Trojan Analysis Leads To Russian Data Hoard

Stolen Identity writes "An attack by a single Trojan variant compromises thousands, circumvents SSL, and uploads the results to a Russian dropzone server. A unique blow-by-blow analysis reveals evidence of cooperation between groups of malware specialists acting as service providers and points to the future of malware's growing underground economy."

Comments

that made me laugh

[Anonymous Coward]

how's that for having your tables turned on you ?

In soviet Russia you invade the trojans :)

Pixie Rank ? WTF ??

What About Firefox Users?

[eldavojohn]

From the article,

• Steals SSL data using advanced Winsock2 functionality
• State-of-the-art, modularized trojan code
• Spread through IE browser exploits
• etc ...

When I read the Slashdot summary, I was initially concerned that I may be at risk. But then I noticed the above three lines and realized there was no risk since I don't use IE.

But, in the end, if this is an exploit utilizing the very basic network DLL that windows provides for socket connections (Winsock2--which is what I assume all network applications eventually link against in Windows) then why aren't other browsers at risk?

I know Firefox is awesome & more secure & all that jazz but I haven't done enough network programming to know the nitty gritty details of it. Does anyone know why, if this trojan is exploiting the basic socket connection library that the Windows API provides, all browsers aren't potential victims?

I mean, it makes sense to introduce some sort of security that never ever lets anything but the browser's code access the interfaces to these libraries ... is IE really that flawed?

Re:What About Firefox Users?

[TheNicestGuy]

Monster of an article, so I don't blame anyone for not catching the details on this. What it boils down to is that IE exploits are the main propagation vector of Gozi, but its actual performance of nastiness does not necessarily rely on IE. Once it's installed and running, it will intercept and leak to its "mothership" any and all HTTP POSTs that go through WinSock2, no matter what browser they come from, because it manages to register itself as a "Layered Service Provider" sitting between the browser and the socket. Unfortunately, I do not know which browsers make use of WinSock2 and its LSP functionality, and which don't. It would have been nice to mention that in the article as an aside.

Another way IE is specifically involved is that Gozi does some extra sniffing inside IE's JavaScript engine to get data that's being sent AJAX-style rather than through normal POSTs.

Re:What About Firefox Users?

[evought]

You are about to have your butt shoved up your nose, Cancel or Allow?

Seriously, though, several things struck me. One was that a screenshot of the (malware) author's webpage showed that Firefox "support" was expected in a new release. Of course, I browse with NoScript enabled on a Macintosh which has been significantly tightened down. I regularly complain to sites that require users to have javascript enabled to do business with them and generally get favorable responses, especially when referring them to recent articles. I often find that even if functionality is degraded, most sites I visit function.

Another interesting thing is that the trojan itself presumably only needed normal user permissions to do its main job, nullifying account protection and one of the things which makes Mac/Windows/Vista better than XP. It needs privilege escalation to hide and make sure it can survive removal attempts, but the encryption and other things also make detection harder without rooting the box.

IE 7/Vista's browser sandbox, in theory, should make this kind of attack less successful, since it makes it harder to convince the browser/system to modify the environment without user intervention even when account permissions would normally allow it. Newer memory protections in both Vista and gcc 4.1+ systems should also make its job significantly harder, but one of the best things is just to limit what a web page is allowed to do and that is one of the things that is much easier to customize in Firefox (with your choice of extensions).

The fact that this is yet another case where otherwise trustworthy systems are the source of an attack is disturbing. Site-rating systems like WOT and certificate rating are rapidly becoming worthless. Also, this means that, since the e-commerce sites are obviously not secure, the attackers can obviously get access to your data from them, regardless of what precautions you take. Systems like Paypal where your account information is not provided to the vendor become more valuable, assuming Paypal itself is not compromised. One-time credit-cards are also very useful.

As for two-factor authentication, something akin to a scramble-pad may work. use multiple choice for a challenge (with randomized positions) or provide randomized buttons to enter a pin. Similar systems are sometimes used for physical security to good effect.

Hmm.. smth does not compute

[wumpus188]

TFA mentions 81.15.146.42, which apparently is a42.skierniewice.mediaclub.pl, which is Poland.
Where Russia came from?

Re:Possible solution...

[Dogtanian]

I guess the major flaw would be that I could write code and report it ? That had occurred to me; the reward, however, would likely not be enough to warrant writing a piece of genuinely new code.

If the case was genuine and one guy had written all the code, he would be getting paid for writing the code (by Mr. Big, presumably) *and* for blowing the lid on the whole thing (by the AV company). If someone writes the code for use by themselves, they either have to report it before it becomes prominent (and hence they don't make much money from the use of the code), or if they wait too long the AV companies figure out the info for themselves first, and they don't get paid.

Basically, though, this idea operates under the premise that there is more than one person involved (preferably many), and that this individual stands to gain by giving the game away.

Re:i'm in awe

[krunk7]

Ok, let's go with this evil genius take on things. Now, you take one look at their situation and within the time frame it took you to click "reply" and start typing you came up with this angle.

Now I'm supposed to accept that these evil geniuses suddenly got retarded when it came to the common sense risks with their new business? They've developed a real cracker jack exploit of commercial quality able to mass infect systems, avoid tracing, the whole nine yards. They then market this to organized crime syndicates around the world and in particular to the Russian mob.

But along the way they never thought about doing all this anonymously. Or maybe, gasp, they aren't even in Russia? Maybe they're in china, india, or the U.S. and chose to vendor to Russian mafia specifically because of the difficulty of extending their reach across continents?

Personally, if I were an evil russian programmer out to make nefarious riches I'd vendor to china, india, or the U.S. Everyone knows the best illegal business is illegal business not done in your own backyard.

Re:i'm in awe

[arivanov]

Or maybe having kids to feed.

With a relatively small local software market as well as relatively small outsourcing market Russia (and to lesser extent Bulgaria and Romania) are ripe for the picking by the mafia. Most of the qualified software engineers who do this kind of work will very happily work on an outsourcing contract instead. Further to this, they are likely to deliver considerably better quality code than most Indian outsourcing shops (I have seen code and projects from both so this statement is based on actual experience and reading the actual code produced).

But for a variety of reasons starting they do not get any work like that and as a result they work for the mafia.

C'est la vie.

zzz

[circletimessquare]

you seem to have some problems understanding how the world works. the programmers who do these things are not untouchable, nor do they go to the great lengths you describe to make themselves untouchable. why? because no one can do business and also be a puff of smoke at the same time. it's a balance you have to strike between being hard to find by the authorities and easy to find by your business interests. it easy to be hard to find by the authorities. even when they see you, their hands are tied

however, it is those very business interests i describe above whom you have to worry about more than the authorities

you cannot do business with the underworld, and not also be made part of the underworld in the process. you fail to understand the dynamics of the situation these programmers are in. you fail to understand the mafia. if you deal with the mafia, and you yourself are doing something shady, the mafia simply moves into your turf. they will simply come to own you, one way or another, and there is absolutely nothing you can do about it

get someone to protect you from them? who? the authorities? you're already illegal yourself. another mafia group? ok, fine: you're not dealing with the original evil a**holes who were threatening to coopt your life, but now you are dealing with another group of evil a**holes who have the same methodologies and goals, so you have the same problem. protect yourself? ok, now you have become the evil a**hole yourself. you have the stomach to threaten loved ones, put innocents in harms way, deal in murder? it's a big step up from internet crime my friend. it's one thing to pilfer a moron's bank account. it's another thing to kill the 9 year old daughter of the mafia tycoon who won't leave your business alone

in other words, deal with the devil, and the devil owns you, no matter what. you are not untouchable when you deal with the mafia and you also make money shady like they do and you do business with them. you have no relatives who can be threatened? you love no one in this world who can't be hurt or found?

in short, you're rather naive about the subject matter you are commenting on. you really haven't the faintest clue about how vile these people are, the mafias of the world

and, therefore, in a way, you are lucky, in your naivete, to be so blissfully unawares of these monsters in your midst. pray you stay that way, naive and clueless about how these type of organizations really operate. it's the best way to live your life. you really don't want to know about these guys, nor boadly boast about how untouchable you would make yourself from them via a few proxies. right, yeah. if you are doing shady work, and you are in business with them, and you are making a nice amount of cash, consider yourself pwned

Re:Who's the target customer?

[TheNicestGuy]

What kind of customer would pay for access to such a broad set of data? That's one of the points the article is trying to make, as a sea change in this sort of malware: Because the data is so broad and voluminous, the providers could have a quite varied customer base. It's been commoditized. Data mined from this store could be of use to unscrupulous folks ranging from simple carders, to account drainers, to mob bosses, to terrorists. Notice that the data was not just credentials for banking and shopping sites, but included access to law enforcement and other government applications. Wanna steal a car and un-report it as stolen the next day? This might not be a bad place to start.

Undernet, is that you?

[HomelessInLaJolla]

At one point the 76service development/trial server was located at an ISP in Atlanta, Georgia, USA, the same city where SecureWorks is headquartered. A few days later, they moved to a server that appears to be located in the American Midwest (Texas, Oklahoma, or Kansas), but the server's IP address is in a block assigned to a company in Tampa, Florida, USA. They will likely move again soon. A google search on 76service shows this page.

 

route 65.254.48.0/20 Proxy registered route object GNAXNET NET 65 254 32 0 1 GNAXNET NET 65 254 48 0 1 Global Net Access, LLC 55 Marietta St, NW Suite 1720 Atlanta, GA 30303 and

as3595 AS GNAXNET AS Global Net Access, LLC 1100 White Street Atlanta, GA 30310 Who ran the Undernet's atlanta.ga.us.undernet.org server? Who worked for GNAX?