honeyblog

25C3: "Banking Malware 101" Slides

Tuesday, December 30. 2008

The slides I used for my presentation at the 25th Chaos Communication Congress (25C3) are now available for download. The presentation was also recorded and should be available in the next few days at http://ftp.ccc.de/congress/25c3/pre-release/. The congress was a lot of fun, unfortunately I had to leave earlier...

An interesting presentation is scheduled for today at 15:15 CET: Jacob and Alex talk about Making the theoretical possible. Not many details are available (see the "abstract" at the left-hand side), but it seems like they found something big that basically affects everyone. Rumors are that they broke a Root CA key that is included in major browsers - the truth will be revealed in a couple of hours...

Posted by Thorsten Holz in honeynets, malware at 11:47 | Comments (0) | Trackbacks (0)

Analyzing Malicious PDF Files

Monday, December 22. 2008

Recently we added a new feature to cwsandbox.org: It is now also possible to upload suspicious PDF files that are then analyzed with the help of CWSandbox. Basically we open the submitted file with Acrobat Reader 8.1.1 since that version has several vulnerabilities. During runtime, we then observe the behavior of Acrobat and can detect suspicious changes such as new files on the hard disk or modified registry keys. Based on the generated report, it is then possible to detect malicious PDF files.

An example of such an analysis is available at https://cwsandbox.org/?page=details&id=520505&password=sfgpk. The PDF file 0416.pdf is malicious and has a rather good detection by AV vendors (21/38 - full details). In the CWSandbox report, we can see that the PDF file is opened with Acrobat Reader and then it drops a new file called wuweb.exe which is also executed. Afterwards, several other files are dropped and a server located in Singapore is contacted. Unfortunately this server is now offline, but presumably the server was used to download additional malware from the system

Posted by Thorsten Holz in CWSandbox, malware at 13:50 | Comments (3) | Trackbacks (2)

25C3: "Banking Malware 101"

Saturday, December 20. 2008

The 25th Chaos Communication Congress (25C3) will take place next week in Berlin, Germany. CCC is always fun and I'm really looking forward to the Congress. I will give a talk on banking malware at the second day (see the schedule for details). The talk can be summarized as:

In the recent years, we observed a growing sophistication how credentials are stolen from compromised machines: the attackers use sophisticated keyloggers to control the victim's machine and use different techniques to steal the actual credentials. In this talk, we present an overview of this threat and empirical measurement results.

Some aspects of this talk are covered by our recent technical report on banking malware, but I will go into some more technical details. If you also attend CCC, you can find me there and we can discuss questions :)

Posted by Thorsten Holz in admin, malware at 10:42 | Comments (2) | Trackbacks (0)

EC2ND'08: "Towards Next-Generation Botnets"

Friday, December 19. 2008

We recently published a paper at EC2ND 2008, the fourth European Conference on Computer Network Defense, on next-generation botnets. The paper highlights challenges we might face in the near future when botnets evolve beyond simple IRC-based botnets that we observe today: The area of botnets faces – similar to other ﬁelds – an arms race between botmasters and defenders. To keep up with latest developments, researchers need to continue to improve detection and mitigation methods and investigate new techniques used by botmasters. The goal of our work is to increase the understanding of more advanced botnet designs. We anticipate that this paper ultimately leads to the development of new, sophisticated techniques, which will help to fend oﬀ arising threats. While the topic of the paper is a bit offensive, I hope that it leads to the development of novel detection techniques that can also be used to stop more advanced botnets.

The full paper contains a discussion of the features of Rambot, the name we gave this project. This work was a collaboration with Ralf Hund and Matthias Hamann, two students from our lab.

Abstract: In this paper, we introduce the design of an advanced bot called Rambot that is based on the weaknesses we found when tracking a diverse set of botnets over a period of several months. The main features of this bot are peer-to-peer communication, strong cryptography, a credit-point system to build bilateral trust amongst bots, and a proof-of-work scheme to protect against potential attacks. The goal of this work is to increase the understanding of more advanced botnet designs, such that more eﬃcient detection and mitigation systems can be developed in the future.

Posted by Thorsten Holz in paper at 23:17 | Comments (2) | Trackbacks (0)

Banking Trojans

Thursday, December 18. 2008

My previous post already contains some information on our recent work, but I think it makes sense to include some more details. We wanted to study an attack class we call impersonation attacks, i.e., all attacks in which an attacker wants to steal a credential from a victim in order to impersonate as the victim at a provider:

This kind of attacks is quite common, for example also phishing attacks fall under this class: In such an attack, the attacker uses phishing e-mails as an attack channel and lures the victim into revealing his credentials at a bogus site. These credentials are then sent to the attacker using the harvesting channel, which can for example be e-mail. The attacker can then use the stolen credentials to impersonate as the victim, for example at an online bank.

We studied a specified type of impersonation attacks, namely the attacks in which keyloggers and banking trojans are used by the attacker. Example of such malware include ZeuS/Wsnpoem and Limbo/Nethell, which we studied in detail. Based on the information collected during dynamic analysis, we found many dropzones and got access to many logfiles. We performed a statistical analysis of this data and here are some highlights:

We found a total of 175 different countries in which the 170,000 victims are located and almost one third of the infected machines are located in either Russia or the United States.

We also found that the dropzones are located in many different Autonomous Systems (68 different AS in total), but several AS host a larger percentage of ZeuS dropzones: The three most common AS host 49% of all dropzones, indicating that there are some providers preferred by the attackers. Presumably those providers offer bullet-proof hosting, i.e., takedown requests are not handled properly by these providers.

In total, we found 10,775 unique bank account credentials in all logﬁles. This includes passwords and all bank account details as entered by a victim during a normal transaction. Furthermore, we found more than 5,600 full credit card details and tens of thousands of passwords for different sites.

The distribution of victim IP addresses is highly non-uniform: The majority of victims are located in the IP address ranges between 58.* – 92.* and 189.* – 220.*.

The results of analyzing the potential income of an attacker indicate that an attacker can earn several hundred dollars per day based on impersonation attacks with keyloggers – a seemingly lucrative business.

Full details are available in the technical report. Note that the data we collected during this study is very sensitive. We thus handed over this data to AusCERT, the national Computer Emergency Response Team (CERT) for Australia, since they are in a position to notify the victims.

Update: I received a few comments regarding how to protect against this threat. Best way for protection is patching and not clicking all links and attachments. Furthermore, you can protect yourself against keyloggers by using two-factor authentification when doing bank transactions. German banks offer services such as mobile TAN/SMS-TAN in which a transaction number is sent to the mobile phone to authorize a transaction. A weaker system is iTAN (indexed TAN). The Postbank also published some guidance on how to protect yourself. If you follow these guidelines, you should be relatively secure and not affected by banking trojans.

Posted by Thorsten Holz in CWSandbox, malware, paper at 09:43 | Comments (7) | Trackbacks (0)