SWIFT E-mail Leads To Evasive Gootkit

SWIFT E-mail Leads To Evasive Gootkit

No Comments

 

We follow the trail of another spam e-mail. It’s delivering a malware downloader that’s 0/63 on Virustotal, not unheard of these days. The e-mail had a PDF attachment SWIFT-MT103.pdf which itself was innocuous and simply displayed a fuzzy scan image, purportedly a SWIFT request that linked to a file hosted on Box.com.

Tactics of the downloader/dropper:

Contains functionality for read data from the clipboard
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Detected TCP or UDP traffic on non-standard ports
Sample file is different than original file name gathered from version info
Internet Provider seen in connection with other malware
Icon mismatch, PE includes an icon from a different legit application
Reads the hosts file

…and many other warning signs shown by the software in deeper debugging in included in the report.

Received: from vps39646.inmotionhosting.com (vps39646.inmotionhosting.com
(envelope-from <[email protected]>)

Reply-To: <[email protected]>
Date: Tue, 12 Jun 2018 01:42:52 +0000

A copy of the original e-mail received to a honeypot spam account:

Download the attached PDF, and examine it finding a link:

SWIFT MT103 PDF from E-mail 

 

Download the file from a box.com link, and unzip the contents:

hxxps://cambridgecommodities.box.com/shared/static/4yr4v2uaa43835jqi0lawo204oydj2d0.zip

Analysis on the dropper downloaded from this link:

SWIFT MT103 Joe Sandbox Report

or directly from Joe Sandbox if you don’t trust my PDF.

 

 

 

Dexter Malware attacks POS

POS Malware Dexter

Dexter Malware attacks POS

Dexter Malware (POS Systems Attack)

 

In an article titled “Dexter – Draining blood out of Point of Sales” an Israel-based security firm Seculert has identified Malware programmed to attack POS systems. The targeting of POS systems appears to help attackers extract card data from aggregation points versus targeting end-user machines or physically installing a skimmer.

Dexter has reportedly targeted systems in 40 countries over the past 2-3 months.

According to Spiderlabs, a team of ethical hackers working for security-software analysis firm Trustwave, Dexter has an unusual nature. Spiderlabs blogger Josh Grunzweig noted: “I can’t remember the last time I saw a piece of malware that targeted Point of Sale systems that had a nice C&C structure to it.”

Bank Fraud had evolved to a billion dollar industry world wide and Dexter is just another example of how attackers are choosing the targets with the most lucrative cyber bounty.

The New Reality of Stealth Crimeware

The New Reality of Stealth Crimeware

No Comments

Anyone who has been in information security recently knows that it has gotten easier for cybercriminals to build stealth crimeware. The malware we deal with on a regular basis grows ever more difficult to find, while high-end targeted attacks such as Stuxnet and other advanced persistent threats (APTs, the abbreviation I hate) are using ever more advanced rootkit techniques to avoid detection.

Cybercriminals use clever stealth techniques to evade detection because it allows their malware to be more effective, live on a machine or network longer, and thus maximize the compromise. McAfee Labs is now at the point where we detect more than 110,000 new unique rootkits per quarter.

To make matters worse, there is another issue that many fail to recognize:

Today’s current OS-based security model is not adequate; cybercriminals know how to get past these defenses every time.

The security industry has to find a new vantage point on cybercriminal behavior to stop and uncover their stealth techniques. It is time for our industry to start looking at security beyond the operating system to gain a more effective view of how cybercriminals operate.

We delve into these and many other issues in our latest report: “The New Reality of Stealth Crimeware,” written by myself and Thom Sawicki of Intel. Download it here.

[wp-pdf-view swf=”https://www.infostruction.com/wp-content/uploads/2011/07/wp-reality-of-stealth-crimeware.pdf” width=”500″ height=”400″ /]

Introduction

Stealth is the art of travelling undetected, of being invisible. Stealth technology allows military aircraft,
Ninjas, and malware to sneak up on the enemy to launch an attack, gain intelligence, or take over
systems and data.

Although stealth techniques are used in sophisticated attacks like Conficker and Operation Aurora, the
Stuxnet attack offers a new blueprint—and benchmark—for how committed criminals can use stealth
techniques to steal data or target computing systems. Stuxnet innovations included a combination of
five zero-day vulnerabilities, three rootkits, and two stolen digital certificates. Powerful toolkits, like what is available in the Zeus Crimeware Toolkit, make stealth malware development a “point- and-click” endeavor, no longer restricted to the most knowledgeable programmers. While there are no definitive industry figures, McAfee Labs estimates that about 15 percent of malware uses sophisticated stealth technique to hide and spread malicious threats that can cause significant damage.1 These attacks form the cornerstone—the “persistent” part—of advanced persistent threats (APTs).

2011 Guardian Analytics – Commercial Banking Fraud (SMB)

2011 Guardian Analytics – Commercial Banking Fraud (SMB)

No Comments

Online Bank Fraud Continues To Plague Small Businesses, Study Says

Responses to the February 2011 survey from more than 533 SMBs indicate that money continues to be siphoned unnoticed from business accounts at an alarming rate and SMBs are leaving their institutions at alarming pace because of it. This means financial institutions are facing a lose-lose proposition: losing money and losing customers.

Business banking fraud — particularly in small and midsize companies — is still causing major problems for both the businesses and the banks that serve them, according to a study published today.

The “2011 Business Banking Trust Study,” a follow-up to a similar study conducted last year, was written by Ponemon Institute and sponsored by Guardian Analytics. This year’s numbers suggest that the banking fraud situation has not improved since 2010.

“The industry has not moved the needle in addressing the corporate account takeover and fraud plaguing SMBs and their financial institutions,” the report states. “The data shows that fraud is still pervasive, money is leaving accounts unnoticed at an alarming rate, and businesses will leave their banks because of it.”

Fifty-six percent of businesses experienced fraud in the past 12 months, according to the study. Of those that experienced fraud, 61 percent were victimized more than once. Seventy-five percent of the victims experienced online account takeover and/or online fraud. These figures are nearly the same as last year’s, the researchers say.

In 78 percent of fraud cases, banks failed to catch fraud before funds were transferred out, according to the study. Banks were able to keep money from leaving the bank in 22 percent of the cases and fully recover fraudulently transferred funds for 10 percent of businesses.

Banks were unable to recover funds in 68 percent of cases, leading to losses for both business and banks, Ponemon says. Banks took the losses in 37 percent of cases by reimbursing businesses for unrecovered funds; businesses took losses in 60 percent of cases.

Forty-two percent of respondents in the study said they do not believe the bank would cover any losses if their companies’ assets were stolen and not recovered. Despite this attitude, 70 percent of businesses still think their institution should be ultimately responsible for securing online accounts.

Forty-three percent of businesses said they have moved their banking activities elsewhere after a fraud incident. Ten percent of businesses that have experienced fraud have terminated their banking relationships following fraud attacks. Thirty-three percent said they did not fully terminate their relationship, but moved their primary cash management services to another institution.

2011 Business Banking Trust Study (PDF)

2011 Verizon Data Breach Report

2011 Verizon Data Breach Report

No Comments

Verizon’s 2011 Data Breach Investigations, a study conducted by the Verizon RISK Team with cooperation from the U.S. Secret Service and the Dutch High Tech Crime Unit.

 

 

 

 

Verizon’s 2010 Data Breach Report found that the number of data breaches quintupled from 2009, highlighting the shift as cyber-criminals target smaller businesses.

While the number of data breaches soared in 2010, the amount of information lost has dropped dramatically, according to Verizon’s latest data breach survey. The contradiction underscores what some security experts have been saying: attackers are increasingly targeting smaller companies because it’s easier.

Released April 19, the latest “2011 Verizon Data Breach Investigations Report” from Verizon Business counted 760 data breaches in 2010, compared to only 141 data breaches in 2009. Verizon noted a dramatic decline of 97 percent in the number of compromised records in 2010, as compared to 2009.

Among some of the report’s key findings:

  • Hacking, at 50 percent, and malware, at 49 percent, are the most prominent types of attack, with many incidents involving weak or stolen credentials and passwords;
  • Physical attacks, such as skimming at ATMs, pay-at-the-pump gas terminals and POS systems, for the first time rank among the three most common ways to steal information, comprising 29 percent of all investigated cases;
  • Outsiders are responsible for 92 percent of breaches, while the percentage of insider attacks dropped from 49 percent in 2009 to 16 percent in 2010.

Attacks Remain Easy
According to the report, 83 percent of the databases hit in 2010 were targets of opportunity; 92 percent of the attacks were classified as “not highly difficult.”

  • 86 percent of the year’s breaches were discovered by third parties;
  • 97 percent were avoidable through simple or intermediate controls;
  • 89 percent of the corporate or organizational victims were not compliant with the Payment Card Industry Data Security Standard at the time of the hack.

Download the 2011 Data Breach.

Malware being sent in job applications

Malware being sent in job applications

If you’re in any kind of business there’s a good chance you have to deal with resumes on a daily basis, especially if you’re a manager or Human Resources professional. While you probably delete that Viagra ad and ignore the promise of Nigerian riches, when a resume hits your inbox, you read it.

Spammers know this and have been increasingly presenting Malware as if it were a resume, hoping that the recipient will be so curious about a potential applicant that they open or run something that they shouldn’t. This practice of using rigged document files goes back to the early 2000’s where exploits for Microsoft’s document format existed even before Office 2000.

Let’s not forget when we could encoded Malware into a MIME header or .eml file and make IE/Outlook execute it… without even opening it. 🙂

These waves of Malware use obfuscation and “dropper” payloads to avoid detection. A dropper serves only to pull a payload, and a backdoor down for Botnet control. It rarely is detected as malicious because of its simple nature. The Antivirus products may continuously delete the Malware payloads, but as time passes with the dropper alive and well. The Malware creators are given the opportunity of changing the package and evading detection.

The Internet Crime Complaint Center (IC3) is reporting that businesses have received Bredolab variants in email attachments masquerading as job applications.

“Recent FBI analysis reveals that cyber criminals engaging in ACH/wire transfer fraud have targeted businesses by responding via e-mail to employment opportunities posted online,” IC3 said in a news release.

They also said: “The FBI recommends that potential employers remain vigilant in opening the e-mails of perspective employees. Running a virus scan prior to opening any e-mail attachments may provide an added layer of security against this type of attack. The FBI also recommends that businesses use separate computer systems to conduct financial transactions.”

It’s called “spear phishing” – malicious code sent specifically to someone in a company who would be expecting that type of email (job applications in attachments in this case.)

“Recently, more than $150,000 was stolen from a US business via unauthorized wire
transfer as a result of an e-mail the business received that contained malware. The
malware was embedded in an e-mail response to a job posting the business placed on
an employment website and allowed the attacker to obtain the online banking credentials
of the person who was authorized to conduct financial transactions within the company.
The malicious actor changed the account settings to allow the sending of wire transfers,
one to the Ukraine and two to domestic accounts. The malware was identified as a
Bredolab variant, svrwsc.exe. This malware was connected to the ZeuS/Zbot Trojan,
which is commonly used by cyber criminals to defraud US businesses.”

“Anyone who believes they have been a target this type of attack should immediately
contact their financial institutions and local FBI office, and promptly report it
to the IC3’s website at www.IC3.gov. The IC3’s
complaint database links complaints together to refer them to the appropriate law
enforcement agency for case consideration. The IC3 also uses complaint information
to identify emerging trends and patterns.”

2010 Verizon Data Breach Report

2010 Verizon Data Breach Report

No Comments

The 2010 Verizon and U.S. Secret Service breach report is full of enlightening facts, figures and statistics. I highly recommend you read it cover to cover. It breaks down the breaches by demographic, threat agents, threat actions, attack difficulty and targeting, vertical, and time span. It also compares how PCI compliance affected the number and severity of breaches. This is the first year that Verizon has teamed up with the Secret Service to expand reporting on breach incidents. This reporting is highly regarded as a source for intrusions into the customers of Verizon’s widely adopted communications services. DBIR series now spans six years, 900+ breaches, and over 900 million compromised records.

https://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf

Highlights:

  • Who is behind Data Breaches?
  • 70% resulted from external agents (-9%)
    48% were caused by insiders (+26%)
    11% implicated business partners (-23%)
    27% involved multiple parties (-12%)

  • How Do Breaches Occur?
  • 48% involved privilege misuse (+26%)
    40% resulted from hacking (-24%)
    38% utilized malware (<>)
    28% employed social tactics (+16%)
    15% comprised physical attacks (+6%)

  • What commonalities exist?
    98% of all data breached came from servers (-1%)
    85% of attacks were not considered highly difficult (+2%)
    61% were discovered by a third party (-8%)
    86% of victims had evidence of the breach in their log files
    96% of breaches were avoidable through simple or intermediate controls (+9%)
    79% of victims subject to PCI DSS had not achieved compliance

Older Reports:

2009: https://www.verizonbusiness.com/resources/security/reports/2009_databreach_rp.pdf

2008: https://www.verizonbusiness.com/resources/security/databreachreport.pdf