WWW.VIRUSBULLETIN.COM/CONFERENCE 2018MONTREAL 3 – 5 October 2018 NOW YOU SEE IT, NOW YOU global and debilitating WannaCry to the most sophisticated false flag to date, Olympic Destroyer. The minimal use of wipers over DON’T: WIPERS IN THE WILD the last decade and their heightened deployment in recent years Saher Naumaan suggests there has been an evolution in APT behaviour. BAE Systems Applied Intelligence, UK Our case studies of wiper attacks highlight three clear categories of wiper use: espionage, sabotage and diversion. We first look at [email protected] the use of wipers for espionage – we discuss the usual motivations of state actors, and the incorporation of a new tactic, with reference to the unusual appearance of wiper functionality in intrusions. The case studies presented are Flame ABSTRACT and StoneDrill. The next section covers the most commonly Wipers are an APT’s new best friend. Traditionally, it is rare for associated use of wipers: sabotage. Prominent examples include destructive malware to appear in cyber espionage, and it Shamoon, Shamoon 2.0 and DarkSeoul, all of which had the generally runs counter to the conventional interests of an aim of deliberate system destruction. Finally, 2017 and 2018 Advanced Persistent Threat (APT) – such as intelligence have seen the emergence of a new strategy for wiper use – collection, persistence and covert access. But wiper malware is diversion – as demonstrated by Hermes and MBR Killer in the now appearing more often, emerging in APT toolkits, and was Taiwanese and Chilean bank heists. seen in at least four attacks in 2017 following only a handful of This paper argues that wipers have become a routine part of an instances in the previous decade. APT toolkit, though their application isn’t limited to Does this mean the motivations of state actors are changing? We destruction. While wiper functionality always results in the have seen APTs deviate from espionage and branch into destruction of data or systems, this is not always the wiper’s criminal operations such as bank heists and the sabotage of sole intent or purpose. This paper evaluates the use of wipers as critical infrastructure and industrial control systems. From the a new tactic in targeted state-sponsored attacks, looking at debilitating WannaCry to the sophisticated false flag Olympic several examples, and highlights the significance of this trend. Destroyer, the heightened deployment of wipers suggests there has been an evolution in attacker behaviour. ANATOMY AND FUNCTION OF A WIPER This paper examines three different classifications of wipers Destruction, the function of a wiper, is reflected in its anatomy, through examples of various politically targeted attacks: which consists of a destructive payload and a propagation espionage (in the cases of Flame and StoneDrill), sabotage (seen mechanism. However, there are nuances and variations in how a in the cases of Shamoon 2.0 and DarkSeoul) and diversion (seen wiper is constructed and how it executes. in the cases of Hermes and MBR Killer in bank heists in Taiwan and Chile, respectively). Wipers have become a low-cost way for state actors to conduct destructive attacks that serve multiple Payload types purposes – they have significantly more impact on victims and A wiper targets one or a subset of three attack vectors: files, the impede investigation into primarily non-destructive attacks. boot section,1 and the backup of the system and data. • The most unmistakable wiper attack is against files. For INTRODUCTION efficiency purposes, most wipers are selective in their Traditional state-sponsored hacking activity is often focused wiping and won’t overwrite the entire hard disk. Some around cyber espionage, as the primary interests of an Advanced wipers target files with specific extensions, or folders, and Persistent Threat (APT) tend to focus on intelligence collection, some only rewrite enough bytes in each file to destroy the exfiltration of sensitive data, persistence, and covert access. file headers and prevent them from being opened. However, we have also seen APTs deviate from espionage and • Another target of wipers can be the boot section. Such an branch into criminal operations such as bank heists and attack works either by erasing the first 10 sectors of the sabotage through attacks on critical infrastructure and industrial physical disks or by overwriting the first 10 sectors with a control systems (ICS). The nature of state-sponsored attacks is new boot loader, as in the Shamoon attacks (discussed later). changing as their motivations and capabilities evolve. Either way, files aren’t just erased – the original operating The tools used in offensive cyber operations cover a vast range system becomes unbootable because the Master Boot Record and include backdoors, remote access trojans (RATs), implants, (MBR) section of the hard disk has been corrupted.2 and even destructive malware. This range also includes wipers, • If the goal is complete corruption, the malware must also which have existed for years but which have, until now, attack all backups and shadow copies. In Duqu, the remained rare in state-sponsored operations. Wipers are attackers scrubbed the servers – the files weren’t just discussed in the context of targeted attacks, the scope of which does not include criminal ransomware. The following discussion 1 Related targets include file tables and partition tables. is also restricted to wiper malware, precluding other destructive 2 Wipers can and have targeted other elements of the physical disks, malware such as Stuxnet and TRISIS/Triton. including NTFS boot sectors and corresponding Master File Tables (MFTs) and their backups. Even if NTFS boot sector corruptions were In the last 10 years we have witnessed only a handful of major manually resolved, the lack of the MFT would result in files needing to wiper attacks, but their use has escalated since 2016, from the be carved manually from disk. The files themselves are left intact. PAPER PRESENTED AT VB2018 MONTREAL 1 2018MONTREAL WWW.VIRUSBULLETIN.COM/CONFERENCE 3 – 5 October 2018 deleted, but the data had been overwritten to prevent attacks. In fact, Talos has blogged that it has ‘historic examples restoration [1]. of this type of malware [wipers] going back to the 1990s’ [4], The wiper attacks that targeted the Iranian Oil Ministry and referencing variants of the Destover malware that attacked Sony Iranian National Oil Company in April 2012 demonstrated Pictures in 2014. selective and targeted wiping [2]. Most files were wiped with a Instances of wiper use, and even destructive operations in repetitive pattern that ensured every header was destroyed, yet general, have been limited over the last ten years compared to other parts of the files remained intact. The wiper likely other types of intrusions. However, it appears to be an searched for and destroyed files with certain extensions, then increasingly popular tactic, with seven high-profile destructive targeted all files in certain folders, and finally overwrote the disk attacks occurring in the last three years. In most cases, the sectors. The attackers first wiped the malware components, and ultimate aim is destruction, but other cases, such as examples of only then targeted other files in the system, which eventually Lazarus activity, show that wipers are even being used to remove made the machine crash. evidence of their own activity or as a diversion technique. Infection/propagation CLASSIFICATION OF WIPERS As with other malware, a wiper requires a delivery mechanism. In an exploration of wipers in the context of state-sponsored, Some malware uses phishing as an infiltration vector, though in targeted attacks, several examples demonstrate the variety and the case of a wiper, it would be less common and less evolution of wiper use cases. We classify them as three distinct advantageous for an attacker because the goal is usually to use cases. infect as many boxes as possible. A wiper could also theoretically be pushed to all machines on a network, such as in Espionage the case of NotPetya, which compromised victims through a Espionage is ‘an attempt to penetrate an adversarial system for malicious software update of MEDoc. purposes of extracting sensitive or protected information’ [5]. Wiper worms, however, consist of a destructive payload and a The most strategic use of wipers, espionage is primarily directed propagation mechanism, which allows the wiper to spread at collecting intelligence to serve a higher purpose, rather than across machines and networks. NotPetya and Olympic as an instrumental goal-oriented operation. Destroyer are examples of wiper worms, meaning they were able to self-propagate – to remotely copy and execute the wiper Flame/sKyWIper – and perform lateral movement. One of the older cyber espionage operations, Flame was a large-scale and sophisticated campaign that was active for at While conventional understanding of wipers assumes their least five years before its discovery in 2012 in organizations in singular purpose is destruction or disruption [3], the following the Middle East, primarily Iran.3 The Flame malware would case studies show that functionality is different from intent and automatically collect everything from infected machines: purpose. The function of all wipers is destruction, but the intent keystrokes, audio recordings from the internal microphone, behind their destructive capability varies and seems to be evolving. screenshots, documents, and network traffic. The complexity of Flame suggests its purpose was long-term surveillance rather HISTORY OF WIPERS 3 Flame could date back to as early as 2007, around the time Stuxnet Wipers appeared in targeted attacks as early as 2009 with the and Duqu were likely created – one component of Flame was seen in use of Dozer on South Korean targets as part of the DarkSeoul December 2007. Figure 1: Major targeted attacks employing wipers and classifications. 2 PAPER PRESENTED AT VB2018 MONTREAL WWW.VIRUSBULLETIN.COM/CONFERENCE 2018MONTREAL 3 – 5 October 2018 Figure 2: Flame code.