Software analyzes apps for malicious behavior

Apps on web-enabled mobile devices can be used to spy on their users. Computer scientists at the Center for Security, Privacy and Accountability (CISPA) developed software that shows whether an app has accessed private data. To accomplish this, the program examines the "bytecode" of the app in question. The researchers show their program at the upcoming computer expo Cebit in Hannover.

Last year at the end of July the Russian software company "Doctor Web" detected several malicious apps in the app store "Google Play." Downloaded on a smartphone, the malware installed -- without the permission of the user -- additional programs which sent expensive text messages to premium services. Although Doctor Web, according to its own statement, informed Google immediately, the malicious apps were still available for download for several days. Doctor Web estimates that in this way up to 25,000 smartphones were used fraudulently.

Computer scientists from the German Saarland University have now developed software which can discover such malicious apps already in the app store. The software detects pieces of code where the app accesses sensitive data and where data is sent from the mobile device. If the software detects a connection between such a "source" and such a "sink," it reports that as suspect behavior. To give an example of such a malicious source-sink combination, Erik Derr explains: "Your address book is read; hundreds of instructions later and without your permission an SMS is sent or a website is visited." Derr is a PhD candidate at the Graduate School of Computer Science and does research at the Center for IT-Security, Privacy and Accountability (CISPA), only a few yards away.

To identify a functional relation between source and sink, the computer scientists from Saarbr?cken use new methods of information flow analysis. As input they provide suspicious combinations of accesses on the application programming interface. As the software needs a lot of computational power and storage, it runs on a separate server. "So far we have tested up to 3000 apps with it. The software analyzes them fast enough that the approach can also be used in practice," Derr says.

View the original article here

A closer look at the malicious Redkit exploit kit

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

In my previous article on the Redkit exploit kit, I provided an overview of how the kit operates. Specifically, how the attack uses a network of compromised web servers to serve up the redirects and malicious content.

In this article, I will take a closer look at the malicious content used to infect the user with malware.

The landing pages used by current versions of Redkit are pretty simple, consisting of just a tiny web page that loads up the malicious Java content. A single param attribute is used to pass in an obfuscated URL (underlined) to the Java code:

This string is retrieved and decoded (simple character substitution):

As noted previously on Naked Security, there have been several recent vulnerabilities in Java that are being targeted by exploit kits like Redkit. In a successful attack, security mechanisms will be bypassed and the malicious payload silently downloaded and run.

The specific vulnerabilities that are being targeted in Redkit change quite regularly, but have recently included:

The JNLP file referenced in the landing page (above) reveals a security bypass that is being used by several of the active exploit kits. The attacks make use of an undocumented parameter (__applet_ssv_validated) to bypass security restrictions, and enable silent (no user prompt) execution of an unsigned applet.

The file downloaded from the payload URL is actually AES encrypted. Clues to the use of AES litter the Java code, despite various attempts to obfuscate the intent. For example, reversing the Cipher transformation string:

Sure enough, looking at the downloaded file, it is easy to confirm that it looks encrypted or encoded in some way (it is not a regular Windows executable at least!):

Of course, to infect the user, the Java has to decrypt the file first. Elsewhere within the code is the necessary decryption key (and iv parameter):

Using these we can manually decode the encrypted file:

openssl enc -d -aes-128-cbc -in -out -K -iv -nosalt -nopad

The Java code does not simply decrypt and save/execute the downloaded file however. There is an additional block of code that inspects the decrypted stream, hunting for a string that is used as a marker.

The purpose of this mechanism is evident a little lower down in the code.

So, if the marker is found, the if condition is false, and two executable files are extracted from the decrypted stream and executed. If the marker is not found, only a single payload is present, and just that file is executed.

Looking at the decrypted file obtained from a recent Redkit payload, the marker is indeed present (highlighted in red), sitting between the two executables that the user is infected with (scareware and a data stealing Trojan).

This mechanism enables the Redkit exploit kit to infect the victim with up to two payloads in a successful attack. The mechanism could easily be extended to allow even more. Of course, this does not really make the attack "worse" - once any machine is infected with a single payload, it is common for that to download and execute others. Nonetheless, it is an interesting feature to note.

The diagram below provides an overview of the above information, summarising how Redkit infects victims with malware.

In these two posts on the Redkit exploit kit I have described the key characteristics of the kit. The most interesting of these are:

use of a network of compromised web servers to "host" the kitproxy malicious content (landing page, JAR, payload) from the C&C server to the victim via a compromised web serverdownload payload(s) in encrypted (AES) formenable infection of 2 payloads in a single attack

To conclude, a few points concerning how users can best protect themselves from this (and similar) attacks.

To start with users or organisations need to consider whether their machines are vulnerable to the exploits being used (just Java in the case of Redkit, at the time of writing).

Do you have Java installed? Do you actually require it? If not, remove Java from your browser.

If you do need Java, ensure you are fully patched, and running the latest version.

In terms of security software, regular good practice should be followed.

In short, use a reputable security product which is up to date.

Additionally, ensure the available functionality within that product is enabled (web reputation filtering, web content scanning, cloud protection, memory scanning, runtime protection/HIPS).

All of these features are designed to provide layered protection, which is crucial for effective protection against drive-by download attacks delivered from exploit kits like Redkit.

Follow @SophosLabs
Follow @NakedSecurity

Image of red eye courtesy of Shutterstock.

View the original article here

Searching for images on Bing? Beware malicious search engine poisoning

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Earlier this week I was asked to look at how search engine poisoning was being used to drive web traffic to payday loan sites.

It turned out that compromised websites were being abused, in order to attract search engine queries, and drive more traffic to the target site(s).

Regular readers will recognise this technique - it is exactly what we have seen being used to drive traffic to malicious websites for several years now.

Further reading: Find out exactly what 'Blackhat search engine poisoning' is.

With search engine poisoning fresh in my mind, I thought it might be interesting to take a look at the current situation regarding malware; how is it currently being used to infect users with malware?

Since we block the redirect used in these attacks as Mal/SEORed, we are able to get insight into which search engines the are managing to poison.

Taking data from the last couple of weeks for search engine redirects blocked on our web appliance, it is clear that the majority of the redirects are affecting those using the Bing search engine.

Of course, this breakdown takes no account of the search engine being used by these customers. Nonetheless, we would expect Google to be the dominant search engine in use, as supported by recent data released by comScore.

Digging further into the data, it is also clear that the attackers are getting most success from poisoning image search results.

Clearly the search engine providers are filtering poisoned results far more effectively from regular, text searches.

Unfortunately for users, it is very hard to recognise rogue images within image search results. Can you spot the rogue images within this selection, (seen from doing an image search for 'movie outline example')?

Actually, three of the six images shown above are rogue images that the attackers have managed to poison the search results with.

At the time of writing, clicking on any one of these, results in being redirected to a malicious Blackhole exploit site (v2, naturally!).

So what can users do to protect themselves?

Clearly the redirect used in these attacks can be blocked by your security product (by detection or reputation filtering). Sophos products block the redirects as Mal/SEORed.

However, we all rely on the search engine providers managing to filter rogue links out of the search results (text and image searches). The bottom line is that we are all guilty of trusting the results we get back, and clicking through without necessarily scrutinizing the URL as closely as we might.

Unfortunately, whilst any of the popular search engines fail to filter out the rogue links, users will continue to be at risk of having their web traffic hijacked.

Follow @SophosLabs

View the original article here

How a malicious help file can install a spyware keylogger

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Do you think that Windows help file is safe? Think again.

Malware authors can create boobytrapped .HLP files, designed to infect your computer.

Take for instance, the strange .HLP file which was sent to SophosLabs by some of our customers at the end of August.

The file, Amministrazione.hlp ("Amministrazione" is Italian for "Administration") was an example of how cybercriminals can use social engineering to trick unsuspecting users into infecting their computers.

If opened, the help file displays an error message:

Help could not read the current Help file.
Make sure there are no errors on the disk, or if the file is on a network drive, that the server is active. (163)

In the background, however, a file called Windows Security Center.exe is being dropped onto the computer, which in turn creates a file called RECYCLER.DLL.

Since SophosLabs first saw this malware attack we have been writing more generic detections which should help pick up new variants of the attack proactively:

The DLL part of the malware attack is the keylogger. It's partof the DarkShell Trojan that has been tied to GhostNet.

The keylogger component is used to log keystrokes made by the user. These are stored in the following file:

\Documents and Settings\username\Local Settings\Application Data\UserData.dat

(where username is a specific username).

The malware attempts to send this data to images.zyns.com (a domain with a long association with malware).

Stay safe everyone - and remember not to click on .HLP files too readily. They could be harbouring a malware attack.

http://twitter.com/SophosLabs

View the original article here

Phishing without a webpage - researcher reveals how a link *itself* can be malicious

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The need for a reliable place to host your malicious website has been the bane of phishers for much of the last decade.

But, no longer.

A researcher at the University of Oslo in Norway says that page-less phishing and other untraceable attacks may be possible, using a tried and true internet communications standard: the uniform resource identifier, or URI.

Henning Klevjer, an information security student at the University of Oslo in Norway, suggests in a just-released research paper that it may be possible for attackers to dispense with phishing sites altogether, embedding their entire scam webpage in an encoded data URI that can be passed around from victim to victim.

URIs are strings of characters that identify a resource. The term encompasses the better-known Uniform Resource Locator (URL) and uniform resource name (URN). However, whereas URLs specify the location of a specific network resource and how it should be accessed (i.e. with HTTP, HyperText Transfer Protocol), URIs are more flexible and can even be used to host the data they “link” to.

Klevjer's paper, "Phishing by data URI" [PDF], suggests ways that the malleability of the URI could be used to mask malicious content.

For example, an attacker could create a stand-alone phishing webpage using images and content pinched from a legitimate site, then embedded in the external document. They could then encode the page’s content in Base64 to mask its meaning to the intended victim, and then append the encoded page into a data URI.

The encoded URI will be long and forbidding looking, but assuming it doesn’t exceed the maximum URL length of a browser, it can be rendered. And, Klevjer’s paper points out, the widespread use of URL shortening services makes it easy for the attacker to mask the hefty URL and circulate it to victims via social networks like Twitter and Facebook, or via e-mail and IM.

In his paper, Klevjer was able to shrink a 24,682 character URI representing a Wikipedia login “phishing” page to just 26 characters using a URL shortening service.

The intention is that victims who receive the link will click on it, launching their web browser. Every modern browser supports the legacy URI scheme and will render the encoded URI as a page in the victim's browser.

The URI-attack method isn’t new. In 2007, researchers Billy "BK" Rios and Nathan McFeters explored similar attacks against Microsoft’s IE6 and IE7 browsers that exploited both documented and undocumented functionality for handling URIs.

The use of URIs creates the possibility that sophisticated attackers could begin circulating individualized phishing pages to small numbers of victims.

It also defeats traditional defenses against phishing attacks, such as web filtering and reputation management, because victims wouldn’t need to communicate out to an attack server to get phished, Klevjer argues.

And the method isn't limited to phishing attacks. Klevjer wrote in an email to Naked Security that fellow Norwegian security researcher Per Thorsheim had pointed out that a data URI could also contain a (compromised) Java applet - worth bearing in mind considering the scare this week about Java zero-day vulnerabilities.

Writing on the SANS blog, Johannes Ullrich points out that attackers would still need to manage some backend infrastructure to receive data stolen in the attack.

However, he says that sophisticated attackers could also sneak the phished data out using a specially-crafted DNS request that would transfer the sniffed login credentials to the log file of a remote system.

Klevjer said the URI attack method could gain adherents among sophisticated attackers who are looking for a way around traffic and reputation monitoring and filtering systems. He said it also raises important questions about who “owns” the malicious data used in a URI based attack.

If URL shorteners are used, for example, the malicious content is now located within a link. Kelvjer told Naked Security:

“This fact transfers liability to the URL shortening services hosting the redirection”

There are caveats, of course. Klevjer points out that Google’s Chrome browser blocks redirection to data URIs, whereas other browsers have set ceilings on the amount of data that can be packed into a URI or URL. IE9 refused to load his sample attack page, which weighed in at 26KB.

Still, both the Firefox and Opera browsers did.

Follow @paulfroberts

Goldfish in bowl and web browser images, courtesy of Shutterstock

View the original article here

Traffbiz: A new malicious twist on affiliate partnerka schemes?

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Website owners have to pay for their websites to be hosted and can easily be tempted to monetize their sites by joining affiliate schemes that pay per click (ppc) or pay per view (ppv). Typically, these schemes promise some dollar amount for thousands of clicks or views.

Some of these affiliate schemes are legitimate, but others are not.

Affiliate web-based malware represents the darker side of these affiliate schemes and is not a new thing - indeed we have been investigating it for at least four years.

The security industry, search engines and independent researchers - such as Stop Malvertising - have been working hard to combat the problem.

Last week, however, we were contacted by the popular Russian search engine Yandex, a technology partner of ours, to help them combat Traffbiz.

Traffbiz is what you might call a bad actor. Not in the Keanu Reeves sense, but in the economics sense. Information about Traffbiz is a little hard to find if you are not comfortable reading Russian. (See these two, Russian-language articles about Traffbiz. Fortunately, the web has online translation services).

What is happening?
Traffbiz are promising webmasters approximately $1 for every 1000 page views (ppv) they generate, and so webmasters are adding code like this to their webpages:

The five digit code in the middle of the URL is a unique tracker id, specific to each affiliate.

The code appears to load a script called counter[0-9]?.jpg. If you manually download the file you may see an image (It was a PNG image file last time I checked).

If you visit the site, monitoring traffic with a tool like Fiddler, you will see another script being loaded.

Then a further script is loaded. Outside of Russia you will just get a clean file. But if you happen to be within Russia, you could find your computer loading a different malicious script like this:

This script would then load a Blackhole exploit kit (Detected by Sophos as Troj/ExpJS-N).

This version of Troj/ExpJS-N targets Russian users, by hitting them with banking trojans.

It should be noted that the present attack is one of the first we have seen that seemingly deliberately targets Russian citizens.

If you would like to know more about Web-based affiliate malware then read my paper and slides, courtesy of Virus Bulletin.

To find out more about Russian affiliate (also known as Partnerka) schemes, a must read is Dmitry Samosseiko's paper "The Partnerka -- what is it, and why should you care?".

Follow @SophosLabs

View the original article here

Foreign hackers targeted US water plant in apparent malicious cyber attack ... - Washington Post (blog)

Foreign hackers caused a pump at an Illinois water plant to fail last week, according to a preliminary state report. Experts said the cyber-attack, if confirmed, would be the first known to have damaged one of the systems that supply Americans with water, electricity and other essentials of modern life.

Companies and government agencies that rely on the Internet have for years been routine targets of hackers, but most incidents have resulted from attempts to steal information or interrupt the functioning of Web sites. The incident in Springfield, Ill., would mark a departure because it apparently caused physical destruction.

Federal officials confirmed that the FBI and the Department of Homeland Security were investigating damage to the water plant but cautioned against concluding that it was necessarily a cyber-attack before all the facts could be learned. “At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety,” said DHS spokesman Peter Boogaard.

News of the incident became public after Joe Weiss, an industry security expert, obtained a report dated Nov. 10 and collected by an Illinois state intelligence center that monitors security threats. The original source of the information was unknown and impossible to immediately verify.

The report, which Weiss read to The Washington Post, describes how a series of minor glitches with a water pump gradually escalated to the point where the pump motor was being turned on and off frequently. It soon burned out, according to the report.

The report blamed the damage on the actions of somebody using a computer registered to an Internet address in Russia. “It is believed that hackers had acquired unauthorized access to the software company’s database” and used this information to penetrate the control system for the water pump.

Experts cautioned that it is difficult to trace the origin of a cyber-attack, and that false addresses often are used to confuse investigations. Yet they also agreed that the incident was a major new development in cyber-security.

“This is a big deal,” said Weiss. “It was tracked to Russia. It has been in the system for at least two to three months. It has caused damage. We don’t know how many other utilities are currently compromised.”

Dave Marcus, director of security research for McAfee Labs, said that the computers that control critical systems in the United States are vulnerable to attacks that come through the Internet, and few operators of these systems know how to detect or defeat these threats. “So many are ill-prepared for cyber-attacks,” Marcus said.

The Illinois report said that hackers broke into a software company’s database and retrieved user names and passwords of control systems that run water plant computer equipment. Using that data, they were able to hack into the plant in Illinois, Weiss said.

Senior U.S. officials have recently raised warnings about the risk of destructive cyber-attacks on critical infrastructure. One of the few documented cases of such an attack resulted from a virus, Stuxnet, that caused centrifuges in an Iranian uranium enrichment facility to spin out of control last year. Many computer security experts have speculated that Stuxnet was created by Israel — perhaps with U.S. help — as a way to check Iran’s nuclear program.

More cybersecurity coverage

- Proactive steps against cyberattacks

- Pentagon: Offensive cyber attacks fair game

- Cyberspying report names China, Russia

- In cyberspace, growing calls for clarity on what U.S. can do to deter against attacks

View the original article here

Trojans spammed out in malicious wave of fake DHL emails

Over 30,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest internet and Facebook security threats. X

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats. X

There is a significant wave of malicious emails being spammed out presently, posing as notification messages from DHL.

If you make the mistake of opening the attached ZIP file you will be putting your computer at risk of infection by a Trojan horse.

There's nothing new, of course, about cybercriminals disguising their attacks as notifications from DHL.

This attack, though, is particularly aggressive and - as you can see in the examples below - uses a variety of different DHL-related subject lines, attachment names and message bodies:

HELLO!

Dear Client, Recipient's address is wrong

Print out the invoice copy attached and collect the package at our department

Best wishes , DHL Customer Services

ATTENTION!
DEAR CLIENT , We were not able to deliver the postal package

Please print out the invoice copy attached and collect the package at our department

Pack it. Ship ip. No calculating, Your DHL .com Customer Services

Good afternoon!

DEAR CUSTOMER, Recipient's address is wrong
PLEASE PRINT OUT THE INVOICE COPY ATTACHED AND COLLECT THE PACKAGE AT OUR DEPARTMENT

Pack it. Ship ip. No calculating, Your DHL .com Customer Services

Good afternoon!

Dear User , Delivery Confirmation: FAILED
Please print out the invoice copy attached and collect the package at our department
With respect to you, DHL Team

Here are just some of the different disguises we saw in a snapshot of less than one minute in a small selection of our spam traps:

Sophos products intercept the attack, detecting the ZIP file as Troj/Invo-Zip and the Trojan horse contained within as Mac/EncPk-NS.

Dangerous emails claiming to come from courier companies are nothing new - it has become one of the most commonly-used methods by which hackers socially engineer unsuspecting users into opening a malicious attachment or clicking on a dangerous link.

Make sure that you and your friends are wise to the trick - and think before you click.

Follow @gcluley

View the original article here