More Mac Malware Thus Far in 2017 Than Any Other Year

More Mac Malware Thus Far in 2017 Than Any Other Year

With more than 4 months to go before the year ends, this year has already seen more Mac specific malware than any other. Is this finally the end of Mac OS’s reputation as relatively virus-free?

Obviously, Macs have never been totally virus-free. Compared to Windows malware however, the amount of Mac targeted malware has always been minimal. This has largely been due to the substantially smaller market share of Mac OS X. With far fewer users to target compared to Windows, malware creators didn’t have enough incentive to develop as many viruses for Apple’s personal computing platform.

Interestingly, this year has been quite different in regards to Mac malware activity. According to Malwarebytes, not only was there a 230% year-on-year increase in Mac malware last July, the first half of 2017 has already seen more Mac malware than all of 2016 or indeed, any other year. While we’re accustomed to seeing more malware year after year, Mac focused malware is a bit different.

Could the significant uptick in Mac malware due to a corresponding increase in user base? Not really. In fact, OS X market share hasn’t changed significantly since last year.

Malware in the App Store

What makes this surge even more alarming is that a significant amount of malware has managed to invade even the App Store. Apple is known to be very thorough in screening the applications that make it to the Mac App Store.

They review each app for objectionable content, acceptability, app completeness, hardware compatibility, intellectual property, spam, ability to inflict harm, and a host of other criteria. Apple has even been quick to pull apps from the store if they’re later found to be problematic.

Apple touts the App Store as the safest place to download apps and many users believe that to be wholly accurate. This false sense of security leaves them more vulnerable to attacks as they are perhaps not as vigilant or discerning as they might be on another platform.

Proton RAT leads off 2017 surge

One of the biggest threats to emerge this year was a RAT (Remote Access Trojan) known as OSX.Proton.B or simply Proton. Being a RAT, Proton takes the form of a legitimate application accompanied by a back door that provides administrative control to a victim’s system.

During one campaign, Proton handlers were able to modify Handbrake, an app built to convert video files. Proton’s handlers infiltrated one of Handbrake’s download mirrors, enabling them to replace the app’s DMG file with a modified version infected with Proton code.

Once the compromised application is installed onto a victim’s device, the Proton RAT kicks in. Proton can carry out several malicious acts, including: recording keystrokes, stealing passwords, controlling the webcam, allowing remote access, and gaining access to the user’s iCloud account.

Proton can be installed surreptitiously because the malware uses genuine Apple code-signing signatures. This allows it to bypass Apple’s Gatekeeper, an OS X feature that blocks apps if they aren’t digitally signed using a valid Apple Developer ID.

Proton’s existence was uncovered when researchers from cyber security firm Sixgill chanced upon a post on a notorious Russian cybercrime message board. The post introduced Proton as the “Newest and only macOS RAT in the market.” Originally priced at approximately 100 BTC (bitcoin), which was equivalent to about $100,000 at the time, Proton was out of reach for most.

Findzip Ransomware

Another piece of Mac malware that emerged this year is Findzip. Ransomware has been gaining a lot of notoriety lately, so people in the Mac community were rightly alarmed upon learning that one of the the biggest malware threats in the world today is now right on their doorstep.

Findzip is usually disguised as a crack for either Adobe Premier Pro or Microsoft Office. Being a crack, it doesn’t go through the normal Mac application installation process. People who use cracks typically employ workarounds to bypass Apple’s security measures meant to prevent the installation of malicious programs. Of course, the use of these workarounds plays right into the hands of Findzip’s operators.

Unlike Proton, Findzip isn’t digitally signed using an Apple-issued certificate. As such, it will be considered as coming from an unidentified developer, marked with a ‘quarantine’ flag, and ultimately denied installation. Well and good, but that doesn’t stop Findzip from getting through.

Normally, apps that aren’t downloaded from the App Store, are downloaded through a Web browser. Some popular web browsers are designed to identify the quarantine flag as well as invalid signatures- so if a user attempts to open such a DMG file, the system will prevent the file from being opened.

Alas, people who want to install cracked applications and other pirated software don’t go down that route. Instead, they download files through alternative means, usually torrents. Torrent clients don’t set the quarantine flag when they download a file. Thus, when the user opens the DMG file, the system won’t be able to do anything about it.

It’s comforting to note however that 1) Findzip will not be able to affect users who download apps through legitimate means and 2) it’s now easy to find tools or methods for decrypting files encrypted by Findzip. In fact, if you google for ‘findzip ransomware’, the first search results actually point to removal/remediation solutions, and not just information about the malware itself.

Flashback to Flashback?

The last time there was a surge of Mac malware activity of this magnitude was in 2011-1012, when the Flashback Trojan struck. Flashback was said to have infected about 600,000 Macs then. That number amounted to more than 1% of the total number of Macs at that time.

Taken individually, none of the Mac malware detected this year appear to have infected as many devices as Flashback. The Flashback outbreak remains the largest Mac-based malware outbreak in history, but 2017 shows a disturbing trend that all Mac users should pay close attention to.

A Closer Look at Spyware Apps Distributed by Google

Phone apps and SDK’s

Software Developer kits (SDKs) are used to help developers quickly code their apps with advertising in mind. This way, they can receive advertising payments from their apps. Until recently, Google didn’t allow any changes to SDKs once they were checked into the play store. Enter Chinese SDK creator Lgexin.

Sneaky Lgexin SDK

Lgexin is responsible for more than 500 android apps in the Google Play store being corrupted. Previously they were not able to alter their SDK once it went to market, due to Google’s strict guidelines around SDK implementation. Their workaround for this was to get approval from the dev owner in order to make some small updates to the SDK package and re-submit it into the Google Play store. These small changes were masked and encrypted to try and hide the phone call tracing functionality that was being inserted.

What is the threat?

Lgexin could do whatever they like with the call data they would receive from users of their SDK applications. This call data could be sold to other companies for telemetry purposes or even to the government for global call tracking. Some of the apps include weather apps, teen related games, photo editors, radio and even some fitness apps. With over 100 million downloads of just one of these apps, Lgexin put a lot of people’s privacy and data at risk.

One of the most downloaded apps was called “Lucky Cash- Earn Free Money”, which would prompt the user with a fake google prompt to allow full access to the phone’s call functionality. Millions of users could have unknowingly granted this access. The plugin is called a “phonestatelistener” and can capture the time of the call, the state of the call and the calling number. The data is then sent encrypted to Lgexin’s API for purposes which remain unknown.

What can I do?

From a user perspective, whenever downloading an app from the app store, you should be prompted with any and all permissions that the application will need from your phone in order to operate. This is where common sense needs to come in. First, do you even need or want the app? Do the permissions requested seem reasonable for the app? i.e. does this calculator app really need access to your contact list or pictures? Once you download an app, you shouldn’t be prompted by the play store via pop up for additional permissions. Lastly, be sure to review your apps on occasion and uninstall any that you are no longer using.

Even following the suggestions above is no guarantee. Lgexin has put trusted downloads in a new light and serves as a reminder that you can no longer trust an app based primarily on the number of downloads it has.

How Trojans Withdraw Money From Your Account

How Trojans Withdraw Money From Your AccountGone are the days when malware were simply irritants that caused minor disruptions. Today, most of them are serious threats that can cause considerable financial loss. One class of malware can even steal money straight from your bank account. Known as banking trojans, these types of malware can empty your account once they’ve infected your system.

How banking trojans steal money

Banking trojans infect systems through the same methods used by most malware, including exploit kits, social engineering, phishing emails, droppers, and so on. We’ve already discussed these in many of our previous blog posts, so let’s skip infection methods for now. Instead, let’s focus on how banking trojans actually steal money from your bank account.

Generally speaking, there are two ways these types of malware can steal money from your bank account:

1. By stealing login credentials to your bank account, or
2. By diverting your funds during a legitimate transaction

Stealing login credentials to your bank account

In this method, the trojan acquires your account’s login credentials and then sends those credentials to the malware operators. Once the operators get ahold of your credentials, they can then use them to take over your account and transfer your funds to either their own accounts or to money mule accounts.

Money mules are accomplices who simply open bank accounts for receiving the stolen money before it’s ultimately transferred to the account of the malware operators themselves. Some of these money mules don’t even know they’re doing something illegal. All they know is that they’ve been hired (often through work-at-home schemes) to facilitate in the transfer of funds. Because a single heist can involve several money mules, it is difficult for authorities to trace the main perpetrators.

But how are these bank trojans able to acquire your credentials in the first place? In most cases, they use any or all of these techniques: keylogging, form grabbing, screen capture, video capture, or man-in-the-browser.

Keylogging

Keylogging is probably the oldest trick in the bank trojan’s book. It involves recording user key strokes and then transmitting them to the malware operators. Keyloggers, however, have two major problems: 1) they don’t work with virtual keyboards, auto-fill features, and copy-paste actions, and 2) they normally collect a large number of irrelevant keystrokes.

Cyber criminals are only interested in login credentials and other information that can help them steal from the user’s bank account. Because keyloggers don’t choose which keystrokes to record, malware operators usually have to spend considerable effort parsing the data they receive to find exactly what they want.

Form grabbing

Unlike keyloggers, which grab credentials as they’re being entered into a web form, form grabbers grab credentials straight from a web form before they’re transmitted to the bank’s web server. Specifically, form grabbers grab GET/POST requests. That means, they’re able to acquire credentials before the browser encrypts the data (in the case of an HTTPS session) and even if the user employs a virtual keyboard, an auto-fill tool, or a simple copy-paste.

Screen and video capture

Other trojans capture multiple screenshots or even entire videos and then send those captures to the malware operators. These techniques allow the operators to literally see actual footages of the screen when the user fills up the online bank’s web forms.

Thus, like form grabbing, screen and video captures are immune to the use of virtual keyboards, auto-fill tools, or copy-pastes. The downside of these techniques is that they typically slow down the computer’s performance or consume a significant amount of bandwidth, so they can easily raise red flags.

Man-in-the-browser

Arguably the most widely used technique for stealing credentials, the man-in-the-browser (MITB) can be found in the toolbox of almost all notorious banking trojans, including Bebloh, Carberp, Cridex, Gameover, Gozi, Silent Banker, Spyeye, and Zeus. Just like a man-in-the-middle attack, a MITB attack intercepts the interactions between a user and a legitimate entity, which, in this case, is the bank’s website.

Through a man-in-the-browser attack, the malware can not only steal credentials. It can also alter how a web page or form appears to the user. One common modification is to insert additional fields in order to request more information than is required.

The trojan can, for instance, ask the user to enter his/her PIN, credit card information (name, card number, expiration date, and CVV), cellphone number, additional authentication data, and many others. All this information can be used to gain greater control over the account. Some of this information can come in handy in case the banking site asks for more identification information along the way.

Diverting funds during a legitimate transaction

Also known as a webinject, the man-in-the-browser attack has other, more sophisticated capabilities. In addition to their basic functions like intercepting data and modifying the content of a web page, more advanced webinjects can also alter the values users enter into a web form.

Let’s say a user is in the process of transferring funds to a business partner. A webinject with Automatic Transfer System (ATS) capabilities can change the B2B transaction details and direct the transfer to a money mule account instead. It can even alter the transaction values (e.g. from $500 to $5,000).

The user won’t be able to notice any of these changes because these webinjects can also alter the content displayed to the user. So, even if $5,000 may have been deducted from the user’s account, the user will still see his current balance to be exactly what he/she expected, i.e., only $500 less.

All of this typically takes place after the user logs in, so webinjects can bypass the authentication process, thereby rendering even 2-factor authentication useless.

Stealth and persistence

Banking trojans are designed to spring into action only when certain conditions are met. For instance, when the user visits certain online banking sites or, in the case of ATS-capable trojans, when the user is about to make a transaction.

Because they need to stay undetected for long stretches of time before they can go to work, banking trojans require exceptional stealth and persistence capabilities. One of the stealth methods employed by these trojans is steganography. Steganography applications in malware take on different forms but the basic idea is to hide the malware (or crucial parts of the malware) in an image.

In the case of ZeusVM (a variant of Zeus), for example, this malware used steganography to hide its configuration files in an image of a beautiful sunset. Configuration files play a crucial role in the makeup of banking trojans, for they usually contain the domains of online banks a specific trojan is designed to attack.

Another method trojans use is obfuscation. Obfuscation enables the malware to circumvent heuristic analysis, a security countermeasure employed by antivirus solutions to detect malware whose signatures have not yet been added to their database.

Heuristic analysis involves running a suspicious program in a controlled environment (usually a virtual machine) and monitoring for malware-like behaviors like replication, establishing connection with a remote server, etc. The purpose of obfuscation is to make any binary or text in the malware difficult for the antivirus to decipher or understand.

Since most advanced anti-malware software perform heuristic analysis in virtual environments known as sandboxes, some trojans try to avoid sandboxes altogether. Basically, a trojan with sandbox evasion capabilities checks first if the environment it’s landed on is a sandbox. If there are indications the environment is indeed a sandbox, the malware doesn’t execute.

One particular banking trojan named Ursnif, for example, runs different checks to determine if it’s running in a sandbox. One of these checks involves finding out whether there are more than 50 tasks with a graphical interface on the system, a normal number in real systems. If there are less than 50, then it’s likely the system is actually a sandbox. There are many other sandbox evasion techniques but that’s for another blog post.

A threat to business

While it might initially appear only individuals can be victimized by this type of malware, several enterprises, particularly small and medium businesses, can also be affected. If a banking trojan manages to infect the system of whoever is in charge of carrying out online banking transactions, the malware will be able to initiate a corporate account takeover and facilitate fraudulent fund transfers.

Some of these fraudulent transfers might even be ACH (Automated Clearing House) transfers involving payroll payments. Once the cyber criminals have taken over the corporate account, they could, for instance, change the names in the payroll file to the names of their money mules.

Because most of these accounts aren’t reconciled on a daily basis, the fraudulent transaction can go unnoticed for days. By the time it’s discovered, the funds would have already been in the hands of the perpetrators.

To learn how to protect your corporate bank accounts from these types of threats, contact us.

How Malware Steals Credit Card Data from Your POS Systems

How Malware Steals Credit Card Data from Your POS SystemsSome of the biggest data breaches involving credit card data, including those that hit Home Depot and Target, were perpetrated by POS malware – we’ll explain exactly how POS malware works.

A brief overview of the market behind POS malware

POS malware is a vital tool in the highly lucrative credit card data theft industry. At the end of the supply chain, there are people who use fake credit cards to purchase products and services. These people source these fraudulent cards from cyber gangs who produce the fake cards.

The gangs in turn source data that make up the cards from carding forums or stores (a.k.a. card malls or card shops) on the dark net or other online black markets. Sellers in these marketplaces typically offer thousands or even millions of pieces of credit card data. Lastly, the people who sell card data in those forums and stores purchase the data in bulk from hackers (yes, we know they’re supposed to be called crackers).

It’s these hackers who employ POS malware. Cyber criminals are drawn to where the money is. As long as there are people down the supply chain who will use fake credit cards, there will always be criminals who will steal the data to make those cards work. As a result, businesses will always be under the threat of data-stealing POS malware.

How a POS system gets infected

Before any POS malware can go about stealing credit card data, it first has to find its way into a POS system. Unfortunately for us, there are many ways for it to get there.

Because POS vendors sometimes need remote access to their products for troubleshooting, applying patches, or performing technical support, most POS devices are designed to directly or indirectly connect to the Internet. As part of PCI DSS compliance, some systems are also required to connect to the Internet in order to perform time-synchronization with NTP servers. Lastly, an Internet connection may also be needed to enable the system to export purchasing, inventory, or other business data to remote servers.

While needed for upkeep, maintenance, security, and other business functions of the device, the Internet also allows attackers to gain access. Here are the most common ways POS systems get infected with malware:

Phishing and social engineering

Not all of these systems are dedicated POS terminals. In fact, many of them are regular desktops that run on Windows. When a POS system is set up like this, it’s likely to be used for other functions like sending/receiving emails, web browsing, checking social media sites, instant messaging, and other online activities.

Unfortunately, these online activities are susceptible to phishing and other social engineering attacks. Once the user clicks a link or downloads an attachment in a phishing email or message, they could end up downloading either the malware itself or a trojan that subsequently downloads the malware.

Unpatched systems

As in most other systems, a POS terminal can also get infected when malware exploits vulnerabilities in the operating system, browser plugins, or the web browser itself. Known vulnerabilities are easily addressed through patches or software updates. Unfortunately, most people don’t patch properly, and many don’t patch at all.

Hacked administrative interface

As mentioned earlier, the main purpose of these Internet connections is for performing upgrades, tech support, and troubleshooting. To perform these tasks, the vendor has to connect through some form of administrative interface. Attackers sometimes brute force their way into these interfaces or take advantage of default settings. Once they’ve gained entry, they then install the malware.

Compromised third party credentials

It’s common for businesses to employ the services of various third parties. Some of these third party providers are given access to either the POS machine itself (e.g. for vendors of software installed on the same machine) or to another device running on the same network as the POS machine. This gives cybercriminals an avenue for attack.

Cybercriminals can steal login credentials assigned to these third parties in order to gain access into the POS system. This type of attack is difficult to trace because if you view the logs, the logins appear to be carried out by someone authorized to access the system.

Other compromised devices in the network

In the event that the POS device is connected to the office LAN but not to the Internet, cyber criminals can still access the device through an indirect attack. They would first attack a device connected to the Internet and use that as a jump off point to reach their main objective.

They can employ phishing, brute force, or an SQL injection on the corporate website. They can even simply hack into a network device whose factory default passwords have not been changed. Once they’ve gotten a foothold into the network, they usually try to acquire administrative-level credentials before finally seeking out the main target – the POS machine. Once they’ve breached to the POS machine, they install the malware.

RAM scraping

So what happens when malware gets installed on a POS system? It does what it’s programmed to do – steal credit card data. Theoretically, there are number of opportunities for malware to steal credit card data from a POS system. First, while the data is stored (a.k.a. data-at-rest). Second, while it traverses the network (a.k.a. data-in-transit). And third, while the credit card data is in memory.

Most POS systems encrypt data-at-rest and data-in-transit (e.g. via SSL/TLS or IPsec), so POS malware rarely strikes at these stages. Cyber criminals can extract the information they need only if the data is in plaintext (unencrypted) form. Usually, this only ever happens when the data is still in memory. This explains why most current malware (including the one used in the Target data breach) attack there.

The process of stealing information from RAM is known as RAM scraping. Depending on the type of RAM scraper, data is stolen either wholesale (i.e. everything is grabbed from memory) or according to a pattern match. RAM scrapers can typically collect the PAN or credit card number, name of cardholder, card expiration date, CVV code, and other information embedded in the cards magnetic stripe. After the data is scraped from RAM, it is temporarily stashed in a file somewhere in the system or in the network.

As more customers come in and have their credit card data swiped, more data is collected and accumulated into that same file. After a certain period, the malware connects to a remote C&C (Command and Control) server and commences with the exfiltration process.

Covert exfiltration and persistence

To avoid being detected, some POS malware encrypts the data before transmitting to the C&C. Some also use HTTP requests in transmitting the data to avoid suspicion. This will make it appear that the POS system is being used for harmless activities like web browsing, allowing the exfiltration process to bypass firewalls and most antivirus solutions.

Note that, when a RAM scraper grabs data from memory, it only manages to grab information from a single card, i.e. the card that was recently swiped. That’s why, as mentioned earlier, the data scraped from memory would still have to be accumulated into a sort of “staging” file. Because it can take some time before a substantial amount of data is collected, the malware has to persist in the system as long as possible for it to be effective.

To do that, POS malware usually employs privilege escalation techniques like tampering logs or disabling antiviruses and monitoring tools. Some types of malware also create backup copies of themselves, which are retrieved in the event their “production” selves are somehow deleted or incapacitated.

Mitigating the POS malware threat

Last year (2016), the rate of identity theft hit an all-time high, with some 15.4 million consumers getting victimized through some form of ID theft. This translated to about $16 billion worth of losses through fraud. Although not all of these incidents involved the use of POS malware, POS malware still remains one of the biggest threats to merchants who haven’t yet adopted EMV chip cards.

To mitigate this particular threat, businesses must adopt a number of security measures, including:

1. Dedicating a POS terminal solely to POS-related functions;
2. If budget does not permit #1, prohibiting employees from using a non-dedicated POS system for non work-related tasks (e.g. personal web browsing, email, or social media);
3. If #2 is still not possible, training employees to recognize and handle phishing emails/messages;
4. Updating all firmware and software;
5. Using reputable antivirus software;
6. Using firewalls and content filtering solutions that identify and block both suspicious inbound and outbound traffic;
7. Ensuring that in-house admins and third parties use strong passwords and 2-factor authentication; and
8. Adopting EMV-enabled cards, which theoretically eliminates credit card cloning.

For help to protect yourself from POS malware, feel free to contact us.

DNS Security Solutions and Your Brand

DNS Security Solutions And Your BrandHow much do you trust a firm once you learn it was the victim of ransomware, data exposure, downtime from a DDoS attack, or some other network breach? If you are like millions of others, you just don’t believe in such firms or sites afterward. That is why you need to consider the longevity and strength of your brand in the face of modern security threats, and implement DNS security solutions that do their best to protect it.

What Can You Do?

We already mentioned DNS security solutions, so let us continue along that thread. In the world of online threats, it seems that DNS has become a popular target for exploits. This is partly due to the rise of IoT or the Internet of Things. These devices are often left unsecured, then infected with malware and turned into an army that floods DNS services and leave their global clients unavailable.

Of course, attacks can also source from within through such activities as torrent and file sharing, adult website visits and other (often prohibited) behaviours. Ideal DNS security solutions would address all of these things through proper monitoring and defence. For example, advanced malware protection, easy to use cloud security solutions, and advanced DNS protection could implement the following actions:

Network policy enforcement – It may seem extreme to create pre-emptive blocks, but your brand’s reputation is worth far more than a few employees feeling annoyed that you cannot just trust them to follow policy. Optimized solutions are able to create effective blocks for tagged traffic patterns, preventing disasters from striking with a single click.

Network protection – Real time protection is nearly impossible to overemphasize, and particularly where DNS security is concerned. When built in a layered design, it will allow you to know that any malicious activity or malware in the system will be identified before it can wreak havoc. A solid solution incorporates botnet, APT and malware or ransomware protections.

Network management – Proper defence of the DNS and network is impossible without the clarity of network assessment and evaluation. Where are your vulnerabilities? Where is there wasted bandwidth? What is the nature of the traffic? It is only through clear data that you are able to make informed decisions about the nature of threats inside or outside of the network.

This is a system of defence that will only enhance your brand. While more and more threats appear, and more and more global names (think Airbnb, PayPal and Sony) are threatened by breaches and botnets, you can easily implement DNS security solutions when you turn to the qualified experts.

Your DNS and IoT Vulnerabilities

Your DNS and IoT VulnerabilitiesAre you properly defended? In the sense of your computer and network safety, do you feel you have a good defence in depth strategy? This is not something to take lightly, and if you wish to truthfully answer yes, you have to be sure you have defences such as a DNS firewall, advanced malware protection, cloud security solutions, and more. Let us take a moment to understand just why this is important to anyone online.

Consider this – the source code for the Mirai botnet was shared online in late 2016. This is a form of malware that converts networked IoT devices into remote controlled bots. These are then used in enormous numbers to perform network attacks at an astonishing scale. In fact, the Mirai botnet actually knocked the entire nation of Liberia offline.

Once the Mirai botnet was shared, though, it split many times over, and now there are multiple Mirai derivatives at work. While you may not yet know what that means to you in terms of security, it is safe to say that you do not want to become victim to it – whether as a business owner or consumer.

To understand why a strong DNS firewall, real time malware protection, and internet security services are important, we need to look at what happened when the Mirai botnet set to work in October of 2016.

Mirai at Work

When the malware had infected enough machines, it attacked and disrupted websites as famous as Airbnb, PayPal, Spotify and the PlayStation network. It did this by taking over IoT (Internet of Things) devices like baby monitors, CCTV systems, DVRs and routers. Though you may not think that the processing power of your CCTV system would amount to much, imagine millions of devices pooling their resources…this is how the Mirai botnet (and many other botnets) operate.

What did it use the power for? It performed a DDoS or distributed denial of service attack that flooded the systems at a firm known as Dyn, a cloud DNS provider. While IT experts are consistently advising against online businesses relying strictly on a single DNS provider in order to ensure accessibility even when under an attack, there are steps that you can take directly to protect yourself.

Considering Real Time Solutions

A DNS firewall is easily one of the strongest ways to overcome the risk of IoT vulnerability, botnets, malware and other threats. It will prevent system connections to known or recognized malicious locations. However, it can also make you aware of the presence of botnets within, or threatening, your network. Because the availability of your website (which is your business) is linked to the availability of your network, you have no real choice but to find ways to implement DNS security solutions. It is the availability of those DNS services that make you reachable, and the botnet attacks are directly targeting this accessibility.
Until IoT devices and other vulnerabilities that plague the Internet are remedied, it is best to find options for a DNS firewall, DNS security solutions, advanced malware protection and other cloud security solutions.

Ransomware nets $1 Million from Korean Web Provider

We knew that WannaCry wasn’t going to remain the biggest ransomware news for long, but we certainly didn’t expect the next big thing to strike so soon either. Earlier this week, a ransomware gang managed to collect the biggest known ransomware payout in history, a cool $1 Million USD.

The WannaCry operation, which affected over 200,000 computers in 150 countries, only managed a total of $142,479 worth of bitcoin as of June 24. Not bad, but certainly not as lucrative as $1 000,000.00.

Aside from the type of ransomware used, the major difference between these two record-setting ransomware incidents is the scope of the attacks. WannaCry was designed to be more of a “spray and pray” type of attack and hence had a larger scope. This new attack, on the other hand, was a targeted attack aimed at only one company.

This particular victim was actually a South Korean web provider named Nayana. The attack, which held 153 Linux servers captive, affected more than 3,400 websites hosted by Nayana. Given the stakes – loss of customer data, business opportunity, revenue, and trust, as well as potential legal actions – Nayana felt it had no choice but to pay up.

This record-setting ransom payment will certainly have serious repercussions. Cybercriminals will now be more inspired than ever to launch their own ransomware attacks. The only way to discourage future attacks is by not paying the ransom. Sadly, that’s easier said than done. It’s easy to preach until you become a victim and it’s your business on the line.

We’re sure to see a whole new wave of ransomware soon. Until then, make sure that your backup and disaster recovery plans are up to par and look to enhance the security of your network.

Are Vigilante Worms the Solution to IoT Botnets?

Mirai, the IoT botnet responsible for record-breaking DDoS attacks last year, has taken a hit. Thanks in part to what appear to be ‘vigilante worms’, which are either taking over or taking down the IoT devices that make up Mirai’s massive network. While these worms might have been effective in disrupting Mirai’s operations, are vigilante worms really the solution to the IoT botnet epidemic?

So far, cyber security researchers have identified two worms that appear to be the handiwork of vigilantes: Hajime and Brickerbot. The former seems to be taking over IoT devices targeted by Mirai, while the latter goes a step farther, rendering the devices unusable.

There’s no doubt Mirai and its ilk are serious threats to business. They already crippled several high-traffic websites and cloud-based services like Amazon, CNN, Netflix, Twitter, and The New York Times in a single DDoS event which rendered them unavailable to a large part of the United States and Europe.

There’s also no question that most IoT devices are widely vulnerable to hacking. When you combine the severity of the IoT botnet threat with the vulnerability and proliferation of IoT devices, it’s easy to see how serious the risk is. While something must be done to mitigate this risk, should that include acts of vigilantism?

Before tackling this question, it is important to know what we’re dealing with.

 

Characteristics of the Hajime worm

Like Mirai, Hajime is a worm, meaning it’s capable of infecting a device and then spreading to other devices in the network without any human intervention. Like Mirai, Hajime also targets IoT devices. It penetrates them by scanning open Telnet ports and then breaking in using default factory passwords.

Hajime has a couple of other features that’s supposed to make it more effective than Mirai. For example, instead of using a centralized C&C (Command-and-Control) server for sending commands to its bots, Hajime uses a P2P (peer-to-peer) architecture. In this architecture, the bots themselves also serve as C&Cs.

To take down a botnet, you need to chop off its head by severing the C&C channel. Thus, Hajime’s network is more resilient than Mirai’s because it consists of multiple C&Cs (i.e., multiple heads to chop off) while the latter may only have one or two of them.

The Hajime botnet is constantly evolving, with the authors adding new features to make it even more stealthy and resilient as well as more effective at breaking into IoT devices.

Malware researchers believe it now has three attack methods. The first method can exploit an Arris cable modem’s password-of-the-day, a relatively old remote backdoor that’s been used since 2009. The second is the Telnet default password attack, which is just like the one employed by Mirai. And the third is the TR-069 exploit, a relatively new attack that exploits the TR-069 standard which ISPs use to manage modems remotely.

Once it’s able to break into a device, Hajime tries to conceal its activities by hiding its running processes and accompanying files. It also enables attackers to open a remote shell over which they can issue commands.

With all these advanced features, you’d think Hajime would be all set to claim Mirai’s turf. It could, but strangely, the authors of Hajime don’t seem interested in doing that. Unlike Mirai, Hajime’s not equipped with DDoS (Distributed Denial-of-Service) capabilities. In fact, in its current form, it doesn’t seem to have any capabilities for attacking other systems (except of course the IoT devices it ensnares).

Instead, it simply seems to be preventing Mirai from carrying out its plans. Hajime does so by blocking ports 23, 7547, 5555, and 5358 – the very same ports normally exploited by Mirai. While those ports are blocked, Mirai is unable to break into the device.

According to researchers, Hajime displays a cryptographically signed message on the terminals (if there are any) of ensnared devices. The message goes states: “Just a white hat, securing some systems. Important messages will be signed like this! Hajime Author. Contact CLOSED Stay sharp!”

Hajime does have a few weaknesses though. Like Mirai, Hajime only gets loaded in the device’s RAM. Thus, it lacks a persistence mechanism that would allow it to stay in the device indefinitely. As soon as the device is rebooted, it would automatically be free from the Hajime infection and those blocked ports would be open (and vulnerable to either a Mirai or Hajime infection) once again.

Hajime’s not the only computer worm out to spoil Mirai’s party. There’s one more, and it’s called Brickerbot.

 

Brickerbot characteristics

Like Hajime, Brickerbot is another vigilante worm that breaks into IoT devices by exploiting default passwords. Unlike Hajime however, which only blocks ports targeted by Mirai upon infection, Brickerbot takes a more radical approach; it bricks every IoT device it infects.

More specifically, Brickerbot wipes the device clean and disconnects it from the Internet. As soon as you reboot the device or do a factory reset, you’ll realize it’s already been bricked. Naturally, a bricked IoT device can no longer be infected. It’s a rather cruel way of countering the Mirai epidemic and the author of Brickerbot knows it, calling his/her approach a form of “Internet Chemotherapy”.

Chemotherapy, which is commonly used for treating cancer patients, destroys not only cancer cells, but also good cells. Janit0r, (the name used by Brickerbot’s author) thinks the ubiquity of vulnerable IoT devices and the risk they pose (i.e. massive DDoS attacks) is a critical issue that “couldn’t be solved quickly enough by conventional means.” and therefore requires a radical treatment.

 

It takes a worm to stop a worm?

A computer worm like Mirai spreads from one device to another on its own. It doesn’t require a human being to install, download, or copy it. For this reason, a large number of devices can be infected by Mirai in a short period of time. And if you’re talking about IoT devices, that number can easily reach millions.

With such a high infection rate, any undertaking for stopping this malware that relies on manual methods will surely prove futile. That’s why the authors of Hajime and Brickerbot are taking this path. They obviously think, in order to stop a worm, you need a solution with worm-link capabilities.

 

Understanding the risks of relying on vigilante worms

First of all, we must remember that these worms are developed by human beings. People are fickle. What starts with noble intentions may develop into something else.

Because Hajime and Brickerbot already have the ability to break into IoT devices, propagate, and lock down its victims, just a small update would be needed for them carry out more sinister acts if their authors eventually decide to turn to the dark side.

These newly weaponized botnets could then be used to launch DDoS attacks or infect and brick IoT-enabled critical devices such as medical equipment. Many of the infected devices are cameras which could lead to espionage or voyeurism.

Even if these worms’ developers maintain their do-good profile, several threat actors could take interest in these projects. If malicious individuals are able to hijack these worms, they could then be weaponized.

Let’s also not forget the fact that, certain vigilante worms – like Brickerbot – have the tendency to inflict disproportionate punishment or unwarranted collateral damage. These worms are supposed to punish IoT device manufacturers for failing to build secure devices, but these worms are in fact destroying other people’s property. Two wrongs still don’t make a right.

Nevertheless, the emergence of Mirai, Hajime and Brickerbot should serve as a wake up call to the manufacturers of IoT devices. The vulnerabilities on these devices pose a serious threat not only to the potential victims of DDoS attacks, but also to the owners of these devices who may be collateral damage to acts of cyber vigilantism.

These 6 DNS Attacks Threaten Your Business

Most Internet-based tasks are dependent on DNS: web browsing, email, file transfers, social media posts, instant messaging, and a variety of communications and data exchange processes. It follows then, if you take down a DNS service, other networking services may also be rendered unusable.

Because these services are vital to modern-day business operations, any threat that may cause an extended disruption to these services must be considered critical. The biggest threats to the availability of DNS (and in turn, network services) are denial-of-service attacks. In this post, we talk about the different types of DNS DoS attacks and discuss the mechanisms behind each type of attack

 

Fundamentals of a DNS DoS attack

The concept of a DNS Denial of Service (DoS) attack is pretty simple. A concentrated attack from tens, hundreds, thousands, or even millions of machines is directed to a DNS server (or group of servers) with the intention of preventing it from providing DNS services to clients or resolvers. It’s like getting blocked from your phone’s contact list. If you can’t access your address book, you likely won’t be able to call your friends, relatives, etc.

When clients and resolvers are denied access to DNS, users and machines (in the case of B2B transactions) will be unable to carry out tasks that are dependent on DNS. There are different ways of taking down or disrupting a DNS service, here are some of the most common.

 

1. DNS Flood

One of the most common types of DNS DoS attacks is the DNS Flood. This attack is carried out over the UDP (User Datagram Protocol) protocol, the primary protocol (the other being TCP) over which DNS messages are transmitted.

A DNS flood attack is performed by sending out a large number of DNS requests to UDP port 53. The goal of the attack is to overwhelm the target DNS server with requests (mostly consisting of malformed or bogus packet information) and prevent legitimate requests from coming through.

 

2. TCP SYN Flood

Although most DNS messages are transmitted through UDP, a substantial volume of messages are also transmitted through TCP (Transmission Control Protocol). DNS responses that exceed 512 bytes in size or transmissions involved in zone transfers all use TCP. For this reason, DNS servers can be vulnerable to TCP SYN Flood attacks, a type of DoS attack that exploits the TCP three-way handshake.

In a nutshell, the TCP three-way handshake works like this:

  1. Client requests a connection to a server by sending a SYN message to the latter
  2. Server responds with a SYN-ACK message as acknowledgement
  3. Client responds with an ACK message as its own acknowledgement, and a connection is established

An attacker who exploits this handshake typically sends a SYN request to the victim, which in our case would be a DNS server, but the victim doesn’t receive any ACK after it responds with a SYN-ACK.

The attacker does this by either not sending back the expected ACK or by using a spoofed source IP address. When a spoofed IP address is used, the DNS server will end up sending its SYN-ACK to the owner of the spoofed IP, who won’t respond because it never sent a SYN request in the first place.

The victim then waits for the response in case the ACK was simply delayed due to poor network conditions. In the meantime, it’s forced to allocate resources for the half-open connection.

In a DNS TCP SYN Flood DoS attack, an attacker directs a large number of these bogus SYN requests to a DNS server. While the victim waits for ACK responses which will never arrive, it continues to allocate resources for the partial connections. Eventually, the server runs out of resources to allocate and additional SYN requests, including those from legitimate clients, are denied.

 

3. NXDOMAIN Flood

When a client or DNS resolver sends out a domain resolution request to a DNS server and the server is unable to resolve that domain into an IP address, the server responds with what is known as an NXDOMAIN response message. This response is sent when the server believes the domain doesn’t exist.

In an NXDOMAIN Flood, an attacker floods a DNS server with queries for non-existent domain names. As a result, the server wastes computing resources trying to resolve domains that don’t exist. At the same time, the server’s cache accumulates NXDOMAIN results, pushing out valid cache entries in the process. When this happens, the server’s processes slow to a crawl and/or will be unable to accept additional requests, legitimate or not.

 

4. DNS Reflection

In a DNS reflection attack, the attacker sends out DNS requests to one or more DNS servers. These DNS servers aren’t the main targets of the attack, but are used as conduits for conducting the attack.

The underlying trick in this attack lies in the attacker’s DNS requests, which are actually spoofed requests. More specifically, the “from” or return IP address in the requests are spoofed. When the DNS servers receive the requests, they send their responses to the spoofed IP address.

 

Because the spoofed recipient was not expecting those DNS responses, as it never sent the requests in the first place, it uses resources trying to make sense of those responses. A few of these responses will not affect the target DNS server. However, once those responses number in the thousands, it can eventually overwhelm the target DNS server.

There is also a variation of this attack that makes it easier for attackers to overwhelm the target DNS server. It’s known as the DNS Reflection Amplification DoS Attack.

 

5. DNS Reflection Amplification DoS

In the DNS Reflection Amplification DoS attack, attackers exploit a DNS characteristic wherein the response is usually larger than the request or query. In fact, there are some DNS responses (like those using ANY or DNSSEC record types) that are many times larger than the original request.

The ANY request, for instance, requests ALL information pertinent to a domain. This may include MX records, A records, and several others – practically all cached records. So, the response can be much larger or “amplified”.

 

In addition to using queries that result in large responses, attackers can also exploit open resolvers in order to amplify the attack even further. Basically, the attackers send the requests via open resolvers, which in turn store the spoofed return addresses in their respective caches.

Once the spoofed return addresses are already cached in a large number of open resolvers, those cache-poisoned resolvers can then be used to launch a massive DDoS attack against the target DNS server.

 

6. Botnet DDoS

Today’s attacks on DNS systems have gotten more disruptive. What used to be simple DoS (denial-of-service) attacks have now evolved into much larger DDoS (Distributed Denial-of-Service) attacks. These attacks are typically launched from botnets, (a network of compromised computers that receive commands from attackers.

Instead of a single machine (or a handful of machines) sending out malicious/bogus packets to a DNS system, a DDoS attack may now involve thousands of machines.

Cyber criminals have also devised methods to ensnare IoT (Internet of Things) devices and build massive botnets out of them. Due to the considerably large number of insecure IoT devices already in use, DDoS botnets can potentially consist of hundreds of thousands or even millions of compromised devices.

As a consequence, DDoS attacks are now much more disruptive than ever before. The IoT botnet DDoS attack on DNS provider Dyn last year, which had an estimated throughput of 1.2 Tbps and was said to be twice the size of the previous largest DDoS attack on record, managed to block users from practically the entire US East Coast and many parts of Europe.

Unless IoT manufacturers start taking security seriously and address the vulnerabilities that plague IoT devices, the threat of massive DDoS attacks on DNS systems will remain.

 

Next steps

The availability of your business is now closely tied with the availability of your network, which is in turn highly dependent on the availability of DNS services. In order to prevent major disruptions to your business due to DNS denial-of-service attacks, your DNS must be an integral part of your defence strategy. Learn how.

Why You Should be Concerned With DNS Security

DNS servers are vital to almost every process that takes place on the Internet. They allow us to browse the web, transact on an e-commerce site, chat via instant messaging, send out file transfers, communicate through email, etc. So when these DNS servers are compromised or somehow fail, the services that rely on them can be adversely affected. 

That’s exactly what happened last October when a DNS provider serving popular websites like Twitter, Amazon, AirBnB, CNN, Comcast, Spotify, Tumblr, Wired, and many others, got hit by a massive DDoS attack. From the point of view of the end users, those sites appeared to be down. While their servers were technically available, they weren’t reachable. That’s because the DNS system users relied on to get to those sites were out of commission.

Why DNS is crucial to Internet connectivity

The main function of the Domain Name System (DNS) is pretty simple; it’s designed to associate certain information to domain names. DNS is responsible for resolving IP addresses to hostname/domain names and back.

This is necessary because the servers that host sites like xdomain.com or ftp.somedomain.edu are actually identified by client machines through IP addresses like 62.115.13.128 or 210.213.130.182 and not through the domain names xdomain.com or ftp.somedomain.edu per se. The client machines – i.e., desktops, laptops, tablets, smartphones, or other servers – need to know what those IP addresses are before they can establish a connection.

When a user types something like xdomain.com into a browser, that request will first have to go through a DNS server. The DNS server (or more specifically, a chain of DNS servers) will then take that domain name, resolve it into the IP address that matches the domain name and then provide that information to the requesting client. Only then can the client connect to the xdomain.com server. 1

Without the DNS system, there’s no way the user will be able to connect without knowing the corresponding IP address for xdomain’s server.
 

Threats to DNS

Generally speaking, threats to DNS systems can be grouped into three:

●Threats against the integrity of data in a DNS system

●Threats against the confidentiality of data in a DNS system

●Threats against the availability of a DNS system

Threats to DNS integrity

Threats to data integrity in a DNS system pertain to threats that may result in intentional or accidental modification of data in a DNS system. There are certain pieces of data used in DNS which, if tampered with, can lead to serious consequences.

For example, if the Resource Records (RR) that are stored in zone files, memory or cache, are tampered with or if the responses to legitimate queries are tainted with bogus information, users can be redirected to other (potentially malicious) sites.

The most common type of attack aimed at damaging the integrity of a DNS system is cache poisoning. The objective of this attack is to force a DNS server to cache bogus information; usually a domain name mapped to the wrong IP address. As a result, when a client submits a legitimate query to the DNS system, the system will then reply with the wrong information.2

Once a cyber attacker succeeds in redirecting traffic to a malicious site (presumably also controlled by the attacker), bad things can happen. These sites are often meticulously crafted to resemble the legitimate site so that redirected users can be deceived into entering sensitive information like passwords, credit card data, and personally identifiable information (PII).

 

Threats to DNS availability

These are the types of threats that render DNS servers inaccessible. When that happens, DNS queries may go unanswered. As a result, clients will be unable to reach the sites they’ve been meaning to connect to. DNS outages can be caused by unintentional server failures or deliberate DoS/DDoS attacks.

3

Recent events have shown that this type of threat has the potential to inflict the most damage among the three. This is primarily because of the way a large portion of the Internet now operates, wherein a multitude of sites rely heavily on a few service providers. When a major DNS service provider bogs down, availability issues can easily affect a large number of sites or customers spanning a vast geographical area, just like what happened in the

Some of the common types of attacks that target DNS availability include the following:

●DNS amplification

●Distributed Reflection DoS (DrDoS)

●NXDOMAIN flood

●Phantom domain

●Slow drip

●TCP SYN flood

●IoT botnet DDoS

An IoT botnet DDoS attack was responsible for the Dyn outage. That attack, which was the largest DDoS attack on record, was noteworthy in that it was launched from an army of compromised IoT devices. This is a serious threat because, if it could bring down an infrastructure as robust as Dyn (even just for a few hours), it could easily overwhelm the infrastructures of much smaller DNS providers.
 

Threats to DNS confidentiality

Threats to the confidentiality of data in DNS systems are not as glaring as the other two, but shouldn’t be taken lightly. If, for example, RRs for internal hosts are stored in external name servers and those servers are compromised, the information obtained can provide attackers insights about the internal network. This information can then be used to support and inform subsequent stages of an attack.

One of the tasks many security consultants perform in the early stages of a penetration testing engagement is DNS reconnaissance. DNS reconnaissance can reveal a lot about an organization’s DNS servers, their RRs and, in turn, the organization’s network infrastructure.

Some of the techniques employed in DNS reconnaissance include:

●DNS server cache snooping

●Domain brute force

●Reverse lookup

●Zone transfer

●Zone walking

 

Impact to business

The impact of a DNS attack on businesses can vary greatly depending on the threat. If it’s an attack on the confidentiality of DNS data, the impact could be minimal.

However, if that incident was actually just reconnaissance that eventually led to a deeper penetration of the network, or a data breach, the impact could be huge. If the data breach involved personal information, the business could face legal action or hefty.

If it’s the integrity of DNS data that’s compromised and client machines are redirected to malicious sites, this can impact:

1.The owners of the client machines. Once these machines are redirected to malicious sites, the owners of these machines could suffer financial losses or loss of confidential information (e.g. credit card data or PII).

2.The owners of the spoofed sites. The moment word of the fraudulent transactions gets out (and spreads through social media), the businesses who own those sites could suffer irreparable brand damage. They could also suffer financial losses as they try to remediate the problem or defend themselves against lawsuits.

If it’s the availability of DNS services that’s compromised, the biggest consequences are likely to be in terms of opportunity and trust. If you have an online business (e.g. an e-commerce, or online banking site) and your DNS provider suffers a lengthy outage (say, several hours), the loss in terms of sales could be massive.

To learn more about using DNS security to protect your data and your reputation, contact us