Today we will be reviewing a cybercriminal’s recipe for success:
- Hacking LinkedIn’s password (and possibly user-) database.
- Sending an email to all obtained email addresses, which is urging you to check your LinkedIn inbox as soon as possible.
- A user unawarely clicking on the link.
- An exploit gets loaded. Malware gets dropped. Malware gets executed.
- User’s computer is now a zombie (part of a botnet).
I was forwarded an email that appeared to come from LinkedIn. The email was inviting you to check your LinkedIn Inbox. As you know, LinkedIn was hacked some time ago and passwords were compromised in the attack. I believe however that (a part of) the user-database was breached as well.
If we verify the “To” and “CC” fields of this email, we see about 100 other recipients. A quick look-up of a few of them on LinkedIn reveals the unconvenient truth… Here’s the email in question:
Subjects of this email might be:
“Relationship LinkedIn Mail“, “Communication LinkedIn Mail”, “Link LinkedIn Mail” or “Urgent LinkedIn Mail“. No doubt the subjects of this email will vary, and are not limited to these four.
Step 1 and step 2 of the cybercrook’s scheme are already fulfilled. Now he just has to wait until someone clicks on one of the links. Which brings us to point 3.
Suppose someone clicks on the link. What will happen exactly ? This depends on the version of these programs that may be installed on your computer:
- Adobe Reader
- Java
In some cases, your browser will crash. In other cases, the page will just appear to sit there and nothing happens. In unfortunate cases, the exploit will begin doing its work. As said before, a mixed flavor of Adobe & Java exploits are used.
In this case, we will review the specific Adobe exploit. We will check with Process Explorer what exactly is happening:
What’s this ? There’s a process from Adobe Reader loaded under our Internet Explorer ? Which seems to spawn a .dll file, which in turn spawns another file… Okay, you get the point here. Your machine is executing malware and is in the process of being infected.
You might get the following message from Adobe Reader, stating it has crashed (this is due to the exploit):
After the user clicks OK, everything looks fine. Right ? No, of course not. Ultimately, there’s a malicious executable which will start every time the computer boots.
The exploits’ source is probably the Blackhole exploit kit. The exploits in question are:
CVE-2006-0003
CVE-2010-0840
Unknown (at this point) Adobe Reader exploit
Step 3 and 4 have also been accomplished now. The user clicked on the link, the exploit(s) got loaded and the user is now infected.
The malware will try to phone home or connect to the following IP addresses:
188.40.248.150
46.105.125.7
The IPs above (188.40.248.150 in particular) are part of a known botnet. The IPs are used to receive new instructions from the botherder or to download additional malware.
After all 4 steps have been executed, Step 5 of the process is completed as well and the machine will be successfully part of a botnet. In particular, the Zeus botnet.
Conclusion
Today’s lesson is a very important one and is one of the basics of security:
PATCH PATCH PATCH people ! Keep ALL of your software up-to-date ! This means Adobe, Java, but don’t forget other software, for example VLC, Windows Media Player…. You get the picture.
This also includes installing your Windows patches, keeping your browser up-to-date as well as any plugins or add-ons you might have installed.
If possible, avoid using Adobe and/or Java. There are other (also free) alternatives on the market.
Finally, use an up-to-date Antivirus product to keep your machine safe should you not have done any patching. Several of Panda’s products use heuristics to determine if an exploit is being loaded on the system or a process is being injected into another process.
Tuesday, June 12, 2012
LinkedIn spam, exploits and Zeus: a deadly combination ?
Is this the perfect recipe for a cybercriminal ?:
- Hacking LinkedIn’s password (and possibly user-) database.
- Sending an email to all obtained email addresses, which is urging you to check your LinkedIn inbox as soon as possible.
- A user unawarely clicking on the link.
- An exploit gets loaded. Malware gets dropped. Malware gets executed.
- User’s computer is now a zombie (part of a botnet).
I would definitely say YES.
A reader of my blog contacted me today, he had received an email from LinkedIn which was looking phishy. We can verify that Step 1 is accomplished, by the simple fact that in the “To” and/or “CC” field of the email below, there are about ~100 email addresses. A quick look-up of a few of them on LinkedIn reveals the unconvenient truth…
Here’s the email in question:
Reminder from LinkedIn. You got a new message !
Subjects of this email might be:
“Relationship LinkedIn Mail“, “Communication LinkedIn Mail“, “Link LinkedIn Mail” or “Urgent LinkedIn Mail“. No doubt the subjects of this email will vary, and are not limited to these four.
Step 1 and step 2 of the cybercrook’s scheme are already fulfilled. Now he just has to wait until someone clicks on one of the links. Which brings us to point 3.
Suppose someone clicks on the link. What will happen exactly ? This depends on the version of these programs that may be installed on your computer:
- Adobe Reader
- Java
In some cases, your browser will crash. In other cases, the page will just appear to sit there and nothing happens. In unfortunate cases, the exploit will begin doing its work. As said before, a mixed flavor of Adobe & Java exploits are used.
In this case, we will review the specific Adobe exploit. We will check with Process Explorer what exactly is happening:
The green highlighting indicates the spawning of a new process
What’s this ? There’s a process from Adobe Reader loaded under our Internet Explorer ? Which seems to spawn a .dll file ? Which in turn spawns another file …. Okay, you get the point here.
The PDF file has several embedded files, which are dropping malicious executables and executing them. After the process of spawning and dropping processes and executables, the malware will also clean-up any leftovers, including the PDF file at first:
Message from Adobe Reader it has crashed. Have a guess why
After the user clicks OK, everything looks fine. Right ? No, of course not. Ultimately, there’s a malicious executable which will start every time the computer boots.
Interesting to note is, that there is also an attempt to exploit CVE-2006-0003. An exploit from 2006 nonetheless !
Step 3 and 4 have also been accomplished now. The user clicked on the link, the exploit(s) got loaded and the user is now infected. With what you may ask ? Well, let’s review all the associated files:
The initial Java exploit – set.jar –
(when I first uploaded this sample a few hours before this blogpost, there were ZERO detections)
Result: 2/42
MD5: b0697a5808e77b0e8fd9f85656bd7a80
VirusTotal Report
ThreatExpert Report
I just now re-uploaded set.jar (17:47:41 UTC), it has now 6 detections. Most probably the Blackhole exploit kit is responsible for this attack. Microsoft identifies the file as
“Exploit:Java/CVE-2010-0840.NQ“.
The corresponding CVE can be found here.
“I got Java patched, always“, you might say. Great ! How about Adobe Reader ?
c283e[1].pdf
Result: 11/38
MD5: ad5c7e3e018e6aa995f0ec2c960280ab
VirusTotal Report
PDFXray Report
MWTracker Report
Thanks to PDFiD, we are able to see there’s an AcroForm action and 6 embedded files. Basically, AcroForm is just another way to execute JavaScript in a PDF document. Embedded files are… files hidden in your PDF document:
PDFiD results
Here’s our first dropped file – calc[1].exe
Result: 5/38
MD5: 4eead3bbf4b07bd362c74f2f3ea72dc4
VirusTotal Report
ThreatExpert Report
Anubis Report
Calc[1].exe will drop other files. Examples:
amutwa.exe
Result: 9/42
MD5: e7e25999ef52e5886979f700ed022e3d
VirusTotal Report
ThreatExpert Report
Anubis Report
nyyst.exe
Result: 10/42
MD5: fbc4bb046449fd9cef8a497941457f4f
VirusTotal Report
ThreatExpert Report
Anubis Report
The malware will try to ‘phone home’ or connect to the following IP addresses:
188.40.248.150 – IPVoid Result
46.105.125.7 – IPVoid Result
The IPs above (188.40.248.150 in particular) are part of a known botnet.
After all 4 steps have been executed, Step 5 of the process is completed as well and the machine will be successfully part of a botnet. The Zeus botnet. For more information about Zeus, you can read upon the (limited in information, but sufficient) Wikipedia article:
Zeus (Trojan Horse)
There are also numerous articles on the Zeus botnet, the takedowns by Microsoft (whether they were successful or not, I’ll leave in the middle), and many other reports.
Conclusion