CONTENTS in THIS ISSUE Fighting Malware and Spam

DECEMBER 2010 Fighting malware and spam CONTENTS IN THIS ISSUE 2 COMMENT PARANOID ANDROID Commercial ‘malware’ production August 2010 saw the appearance of the fi rst piece of malware for the Android mobile platform. 3 NEWS Denis Maslennikov examines three variants of the Season’s greetings FakePlayer SMS trojan. Spam falls to 2008 levels page 4 3 VIRUS PREVALENCE TABLE THREATS TO ONLINE BANKING Alisa Shevchenko sheds some light on the MALWARE ANALYSES technology of online banking fraud with an in-depth 4 Android SMS trojans: new platform, analysis of the Ibank trojan which targets a wide ‘old’ tricks variety of Russian online banking technologies. 8 Case study: the Ibank trojan page 8 12 FEATURE VBSPAM CERTIFICATION What’s the deal with sender authentication? One month later than planned, the Part 5 tenth VBSpam report puts 19 full 18 CONFERENCE REPORT solutions to the test as well as one reputation blacklist. Martijn Grooten VERIFIED VB ‘Securing Your Organization in the Age of Cybercrime’ Seminar has the details. page 20 CALL FOR PAPERS 19 VB100 CERTIFICATION VB2011 Barcelona This month the VB lab team put COMPARATIVE REVIEWS a monster haul of products to test 20 VBSpam comparative review on Windows 7 Professional but were disappointed by the level of 27 VB100 comparative review on Windows 7 Professional unreliability, untrustworthiness and fl akiness they encountered. John 77 END NOTES & NEWS Hawes has all the gory details. page 27 ISSN 1749-7027 COMMENT ‘The development departments have often been the consumers of these specialized products, there is an increasing call for such and application penetration testing services in the commercial market. of sophisticated Enterprise customers are looking for new, more malware ... already exhaustive methods to test the strength of their business systems and products. Perimeter defences such as exists within the anti-virus gateways and content fi lters are now fair game commercial realm.’ and, in order to test them successfully, targeted delivery of bespoke malware and tuned exploit platforms is required. Gunter Ollmann, Damballa Much of this is driven by the need to verify the claims of security vendors that employ ‘pre-emptive’ technologies COMMERCIAL ‘MALWARE’ and other broad-spectrum protection engines. PRODUCTION What this all means is that the production of sophisticated As an industry we spend a lot of time tracking and malware is no longer entirely within the realms of discussing the criminals that manufacture malware. While, criminals (if it ever was). Security consultants are from a technological point of view, a remote management generating their own custom malware agents and tool is typically indistinguishable from a remote access specifi cally tuning their exploits to defeat the defences trojan, intent is the guide we use to label the trojan as uncovered during a penetration test. These consulting malicious and the management tool as benign. deliverables are often of a much higher calibre and sophistication than the average piece of malware As threats morph, our industry undergoes periodic circulating the Internet. As a consequence, we must be changes in the way in which we categorize both the careful in how we label and react to the newest threats we software agents we’re expected to protect against and the encounter in the anti-malware business. We will also have labels we apply to their authors. Today, we’re being asked to be more vigilant in identifying specifi c targeted attacks. to make the call on ‘designer malware’ – in particular, the product of professional security consulting companies. We know from past experience that it’s easy for proof-of-concept malware to escape confi nement For a number of years, the call for commercial-grade – whether that be through poor coding of worm malware – whether delivered as construction tools or as functionality, unexpected recipients, failure to clean up proof-of-concept code – has been increasing. What was afterwards, or merely because a sample was passed to the once a hushed offering from boutique penetration testing security vendor at the conclusion of the engagement. The companies has entered into the standard service offerings result is a new family of malware or exploit technique of several mainstream security consulting fi rms. causing a fi re-drill response from the security vendor. Obviously, there is great breadth in the classes and Then, of course, there’s the issue of research-driven usage of ‘commercial-grade malware’ (for want of a malware. For example, a customer hires a consulting better name). Traditionally, boutique security consulting company to review the security of cellular picocell companies have constructed their own malware for two appliances from four different manufacturers. After primary purposes: as a stable platform for weaponized several months of research, multiple vulnerabilities are exploits, and as a delivery vehicle for proof-of-concept uncovered and a proof-of-concept delivery sample is made penetrations. While various government agencies and (e.g. a worm that exploits the vulnerabilities). That piece of malware is the property of the customer, so we have to Editor: Helen Martin hope that the commissioner of the research was reputable. Technical Editor: Morton Swimmer The point of all this is that commercial ‘malware’ Test Team Director: John Hawes production is here to stay. As an industry, we need to Anti-Spam Test Director: Martijn Grooten recognize that malware is a tool used by criminal and Security Test Engineer: Simon Bates legitimate businesses. The development and application Sales Executive: Allison Sketchley of sophisticated malware – such as worms with ‘zero-day’ Web Developer: Paul Hettler exploits that target specifi c classes of embedded devices Consulting Editors: Nick FitzGerald, Independent consultant, NZ – already exists within the commercial realm. As a Ian Whalley, IBM Research, USA consequence, we can expect to see more sophisticated Richard Ford, Florida Institute of Technology, USA malware coming from a broader spectrum of vectors which may not always be a ‘threat’ in the classic sense. 2 DECEMBER 2010 VIRUS BULLETIN www.virusbtn.com NEWS SEASON’S GREETINGS The members of the VB team extend their warm wishes to Prevalence Table – October 2010 [1] all Virus Bulletin readers for a very happy holiday season and a healthy, peaceful and prosperous new year. Malware Type % This Christmas Virus Bulletin has made a donation of Autorun Worm 12.52% clothing and other items to UK-based charity for the VB Worm 7.87% homeless Crisis (http://www.crisis.org.uk/). Confi cker/Downadup Worm 6.59% FakeAlert/Renos Rogue AV 5.21% Sality Virus 3.83% Downloader-misc Trojan 3.30% Heuristic/generic Trojan 3.15% Heuristic/generic Misc 3.12% OnlineGames Trojan 2.95% Heuristic/generic Virus/worm 2.52% Delf Trojan 2.51% Zbot Trojan 2.42% StartPage Trojan 2.39% Virut Virus 2.07% Clockwise from top left: Helen Martin, Martijn Grooten, AutoIt Trojan 1.99% Allison Sketchley, John Hawes, Simon Bates, Paul Hettler. Adware-misc Adware 1.96% Injector Trojan 1.91% SPAM FALLS TO 2008 LEVELS Iframe Exploit 1.64% In 2008 we complained bitterly about the amount of spam Encrypted/Obfuscated Misc 1.61% clogging up our inboxes – today, however, there is reason to Exploit-misc Exploit 1.54% be cheerful about receiving the same amount. Researchers Alureon Trojan 1.48% claim that, in the third quarter of 2010, spam volumes fell to their lowest level since 2008. Crypt Trojan 1.41% PDF Exploit 1.22% It is believed that the decrease is due in large part to the takedown of several botnets, and researchers suggest that Small Trojan 1.21% cybercriminals may be turning to SEO poisoning, phishing Vobfus Trojan 1.16% attacks and malware in preference to spam – possibly Agent Trojan 1.12% because these methods are more profi table. Dropper-misc Trojan 1.07% Meanwhile, a man suspected to be the mastermind of the Tanatos Worm 1.05% Mega-D botnet – which at one point accounted for nearly a third of all of the spam on the Internet – has appeared Hupigon Trojan 1.05% in court in Milwaukee. The FBI alleges that 23-year-old PCClient Trojan 1.05% Russian Oleg Nikolaenko was responsible for controlling Rimecud Worm 0.95% the botnet which, at its most active, was churning out 10 FakeAV-Misc Rogue AV 0.93% billion spam messages per day. Others [2] 15.16% The Mega-D botnet was partially taken down in 2009 in an operation by security fi rm FireEye, and its activity had Total 100.00% been notably reduced in recent months. Nikolaenko, who was arrested in November, was charged with running a [1] Figures compiled from desktop-level detections. global network of more than 500,000 virus-infected PCs. [2] Readers are reminded that a complete listing is posted at He pleaded not guilty and was denied bail, being deemed by http://www.virusbtn.com/Prevalence/. the judge to be a fl ight risk. DECEMBER 2010 3 VIRUS BULLETIN www.virusbtn.com MALWARE ANALYSIS 1 ANDROID SMS TROJANS: NEW In the following sections we take a look at three variants of this trojan, looking at where they came from, and the way in PLATFORM, ‘OLD’ TRICKS which they spread. Denis Maslennikov Kaspersky Lab, Russia FakePlayer.a The fi rst variant of FakePlayer was identifi ed at the The vast majority of today’s mobile malware is designed beginning of August 2010. The trojan fi le, called to make illicit profi ts. This type of malware (particularly ‘RU.apk’, spreads disguised as a media player. The fi le is SMS trojans) is most widespread in Russia and certain CIS 12,927 bytes in size, and the installation package contains countries for one very simple reason: weak legislation in the following fi les: these countries makes it possible to rent short premium pay numbers anonymously.

Load more