Black Hat USA 2010: Malware Freak Show 2010: The Client-Side Boogaloo 1/4

This is a malware fingerprinting track. The talk is called Malware Freak Show 2010: The Client-Side Boogaloo. Please give a warm welcome to Nick Prokoko and Jibran Ilyas.

Okay, so welcome to Malware Freak Show.

Uh, there's a significant problem with my demos, uh, based on the fact that the The phones that I'm using are only dual bands, and over here there's only, uh, 6 bands.

That's not us. Okay, so let's, let's kick things off. So this is, um, this is Malware Freak Show, um, 2010. Um, feedback going on here. So, um, jump in here to the introduction. So this is really a high-level agenda. And, and basically, um, we're gonna spend a lot of time this year in the, in the sample analysis section. So I have some background things to go over with you guys, but then we're gonna really spend a lot of time, just about 30 minutes of this presentation, showing live demos of the malware that we obtained in the wild over the last year. So a little bit about us. I'm Nick Prococo. I'm Senior Vice President and Head of Spider Labs at Trustwave. About 15 years InfoSec experience. I built and now I— and still lead the Spider Labs team at Trustwave, and my interests are targeted malware, attack prevention, mobile devices, really from the business and social impact, um, of how those things impact our lives.

And, uh, I'm Jibran Ilyas. I am a security consultant at Trustwave. I do forensics. Um, also have about 8 years experience in InfoSec. I recently got my master's from, uh, Northwestern University, uh, in, uh, Chicago. Uh, also my interests are anti-forensics, artifact analysis, real-time defense, and, uh, praying to the demo gods as, uh, we have about 4 demos here and, uh, you know, which I request you all to pray that our demos I'm always working.

Okay, so a little bit of introduction. So over the last year, so from 12 months ago till now, we did a lot of investigations, over 200 incident investigations across 24 different countries. We had hundreds of different samples to pick from, and so we tried to pick classes of samples that we thought were very interesting, but also sort of targeted some of the very commonalities that we see when we're doing investigations. So we tried to pick the most interesting ones for you. So we have some new targets this year. So we have a sports bar in Miami, an online adult toy store, an international VoIP provider, and a US defense contractor were the 4 targets that we're including in our analysis. And then really, basically here, it's the developers were very, very busy over the last year. So if anybody saw our Malware Freak Show at DEF CON last year, some of the samples we're using, the classes are very similar to what we showed last year, but the advances were actually rather dramatic in what they did over the last 12 months in their development. So we actually were talking, or maybe they saw our Freak Show last year and actually decided to improve their applications or improve their malware over the last year. So, So what is a malware freak show? So really the bottom line question there. So in order to get to that question, really talk about the environments that we're seeing in these investigations have extremely valuable data. And so we'll talk about what that data is and why they're being targeted. The whole smash and grab technique, if you crank the clock back 3, 4 years ago, we would often see people breaking into environments, they'd steal a database or they'd steal a file and then they'd leave. And they would never come back again. They would just literally take it and run. It's sort of like when you throw a chair through a window. at a TV store and then you take all the TVs and you run down the street with them. We don't see that anymore. People are sticking around for a very long period of time. An average over the last year, we saw an average of 156 days were the amount of time that people were actually in environments and sticking around, learning about the environment, writing custom malware to take data out of that environment. So that's important to note. Basically, with that time comes exploration. So imagine if anybody here had, you know, 156 days in an online adult toy store. If you had that much time to sit within that system, you can mine a lot of information out of that about customers, about things that they're doing as far as what people are buying and the credit card information that's there as well. Custom and targeted malware is the norm today. And so, you know, if you, you know, 5, 6 years ago, you'd see these custom attacks that were very sort of rare. Everybody was getting hit with viruses. What we see today in these attacks are really custom malware being written to specifically attack the organizations and the organization systems that are being targeted. And the real benefit here for doing the malware freak show is for you guys to learn. It's for us to learn as well when we do the analysis, but really learn about ways to alert to these problems, detect these problems, and then defend against these problems as well. So before we jump into the sample analysis, we thought it was important to really talk about the anatomy of a successful malware attack. So we're taking this from really the mind of an attacker. Pretend that you're the attacker and you want to actually target an organization and pull off a successful attack. We looked at our cases over the last year and said, what were some of the characteristics that they had that made them very successful? And so we put these steps here. We're going to walk through in a little bit of detail in each of these steps. So first is identifying the target. And we know that there's targets all over the world, right? They have— there's confidential information, there's personally identifiable information, there's proprietary or intellectual property that people are trying to steal. But really it's all about money. And so in our caseload, we saw a great deal of credit card breaches. And so if you're thinking about how are you— if you're an attacker and you want to pull off something and you want to be successful, you want to go after something that's going to turn into money quickly for you. So really there's 2 different types of data that people can go after. There's credit card data and then there's ATM debit card data. They're very similar, but from a sort of a food chain standpoint, we actually did— when we were writing this presentation and writing the white paper, We actually noticed that if you go after ATM and debit card data, the food chain is a little bit shorter. So it's less hops to cash. And that's what it's all about. You know, if you're a cybercriminal and you want to attack a system, getting the data and having it on a hard drive someplace does you no good if you can't turn it into cash. And so organizations who go after ATM and debit card data are actually one step closer to getting cash. They don't have to actually buy something and then try to sell it to make money. They actually can just go to an ATM machine and take the cash out and walk away with it. So that's identifying the target. So if you're writing malware, you're going to pick someplace where that data exists. And then developing the malware. We sort of break it down into really the big 3 from a malware standpoint. Keystroke loggers, network sniffers, and memory dumpers is what we see very, very often. Now it's not in the traditional sense that you're used to keystroke logging. Sometimes they're looking for people to see what people are typing and see what data's going across, but oftentimes many systems, even ATM systems and various other systems, When it reads data into the operating system, it's actually using basically a keyboard driver to read that data. And so when you use a keystroke logger in those environments, you're able to get that data pretty quickly. And then sort of the disk parser there, I sort of put that in there because you would think that if data exists on these systems that we would see a lot of malware that just parses the disk and tries to find that data. We often don't see that.

Yeah.

Very often in our investigations. Mainly because it's slow, it takes time, and if you have systems that are actively have active transactions going on, why not pull them either out of memory, off the network, or basically through the keyboard mechanisms?

Right. And the thing with memory is that if you know fundamentals of computers, everything that you do on a computer, it has to go through the memory, then to the application, and then to the database that's encrypted. Memory is one place that you would see unencrypted data at all times. And now that we have like 2, 4 gigs, or like 8 gigs of memory, it's like a gold mine for attackers. Not just financial data, but just your username passwords, just about anything that you do on a computer.

And then talk about design considerations. When you're writing the malware itself, naming convention is a big deal. You would think it wouldn't be, but it is. When you're talking about these IT organizations who are looking at these systems, when they see applications or something running in Task Manager called svchost, they just ignore it. They say, oh, well, okay, it's something legit, I'm going to move on. They don't even look any deeper. Name something blah blah .exe, it's going to raise some red flags, hopefully. How many people know where that blah blah exe is from? Not too many people. Okay. Well, it is from a real case that was publicized over the last couple of years. If you do a Google search for it, you'll probably find it. It's pretty interesting. Functionality. Slow and steady wins the race. You don't want to just get into that system and rip the system apart. You want to sit there, be methodical, and get access to the data, not raise any eyebrows of what you're doing. And then, of course, persistency and data storage. You want to be there once someone reboots the system. But you also want to be mindful of the amount of data that you're storing on the system and move that data off the system whenever you can. So here's basically 3 basic methods. We have sort of the physical way, right? So you— we see environments all the time where you can walk up to a kiosk or someplace, throw a USB key in the back of that system, and basically it's owned, right? So you planted your malware on the system that easily. We also have the easy way. We sort of call it nice to meet you, RDP, and your friend default password. Basically, we see this all the time. People have RDP available on the internet, and the passwords are very easily guessable.

Right.

And then you have the uber way, right? So you're talking about 0-days, if those exist. And then you have what some people call the APT, which we call internally the silent but deadly attack vector. But basically, that's where you're using an 0-day attack, and it's coming into the environment, and people really aren't aware of what's going on. So that's the uber way. But most cases we see really follow the easy way. It's very, very low-hanging fruit actually getting these criminals into these environments. Software holds the secrets. Finding the data. Look at the— people are looking at the applications. The attackers are downloading these applications from the manufacturers or from the developers. They're studying them and then they're writing their applications to actually target those systems. If you're looking at a system that you don't have access to basically install the install the media, watch the processes. The busy processes probably have the data flowing through them. Also look in the temp files. We see a lot of data written to temp files for a millisecond and then deleted. And so the attackers will write tools that do that as well. Configuration files, turning debug on usually dumps a lot of data to the hard drive. And on the wire, many times in local networks, not talking over the internet, local environments, the data's being transmitted amongst various systems in the clear. They're not using SSL, they're not using IPsec within their environment.

What's IPsec?

It's basically just clear text data flowing around. It's typically a gold mine once you—

Right. And a lot of this is like a simple registry hack or just like one value from like true to false or false to true that actually gets them this kind of data.

So getting the loot out. You know, how are— if you're writing a piece of malware and you want to get the loot, the data out of the environment, don't use 31337 as the port. You know, don't use random high ports or anything that looks out of the ordinary. Use your basic stuff. So use FTP, HTTP, SMTP. We see the successful pieces of malware that we've been analyzing are starting to use that. They used to use all sort of goofy things, but they've sort of learned that if they use HTTP to get their data outbound, no one's gonna detect them, because the IT administrator's looking at their firewall logs and they see, yep, HTTP traffic, oh, 31337, that's something I should look into. But everything else, they just assume it's normal user traffic and it doesn't raise any red flags. Then of course covering tracks and obfuscation. This is basically optional. We've seen in our investigations that there's sometimes the attackers will make a mess of the system and no one knows that this is going on. We've seen some of the more advanced pieces that we're going to demo here today that are trying to do some of these things. Right.

In some of the cases, you know, the crashing the systems and filling up the disk space, and what we've seen is like, you know, when the attackers are filling up disk space, the IT administrators are actually adding like a terabyte hard drive for the attackers, just aiding them without knowing, and then all their accounting data and everything gets in there.

And then of course messing with the cops, so messing with investigators like us or law enforcement. If you do things like modifying MAC times, we're gonna show some of that stuff in our demos, obfuscating output, that's something that's rather successful. It basically, even if it just slightly changes it, it can throw off someone's regex and they may not be able to find that data on the system. Packing, basically packing your bag of tricks. Now if it's custom malware, there's no reason to pack it 'cause AV's not gonna detect it. If you wrote and compiled that yourself, there's not an antivirus that's gonna be able to understand what you're doing there. But if you bring a whole bunch of other tools with you that are sort of well-known, you're gonna wanna pack those to avoid AV detection. And then automating tasks is very important as well. You don't wanna keep connecting to the system to download data. So the successful pieces of malware that we're we're going to show today have a lot of those features and functionality in them. And there are still some flaws, and we'll talk about those when we get to those. And then of course rootkits. This is the big advancement we saw over the last 12 months. They start moving from— they move from your normal executables, and now they're running rootkits to do the same things that we were doing previously, but makes it even harder to detect and actually much more efficient as well. So now we're going to go into the demos. And so what we have from the demos perspective is we have basically the vitals, profile here of each piece of malware. And then we're going to move into a demo and we're going to come back to it. So we have 4 pieces to show you. So this first one here is the memory rootkit malware. We gave it the code name Captain Brain Drain, is what we gave it. The target environment here is a Miami sports bar. And so we talked about that earlier. I'm not going to go over the key features because Jibran's going to demo those in his portion of the presentation. But basically tell you a little bit about the environment. This is an elite sports bar in Miami, frequented They're frequented by a lot of celebrities. We saw a lot of celebrities' information on these systems that we analyzed. They don't have IT staff, right? So most of these businesses do not have someone who can come and, you know, the system crashes, they call someone, some guy walks out of the back room and actually fixes their systems during business hours. They have to outsource all that. Also, the owner, when we were having conversations with him, he said, oh yeah, I got these security compliance notifications from my bank. It just— these things are giving me a headache, so I just throw them in the garbage. So he didn't care, really. Um, you know, about his environment. And basically just said, well, if the problem's not going on, you know, I don't have to worry about it. And then the other side effect, and we have a lot of side effects from investigations, is basically the point of sale system was also the DVR within the environment. So if you ever wondered what's going on in a Miami sports bar after hours, we know now. And interestingly enough, if you do visit a bar that has a nice, flat, sturdy bar with it, Um, your fry falls off your plate, the 5-second rule does not apply, um, in these environments. So it's demo time. So Jibran's going to jump into the demo of the memory rootkit malware.

Alright.

Okay, this is the time that we pray that all of these work. So this, this is going to be the memory dumper, uh, malware as, um, uh, Nick talked about. Um, now, now the key features again for this malware is, uh, that it installs installed in the kernel, um, as a rootkit. So, you know, as far as detection goes, it's— detection is pretty, pretty hard because, you know, once, once things are running in the rootkit, um, or in the kernel, it's pretty hard to detect it.

So, um,