We knew that WannaCry wasn’t going to remain the biggest ransomware news for long, but we certainly didn’t expect the next big thing to strike so soon either. Earlier this week, a ransomware gang managed to collect the biggest known ransomware payout in history, a cool $1 Million USD.

The WannaCry operation, which affected over 200,000 computers in 150 countries, only managed a total of $142,479 worth of bitcoin as of June 24. Not bad, but certainly not as lucrative as $1 000,000.00.

Aside from the type of ransomware used, the major difference between these two record-setting ransomware incidents is the scope of the attacks. WannaCry was designed to be more of a “spray and pray” type of attack and hence had a larger scope. This new attack, on the other hand, was a targeted attack aimed at only one company.

This particular victim was actually a South Korean web provider named Nayana. The attack, which held 153 Linux servers captive, affected more than 3,400 websites hosted by Nayana. Given the stakes – loss of customer data, business opportunity, revenue, and trust, as well as potential legal actions – Nayana felt it had no choice but to pay up.

This record-setting ransom payment will certainly have serious repercussions. Cybercriminals will now be more inspired than ever to launch their own ransomware attacks. The only way to discourage future attacks is by not paying the ransom. Sadly, that’s easier said than done. It’s easy to preach until you become a victim and it’s your business on the line.

We’re sure to see a whole new wave of ransomware soon. Until then, make sure that your backup and disaster recovery plans are up to par and look to enhance the security of your network.

Mirai, the IoT botnet responsible for record-breaking DDoS attacks last year, has taken a hit. Thanks in part to what appear to be ‘vigilante worms’, which are either taking over or taking down the IoT devices that make up Mirai’s massive network. While these worms might have been effective in disrupting Mirai’s operations, are vigilante worms really the solution to the IoT botnet epidemic?

So far, cyber security researchers have identified two worms that appear to be the handiwork of vigilantes: Hajime and Brickerbot. The former seems to be taking over IoT devices targeted by Mirai, while the latter goes a step farther, rendering the devices unusable.

There’s no doubt Mirai and its ilk are serious threats to business. They already crippled several high-traffic websites and cloud-based services like Amazon, CNN, Netflix, Twitter, and The New York Times in a single DDoS event which rendered them unavailable to a large part of the United States and Europe.

There’s also no question that most IoT devices are widely vulnerable to hacking. When you combine the severity of the IoT botnet threat with the vulnerability and proliferation of IoT devices, it’s easy to see how serious the risk is. While something must be done to mitigate this risk, should that include acts of vigilantism?

Before tackling this question, it is important to know what we’re dealing with.

Characteristics of the Hajime worm

Like Mirai, Hajime is a worm, meaning it’s capable of infecting a device and then spreading to other devices in the network without any human intervention. Like Mirai, Hajime also targets IoT devices. It penetrates them by scanning open Telnet ports and then breaking in using default factory passwords.

Hajime has a couple of other features that’s supposed to make it more effective than Mirai. For example, instead of using a centralized C&C (Command-and-Control) server for sending commands to its bots, Hajime uses a P2P (peer-to-peer) architecture. In this architecture, the bots themselves also serve as C&Cs.

To take down a botnet, you need to chop off its head by severing the C&C channel. Thus, Hajime’s network is more resilient than Mirai’s because it consists of multiple C&Cs (i.e., multiple heads to chop off) while the latter may only have one or two of them.

The Hajime botnet is constantly evolving, with the authors adding new features to make it even more stealthy and resilient as well as more effective at breaking into IoT devices.

Malware researchers believe it now has three attack methods. The first method can exploit an Arris cable modem’s password-of-the-day, a relatively old remote backdoor that’s been used since 2009. The second is the Telnet default password attack, which is just like the one employed by Mirai. And the third is the TR-069 exploit, a relatively new attack that exploits the TR-069 standard which ISPs use to manage modems remotely.

Once it’s able to break into a device, Hajime tries to conceal its activities by hiding its running processes and accompanying files. It also enables attackers to open a remote shell over which they can issue commands.

With all these advanced features, you’d think Hajime would be all set to claim Mirai’s turf. It could, but strangely, the authors of Hajime don’t seem interested in doing that. Unlike Mirai, Hajime’s not equipped with DDoS (Distributed Denial-of-Service) capabilities. In fact, in its current form, it doesn’t seem to have any capabilities for attacking other systems (except of course the IoT devices it ensnares).

Instead, it simply seems to be preventing Mirai from carrying out its plans. Hajime does so by blocking ports 23, 7547, 5555, and 5358 – the very same ports normally exploited by Mirai. While those ports are blocked, Mirai is unable to break into the device.

According to researchers, Hajime displays a cryptographically signed message on the terminals (if there are any) of ensnared devices. The message goes states: “Just a white hat, securing some systems. Important messages will be signed like this! Hajime Author. Contact CLOSED Stay sharp!”

Hajime does have a few weaknesses though. Like Mirai, Hajime only gets loaded in the device’s RAM. Thus, it lacks a persistence mechanism that would allow it to stay in the device indefinitely. As soon as the device is rebooted, it would automatically be free from the Hajime infection and those blocked ports would be open (and vulnerable to either a Mirai or Hajime infection) once again.

Hajime’s not the only computer worm out to spoil Mirai’s party. There’s one more, and it’s called Brickerbot.

Brickerbot characteristics

Like Hajime, Brickerbot is another vigilante worm that breaks into IoT devices by exploiting default passwords. Unlike Hajime however, which only blocks ports targeted by Mirai upon infection, Brickerbot takes a more radical approach; it bricks every IoT device it infects.

More specifically, Brickerbot wipes the device clean and disconnects it from the Internet. As soon as you reboot the device or do a factory reset, you’ll realize it’s already been bricked. Naturally, a bricked IoT device can no longer be infected. It’s a rather cruel way of countering the Mirai epidemic and the author of Brickerbot knows it, calling his/her approach a form of “Internet Chemotherapy”.

Chemotherapy, which is commonly used for treating cancer patients, destroys not only cancer cells, but also good cells. Janit0r, (the name used by Brickerbot’s author) thinks the ubiquity of vulnerable IoT devices and the risk they pose (i.e. massive DDoS attacks) is a critical issue that “couldn’t be solved quickly enough by conventional means.” and therefore requires a radical treatment.

It takes a worm to stop a worm?

A computer worm like Mirai spreads from one device to another on its own. It doesn’t require a human being to install, download, or copy it. For this reason, a large number of devices can be infected by Mirai in a short period of time. And if you’re talking about IoT devices, that number can easily reach millions.

With such a high infection rate, any undertaking for stopping this malware that relies on manual methods will surely prove futile. That’s why the authors of Hajime and Brickerbot are taking this path. They obviously think, in order to stop a worm, you need a solution with worm-link capabilities.

Understanding the risks of relying on vigilante worms

First of all, we must remember that these worms are developed by human beings. People are fickle. What starts with noble intentions may develop into something else.

Because Hajime and Brickerbot already have the ability to break into IoT devices, propagate, and lock down its victims, just a small update would be needed for them carry out more sinister acts if their authors eventually decide to turn to the dark side.

These newly weaponized botnets could then be used to launch DDoS attacks or infect and brick IoT-enabled critical devices such as medical equipment. Many of the infected devices are cameras which could lead to espionage or voyeurism.

Even if these worms’ developers maintain their do-good profile, several threat actors could take interest in these projects. If malicious individuals are able to hijack these worms, they could then be weaponized.

Let’s also not forget the fact that, certain vigilante worms – like Brickerbot – have the tendency to inflict disproportionate punishment or unwarranted collateral damage. These worms are supposed to punish IoT device manufacturers for failing to build secure devices, but these worms are in fact destroying other people’s property. Two wrongs still don’t make a right.

Nevertheless, the emergence of Mirai, Hajime and Brickerbot should serve as a wake up call to the manufacturers of IoT devices. The vulnerabilities on these devices pose a serious threat not only to the potential victims of DDoS attacks, but also to the owners of these devices who may be collateral damage to acts of cyber vigilantism.

Most Internet-based tasks are dependent on DNS: web browsing, email, file transfers, social media posts, instant messaging, and a variety of communications and data exchange processes. It follows then, if you take down a DNS service, other networking services may also be rendered unusable.

Because these services are vital to modern-day business operations, any threat that may cause an extended disruption to these services must be considered critical. The biggest threats to the availability of DNS (and in turn, network services) are denial-of-service attacks. In this post, we talk about the different types of DNS DoS attacks and discuss the mechanisms behind each type of attack

Fundamentals of a DNS DoS attack

The concept of a DNS Denial of Service (DoS) attack is pretty simple. A concentrated attack from tens, hundreds, thousands, or even millions of machines is directed to a DNS server (or group of servers) with the intention of preventing it from providing DNS services to clients or resolvers. It’s like getting blocked from your phone’s contact list. If you can’t access your address book, you likely won’t be able to call your friends, relatives, etc.

When clients and resolvers are denied access to DNS, users and machines (in the case of B2B transactions) will be unable to carry out tasks that are dependent on DNS. There are different ways of taking down or disrupting a DNS service, here are some of the most common.

1. DNS Flood

One of the most common types of DNS DoS attacks is the DNS Flood. This attack is carried out over the UDP (User Datagram Protocol) protocol, the primary protocol (the other being TCP) over which DNS messages are transmitted.

A DNS flood attack is performed by sending out a large number of DNS requests to UDP port 53. The goal of the attack is to overwhelm the target DNS server with requests (mostly consisting of malformed or bogus packet information) and prevent legitimate requests from coming through.

2. TCP SYN Flood

Although most DNS messages are transmitted through UDP, a substantial volume of messages are also transmitted through TCP (Transmission Control Protocol). DNS responses that exceed 512 bytes in size or transmissions involved in zone transfers all use TCP. For this reason, DNS servers can be vulnerable to TCP SYN Flood attacks, a type of DoS attack that exploits the TCP three-way handshake.

In a nutshell, the TCP three-way handshake works like this:

1. Client requests a connection to a server by sending a SYN message to the latter
2. Server responds with a SYN-ACK message as acknowledgement
3. Client responds with an ACK message as its own acknowledgement, and a connection is established

An attacker who exploits this handshake typically sends a SYN request to the victim, which in our case would be a DNS server, but the victim doesn’t receive any ACK after it responds with a SYN-ACK.

The attacker does this by either not sending back the expected ACK or by using a spoofed source IP address. When a spoofed IP address is used, the DNS server will end up sending its SYN-ACK to the owner of the spoofed IP, who won’t respond because it never sent a SYN request in the first place.

The victim then waits for the response in case the ACK was simply delayed due to poor network conditions. In the meantime, it’s forced to allocate resources for the half-open connection.

In a DNS TCP SYN Flood DoS attack, an attacker directs a large number of these bogus SYN requests to a DNS server. While the victim waits for ACK responses which will never arrive, it continues to allocate resources for the partial connections. Eventually, the server runs out of resources to allocate and additional SYN requests, including those from legitimate clients, are denied.

3. NXDOMAIN Flood

When a client or DNS resolver sends out a domain resolution request to a DNS server and the server is unable to resolve that domain into an IP address, the server responds with what is known as an NXDOMAIN response message. This response is sent when the server believes the domain doesn’t exist.

In an NXDOMAIN Flood, an attacker floods a DNS server with queries for non-existent domain names. As a result, the server wastes computing resources trying to resolve domains that don’t exist. At the same time, the server’s cache accumulates NXDOMAIN results, pushing out valid cache entries in the process. When this happens, the server’s processes slow to a crawl and/or will be unable to accept additional requests, legitimate or not.

4. DNS Reflection

In a DNS reflection attack, the attacker sends out DNS requests to one or more DNS servers. These DNS servers aren’t the main targets of the attack, but are used as conduits for conducting the attack.

The underlying trick in this attack lies in the attacker’s DNS requests, which are actually spoofed requests. More specifically, the “from” or return IP address in the requests are spoofed. When the DNS servers receive the requests, they send their responses to the spoofed IP address.

Because the spoofed recipient was not expecting those DNS responses, as it never sent the requests in the first place, it uses resources trying to make sense of those responses. A few of these responses will not affect the target DNS server. However, once those responses number in the thousands, it can eventually overwhelm the target DNS server.

There is also a variation of this attack that makes it easier for attackers to overwhelm the target DNS server. It’s known as the DNS Reflection Amplification DoS Attack.

5. DNS Reflection Amplification DoS

In the DNS Reflection Amplification DoS attack, attackers exploit a DNS characteristic wherein the response is usually larger than the request or query. In fact, there are some DNS responses (like those using ANY or DNSSEC record types) that are many times larger than the original request.

The ANY request, for instance, requests ALL information pertinent to a domain. This may include MX records, A records, and several others – practically all cached records. So, the response can be much larger or “amplified”.

In addition to using queries that result in large responses, attackers can also exploit open resolvers in order to amplify the attack even further. Basically, the attackers send the requests via open resolvers, which in turn store the spoofed return addresses in their respective caches.

Once the spoofed return addresses are already cached in a large number of open resolvers, those cache-poisoned resolvers can then be used to launch a massive DDoS attack against the target DNS server.

6. Botnet DDoS

Today’s attacks on DNS systems have gotten more disruptive. What used to be simple DoS (denial-of-service) attacks have now evolved into much larger DDoS (Distributed Denial-of-Service) attacks. These attacks are typically launched from botnets, (a network of compromised computers that receive commands from attackers.

Instead of a single machine (or a handful of machines) sending out malicious/bogus packets to a DNS system, a DDoS attack may now involve thousands of machines.

Cyber criminals have also devised methods to ensnare IoT (Internet of Things) devices and build massive botnets out of them. Due to the considerably large number of insecure IoT devices already in use, DDoS botnets can potentially consist of hundreds of thousands or even millions of compromised devices.

As a consequence, DDoS attacks are now much more disruptive than ever before. The IoT botnet DDoS attack on DNS provider Dyn last year, which had an estimated throughput of 1.2 Tbps and was said to be twice the size of the previous largest DDoS attack on record, managed to block users from practically the entire US East Coast and many parts of Europe.

Unless IoT manufacturers start taking security seriously and address the vulnerabilities that plague IoT devices, the threat of massive DDoS attacks on DNS systems will remain.

Next steps

The availability of your business is now closely tied with the availability of your network, which is in turn highly dependent on the availability of DNS services. In order to prevent major disruptions to your business due to DNS denial-of-service attacks, your DNS must be an integral part of your defence strategy. Learn how.

DNS servers are vital to almost every process that takes place on the Internet. They allow us to browse the web, transact on an e-commerce site, chat via instant messaging, send out file transfers, communicate through email, etc. So when these DNS servers are compromised or somehow fail, the services that rely on them can be adversely affected. 

That’s exactly what happened last October when a DNS provider serving popular websites like Twitter, Amazon, AirBnB, CNN, Comcast, Spotify, Tumblr, Wired, and many others, got hit by a massive DDoS attack. From the point of view of the end users, those sites appeared to be down. While their servers were technically available, they weren’t reachable. That’s because the DNS system users relied on to get to those sites were out of commission.

Why DNS is crucial to Internet connectivity

The main function of the Domain Name System (DNS) is pretty simple; it’s designed to associate certain information to domain names. DNS is responsible for resolving IP addresses to hostname/domain names and back.

This is necessary because the servers that host sites like xdomain.com or ftp.somedomain.edu are actually identified by client machines through IP addresses like 62.115.13.128 or 210.213.130.182 and not through the domain names xdomain.com or ftp.somedomain.edu per se. The client machines – i.e., desktops, laptops, tablets, smartphones, or other servers – need to know what those IP addresses are before they can establish a connection.

When a user types something like xdomain.com into a browser, that request will first have to go through a DNS server. The DNS server (or more specifically, a chain of DNS servers) will then take that domain name, resolve it into the IP address that matches the domain name and then provide that information to the requesting client. Only then can the client connect to the xdomain.com server.

Without the DNS system, there’s no way the user will be able to connect without knowing the corresponding IP address for xdomain’s server.
 

Threats to DNS

Generally speaking, threats to DNS systems can be grouped into three:

●Threats against the integrity of data in a DNS system

●Threats against the confidentiality of data in a DNS system

●Threats against the availability of a DNS system

Threats to DNS integrity

Threats to data integrity in a DNS system pertain to threats that may result in intentional or accidental modification of data in a DNS system. There are certain pieces of data used in DNS which, if tampered with, can lead to serious consequences.

For example, if the Resource Records (RR) that are stored in zone files, memory or cache, are tampered with or if the responses to legitimate queries are tainted with bogus information, users can be redirected to other (potentially malicious) sites.

The most common type of attack aimed at damaging the integrity of a DNS system is cache poisoning. The objective of this attack is to force a DNS server to cache bogus information; usually a domain name mapped to the wrong IP address. As a result, when a client submits a legitimate query to the DNS system, the system will then reply with the wrong information.

Once a cyber attacker succeeds in redirecting traffic to a malicious site (presumably also controlled by the attacker), bad things can happen. These sites are often meticulously crafted to resemble the legitimate site so that redirected users can be deceived into entering sensitive information like passwords, credit card data, and personally identifiable information (PII).

Threats to DNS availability

These are the types of threats that render DNS servers inaccessible. When that happens, DNS queries may go unanswered. As a result, clients will be unable to reach the sites they’ve been meaning to connect to. DNS outages can be caused by unintentional server failures or deliberate DoS/DDoS attacks.

Recent events have shown that this type of threat has the potential to inflict the most damage among the three. This is primarily because of the way a large portion of the Internet now operates, wherein a multitude of sites rely heavily on a few service providers. When a major DNS service provider bogs down, availability issues can easily affect a large number of sites or customers spanning a vast geographical area, just like what happened in the

An IoT botnet DDoS attack was responsible for the Dyn outage. That attack, which was the largest DDoS attack on record, was noteworthy in that it was launched from an army of compromised IoT devices. This is a serious threat because, if it could bring down an infrastructure as robust as Dyn (even just for a few hours), it could easily overwhelm the infrastructures of much smaller DNS providers.
 

Threats to DNS confidentiality

Threats to the confidentiality of data in DNS systems are not as glaring as the other two, but shouldn’t be taken lightly. If, for example, RRs for internal hosts are stored in external name servers and those servers are compromised, the information obtained can provide attackers insights about the internal network. This information can then be used to support and inform subsequent stages of an attack.

One of the tasks many security consultants perform in the early stages of a penetration testing engagement is DNS reconnaissance. DNS reconnaissance can reveal a lot about an organization’s DNS servers, their RRs and, in turn, the organization’s network infrastructure.

Some of the techniques employed in DNS reconnaissance include:

●DNS server cache snooping

●Domain brute force

●Reverse lookup

●Zone transfer

●Zone walking

Impact to business

The impact of a DNS attack on businesses can vary greatly depending on the threat. If it’s an attack on the confidentiality of DNS data, the impact could be minimal.

However, if that incident was actually just reconnaissance that eventually led to a deeper penetration of the network, or a data breach, the impact could be huge. If the data breach involved personal information, the business could face legal action or hefty.

If it’s the integrity of DNS data that’s compromised and client machines are redirected to malicious sites, this can impact:

1.The owners of the client machines. Once these machines are redirected to malicious sites, the owners of these machines could suffer financial losses or loss of confidential information (e.g. credit card data or PII).

2.The owners of the spoofed sites. The moment word of the fraudulent transactions gets out (and spreads through social media), the businesses who own those sites could suffer irreparable brand damage. They could also suffer financial losses as they try to remediate the problem or defend themselves against lawsuits.

If it’s the availability of DNS services that’s compromised, the biggest consequences are likely to be in terms of opportunity and trust. If you have an online business (e.g. an e-commerce, or online banking site) and your DNS provider suffers a lengthy outage (say, several hours), the loss in terms of sales could be massive.

To learn more about using DNS security to protect your data and your reputation, contact us

The Cloudflare incident that derailed weekend plans for many cyber security professionals is turning out to be a huge eye opener. The culprit, a bug now known as Cloudbleed, resulted in a serious data leak which affected an abundance of websites. As the dust began to settle, it became clear that the implications were far more severe than anticipated. The Internet has undergone considerable changes, and security issues must now be handled differently.

An overview of Cloudflare

In order to understand the extent of Cloudbleed, it is crucial to become familiar with the role of Cloudflare in today’s Internet. While most people might not know what Cloudflare is, there is a good chance that these same individuals actually interact with a Cloudflare service multiple times a day. Take, for instance, the following example:

The above image is that of a Cloudflare feature in action. It serves the purpose of protecting the site that a given individual is about to visit, keeping it safe from spammers and bots by making sure the person is, in fact, human. Cloudflare is a content delivery network that also provides DDoS protection, web application firewalls, DNS (domain name server), and reverse proxy services. This network serves millions of websites, acting as a layer between those sites and their visitors.

That has some advantages and disadvantages. One disadvantage is that if something goes wrong at that layer, a lot of websites are going to be affected.

Cloudbleed in a nutshell

Cloudbleed was a bug in the Cloudflare infrastructure that resulted in a data leak involving passwords, keys, cookies, POST data, and HTTPS requests; the whole nine yards. Some of this data, which came from Cloudflare customer websites, included PII (personally identifiable information), private messages, and other confidential information. Although data would only leak out if certain conditions were met, the sheer size of Coudflare’s customer base made the incident a major issue.

To make matters worse, some of the information that leaked was caught by search engine crawlers and cached into memory. This means that, even after the bug was identified and fixed, one critical, and rather tricky, task still remained.

Cloudflare had to work with Google and other search engine providers to make sure leaked data was completely scrubbed from search engine caches. Otherwise, the data would run the risk of being targeted by shady (or simply curious) characters as soon as details of the security incident broke out.

Technically speaking, the bug only affected three features:

1. Email Obfuscation – a feature that prevents bots from harvesting email addresses (which attackers use in their spamming campaigns) from web pages;
2. Server-Side Excludes – a feature that hides sensitive content on your site from suspicious visitors; and
3. Automatic HTTPS Rewrites – a feature that rewrites HTTP links to HTTPS.

In addition, the bug was only triggered if (in addition to any of those features being enabled) the HTML page that was served was malformed, i.e. the page had to end with an unterminated attribute.

However, because much of Cloudflare’s infrastructure is basically shared by its large customer base, a lot of websites were still affected by the bug – even if those sites did not have any of those three features enabled. Some of the popular websites known to have been impacted included Uber, Fitbit, and OkCupid. A much longer list of potentially affected sites can be found on Github.

In order to perform their specific functions, all three features – email obfuscation, server-side excludes, and automatic HTTPS rewrites – have to parse and modify HTML pages as the pages pass through Cloudflare’s edge servers and are subsequently served to clients. To do this, the three features rely on what is known as an HTML parser. It was this HTML parser that contained the bug, which in turn caused random memory leaks.

Cloudflare’s detailed explanation can be found here for those wanting to dive into more technical information.

Discovery and Remediation

The data leak was accidentally discovered by Tavis Ormandy, a security analyst at Google’s Project Zero.

“On February 17th 2017, I was working on a corpus distillation project, when I encountered some data that didn’t match what I had been expecting”, Tavis posted in a bug report. He added that “…It became clear after a while we were looking at chunks of uninitialized memory interspersed with valid data.”

When he and other members of the team managed to fetch some live samples, they were able to obtain data that should not have been out in the open – encryption keys, cookies, passwords, chunks of POST data and even HTTPS requests. As soon as they were able to pinpoint Cloudflare as the source of the leaked data, they immediately tried to establish contact with Cloudflare’s security team. Tavis decided to reach out through twitter.

Fortunately, some members of the Cloudflare security team were active on social media and word of the tweet reached them. This led to a series of exchanges and some collaborative work. The bug was found and a patch was deployed in less than a day. As soon as the bug’s location was identified (but before a patch was released), Cloudflare initiated what they called a “global kill” switch that disabled the features in question throughout their global network.

However, it did take more time to work with the search engine engineers in purging leaked data that was already cached. After further investigation, it was later discovered that the bug may have been leaking data for months. The leak is estimated to have stretched from late September 2016 to February 2017.

That estimated period over which data leaked is quite alarming, considering that search engines aren’t the only entities who mobilize crawlers across the Web. Ideally, leaked data cached in those systems would be purged as well.

To be on the safe side, all Cloudflare customers must assume that their sites might have leaked some amount of data and take appropriate measures. Some of the countermeasures include resetting passwords, forcing re-authentication, invalidating session cookies, rolling internal authorization tokens, adapting two-factor authentication, and educating users of potential risks.

Cloudbleed and the Current State of the Internet

Cloudbleed (and the recent Amazon outage) indicates a couple of things. First, that the Internet, as many of us know it, is now heavily dependent on just a handful of organizations. The downside is that, when something goes wrong with the infrastructure of those few organizations, a massive fraction of the Internet – and everyone using it – suffers.

Indeed, if services from the top providers like Amazon and Cloudflare go offline or acquire some form of vulnerability, a lot of businesses will be affected. There is, however, an upside to this. Because things are provided as-a-service by a single provider, a fix can be made in a central location and then rapidly propagated across all nodes.

In the case of Cloudbleed, a simple activation of a kill switch at Cloudflare switched off all affected features, thereby plugging the holes throughout its entire global infrastructure in a matter of seconds. As soon as the bug was fixed, that fix was then propagated throughout the infrastructure, almost instantly.

The rise of ubiquitous cloud service providers has altered the Internet landscape in a big way. In order to mitigate the risks that accompany this new landscape, on can take the lessons learned from Cloudbleed into consideration when developing new security strategies.

Despite the many tools in place to prevent them, phishing attacks continue to be a menace to employees and businesses. In Q3 of 2016, the Anti-Phishing Working Group detected at least 340 hijacked brands per month. In the last month of that same period, they also found 104,973 unique phishing sites. In order to understand the implications of these statistics, one needs to gain a better understanding of phishing attacks, the motivations behind them, why they succeed, and their impact to business.

In a nutshell, a phishing attack is a fraudulent message, usually in the form of an email, which lures users into clicking a link. That link in turn either leads the victim to a malicious website or initiates a malicious download.

Anatomy of a Phishing Attack

Phishing email is a form of spam email; it’s an undesirable message sent in bulk to a large number of recipients. While traditional spam emails are mostly part of advertising campaigns, phishing emails are more sinister. The main goal of a phishing email is usually to obtain confidential information from the email’s recipient.

In essence, the following is what takes place during a phishing attack:

1. First, the phishing email is sent to a large collection of email addresses. These days, the mass mailings are launched from zombie computers or devices that belong to botnets.
2. If the phishing email was well crafted, the victim would be compelled to either click on a link found in the email body, or download an attachment.
3. If the victim clicks on the link, he or she will likely be redirected to a landing page closely resembling a legitimate webpage of a popular and trusted company. Most of the organizations impersonated are banks, credit card companies, online payment service providers (e.g. PayPal), and even social networking sites. The use of a reputable brand name increases the probability of the victim performing the desired action (e.g. fill out a form or download a file).
4. If the victim downloads an email attachment, he or she will likely end up installing a trojan that might contain a key logger, botnet client, ransomware, or just about any other type of malware.

Why Cyber Criminals Phish

The goal of most phishing attacks is to acquire what is known as personally identifiable information, or PII. This information includes data that, either individually or combined with other relevant data, can be used to identify an individual. Examples of this kind of data would include social security numbers, bank account numbers, credit card numbers, medical records, educational records, mailing addresses, biometric records, and so on.

Stolen PII is often sold in shady online marketplaces, where they will then be purchased by identity thieves. These cybercriminals then use the information to carry out credit card or banking fraud and other fraudulent transactions. The cost of a single piece of stolen personal information can range from a few dollars to thousands of dollars, depending on the specific information that has been obtained. For example, a random credit card number can cost $5; a medical record, $50; and a bank account credential, $1,000.

Looking at the total value of PII belonging to thousands of individuals makes it is easy to understand why phishing can be so lucrative.

How Phishing Attacks Succeed

Phishing relies on the time-tested art of deception. These days, cyber security experts and cyber criminals have dubbed these deceptive acts “social engineering.” Social engineering plays on people’s emotions, curiosity, fear, or plain gullibility.

A simplified example of what one might read in a phishing email would be as follows:

“Congratulations! You just won in the 2017 Online Lottery. Please claim your prize by clicking the link below.”

Most people get excited when they are told they won something – even if they never bought a ticket for any “2017 Online Lottery” in the first place.

Some phishing emails play on fear and take advantage of recent events, for example, a massive data breach. The following is what one might receive in the wake of a PayPal data breach:

“Dear [insert your name here]

Earlier today, PayPal’s databases were hacked and several user accounts were compromised. We regret to inform you that your account was one of them. While no funds have been stolen yet, we can confirm that the hackers were able to acquire your login credentials. To prevent any financial loss, you need to reset your password immediately. Click the link below and follow the instructions to carry out the reset.”

The message above can be quite alarming and can spur a sense of urgency. For this reason, some recipients of this email would no longer stop to think and just do as instructed.

These deceptive messages are made more believable with the advent of HTML-based emails. Unlike plain text emails, HTML-based emails can be spruced up with graphics and formatted text. Hence, it’s easier to make them resemble official communications from a trusted or reputable source – like a bank or, in the example above, Paypal.

When people are faced with a well-written and professionally formatted email bearing a trusted logo, most of them won’t bother to verify its authenticity.

Increasing Email Open Rates and Clicks Through Spear Phishing

Traditionally, phishing emails followed a spray and pray tactic. Attackers typically sent out large volumes of emails without any regard as to who would end up receiving them. For example, of the thousands who would receive the “Paypal” email, only a few may actually own a PayPal account. As a result, the majority of those who would receive the email would mark it as spam.

To increase the efficiency of their attacks, phishers started resorting to more sophisticated techniques. One of these techniques is known as spear phishing. This is a more targeted phishing attack aimed at a specific individual or group of people.

Spear phishing emails contain elements closely associated with the target. For example, a spear phishing email may mention and may appear to originate from the target’s boss, their organization’s network administrator, or HR manager. In addition, it may follow the company’s standard email format and include the corporate letterhead.

Because spear phishing emails are so customized, their open rates and click-through rates are quite high. The people who conduct spear phishing attacks usually have even more sinister intentions in mind than just stealing PII.

Many of these attackers are often after high value targets buried deep inside the organization. Hence, the main purpose of the phishing attack might be to acquire administrative credentials for privilege escalation or to infiltrate the network in preparation for an APT (advanced persistent threat) campaign.

Spear phishing emails are typically laced with malicious attachments that often take the form of corporate files like PowerPoint presentations, reports, spreadsheets, resumes, and business documents. While these files appear as common file formats like .PDFs, .PPTs, .DOCXs, and .XLSs, they are actually executable (.EXE) files containing trojans that may even connect to remote command-and-control (C&C) servers.

Business Impact

Although phishing attacks are primarily aimed at individuals (more specifically, their PII), they can have other unintended, but nevertheless unavoidable casualties as well.

When phishers launch an attack, they usually need to hijack a legitimate brand. As discussed earlier, attackers typically set up a malicious landing page that closely resembles the web page of a trusted brand. This makes it easier to convince victims into responding to a call-to-action, such as filling out a form or downloading something.

These brands become casualties once the phishing campaign is discovered and later disclosed in news outlets or social media. This type of publicity can hurt the brand’s image, leaving the impression that its web pages are unsafe. Some customers might end up avoiding the brand’s legitimate websites for fear of accidentally landing on a fake web page.

In most cases, the people who do land on a hijacked brand’s website are likely customers of that organization. These people can lose confidence in the brand and may ultimately drop it for a competitor. Worse, if they actually become victims (i.e. their personal data get stolen), they might even file a lawsuit, or, if the data is covered by data protection regulations, the company can be levied fines for noncompliance.

How to Defend a Business against Phishing Attacks

There are a couple of ways to thwart phishing attacks, the first of which being user education. This method of avoidance is primarily designed to counter the social engineering aspect of the attack. Because users are the recipients of phishing emails, your employees must be trained to determine when an email can be considered suspicious.

Some indicators include:

• Requests for personal information
• Deceptive domain names (e.g. paypal.somebank.com is certainly not a legitimate PayPal domain)
• Generic salutations (e.g. Dear Sir instead of Dear [your name])
• URLs that don’t match what is being displayed on the link (You can verify this by hovering your mouse on the link and inspecting the link that appears on your browser’s bar)
• Emails with executable file attachments (the common file types include exe, com, jar, msi, bat, and scr, but there are many others)
• Any email attachment that wasn’t expected (you can always verify with the sender)
• Messages that elicit heightened emotions, whether of happiness, fear, pity, etc.
• A sender who’s not familiar to you

Although user education is an important component in countering phishing attacks, it is by no means ironclad. Employees can forget or even disregard warning signs; hence, one will need to augment user education with something immune to human shortcomings.

Learn how our DNS Security Solutions can help detect and block fraudulent links, phishing campaigns, rogue antivirus downloads, and forced redirection to malicious domains.

*APWG Phishing Activity Trends Report  – 3rd Quarter 2016

Attackers who want to infect systems with malware usually need a vehicle to reach as many infections as possible. These days, that vehicle is most often an exploit kit. In this post, we take a closer look at exploit kits, where they fit in the cybercrime industry, what’s inside a typical toolkit, and most importantly, how they work.

A peek into the exploit kit industry

Before we talk about what an exploit kit (EK) is and how it works, let’s first discuss the financial incentive for developing these kits. What drives people to create exploit kits?

Contrary to what most people think, not everyone who commits cyber crime has the technical skills to “hack into a system”. There are those who carry out cyber attacks by simply relying on ready-made tools they purchased in black hat marketplaces on the dark web.

Let’s say that Joe reads this article and learns that ransomware campaigns can be quite lucrative. Being morally flexible, Joe decides to launch a ransomware campaign. Joe then realizes that ransom malware by itself is not enough. He still needs to deliver the malware onto a victim’s system. One way to do that is by taking advantage of certain vulnerabilities in the system. Luckily, people have already written programs for doing just that.

These tiny programs or pieces of code are called ‘exploits’ and can be purchased through black hat hacking forums. The prices of these exploits vary, with zero-day exploits generally priced higher. So if an attacker like Joe gets a hold of an exploit, is he good to go? Not quite yet.

One exploit typically can only target one vulnerability. It’s hard to predict what vulnerabilities are present in a system. So if Joe only targets one vulnerability, chances are he would only be able to compromise a few systems, while ignoring other systems that have other vulnerabilities. If Joe wants to infect those systems too, he needs to acquire exploits for those vulnerabilities as well.

It gets even more complicated because different exploits might be written by different authors. That means, he would have to communicate with several parties. It would be so much easier if he could only deal with one vendor. That’s where exploits kits come in.

An exploit toolkit or kit is a tool, usually written in PHP, that already comes with a collection of exploits. The people who develop exploit kits purchase exploits from exploit authors and package them into one tool. They (the exploit kit developers) then sell their kits to people like Joe.

Some exploit kit licenses have validity periods. Once the license subscription expires, you would need to purchase a new subscription to continue using it. Other exploit kits are offered as a subscription service. The rates typically range from a few hundred dollars per month to a couple thousand dollars per month. This typically includes tech support and updates or patches. For example, there may be patches that introduce new evasion techniques, new exploits, or support for certain malware.

Some of the most notorious exploit kits in recent history include:

• Angler
• Rig
• Neutrino
• Blackhole
• Sweet Orange
• Nuclear
• Magnitude

Inside an exploit toolkit

When an attacker purchases an exploit kit, he’ll be provided with a management console. Here he’ll see various information and statistics pertinent to his exploit campaign. This is to help him monitor how the overall campaign and the individual exploits are performing.

In addition to the number of times each exploit type was delivered, the attacker will also see where those exploits actually landed. Mostly, he’ll see the countries that were targeted. Cyber attackers normally want to target specific countries (US is the usual favorite), so they want to verify whether the campaign was actually successful in that geographical region. Toolkits can focus on specific areas through geolocation based on the victim’s IP address.

Another key piece of information is the victim’s Operating System and web browser. Certain malware only works on certain operating systems (e.g. Windows), so it’s important for the payloads to be dropped in those systems.

Here’s a screen grab from a Youtube video showing Black Hole EK’s management console:

Lastly, a toolkit would typically include a module for uploading or selecting the desired payload. The attacker can either pick from a selection of payloads bundled with the kit or upload his own payload. Some of the most commonly used payloads include:

• Click-fraud bots (e.g. Bedep)
• Ransomware (e.g. CryptXXX, TelsaCrypt)
• Spambots (e.g. Tofsee)
• Banking Trojans (e.g. Zeus, Panda Banker)
• Worms (e.g. Qbot)
• Botnets (e.g. Andromeda/Gamarue)
• And many others

How exploit kits work

There are different kinds of exploit kits, but the most popular are those designed to exploit vulnerabilities in web browsers and browser plugins like Flash, Silverlight, Java, and ActiveX.

Below is a simplified diagram illustrating a web-based exploit kit. The actual set ups are often far more sophisticated than this and can also involve other processes, but this should give you an idea of the basic structure.

1.    Victim lands on a compromised website

The first stage of an exploit kit attack begins when a victim visits a compromised website. These are usually popular, legitimate websites, including blogs, news sites, and social networking sites. Examples of high-traffic sites that have already been hijacked by exploit kit attackers in the past include: BBC, Yahoo, MSN, AOL, MySpace, Forbes, and New York Times, to mention a few.

The way attackers do this varies. Some attackers target vulnerabilities in CMS (content management system) plugins or in the CMS themselves. Others, like those that carry out domain shadowing, take advantage of weak login credentials. There are also those who perform cross-site scripting, SQL-injection, or FTP compromise. Perhaps the most popular method, though, is malvertising.

In a malvertising campaign, attackers target ad networks. This then allows them to reach a wide range of legitimate (and often high-traffic) websites without having to hack into the websites themselves.

2. Victim is redirected to the exploit kit’s landing page

Once the victim visits a compromised site or one that serves malvertising-infected ads, the victim’s browser will then be redirected to the exploit kit’s landing page. This redirection is carried out through an HTML iframe, 302 cushioning or some surreptitious code that the attacker previously injected into the legitimate website or malicious ad.

This article about the Stegano exploit kit offers a nice example of how a typical malvertising campaign and the use of a banner ad laced with a malicious script works.

As soon as the victim gets redirected to the landing page, the profiling process begins. Here, pertinent information regarding the victim’s browser and its plugins is collected. What the exploit kit will want to know is the kind of vulnerabilities that are present on either the web browser or the browser’s plugins. Because each browser or plugin version will have already been associated with a set of known vulnerabilities, it’s usually enough to just determine the version numbers.

3. Exploits are served

Once the version numbers (and consequently, the corresponding vulnerabilities) have been identified, the exploit kit will know which exploits to deliver. In most cases, the landing page is only used for profiling. The exploits and the payloads are usually hosted on a separate server. In fact, in many cases, these two (exploits and payloads) are likewise separated as well.

The first thing that gets delivered to the victim’s browser are the exploits. As you have already learned, these exploits will take advantage of the vulnerabilities that have been previously identified. If the exploit or exploits are successful, the exploit kit then delivers the final blow.

4. Malicious payload is delivered

At this final stage, the exploit kit drops whatever payload it was configured for. As mentioned earlier, the payload can be ransomware, a keylogger, a banking trojan, or just about any type of malware.

How exploit kit attacks succeed

The main reason that these kits are so effective is that the malicious payloads are usually delivered without the victim having to click or intentionally download anything. All the victim has to do is visit a compromised site, and the payload will be downloaded automatically in the background.

Known as a drive-by-download, this covert method is a staple in many exploit kits and is one of the primary reasons they succeed in delivering various forms of malware. Since the victim doesn’t notice anything alarming or suspicious, they are less likely to think anything is amiss.

Another major reason why these kits succeed is because a lot of people don’t patch their software. Patches typically include security updates that fix known vulnerabilities. So, if people don’t patch, the vulnerabilities will remain. In fact, some exploit kit exploits have been found to target vulnerabilities that have already been known for years. Until we have a better solution for handling updates or remove the incentive to launch these attacks, there will be a busy trade in exploit kits.

There are few worse ways to start the new year than scrambling to recover urgently needed files encrypted by ransomware. Unfortunately, the chances of that happening in your organization only seems to be growing. What’s more, although ransomware infections are arguably the most publicized, they’re not the only malware poised to pounce in the Year of the Rooster.

“If you know the enemy and know yourself, you need not fear the result of a hundred battles” – Sun Tzu

In this post, we help you prepare for this year’s wave of malware attacks by identifying which types of malware are most likely to hit your organization.

1. Ransomware

Easily the most disruptive, and publicized malware of 2016, ransomware is positioned to become a much bigger threat in 2017. Ransomware cyber crooks raked in no less than $1 billion last year. The amount of profit that can potentially be earned from this type of malware is enough to attract even more cyber criminals.

A ransomware attack is typically characterized by files or entire systems being held captive, usually through encryption, and freed only after victims pay up, usually through Bitcoin. While most victims are individuals, there were many instances when infections managed to spread throughout an organization and crippled entire networks, like in the case of the Hollywood Presbyterian Medical Center and San Francisco’s Municipal Transport Agency (a.k.a. Muni).

It’s easy to see why launching ransomware attacks is a lucrative business model. A large number (if not most) of victims are willing to pay. We discussed the possible drivers behind ransomware’s recent rapid growth in the blog post “The Secrets Behind Ransomware’s Surging Notoriety”.

2. IoT botnets

If it weren’t ransomware up there in number 1, it would most likely have been IoT botnets. Last year, we witnessed some of the largest DDoS attacks of all time. Some of these record-breaking attacks were launched not through typical zombie computers, but rather, through botnets of IoT (Internet of Things) devices.

Many of these attacks were carried out by a single botnet known as Mirai. Unfortunately, the source code of the Mirai malware was shared to the hacking community, setting into motion separate initiatives for the development of Mirai-like offspring. As more cyber gangs gain access to the code, the likelihood of new and improved versions of the malware is likely.

IoT adoption has started to go mainstream. If Gartner’s predictions were accurate, 43% of organizations ended up implementing IoT technology by the end of 2016. With even more companies planning to use IoT and several IoT vulnerabilities still waiting to be plugged, criminals are going to have a massive source of vulnerable devices at their disposal.

3. Extra cautious exploit kits

When the Stegano Exploit Kit was exposed last December, a lot of the attention was focused on how it used steganography to avoid detection. Although steganography certainly contributed to its avoidance capabilities, there was an even craftier mechanism working behind the scenes.

Before Stegano EK would proceed with each attack, it would first verify whether any monitoring or security product was present. If it found one, it would promptly retreat. It did this twice, in fact. First, before redirecting the browser to the exploit kit’s landing page, and secondly, before dropping the payload. This, as much as its use of steganography, allowed Stegano to avoid detection for so long.

By being extra cautious and extra selective of its targets, exploit kits like Stegano might not be able to infect as quickly as others, but it does enable them to remain in existence much longer. As is often said, the biggest malware infections are most likely the ones that have yet to be uncovered.

4. Android malware

Android continues to dominate the mobile market, as well as the mobile malware market. The Android platform has long been plagued with vulnerabilities and in July 2016 alone, Google released a massive security update that aimed to address 108 vulnerabilities in Android. Just last week, security researchers discovered what is now known as the Switcher Trojan, malware that infects Android devices and uses them to attack routers, altering the router’s DNS settings and rerouting DNS queries to attacker-controlled networks.

Smartphones contain mountains of confidential information, including passwords, credit card data, and a large collection of personal details. In many cases, particularly in BYOD environments, smartphones even contain company-owned data. The amount of valuable information that can be stolen from smartphones makes them a prime target for identity thieves and cyber criminals of all stripes.

5. Malware distributed through malvertising

The types of malware dropped through malvertising campaigns can vary substantially. Some drop spyware, some keyloggers, others ransomware, etc.

Malvertising often infects through drive-by downloads. This method of infection doesn’t require any deliberate action from the victim, making it particularly dangerous. The victim doesn’t have to click, download, or install anything. As soon as the victim lands on a web page serving a malicious or compromised ad, the victim will be automatically redirected to a malicious server.

That server can then download an exploit kit that will, in turn scan for vulnerabilities and subsequently drop the payload. All this happens in the background, without any hint to the user of it taking place. The level of obscurity achieved by drive-by downloads makes malvertising a very compelling means of attack.

In addition, some cyber crooks manage to hijack ad networks, enabling them to display their malvertising on multiple legitimate, high-traffic websites. In this way, even those individuals who take care to avoid sketchy websites can still be victimized.

6. Banking/financial malware

Not so long ago, banking trojans and botnets towered over the malware landscape. The first piece of malware that comes to mind is Zeus/Zbot, a trojan that became the foundation of what has now evolved into the Zeus malware family. This trojan primarily stole banking information through man-in-the-browser keystroke logging and form grabbing.

Malware developers built on top of Zbot to create even more sophisticated malware. One of Zbot’s offsprings is Gameover Zeus, a notorious botnet that infected over a million users around the globe. It stole login credentials and credit card data, which were later used to carry out banking fraud. Other descendants of Zbot include SpyEye, Ice IX, Citadel, Carberp, Bugat, and many others. Banks won’t be going away anytime soon, and while they’re here, they’ll always be a prime target for cyber criminals.

7. Point of Sale (POS) malware

Closely related to banking malware, in the sense that it also steals credit card and debit card information, POS or Point of Sale malware targets POS terminals. POS devices are simply specialized types of computers and actually run on operating systems like Windows, Unix, or Linux, making them just as vulnerable to malware as a traditional computer.

These terminals often process hundreds or thousands of transactions per day and thus store a ton of payment card data. Much of this data finds its way to hacking forums where it can be bought for identity or credit card fraud.

POS malware has become more popular than manual methods like skimming, which requires the installation of a device on the POS terminal. Skimming is time-consuming, and riskier for criminals since they have to be physically present in order to install the device.

Some of the more notable companies that were attacked in 2016 through some kind of POS malware include Wendy’s, Cici’s Pizza, and Rosen Hotels and Resorts. Of course, the most highly publicized attack involving POS malware happened a couple of years ago; the infamous Target data breach involved millions of credit and debit cards.

Like banks, credit cards aren’t going away. While e-commerce and online shopping is on the rise, most credit card transactions still happen in grocery stores, restaurants, and other brick-and-mortar establishments. As such, POS malware will continue to thrive

The biggest malware infections are probably the ones that have yet to be uncovered. Earlier this month, security researchers revealed a massive malvertising-based exploit kit whose earliest variants may have been operating since 2014 and whose infected banner ads might have already been displayed to millions. How could it have remained hidden in plain sight for so long? Apparently, it evaded detection through a combination of fingerprinting/probing and steganography.

The folks at ESET, who recently carried out extensive research on this cyber attack, are attributing the infections to what they now call the Stegano exploit kit. The name comes from the way the exploit kit conceals its malicious code on banner ads, i.e., through steganography.

Steganography is a known technique (not always for malicious purposes) for concealing content inside another piece of content. In most cases, that “other piece of content” is an image. And in this particular case, that image is the one on the banner ad. The content being concealed here is a malicious script and some accompanying variables.

Stegano EK is believed to have reached millions of users. The reason is because it managed to serve its malicious ads on advertising networks whose content is displayed on high traffic news websites. The volume of visitors on these sites number in the millions … per day.

An overview of how the Stegano exploit kit works.

1. Initial environment check.

When a user arrives at an infected news site’s web page, the web page loads along with the malicious banner ad. But before loading the ad, Stegano does an initial check. It does this through a modified version of countly. Countly is a tool normally used for web analytics, so it doesn’t raise any red flags.

The modified tool then reports back to the attacker’s server, providing it with information that enables the server to determine whether to display a clean ad or a malicious ad.

2. Malicious ad is served

The malicious ad is almost identical to the clean ad, except that it has a slightly modified alpha channel. The alpha channel is that part of an RGBA (red green blue alpha) image that dictates a pixel’s degree of transparency. Because the change in the malicious image’s alpha channel is so minimal, the difference between the malicious ad and the clean ad is virtually imperceptible to the naked eye.

However, because a banner’s image consists of a large number of pixels, that difference is enough to conceal information. In this case, malicious script. That script then checks the user’s system for a vulnerability in Internet Explorer (CVE-2016-0162) which allows the exploit kit to determine whether any tools and applications normally used by security professionals are present in the system. If any packet capturing, sandboxing, virtualization and similar applications are found, the exploit kit promptly backs off.

3. Exploit stage

In the event the exploit kit determines the coast is clear, it then redirects the victim’s browser to the exploit landing page. The landing page then loads a Flash file, which in turn exploits any of three Flash-related vulnerabilities (CVE-2015-8651, CVE-2016-1019, CVE-2016-4117).

If the exploit succeeds, Stegano then drops its payload(s), which may range from keyloggers, trojans, to ransomware. Before downloading the payload, Stegano performs yet another check to determine the presence of security tools. It’s this highly cautious approach (coupled with steganography) that has allowed Stegano to avoid detection for so long.

Other malware that has used steganography

While the use of steganography is certainly a unique way of hiding malicious information, Stegano EK isn’t the only malware that has employed this technique. Here are some examples of malware that have also done it in the past.

ZeusVM

A variant of the notorious banking trojan Zeus/Zbot, ZeusVM is one of the more popular pieces of malware that has used steganography. Unlike Stegano though, ZeusVM didn’t hide malicious code in an image. Instead, it hid its configuration data in it. This data, which is equally vital to the malware’s functionality, included domains of banking and financial institutions which the malware targeted.

The configuration data was appended to the image and encrypted using Base64, RC4, and XOR to make it indecipherable to anyone who decided to inspect the image more closely. The ZeusVM toolkit, which included a builder that would enable the user to inject the malware’s config to any JPG file, was spread online, so several script kiddies were able to get their hands on it.

Gozi

Also known as VAWTRAK, Gozi is a banking trojan that steals personal information and credentials (usually through screen captures and keyloggers) that are then used by the attackers to carry out fraudulent transactions. Gozi leveraged steganography to hide a configuration file that contained a list of domain names that in turn corresponded to its Command and Control servers.

The configuration data was hidden in what is known as a favicon. This is a tiny icon (.ico) associated with a website that’s displayed on a web browser. So, for example, you have favicon for Wikipedia and a different favicon for, say, Yahoo. Because it’s normal for websites to be accompanied by a favicon, security solutions failed to flag the favicon downloads as threats.

Gozi more closely resembled Stegano in the manner by which it hid malicious information. Unlike ZeusVM, which simply appended malicious information to the image, Gozi (like Stegano) made very small changes to the image’s pixels. But while Stegano altered the alpha channel, Gozi altered the least significant bits (LSB) of the R, G, B, and A parameters of each pixel.

Lurk

Most malware that use steganography hide malicious information in visually appealing images like cats or sunsets. However, there is one that hid the information in what looked like plain white images but actually had very small alterations in its pixels.

The use of “white color” is actually very clever because the naked eye can’t differentiate between a pure white pixel (RGB = 255,255,255) and one that’s slightly grey (e.g. RGB = 254, 254, 254). Again, that difference, when spread across the pixels that comprise the entire image, is enough to contain malicious information.

This is the kind of image that Lurk used. Lurk is primarily a downloader. When it was discovered, Lurk’s usual payload was click-fraud malware. To retrieve the URL of the malware it was configured to download, Lurk first downloaded an image (the “white” image we discussed earlier), extracted the LSB from each pixel, performed some XOR operations to decode, and then used the retrieved URL to download the actual payload.

To illustrate how difficult it is to distinguish between pure white (RGB=255,255,255) and slightly greyish white with RGB = 254,254,254, try to compare the two images below. The top NEMESIS logo uses pure white, while the bottom logo uses slightly greyish white with RGB = 254,254,254.

Can you tell the difference?

Stegoloader

This is one piece of malware that has a couple of similarities with Stegano. Stegoloader is primarily an information stealer but consists of several modules. Its downloader module is the one that employs steganography.

Its use of steganography isn’t the only characteristic that makes Stegoloader similar to Stegano. First, like Stegano, Stegoloader initially inspects the target system to make sure it’s not running in an analysis environment or that any security tools are present. If it determines that the environment is not safe enough, it automatically aborts the attack. Secondly, unlike Gozi and Lurk, which simply hid URLs, Stegoloader (like Stegano) also hid code.

How to protect your system from Stegano

There are a couple of ways to protect yourself from a Stegano EK attack. There’s absolutely no way you can identify a malicious banner ad by simply looking at it, so you can forget about countering the steganography part of the attack.

First, you can simply avoid using Internet Explorer. The first vulnerability Stegano exploits, which allows it to detect any security monitoring software, is an IE vulnerability. So if you use Chrome, Firefox, or Safari, that could put Stegano off.

Second, you can either update your Adobe Flash installations, switch Flash off, or stop using Flash altogether. This month, Chrome will stop using Flash as the default enabler of web media. The makers of Firefox, Safari, and Edge (Microsoft’s replacement for IE) are also planning a similar move, so that’s something you might want to put into consideration when prescribing browsers to your end users.

Third, you can deploy advanced anti-malware solutions. Remember that, as part of Stegano’s (and Stegoloader’s) security avoidance techniques, it scans for security tools. If it finds one, it will back off.