In our continuing commitment to the security research community, these vulnerabilities were disclosed to Microsoft through our participation in the Microsoft Active Protections Program (MAPP) program, which ensures the timely, responsible disclosure of new vulnerabilities and creation of protections from security vendors.
By proactively identifying these vulnerabilities, developing protections for our customers, and sharing them with Microsoft for patching, we are removing one weapon used by attackers to compromise enterprise and government networks.
Every vendor coming to market with a new security solution claims to provide better security, but none seems to solve the complexity created by multiple, independent point products that neither fully integrate nor work together in an automated way.
Combine that with enormous amounts of largely uncorrelated data – impossible to fully sift through, hampering response times — and you have operational gaps between where most organizations are and where they need to be.
Today, we’re announcing key updates to the Palo Alto Networks Security Platform intended to bridge these gaps, which we view as the following:
First, there’s the gap between when a security alert is received and when action is taken. Organizations are inundated with data, but the data deluge won’t help if they can’t easily determine what’s minor from what’s major. The Target breach is a perfect example: the company had the data it needed to take action but it was hidden in mountains of other information. According to a recent Ernst & Young study, 33 percent of all companies are not even aware of how long it takes their organization to organize a response to a threat.
A second gap is between what’s known and unknown. As the threat landscape grows increasingly complex, we are facing a growing number of unknown threats, and many security teams are struggling to keep pace. Discovering these threats quickly is crucial, but once discovered, security professionals also need to be able to quickly differentiate between the critical and the non-critical. The 2015 Verizon DBIR report found that 75 percent of all attacks spread from victim 0 to victim 1 within 24 hours. This is largely due to the slow detection rate of unknown threats.
A third gap is between the idea of security and the implementation of security to prevent breaches. Networks are growing fast and complexity is increasing. Many companies have huge numbers of policies, many of them outdated, because the complexity of provisioning and managing a security network simply has become too overwhelming. According to AlgoSec, 64 percent of all organizations are consumed with complex security policies, reducing the effectiveness of operations. Streamlining the management process is a priority in closing this gap.
With new enhancements to PAN-OS 7.0, the Palo Alto Networks Security Platform helps close these operational gaps. All security teams should be able to quickly identify and take preventative action on threats of all kinds in various stages of the attack lifecycle and across any network segment, and that’s what our platform achieves.
Here are some of the enhancements we’ve made in PAN-OS 7.0:
We are reducing response times from alert to action with visual and actionable data in the Application Command Center (ACC). Easy-to-use, interactive and customizable widgets enable customers to get to the bottom of an alert with just a few clicks.
We are closing the gap of the unknown to known through discovery, by introducing automated multi-version application analysis in WildFire. And with the addition of malware classification by threat level, teams can better prioritize their threat response for quick preventative action when needed.
Our new Automated Correlation Engine identifies and prevents compromised hosts in an organization’s network by correlating patterns to pinpoint malicious activity.
We are closing the gap from policy to implementation with new streamlined management capabilities within Panorama. Template stacking and device hierarchy groups allow for the creation of security policies and device configurations that can be easily and appropriately applied to many next-generation firewall instances, physical or virtual, reducing the chances for human error and gaps in the policy or configuration.
There are many more enhancements in this release which focus on closing these operational gaps and helping you improve operations and security throughout your network. Watch this space over the next few days as we look at these enhancements in details.
2011 was a watershed year for cyber attacks. RSA was hit in March, Lockheed Martin in May, and Lulzsec went on their rampage through Sony, Fox, PBS, Nintendo and even the CIA. It was also the year that the U.S. Government proposed a new approach to dealing with cyber threats that received little attention at the time, but has come to revolutionize how we tackle this problem today.
When we think about U.S. Government efforts in cybersecurity today, we often conflate these with ongoing efforts to reform the National Security Agency’s surveillance authorities. But we have long taken an approach to this problem that is more collaborative than confrontational. The Department of Homeland Security and MITRE’s 2011 Enabling Distributed Security in Cyberspace was the first official document to call for building an “ecosystem” in cybersecurity today. Rather than focus on the security of individual organizations, the proposed idea was that we should work as a community to address threats as they arose. By inoculating the community to these threats, we would only have to suffer the disease once before we all grew stronger.
DHS noted later that several principals defined achieving a secure ecosystem:
Understanding of IT risks,
Use of best practices,
Validated identities,
Interoperable technology, and
Machine-to-machine threat information sharing.
To be honest, these principals were fantasies in 2011. Risks were poorly understood as low-level defacement by groups such as Anonymous received the same attention as incidents like the RSA breach. Best practices were spread out over a range of competing technical standards that were meaningless to some industries and unpractical to others. Personal identifying information was scattered around every online vendor or cat video website you could visit. Security technology was a bolt-on model, not designed to intelligently manage itself or grow to new threats. And information sharing, not to mention machine-to-machine interaction, was largely done quietly in personal trust groups to stay out of the weary gaze of company lawyers who probably would not have approved.
I’d like to say that in 2015 the landscape is vastly different, but we have been too slow to achieve the vision of a secure cyber ecosystem. We have some of the principals in place here and there, but have yet to achieve the critical mass necessary to drain the swamp of low-level cyber threats and enable us to focus our energy on fighting the actual diseases.
Many of these goals, such as better understanding risks and following best practices, are finally getting some traction, but they require long-term cultural changes that will be realized over time. We can hope that one day, writing unsecure code will be as scorned as smoking at a daycare center, but today we have an opportunity to make big strides in interoperability and peer information sharing.
The “theory” goes like this. As Moore’s Law drives down the cost of computing power, cyber attacks will rise in number. And since the threat is asymmetric, an attacker only has to be right once to breach your system and cost you money, time and reputation. But automated technology that is natively integrated can change the economics of this fight.
Much of the cyber threat we face today is noise that can confound and distract human users. Automation helps clear away this noise and focuses humans on the most significant threats. Integrated systems that were built to work together can also be linked to information sharing repositories, like our WildFire Threat Intelligence Cloud. Large threat data sets makes them significantly more powerful as they learn to take action from attacks observed against other partners, building an almost biological response.
Beyond the new technology available to us today, our best chance of building this ecosystem is in the growing and enthusiastic response from members of commercial industries who are joining threat information sharing and analysis organizations. A recent Presidential Executive Order and guidance from the U.S. Department of Justice have given new life to these efforts. Even companies not in the security space, like Nike and Safeway, are joining together in groups like the Retail Cyber Intelligence Sharing Center. If we can link these trusted communities together to share cyber threat information in real time using standardized methods, the ability of everyone to detect and prevent cyberattacks strengthens exponentially. You can see an example of how Palo Alto Networks is proactively taking action by following the work we do sharing threat information with other major security vendors as part of the Cyber Threat Alliance.
The trust inherent in information sharing can be hard to earn, but we have to be willing to take action and drive collaboration when we can. Cultural changes required for the wide adoption of best practices and risk mitigation strategies will come slowly. However, we have an opportunity today to accelerate our ability to clear the weeds and strengthen our cyber ecosystem. By building bridges to increase information sharing and investing in the best technology available, we can keep humans focused on the endgame of, “a healthy, resilient – and fundamentally more secure – cyber ecosystem of the future.”[1] We have already waited long enough.
In recent months, our team has been tracking a keylogger malware family named KeyBase that has been in the wild since February 2015. The malware comes equipped with a variety of features and can be purchased for $50 directly from the author. It has been deployed in attacks against organizations across many industries and is predominantly delivered via phishing emails.
In total, Palo Alto Networks AutoFocus threat intelligence service identified 295 unique samples over roughly 1,500 unique sessions in the past four months. Attacks have primarily targeted the high tech, higher education, and retail industries.
Malware Distribution and Targets
KeyBase was first observed in mid-February of 2015. Shortly before then, the domain ‘keybase[.]in’, was registered as a homepage and online store for the KeyBase keylogger.
Domain Name:KEYBASE.IN
Created On:04-Feb-2015 08:27:44 UTC
Last Updated On:05-Apr-2015 19:20:38 UTC
Expiration Date:04-Feb-2016 08:27:44 UTC
This activity is in-line with an initial posting made by a user with the handle ‘Support™’ announcing KeyBase on the hackforums.net forum on February 7, 2015. In the forum post, the malware touts the following features:
Advanced Keylogger
Fully undetected scan-time and run-time (Later removed)
User-friendly web-panel
Unicode support
Password recovery
Figure 1. KeyBase posting on hackforums.net
Since February 2015, approximately 1,500 sessions carrying KeyBase have been captured by WildFire, as we can see below:
Figure 2. KeyBase timeline in AutoFocus
We can also quickly determine targeted industries using AutoFocus:
Figure 3. Targeted industries in AutoFocus
The targeted companies span the globe and are located in many countries.
Figure 4. Targeted countries in AutoFocus
This malware is primarily delivered via phishing emails using common lures. Some examples of attachment filenames can be seen below:
Purchase Order.exe
New Order.exe
Document 27895.scr
Payment document.exe
PO #7478.exe
Overdue Invoices.exe
One such example of an email delivering KeyBase can be seen below.
Figure 5. KeyBase phishing email
Overall, Unit 42 has seen a large number of separate campaigns using KeyBase. As the software can be easily purchased by anyone, this comes as no surprise. As we can see in the following diagram, around 50 different command and control (C2) servers have been identified with up to as many as 50 unique samples connecting to a single C2.
Figure 6. KeyBase campaign diagram
Malware Overview
KeyBase itself is written in C# using the .NET Framework. These facts allowed us to decompile the underlying code and identify key functionality and characteristics of the keylogger.
Figure 7. KeyBase logo
Functionality in KeyBase includes the following:
Display a website on startup
Screenshots
Download/Execute
Persistence
Kill Timer
When the malware is initially executed, a series of threads are spawned.
Figure 8. KeyBase main function
The various functions spawned in new threads may be inert based on options specified by the attacker during the build. Should a feature not be enabled, a function looks similar to the following:
Figure 9. Inert functions in KeyBase
Figure 10. KeyBase builder
The author makes use of a number of simple obfuscation techniques on various strings used within the code. Examples of this include replacing single characters that have been added to strings, as well as performing reverse operations on strings.
Figure 11. String obfuscation using replace
Figure 12. String obfuscation using reverse
Additionally, the author makes use of an ‘Encryption’ class. This class is used to decrypt a number of strings found within the code.
Figure 13. KeyBase Encryption class
References to this decompiled code were discovered in an old posting on hackforums.net, where the user ‘Ethereal’ provided sample code.
Figure 14. Encryption code posting on hackforums.net
We see the ‘DecryptText’ function used by the author when he/she dynamically loads a number of Microsoft Windows APIs.
Figure 15. Obfuscated API functions in KeyBase
The following Python code can be used to decrypt these strings.
Persistence in KeyBase, should it be enabled, is achieved using two techniques—copying the malware to the startup folder or setting the Run registry key to autorun on startup. When KeyBase copies itself to the startup folder, it names itself ‘Important.exe.’ This is statically set by the author and cannot be changed by the user in the current version. The key used in the following Run registry key is set by the user, and is always a 32 byte hexadecimal value.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run [32 byte key] : [Path to Executable]
Keylogging
Keylogging in KeyBase is primarily accomplished in a separate class appropriately named ‘KeyHook.’ While the class shares a name with a publicly available repository on github, the class appears to be custom written. While custom, the class itself uses a very common technique of using the Microsoft Windows SetWindowsHookExA in order to hook the victim’s keyboard.
Figure 16. Hooking keyboard via SetWindowsHookExA
The author proceeds to handle appropriate keyboard events as expected.
Figure 17. Handling keyboard events
The class also has the ability to handle Unicode characters, as well as get the name of the foreground window. This allows the malware to not only identify what keys are being pressed, but what application said key presses are being sent to.
Command and Control (C2)
All communication with a remote server takes place via HTTP. Data is not encrypted or obfuscated in any way. Upon initial execution, KeyBase will perform an initial check-in to the remote server, as we can see below.
Figure 18. Initial KeyBase notification HTTP GET request
A number of HTTP headers are not included with the request. This provides a simple technique for flagging the activity as malicious. It is also important to note that it is fairly elementary to detect the activity using the hardcoded GET variables included in the request. While the victim machine name and the current time will vary, the remainder of the request will remain static.
KeyBase may also send the following data back to its C2 server:
Keystrokes
Clipboard
Screenshots
Examples of this data can be seen below.
Figure 19. KeyBase uploading clipboard data
Figure 20. KeyBase uploading keystroke data
During this communication with its C2 server, KeyBase will include the raw clipboard and keystroke log data using various GET parameters. This data is URI-encoded, but otherwise sent in the clear.
Finally, Keybase will also use a specific URI to upload screenshots. The path ‘/image/upload.php’ is hardcoded within the malware. All images sent back to its C2 server will be placed within the ‘/image/Images/’ path. Uploaded data is once again sent unencrypted, as we can see below.
Figure 21. KeyBase uploading screenshot image
Web Panel
The web panel itself does not provide any innovative characteristics. It uses a simple red/grey color scheme as seen below.
Figure 22. KeyBase web panel
The panel does allow the attacker to quickly view infected machines, keystrokes, screenshots, clipboard data, and password data. Unfortunately, the author of KeyBase does not make use of pagination, which results in poor performance in the event a large amount of data is being displayed to the attacker.
Interesting Discoveries
During the course of our research, Unit 42 discovered that no authentication was required when viewing the ‘/image/Images/’ path. One C2 server in particular stood out because it appeared the operator was testing KeyBase on his/her local machine. As such, screenshots of his machine were uploaded to his server and could be viewed by the general public. In the screenshot below, we can clearly see the ‘KeyBase v1.0’ folder. This folder almost certainly contains the KeyBase installation. While viewing the operator’s desktop, we can also see a number of other keyloggers, such as ‘HawkEye Keylogger’ and ‘Knight Logger’. Also of note is a popular crypter named ‘AegisCrypter’. Finally, we can also see that the user engages in piracy, as copies of both ‘The Hobbit’ and ‘Fury’ appear on the desktop as well.
Figure 23. KeyBase operator desktop screenshot
While continuing to examine the uploaded images, we also identify the user logging into a Windows Web Server 2008 R2 instance via remote desktop. This appears to be where the attacker is launching their spam campaigns using an instance of ‘Turbo-Mailer 2.7.10’. Unfortunately, it appears the operator had forgotten his/her username/password at this particular moment.
Further examination of the uploaded screenshots shows activity of the user logging into his/her Facebook account. The user looks to be named ‘China Onyeali’ and is observed discussing some of his/her latest endeavors. Specifically, we see a link to a .rar file hosted on rghost[.]net containing the following file. We also see the operator discussing the HawkEye keylogger in another chat window. The operator’s Facebook page claims that he/she lives in Mbieri, Nigeria. We previously reported on Nigerian actors using off-the-shelf tools to attack business in our 419 Evolution report last July. This user has been reported to the Facebook security team.
Figure 25. KeyBase operator logged into Facebook
Further Interesting Discoveries
Other interesting discoveries were made while researching the backend C2 code. In particular, the upload.php file was examined and analyzed, as this file handles file uploads to the server. As we can see, there is no validation for the types of files uploaded to the remote server.
Figure 26. KeyBase screenshot upload PHP script
This poses an issue from a security perspective, as a third party can simply upload a PHP script to the ‘/image/Images/’ directory to gain unauthorized access. The following PHP code can be used to read the KeyBase ‘config.php’ script, which contains the username and password for the web panel.
1
2
3
4
5
6
7
8
9
10
<?php
$file=‘../../config.php’;
echo“It works!”.“</br>”;
if(file_exists($file)){
echo“Reading file”.“</br>”;
echofile_get_contents($file);
}
?>
Additionally, the following Python code can be used to upload this file and read the results.
Overall, this KeyBase malware is quite unsophisticated. It lacks a number of features available in some of the more popular malware families, and the C2 web panel contains security vulnerabilities that could allow a third party to gain unauthorized access. The builder for KeyBase provides an easy-to-use, user-friendly interface; however, a number of options are hardcoded into the malware itself. Some examples include the filename KeyBase uses when it is copied to maintain persistence, and various URI paths it uses during the command and control phase.
While this malware has some issues with sophistication, Unit 42 has observed a significant and continued rise in usage by attackers, generally targeting the high tech, higher education, and retail industries. Palo Alto Networks customers are protected via WildFire, which is able to detect KeyBase as malicious. Readers may also use the indicators provided to deploy protections.
For a list of sample hashes and their associated domains and IP addresses, please see the following link.
I’m excited to announce the acquisition of CirroSecure and with it the expansion of our platform’s ability to safely enable the applications that form the backbone of today’s businesses.
Increasingly organizations are turning to SaaS applications such as Box, Dropbox, or salesforce.com that are highly collaborative in nature, yet often store some of an organization’s most sensitive data. Securing these sanctioned applications requires a new level of visibility and control that, up to this point, hasn’t existed within the industry. Ultimately organizations must have the ability to peer deep into the application, tracking usage at a granular enough level to allow for more effective control. This control must allow for better management of access privileges and data sharing, from both corporate and personal devices.
The addition of the CirroSecure technology to the Palo Alto Networks Enterprise Security Platform provides organizations with this necessary functionality by extending visibility down to the individual file, folder and user that’s operating within the SaaS application. The CirroSecure technology then applies deep analytics into the day-to-day usage in order to quickly determine if there are any DLP or compliance-related policy violations. Then, through use of granular context-aware policies, violations can trigger an immediate response such as the quarantine of a user or data. This complete visibility, coupled with granular policy controls, moves organizations from a position of speculation to one of knowing exactly what’s happening to its sensitive SaaS application data at any given point in time, while automatically responding to contain or eliminate risks.
This innovative technology will be available the second half of 2015 via a new Palo Alto Networks service. Over the course of the next few months we’ll share more detail with regards to future strategy, product features, and demonstrations. If you’d like these periodic updates, make sure to visit our announcement page at go.paloaltonetworks.com/saassecurity and sign up for automated updates.
