Cryptocurrency scammers are getting more creative to convince potential victims to part with their money. Recently, the security community was shocked when a team of researchers discovered the existence of a sophisticated botnet on Twitter which was used as a comprehensive tool for spreading a cryptocurrency scam.

The botnet was discovered by a team of researchers from security firm Duo Security. The team was doing research on how to identify Twitter account automation and was reviewing the tweets of around 88 million accounts in an effort to study how bots operate.

The researchers used machine learning and other data science techniques to analyze close to half a billion tweets to uncover the structure of botnets. As a result, they discovered the botnet, comprised of more than 15,000 bots.

What is a Twitter bot?

Most people might not exactly know what a Twitter bot is, but virtually anyone who maintains an account with the popular social media platform has likely interacted with one. Simply put, a Twitter bot is just software designed to do a specific task. This automated software is a tool for easier management of social media accounts and is especially useful for large organizations.

Malicious use of such bots has been highlighted by recent media reports. For instance, Russian Twitter bots were used in trying to influence US election results. Bots are also sometimes used to spread false information, rig online surveys, and even inflate social media metrics.

Not All Bots are Dangerous

Conversely, there are a host of legitimate uses for automating Twitter accounts; companies often use them to manage their social media accounts. Some legitimate bots automate the handling of customer responses, others are used schedule the release of online content. Benign twitter bots can do everything from answering frequently asked questions to providing flight information.

The Cryptocurrency Scam Botnet

The botnet involved in the cryptocurrency scam discovered by the Duo Security researchers is significant in scale. According to the firm’s report, the botnet is composed of more than 15,000 fake accounts managed by bots.

To maintain a veneer of credibility, the scam created spoofed versions of legitimate cryptocurrency-affiliated Twitter accounts. These spoofed or fake accounts would mimic the originals by copying the profile pictures and imitating the names of the legitimate accounts.

These fake crypto-related accounts will then post a reply to a tweet sent out by the legitimate Twitter accounts. The reply would contain a link of a cryptocurrency giveaway and victims are fooled into clicking the link, thinking that it was shared by the legitimate Twitter account.

The scam botnet was able to avoid automated detection for so long by employing increasingly sophisticated techniques. For instance, the bots would use Unicode characters in tweets instead of traditional ASCII characters, add spaces between words and punctuations to introduce some variance to the tweets, and edit their profile pics to modify them slightly from the original account’s pictures.

Fake Twitter Accounts Involved in Crypto Scams on The Rise

Fake Twitter accounts promoting various types of crypto scams have been plaguing the platform for months now. Scammers have been impersonating famous personalities such as Elon Musk, Warren Buffet, and even Ethereum co-founder Vitalik Buterin, using their names to ask for a small amount of crypto while promising substantial future returns.

Even Britain’s Financial Conduct Authority (FCA) recently issued a warning that crypto scammers using social media platforms such as Twitter are on the rise. According to the FCA, these scammers are now trying to entice victims by using fake celebrity endorsements to sweeten the deal. Clicking on the links contained in these endorsements will redirect potential victims to a professional-looking site offering various crypto-related products.

Faced with increasingly sophisticated cybercriminals, it pays to be vigilant; especially in making online transactions. Always check if the Twitter account used has been verified and check for how long it has been in use. Avoid links when possible, navigate to the company web page yourself.  In addition, always be wary if the promotion seems unrealistic. If the deal sounds too good to be true, then it probably is.

If you think you’ve been consuming web content for free without signing up for a subscription or by disabling ads, you could be in for a big surprise. As it turns out, some websites make you pay for your use whether you’re agreeable to it, or even aware of it. How exactly? By employing cryptojacking, the latest malware fad to hit unsuspecting victims everywhere. Cryptojacking is defined as the unauthorized use of computing resources for the purpose of mining cryptocurrency.

Why cryptojacking is on the rise

Bitcoin, currently the most widely-circulated of these digital currencies, reached a record high value of more than $19,000 (per coin) last December 2017. It has been on the decline since then, presently valued at roughly $6,000.00.

These prices are nothing to scoff at, especially since malicious actors can get away with mining cryptocurrencies for free. Despite heavy fluctuations in value, the cryptocurrency market isn’t going away any time soon.

It’s therefore no surprise that cryptocurrency mining scripts have been making the rounds across thousands of websites. As an illicit means of generating revenue, cybercriminals have found cryptojacking to be a worthy alternative to ransomware because it’s easier to deploy, requires no interaction with the victims, and can remain undetected for a long time.

How cryptojacking works

There is no central bank that mints these virtual currencies like your regular banknotes and coins. Instead, cryptocurrencies are generated or mined when a computer solves complex math puzzles, adding to the constantly growing “blockchain,” essentially infinite bits of decentralized information. The hardware that contributed to the transaction gets a sort of miner’s fee in the form of that block’s coin.

While a detailed explanation of blockchain technology and cryptomining merits a separate article altogether, suffice it to say that mining for cryptocurrency can be a very profitable endeavor. To have a computer perform cryptomining in secret, hackers deploy one of two ways: by loading cryptomining code onto the victim’s computer, or by injecting a mining script on a website or an ad that circulates in numerous websites.

In the first method, the hacker relies on phishing techniques to load the code into a target computer. The owner receives a legitimate appearing email and is encouraged to click the link to initiate or complete a certain process. Instead of the expected transaction, the victim unwittingly installs a program that secretly mines digital currencies.

Using JavaScript on a website as described in the second method is commonly referred to as in-browser cryptojacking. There’s really no getting around it because as soon as you load a page, the mining code begins to run. No opt-ins are required, and no installations are needed.

While websites most often deploy in-browser cryptojacking to earn the money they can’t generate with just online advertising, hackers usually make use of both methods to maximize their earning potential.

Should you be worried about?

It’s worth noting that unlike other security threats, cryptojacking doesn’t cause any obvious and immediate damage to the host computer or to the data stored therein. Once cryptojacking scripts get to work however, they do affect the computer’s performance adversely by hijacking processing power.

Over time, the constant and intense mining can eventually take its toll on the victim’s device, not to mention driving up one’s electricity bill. According to a widely-cited website that tracks relevant cryptocurrency developments, the electricity used in a single Bitcoin transaction could power about 30 US households for a day. Other examples liken it to energy that could boil 36,000 water-filled kettles. Note that these comparisons are solely for Bitcoin transactions which are known to demand the most high-powered computing resources.

Falling victim to cryptojacking schemes is something that should be cause for concern. The degree to how much this affects the victim however, depends on the amount of processing power one actually contributes. For the average computer user, having a slower computer and a slightly higher electric bill, could be no more than a minor annoyance or even considered a fair trade for being able to access free content.

For an organization with numerous devices connected to their network, the collective illegal usage of company devices could add up to a significant amount of resource and power costs. The lowered productivity for employees who are bogged down by poorly-performing computers, and the added manpower costs for IT personnel who need to track down and troubleshoot the performance issues should also be considered. Of course, the primary concern is the unauthorized usage of your property and the potential for more malicious malware being installed.

If you’d like to learn about how our DNS Security Solutions can help identify and prevent cryptojacking, visit us at http://www.defintel.com

Rootkits are among the most dangerous tools in a malware developer’s toolbox. They can be easily added to malware in order to gain unauthorized, privileged access to a system as well as achieve stealth and persistence. While not all rootkits are used for malicious purposes, we’ll focus on those that are.

Origin of the term ‘rootkit’

The term rootkit can be broken down into two parts. The ‘root’ part can be traced to its origins in UNIX and UNIX-based operating systems. In these environments, the root refers to an account with administrative privileges. Anyone who has root-level access can do pretty much anything on the system.
Because the ability to have unrestricted privileges can be dangerous in the hands of a bad actor, or even a beginner, most modern-day UNIX-based operating systems like MacOS, Red Hat, and Ubuntu disable the root account by default and just issue regular user accounts. A regular user account will have a minimal amount of privileges.

As for the ‘kit’ in rootkit, it’s an abbreviation of the word ‘toolkit’. This particular toolkit, which is used by malware developers, typically consists of programs, scripts, and other pieces of code. So, a rootkit is a malicious toolkit used to gain privileged access and establish stealth and persistence.

Although the term rootkit has UNIX origins, it’s now commonly used in the Windows world. In fact, a large majority of the rootkits currently in circulation are Windows based.

How a rootkit works

In most cases, the rootkit itself doesn’t do any damage. Rather, its main function is to keep the malware (which is the one that does the damage) from being detected. It’s able to do this by hiding characteristics normally generated by programs when they’re installed or running on a system.

As soon as malware establishes residence on a system, its existence can often be given away by several indicators, such as:

• The presence of accompanying files
• The generation of certain processes (which, in Windows, can be seen in the Task Manager)
• The creation of certain registry keys
• CPU or disk space utilization
• And many others

Most security tools designed to detect malware, like say an antivirus, will monitor the system for any irregularities involving these indicators. The job of the rootkit is to tamper with the parts of the system that show these indicators so that the malware will appear invisible. For example, the rootkit may hide the malware’s files, its processes, or even its registry keys (in the case of Windows-based rootkits).

Types of Rootkits

In the Windows environment, rootkits are often classified into two types:

• User mode rootkits – These are rootkits operating in user space a.k.a. Ring 3, which is also where applications run.

• Kernel mode rootkits – These are rootkits operating in kernel space a.k.a. Ring 0. Generally speaking, these types of rootkits are the more dangerous (and more difficult to develop), as they are able to acquire the highest level of privileges in the OS.

Common Actions

Rootkits employ several cloaking techniques. But one particular technique used by user mode rootkits to hide malicious software is IAT hooking. The IAT or Import Address Table is a table where applications look up the addresses of pertinent functions found in DLLs (Dynamic-Link Libraries). 

A rootkit would typically alter (or ‘hook’) certain addresses so that those addresses would then point to the malware’s malicious code. So, when an application calls a hooked function, what would instead be executed would be the malicious code. Now, if that application were a virus scanner and the hooked function was supposed to support the malware detection process, the result of that scan would understandably be tainted. It would, for instance, omit the malware from the results.

Kernel mode rootkits also employ a similar API hooking technique. In this case, the API hooking technique is targeted at another lookup table known as the System Service Dispatch Table or SSDT. The SSDT runs in the kernel memory, where it stores addresses that point to system call functions.

Similar to what a user mode rootkit would do with an IAT, a kernel mode rootkit would tamper with the SSDT so that system calls would be diverted to the malware’s code. Again, if the original system call had something to do with malware detection, this SSDT hooking technique would remove the malware from the results.

Threat Level

Because rootkits are exceptionally good at hiding malware, they’re a serious threat to any system. Once they get installed, it can be very difficult to detect and, in turn, remove them. Some experts even suggest a total re installation of the operating system.

As with most things, the best way to counter rootkits is through prevention rather than detection and remediation. Rootkits are most commonly installed via social engineering techniques or through malware droppers, so defensive countermeasures should be aimed at these particular threat vectors.

Webinjects have now taken the place of keyloggers and form grabbers in the financial malware arena as the primary means of stealing login credentials and other personal information through a web browser. Some webinjects are even capable of performing tasks that traditional malware modules can’t do, like carrying out automated fraudulent transactions.

In this post, we help you understand what webinjects are, explain their underlying mechanisms, and look into the different ways cybercriminals use them.

How Webinjects Work

Webinjects are modules or packages used in financial malware that typically inject HTML or JavaScript code into content before it’s rendered on a web browser. As a result, webinjects can alter what the user sees on his/her browser, as opposed to what’s actually sent by the server. For example, it can add or remove text, labels, text fields, and other GUI elements.

Figure 1 below shows a simplified illustration of a webinject inserting an additional field to a form sent by an online bank’s server. The purpose of those extra fields (presumably accompanied by supporting labels and instructions) is to dupe the user into entering certain confidential information (e.g. login credentials, credit card numbers, CVVs, PINs, tokens, etc.) even if that information was not being requested by the online bank in the original form.

Figure 1 – A webinject inserting an additional field

Webinjects can remove web page elements as well. One purpose of doing so is to prevent the user from seeing security alerts/warnings that might hamper the malware’s fraudulent activities.

Figure 2 – A webinject removing a warning

Because the extra fields appear in the course of a legitimate transaction after presumably a secure login, the unwitting victim wouldn’t suspect anything amiss and would promptly enter the requested information. Once the attackers get a hold of that information, they can then use the information to perform unauthorized logins and carry out fraudulent transactions.

Can’t we prevent these malicious content alterations by using HTTPS, i.e. so that data can be encrypted by SSL or TLS? Unfortunately not. While HTTPS does encrypt data from the online bank’s web server to the user’s computer, many of these webinjects (like those used by SpyEye and its derivatives, for example) operate between the HTTPS API functions and the browser’s rendering engine. At that point, the data would have already been decrypted and thus be vulnerable to tampering.

When HTTPS is used, the unaltered HTML and CSS source code (which dictate the appearance of the webpage) is transmitted from the web server to the user’s computer in encrypted form. Of course, that code has to be decrypted eventually. Otherwise, the browser rendering engine wouldn’t be able to parse the code, process the layout, paint the tree, and then ultimately display the text, buttons, fields, etc. for the user to see and interact with.

The decryption process takes place when the code reaches the network APIs (in the case of Windows, that would be in the Wininet.dll library). In other words, the code is decrypted before it’s forwarded to the browser’s rendering engine. This is where the attack is carried out and the webinject is called into play. Because the attack essentially happens in the browser, it’s usually considered as a Man-In-The-Browser (MITB) attack.

A man-in-the-browser attack is usually carried out by hooking the API functions responsible for sending and receiving the HTTP or HTTPS data. API hooking is basically a technique that enables a piece of software (in this case, the malware) to intercept function calls or messages exchanged between two other pieces of software and make unauthorized changes. In this case, the changes are able to alter the web content.

There are a number of ways to hook an API but the popular methods include inline hooking, IAT (Import Address Table) hooking, and export address table (EAT) hooking, to mention a few.

Configuration files

Most banking trojans target multiple financial institutions. Because the web pages and the corresponding content of these different institutions naturally vary from one another, the webinjects are designed so that they can easily adapt to whichever URL the user has visited (provided of course that URL is included in the target list). This is done with the help of a configuration file.

A webinject configuration file contains instructions that support the injection process, e.g. the target URL, what to inject, where (on the webpage) to inject, etc. In most cases, the malware polls it’s C&C (command and control) server and obtains its configuration file from there.

Having the malware retrieve its configuration file from a remote C&C provides a convenient way for the malware operators to update the details in the file if needed. This can come in handy if any of the target institutions decide to change the URLs or the web page content associated with those URLs.

A configuration file consists of configuration blocks, with each block consisting of a set of parameters specifying a target URL, the corresponding modifications to be made for that URL, and a couple of other instructions.

For example, if you happen to view the configuration files of Zeus and SpyEye, you’ll find that each block consists of the following parameters:

set_url – This is where the target URL is specified. In most cases, the ‘URL’ is written in the form of a regular expression in order to target a set of URLs that match a certain pattern. These URLs are accompanied by letters like G, P, and L that tell the malware what to do when the browser lands on that particular URL.

For example, G instructs the malware to act on all GET requests, P tells it to act on POST requests, and L instructs it to log certain data.

data_before – Defines existing content on that URL that, after injection, should be displayed right before the injected content.

data_after – Defines existing content on that URL that, after injection, should be displayed right after the injected content.

data_inject – This is where the content to be injected is specified, typically in the form of HTML or JavaScript code, and is basically the web inject itself. The main code can be either written inline or referenced as an external script.

Other Criminal Applications of Webinjects

Their ability to hijack a legitimate transaction on a trusted site (e.g. the user’s online bank) and then display content to dupe users into submitting confidential information or responding to some kind of call-to-action makes webinjects suitable for other criminal activities.

Attacking Facebook users

A couple of years ago, the Qadars banking trojan used webinjects to force an infected system’s browser to display deceptive content when the user was on Facebook. The content was designed to trick the victim into entering his/her phone number, performing a series of actions, and then ultimately downloading Android malware known as iBanking.

Corporate espionage

There have also been reports in the past of browsers getting infected with Zeus (a popular banking trojan) and then displaying pop-ups that asked for the user’s employer and phone number.

It was suspected that the Zeus operators may have combined this information with the user’s passwords (which the operators may have acquired through a separate form also displayed via webinjects) to gain access to that user’s corporate network.

Once attackers are able to gain initial access to a corporate network, they could apply privilege escalation techniques to gain a better foothold into the infrastructure and conduct corporate espionage. But how could attackers infiltrate a corporate network using information gained from a user’s banking transactions? Easy. By taking advantage of poor security practices.

Unless they belong to an organization that implements a strict password policy, a lot of end users tend to recycle passwords. Not only do they use the same passwords for all their corporate business applications, they also use those same passwords in their personal activities – including banking transactions. As you can see, malware operators can use webinjects to steal not only money but also intellectual property.

Webinject kits on the market

You’ve heard of exploit kits, right? Those bundles of exploits sold to malware operators in the dark corners of the Internet. Well, there are also webinject kits. Mainly consisting of webinject configuration files, webinject kits are specifically marketed to banking trojan operators. Some kits are simply designed to steal confidential data, while the more advanced kits are equipped with ATS (automatic transfer system), mechanisms for bypassing 2-factor authentication, and even mobile device components.

The presence of these webinject kits is now making it much easier for cybercriminals to launch their own banking trojan campaigns.

Do you have the capability to detect these types of malware before their operators defraud your employees or, worse, penetrate your network?