Mar 31 2014

Agnitio v2.1 Released – Manual Security Code Review Tool

A tool to help developers and security professionals conduct manual security code reviews in a consistent and repeatable way. Agnitio aims to replace the adhoc nature of manual security code review documentation, create an audit trail and reporting. It hasn’t been updated for a fair while sadly, and v2.1 was released in 2011 – but...

Read the full post at darknet.org.uk
Mar 31 2014

Report: RSA endowed crypto product with second NSA-influenced code

Security provider RSA endowed its BSAFE cryptography toolkit with a second NSA-influenced random number generator (RNG) that's so weak it makes it easier for eavesdroppers to decrypt protected communications, Reuters reported Monday.

Citing soon-to-be-published research from several universities, Reuters said the Extended Random extension for secure websites allows attackers to work tens of thousands of times faster when breaking cryptography that uses the Dual EC_DRBG algorithm to generate the random numbers that populate a specific cryptographic key. Dual EC_DRBG is a pseudo-random number generator that was developed by cryptographers from the National Security Agency and was the default RNG in BSAFE even after researchers demonstrated weaknesses so severe that many suspected they were introduced intentionally so the US spy agency could exploit them to crack encrypted communications of people it wanted to monitor. In December, Reuters reported that the NSA paid RSA $10 million to give Dual EC_DRBG its favored position in BSAFE.

Extended Random was a second RNG that would presumably make cryptographic keys more robust by adding a second source of randomness. In theory, the additional RNG should increase the entropy used when constructing a new key. In reality, the algorithm made protected communications even easier for attackers to decrypt by reducing the time it takes to predict the random numbers generated by Dual EC_DRBG, which is short for Dual Elliptic Curve, Reuters reported Monday.

Read 2 remaining paragraphs | Comments

Mar 31 2014

CryptoDefense, the CryptoLocker Imitator, Makes Over $34,000 in One Month

On the back of Cryptolocker’s (Trojan.Cryptolocker) perceived success, malware authors have been turning their attention to writing new ransomcrypt malware. The sophisticated CryptoDefense (Trojan.Cryptodefense) is one such malware. CryptoDefense appeared in late February 2014 and since that time Symantec telemetry shows that we have blocked over 11,000 unique CryptoDefense infections. Using the Bitcoin addresses provided by the malware authors for payment of the ransom and looking at the publicly available Bitcoin blockchain information, we can estimate that this malware earned cybercriminals over $34,000 in one month alone (according to Bitcoin value at time of writing).

Imitation
Imitation is not just the sincerest form of flattery - it's the sincerest form of learning” – George Bernard Shaw.

CryptoDefense, in essence, is a sophisticated hybrid design incorporating a number of effective techniques previously used by other ransomcrypt malware authors to extort money from victims. These techniques include the use of Tor and Bitcoins for anonymity, public-key cryptography using strong RSA 2048 encryption in order to ensure files are held to ransom, and the use of pressure tactics such as threats of increased costs if the ransom is not paid within a short period of time. However, the malware author’s poor implementation of the cryptographic functionality has left their hostages with the key to their own escape.

Infection
Symantec has observed CrytoDefense being spammed out using emails such as the one shown in Figure 1.

Figure1_9.png

Figure 1. Malicious spam email example

Network communications
When first executed, CryptoDefense attempts to communicate with one of the following remote locations:

  • machetesraka.com
  • markizasamvel.com
  • armianazerbaijan.com
  • allseasonsnursery.com

The initial communication contains a profile of the infected computer. Once a reply is received from the remote location, the threat then initiates encryption and transmits the private key back to the server. Once the remote server confirms the receipt of the private decryption key, a screenshot of the compromised desktop is uploaded to the remote location.

Ransom demand
Once the files are encrypted, CryptoDefense creates the following ransom demand files in every folder that contains encrypted files:

  • HOW_DECRYPT.TXT
  • HOW_DECRYPT.HTML
  • HOW_DECRYPT.URL

Figure2_5.png

Figure 2. Example of HOW_DECRYPT.HTML file

As can be seen in Figure 2, the malware authors are using the Tor network for payment of the ransom demand. If victims are not familiar with what the Tor network is, they even go as far as providing instructions on how to download a Tor-ready browser and enter the unique Tor payment Web page address. The use of the Tor network conceals the website’s location and provides anonymity and resistance to take down efforts. Other similar threats, such as Cryptorbit (Trojan.Nymaim.B), have used this tactic in the past.

Payment
Once the user opens their unique personal page provided in the ransom demand using the Tor Browser, they will be presented with a CAPTCHA page.

Figure3_3.png

Figure 3. Example of CAPTCHA shown to victim

Once they have filled in the CAPTCHA correctly, the user will be presented with the ransom payment page.

Figure4_4.png

Figure 4. CryptoDefense ransom payment page

Of note here is the ransom demand of 500 USD/EUR to be paid within four days or the ransom doubles in price. The use of time pressure tactics by the cybercriminals makes victims less likely to question the costs involved when evaluating potential losses. The cybercriminals offer proof through a “My screen” button, included on the payment page, that they have compromised the user’s system by showing the uploaded screenshot of the compromised desktop. They also offer further proof that decryption is feasible by allowing the victim to decrypt one file through the “Test decrypt” button. They then proceed to educate their victim on how to get hold of Bitcoins to pay the ransom.

Encryption
CryptoDefense employs public-key cryptography using strong RSA 2048 encryption. This means that once the files have been encrypted, without access to the private key, victims will not be able to decrypt the files. With Cryptolocker, the private key was only ever found on servers controlled by the attacker, meaning the attackers always maintained control over the encryption/decryption keys. On investigating how CryptoDefense implemented its encryption, we observed that the attackers had overlooked one important detail: where the private key was stored.

As advertised by the malware authors in the ransom demand, the files were encrypted with an RSA-2048 key generated on the victim’s computer. This was done using Microsoft’s own cryptographic infrastructure and Windows APIs to perform the key generation before sending it back in plain text to the attacker’s server. However, using this method means that the decryption key the attackers are holding for ransom, actually still remains on the infected computer after transmission to the attackers server.

Earnings
Symantec is aware of the following Bitcoin addresses being used in CryptoDefense ransom demands:

The first known Bitcoin transaction for these addresses was on February 28, 2014. This corresponds with the first detection of a CryptoDefense sample by Symantec. At this time, based on the number of received transactions for both Bitcoin addresses, Symantec can estimate that the cybercriminals behind CryptoDefense have earned over $34,000 in just one month.

Prevalence
Symantec telemetry shows that we have blocked over 11,000 unique CryptoDefense infections in over 100 countries. The United States makes up the majority of these detections followed by the United Kingdom, Canada, Australia, Japan, India, Italy, and the Netherlands.

Figure5_1.png

Figure 5. Heatmap for CryptoDefense detections

Protection
Although not related, such were the similarities seen between CrytoDefense and Cryptolocker that Symantec initially detected this threat as Trojan.Cryptolocker along with numerous other detections. Symantec detects CryptoDefense under the following detection names:

Antivirus detections

Heuristic detections

Reputation detections

Intrusion prevention signatures

Symantec customers that use the Symantec.Cloud service are also protected from the spam messages used to deliver this malware.

For the best possible protection, Symantec customers should ensure that they are using the latest Symantec technologies incorporated into our consumer and enterprise solutions. To further protect against threats of this nature, it is recommended that you follow security best practices and always backup your files using a product such as Symantec’s Backup Exec Family. Finally, always keep your systems up to date with the latest virus definitions and patches.

Mar 30 2014

Simple njRAT Fuels Nascent Middle East Cybercrime Scene

Symantec has observed the growth of indigenous groups of attackers in the Middle East, centered around a simple piece of malware known as njRAT. While njRAT is similar in capability to many other remote access tools (RATs), what is interesting about this malware is that it is developed and supported by Arabic speakers, resulting in its popularity among attackers in the region.

The malware can be used to control networks of computers, known as botnets. While most attackers using njRAT appear to be engaged in ordinary cybercriminal activity, there is also evidence that several groups have used the malware to target governments in the region.

Symantec analyzed 721 samples of njRAT and uncovered a fairly large number of infections, with 542 control-and-command (C&C) server domain names found and 24,000 infected computers worldwide. Nearly 80 percent of the C&C servers were located in regions in the Middle East and North Africa, including Saudi Arabia, Iraq, Tunisia, Egypt, Algeria, Morocco, the Palestinian Territories and Libya. 

figure1_18.png
Figure 1. Majority of njRAT C&C servers are found in the Middle East and North Africa

The majority of the C&C server IP addresses were traced to ADSL lines, which indicates that most attackers using the malware could be home users in the Middle Eastern region.

njRAT is not new on the cybercrime scene. It has been available since 2012, with three versions already released, all of which can be propagated through infected USB keys or networked drives.

The malware has the basic features common in most RATs. It can download and execute additional malware; execute shell commands; read and write registry keys; capture screenshots; log keystrokes; and snoop on webcams.

Strong online support for Middle East home users
The main reason for njRAT’s popularity in the Middle East and North Africa is a large online community providing support in the form of instructions and tutorials for the malware’s development. The malware’s author also appears to hail from the region. njRAT appears to have been written by a Kuwait-based individual who uses the Twitter handle @njq8. The account has been used to provide updates on when new versions of the malware are available to download.

figure2_17.png
Figure 2. The creator of njRAT announcing in a tweet that version 0.7 of njRAT is available to download.

Symantec has also located the malware author’s WordPress webpage, which redirects to another Blogspot webpage. The latter displays visitor statistics, indicating that majority of the blog’s visitors come from Saudi Arabia as shown below:

figure3_10.png
Figure 3. The visitor statistics of @njq8’s Blogspot Web page

Technical support and tutorials on using njRAT are widely available on the Web. Symantec has found numerous video tutorials in the Arabic language containing step-by-step processes for downloading and setting up the malware, including steps such as dynamic DNS naming for C&C servers. This level of support enables attackers in the region to easily to build tools and server components for njRAT.

figure4_8.png
Figure 4. Description of a video tutorial of how to build an njRAT on hacking group MaDLeeTs’s website

figure5_6.png
Figure 5. The latest three tutorials on Anonymous Iraq’s YouTube channel are on obfuscating njRAT to evade antivirus software

Hacker groups launch targeted attacks with njRATs
Most njRAT users seem to be home users who are interested in online pranks such as spying on webcams or taking screenshots of victims’ computers. However, infections have also been recorded on the networks of a number of governments and political activists.

Symantec has identified 487 groups of attackers mounting attacks using njRAT. These attacks appear to have different motivations, which can be broadly classed as hacktivism, information theft, and botnet building.

One such group is the S.K.Y.P.E/Tagged group, which has C&C servers hosted in Egypt and Algeria. The group’s vector for infection is a screensaver hosted on the file sharing site ge.tt. When victims download the compressed .rar file containing the screensaver, they get an executable containing njRAT.

figure6_1.png
Figure 6. The infected screensaver created by the S.K.Y.P.E/Tagged group on the ge.tt file sharing site

It is also interesting to note that the infected file hosted on ge.tt was dated November 20, 2012, indicating that the group was one of the early adopters of the malware.

Symantec has also observed that infection numbers spiked around the time this copy of njRAT was uploaded on ge.tt. The S.K.Y.P.E/Tagged group uses two C&C servers: njratmoony.no-ip.biz and njr.no-ip.biz. The number of newly infected computers reporting to both servers spiked in October and November of 2012.

figure7_1.png
Figure 7. The daily infection rate of computers reporting to the S.K.Y.P.E/Tagged group’s C&C servers, njratmoony.no-ip.biz and njr.no-ip.biz

njRAT signals growing cybercrime community
As large numbers of Middle Eastern attackers continue to use njRAT due to its accessibility, Symantec expects that they will try to find new ways of obfuscating the malware to evade detection by antivirus software. They are likely to continue to use njRAT since an Arabic speaking community and its Arabic author continue to provide support for the malware.

The more advanced threat actors, such as hacker groups, may continue to use njRAT for targeted attacks in the short term. For example, a report by the Electronic Frontier Foundation (EFF) and Citizen Lab found that njRAT is one of a number of tools being used to target Syrian opposition groups during the Syrian conflict. However, Symantec anticipates that such groups will eventually depart from using publicly-available tools like njRAT and begin to develop their own tools and more advanced RATs for cyberattacks.

Symantec detects this threat as Backdoor.Ratenjay.

Update: The original version of this article stated that njRAT first became publicly available in June 2013. It was in fact available since 2012. A dedicated website for the malware was launched in June 2013.