Exploit. Angler. Nuclear. Doesn’t matter what they’re called, they always deliver.  We should be prepared for the fact that these die down then reappear, with renewed code and vigor.  Here’s a current representation of strains. And to that we add Zeus Sphinx.

As banking malware goes, Sphinx  “combined elaborate fraud tactics to steal credentials and one-time passwords”. Sphinx was originally identified in 2015, but the Brazilian variant appeared hot on the heels of Zeus Panda in Aug 2016,  attacking Brazilian banks, specifically the online banking and Boleto payment systems (Boleto fraud is highly lucrative and deserves its own post). That this occurred at the same time as the Olympics is no coincidence.  Activity died down until recently. IBM X-Force has identified new, targeted attacks against online users of banks and especially credit unions in Canada and Australia. In this article written by malware hunter Limor Kessem, these are “low-volume testing, not full-blown infection campaigns. The malware’s operators appear to be looking very carefully to determine which geographies offer the paths of least resistance.” According to X-Force, the attackers are using the same attack servers that facilitated the Zeus Citadel and Ramnit attacks in 2016. As well, the webinjections share similar code patterns with other banking Trojans. Sphinx uses two distribution methods: email loaded with a malicious VBA loader, and malvertising.

Note how Credit Unions are the major target, as they apparently are low-hanging fruit from a security standpoint.  For Australia, the mix is 40 major banks, credit unions and payment providers. NOTE: This also targets some US banks.

Per the X-Force Exchange site:

Zeus Sphinx is used for the theft of online banking authentication elements such as user credentials, cookies and certificates. These elements are subsequently used by fraudsters in illicit online transactions typically performed from the user’s own device. Connection to the endpoint is facilitated via backconnect hidden virtual network computing (VNC), which means the infected endpoint will initiate a remote-access connection to the criminal’s endpoint. This feature allows the attacker to gain user-grade access to the device even through firewall protection.

https://securityintelligence.com/around-the-world-with-zeus-sphinx-from-canada-to-australia-and-back/

https://securityintelligence.com/brazil-cant-catch-a-break-after-panda-comes-the-sphinx/

Here’s my catch of the day for you: Monday Jan 23 2017

Massive Twitter Botnet Discovered: We know this can’t be good.  Two researchers have found a huge but dormant Twitter botnet of 350,000 bots. Active, this could spread spam or malicious links, or be used to spread – gasp – fake news. The researchers claim to have found an even larger botnet of over 500K. Just think of the Mirai botnet and outages along the eastern seaboard. While details on that are not being released just yet, the Twitter botnet was apparently created in 2013 and stayed hidden til recently. The content consists of harmless quotes from Star Wars and no URLs are involved. The users attached to the bots seem believably human and unaggressive. The researchers are encouraging people to research these bots, and have created two Twitter accounts to report bots: @thatisabot and @website.  https://threatpost.com/massive-twitter-botnet-dormant-since-2013/123246/

Locky Ransomware – Awaken the Kraken?:  2016 started with a ransomware bang and ended with a botnet boom. The pairing of ransomware and botnets should make anyone nervous. And the minds at Cisco are warning that we should expect a massive spam campaign with a return of the near-dormant Locky ransomware.   Locky was spread via the Necrus botnet, which had 500K devices under its control to deliver spam, which contained the unbreakable Locky payload. Researchers are seeing a subtle increase in attacks via Necrus and Locky this month. It is possible attackers are exercising caution rather than risk getting caught.  I say batten down those hatches.  http://www.theregister.co.uk/2017/01/20/locky_ransomware_horrorshow_returns/

How to Secure Your Bank – in 3 Easy Steps!: OK. It’s not that easy. But these are good principle for any organization to follow, including banks. After last year’s massive financial attacks and heists, and the return of Carbanak, financial organizations need to get their houses in order to face the year ahead. And it isn’t just the gold or currency that holds value in the vault. It’s all. That. Data. Those mainframes are no longer as segregated as they once were. And banks are more at risk of Advanced Persistent Threats and targeted attacks. Recommendations are to train everyone on security practices and awareness.  Then, make sure controls are in place and that people are aware of them. Finally, make sure that all outside parties, or trusted partners, understand and adhere to these rules to maximize security.   http://www.networkworld.com/article/3157555/security/new-game-new-rules-3-steps-to-secure-your-bank-in-the-digital-age.html#tk.twt_nww

Here’s my catch of the day for you: Friday Jan 6 2017

There’s a New APT in town: BaneChant or “MM Core,” was discovered in April 2013 by FireEye researchers who then noticed some of its interesting features. The Trojan was designed to collect information about the infected computer and set up a backdoor for remote access. New versions have been identified recently in the Middle east, Asia, Africa and US. Targets are media, government, telecommunications and energy. Keynotes: this malware evades sandboxing by detecting mouse clicks. As well, it has a shortened URL to avoid blacklisting. To be expected it has shared certificates, likely stolen. According to Forcepoint’s Nicholas Griffin, “Ultimately this suggests that MM Core may be a part of a larger operation that is yet to be fully uncovered”. What’s also interesting – the name Bane comes from, yes, Bane from Batman, because of where the URL is supposedly tied to.Per Fireeye, the malware attempts to:

1. Evade sandbox by detecting human behaviors (multiple mouse clicks);
2. Evade network binary extraction technology by performing multi-byte XOR encryption on executable file;
3. Social engineer user into thinking that the malware is legitimate;
4. Avoid forensic and incidence response by using fileless malicious codes; and
5. Prevent automated domain blacklisting by using redirection via URL shortening and Dynamic DNS services.

https://www.fireeye.com/blog/threat-research/2013/04/trojan-apt-banechant-in-memory-trojan-that-observes-for-multiple-mouse-clicks.html

http://www.securityweek.com/new-mm-core-apt-malware-targets-united-states

FireCrypt Ransomware:  Would you like a side of DDoS with that? This is another recent discovery as ransomware continues to evolve.  This variant launches a DDoS attack against a URL hardcoded in the source code by continuously connecting to the URL and downloading junk from it to fills up the machine’s %Temp% folder.  Features: this code can be disguised under PDF or DOC icons; attackers can slightly modify the binary for a different hash; this can create polymorphic malware that evades AV.  Note that this is very similar to the “deadly with a good purpose” ransomware released in Oct 2016.  The opinion is that this is that variety just rebranded.  DDoS activities appear to currently target Pakistan’s Telco Authority. However, the attack is relatively ineffective in this configuration as DDoS requires massive mobilization.

http://www.securityweek.com/firecrypt-ransomware-packs-ddos-code

Ransomware on Android Smart TVs: You can’t change the channel
This is not the added feature you were looking for. Ransomware has been on Android phones for a few years, so this is the extension, and was discovered a year ago in the wild. This Christmas, it was reported when someone downloaded ransomware with a movie-watching app on a three year old TV. And the screen locker does not work the same on TVs as it does on phones and computers. So any attempt to click and comply to free the screen doesn’t work. In this story, LG was able to give the victim a solution that worked, and the ransomware only was a screenlocker, not a file encrypter.  But Smart tv’s have USB ports so folks can load pics and personally valuable files. These can become infected through that connection.

http://www.networkworld.com/article/3154161/security/ransomware-on-smart-tvs-is-here-and-removing-it-can-be-a-pain.html

FTC files suit against D-Link – Strike 1 IoT:  There has been much talk about trying to regulate the lack of security released with the ever-growing Internet of Things. Now, we may have a precedent. The US FTC has filed a lawsuit against well-known manufacturer D-Link, whose SOHO devices are in many homes. The charge is that D-Link put “thousands of customers at risk of unauthorized access by failing to secure its IP cameras and routers”. And there have been plenty of security issues written up for their products. The suit claims the company “repeatedly have failed to take reasonable software testing and remediation measures to protect their routers and IP cameras against well-known and easily preventable software security flaws”.

http://www.zdnet.com/article/ftc-files-lawsuit-against-d-link-for-router-and-camera-security-flaws/

The Evolution of Wiper Malware into Ransomware

All eyes should be on the Ukraine for more reasons than one. ESET claims they believe that BlackEnergy, the group responsible for attacks against the energy sector in the Ukraine, has morphed into Telebots, and are responsible for a series of attacks against “high value targets” in the financial sector in the Ukraine. The group utilized backdoor trojans and malicious emails. The TeleBots malware is distinctive “because it uses the Telegram protocol to communicate with its operators”.  The attackers rendered computers unbootable and hid their tracks using Killdisk to delete critical system files, replace files, and rewrite file extensions. The ESET article offers a very detailed and comprehensive analysis with IOCs, file extensions etc. which I won’t copy over here but highly recommend you look at.

According to Tripwire, “TeleBots is also an evolution of Sandworm, a Russian espionage gang which exploited CVE-2014-4114 to attack NATO and other Western organizations in 2014 and used KillDisk against several Ukrainian power companies in December 2015.” This includes ICS targets in the US in 2014.

And it gets better. Guess what they’re using? Killdisk wiper malware. Because wiper malware means never having to say you’re sorry.  But wait – there’s more.  It appears Telebots has helped the Killdisk evolve from wiper malware into ransomware, according to researchers with CYberX, a security firm specializing in ICS SCADA. We can expect lucrative extortion attacks against industries, because those are systems that cannot easily be secured or defended.   Per Catalin Cimpanu of Bleeping Computer,  “KillDisk’s ransomware component makes it easier for the gang to hide its tricks. It also means the group can extort industrial organizations, targets which can’t afford to not access their data or shut down their networks to scrub them of malware.

The ransoms asked are roughly $215,000.  Never mind what comes next. Buckle up guys, we’re in for a rough ride.
http://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/

https://www.tripwire.com/state-of-security/latest-security-news/killdisk-wiper-malware-evolves-ransomware/

https://www.bleepingcomputer.com/news/security/killdisk-disk-wiping-malware-adds-ransomware-component/

Yes, Virginia, you can hack a mainframe. My excellent friend, Phil Young, will be glad to show you how it’s done in his latest talk here from CA World 2016. “Gaps in Your Defense: Hacking the Mainframe”.

 Red teams, Blue teams. Attackers vs Defenders. But what happens when you combine the best of both? Purple teaming!

My very skilled friend, Haydn Johnson, has done a lot of research into this subject. As an adroit pentester himself, he knows about attack skills. And we’ve given a kickass talk on Blue Teams as well. Purple teaming is what happens when you take defending your realm to a whole new level. Give it a read and see what you think.  “Top 4 Tips for Purple Team Exercises”

We have several really good infosec cons going on here in Canada. One of these is Hackfest, billed as the “largest hacking event in Canada”, and is held in la belle province, Quebec. which celebrated their 8th year. With the feel of DefCon, but at a much smaller scale, Hackfest invites the true spirit of exploration and hacking. Talks are diverse, concepts are challenging, and people are really friendly. But what Hackfest has become reknowned for is its CTF. I got to do my first CTF here this year, at a Saturday night party that was more fun than any I’ve been to in ages. Everyone was having a great time, playing together, enjoying the music and light show. Hats off to you, Hackfest!

Hackfest also features outstanding training courses – the kind that are really hard to get. I’m not there yet, but this year they had an intense Corelan course and yes, people were developing exploits within 2 days.

Then there were the talks. Where do I begin? Chris NIckerson brought it with his talk on Adversarial Simulation. The industry needs reform, and he outlined a ground-breaking, earth-shaking plan on how to get us where we need to be. To move beyond colours in a crayon box.  It’s about selling integrity with the service, actually making security happen even when it’s hard.  I talk about getting people out of their silos and collaborating – Chris and his compadres actually wrote the plan. Big things are in store, if we are willing to listen to some of the brightest and most experienced minds out there. 

My friend Stephanie Carruthers, #Sn0ww, enthralled (yes!) a roomful of attendees with how to do OSINT really well. She operates her own consulting business and advises clients on social engineering, vishing, phishing and some other dark arts.

@Renderman and pal, Murdoch Monkey, gave the talk everyone was talking about with “Hacking the Internet of Dongs.”  Because really, was there a better time and place to do this? How much fun can you have on a Saturday afternoon 😉

And I had the pleasure of giving a talk on revamping Blue Teaming with my buddy Haydn Johnson. There’s nothing like a shot of whiskey before giving a 10:00 am talk. We built it from a webinar we had given for Dark Reading on how to do effective IT threat security analysis. We delved into some of our favourite things: data, monitoring, data, context; more data, the enhanced cyber kill chain and the OODA loop. It was a fantastic experience and deserves its own post. See the prezzie at http://www.slideshare.net/haydnjohnson/blue-team-reboot-hackfest

Then, at 11:00 I got to talk about some of my favourite things in A Stuxnet for Mainframes. Yes! 2 talks at Hackfest. Poutine, sight seeing  – it all went by too quickly. But, there’s always next year. A bientot!

http://hackfest.ca/en/speakers/#mainframe