Third level • Fourth level Automated infection system...Click to edit Master title style • Click...

Click to edit Master title style

• Click to edit Master text styles• Second level

• Third level• Fourth level

• Fifth level

June 10th, 2009 Event details (title, place)

Automated infection system:New generation of threatsBased on a story of Gumblar trojan

APRICOT, 1st – 5th of March 2010, Kuala Lumpur

Michael MolsnerSenior Malware Analyst

• Fifth level

What is Gumblar?Components list

• Fifth level

Gumblar components

List of components: Exploits component:

Adobe PDF exploits Adobe Flash exploits

Win32 trojan application Server PHP backdoor HTTP redirector component (infected html) Injection component (html infector + server script

spreader)

• Fifth level

Component tiers

• Fifth level

Data flows

• Fifth level

Speed of growthHTML Injection Count

• Fifth level

Speed of growth

Number of server-side infections in October-November 2009

• Fifth level

Global Location analysis

Status Dec 04th 2009

• Fifth level

Global Location analysis

Status Feb 16th 2010

• Fifth level

Injection Statistics JapanDomestic Location analysis

Local access count analysis

• Fifth level

Injection Statistics MalaysiaDomestic Location analysis

• Fifth level

Gumblar-‐x vs Pegel

Gumblar-‐x Pegel

Exploit Adobe Reader Adobe Reader

Targets Flash MDAC

MSOffice WebComponent SnapShotViewer

Internet Explorer JRE

Function FTP acc FTP acc

Rootkit Rootkit

Fake AV

Botnet join

JP Count 5000 440

• Fifth level

Possible originsTimeline analysis

• Fifth level

Timeline analysis

HTML injection time:

• Fifth level

Timeline analysis

Daylight zones (05:00 UTC)

• Fifth level

Timeline analysis

Daylight zones (15:00 UTC)

• Fifth level

Case studyHTML Injected sites

• Fifth level

Gumblar Samples

Many kind of web sites were found victimized.At especially high risk:

Small businesses (lower IT skill; business loss) Admins using same Passwords for multiple sites (adult)

• Fifth level

Gumblar Samples

• Fifth level

Gumblar Samples

Really ANY kind of web site can be a target.Some Police related samples:

• Fifth level

Gumblar components

Analysis of active components: HTTP redirector component (injected .htm*, .js) Injection component (html infector + server script

spreader)

• Fifth level

Gumblar components

HTTP redirector component (infected html)

• Fifth level

Gumblar components

Analysis of active components: Exploits component:

MSOfficeWeb exploit Adobe PDF exploits Adobe FLASH exploits

WIN32 Trojan ROOTKIT DLL injection Web traffic hook

• Fifth level

Exploit layers

Adobe PDF exploit shellcode downloads Win32 malware

• Fifth level

Gumblar components Analysis

Script exploit:

• Cookie,Referer,UA check

• Dynamic code on access

• ENV dependent aSack

• Exploit downloader

• Fifth level

Gumblar components Analysis

PDF reader exploit:• PDF file

• FlateDecode

• JavaScript

• Downloader

• Fifth level

Gumblar components

• CWS file 1

• FWS file 1

• Binary

• Decrypt

• CWS file 2

• FWS file 2

• Strings

• ASCII bin

• FWS file 3

(Downloader)

Flash Player exploit:

• Fifth level

Gumblar components

• Downloaded Exe ...

• Creates DLL

• Restart …

• Process Injec]on

Win32 trojan application

• Fifth level

Gumblar components

Win32 trojan application

• C&C Communica]on

• Hidden in legit stream

• Self UPDATE

• FTP Acc data stolen

• Fifth level

JAVASCRIPT

Gumblar components

REDIRECT

BROWSER?

Internet ExplorerMSOfficeWeb

EXPLOIT?

DOWNLOADER

PDF CWS

DOWNLOADER DOWNLOADER

• Fifth level

Gumblar Demo

Infection procedure

• Live demonstration with Virtual machines as Server & Client

(DEMO)

• Fifth level

Gumblar Demo

Server PHP backdoor

• Command line level access to compromised machine

(DEMO)

• Fifth level

Variable name analysis

Eastern European name “iutka” - the only meaningful identifier

• Fifth level

Automated infection systemGeneralization of Gumblar threat

• Fifth level

Definition

Automated Infection System (AIS) is a distributedmulticomponent information system which has a viral natureand can grow on its own by establishing the data exchangebetween its components. The growth of the system isestimated by the number of computers which hosts thecomponents of the system.

• Fifth level

Threat level estimationHow dangerous is such system?

• Fifth level

Threat level estimation

Risks:Very large scaleSensitive data leakageInternationalRapidly growingNo human interaction required (self-sufficient)Has the power of server botnet

• Fifth level

Threat level estimation

Weaknesses:Dependence on the root servers

Elimination of root infector-servers stops system operation

Dependence on stable data exchangeDestruction of few communication channels (even basing on

network filtering) stops system growth

Compatibility problem (different platforms/interpreters)The code highly depends on usage of compatible (sometimes

deprecated) functions to work correctly

Can be simply honeypottedThe system may be artificially fed with honeypot FTP credentials

that will reveal active servers

• Fifth level

Conclusion

• Success due to low profile visibility;• Result - slow countermeasures by AV industry;• Multiple infection routines & obfuscation;• Frequent code changes to circumvent security software;

• Fifth level

June 10th, 2009 Event details (title, place)APRICOT, 1st – 5th of March 2010, Kuala Lumpur

Michael Molsnermichael@kaspersky.co.jp

Thank you !

Third level • Fourth level Automated infection system...Click to edit Master title style • Click...

Documents

Transcript of Third level • Fourth level Automated infection system...Click to edit Master title style • Click...

____ __ ____ _____ ____ ______ _____ _____ ____ _____ _____ _____ ____ _____ Click to edit Master text styles Second level Third level Fourth level Fifth.

Click to edit Master text stylesClick to edit Master text styles Second levelSecond level Third levelThird level Fourth levelFourth level Fifth levelFifth.

Click to edit Master title style - MemberClicks · Click to edit Master title style • Click to edit Master text styles • Second level • Third level • Fourth level • Fifth

Third level Fourth level goriva I hemikalija Fifth level · • Click to edit Master text styles –Second level •Third level –Fourth level »Fifth level Razvoj biogoriva Prva

Click to edit Master title style - Intel · Click to edit Master title style Click to edit Master text styles ─Second level ¼Third level ¼Fourth level ¼Fifth level Chia-Hong

Click to edit master title style...Bank Reporting Monitoring Click to edit master title style • Edit Master text styles • Second level • Third level • Fourth level • Fifth

Click to edit Master title style Click to edit Master text styles – Second level Third level – Fourth level » Fifth level Civil Service Commission Contract.

Confidential Proprietary Click to edit Master text styles Second level Third level Fourth level Fifth level Software Architecture April-10 Click to edit.

Click to edit Master title style · Click to edit Master title style • Edit Master text styles –Second level •Third level –Fourth level »Fifth level Session Objectives •

Click to edit Master title style Stakeholder mapping€¦ · Click to edit Master title style •Click to edit Master text styles •Second level •Third level •Fourth level •Fifth

Click to edit Master title style Zoom platform · Click to edit Master title style •Edit Master text styles •Second level •Third level •Fourth level •Fifth level Zoom platform

Click to edit Master text styles – Second level Third level – Fourth level » Fifth level Click to edit Master text styles – Second level Third level –

Click to edit Master title style - yu.edu · Click to edit Master title style • Click to edit Master text styles – Second level • Third level – Fourth level » Fifth level

First level – Second level Third level – Fourth level » Fifth level Click to Edit Title.

Click to edit Master title style - Transportation.org · Click to edit Master title style •Click to edit Master text styles Second level •Third level –Fourth level » Fifth

Click to edit Master text styles Second level Third level Fourth level Fifth level Installation Training.

Edit Master text styles Second level Third level TPD ... · PDF fileClick to edit Master title style Edit Master text styles • Second level • Third level • Fourth level • Fifth

Click to edit Master title style - Isen · Click to edit Master title style • Edit Master text styles • Second level • Third level • Fourth level • Fifth level. Motivation

Click to edit Master title style - NRCeS · Click to edit Master title style •Click to edit Master text styles –Second level •Third level –Fourth level » Fifth level •There

Click to edit Master title style - Black Hat · • Click to edit Master text styles —Second level • Third level —Fourth level » Fifth level Click to edit Master title style

_ __ _ _ _ _ _ ___ Click to edit Master text styles Second level Third level Fourth level Fifth.