Crimeware on the Net The “Behind the scenes” of the new web economy Iftach Ian Amit Director, Security Research – Finjan BlackHat Europe, Amsterdam 2008 Who Am I ? (iamit) • Iftach Ian Amit – In Hebrew it makes more sense… • Director Security Research @ Finjan • Various security consulting/integration gigs in the past – R&D – IT • A helping hand when needed… (IAF) 2 BlackHat Europe – Amsterdam 2008 Today’s Agenda • Terminology • Past vs. Present – 10,000 feet view • Business Impact • Key Characteristics – what does it look like? – Anti-Forensics techniques – Propagation methods • What is the motive (what are they looking for)? • Tying it all up – what does it look like when successful (video). • Anything in it for us to learn from? – Looking forward on extrusion testing methodologies 3 BlackHat Europe – Amsterdam 2008 Some Terminology • Crimeware – what we refer to most malware these days is actually crimeware – malware with specific goals for making $$$ for the attackers. • Attackers – not to be confused with malicious code writers, security researchers, hackers, crackers, etc… These guys are the Gordon Gecko‟s of the web security field. The buy low, and capitalize on the investment. • Smart (often mislead) guys write the crimeware and get paid to do so. 4 BlackHat Europe – Amsterdam 2008 How Do Cybercriminals Steal Business Data? Criminals’ activity in the cyberspace Federal Prosecutor: “Cybercrime Is Funding Organized Crime” 5 BlackHat Europe – Amsterdam 2008 The Business Impact Of Crimeware Criminals target sensitive business data using crimeware •Gain access to employee financial Employee information Data • Steal Identity information • Discover passwords Sophisticated • Steal financial statements and Organized Financial • Steal money through online accounts Data • Steal proprietary data Criminals • Gain customer record information • Brand damage •Access customer accounts Customer •Steal customer identities • Financial theft Data •Impair customer relationships • Data theft • Password theft • Identity theft • Compromised computers to steal resources • Employee productivity loss Federal Prosecutor: “Cybercrime Is Funding Organized Crime” 6 BlackHat Europe – Amsterdam 2008 The Business Impact Of Crimeware How much is business data worth to criminals? BlackHat Europe – Amsterdam 2008 Key Characteristics of Crimeware Financially motivated criminals are utilizing new methods to infect PCs with crimeware that steals sensitive data Propagation Methods Anti-Forensic Methods Hosted on compromised legitimate and Evade signature-based detection by Web 2.0 sites over the globe utilizing code obfuscation and controlled with frequent location changes exploits visibility in the wild URL and Reputation-based Anti-Virus signatures will not filtering solutions will not block match today‟s malicious code these sites 8 BlackHat Europe – Amsterdam 2008 Anti Forensics • Code Obfuscation – Not the one you are used to… • Single serve exploits – One per customer please • Geographical preference – More on this later when we talk $$$… 9 BlackHat Europe – Amsterdam 2008 Dynamic Code Obfuscation 10 BlackHat Europe – Amsterdam 2008 Dyn. Code Obf. – the neosploit way (2.0.15) BlackHat Europe – Amsterdam 2008 Obfuscation and IFRAMES • Have become in 2007 the main driving tools for distributing malware and malicious code in general. – They are even signatured by AV – while as we see the obfuscation or IFRAME itself may NOT be malicious… Source: top 10 web threats in 2007 http://www.sophos.com/pressoffice/news/articles/2008/01/toptendec07.html 12 BlackHat Europe – Amsterdam 2008 Crimeware Profile based Malware based - The Ghost In The Browser Analysis of Webof Browser AnalysisThe GhostInThe - Google Inc. Google Crimeware binaries and their URL locations are changing every hour 13 BlackHat Europe – Amsterdam 2008 Location, Location, Location index.php • Have you been to our fine //checks and saves user's IP hashed with browser //to avoid future browser's hangup establishment before? function CheckAddUser() { … – You can only get the $rcount=@mysql_num_rows($res); if ($rcount>0) { “good” stuff once… //found data, prevent view echo ":["; exit; } else { //not found, add $query = "INSERT INTO ".$dbstats."_users VALUES ('".$ipua."')"; mysql_query($query); • Where do you come } from? settings.php: $BlockDuplicates=1; //send exploits only once – You may not be worth $CountReferers=1; //make referrer's statistics $OnlyDefiniedCoutries=0; //send exploits only to the exposure… counties in the list $CoutryList="RU US UA"; //2-letter codes ONLY! (see readme for details) Source: Mpack 0.94 source code 14 BlackHat Europe – Amsterdam 2008 Crimeware Toolkits 15 BlackHat Europe – Amsterdam 2008 A glimpse into the code License_load: License_Verification: ... push edi push ebp push offset aNeosploit_key mov ebp, esp lea eax, [ebp+string] push edi • Modern toolkits are push eax push esi lea eax, [ebp+var_188] push ebx push eax sub esp, 38h provided in their binary call license_load mov ebx, [ebp+arg_0] add esp, 10h mov edi, [ebp+arg_8] form, with licensing test eax, eax push offset aServer_addr jz loc_8049918 call _getenv add esp, 0Ch mechanisms, built in mov [ebp+var_1C], eax ... push 100h ; size_t obfuscation, configuration call form_parse push 0 ; int lea edi, [ebp+var_38] push ebx ; void * xor eax, eax call _memset files, user management cld mov ecx, [ebp+var_1C] mov ecx, 7 add esp, 10h (for supporting multiple rep stosd xor edx, edx mov [esp+4E8h+var_4E8], 0 test ecx, ecx call _GeoIP_new jz short loc_804CC25 attackers under the same add esp, 10h test eax, eax kit), and DB functionality. mov ebx, eax online_test: ... mov [ebp+var_20], 1 sub esp, 8 push edx • The snippets here are push [ebp+timer] push 0 ; int push eax push ebx ; void * taken from a disassembly call _GeoIP_country_id_by_addr push [ebp+arg_4] ; int add esp, 10h call connect_to_homeserver cmp eax, 0FFh add esp, 10h of Neosploit version 2.0.15 jle loc_8049933 test eax, eax (first time analysis – in.cgi) jz short loc_804CDDE BlackHat Europe – Amsterdam 2008 Neosploit code ... call js_crypter_put mov [esp+4E8h+var_4E8], offset aStartquicktime call add_function push offset exp_superbuddy_is_decoded push 0D90FC7h loc_8049BE8: push 0CAh sub esp, 0Ch sub esp, 8 push offset exp_superbuddy push [ebp+timer] call decode_data push [ebp+var_7C] ; char * call get_ip_hash add esp, 18h push [ebp+var_54] ; int push 0 add esp, 10h call referer_validate push offset exp_superbuddy cmp eax, [ebp+var_468] call js_crypter_put add esp, 10h jnz loc_8049ABE mov [esp+4E8h+var_4E8], offset aStartsuperbudd test eax, eax call add_function jnz short loc_8049C07 push offset exp_audiofile_is_decoded push 0A1E716h push 145h push offset exp_audiofile call decode_data add esp, 18h push [ebp+var_84] push 0 push [ebp+var_2C] push offset exp_audiofile push offset a?o6PURU call js_crypter_put mov [esp+4E8h+var_4E8], offset aStartaudiofile lea ebx, [ebp+var_338] call add_function push ebx push offset exp_gom_is_decoded call _sprintf push 1F040Ah add esp, 0Ch push 0D9h push ebx push offset exp_gom push offset aData call decode_data add esp, 18h push offset exp_quicktime_opera push 0 push offset exp_gom call js_crypter_put sub esp, 8 mov [esp+4E8h+var_4E8], offset aStartgom call add_function push 0 push offset exp_wvf_is_decoded push [ebp+var_4AC] push 84C0B8h push 10Dh call js_crypter_put push offset exp_wvf mov eax, [ebp+var_4AC] call decode_data add esp, 10h add esp, 18h push 0 test eax, eax push offset exp_wvf call js_crypter_put mov [esp+4E8h+var_4E8], offset aStartwvf ... BlackHat Europe – Amsterdam 2008 Propagation techniques • How did THAT code turned out on THAT site – Anyone remember bankofindia.com? • Helpful HTML tags (infamous iframes…) • And of course, bling… $$$ 18 BlackHat Europe – Amsterdam 2008 On My Site? No way! 19 BlackHat Europe – Amsterdam 2008 Way… It’s all business • You can get paid to put a snippet of HTML on your site that will spur “installations” (= infections). Guaranteed high “install” rate, updated code (remember the toolkit), bypass of security measures… • “The number of legitimate Web sites compromised by attackers has surpassed those purposefully created by attackers” – Jan 22nd, Websense security labs. 20 BlackHat Europe – Amsterdam 2008 Evasive attacks – increasing the infection rates 21 BlackHat Europe – Amsterdam 2008 What’s the end game? • Holy grail of web attacks: successful installation of crimeware Trojan (aka – rootkit+keylogger+otherstuff) 22 BlackHat Europe – Amsterdam 2008 Local Crimeware Effect • Crimeware analysis showing a sampler of how financial crime is being performed. • Don‟t let your eyes off the ball… (the SSL icon?) 23 BlackHat Europe – Amsterdam 2008 Play-by-play… 24 BlackHat Europe – Amsterdam 2008 And in reality (movie)… [Crimeware video showing XXX-bank being targeted.] 25 BlackHat Europe – Amsterdam 2008 The last nail in the coffin of “trusted websites” • To conclude – the recent example of website exploitation to distribute crimeware: – Using all the techniques detailed in this talk – Single point of contact (no data is being pulled from external domains – all self hosted on the compromised webserver) – Still financially motivated – And to top it all – baffling the security community with how the attack took place to begin with to infect the hosting servers. • Now let‟s talk about a website‟s “reputation”… BlackHat Europe – Amsterdam 2008 Where are we going to? • Time for predictions: – We are starting to see criminals exploit (pun intended) the full potential of “web2.0” – Think