Anonymity is King

Virus Bulletin 2015: Prague October 1, 2015

“A man is least himself when he talks in his own person,

But give him a mask and he will tell you the truth”

2 Copyright 2015 Trend Micro Inc. Speakers Michael John Marcos Anthony Joe Melgarejo

Threat Research Engineer, Trend Threat Research Engineer, Trend Micro Micro SME – Banking Trojan SME - Ransomware

3 Copyright 2015 Trend Micro Inc. Deep Web • part of the that is inaccessible to conventional search engines, and consequently, to most users.

4 Copyright 2015 Trend Micro Inc. WHAT’S OUR STORY?

5 Copyright 2015 Trend Micro Inc. What’s our story • How it all began? • How do cybercriminals exploit this technology? • What can we do to investigate? • What’s next?

6 Copyright 2015 Trend Micro Inc.

HOW IT ALL BEGAN?

7 Copyright 2015 Trend Micro Inc. Botnet Topology • Star

C&C Server

8 Copyright 2015 Trend Micro Inc. Botnet Topology (cont’d) • Multi-server

C&C Servers

9 Copyright 2015 Trend Micro Inc. Takedowns.. Everywhere..

10 Copyright 2015 Trend Micro Inc. Solution

11 Copyright 2015 Trend Micro Inc. Deep Web traffic is Encrypted.

12 Copyright 2015 Trend Micro Inc. Deep Web offers Deception.

uhwikih256ynt57t.onion

Infected Machine lp4t52xp5vlhyhkb.onion C&C Server

s6cco2jylmxqcdeh.onion 13 Copyright 2015 Trend Micro Inc. Deep Web provides Resilience and High Availability.

Offline

C&C Server 1

Active

Infected Machine lp4t52xp5vlhyhkb.onion C&C Server 2

Reserved

14 Copyright 2015 Trend Micro Inc. C&C Server 3 HOW DO CYBERCRIMINALS EXPLOIT THIS TECHNOLOGY?

15 Copyright 2015 Trend Micro Inc. - The Onion Router

TOR CLIENT

Unencrypted

16 Copyright 2015 Trend Micro Inc. Hidden Services IP1-3

PK DB

IP1-3

PK PK IP1 IP2 HIDDEN Cookie SERVICE

RP TOR CLIENT RP IP3 Cookie

17 Copyright 2015 Trend Micro Inc. KINS

18 Copyright 2015 Trend Micro Inc. KINS - Static Analysis

32-bit executable 64-bit executable

TOR executable 19 Copyright 2015 Trend Micro Inc. KINS Infection Flow

Installation

Inject

--HiddenServiceDir "%appdata%\tor\hidden_service" --HiddenServicePort "1080 127.0.0.1:23318"

20 Copyright 2015 Trend Micro Inc. --HiddenServicePort "5900 127.0.0.1:26824"

Tor pre-requisites Tor Browser Installation

21 Copyright 2015 Trend Micro Inc.

Allows Internet users to access Tor hidden services without using Tor Browser

22 Copyright 2015 Trend Micro Inc. Using Tor2Web Tor: • http://duskgytldkxiuqc6.onion

Tor2web: • http://duskgytldkxiuqc6.tor2web.org • http://duskgytldkxiuqc6.onion.to • http://duskgytldkxiuqc6.onion.cab • etc...

23 Copyright 2015 Trend Micro Inc.

CTB-Locker - Overview

ECDH BITCOIN

TOR AND TOR2WEB

24 Copyright 2015 Trend Micro Inc. CTB-Locker Infection Flow

Installation

Public Key Bitcoin Address Payment Site

Inject

25 Copyright 2015 Trend Micro Inc. CTB-Locker: Payment Sites

26 Copyright 2015 Trend Micro Inc. Blocked Payment sites

27 Copyright 2015 Trend Micro Inc. CTB-Locker: Leveraging Tor2web availability

28 Copyright 2015 Trend Micro Inc. Advantages of Malware using Tor2web • No need for Tor installation • No Tor network traffic in the system • Availability of variety

29 Copyright 2015 Trend Micro Inc. I2P - Invisible Internet Project

CLIENT OUTBOUND TUNNELS SERVER INBOUND TUNNELS

HTTP REQUEST HTTP REQUEST GARLIC MESSAGE HTTP REQUEST DATABASEHTTP REQUEST STORE DELIVERY STATUS DELIVERY STATUS DATABASE STORE DATABASE STORE SERVER CLIENT CLIENT ROUTER ROUTER WEB SERVER

DELIVERY STATUS CLIENT INBOUND TUNNELS SERVER OUTBOUND TUNNELS

30 Copyright 2015 Trend Micro Inc. Dyreza

31 Copyright 2015 Trend Micro Inc. Dyre capabilities

NAT

System Informatiom

32 Copyright 2015 Trend Micro Inc. Dyreza: Call Home via I2P

33 Copyright 2015 Trend Micro Inc. Dyreza: Domain generation algorithm

34 Copyright 2015 Trend Micro Inc. As Malware Support Portal • CRYPVAULT – crypto-ransomware (Warning Message)

(Brief) (Instructions)

Support Portal URL

key file

35 Copyright 2015 Trend Micro Inc. As Malware Support Portal (cont’d)

Upload key file As Malware Support Portal (cont’d)

Real-time Chat Technical Support

37 Copyright 2015 Trend Micro Inc. As Command and Control Server • Slempo – Android Backdoor malware • Trojanized version of Orbot • Backdoor Commands

38 Copyright 2015 Trend Micro Inc. As Command and Control Server (cont’d)

} stolen information

TOR URL

39 Copyright 2015 Trend Micro Inc. As File Server hosting malware • Chanitor, a downloader malware • It uses Tor2Web URLs to deploy a banking trojan, VAWTRAK in the infected system

Harcoded Tor2Web URLs

40 Copyright 2015 Trend Micro Inc. WHAT CAN WE DO TO INVESTIGATE?

41 Copyright 2015 Trend Micro Inc. Forensics / Detection Good sources of information to extract Deep Web artifacts: • Command-line arguments • Installed files and folders • Prefetch (.pf) files • Network Traffic

42 Copyright 2015 Trend Micro Inc. Forensics / Detection (cont’d) • Command-line arguments

43 Copyright 2015 Trend Micro Inc. Forensics / Detection (cont’d) • Installed files and Folder – Installation Date – Last Execution Date – Other info (e.g. generated Deep Web URL, version and etc.)

44 Copyright 2015 Trend Micro Inc. Forensics / Detection (cont’d) • Prefetch files

45 Copyright 2015 Trend Micro Inc. Forensics / Detection (cont’d) • Network Traffic logs

46 Copyright 2015 Trend Micro Inc. WHAT’S NEXT

47 Copyright 2015 Trend Micro Inc. Conclusion • Cyber criminals will continue to use Deep Web to evade attribution

48 Copyright 2015 Trend Micro Inc. Over the years.. 2012 April 20152013 – October 20152014 April 2015 Skynet Sefnit Tox Chewbacca CryptoWall 3.0 Atrax BitCrypt CTB Locker ZbotORX LockerBifrose Dyre Encryptor RaaSOnionduke VaultCrypt CryptoWall 2.0 TeslaCrypt Cryptoapp LusyPOS Babar AlphaCryptSlempo Chanitor Troldesh Torrent Locker Vawtrak

49 Copyright 2015 Trend Micro Inc.

50 Copyright 2015 Trend Micro Inc. Conclusion • Cyber criminals will continue to use Deep Web to evade attribution. • More cybercriminal groups will be attracted to Deep Web. • Being one-step ahead.

51 Copyright 2015 Trend Micro Inc. QUESTIONS?

52 Copyright 2015 Trend Micro Inc. Conclusion

Thank You !!! Michael John Marcos, Anthony Joe Melgarejo October 2015

53 Copyright 2015 Trend Micro Inc.