Blog

On May 6 and May 11, 2015, Unit 42 observed two targeted attacks, the first against the U.S. government and the second on a European media company. Threat actors delivered the same document via spear-phishing emails to both organizations. The actors weaponized the delivery document to install a variant of the ‘9002’ Trojan called ‘3102’ that heavily relies on plugins to provide functionality needed by the actors to carry out on their objectives.

The 3102 payload used in this attack also appears to be related to the Evilgrab payload delivered in the watering hole attack hosted on the President of Myanmar’s website in May 2015.  Additionally, we uncovered ties between the C2 infrastructure and individuals in China active in online hacking forums that claim to work in Trojan development.

Palo Alto Networks WildFire detected the payload delivered in these spear-phishing attacks as malicious, and the payload was also tagged in Palo Alto Networks AutoFocus as 9002.

Delivery Document

The delivery document attached to the two spear-phishing attacks was an Excel document that exploits CVE-2012-0158, specifically exploiting a vulnerability in the MSComctlLib.TreeView ActiveX control. The malicious Excel document had a filename of電郵名單.xls, which translates from Chinese to “email list.xls”. Upon successful exploitation, the malicious Excel document installs a payload and opens a decoy document. The decoy document displays a list of names and email addresses of individuals allegedly associated with the Hong Kong Professional Teachers’ Union.

9002 Trojan: 3102 Variant

The threat actors weaponized the malicious Excel spreadsheet to extract and execute an initial payload, which is a dropper with a filename DW20.dll that we track as DoWork. This DoWork variant writes a second sample to the %TEMP% folder with a temporary filename and executes it.

Figure 1. Malware Execution Flow

The second payload extracts shellcode from a resource named “RES” and decrypts it by subjecting the resource to the RC4 algorithm twice, first using a key of “Oq9n01Ca9g” and then using the key “12345678”.  The shellcode then installs the actual payload of this attack by saving the 3102 payload to “C:\Program Files\Common Files\ODBC\Mshype.dll” and adding persistence via a registry key “HKCU\Software\TransPan\RunPath”. The second payload is also responsible for writing the 3102 Trojan’s 504-byte configuration to the registry, specifically in the key “HKCU\Software\TransPan\mshtm”.

The actors use a clever anti-analysis trick that stores the configuration in the registry, as the 3102 sample does not contain the configuration itself and relies on the second payload mentioned above to be operational. The second payload deletes itself from the system after it executes, suggesting that the malware authors added the configuration saving functionality in the second payload to thwart researchers seeking to extract C2 information from the 3102 sample itself.

The functional payload uses the string “3102” as the first four-byes of its network communications with its C2 server, which is the basis for the name ‘3102’. In May 2014,Cylance published an article on a targeted attack against a Chinese national that delivered the 3102 variant of 9002. When comparing the attacks, we found the following commonalities:

1. Same Mshype.dll filename and file system path for the payload.
2. Mshype.dll is signed using the same digital certificate belonging to A’digm, Inc.
3. Same registry key for persistence: HKCU\Software\TransPan\RunPath: “rundll32.exe “C:\Program Files\Common Files\ODBC\Mshype.dll”,Process32First”
4. Saves its configuration to the same registry key: HKCU\Software\TransPan\mshtm
5. Uses the same key logging plugin.
6. Shares common C2 communication protocols.

While similarities exist to the payload discussed in Cylance’s article, it is worth exploring some specific attributes and behaviors of the 3102 payload used in the May 2015 attacks on the U.S. government and the European media organization to gain a better understanding of the treat actors involved.

This 3102 payload saves the configuration seen in Figure 2 to the registry. The C2 domain “ericgoodman.serveblog[.]net” exists within this configuration; however, the configuration also contains the domain “fordnsdynamic.no-ip[.]org” that does not appear to be used anywhere within the Trojan’s code.

Figure 2. 3102 Configuration Saved to the Registry

The Trojan also contains several debug messages that reference the domain “www.aestheticismwoods[.]com”, which is a C2 domain referenced in the Cylance article. This 3102 sample never communicates with this domain, suggesting that the malware author did not remove debugging messages introduced in previous samples of 3102 when compiling the particular sample used in these attacks. The unnecessary inclusion of these two domains suggests that the author of this 3102 sample is rather sloppy with code changes and lacks a sense of operational security.

C2 Communication

To interact with compromised systems, the actors rely on the 3102 Trojan to communicate with its C2 server using one of two different communication methods.  The Trojan’s primary method involves using a custom protocol that has a static string of “3102” as the first four bytes of each transmission and uses LZO to compress its data. Each transmission contains the size of the LZO compressed data immediately after the “3102” string, followed by the length of the decompressed data, and finally the compressed data itself. Figure 3 shows a sample of the custom protocol beacon sent from the 3102 variant and the response received from its C2 server.

Figure 3. Custom Protocol Used by 3102 to Communicate with C2 server

The second method 3102 used for C2 communications employs basic HTTP POST requests. Figure 4 shows an example HTTP request sent from the 3102 Trojan to its C2 server. The URL within the POST request is a hexadecimal value that increments with each request. The content in the HTTP POST, specifically the “AA” string, the content-length of 2 and the user-agent of “lynx” are hardcoded into the 3102 Trojan.

Figure 4. HTTP POST Request Created by 3102

Once communications are established between the 3102 Trojan and its C2 server, the threat actors can interact with the compromised system and act on their objectives.

Capabilities and Plugins

The 3102 Trojan by itself does not contain much in the form of functional capabilities; rather, it is a modular Trojan that requires external plugins to provide capabilities. Therefore, the threat actors must provide plugins in the form of dynamic link libraries (DLL) that the Trojan will load manually. The author of 3102 chose to manually load the libraries in an attempt to evade antivirus engines that scan libraries loaded using the conventional LoadLibraryA and LoadLibraryW API functions.

During these two attacks, the actors used two different methods to load plugins in the 3102 Trojan. A third method existed in the code base, but was unused. We will discuss the three loading techniques and the plugins that the actors loaded onto compromised systems.

Embedded Plugins

3102 can load embedded plugins by manually loading a DLL that exists within the Trojan without saving the plugin to the file system. The sample used in the attacks described in this article contained only one plugin with the filename of “KeyLogger.dll.” We obtained the filename “KeyLogger.dll” from the ‘OriginalFilename’ field in the VERSIONINFO resource of the DLL. As this filename suggests, this plugin provides key logging functionality for the 3102 Trojan by monitoring keystrokes and logging them to a file named “temp_k.ax”. The keylogger also encrypts the logged keystrokes saved to temp_k.ax by using an XOR algorithm with 0x56 as the key.

Plugins over the Wire

3102 can also load plugins provided directly from the C2 server. This method manually loads a DLL from the network communications without saving the DLL to the disk, making it difficult for antivirus products to detect its malicious functionality. After manually loading the plugins, 3102 will run the plugin by calling the function “CreatePluginObj” within the plugin’s export address table (EAT).

During analysis of the attacks, we observed the threat actor sending three different plugins to the 3102 Trojan from the C2 server. The 3102 Trojan loaded these plugins, which allowed the actor to use the added functionality to interact with the compromised system. The plugins are not saved to disk, so we extracted and decompressed each plugin from a packet capture and obtained their filenames from the ‘OriginalFilename’ field in the VERSIONINFO resource of the DLL.

The first plugin has a filename of “DownFileS.dll” and enables 3102 to carry out file system activities, such as reading, writing and searching for files, as well as enumerating storage devices and volumes. The second plugin is called “FileManagerS.dll” and has a great deal of functionality overlap with the DownFileS.dll plugin, but it contains the added ability to remove folders and execute files. The third and final plugin provided by the C2 server is called “ScreenSpyS.dll” and allows for screen capture and allows the operator to interact with the system by sending key strokes, mouse movements and mouse clicks.

Plugins from the File System

Lastly, 3102 can manually load plugins directly from a file named “temp_plugin.ax”. This plugin loading method allows the Trojan to save plugins to disk so they persist system reboots. The “temp_plugin.ax” file can contain multiple plugins, as 3102 will read the entire temp_plugin.ax file and parse its contents for plugins stored in the following structure:

Offset	Description
0-1	Single byte XOR key
4-8	Length of cipher text
8	Filename of plugin in unicode
528	Beginning of cipher text

We did not observe the threat actors using this method in this attack; however, it is possible that the threat actors could use the “DownFileS.dll” or “FileManagerS.dll” plugins obtained from the C2 to install plugins that use this loading method.

Connection to Watering Hole Attack and Chinese Threat Actors

As previously mentioned, the malware author signed the 3102 sample delivered in the attacks discussed in this article using a digital certificate issued to A’digm, Inc. The same digital certificate was used to sign a separate 9002 malware sample, which also shared the C2 domain  “dns.mailpseonfz[.]com” with a second 9002 sample that was not signed with the A’digm Inc. certificate. The unsigned 9002 sample was also configured to use the domain “dns.websecexp[.]com” as an additional C2 server. This domain was the C2 server used by the Evilgrab payload delivered in the watering hole attack on the President of Myanmar’s websitethat we discussed in a blog post on June 11, 2015. Figure 5 shows the relationship between the spear-phishing and watering hole attacks.

Figure 5. Link Between Samples Signed by A’digm, Inc Certificate and the Watering Hole on President of Myanmar’s Website

While it should be noted that dissimilar groups can sign their Trojans using the same digital certificate, we believe that the same threat group is likely involved with both the spear-phishing attacks discussed in this article and the watering hole attacks hosted on the President of Myanmar’s website. We believe this as it appears that a common malware author may be involved because the compile times for the 3102 sample (2014-02-28 07:40:37 UTC) and 9002 sample signed by A’digm, Inc. (2014-02-28 08:07:48 UTC) were less than a half hour from each other.

Additionally, we have not found many other malware samples signed with this certificate, indicating it is not in widespread use.

While researching the mailpseonfz[.]com and websecexp[.]com domains that created the correlation between the watering hole and spear-phishing attacks, we noticed that these two domains had historic registrant email addresses that were also used in online forums, primarily in Chinese, discussing hacking, Trojan development, and website defacements. The domain websecexp[.]com was originally registered in 2013 with the email ‘bychinahacker@gmail.com’.  It has since been updated, but the domain has been actor controlled the entire time. Research on this email shows it has been tied to multiple website defacements and is also used a contact email within multiple Chinese hacking forums as well as for a company located in Guangzhou.

Figure 6. Screenshot of one of the website defacements.

For a brief period in late 2011 and early 2012, the registrant email for mailpseonfz[.]com was ‘bubai2012@163[.]com’.  The domain was under actor control the entire time, but currently has the registrant information hidden using a registrant protection service. When researching the registrant email we found ties to a Chinese forum advertising for a Software Security Engineer position in Shanghai in 2007. One responder requested to be contacted at that email address and said he or she worked in “Trojan testing.”

Conclusion

Unit 42 detected a cyber espionage group attacking the U.S. government and a European media organization within days of each other using a spear-phishing attack to deliver a variant of the 9002 Trojan called 3102. During the attack, the threat actor provided the 3102 Trojan with three plugins, which allowed the actors to interact with a compromised system’s file system, log keystrokes and perform screen-capturing activities.

The threat actors signed the 3102 payload with a digital certificate that was also used to sign a 9002 sample that has ties to the Evilgrab payload delivered by the watering hole hosted on the President of Myanmar’s website. Because that certificate doesn’t seem to be in widespread use and the samples were compiled within thirty minutes of each other, we believe the same threat group conducted both of these attacks. The threat group uses both spear-phishing and watering hole attack vectors, along with different families of malware to target individuals and groups of interest. However, while they use different attack vectors and malware, this threat group also seems to reuse significant portions of their infrastructure between attacks, which aides in detection and proactive mitigation.

Research on registrant information used to set up infrastructure for these attacks led to ties within the hacking community in China, indicating the threat group behind this activity is likely Chinese-based. Interestingly, the tie to a private Chinese company further indicates they are likely being hired as contractors, in contrast to threat groups like APT1 that are associated with the Chinese military.

The files used in this attack are properly classified as malicious by WildFire. Users of Palo Alto Networks Traps advanced endpoint protection are protected from exploitation of the CVE-2012-0158 vulnerability if they have not been able to patch their systems.  AutoFocus users can find more information on samples and indicators related to this attack by viewing the 9002 tag.

Files

Filename	SHA256
電郵名單.xls	6ec4ec93409227e225d1d9fcf23ac3b73bbcf534e38628ca51e161efa1239f29
DW20.dll	dd7bb7544d27114a3ac7c95302c215c1bbd4ddf7bcd8c5fdc3df1c9935c60359
%TEMP%\<temporary filename>.tmp	6f1b5f73bf33112737418b52b2f2de4e10747d979789531f8992691dda6a0dbb
Mshype.dll	4a4f4a1a0db0d8b169c214d495049dc7bc1a55d011c0db3ad2aea0e2587afab6

3102 Plugins

Filename	SHA256
KeyLogger.dll	2656335c9faf75a29d47002f3a54c503cbeee419fa841de0d8f9a3d4dee19c89
DownFileS.dll	bcba4361ba4d0344bb0ed1080fa2fcd3dbdf7e1e91b4d1c85ff8e7091de24ef7
FileManagerS.dll	7db917f8fdd62f321e7547d9bea572670051c44080b1df91f69fad9894fd4fff
ScreenSpyS.dll	084f01caf66abfd1f0f3669edfba9e07ea0b436820180d2af066d91642a79794

Indicators

Type	Value
Mutex	DATA_RUN_MYWAY
Certificate	A’digm, Inc.
Domain	ericgoodman.serveblog[.]net
Registry Key	HKCU\Software\TransPan\mshtm
Registry Key	HKCU\Software\TransPan\RunPath
Domain	dns.websecexp[.]com
Domain	dns.mailpseonfz[.]com
Registrant Email	bychinahacker@gmail[.]com
Registrant Email	bubai2012@163[.]com
Filename	temp_k.ax
Filename	temp_plugin.ax

Robert Falcone and Jen Miller-Osborn

[Palo Alto Networks Blog]

The terrifying remote hack of a Jeep on the highway, as reported by Andy Greenberg in Wiredmagazine , seemingly validates the pervasive, yet vague, fears that many consumers have about the digitalization of our everyday lives. Charlie Miller and Chris Valasek’s demonstration of their ability to control the car’s motor management system, remotely cut the brakes or disable the accelerator, and in certain circumstances, turn the steering wheel, all served as a reality check as to what the future of the Internet of Things might hold.

Additionally, the car hack enables surveillance. Currently, the GPS coordinates of a targeted car can be tracked, its speed measured and its route followed. It is not hard to imagine geolocation and other personal information (e.g., contacts from the dashboard) combined with physical hacks to further increase the threat to drivers.

Hackable Cars
While the 2014 Jeep Cherokee was the focus of this particular attack (apparently accomplished by using relatively inexpensive off-the-shelf components connected to a laptop and broadcasting the malicious data), all cars connected to the Internet are vulnerable to varying degrees. Those models with the most computerized functions, and the fewest networks used are the most hackable. For example, if a car’s engine, braking systems , Bluetooth, telematics and radio functions all run on the same network, it can make it easier for an attacker to gain control of the car’s computerized physical operations .

As Miller notes in the Wired article, “When you lose faith that a car will do what you tell it to do, it really changes your whole view of how the thing works.”

As a result of this hack, FIAT/Chrysler issued a recall for 1.4 million cars for a software update. The upgrade must be manually loaded at a car dealer, and cannot be remotely distributed over the Internet.

Physical versus Informational Hacks
While physical security in a hacked car is the predominant issue that comes to mind for clear reasons of immediate potential danger, hackers can also obtain tremendous amounts of data about the car and the driver’s driving style, speed, and locations. This pervasive data collection is likely to be more valuable to hackers in the longer term. As opposed to a hack over the car controls, which may become immediately obvious to the car’s occupants, a data hack may go unnoticed (for years).

Greenberg uses as an example the ability to track vehicle location and destination searches enabled through a car hack, which points to the level of informational detail that may be obtained by hackers. Building up a database from this information allows hackers to determine where a person lives, works, worships and shops. Over time, they can build an understanding of a network of family and friends; and even predict where the driver will go. Other information that can be obtained from a connected car includes biometric data, telephone calls and browsing history.

The legal landscape
In response to growing evidence that vehicle manufacturers are not prepared to protect the networks they increasingly rely on, with potentially fatal consequences for consumers, regulators are evaluating the protections provided by the legal landscape:

• US Senators have introduced the Security and Privacy in Your Car Act of 2015 , which would require the development of privacy and security standards by relevant government agencies.
• In the EU, there are currently no initiatives to pass laws specific to the connected car. Instead, the applicable laws are understood to be the EU Data Protection Directive (soon Regulation) and Telecom Laws. These laws will need to be interpreted in relation to connected cars—for example, assessing whether there should be restrictions on vehicle-to-vehicle data transfer. Recently the Article 29 Working Group, which is composed of EU national Data Protection Authorities, issued an opinion on the Internet of Things, including a reference to connected cars and privacy.

To demonstrate to governments that new regulations are not necessary, car companies are developing industry standards. Two trade groups, the Association of Global Automakers and the Alliance of Automobile Manufacturers, have agreed to a set of privacy-enhancing principles effective in model year 2017.

Whether developing new laws, interpreting existing ones, or relying on industry standards, one thing is clear: customers must be able to trust their connected cars, or the “drivable smartphone” of the future is not going to go very far.

Sarah Pipes, CIPP, CIPT
Senior Advisor and Data Protection Specialist, KPMG in Belgium

Sarah will speak at the 2015 ISACA EuroCACS/ISRM Conference on Privacy Challenges in the Internet of Things, with co-presenter Ronald Koorn, Partner, KPMG in The Netherlands.

[ISACA Now Blog]

  

Date : 7 Sep 2015

Organisation : (ISC)²

Writer : Chuan-Wei Hoo

 

According to the 2015 (ISC)² Global Information Security Workforce Study, 62 percent of nearly 14,000 respondents believe that their organizations have too few information security professionals. Signs of strain within security operations due to the workforce shortage are materializing while companies and organizations are increasingly struggling to manage threats, avoid errors and are taking longer to recover from cyberattacks. The strategies of investing in security technologies, personnel and outsourcing will be insufficient to materially reduce the workforce shortage instantly. An expansion of security awareness and accountability throughout the organization is required. A more impactful approach is to embed real security accountability into other departments; and for the IT and security departments to function more collaboratively. Solving the problem will not just require the orchestration of information security leaders, but all cyber-enabled organizations to elevate the level of importance and ownership of security amongst all employees. Here are some key security essentials that everyone at a business operations should observe.

1. Asset Security — protect the company jewels
Every company has information that it considers to be crown jewels. Perhaps it’s scientific and technical data or documents regarding possible mergers and acquisitions, or clients’ non-public financial information. This is why we must address the policies and processes around the collection, handling and protection of information throughout its lifecycle. Each enterprise should carry out an inventory, with the critical data getting special treatment. Each priority item should be guarded, tracked and encrypted as if the company’s survival hinged on it. In some cases, it may. The concepts, principles, structures and standards used to monitor and secure assets is crucial to the enforcement of various levels of confidentiality, integrity and availability.

2. Security and Risk Management — build a risk-aware culture
The idea is elementary. Every person within an organization can infect it; whether it’s from clicking a dubious attachment or failing to install a security patch on a smart phone. So the effort to create a secure enterprise must include everyone. Building a risk-aware culture involves setting out the risks and goals, and then spreading the word throughout the entire company. But the important change is cultural. Think of the knee-jerk reaction — the horror — that many experience if they see a parent yammering on a cell phone while a child runs into the street. The information security leaders who try to nurture risk-aware cultures should have a broad spectrum understanding of general information security and risk management topics, beginning with the fundamental security principles of confidentiality, availability and integrity.

3. Software Development Security — embed security in design
Imagine if the auto companies manufactured their cars without seat belts or airbags, and then added them later, following scares or accidents. It would be both senseless and outrageously expensive. Similarly, one of the biggest vulnerabilities in information systems — and wastes of money — comes from implementing services first, and then adding security on as an afterthought. The only solution is to build in security from beginning, and to carry out regular automated tests to track compliance. This also saves money. If it costs an extra $60 to build a security feature into an application, it may cost up to 100 times as much — $6,000 — to add it later.

4. Communication and Network Security — establish secure communication channels
Consider urban crime. Policing would be far easier if every vehicle in a city carried a unique radio tag and traveled only along a handful of thoroughfares, each of them lined with sensors. The same is true of data. Companies that channel registered data through monitored access points will have a far easier time spotting and isolating malware. Cybercriminals are constantly probing for weaknesses. Each work station, laptop or smart phone provides a potential opening for malicious attacks. The settings on each device must not be left up to individuals or autonomous groups. They must all be subject to centralized management and enforcement. And the streams of data within an enterprise have to be classified, each one with its own risk profile and routed solely to its circle of users. Securing the workforce means vanquishing chaos and replacing it with confidence.

5. Identity and Access Management — track who’s who
Say a contractor gets hired full time. Six months pass and he/she gets a promotion. A year later, a competitor swoops in and hires him/her. How does the system treat that person over time? It must first give him/her limited access to data, then open more doors before finally cutting him/her off. This is managing the identity lifecycle. It’s vital. Companies that mismanage it are operating in the dark and could be vulnerable to intrusions. This risk can be addressed by implementing meticulous systems to identify the people, manage their permissions and revoke them as soon as they depart.

6. Security Assessment and Testing — patrol the neighborhood
Say a contractor needs access to the system. How do you make sure he/she has the right passwords? Leave them on a notepad? Send them on a text message? Such improvisation has risk. An enterprise’s culture of security must extend beyond company walls to establish best practices among its contractors and suppliers. This is a similar process to the drive for quality control a generation ago. And the logic is the same: Security, like excellence, should be infused in the entire ecosystem. The ruinous effects of carelessness in one company can convulse entire sectors of society.

7. Security Operations — manage incidents and respond
Say that two similar security incidents take place: One in Brazil, the other in Pittsburgh. They may be related. But without the security intelligence needed to link them, an important pattern — one that could indicate a potential incident — may go unnoticed. A company-wide effort to implement intelligent analytics and automated response capabilities is essential. Creating an automated and unified system will enable an enterprise to monitor its operations — and respond quickly.

8. Security Engineering — access and mitigate vulnerabilities
It happens all the time. People stick with old software programs because they know them, and they’re comfortable. But managing updates on a hodgepodge of software can be next to impossible. Additionally, software companies sometimes stop making patches for old programs. Cyber criminals know this all too well. In a secure system, administrators can keep track of every program that’s running, be confident that it’s current, and have a comprehensive system in place to install updates and patches as they’re released. Balance managing risk and enabling innovation. The administrator and/or security leaders should know the practice of building information systems and related architecture that continue to deliver the required functionality in the face of threats that may be caused by malicious acts, human error, hardware failure and natural disasters.

To download a copy of 2015 (ISC)² Global Information Security Workforce Study, please go to www.isc2cares.org/IndustryResearch/GISWS/

[Cyber Security Information Portal]