Software Pirate Cracks Cybercriminal Wares

Make enough friends in the Internet security community and it becomes clear that many of the folks involved in defending computers and networks against malicious hackers got started in security by engaging in online illegal activity of one sort or another. These gradual mindset shifts are sometimes motivated by ethical, karmic or personal safety reasons, but just as often grey- and black hat hackers gravitate toward the defensive side simply because it is more intellectually challenging.

I first encountered 20-year-old French hacker Steven K. a few months ago while working on a series about the fake antivirus industry. I spent several hours reading accounts of his efforts to frustrate and highlight cybercriminal activity, and took time to follow the many links on his blog, XyliBox, a variant of his hacker alias, “Xylitol.” It turns out that Xylitol, currently unemployed and living with his parents, is something of a major player in the software piracy or “warez” scene, which seeks to crack the copy protection technology built into many computer games and commercial software programs.

As a founding member of redcrew.astalavista.ms (this site may be flagged by some antivirus software as malicious), Xylitol spent several years devising and releasing “cracks,” software patches that allow people to use popular commercial software titles without paying for a license. Cracks are frequently bundled with backdoors, Trojans and other nasties, but Xylitol claims his group never tainted its releases; he says this malicious activity is most often carried out by those who re-purpose and redistribute the pristine patches for their own (commercial and criminal) uses.



But about a year ago, Xylitol began shifting his focus to reverse engineering malware creation kits being marketed and sold on underground cybercrime forums. In October 2010, he began releasing cracked copies of the the bot builder for the SpyEye Trojan, a crimeware kit that sells for several thousand dollars. Each time the SpyEye author released an update, Xylitol would crack it and re-release a free version. This continued for at least a dozen updates in the past year.

The cracked SpyEye releases have been met with a mix of praise and scorn from the security industry; the free releases no doubt frustrated the moneymaking capabilities of the SpyEye author, but they also led to the public distribution of a malware kit that had previously been much harder to come by.
In an instant message chat, Xylitol said he still cracks the occasional commercial software title, just for old time’s sake.

“Sometimes for the old memories, but I’m more into malware cracking now,” he wrote. “It’s more fun.”

Since Nov. 2010, Xylitol and some of his associates have been locked in a daily battle with Russian scareware and ransomeware gangs. Scareware programs hijack PCs with incessant and misleading security warnings in a bid to frighten users into paying for the worthless software. Paying customers are given a license key eliminates the annoying security warnings. Ransomware is even more devious: It encrypts the victim’s personal files — pictures, documents, movies and music files — with a custom encryption key. Victims who want their files back usually have little recourse but to pay a fee via text message to receive a code that unlocks the encrypted files.

Xylitol and his pals have been busy over the past year cracking and publishing the license keys needed to free computers snared by scareware and ransomware. For months, these guys have been taking on a Russian ransomeware group called the WinAd gang, releasing the ransomware codes on a daily basis, often just hours after the WinAd gang began pushing out new ransomware variants.

In a chat conversation with KrebsOnSecurity.com, Xylitol said he’s lost track of the number of ransomware cracks he’s released, noting that at one point the WinAd gang switched to shipping a half-dozen updates daily in a bid to stay one step ahead.

“I lost count of how many of these I’ve cracked,” Xylitol said. “For a period that was daily and five or six per day, due to automatic ransomware update.”
Sometime around Sept. 14, 2011, the WinAd gang apparently decided it was losing the war, and called it quits. In closing a year-long discussion thread on the WinAd gang, Kernelmode.info moderator EP_XOFF wrote:

“Since September 11, their activity has decreased significantly. September 14 had died last known domain and redirector. However this may mean nothing. We continue to search.”

Another Kernelmode member, Nickvth2009, replied, “Let’s hope it will never come back.”

Read More...

‘Right-to-Left Override’ Aids Email Attacks

Computer crooks and spammers are abusing a little-known encoding method that makes it easy to disguise malicious executable files (.exe) as relatively harmless documents, such as text or Microsoft Word files.

The “right to left override” (RLO) character is a special character within unicode, an encoding system that allows computers to exchange information regardless of the language used. Unicode covers all the characters for all writing systems of the world, modern and ancient.

It also includes technical symbols, punctuations, and many other characters used in writing text. For example, a blank space between two letters, numbers or symbols is expressed in unicode as “U+0020″.

The RLO character (U+202e in unicode) is designed to support languages that are written right to left, such as Arabic and Hebrew. The problem is that this override character also can be used to make a malicious file look innocuous.

This threat is not new, and has been known for some time. But an increasing number of email based attacks are taking advantage of the RLO character to trick users who have been trained to be wary of clicking on random .exe files, according to Internet security firm Commtouch.

Take the following file, for example, which is encoded with the RLO character:
“CORP_INVOICE_08.14.2011_Pr.phylexe.doc”
Looks like a Microsoft Word document, right? This was the lure used in a recent attack that downloaded Bredolab malware. The malicious file, CORP_INVOICE_08.14.2011_Pr.phyldoc.exe, was made to display as CORP_INVOICE_08.14.2011_Pr.phylexe.doc by placing the unicode command for right to left override just before the “d” in “doc”.


I wanted to see this work on my Windows 7 system, but found that I had to enable a registry tweak to allow the insertion of unicode into file names. After a reboot, I was able to rename any executable by holding the ALT key, then pressing the “+” sign on the keypad and typing “202e” in front of the targeted area while renaming a file.

According to Commtouch, this technique is being used to conceal malicious files in an unusually aggressive series of spam blasts that have been ongoing since mid-August.

“The average outbreak during 2010 occurred every 10-14 days and consisted of 5-10 billion messages sent by botnets,” Commtouch co-founder Amir Lev said. “The outbreak distribution kept enough bots alive to manage [a] certain level of malicious activity.”

In contrast, Lev said, recent malware spam outbreaks have been far more frequent – sometimes three per day. The malware variants embedded in the spam include many password-stealing bots used in high-profile cyber heists, such as SpyEye and Zbot/ZeuS, in addition to Sasfis and fake antivirus. The lures used include UPS package notifications, credit card errors, inter-company invoices, and supposed notifications from NACHA, a not-for-profit group that develops operating rules for organizations that handle electronic payments, from payroll direct deposits to online bill pay services.

Some email applications and services that block executable files from being included in messages also block .exe programs that are obfuscated with this technique, albeit occasionally with interesting results. I copied the program that powers the Windows command prompt (cmd.exe) and successfully renamed it so that it appears as “evilexe.doc” in Windows. When I tried to attach the file to an outgoing Gmail message, Google sent me the usual warning that it doesn’t allow executable files, but the warning message itself was backwards:

“evil ‮”cod.exe is an executable file. For security reasons, Gmail does not allow you to send “this type of file.

Unfortunately, many mail applications don’t or can’t reliably scan archived and zipped documents, and according to Commtouch and others, the malicious files manipulated in this way are indeed being spammed out within zip archives.

This class of attack is a good reminder that there is no substitution for being careful with unbidden documents and attachments sent to you via email. If you receive a message with an attachment you weren’t expecting — even if it appears to come from someone you know — the safest option is to take a second and reply back to the person to verify the contents of the message and that they meant to send it.

I have not had an opportunity to test this on other operating systems or email clients (although my Mac happily displayed the cmd.exe file as evilexe.doc). I’d be interested in comments from readers who have broader experience with this approach in manipulating file types.

nb : krebsonsecurity

Read More...

SSCC 73 - Patch Tuesday, UBS, SpyEye, Twit.tv and Windows 8

I was very happy to have Paul Ducklin, Sophos's Head of Technology, Asia Pacific, as my guest again this week.

Paul joined me amidst what he referred to as a Denial of Service (DoS) attack at the security checkpoint of Sydney airport.

Paul shared his thoughts on the September 2011 Patch Tuesday release from Microsoft and Adobe (Hint: if you have to prioritize, start with Adobe.)

We chatted a bit about the guy who lost more than £2.3 billion as a trader for UBS bank. If they can't keep track of £2.3 billion, are they taking proper care of our personally identifiable information?

It appears SpyEye is following in the Zeus bot's footsteps and is beginning to target mobile banking users on Android who use their phone as a second factor for authentication. Paul explains the social engineering aspects of this malware.
One of the most popular tech podcast/vodcast sites, Twit.tv, run by Leo LaPorte was hacked this week. The malware targeted unpatched versions of Adobe Reader and Java. Remember, there is no such thing as safe surfing.

I asked Paul what he thought about the news that Microsoft will be including a free unmanaged anti-virus program in Windows 8.

He talked a bit about patching in general, and was upbeat that users who care to keep themselves up to date could definitely benefit.


nb : nakedsecurity.sophos

Read More...

SpyEye targeting Android users - just a copy of Zeus's strategy?

In the world of Windows malware, SpyEye is a widely spread malicious toolkit for creating and managing botnets designed primarily for stealing banking credentials and other confidential information from infected systems.

SpyEye is a major competitor of infamous Zeus toolkit. Zeus (also known as ZBot) generated a lot of interest in the mobile security community a couple of months ago when an Android version was discovered.

Of course, we did not have to wait for too long before a version of SpyEye targeting Android was also developed, and sure enough a malicious SpyEye Android app was discovered a few days ago.

The functionality of Zeus and SpyEye on Windows is quite similar, so I was curious as to how similar their respective Android versions would be.

Zeus for Android purports to be a version of Trusteer Rapport security software. This social engineering trick is used in an attempt to convince the user that the application they are installing is legitimate.

SpyEye for Android, now detected by Sophos products as Andr/Spitmo-A, uses a slightly different but similar social engineering technique.

When the user of a PC infected by the Windows version of SpyEye visits a targeted banking website, and when the site is using mobile transaction authorization numbers, the SpyEye Trojan may inject HTML content which will instruct the user to download and install the Android program to be used for transaction authorisation.

The SpyEye application package does not include an icon which would be displayed in the "All apps" menu, and the user will only be able to find the package when the "Manage Applications" is launched from the mobile device's settings.

The application uses the display name "System" so that it seems like a standard Android system application.



When installed, Zeus for Android displayed a fake activation screen, and Spitmo is again very similar.

However, Spitmo uses different tactics to reinforce user's opinion that it is a legitimate application.

It applies for the following permissions Android permission:


<action name="android.provider.Telephony.SMS_RECEIVED" />
<action name="android.intent.action.NEW_OUTGOING_CALL" />


This allows the malware to intercept outgoing phone calls.

When a number is dialed, the call is intercepted before the connection is made and the dialed phone number is matched to a special number specified by the attacker in the alleged helper application installation instructions.

If the number matches, Spitmo displays a fake activation number, which is always 251340.


Once installed, the functionality of Zeus and SpyEye are pretty much the same.
A broadcast receiver intercepts all received SMS text messages and sends them to a command and control server using an HTTP POST request. The submitted information includes the sender's number and the full content of the message.

So far, it does not seem that this attack is widespread, but it shows that the developers of major malicious toolkits are closely watching their competition and matching the latest features.

It also seems that support for Android is increasingly becoming an important part of their product strategy.

nb : nakedsecurity.sophos

Read More...

SpyEye Trojan stole $3.2 million from U.S. victims

The amounts stolen and the number of large organizations potentially impacted is cause for serious concern, says Trend Micro

A Russian cybergang headed by a mysterious ringleader called 'Soldier' were able to steal $3.2 million from U.S. citizens earlier this year using the SpyEye-Zeus data-stealing Trojan, security company Trend Micro has reported.

Over a six month period from January 2011, Trend found that the Soldier gang had been able to compromise a cross-section of U.S. business, including banks, airports, research institutions, and even the U.S. military and Government, as well as ordinary citizens.

[ Learn how to greatly reduce the threat of malicious attacks with InfoWorld's Insider Threat Deep Dive PDF special report. ]

A total of 25,394 systems were infected between 19 April and 29 June alone, 57 percent of which were Windows XP systems with even Windows 7 registering 4,500 victim systems.

The company has not explained how the sum of $3.2 million was taken, nor from which types of user, but accounts across a wide range of applications were found to have been compromised. The three largest by some margin were Facebook, Yahoo and Google, but eBay, Amazon, PayPal, and Skype also appear on the list.

"'Soldier' has mainly targeted U.S. users and to increase the number of successful infections achieved in the U.S., he even bought U.S. traffic from other cybercriminals. Besides using malware to steal money from the compromised accounts, he also steals user security credentials," Trend Micro said.

"Compromise on such a mass scale is not that unusual for criminals using toolkits like SpyEye, but the amounts stolen and the number of large organizations potentially impacted is cause for serious concern."

Banking Trojans such as SpyEye and the older Zeus (possibly now merged with SpyEye) have been one of the malware stories of the last year, and have featured in a number of high-profile online crime cases.

In the U.K. this included a teen gang said to have stolen as much as £12 million ($18 million) from a range of activities including online bank fraud. Earlier in 2010, a separate gang using Zeus was able to steal up to £20 million ($30 million), police believe.

nb : infoworld Read More...

Doing the Zbot spot; playing gotcha with a botnet

Greetings Internet!
This month (carefully hidden under the Win32/Bamital blanket), employing the old adage 'fight fire with fire', we decided to fight sneakiness with sneakiness and quietly slipped a fairly major Win32/Zbot update into MSRT.

"Zbot" I hear you say? Yes, it's still around and kicking. Despite Win32/Zbot (officially self-titled with the oh-so-ego-inflating 'Zeus' moniker, despite never fathering Hercules bot, nor employing lightning in any way during infection) being rumoured to have merged with Win32/EyeStye (aka SpyEye), we're still seeing both distinct malware families out and about in the wild. Between the two, we're finding that they're responsible for a significant amount of the e-commerce-related fraud happening at any given time.

Of course, since Zbot has been in MSRT since last October, MSRT has been continually updated monthly with all of our related signatures. We believe this tried-and-true method is effective - every month we clean between 60,000 and over 100,000 unique Windows computers:

Month	Count
March	103391
April	113814
May	60385
June	83555
July	61323
August	89994

So what's changed? Well, let's just say we felt it was time to turn the screws tighter on Zbot again. Whilst we get to do some pretty in-depth analysis of infections through the telemetry we get back from Microsoft Security Essentials, it's time for us to get a really definitive snapshot of the Zbot infection ecosystem as best we could. I know! Statistics are fun! High five!

Ideally, this information will help us and our partners in law enforcement battle the threat more effectively in the future.

Naturally, once we see how things pan out in MSRT over the next couple of days, I'll update you on how it's all going!

nb : technet Read More...

Android targeted by SpyEye banking Trojan

A new version of the SpyEye Trojan designed to intercept two-factor authentication codes sent via SMS is the first known one for Android

 

Banking transactions for owners of Android phones just became more dangerous with a new iteration of the SpyEye Trojan designed to intercept two-factor authentication codes sent via SMS -- the first known version for Android.
The malware not only tries to steal authentication information banks send via SMS, it also encourages users to go out and buy an Android if they don't already have one, according to Ayelet Heyman, senior malware analyst for Trusteer, which makes software to thwart banking malware.

[ Learn how to secure your systems with InfoWorld's Malware Deep Dive PDF special report and Security Central newsletter, both from InfoWorld. ]
Customizing for Android is good for attackers because they don't have to wait three days to commandeer the SMS messages, which is the case with Symbian phones, she says.

BACKGROUND: Discounted SpyEye could mean trouble for enterprises
Trusteer discovered the SpyEye variant in the wild in Spain on July 26, and Heyman wrote about it today in a blog.

The attack is carried out against customers of targeted banks that use SMS messages to send out one-time passwords as customers log in.
Attackers first compromise customers' home desktops that are used for remote banking transactions, then compromise the phones so they can intercept the one-time passwords.

Once they have infected both the desktops and phones they attack on customers' accounts by logging in using credentials stolen from the compromised laptop. When SMS messages with the one-time passwords are sent, the malware in the phones diverts the passwords to the attacker who uses them to complete authentication to the users' accounts. Once in, the attacker can withdraw or transfer funds.

The phone compromise starts when a victim connects to a targeted bank's website via desktop. A message pops up that says a mandatory new security measure is being implemented that requires downloading a security application to an Android phone. The user is walked through how to download and install the malicious application.

Once activated, the malware picks off all SMS messages and forwards them to the attacker's command and control server.

For customers who don't have Androids, the malware offers this message: "Users who do not have cell phones that work on the Android platform will be forced to buy it. ... It's inconvenient, but it is the only way to keep their money secure."
Heyman says she thinks the next innovation will be for SpyEye to commandeer sessions initiated from cellphones rather than desktops.
.
nb : infoworld

Read More...

Variant of SpyEye Targets Android Devices

Researchers at security firm Trusteer claim a new version of the SpyEye Trojan horse program that targets mobile banking users with Android mobile phones and intercepts SMS text messages to and from the phone. However, significant obstacles may prevent it from spreading.

Writing on the company's blog, Ayelet Heyman, a Senior Malware Researcher at Trusteer, said that the company had found the malware on a compromised machine in late July.  The variant is the first SpyEye known to target Android devices. Previous versions of the Trojan targeted devices running Nokia's Symbian and Research in Motions Blackberry operating systems.

The new variant, dubbed "SPITMO," is distributed from compromised spanish bank Web pages. USers who visit those sites are prompted to download and install the malicious Android application. Its a cumbersome process that involves the victim pointing their mobile Web browser to a malicious binary hosted online, installing that application, then calling a predetermined number to receive an activation code. Once the activation code has been entered, the installed SpyEye Trojan is programmed to intercept SMS messages to and from the phone.

Intercepted messages are forwarded to command and control servers operated by the SpyEye authors.

Needless to say, the multiple steps required to install the malware are making it difficult for it to gain much traction in the wild. However, the new Trojan does suggest that malware authors are grasping the potential of the fast-growing Android install base.

SpyEye is a common and sophisticated family of malicious program designed to compromise accounts and steal personal information. SpyEye is typically spread from infected Web sites, and its authors have been creative in tapping online resources, including Amazon's S3 cloud, to distribute their wares. SpyEye programs have been linked to prominent Web-based attacks including  has been linked to numerous online attacks, including one on Verizon's online billing Web site. Within the last year, the SpyEye and Zeus malware families have merged.

nb : threatpost Read More...