W32/VBNA-X worm spreads quickly through networks and removable media

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

SophosLabs researchers have noticed a significant increase in the spread of malware we call W32/VBNA-X (among other names).

Several other vendors, including McAfee (W32/Autorun.worm.aaeb) and Symantec (W32.ChangeUp), have been alerting their customers as well. While the basic components of this malware have been around for some time, it has become considerably more aggressive in its latest iteration.

W32/VBNA-X is a worm, but also exhibits characteristics typically found in a Trojan. Its most obvious method of spreading appears to be through the use of autorun.inf files dropped on removable media and writable network shares.

You would hope this technique wouldn't be too effective on today's PCs, though. Microsoft released updates for XP, 2003 and Vista in February 2011 to disable Autorun on all media aside from "shiny discs."

It is still not a bad idea to disable Autorun/Autoplay more completely, which is quite easy to do according to Microsoft's instructions, which include a "FixIt."

Most PCs will ignore autorun.inf files these days, so people must be clicking on the malware itself, but why?

It appears to be a cocktail of clever social engineering, poor default settings and user carelessness.

After creating the autorun.inf file for the unpatched victims, it begins to enumerate all of the file and folder names on writable shares and removable devices.

For example, say your E: drive is a network share with folders named au and r and files named as.txt and Adobe.pdf.

It will set all of these to have the hidden attribute and set a registry key to ensure hidden files are not displayed.

Then it will create copies of itself called Porn.exe, Sexy.exe, Passwords.exe and Secret.exe in addition to creating a copy of itself for each legitimate file and folder present on the volume.

The duplicates of the original folders and files will have their icons set to the standard folder icon in Windows 7.

In this screenshot you can see the original folders at the top showing their Windows XP icons and the cloned/Trojaned ones with the Windows 7 icons lower down.

The malware appears to assume that you are not showing extensions, which is the default in all releases of Windows.

I can easily see how people browsing file shares and USB drives could accidentally click the wrong folder, especially if the real folders are set to hidden.

If we show extensions and view all hidden files we see a very different picture.

In addition to the original files and their impostors there are also files called ..exe and ...exe. The malware is also known to write a zero byte file called x.mpeg, although it did not do so in this test instance.

The malware copies itself to the user's profile using a random file name and adds a registry key to start the malware on boot.

Some variants are known to disable Windows Update to prevent the victim from receiving a patch or updated instructions that may disable it.

W32/VBNA-X is also polymorphic so the SHA1 checksums vary for some of the files: 30582368427f752b7b6da4485db456de915101b2 SHA1 for Porn.exe7ff75f92c5461cc221cb3ab914592bd2a5db6e15 SHA1 for Sexy.exed71a89c085ffbb62f4e222fb2f42d7e2271e4642 SHA1 of all the rest

Registry keys created:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\%random% %UserProfile%\%random% /%randomletter% - For persistenceHKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\ NoAutoUpdate = 1 - To disable updatesHKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ ShowSuperHidden = 0 - To ensure hidden items stay hidden

These samples follow the standard operating procedure for modern malware. Once loaded W32/VBNA-X contacts a command and control (C&C) server to receive instructions for further payloads to download.

The malware attempts to contact the C&Cs on port 9003 using HTTP, although McAfee has reported seeing samples connecting to port 9004 as well.

Many of the DNS names are hosted in the ddns#.eu domain space, but the entire list is quite extensive. Administrators who wish to monitor for infections may wish to monitor their firewall logs for connections to ports 900[0-9].

Once the C&C server is contacted a command and URL is passed back to the malware instructing it to download a payload named google.exe which is placed in the users profile directory.

The instances we investigated downloaded banking Trojans belonging to the Zeus/Zbot family, but can frequently change based on time of day or geographic location.

Aside from keeping your anti-virus up to date there are several things you can do and can watch for.

Ensure Autorun is totally disabled on all Windows operating systems. Make sure your standard Windows images and group policies are configured to show file extensions and hidden files. Restrict write permissions to file shares to allow access only where absolutely necessary Block all outbound connections to unknown ports and services on your gateway and client firewalls. Ensure behavioral detection technologies are enabled in your anti-virus product to detect addition of malware persistence schemes and tampering with updating and anti-virus settings.Sophos Anti-Virus on all platforms detects and blocks the various components of this malware as follows:

* W32/VBNA-X: Specific detection for this worm (variants include W32/VBNA-U, W32/VBNA-Z, W32-VBNA-AA and W32/VBNA-AB)
* Mal/SillyFDC-Z Generic worm detections for Autorun.inf files (variants include Mal/Autorun-AX, W32/SillyFDC-IP and W32/AutoInf-DI)
* Troj/Tepfer-E Trojan payloads detected in relation to this malware (variants include Troj/VB-GFM, W32/SillyFDC-IP and Mal/SillyFDC-Z)
* HIPS/RegMod-009 Proactive detection and prevention for registry modifications and persistence

* Customers using Sophos web protection will be prevented from accessing domains known to be involved with this malware

I would like to extend a special thank you to the entire SophosLabs Vancouver team and especially Mike Wood, Peter Szabo and Savio Lau for spending so much extra time to share these details with our readers.

Follow @chetwisniewski
Follow @SophosLabs

Malware skull image from Shutterstock.

View the original article here

Most Wi-Fi routers susceptible to hacking through security feature

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Stefan Viehböck, an independent security researcher, published a paper on Boxing Day titled "Brute forcing Wi-Fi Protected Setup" to his WordPress blog disclosing a weakness in the configuration of most consumer/SoHo Wi-Fi routers.

As we all know the state of security for most home Wi-Fi networks was nearly non-existent only a few years ago.

This prompted the Wi-Fi Alliance to establish a new simple method for consumers to enable and configure WPA2 on their routers without knowledge of encryption, keys or how it all works.

The standard is called Wi-Fi Protected Setup (WPS) and is enabled by default on nearly all consumer Wi-Fi access points, including those sold by Cisco/Linksys, Netgear, Belkin, Buffalo, D-Link and Netgear.

It has three methods of simplifying the connection of wireless devices to WPA2 protected access points:

Push Button Connect (PBC) requires the user to push a button on the router which allows it to communicate with a client needing configuration. The client attempts to connect and the router simply sends it the security configuration required to communicate.Client PIN mode is where the client device supports WPS and has a PIN assigned by the manufacturer. You then login to the router's management interface and enter the PIN to authorize that client to obtain the encryption configuration.Router PIN mode allows a client to connect by entering a secret PIN from a label on the router, or from its management interface which authorizes the client to obtain the security configuration details.

The first method requires physical access, while the second requires administrative access, both of these pass muster. The third however, can be accomplished only through the use of the Wi-Fi radio.

The PIN used for authentication is only eight digits which would give the appearance of 108 (100,000,000) possibilities. It turns out the last digit is just a checksum, which takes us down to 107 (10,000,000) combinations.

Worse yet the protocol is designed where the first half and second half are sent separately and the protocol will confirm if only one half is correct.

So you have now reduced the difficulty of brute forcing the PIN down to 104 (10,000) plus 103 (1,000) or 11,000 possibilities.

Some of the routers Viehböck tested did seem to implement a mechanism to slow down the brute forcing, but the worst case scenario allowed him to acquire the keys within 44 hours.

Compared with attempting to attack WPA2-PSK directly, this is a cheap and effective attack.

As the sub-title of Viehböck's paper states "When poor design meets poor implementation" security is the loser.

If you own a reasonably modern Wi-Fi router you are at risk (unless you have installed some sort of alternative firmware like OpenWRT or Tomato Router).

If possible disable the WPS support on your router and contact your manufacturer for updated firmware which may provide a fix or mitigation against this attack.

Another researcher independently discovered the same issue and has published a tool called Reaver that implements this attack.

Similar to the Firesheep tool, this will likely light a fire under the butts of the Wi-Fi Alliance and manufacturers to quickly resolve these issues.

Follow @chetwisniewski

View the original article here