Chinese Hackers Waking up to Malware

An anonymous reader writes "An increase in malware originating from China has not gone unnoticed by security researchers, according to the site ITWeek. The aggravating software has been increasing over the last three months, to the point where some unlucky persons may be getting some every day. Individuals interviewed for the article are seeing an increasing sophistication and independent use of rootkits, new to the Chinese malware scene. 'China has traditionally been a hotbed of password stealers who go after log-in names and passwords for online games such as World of Warcraft. The criminals are after virtual currencies and goods which can be sold on auction websites.' These new types of software are actually encrypted, and can prove hard to dismantle."

Comments

Pretty cool stuff, actually

[shrapnull]

This article is interesting because a) I've seen it firsthand this past week, and b) Some of these are actually very sophisticated attacks.

One of our buildings was going through an antivirus upgrade over AD when it got hit. Every machine in the building was getting an iframe in the web browser from some Chinese ISP (usa.d3a.us) that would bracket the computers web browsing session throughout its duration. The iframe contained javascript designed to capture passwords from gmail and other public websites, in essence a browser-based keylogger. Of course, blocking the offending domains through our filter got rid of the iframe, but it still affected websites because now they all had broken source code (wonderful XML render errors on just about every website, including google).

Then the hunt was on.

The 'sophistication' I witnessed comes from the fact that no matter how many of these boxes we cleaned and patched, the iframe source code kept popping up everywhere. I ran a Wireshark on it and discovered something rather interesting (to me anyways). The software was attacking the router's ARP table, by feeding it a bogus mac address (one of the infected machines) in essence redirecting all network traffic to a software-based proxy. Tracking down machines via MAC address and patching them eventually resolved the issue long enough to update the antivirus on the network, but I left the place somewhat in awe of what I had just seen, having most of my network antivirus experience involve easily blockable/patchable worms and viruses.

While an ARP attack isn't all that uncommon, the presence of Chinese characters on every infected machine was a dead giveaway. Not exactly something I'd ever seen from a country more historically known for installing local keyloggers to steal WoW accounts.

But or a good hour or two, I was getting my ass handed to me, and I had to completely disconnect the building from the WAN. In addition, our AV (very big-name corporate AV firm), didn't do shit on it. After the update I had to submit samples to the AV company to get a permanent patch upstream.