Slashdot Mirror

← Back to Stories (view on slashdot.org)

Inside a Modern Malware Distribution System

Posted by kdawson on from the enemy-are-as-thick-as-peas-out-there dept.

Scrabblous sends in this analysis of the Pushdo Trojan downloader's backend code and control server. Pushdo is a complex Trojan downloader that meticulously tracks its victims; much of its innovation is not in the Trojan itself but in its control infrastructure. Quoting: "The Pushdo controller also uses the GeoIP geolocation database in conjunction with whitelists and blacklists of country codes. This enables the Pushdo author to limit distribution of any one of the [421 different] malware loads from infecting users located in a particular country, or provides the ability to target a specific country or countries with a specific payload. Pushdo keeps track of the IP address of the victim, whether or not that person is an administrator on the computer, their primary hard drive serial number..., whether the filesystem is NTFS, how many times the victim system has executed a Pushdo variant, and the Windows OS version."

27 of 135 comments (clear)

  1. industrial strength stuff by jacquesm · · Score: 4, Funny

    If only Microsoft would spend that much effort on windows update...

    --
    MP3 Search Engine
    1. Re:industrial strength stuff by RAMMS+EIN · · Score: 4, Insightful

      ``If only Microsoft would spend that much effort on windows update...''

      They do, but they spend their efforts on making sure it doesn't work for pirates, rather than on making sure it works better for customers.

      --
      Please correct me if I got my facts wrong.
    2. Re:industrial strength stuff by jacquesm · · Score: 2, Informative

      afaik it does work fine for pirates but not for consumers that have paid for the product. A friend of mine made the linux switch solely because of being pissed off once to many while being told to re-register his machine after windows update literally crashed the box beyond recovery and they wouldn't activate him. He said, ok, fine don't activate me I'll get another OS. It's well past the point of being a nuisance, it's a real risk (having your machine taken down by an automatic update is *not* funny at all) and then to be insulted like that is really not the best way to deal with an already pissed off customer.

      --
      MP3 Search Engine
  2. Question about platform security by Iphtashu+Fitz · · Score: 4, Interesting

    Call me a troll if you will but I have a serious question here.

    Microsoft constantly claims that the main reason there are so many trojans & botnets like this is because Windows systems make up the vast majority of computer systems out there, not because Windows is any less secure than linux, OS-X, etc.

    Assume a completely even playing field where each of the three main consumer OS's, Windows, linux, and OS-X each has 33.3% of the market. Which environment would a trojan/botnet writer target and why? Put another way, how difficult would it be to develop a similarly intricate for linux or OS-X if a malware author decided to target those platforms?

    1. Re:Question about platform security by m50d · · Score: 2, Interesting
      Assume a completely even playing field where each of the three main consumer OS's, Windows, linux, and OS-X each has 33.3% of the market. Which environment would a trojan/botnet writer target and why?

      Even if marketshare was the same, there are still other variables to consider: how useful is the OS, and what is the userbase like? My instinct would be to go for linux - it's (marginally, and in my experience) more stable, systems are more likely to be left running 24/7, and systems programming for it is easier - you don't have to e.g. jump through hoops to get raw sockets, and the open source might make things better - I don't know how good the documentation of windows/osx interals is. As against that there is the distribution fragmentation and the somewhat higher technical competence of average users.

      Ultimately there's not much to choose between them - all three OSes have their vulnerabilities, all three can be programmed by anyone competent, and this kind of malware could easily be written for all three. In fact, it probably already has been.

      --
      I am trolling
    2. Re:Question about platform security by flyingfsck · · Score: 3, Insightful

      Actually, there are vastly more Linux systems out there than Windows systems. Each year about 300 million Linux devices are produced - most cell phones and routers. These devices have a life span of 5 years or more, meaning that there should be about 2 billion Linux devices out there. In contrast, there are only about 600 million Windows devices. Also, note that there are more Linux servers on the internet, than Windows servers. The simple fact that these Linux devices and servers are mostly secure, while the Windows machines are mostly insecure, therefore has nothing to do with numbers.

      --
      Excuse me, but please get off my Pennisetum Clandestinum, eh!
    3. Re:Question about platform security by IamTheRealMike · · Score: 4, Interesting

      That reasoning is invalid. There are tens of millions of XBoxes in the world, all of which run a customized version of Windows, yet I'm not aware of any viruses for the XBox. I guess Windows must be entirely secure!

      Or maybe desktop security and arbitrary-consumer-electronic-device security are different problems with different solutions.

      The other poster is correct. There is no difference in Windows vs Linux desktop security. It's beyond trivial to phish or intercept the users root password, if you want it, which you might not bother with because there are plenty of other ways to hide in a modern operating system (google "user mode rootkit").

    4. Re:Question about platform security by 99BottlesOfBeerInMyF · · Score: 5, Interesting

      Assume a completely even playing field where each of the three main consumer OS's, Windows, linux, and OS-X each has 33.3% of the market. Which environment would a trojan/botnet writer target and why? Put another way, how difficult would it be to develop a similarly intricate for linux or OS-X if a malware author decided to target those platforms?

      This is an interesting question, but it lacks some details that may make a large difference. First, was it a single Linux distribution or a mixture of the ones currently available. Second, are we talking Windows Vista, or are we talking about the current mix of Windows versions deployed today?

      Potential reasons why it is easier to target Windows:

      • Malware authors are familiar with Windows and Windows development tools and often are not experienced in coding for other platforms.
      • Even with an even distribution of OS's, MS still dominates certain application segments on Windows, with MS Office, Outlook, and IE. Other platforms have more varied application sets by comparison, making it harder to make a virus work via an exploit for a particular application.
      • Windows in general runs with more network services listening by default than either OS X or Linux and each one is a potential hole.
      • Windows fails to operate using standard protocols, so assuming most networks in the future are mixed, for full functionality Windows servers often have to run two services for a given function, versus one when using Linux or OS X. (For example, a Windows box might be listening to the local network using UPnP SSDP to discover network services, as well as ZeroConf, which is implemented by various applications on Windows, whereas OS X and Linux use only the standard ZeroConf.)
      • Windows has a different user base from the other OS's and it is often a less security conscious one overall. That could change, however if market share does.

      On the other hand, Windows has a few advantages as well:

      • More anti-virus tools and services are available for Windows
      • Windows makes better use of sandboxes in some instances than the vast majority of Linux distros.

      The question is pretty academic though. Market share is not going to shift drastically overnight, nor distribute evenly. Market share has an enormous affect on the products themselves. Right now Linux and OS X have appropriate levels of security so that it is not a big issue for their users. If security threats increased for either platform, security improvements would also increase because the developers are motivated to not lose money.MS is currently a monopoly so the fact that Windows does not have sufficient security to deal with the malware ecosystem does not cost them much money at all, so they are nt motivated to fix it. If Windows had 30% of the market, they would no longer have a monopoly and they would fix their security problems or go out of business.

      Having a diverse computing market makes things hard for botnet operators, because it lessens the effect of any vulnerability and because it motivates better security through competition between the players in that market. The theoretical you propose would change things in many, many ways. In some ways, Linux and OS X would become bigger targets and have to adapt their security to deal with it, but we'll never know what would hold up as the "best" six months or two years afterwards.

    5. Re:Question about platform security by Torvaun · · Score: 2, Insightful

      Yes, and by the time you finished any sizable app, one that was "good enough" would already have been released, and gobbled up marketshare. The problem with chasing perfection is that it takes forever, and even if you find it, most people don't need it.

      --
      I see your informative link, and raise you a pithy comment.
    6. Re:Question about platform security by SanityInAnarchy · · Score: 2, Insightful

      Assume a completely even playing field where each of the three main consumer OS's, Windows, linux, and OS-X each has 33.3% of the market. Which environment would a trojan/botnet writer target and why?

      I'd say Linux and OS X at that point, because both are Unix. Much easier to port things between Linux and OS X than it is to port things between either and Windows.

      Put another way, how difficult would it be to develop a similarly intricate for linux or OS-X if a malware author decided to target those platforms?

      The relative security of the OS has nothing to do with the intricacy of the virus. If you could write ANY kind of malware for Linux, you could easily write one this intricate.

      And so, the question you're asking is exactly the same one that's been asked time and time again, and has absolutely nothing to do with this story. It's a question of whether malware could target Linux and OS X. I can't really say, but I think it would be somewhat harder -- and I figure Linux has a much better shot, unless you mean 33.3% Ubuntu, simply because of distro diversity.

      --
      Don't thank God, thank a doctor!
    7. Re:Question about platform security by cheater512 · · Score: 2, Insightful

      The fact that they cannot easily execute themselves stops a lot.
      A executable in a email attachment or web download cannot be executed by a idiot. It needs to be chmodded.

      Also the root password box appears significantly less than the Windows equivelants.
      Your average user will never have to enter it in.
      Helps reduce false negatives but it can still occur.

    8. Re:Question about platform security by IamTheRealMike · · Score: 4, Informative

      how difficult would it be to develop a similarly intricate for linux or OS-X if a malware author decided to target those platforms?

      Here's how you could make a somewhat modern piece of malware for Linux. I'll leave out the stuff that's the same between operating systems ... the control networks, etc, and just look at controlling/hiding in the system.

      1. First question - how to get in? All the usual techniques will work. Browser exploits are still common, even after years of hardening the IE and Firefox codebases. Plugin exploits (quicktime, acrobat, etc) even more so. Emailing out virus mails that appear to come from friends is still a very effective technique - we spent years training people to not trust emails from random people, only to have that advice subverted by having the emails come from friends. There are no restrictions on sending mail on Linux, nor reading from the users address book assuming they use client-side mail. If they use webmail the same techniques will work as on Windows.

        Some people might say, but Mike, it's hard to make a binary that works on all forms of Linux! In reality, it's not that hard. The basic loading/linking code and core libraries are the same across distributions. It's hard once you try to build real, interesting apps that provide GUIs and so on, but if you're willing to put in some testing (and modern malware is a professional operation, so why not) you can make the same binary work just fine on dozens of distros.

        Other people might say that it's complicated to run binaries on Linux, because you have to set the +x bit. I'll ignore the fact that I think Linux isn't ever going to get 33% market share with the current way of distributing software ... suffice it to say, that once you convince a user that you're legitimate and that they want your eCard (that's how this malware spreads), you can just give them a command to copy/paste into the "Run Program" dialog box.

      2. Once you're in, you want to do a few things. You want to download the rest of the trojan ... no problem with that ... maybe start sending mail ... again no problem ... what else? Maybe you want to drain the users bank account. The easiest way to do that is to install a browser extension that waits for the user to log in, and then scripts the web app. This has already been done on Windows/IE and isn't technically difficult - although it does require testing on the banks you want to target.

        What else? Stealing cookies is popular. Yep, we can do that. Maybe popping up "unkillable ads". Yes, X will let you do this.

      3. Next, you want to hide, to make yourself hard to get rid of. This is the part where people tend to assume Linux is more robust than Windows. Is it really? Well, firstly, you can do a decent job of hiding without root. To start with, try injecting yourself into a system process ... or start several copies of the same program, all of which watch each other and restart new copies if others are killed or paused. It exploits the fact that you can't send signals to groups of processes atomically. Adjust the users path in their startup scripts to let you override any binary you wish, and then use a user-mode rootkit technique to hide the fact that the file was modified. Or set yourself to startup in the KDE/GNOME config systems somehow (eg, as an invisible panel app).

        What if you want to store stuff on disk, and hide those files? Doing it with a kernel rootkit is easy enough, but what about without having access to kernel space? One way to do it is ptrace every process that might be used to explore the filesystem - like shells. You can intercept the syscalls of these programs before they reach the kernel in that way, and thus make files "disappear" from the command line, from Nautilus/Konqueror, or whatever other programs you want to do. If you're worried about the ptrace

    9. Re:Question about platform security by LiquidCoooled · · Score: 4, Funny

      The only problem with releasing trojans in Linux is that the damned things have to be GPL.
      Having to leave the contact details for people wanting the source also makes it a bit tricky.

      --
      liqbase :: faster than paper
    10. Re:Question about platform security by timeOday · · Score: 2, Insightful

      I don't see why a botnet client would even need to run as root. So long as the user in question can run 'at' or cron, it can still install itself. I'll grant, a rootkit could conceal itself better with root access, but I doubt very many people would notice an extra process running anyways. (I think I'd call my trojan "bash").

    11. Re:Question about platform security by Tim+C · · Score: 2, Insightful

      Your post seems predicated upon the assumption that the means of compromise is a trojan. Right now, that is not the common case, especially for bots.

      Well, I can't say that I have any hard facts to back up my opinion, but I've always assumed the exact opposite. I don't see *anything* in my router/firewall logs. Either the attacks aren't happening, or they're stopped by my ISP; either way, they're not compromising any PCs (and I'd expect the ISP to advertise the extra protection if they were doing it)

      In contrast, I receive viruses attached to spam mails *every single day*. I use p2p and occasionally download a file that my av software software flags up as being a virus or trojan. Hell, I even get viruses mailed to me in password-protected zip files; people must be opening up these unexpected files, typing in the password and infecting themselves.

      even if that is the case, that's still less than half of the exploits happening

      Assuming that's true, then you'll wipe out roughly half the exploits by switching to Linux. So malware authors will adapt; worms will die out and social-engineering attacks and trojans will increase. You'll buy a temporary respite as the authors react and amp up production of new attacks. Big deal. User education is key, but we've known that for a decade and the situation doesn't seem to be improving.

      --
      It's official. Most of you are morons.
  3. I'm not seeing the "easy" part there. by khasim · · Score: 5, Informative

    Download some malware, pop-up a fake window when the user does something to get the password, sudo with the password, install whatever else you want and setup init scripts, done!

    Okay, that first part "Download some malware". How?

    With Windows it is easy to explain. ActiveX.

    With Linux/Apple, it's not so easy.

    With old versions of Windows/Outlook, you could just mass mail the exploit and hope that enough people hadn't patched Outlook NOT to auto-run some executables.

    Or that they hadn't configured their security zones correctly.

    Microsoft is getting better. But they're still focused on adding layers of "security" instead of taking the simple option and just not installing so many services that the user will probably never use. So if there's any flaw in the various layers, you can still be cracked.
    1. Re:I'm not seeing the "easy" part there. by WeirdJohn · · Score: 2, Interesting

      The trick is to (Step One) get the User to visit an Evil Website: "Naked Lesbian Twins with Machine Guns" should do it.

      (Step Two) Tell the User that a new "Video Codec" must be installed on their Ubuntu|Redhat|Suse System, which requires SuperUser privilege.

      (Step Three) popup a standard webbrowser password dialog, asking for the root password

      (Step Four) Start to download the "Codec Installer" that plays funny games with gcc, expect and python to sudo and install the malware when run.

      (Step Five) Tell user to run 'bash GirlsWithGunsCodecInstaller'

      Your logic error was in assuming that if GNU/Linux had 33% of the desktop then all those extra users were as clued as you. An easy mistake to make, I've done it myself many times. And it's amazing how peoples judgment fails when they have the chance to see naked lesbian twins with guns.

    2. Re:I'm not seeing the "easy" part there. by m50d · · Score: 2, Funny

      This thread is worthless without pics

      --
      I am trolling
    3. Re:I'm not seeing the "easy" part there. by prshaw · · Score: 2, Insightful

      >> Okay, that first part "Download some malware". How?

      Read up on how Storm-Worm got started. It sent an email asking people to go to a site and download something. Guess what, they did what they were told to do.

      Now it may have only have been 1 out of a 1000 people who actually did it, but that number is high enough to get a good start. And then all that those individual computers needed to be able to do was connect to a website and send email. Something pretty much any computer on the internet can do (even Linux boxes running as a user can connect to a website and send email).

      All you need is enough targets to make that 1 out of 1000 (or 1 out of 1000000) to make it work. You don't need some magical hole in the OS, or root privileges, or anything special. You just need enough dumb users that will do what you ask them to do.

  4. Comment removed by account_deleted · · Score: 5, Interesting

    Comment removed based on user account deletion

  5. Re:the fix by QuoteMstr · · Score: 5, Insightful

    Just replace the destination URL with the one you get after following 301 redirects. That shouldn't break anything (301s are meant to be cached, and legitimate URL compression services should be using 301s anyway.)

  6. 21st century war by brit74 · · Score: 2, Insightful

    This enables the Pushdo author to limit distribution of any one of the [421 different] malware loads from infecting users located in a particular country, or provides the ability to target a specific country or countries with a specific payload.

    I can't help but think a lot of malware creators will get rich in the 21st century when governments pay them to attack countries they are at war with - either destroying their computer infrastructure, or acting as spies.

  7. Re:Counter attack is required by SoupIsGoodFood_42 · · Score: 3, Insightful

    Because then people like you end up blasting legit people off the internet by mistake and ignore the problem as collateral damage?

  8. Comment removed by account_deleted · · Score: 3, Informative

    Comment removed based on user account deletion

  9. Command and Control Server by phantomcircuit · · Score: 2, Interesting

    My question is simple, How can the command and control servers for botnets stay up?

    Wouldn't their hosting provider and/or IP block owner not want to end up on blacklists and thus kick them off, thus cutting off all infected systems from further contact.

    1. Re:Command and Control Server by KillerBob · · Score: 4, Informative

      IRC... have a master channel, and configure the virus so it's able to connect to a slave channel and receive commands, or connect to the master channel and relay commands to its slave channel. Program the bot/virus so that it connects to a non-persistent "slave" channel. If it's automatically given moderator status, then it's the first bot in the channel, so it connects to the master channel and functions as a command/control herder. If it doesn't automatically get mod rights, then it functions as a slave and actually does the dirty work.

      And by using a wide open IRC server, of which there's plenty, it's virtually impossible to shut down the network. All the main controller has to do is connect to his "master" control channel periodically to send out commands, and the rest of the herding gets done by his deputies.

      --
      If you believe everything you read, you'd better not read. - Japanese proverb
  10. Re:the fix by Debug0x2a · · Score: 2, Insightful

    Or just disallow links to tinyurl or dwarfurl entirely. I think the detriment would be far outweighed by the benefit.

    --
    First post = troll. Cleverly worded post designed to enrage others = flamebait.