[Updated on December 30, 2012] On December 27, we received reports that the Council on Foreign Relations (CFR) website was compromised and hosting malicious content on or around 2:00 PM EST on Wednesday, December 26. Through our Malware Protection Cloud, we can confirm that the website was compromised
at that time, but we can also confirm that the CFR website was also hosting the malicious content as early as Friday, December 21—right before a major U.S. holiday.
Category Archives: Threat Research
Who Do I Trust? Me, That’s Who…
Malware using digital signatures to dupe endpoints has been on the rise. We saw this tactic pick up momentum with the rise of attacks like Stuxnet, Duqu, and Flame (to name a few). As the problem continues to grow, it affects both enterprises and the companies whose digital signatures are hijacked and used for evil. This is especially a problem when the trusted signer is a well-known organization, increasing the likelihood that files bearing their signature will be trusted. We’ve all seen the headlines…
It happened with Microsoft. And Adobe. And the list goes on…
Don’t Click the Left Mouse Button: Introducing Trojan UpClicker
In one of the recent posts from Symantec, researchers shared the analysis of a malware that could evade automatic analysis in a sandbox environment. Evasion was done by hooking to the mouse. Per the analysis, SetWindowsHookExA() API installs the _main_routine to monitor messages from the mouse. When the malware receives messages from the mouse—that is, if the mouse is moved or buttons are clicked—the main subroutine executes. Since the automated analysis system does not use the mouse, the code will remain dormant, hence bypassing analysis by a sandbox.
Recently, we came across another sample, called Trojan Upclicker, that went one step further: using a mouse to evade automated analysis. The purpose of this posting is to share some of the finer technical details of using a mouse to evade detection along with the malicious behavior of Trojan Upclicker.
To Russia With Targeted Attack
Looking at the human aspect of offensive cyber operations is one of the most interesting parts of a malware analyst’s day. Malware that was generated by an algorithm, such as a polymorphic PDF, is a little boring because you know you aren’t fighting against a human on the other side of the keyboard. However, when dealing with nation-state sponsored intrusions, or at least deliberate attacks against a specific group of people, it’s interesting to look at the different stages of the attack, from victim selection, to attack method, to what kind of data is exfiltrated. We recently discovered an attack that appeared to be against primarily Russian targets.
More Phish
In my last post, we saw attackers carry out a targeted campaign, sending phishing emails with malicious attachments. This article picks up where we left off, briefly looking at the malware attachment, then examining its interesting CnC communication techniques.
A blast from the past: How to protect yourself against SYSENTER/SYSCALL hooks
In my last two blogs I discussed PDF exploits and shell code in general, so this time around I’ll make it a little different.
Experienced Windows programmers (well, Linux can be included as well if you think about it) know that for a few years now Microsoft has been taking advantage of the evolution of microprocessors like Intel and AMD.
A long time ago, when a function was called from user mode, the call would trickle down a system DLL and end up calling a system API. The problem was that the context switch between user mode and kernel mode was too expensive and they needed something more efficient. Enter fast system calls.
Backdoor.ADDNEW (DarkDDoser) and Gh0st, a match made in heaven?
At FireEye we monitor all kinds of attacks: targeted, non-targeted, and everything in between. We always try to figure out, not just how a piece of malicious code works, but also other possibilities, like whether it is related to some other malware, in what way, etc.
Gh0st has been much talked about and there is a lot of good research out there on this RAT (Remote Access Trojan). This RAT has been used in many serious attacks and a quick Google search on the Gh0st RAT will give you a lot of good articles which will go into great detail about the versions and the inner workings of the malware. However this post is not about Gh0st. Very recently while investigating some of these Gh0st infections, we identified another interesting piece of malware.
Looking Forward to Windows 8: A Look Back at Windows Security
With the release of Windows 8 scheduled for October 26, Windows security is on our mind. Windows is one of the most widely used operating systems in the world, making it a lucrative target for exploit developers and malware authors. In previous versions of Windows, many security features were introduced, including ASLR, DEP, and pointer encodings. Microsoft utilized software development lifecycle and threat modeling to ensure it was delivering a secure operating system to its users; however, many of previous Windows security exploits were the result of developers overlooking the proper implementation of protocol standards. Supplementing the detailed analysis made available by Microsoft, in this blog post, we share additional analysis of one of these exploits and highlight a short list of additional exploits that were the result of poor security validation.
Microsoft implemented many initiatives focused on developing code that was secure from exploitation of vulnerabilities, but unfortunately, many zero-day vulnerabilities were reported in Windows 2008 and Windows 7.
Let’s dive into the analysis of one zero-day CVE-2011-0654 which was reported on February 14, 2011, for Windows 7 and 2008 servers to understand the factor that seems to have been missed to ensure the safety of Windows.
Defining Advanced Malware is as Difficult as Preventing It (Part 1 of 2)
Advanced targeted attacks—or the ubiquitous advanced persistent threat (APT), if you prefer—have captured the attention of the security industry because of their clandestine and sinister nature. Unfortunately, it is almost as challenging to get the security industry to agree on what constitutes an APT as it is to protect against one, but we can identify and agree upon a few common themes.
Before I begin, I do want to make reference to testimony before congress from Richard Bejtlich, currently CSO at Mandiant, and formerly USAF. Rather than summarize, I’ll quote from the hearing on “Developments in China’s Cyber and Nuclear Capabilities:”
“…I use the strict definition of APT as created by the Air Force in 2006, namely as an unclassified reference to intrusions sets ultimately traced back to actors in China.”
This is a very fair and accurate definition. However, at the core, it requires the big “A”—attribution. Private companies (excluding government contractors) rarely have the ability to accurately identify a specific attacker, hence, making the distinction among a PLA unit, university training program, or contracted hacker, difficult. Because of that missing link, and the fact that many have misused the term, many attacks are miscategorized as APT simply due to being “advanced.”
Having said that, whether an attack is APT (or more accurately, if the attacker is the APT), or whether the attack is from another well-financed adversary, the TTPs have significant overlap. A typical scenario combines sophisticated exploits and social engineering to breach networks, execute malware instances, and establish communication with command and control (C&C) servers. As a result, technologies that examine executable files, monitor outbound communication, or analyze suspicious patterns in the network have become very popular; however, the effectiveness of some such solutions is questionable at best since advanced malware is constantly evolving to stay a step ahead of detection.
In this post, I will delineate the key characteristics of an advanced persistent threat and discuss some of the common approaches to mitigation. In a follow-up post, I will deconstruct why these common approaches are little more than a Band-Aid on a gaping wound.
Spear Phishing In Action
Recently, while monitoring an infected system we uncovered activity that showed a good example of attackers selectively emailing malware to a specific group (in this case a country).
After conducting analysis of the threat, network traffic, and hosts involved, we believe that the attackers were directly targeting companies located in the Middle East—Saudi Arabia, to be exact.
In the following examples we can see the sequence of events leading up to the spear phishing as well as the tactics used to seek out targets for the attack (aka the “reconnaissance”).
