Ramnit evolves into a financial malware (Aug 25, 2011)

/in /by

SonicWALL UTM Research team received reports of a new variant of Ramnit malware spreading in the wild.

The Ramnit malware family is known for following capabilities:

  • File infector: infects files with EXE, DLL, SCR, HTM and HTML extensions by appending its code.
  • Network propagation: Spreads via network shares and USB devices.
  • Backdoor: Creates a backdoor where it can receive remote instructions.
  • Steals FTP credentials and browser cookies.

The latest variant also incorporates Zeus-like Man-in-the-Browser (MitB) web inject functionality to steal Online Banking credentials. It is highly likely that some modules of the Zeus source code (leaked earlier this year) have been integrated into it.

The sample under investigation performs following activities on the infected system:

  • Creates a copy of itself as (Local Settings)Tempdbsoowwjviewtmlp.exe (random filename generated per system).

  • Initiates two instances of svchost.exe processes and injects code into it.

  • Infects executable files having .EXE and .DLL extensions by appending malicious code to the files. Below is a sample list of files under Program Files that were infected:
    • AdobeReader 9.0ReaderLogTransport2.exe
    • AdobeReader 9.0Readerpe.dll
    • AdobeReader 9.0Readersqlite.dll
    • Common FilesAdobeAcrobatActiveXAcroIEHelper.dll
    • Common FilesAdobeAcrobatActiveXAcroPDF.dll
    • Common FilesAdobe AIRVersions1.0Resourcestemplate.exe
    • Common FilesDESIGNERMSADDNDR.DLL
    • Common FilesJavaJava Updatejusched.exe
    • Common FilesMicrosoft SharedMSDesigners7MSVCP71.DLL
    • Common FilesMicrosoft SharedOFFICE11MSO.DLL
    • Common FilesMicrosoft SharedOFFICE11MSSOAP30.DLL

    The infected executable files will have an additional section containing malicious code:

    screenshot
    screenshot

  • Makes registry modifications to launch itself upon system reboot. It also disables the Windows Safe Mode feature by deleting registry keys from following locations:
    • HKLMSYSTEMControlSet001ControlSafeBootMinimal
    • HKLMSYSTEMControlSet001ControlSafeBootNetwork
    • HKLMSYSTEMCurrentControlSetControlSafeBootMinimal
    • HKLMSYSTEMCurrentControlSetControlSafeBootNetwork

    Subsequent attempts to reboot infected system in Safe Mode will result in Blue Screen of Death (BSoD) crash.

    screenshot
    screenshot

  • Opens a backdoor Secure FTP server on TCP port 22 on the infected system.

    screenshot

  • Connects to a remote C&C server at carr(REMOVED)ezz.com using SSL connection to receive instructions.

SonicWALL Gateway AntiVirus provides protection against this threat via following signatures:

  • GAV: Ramnit.D (Trojan)
  • GAV: Ramnit.D_2 (Trojan)

RealPlayer QCP File Parsing Buffer Overflow (Aug 25, 2011)

/in /by

The QCP file format is used by many cellular telephone manufacturers to provide ring tones and record voice. It is based on RIFF, a generic format for storing chunks of data identified by tags. The QCP format does not specify how voice data in the file is encoded. Rather, it is a container format. The detailed QCP file format is defined in RFC3625

RealPlayer is a cross-platform media player by RealNetworks that plays a number of multimedia formats including MP3, MPEG-4, QuickTime, Windows Media, QCP, and multiple versions of proprietary RealAudio and RealVideo formats.

A heap-based buffer overflow vulnerability exists in RealPlayer. Specifically, the vulnerability occurs while processing fmt chunks in QCP files. An attacker can exploit this vulnerability by enticing a user to open a specially crafted QCP file using RealPlayer. Successful exploitation would allow for arbitrary code injection and execution with the privileges of the currently logged in user. Code injection that does not result in execution would terminate the application.

The vulnerability has been assigned as CVE-2011-2950.

SonicWALL has released an IPS signature to detect and block known exploits targeting this vulnerability. The following signature was released to address this issue:

  • 1569 – RealNetworks RealPlayer QCP File Parsing Buffer Overflow

Mozilla Firefox mChannel Use After Free (Aug 19, 2011)

/in /by

Mozilla Firefox is a web browser developed by the Mozilla Foundation. Firefox is capable of rendering multiple types of content such as HTML, XML, XUL, JavaScript, and popular media formats among others. Firefox is distributed for all major platforms such as Windows, Apple, and Linux. The Cross Platform Component Object Model (XPCOM) is a component oriented software framework produced by the Mozilla Foundation. It is similar to Microsoft’s Component Object Model (COM). Mozilla’s Gecko layout engine is XPCOM based as is the DOM implementation. XPCOM has many language bindings, and can be accessed via JavaScript. All XPCOM interfaces inherit from the base interface nsISupports, which has the following methods:

 nsrefcnt AddRef(); void QueryInterface( in nsIIDRef uuid, [iid_is(uuid),retval] out nsQIResult result); nsrefcnt Release();

The QueryInterface method is used for type discovery, and performs a type casting function. It returns the interface pointer. An example is shown of obtaining an object implementing the nsIChannelEventSink interface in JavaScript:

 obj.QueryInterface(Components.interfaces.nsIChannelEventSink)

The nsIChannelEventSink interface is shown to provide the following methods:

 void asyncOnChannelRedirect(in nsIChannel oldChannel,         in nsIChannel newChannel, (Firefox 4+)        in unsigned long flags,        in nsIAsyncVerifyRedirectCallback callback); void onChannelRedirect( in nsIChannel oldChannel,        in nsIChannel newChannel,        in unsigned long flags);

The function asyncOnChannelRedirect is an asynchronous replacement for onChannelRedirect. These methods are called when a redirect occurs, such as when triggered by a 3xx HTTP status code. The onChannelRedirect method implementation for HTML objects contains a use after free flaw.
In order to exploit this vulnerability, a remote attacker would have to entice the target user to open a crafted web page. Successful exploitation could allow the attacker to execute arbitrary code on the vulnerable system in the security context of the browser. An unsuccessful exploitation attempt could result in the abnormal termination of the browser. Use after free vulnerabilities are generally difficult to exploit successfully for code execution, hence the most likely outcome of an attack attempt would result in a browser crash.

SonicWALL has released the following IPS signature to address this threat:

  • 1497 – Mozilla Firefox onChannelRedirect Method Invocation

Additionally, SonicWALL has multiple existing IPS signatures that detect and block suspected heap spray methods which would most likely be used in attacks targeting this type of vulnerability. These signatures serve as a pro active defense against the most popular HTML based attacks.

This vulnerability has been assigned CVE-2011-0065 by mitre.
The vendor has released an advisory addressing this issue.

Android Malware Nickispy.C snoops on Users (Aug 18, 2011)

/in /by

SonicWALL UTM Research team received reports of a new variant of AndroidOS malware Nickispy that can record phone calls, log call details, sms messages, gps locations, and copy contact informations and eventually sends them to remote server.

This malware was seen hosted in a chinese website riding on the popularity of recently released social networking service Google+ as evident on its use of installed application – “Google++”.

    screenshot

Users are advised against installing third-party applications from unknown or untrusted sources and to be wary of request for suspicious permissions during installation.

Once the malware is downloaded and executed, it requests for the following permissions during installation:

    screenshot

Take note of unnecessary permissions requested by the malware such as able to intercept outgoing calls, edit SMS or MMS and record audio. These permissions should raise the user’s suspicion that the application could be on to some phony activities.

Installed services include the following:

    screenshot

It also uses the following services:

  • CallLogService
  • CallRecordRegisterService
  • CallRecordService
  • CallsListenerService
  • ContactService
  • GpsService
  • KeyguardLockService
  • LocationService
  • ScreenService
  • SendResultService
  • SMSControllerService
  • SyncContactService
  • UploadService

Once installed, this malware performs the following:

  • Record Calls:
      screenshot
  • Record GPS Locations:

      screenshot

  • Logs SMS Messages:
      screenshot
  • It eventually uploads collected data to a remote server:
      screenshot
    • Remote Server: cs.{removed}ng.com
      Port: 2018

This malware is also known as Trojan-Spy.AndroidOS.Nickspy.g [Kaspersky], AndroidOS_NICKISPY.C [TrendMicro] and TrojanSpy:AndroidOS/Nickispy.B [Microsoft]

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

  • GAV: AndroidOS.Nickispy.C (Trojan)

New banker Trojan steals information via compromised webservers (Aug 10, 2011)

/in /by

The Sonicwall UTM research team received reports of a new Banking Trojan spreading in the wild. The Trojan spreads through email and steals banking credentials from customers of BBVA bank. The email that is spread falsely reports that the long-time dictator of Cuba, Fidel Castro had died from a sudden heart attack at his residence. The email uses 2 links: “click on the image” and “Play video” that lead to the download of the Trojan executable file:

The links to the Trojan are hosted on compromised webservers:

  • http://www.chem{removed}.co.uk/24horasnoticias.exe
  • http://www.ferienwoh{removed}-vk.de/lightbox/js/24horasnoticias.exe
  • http://web4.au{removed}.org/bird/cbc/pdf/24horasnoticias.exe

The downloaded file uses the following icon:

Once run, this initial dropper Trojan adds the following file to the filesystem:

  • C:09342.exe [Detected as GAV: Dapato.HEM (Trojan)]

The following request was observed when obtaining 009342.exe. This file is a spreader Trojan and is downloaded from a predetermined list of compromised remote webservers:

C:09342.exe is executed and makes the following changes to the filesystem:

  • C:Documents and SettingsAll UsersApplication DataLupitaLupita.exe [Detected as GAV: Banker.SKQG (Trojan)]

C:09342.exe makes the following change to the windows registry to enable startup of the main banking Trojan:

  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “C:Documents and SettingsAll UsersApplicationDataLupitaLupita.exe”

C:09342.exe was also seen scanning all directories on the filesystem for .dbx files in an attempt to gather email addresses for further spreading.

The dropped executable (Lupita.exe) is the main banker Trojan. The Trojan binary contains the following links:

  • http://www.hidro{removed}.com.br/img_site/addo.php
  • http://www.holi{removed}.info/features/addo.php
  • http://h1655219.stra{removed}.net/wework/js/addo.php
  • http://www.hippodr{removed}.com//Hippodrome/Les_partenaires/del.php
  • http://www.houseimm{removed}.it/php/del.php
  • http://icomiarr{removed}.net//del.php
  • http://www.ihp-e{removed}.be/espoir/wii.php
  • http://www.hw{removed}.com/modules/wii.php
  • http://www.group{removed}.com/gosier//images/people/wii.php
  • http://www.f{removed}.at//newpics/tr/up7.exe.bak
  • http://mox{removed}.vn//images/up7.exe.bak
  • http://www.flc{removed}.com.tw/html/up7.exe.bak
  • http://www.marath{removed}.com//images/sd/up7.exe.bak
  • http://www.ecuriesdupa{removed}.com//agb/config/up7.exe.bak
  • http://www.designs{removed}.com/portfolio/we/up7.exe.bak

The links are used for receiving stolen banking credentials from the Trojan.

Lupita.exe uses the following icon:

After reboot and an undertermined period of time the Trojan (Lupita.exe) will spawn a BBVA bank login page in place of the Windows desktop background. The page cannot be closed unless the process is killed:

In an attempt to appear legitimate, the page contains genuine warnings about online banking security. One warning roughly translates to:

  • "If you get a few emails or enter a screen where you apply all your card numbers secure password, do not give any help and contact information online at 600 600 1100"

The page does however ask for your BBVA bank logon credentials. This information is posted to a remote webserver:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

  • GAV: Banker.SKQG (Trojan)
  • GAV: Dapato.HEM (Trojan) (Trojan)

Microsoft Security Bulletin Coverage (Aug 9, 2011)

/in /by

SonicWALL has analyzed and addressed Microsoft’s security advisories for the month of August, 2011. A list of issues reported, along with SonicWALL coverage information follows:

MS11-057 Cumulative Security Update for Internet Explorer

  • Window Open Race Condition Vulnerability – CVE-2011-1257
    This is a race condition. Not detectable by an IPS appliance.
  • Event Handlers Information Disclosure Vulnerability- CVE-2011-1960
    This is a logical flaw in the script engine of IE. Normal traffic is not distinguishable from malicious traffic.
  • Telnet Handler Remote Code Execution Vulnerability – CVE-2011-1961
    This is a binary planting vulnerability in the telnet scheme handler.
    IPS 6847 Possible Binary Planting Attempt 3
  • Shift JIS Character Encoding Vulnerability – CVE-2011-1962
    This is a logical flaw in the script engine of IE. Normal traffic is not distinguishable from malicious traffic.
  • XSLT Memory Corruption Vulnerability – CVE-2011-1963
    IPS 6848 MS IE XSLT Memory Corruption Attack Attempt
  • Style Object Memory Corruption Vulnerability – CVE-2011-1964
    This is a logical flaw in the script engine of IE. Normal traffic is not distinguishable from malicious traffic.
  • Drag and Drop Information Disclosure Vulnerability – CVE-2011-2383
    This is a logical flaw in the script engine of IE. Normal traffic is not distinguishable from malicious traffic.

MS11-058Vulnerabilities in DNS Server Could Allow Remote Code Execution

  • DNS NAPTR Query Vulnerability – CVE-2011-1966
    IPS 1371 Suspicious DNS Traffic 3
  • DNS Uninitialized Memory Corruption Vulnerability – CVE-2011-1970
    There is no method of detecting attacks targeting this vulnerability. An attack is not distinguishable from valid scenario.

MS11-059 Vulnerability in Data Access Components Could Allow Remote Code Execution

  • Data Access Components Insecure Library Loading Vulnerability – CVE-2011-1975
    IPS 5726 Possible Binary Planting Attempt

MS11-060 Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution

  • pStream Release RCE Vulnerability – CVE-2011-1972
    IPS 1374 Malformed Visio Document 1b
  • Move Around the Block RCE Vulnerability – CVE-2011-1979
    IPS 1388 Malformed Visio Document 2b

MS11-061 Vulnerability in Remote Desktop Web Access Could Allow Elevation of Privilege

  • Remote Desktop Web Access Vulnerability – CVE-2011-1263
    IPS 6843 Remote Desktop Web Access XSS

MS11-062 Vulnerability in Remote Access Service NDISTAPI Driver Could Allow Elevation of Privilege

  • NDISTAPI Elevation of Privilege Vulnerability – CVE-2011-1974
    This is a local vulnerability.

MS11-063 Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege

  • CSRSS Vulnerability – CVE-2011-1967
    This is a local vulnerability.

MS11-064 Vulnerabilities in TCP/IP Stack Could Allow Denial of Service

  • ICMP Denial of Service Vulnerability – CVE-2011-1871
    This is a logical vulnerability. There is nothing distinguishable in attack traffic from normal traffic.
  • TCP/IP QOS Denial of Service Vulnerability – CVE-2011-1965
    This is a logical flaw which manifests itself in certain configurations of the vulnerable product. There is nothing distinguishable in attack traffic from normal traffic.

MS11-065 Vulnerability in Remote Desktop Protocol Could Allow Denial of Service

  • Remote Desktop Protocol Vulnerability – CVE-2011-1968
    This is a race condition. Not detectable by an IPS appliance.

MS11-066 Vulnerability in Microsoft Chart Control Could Allow Information Disclosure

  • Chart Control Information Disclosure Vulnerability – CVE-2011-1977
    IPS 6845 Chart Control Information Disclosure Attempt

MS11-067 Vulnerability in Microsoft Report Viewer Could Allow Information Disclosure

  • Report Viewer Controls XSS Vulnerability – CVE-2011-1976
    IPS 6844 Report Viewer Controls XSS Attempt

MS11-068 Vulnerability in Windows Kernel Could Allow Denial of Service

  • Windows Kernel Metadata Parsing DOS Vulnerability – CVE-2011-1971
    This is a local vulnerability.

MS11-069 Vulnerability in .NET Framework Could Allow Information Disclosure

  • Socket Restriction Bypass Vulnerability – CVE-2011-1978
    This is a local vulnerability.

Spygold trojan found in rogue android application (Aug 3, 2011)

/in /by

SonicWALL UTM Research team received reports of a rogue android gaming application spreading in the wild. The rogue application is a modified version of a legitimate game available on the android market. The modified application was found spying on call logs and text messages. SonicWALL advices users against installing applications from untrusted sources and to be wary of applications that request for suspicious permissions.

When the rogue application is downloaded and executed, it requests for the following permissions:

screenshot

It performs the following activities when installed:

  • It stores calls logs and text message periodically to the following locations
      screenshot
  • The contents of the files storing call logs and text messages are shown below:
    • zjphonecall.txt:

      screenshot

    • zjsms.txt:

      screenshot

  • It ensures service is started on reboot of the phone
      screenshot
  • It scrounges device information
    • Grabs IMEI, IMSI and SIM number
      screenshot
  • It uploads collected data to a remote server
    • http://{removed}.net/zj/upload/UploadFiles.aspx

SonicWALL Gateway AntiVirus provides protection against this threat with the following signature:

  • GAV: AndroidOS.spygold (Trojan)

    • Apple Safari WebKit SVG Memory Corruption (Aug 1, 2011)

    /in /by

    Safari is a web browser developed by Apple Inc. and included with the Mac OS X and iOS operating systems. The browser is capable of processing HTML, images, scripting languages, and various other media formats. Safari is based on Apple’s internal fork of the KHTML rendering engine, called WebKit. WebKit provides the WebCore HTML parser and the JavaScriptCore JavaScript engine.

    The Document Object Model (DOM) is a cross-platform and language-independent convention for representing and interacting with objects in HTML, XHTML and XML documents. DOM has a hierarchical structure in which HTML tag and attribute data is stored as elements of this hierarchy. WebKit supports manipulation of DOM objects via “client-side” scripting (e.g. JavaScript), allowing for dynamic modification of an HTML document.

    Scalable Vector Graphics (SVG) is a family of specifications of an XML-based file format for describing two-dimensional vector graphics, both static and dynamic. The SVG specification is an open standard that has been under development by the World Wide Web Consortium (W3C) since 1999. SVG is supported by most modern web browsers, including Safari.

    A memory corruption vulnerability has been found in the WebKit component of Safari. The vulnerability is due to the corruption of certain pointers in DOM objects relating to SVG elements. An attacker can exploit this vulnerability to inject and execute malicious code in the security context of the logged in user.

    SonicWALL UTM team has researched this vulnerability and created the following IPS signatures to capture the attacks in the wild.

    • 1149 Apple Safari SVG Object Memory Corruption 1
    • 1158 Apple Safari SVG Object Memory Corruption 2

    This vulnerability has been referred by CVE as CVE-2011-0222.

    libsndfile PAF File Integer Overflow (July 28, 2011)

    /in /by

    libsndfile is a widely-used C library for reading and writing audio files. It supports a wide variety of audio encodings and sound file formats and will convert automatically from one to another. In addition to the library itself, the package provides command-line programs for converting one format to another (sndfile-convert), for playing audio files (sndfile-play), and for obtaining information about the contents of an audio file (sndfile-info).

    libsndfile supports many different audio file formats, including Creative Technology’s (formerly Ensoniq’s) Professional Audio Recording Integrated System (PARIS) Audio Format (PAF). The PAF is a linear Pulse-code modulation (PCM) based format that can store 8, 16, or 24-bit samples. The format of the PAF file header is:

     Offset Length Description ----------------------------------------------------------------------- 0x0000 4 File format marker (also determines header endianess) 0x0004 4 Version 0x0008 4 Endianess specification 0x000C 4 Sample rate 0x0010 4 Format (sample size) 0x0014 4 Number of Channels 0x0018 4 Source

    An integer buffer overflow vulnerability exists in the PAF processing code of the libsndfile library. The vulnerable codes do not validate the provided PAF file data when it’s calculating the memory size to allocate, which may cause an integer overflow. A remote, unauthenticated attacker can exploit this vulnerability to inject and execute arbitrary code in the context of the affected user.

    SonicWALL UTM team has researched and analyzed this vulnerability. Two IPS signatures have been created to detect/prevent the attacks addressing this issue.

    • 1109 libsndfile PAF File Integer Overflow 1
    • 1111 libsndfile PAF File Integer Overflow 2

    This vulnerability has been assigned by CVE as CVE-2011-2696

    Wrong Hotel transaction spam campaign (July 28, 2011)

    /in /by

    SonicWALL UTM Research team observed a new spam campaign pretending to be from known hotels like Embassy suites, Marriott, etc in the wild. The e-mail contains an apology note from Hotel’s reservation department listing details about a wrong transaction applied to your credit card. It further asks the user to download and fill out the refund form attached with the e-mail. The e-mail attachment is a zip file which contains a malicious Fake AV Downloader Trojan executable.

    A sample e-mail message looks like:

    screenshot

    A sample list of e-mail subjects showing various Hotels masqueraded in this campaign till now:

    screenshot

    The executable file inside the zip attachment has an icon disguised as a Microsoft Excel file:

    screenshot

    The file if executed will perform activity similar to what we have seen in previous variants:

    • Creates a process SVCHOST.EXE and injects code into it.

    • Reports the infected machine to a server on domain yomwar(REMOVED).ru by sending the following GET request:
      • GET /forum3/task.php?bid=a67a41eXXXXX23&os=5-1-2600&uptime=0&rnd=229125

    • Drops following files
      • (Startup)dxdiag.exe [Copy of itself that starts upon system re-boot and runs the Fake AV]
      • (Application Data)gL11000PgAgJ11000gL11000PgAgJ11000.exe [GAV: Fakesysdef.BDO (Trojan) downloaded from radio-80.com

        • ]

    • Deletes the original copy of the file.

    • Runs the downloaded new Fake AV Trojan variant which performs following activity after a 500 milisecond sleep:
      • Displays multiple fake infections in Rogue AV GUI

        • screenshot

      • Unlike previous Fake AV variants it does not hide the user program files but instead makes them unusable. It terminates any user initiated processes displaying a fake alert message

        • screenshot

      • Prompts user to purchase the full version in order to clean up the fake infections

        • screenshot

    SonicWALL Gateway AntiVirus provides protection against this threat via following signatures:

    • GAV: Injecter.GFY (Trojan)
    • GAV: Zbot.ASK_2 (Trojan)
    • GAV: Kryptik.QUV (Trojan)