If you’ve ever seen me, or any of the NetWitness crew, speak on malware, advanced threats or the current threat environment, you’ll generally hear more than one recurring theme, one of which is:

Your anti-virus solution isn’t working like you think it is.

This is occurring for a variety of reasons and is ultimately the result of a business-based exploitation cycle in the criminal underground.   This cycle includes software support, licensing, and ongoing quality assurance.  One of the best examples I’ve ever seen to illustrate this concept is in the case of “scan4u.biz”.

Brian Krebs posted about this particular cybercrime endeavor in his blog here a few months ago:

http://krebsonsecurity.com/tag/scan4u-biz/

However, recent intelligence gathering efforts have revealed that this particular business venture has been extended and improved using the same resilience concepts used in most large legitimate corporate infrastructures.

A brief overview of “scan4u.biz”

Scan4u.biz is essentially  a “criminal virustotal plus”.  That is, it is a service where a miscreant can submit a newly created malware binary to gauge the detection rate of various antivirus vendors.  While similar to virustotal in this regard, the key is that scanned binaries aren’t submitted to the antivirus vendors in question, as is done with virustotal.

Let’s surf the service for examples:

What we see here is a general overview of the service (translated from russian) with the following key points:

• The service doesn’t submit to anti-virus vendors.
• Antivirus clients are updated hourly to maintain a current definition set
• Submitted binaries are rechecked on a schedule and customers are emailed about new detections

Digging deeper we see an example of the current signature state of included antivirus engines, which includes the vendor name, signature update version number and last update time:

And it’s even affordable and easy to pay for…$25 a month or 15 cents per scan, and a discount for referrals.  As well as flexible payment options and multiple contact points (I’ve blocked the specifics out):

How long has this service been running?

“News” updates indicate that this service has been running since at least October of 2009 and is being consistently upgrade and maintained:

How do we kill it?

So to take this down, we’d just get the domain name suspended right?   Well..it appears that that has already been done as is evident with a quick dig:

Not found: scan4u.biz

>>>> Whois database was last updated on: Sun May 30 14:07:49 GMT 2010 <<<<

So how is it still accessible?

At this moment, this service is being hosted or proxied through a criminal infrastructure, known in the industry as Gumblar.  Gumblar was recently referenced in a large scale compromise of blogs at most major hosting companies and has been an ongoing presence in the malware world for the past few  years.   At last check, the infrastructure has at least 376 verified domains, mostly in the .ru tld, across at least 43 different IPs in geographically disperse locations.

This hosting model is, in effect, a content distribution network, as used by most major online presences.  In this case, it’s being used to both hide the miscreants actual operating location, as well as provide fault tolerance from ongoing takedown efforts by the security community.

Extending beyond antivirus checks

As well as antivirus checks, the miscreants running the service appear to have extended their checks into the online blacklist area:

“Domain check on presence in black list: ZeuS domain blocklist, ZeuS IP blocklist, ZeuS Tracker, MalwareDomainList (MDL), Google Safe Browsing (FireFox), PhishTank (Opera, WOT, Yahoo! Mail), hpHosts, SPAMHAUS SBL, SPAMHAUS PBL, SPAMHAUS XBL, MalwareUrl,SmartScreen (IE7/IE8 malware & phishing Web site),Norton Safe Web, Panda Antivirus 2010, (Firefox Phishing and Malware Protection), SpamCop.net and RFC-Ignorant.Org.”

This update indicates ongoing blacklist checks across a variety of services, including:

• Security researcher and community published blacklists (zeustracker, malwaredomainlist,malwareurl,phishtank,spamhaus)
• Browser-based anti-phishing technology (google safe browsing,smartscreen)
• Vendor blacklists (Norton, Panda, etc)

So in essence, miscreants using this service have a one-stop shop for both the detection of malicious binaries as well as the existence of their delivery systems in disparate blacklists across the internet.

They also understand researcher and malware analysis activity:

“Add ability to get execution result of find/pdfid/pefile/trid utility (“Save file on server” option must be on)”

• PDFID is Didier Steven’s excellent PDF analysis tool.
• PEFILE  is a python module used to assist in reverse engineering binaries to detect packing and other indicators of maliciousness.
• TRID is a tool used to identify files from their binary signatures.

What all of this should tell you is that criminal miscreants continue to upgrade and enhance their services to assist in perpetuating their business model, penetrate your networks, and make money!

Watch your network, because they certainly are!

Alex Cox, Principal Research Analyst

There was a significant amount of coverage yesterday on research performed by NetWitness into a large set of stolen information recovered from a ZeuS botnet.  Some of the information, analysis, and commentary was very beneficial to the broader discussion of threats such as these.  There is, however, some information that we feel we should address.

• Kneber is a pseudonym for ZeuS:

Kneber is not a pseudonym for ZeuS. Kneber refers to one group of organized criminals, one group of Command and Control Systems, and 74,000+ infected victim systems for this particular ZeuS (primarily) botnet.   ZeuS is a tool, used by many groups to create command and control systems, and steal information.  There are hundreds of active ZeuS botnets, many of which are larger than this one. It is but one of many tools used in this particular botnet.  We have seen INTENTIONAL cross pollination of various trojans, including waledec, grum, and even tools such as packet sniffers.  When we discuss threat, we are referring to more than the tool used, but the organization behind them.

• Kneber is “nothing new”:

We have been very clear that this is a medium sized infestation when compared with all the tracked ZeuS botnets on the Internet.   What does make this very valuable is the opportunity to analyze such a large sample of stolen information, and quantitatively add to the discussion of threats to corporate security.  The number of infected and active systems behind some of the largest, most technology savvy companies needs to be considered, and our approach to security needs to change given the broad failure to identify or remediate these infestations.   In addition, trivializing the damage done is simply disingenuous by anyone who has seen the types of data stolen from threats such as these.

• Current protections and solutions can detect this type of activity:

This quote from Symantec, via the Guardian, KrebsOnSecurity, and others:

“Kneber, in reality, is not a new threat at all, but is simply a pseudonym for the infamous and well-known Zeus Trojan,” said the company. “The name Kneber simply refers to a particular group, or herd, of zombie computers, a.k.a. bots, being controlled by one owner. The actual Trojan itself is the same Trojan.Zbot, which also goes by the name Zeus, which has been being observed, analyzed and protected against for some time now.”

This quote is particularly troubling, as it seems to minimize the threat and is almost dismissive.   Moreover, when this particular variant was analyzed in late January (various services used), Symantec did NOT detect this as malicious.   To be fair, McAfee, Trend Micro, AVG, and most other mainstream anti-virus solutions also failed to recognize this as malicious.  In the past 3 weeks, Symantec has added signatures to detect this particular variant as a generic “Trojan Horse”.  However, if you were infected by this particular strain, your system has already processed an update that prevents you from contacting Symantec and others for updates.   In most cases, this will prevent future detection.   Worse, as part of normal operation of ZeuS, it attaches to running processes on victim systems in order to monitor them.   This data is logged along with other stolen information.   This set of data shows that ZeuS has actually attached to running versions of Symantec software on over a thousand victim systems.  Many other AV vendors are also present.

This example shows ZeuS monitoring a Symantec Live Update, and includes the ftp username and password used by the Symantec software during the update process.

• Are the facts overstated?:

The facts are fairly succinct in the whitepaper that we released.   We do not believe the threat is over-stated, and we were very conservative on the analysis released.   There are likely thousands of additional corporate networks affected, and analysis of this much information takes time.   And this is simply one of many similar operations in existence.  The group behind this effort can be described as sophisticated, yet also shows signs of lax effort to hide their trails.   The botnet is very actively managed, and continues in operation today.   The fact that they have been in successful operation for over 18 months also has to be considered.   We have also received several additional data points from federal contacts with additional insight into related government focused attacks.

More to come.

Tim Belcher and Alex Cox

While the world took pause to consider the implications of Operation Aurora, and Google lent considerable voice to the concept of Advanced and Persistent Threats (APT), we can ill-afford to believe even for a moment that they are alone in their sophistication or capability.   According to the FBI more than 100 nations have offensive cyber operations as part of their intelligence or national security fabric.  And the same attributes that make the Internet ideal for covert intelligence gathering make it attractive for corporate espionage and organized criminal activity.  The IT security industry commonly refers to the online activities of Eastern European and Asian organized crime as “cyber criminals” or “gangs”, which in many ways only serves to minimize the attention they deserve.  In truth the online operations of some organized crime syndicates are every bit as sophisticated, advanced and persistent as their nation-state counterparts.  They are truly expert at gaining footholds and siphoning off critical information.  And they are FAR more pervasive than Operation Aurora.

In late January, NetWitness security research were able to gain visibility into a large scale ZeuS-based botnet, taking user credentials and confidential information from thousands of organizations around the world (See The Wall Street Journal article).  Some of the information collected has been synthesized in the Kneber Bot whitepaper that you can dowload from the NetWitness website.

The sheer volume of information gathered and has forced us to reconsider the common belief that this very successful botnet is simply “financial services” related.  In fact, this particular botnet was much more concerned with culling account and network access credentials, as well as collecting as much detail about victim identities as possible.  In effect, they were less concerned with accessing any particular account, than being able to access ALL accounts related to a victim.

As we began analyzing victim information, we rapidly formed a picture of thousands of corporate compromises around the globe.  As with Aurora, many of the largest most technology savvy companies had internal compromised hosts, which had culled various corporate user level and administrative credentials.

We may attempt to broadly classify threats in the security industry, in hopes that we can make the complex more digestible to management.  However, classifying threats like this as “banking trojans” may do a large disservice to the victim companies.  Indeed, there are many that broadly dismiss threats such as these as “unsophisticated”, or less advanced than a pinpoint attack like Operation Aurora.  Rest assured, these adversaries could not care less how we classify their work.  They are well organized, have demonstrated technical sophistication on par with many intelligence services and do not forgo the opportunity for financial gain with the the information they collect.  If they are collecting network credentials, it means they are using or selling them in an active underground economy – which may include sponsoring foreign intelligence services. What is easier? Designing a campaign like Operation Aurora, or simply purchasing access to your target companies?

We are working with federal law enforcement, and continue in our efforts to notify victim organizations.  Please feel free to download our white paper and I am confident we will discuss great detail in future blog posts.