Slashdot Mirror
IE Zero-Day Exploit Disappears On Reboot
nk497 writes "Criminals are taking advantage of unpatched holes in Internet Explorer to launch 'diskless' attacks on PCs visiting malicious sites. Security company FireEye uncovered the zero-day flaw on at least one breached U.S. site, describing the exploit as a 'classic drive-by download attack'. But FireEye also noted the malware doesn't write to disk and disappears on reboot — provided it hasn't already taken over your PC — making it trickier to detect, though easier to purge. '[This is] a technique not typically used by advanced persistent threat (APT) actors,' the company said. 'This technique will further complicate network defenders' ability to triage compromised systems, using traditional forensics methods.'"
The term has been used in the IT security industry for years.
APT is the new buzzword in IT security, like Web 2.0 for web developers or Cloud for the server guys. APT means bad guys of moderate sophistication all the way to government agencies, so everyone but script kiddies running standard exploit kits.
Seems kinda silly for Debian to have a command to intentionally go out and get those things...
Spying is boring.
When's the next SQL Slammer?
APT is the new buzzword in IT security, like Web 2.0 for web developers or Cloud for the server guys. APT means bad guys of moderate sophistication all the way to government agencies, so everyone but script kiddies running standard exploit kits.
New buzzword? Unless you have been living under a rock the last few years, IT speaking, these are all rather old.
Definitely security buzzword bingo:
... diskless attack ... APT ... actor ... network defender ... triage ...
We get it, dude, you find buffer overflows and stuff. You're not a surgeon.
Sounds like their APT doesn't have super cow powers...
Support the EFF and Creative Commons. The war is coming, and they're supporting you...
Why? It's a very apt term.
"us"
AC is a veteran? Core Wars excepted.
It's still the Advanced Passenger Train to me.
Let the train take the strain.
Another Windows problem that can be fixed by having the user restart his or her computer!
AFIK WriteProcessMemory and CreateRemoteThread APIs require root. (specifically SeDebugPrivilege)
But you already knew not to run IE as root right?
Disappears on reboot is a limitation, not a feature. If you get root you could always remove payload, if it disappears on its own then it is likely limitation of specific sandbox bypass method. If I had to guess, Zero-Day is related to ElevationPolicy fix for CVE-2013-3186.
This is the first time I've ever seen the value being used in an XOR loop referred to as a "key".
Just because a bunch of "security" dbags use a term doesn't make a thing.
I want to delete my account but Slashdot doesn't allow it.
It's maybe complicated unless forensics are capturing a memory image... which they should be these days.
APT = Always Puke on Tilt
Many people felt sick when the train tilted. According to a mate of mine who worked on it, they couldn't get the tilt damping right. Too little feedback in the control system apparently.
We get it, dude, you find buffer overflows and stuff. You're not a surgeon.
But he did stay in a Holiday in last night.
It's a polite way of saying "governments" because we used to pretend that out own government wouldn't be doing this to us, so "governments" seemed too broad.
Socialism: a lie told by totalitarians and believed by fools.
If all you wanted was the data on the end users disk; e.g. credit card numbers, logins, cookies, email passwords, etc; then this is a desirable feature as it makes it much harder for an individual defending systems to get a copy of the code and exploit.
Additionally, if the worm or virus agent is polymorphic in nature, then this assists in avoiding detection by antivirus scans. Remember, those scans slow down end user machines, many companies only do them once a week. By the time the antivirus company updates their heuristics algorithm your code is commited to cybernetic oblivion.
Two broad approaches exist.
Firstly, the rootkit: 'implant' an agent (monolithic or multipartite) which stays as persistent as possible, maintaining control of the system. The most extreme case I've seen writes new firmware to the NIC, which is loaded by the BIOS or UEFI code; this alters the CPU microcode slightly to change TLB handling and then chains a hypervisor into the boot process which is (thanks to the TLB update) hard to detect, and a major barnacle to get rid of - the payloads dropped by the hypervisor's code injections are nowhere near as ninja but somehow keep coming back. (Now you know one more place to look and the general class of attacks if you didn't notice before.)
Alternatively, the CRIT (Covert Remote Intrusion Tool): a non-persistent agent which runs a stealthy process, and when it's done, unloads itself from RAM. Notably, CRITs are never truly reset-proof: this is a conscious design decision. An ideal CRIT leaves absolutely no forensic trace on disk or RAM of the target machine after it disappears (although traces of the vector of infection might need to be cleaned up, and there's always the possibility of server logs from something else - if anyone even knows to look at it). The real world, of course, is rarely so elegant, as anyone who remembers how TSRs weren't always quite so trouble-free.
It is a difference in intent, signalled via design. One prioritises maintaining control above stealth; the other prioritises maintaining stealth above control.
It is telling that the NSA and GCHQ attacks found in the wild so far or described in leaked documents have all been rootkits and never CRITs. Of course, that may be because CRITs simply weren't written of, weren't leaked yet, or were more unlikely to be discovered, but it seems more likely that this is a wide, strategic decision: maintaining control of an asset as long as is possible, even if its cover is blown.
It is very hard to conceive of effective countermeasures - it is, as I unfortunately predicted a little over 15 years ago when I first publicly described such a possibility, likely to become (and now remain) an arms race, between state actors (who, it seems, always wear the black hats), and between non-state actors (black-hats and white-hats alike). In truth, all such agents are terribly dangerous, particularly those with autonomous spreading capabilities, or merely capricious greedy idiots at the keyboard. Perhaps they should be regulated via treaty, like the biological weapons their action resembles: that is an act for politicians and those who lie with a smile on their face. Perhaps we, as engineers, should concentrate on fixing the bugs the vectors exploit; but alas, I fear that may be like trying to sail a giant colander across the Pacific armed only with tape.
I have grave concerns about the direction this whole mess is headed. They have taken what may be the greatest achievement of humankind, and threaten it more than any terrorist ever could, because terrorists don't have a billion dollar budget and a whole world's trust to undermine. We can but try, and do what we can, to fix such damage, and route around it, wherever we find it and whomever perpetrates it for whatever reason - it is all, simply, a bug, at its heart, and bugs need fixing. Perhaps we can build protocols, and software, far more resilient at their core; but until they are ready, please at least let me have my cat pictures and my tea and my discourse and my computer games, lest I become mad as hell and cannot take it anymore. I grow weary. And quietly bitter.
Sure it dissapears!
Unless you're running IE as admin, you have UAC disabled and the malware has installed a hypervisor and you're hickjacked forever without having any chance to detect it. How long before we see that?
Doh!!!
Holiday 'Inn' not 'Holiday in'
Good thing it wasn't written to disk....
Disappears on reboot is a limitation, not a feature
The most sophisticated malware in modern times, Stuxnet, had a built in self-destruct. How is it that a feature that disappears after a certain number of days a feature, but after a reboot not a feature?
If you get root you could always remove payload, if it disappears on its own then it is likely limitation of specific sandbox bypass method.
Small comfort to those who enter their credit card data and then wake up to $-300 dollars, two weeks to pay day, rent due, and not enough gas or food to last. People need to stop being so puritanical about exploits... "Oh, it disappears after reboot, big deal!" ... If it manages to do damage, it doesn't matter.
#fuckbeta #iamslashdot #dicemustdie
THIS! Plus there's the summary which says "and disappears on reboot **********provided it hasn't already taken over your PC********** making it trickier to detect".
I think they're suggesting that it's a dropper that doesn't start from disk but might make itself persistent later on.
>Web 2.0 for web developers or Cloud for the server guys
That's the marketing guys. Any dev who says web 2.0 is... limited.
Once a guy asked if the website I was working on for him was Web 2.0 compatible....
What the hell....you get a point and I don't? Damn you, Slashbots....damn you all to hell!
Why do *we* need to keep the *world* free?
There are two types of people in the world: Those who crave closure
They attempted polymorphism with they key change. Fireeye blog stated: "this 4-byte key is present at offset 0 and changes with each subsequent beacon.". I have no idea how effective this would be, but my guess is that it would defeat all off-the-shelf detectors. If you use static key AV vendors simply add a rule to signature detection. Cryptographically speaking, exploit authors are not 'encrypting' this to keep data secret, or they wouldn't use 4-byte key.
Re:" Copy of the code and exploit"
You have exploit and you have payload. Exploit is always there in pcaps and whatever website that got compromised and serving this, so it is very difficult to completely hide it. Not sure if "memory only" makes it any more difficult for forensic analysis, since payload (trojan) is still there. Attacker wouldn't be uploading such 'red flag' payload if they wanted to keep intrusion hard to detect. This tells me it was likely a smash and grab job.
To answer your question - one is controlled entirely by exploit/malware authors and other is not.
I didn't say it did, I was just pointing out that it was not just made up.
So it's a perfectly cromulent expression.
MOO
Indeed, I've been using it for almost a decade now, A lot of my programs depend on it to install and update :)
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
Or, this is simply bad reporting and this particular piece of malware is deliberately engineered to not persist to disk.
This PDF is much more informative than the summary or TFA. I got interested, and followed links, stumbling over this along the way.
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/hidden_lynx.pdf
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
It is even more apt to follow links from TFA to get the real story.
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/hidden_lynx.pdf
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
To answer your question - one is controlled entirely by exploit/malware authors and other is not.
Yeeeeah... a difference that's sufficiently important why again? Most computer today don't reboot; they hibernate. It could be days to weeks now before they actually wipe it. Weeks during which, it's hoover-vacing every piece of data you put in your browser. Now, let's be honest -- how much do you really do with your computer if your internet is down?
o____o
#fuckbeta #iamslashdot #dicemustdie
If all you wanted was the data on the end users disk; e.g. credit card numbers, logins, cookies, email passwords, etc; then this is a desirable feature as it makes it much harder for an individual defending systems to get a copy of the code and exploit.
Additionally, if the worm or virus agent is polymorphic in nature, then this assists in avoiding detection by antivirus scans. Remember, those scans slow down end user machines, many companies only do them once a week. By the time the antivirus company updates their heuristics algorithm your code is commited to cybernetic oblivion.
That's my take as well. If you're a thief breaking into a building to get a copy of important files, you don't leave a busted out window and the safe sitting wide open. The best theft is the one no-one realized happened. For example, the break into Bit-9 where they stole a digital signing cert would have been far more useful if it wasn't detected. Or instead of stealing something, you're leaving something behind such as installing a trusted root cert that you control.
Just because you say you are a Gothmolly doesn't make it a thing!
Because we'd be down to less than 4 races by now if we hadn't?
http://scherbius2014.de/HandbuchScherbius2014.pdf
(only in German for now, Google translate is your friend)
In short:
+ Disconnect the cipher machine from the net or be compromised
+ Symmetric crypto and key couriers defeat quantum crypto
+ Carrier pigeons might be an excellent idea after all
APT was made up to make low-level background brute force attacks seem more impressive when a certain security vendor was caught with their pants down and lost their token seed data.
LOL, no.
There are two types of people in the world: Those who crave closure
I was under the impression that it only took one core because multicore didn't become popular until 2006, the last year of the Windows XP era, when the first Intel Core Duo (a rebadged Pentium M) was introduced. This means a PC that shipped with Windows XP likely has only one core, meaning it only takes one real-time thread to stall it.
how much do you really do with your computer if your internet is down?
I usually keep enough reading material or coding projects on my laptop to last a few hours of being offline. This comes in handy on my bus commute, as I don't have to pay hundreds of USD per year for cellular broadband.