TrendMicro’s blog and dubbed the “Siesta” campaign. The tools, modus operandi, and infrastructure used in the campaign present two possibilities: either the Chinese cyber-espionage unit APT1 is perpetrating this activity, or another group is using the same tactics and tools as the legacy APT1.

The Siesta campaign reinforces the fact that analysts and network defenders should remain on the lookout for known, public indicators and for shared attributes that allow security experts to detect multiple actors with one signature.

Overview

On March 6, 2014 TrendMicro reported on the Siesta Campaign. Though not explicitly stated in this report, the tactics, techniques and procedures (TTPs) described in this report share a number of characteristics with historical activity we’ve attributed to APT1 (also known as the “Comment Crew”). Continue reading »

Intelligence Analysts Dissect the Headlines: Russia, Hackers, Cyberwar! Not So Fast.

| By and | Security Perspective |
Comments
0

Claims of cyber attacks, website defacements, sophisticated Russian malware, and even “cyberwar” have hit front pages since the conflict in Crimea heated up. With all the noise, it’s hard to know what has actually occurred, and even tougher to interpret the consequences of the potential activity.

Here’s our take on the major cyber activities that have been reported throughout the Russia-Ukraine crisis.

We anticipate that Moscow will seek to avoid the international criticism of its purported network operations that accompanied the 2008 Georgia crisis and the 2007 incident in Estonia. Instead, we think Moscow is more likely to use narrowly focused, limited operations in support of strategic state objectives.

Continue reading »

Cybercriminals Continue to Target Retail Sector

| By | Advanced Threat Trends, Security News, Targeted Attack, Threat Intelligence |
Comments
0

A series of spectacular cyber attacks have breached big-name retail stores in recent months, including Target, Nieman Marcus, and Michaels. These incidents are the only latest in what has become an alarming trend.

In 2013, for example, the U.S. Department of Justice (DoJ) profiled a financial hacking scheme in which four Russians and one Ukrainian penetrated the computer networks of retail organizations. This series of attacks yielded more than 160 million credit card numbers — and cost corporations and consumers hundreds of millions of dollars. The cybercriminals sold the credit card data (which was stored on computers scattered around the globe) and sold it via hacker forums. They charged $10 for American cards and $50 for European cards.

The FireEye Dynamic Threat Intelligence™ team can confirm that the retail sector faces an increased risk from actors using point-of-sale (POS) malware to steal customer credit card data. Ongoing attacks against our retail clients align closely with the DoJ revelations and recent headlines. FireEye is actively tracking one financial threat group that we believe is associated with Russian and Ukrainian attackers.

Continue reading »

RSA USA 2014: Continuous Monitoring, Protection, and Vigilance

| By | Business of Security, Executive Perspectives, Security Perspective, Technology |
Comments
0

The advanced threat landscape was a hot topic at last week’s RSA Conference, where industry influencers, peers, customers, and partners came together to look at today’s security challenges and help solve them.

At the event, FireEye chief security strategist Richard Bejtlich sat down with Mike Scutt, incident handler at FireEye. They discussed how customers benefit from the powerful addition of Mandiant to the FireEye Threat Prevention Platform.

Their exchange zeroed in on FireEye Managed Defense one of the first products to come about from the Mandiant integration. Managed Defense enhances FireEye Continuous Monitoring capabilities with a greater level of intelligence. This new family of services leverages the Mandiant professional services group to provide vital context about cyber-attacks and detailed advice about how to prevent, detect, contain, and resolve them.

Managed Defense offers three levels of service, tailored to customers’ in-house resources and risk tolerance: Continuous Monitoring, Continuous Protection, and Continuous Vigilance. All three service tiers help subscribers identify attackers, understand their intentions, and draw up a step-by-step action plan.

Click below to listen to the full podcast recorded live from the show floor at RSA USA 2014:
Richard Bejtlich Interviews Mike Scutt