Ice IX Rising Against SpyEye

As commercial crimeware construction tools go, SpyEye has been king of the hill for the last year or so – with dozens of cybercrime organizations adopting it as their attack platform of choice. But has its time come to an end already? In the competitive ecosystem of crimeware construction tools and attack delivery platforms, to maintain a lead, the engineers behind the tools have to continuously innovate and roll out new features to their subscriber-base. In the case of SpyEye, it looks like they’re falling behind and their customers are already switching platforms and providers.

Ever since the public leaking of the 1.3.45 SpyEye builder and some accompanying cracks, a menagerie of “unauthorized” SpyEye resellers and distributors have flooded the hacker forums with cut-price copies of the malware construction tool. As would-be SpyEye sellers tout their latest extensions, fake updates and fixes, the SpyEye original authors have bunkered down – focusing their attention upon only their most trusted customers, and not actively seeking more. As distrust spreads within the cybercrimal fraternity, a number of notable criminal operators have been moving to a new competitor on the block – “Ice IX”.

Ice IX, like its competitors (SpyEye, Zeus, TDL, Hiloti, Carberp, etc.), offers the same core crimeware construction functionality – malware builders, an attack delivery platform, and a management console – and also makes extensive use of third-party developed Web Inject content to extract valuable data from its victims. What makes Ice IX so interesting to (former) SpyEye customers is that it’s being actively maintained and is proving to be a reliable attack platform against even newly patched victims – not to forget being much cheaper too.

Over the last few months Damballa Labs have been tracking a number of criminal operators as they replace their SpyEye installations and migrate to the new Ice IX platform. It is only a trickle at the moment, but we can probably expect more SpyEye operators to transition to other better-supported crimeware construction platforms throughout the year.

To understand why SpyEye is losing out to Ice IX, my colleague Sean Bodmer has pulled together a Research Note on the topic – where he details the crybercriminal migration between attack platforms and discusses the impact on some of the larger (former) SpyEye-based operators we’re tracking.

The Research Note – “SpyEye, being kicked to the curb by its customers?” can be found at http://www.damballa.com/downloads/r_pubs/RN_SpyEye-Kicked-to-Curb_Bodmer.pdf

Mobile Malware Analysis

Every couple of years there’s a new “hot threat” in security for which vendors abruptly tout newfangled protection and potential customers clamor for additional defense options. Once upon a time it was spyware, a few years ago it was data leakage, and today it’s mobile malware. It’s a reoccurring cycle, analogous to the “blue is the new black” in fashion – if you fancy adopting a certain cynical tone.

Lying at the heart of the cycle is the fact that these hot threats have never been particularly new. Within the security community, we tend to talk about the evolution of the threat landscape. If you speak with the relevant experts about a particular threat category you’ll uncover that the back story to many of these “hot threats” often goes back a decade or two. Mobile malware threats are certainly no exception.

A history lesson in the evolution of mobile malware is hopefully not required, beyond to say that today’s hot threat has evolved over a couple of decades and poses less of a technical challenge than many believe or commonly portray. But as history so often reveals in these cases, when a new threat is similarly labeled and thrust into the limelight for the first time, there’s all too often a stampede towards apparently novel and threat-specific solutions.

Solutions (and I use that term very loosely) within the mobile malware threat mitigation arena are increasingly difficult to differentiate from one another. In the confusion of defining a new threat and the nomenclature that accompanies it, the underlying technologies and viability of their approaches can get lost rather easily.

What is the “Mobile Threat”?

When I meet with customers, prospects and journalists, I get a lot of questions about the Mobile Threat. In particular, how should businesses work to defend against it? My immediate response tends to be “what do you define as the mobile threat?”

The term “Mobile Threat” is amorphous – it has become a catch-all to encompass anything not physically tethered to a network and happens to be newish from a technology perspective, and likely subject to some new (previously unencountered) formulation of evilness. That sounds like a kind of wishy-washy definition (and it is), but catch-all’s usually are. Instead, I’d rather focus on one aspect of the Mobile Threat – that of the mobile malware threat.

As I described in a blog entry illuminating a handful of security predictions for 2012, mobile malware threats continue to be misunderstood. It’s all too easy to dive deep in to the various technologies that expose mobile devices to new forms of attack and vectors of compromise; just as it’s rather easy to describe the various built-in technologies that the developers and engineers of the mobile devices have included to prevent many of the “legacy” threat categories we’re already all too familiar with.

You could spin a lot of cycles looking into the “what if’s” of mobile security threats but, at the end of the day, if you want to determine which threats and attack vectors are going to be the most immediate and protectable concern for your organization you only need to understand two things – how do your employees really use their mobile devices, and how are cybercriminals going to monetize their control of these devices?

For a moment, think about this. While Smartphones and Tablets often share a common operating system and maybe even the same application markets or stores, they are used in different ways, at different times, to accomplish different tasks. For this reason the attack vectors cybercriminals (and espionage-focused agencies) choose to launch against them are different for each category of mobile device. The tools – of which the most commonly encountered category is “malware” – are likely to be transportable between devices, but the vectors for installation and the type of meaningful information that can be extracted via them are quite different.

When it comes to the cybercriminals that target mobile devices (which constitute the core element of the “Mobile Threat”), it is interesting to note that they’re pretty much the same entities that have been historically successful in targeting traditional non-mobile devices. That shouldn’t really be a surprise to anyone – it’s all about monetizing the victims. If a particular cybercriminal group specializes in online banking fraud and a third of their potential target list shifts to tablet-based banking applications, they need to make a business decision – do they target the new platform or optimize their attacks against the traditional devices. As mobile application use increases, there’s an increasing driver for cybercriminals to invest in new mobile tool development. Similarly, if employees are wirelessly connecting to corporate systems and assets using mobile devices in preference to other traditional platforms, the attackers are forced to target these new devices and develop the appropriate tools.

It’s important to note that, while the end-point device is physically changing and the specifics of the tools the criminals need to develop and install upon the compromised devices is also changing, at the enterprise network and Internet infrastructure level there has been no change in criminal behaviors; nor is any change actually needed by them. The vast majority of C&C communications are HTTP-based regardless of the malware family or compromised device type. By speaking the same language, the cybercriminals can keep their existing infrastructure… business as usual!

The Role Damballa Plays

One of the questions I commonly get asked on the topic is “what has Damballa been doing to defend against the mobile threat?”

In a nutshell, if you’re operating at the network level (e.g. Damballa Failsafe and Damballa CSP) the specifics of the compromised device and any application-level interactions are irrelevant – which is a round-about way of saying that Damballa customers have had defenses against mobile threats before the term made its red carpet début.

What do we do (or have been doing) in combating the mobile threat?

• Compromised devices that attempt to connect to the servers used by cybercriminals for command and control (C&C) and stolen data drops are identified within customer networks and are alerted upon in real-time. The device operating system, architecture, or communication protocol is irrelevant to this form of detection – and any victim mobile devices are similarly alerted upon.
• Damballa Labs monitors DNS on a truly global and massive scale. In basic terms, every successful domain to IP resolution around the world is recorded and used to automatically map relationships between Internet infrastructure components. This live “map” is augmented with streaming threat information and training data to automatically group, cluster and label the servers and hosting infrastructure used by cybercriminal entities.
  In practical terms what this means is that every time cybercriminals register a new domain and point it to one of their servers, or remove/add new servers, or change hosting facilities, or modify their DNS settings, Damballa Labs is able to identify and associate these changes with the specific criminal entity.
• Dynamic reputation systems such as Damballa Lab’s Notos system provide reliable reputation scoring capabilities for DNS. These technologies are used to detect communications to newly integrated cybercrime infrastructure, independent of whether the domain or IP address has previously been observed as providing C&C functionality.
• Thousands upon thousands of malware samples and suspicious files are harvested by Damballa Labs every day. Automated systems process these files through a mix of dynamic, static and bare-metal analysis systems in order to extract the network behaviors and characteristics of all newly identified malware. By employing a wide variety of clustering and machine learning systems, new C&C domains and IP addresses are automatically identified and associated with malware families, and in turn, the criminal entities that manage them.
  For example, new Android applications (and updates) published to the major international markets are automatically analyzed. For every application identified as “mobile malware”, any new C&C or related communication is in turn associated with a criminal operator and serves as actionable intelligence within the Damballa product range.
• Threat analysts target the most important cybercriminal entities for manual analysis and counter intelligence surveillance. Using a variety of tools, aliases, and social engineering tactics, Damballa Labs analysts gain an insider view of the criminal entities. This insight is used to not only track the latest changes with their operations, but also to preempt new attacks and attack vectors.
• Many times, the malware on the infected device has to search for its C&C – either because the static list of built-in potential C&C’s is out of date, or because it is using Domain Generation Algorithms (DGA) to bypass static reputation systems. Damballa technologies are able to identify malware that attempts to locate its C&C even if the cybercriminals’ C&C cannot be found (and before any communications can commence).
• Damballa Labs has visibility of DNS resolution traffic from multiple authoritative DNS servers. Using technologies such as Kopis, we are able to automatically detect malware-related domains at the upper DNS hierarchy independently of (and a long-time before) malware samples are captured by the security community and analyzed. This technology operates independently of the malware, and is able to forecast domains that are being abused for mobile threats a long time before the mobile application is recognized and classified as malware.

There’s more of course, but these are probably the most significant technologies and approaches that Damballa products use to keep ahead of the mobile malware threat (that I can mention in public). We’re constantly expanding the list of detection and threat tracking/labeling technologies with new research being published by Damballa Labs on a regular basis.

All-in-all, while the much hyped “mobile threat” is likely to bask in the media spotlight for another year or two, it’s comforting to know that defensive technologies are not only already out there but have been successful in combating the threat for several years already.

Static vs. Dynamic Reputation (or, why Blacklists suck more each day)

If you look deep enough, hidden at the darkest recesses of most security technologies deployed within enterprise networks today, you’ll find static reputation systems chugging away doing the grunt work of threat protection. They’re not glamorous and vendors have had a propensity to instruct their sales force (and resellers) to refrain from mentioning them to customers and prospects in recent years. They’re a legacy hangover from the days when cutting-edge security consisted of blacklists and regex signatures.

Static reputation systems are effectively frameworks for managing lists of previously classified goodness or badness – i.e. blacklists and whitelists. Their basic concepts are thoroughly understood and they tend to perform tremendously well as a first-pass filter for many of the most prevalent threat categories. So, despite their aged stature, they are an incredibly valuable tool. In fact, for many threat categories, modern protection products wouldn’t be able to handle traffic volumes if static reputation systems didn’t perform the first pruning of inbound threats. For example, in the world of Anti-Spam up-to-date blacklists of just a few hundred known bad IP addresses can reduce the spam volume that more sophisticated technologies must parse by 90+ percent.

There are however many limitations to static reputation systems. In a world of increasingly agile threats and a fundamentally dynamic (and some would say ‘chaotic’) Internet infrastructure, static reputation systems are simply incapable of keeping pace. Some short-term fixes have been applied – for example, releasing and importing updated blacklists more frequently, or pruning overly long blacklists to the most reliably static data in an attempt to remove “false positives”. Whilst these quick fixes have extended the life of some static reputation systems, the frayed edges have been exposed and are being constantly picked at.

In response to the failures and reducing viability of static reputation systems, a number of dynamic reputation system approaches have come to the fore in recent years. These new approaches seek to be more accurate in discerning goodness and badness, and to dynamically keep pace with agile threats and continuous Internet change.

Dynamic reputation systems aren’t a one-for-one replacement for systems currently dependent upon static reputation. While their protection objectives are similar, their output and delivery are quite different. Static reputation systems are effectively Boolean list technologies; the IP/Domain/URL/etc. is either on the list or it isn’t. Dynamic reputation systems typically operate as a queryable API and provide answers in a “score” format.

These scores can change at a moment’s notice as new intelligence relating to the IP/Domain/URL/etc. are received, features extracted and classified, and are derived in real-time. The scores themselves can often be interpreted as probabilities or confidence in a particular threat classification – and are delivered as values between zero and one, or as a percentage.

If you’re interested in learning more about the limitations of static reputation systems and how dynamic reputation systems have begun to replace them (and why), I’ve released a new reference paper on the topic – “Blacklists & Dynamic Reputation – Understanding Why the Evolving Threat Eludes Blacklists“- and it can be found on the Damballa website.

Dialing in the Malware

Despite several decades of anti-malware defense development, the pro-malware industry is still going strong. As I listen to presentations here at VB2011 in Barcelona this week covering many aspects of malware-based cyber-crime and the advances in detection being made, I'm reminded of a recent posting I made on the Damballa site concerning the success of malware. At the end of the day it costs the attacker practically nothing to generate new malware instances and, with a little investment in a QA process, they can guarantee evasion...

There’s often a lot of discussion about whether a piece of malware is advanced or not. To a large extent these discussions can be categorized as academic nitpicking because, at the end of the day, the malware’s sophistication only needs to be at the level for which it is required to perform – no more, no less. Perhaps the “advanced” malware label should more precisely be reattributed as “feature rich” instead.

Regardless of whether a piece of malware is designated advanced or run-of-the-mill, and despite all those layers of defense that users have been instructed to employ and keep up to date, even that ever-so-boring piece of yesteryear malware still manages to steal its victims banking information.

How is that possible?

I could get all technical and discuss factors such as polymorphism and armoring techniques, but the real answer as to why the malware manages to slip by all those defenses is because the bad guys behind the attack tested it prior to release and verified that it was already “undetectable” before it was shipped down to the victim’s computer. Those host-based defenses had no chance.

It’s worthwhile noting that generating “unique” malware is trivial. Armed with a stock-standard off-the-shelf DIY construction kit, it is possible to manually generate several hundred unique variants per hour. If the cyber-crook is halfway proficient with scripting they can generate a few thousand variants per hour. Now, if they were serious and stripped back the DIY kit and used something more than a $200 notebook, they could generate millions of unique variants per day. It sort of makes all those threat reports by anti-virus vendors that count the number of new malware detected each month or year rather mute. Any cyber-criminal willing to do so could effectively choose what the global number of new malware will be and simply make enough variants to reach that target. I wonder if any online betting agencies will offer worthwhile odds on a particular number being achieved. It may be worth the effort.

Armed with a bag of freshly minted malware, the cybercriminal then proceeds to test each sample against the protection products they’re likely to encounter on potential victim’s computers – throwing out any samples that get flagged as malware by the anti-virus products.

Using a popular malware DIY construction kit like Zeus (retailing for $4,000, or free pirated version via Torrent download networks), the probability of any sample being detected even at this early testing stage tends to be less than 10 percent. If the cybercriminal chooses to also employ a malware armoring tool that average detection rate will likely drop to 2 percent or less.

Obviously this kind of testing or, more precisely, Quality Assurance (QA) is a potentially costly and time-consuming exercise. Never fear though, there are a lot of entrepreneurs only too happy to support the cybercriminal ecosystem and offer this kind of testing as a commercial service.

Today there are literally dozens of online portals designed to automatically test new malware samples against the 40+ different commercially-available desktop anti-virus and protection suites – providing detailed reports of their detection status. For as little as $20 per month cybercriminals can upload batches of up to 10,000 new malware samples for automated testing, with the expectation that they’ll receive a thoroughly vetted batch of malware in return. These “undetectable” malware samples are guaranteed to evade those commercial protection products. As a premium subscription service model, for $50 per month, many QA providers will automatically fix any of the malware samples that were (unfortunately) detected and similarly guarantee their undetectability.

Armed with a batch of a few thousand fully-guaranteed malware samples that are destined to be deployed against their victims in a one-of-a-kind personalized manner, it should be of little surprise to anyone precisely why run-of-the-mill or feature-rich malware manages to infect and defraud their victims so easily.

Tuning Spear Phishing Campaigns

I was recently asked to discuss tools and tactics of cyber-crime campaigns in relation to advanced spear phishing tactics. One of the interesting service industries that form the advanced criminal ecosystems is that of ProRing. The following Damballa post summarizes this particular industry...

Despite the advances in anti-spam technologies and mail filtering gateways, if you’re inbox is anything like mine, each morning there will be a bundle of emails offering a cut of some recently liberated or long forgotten monies, offers to work from home (all you need is a US bank account!), notifications of bank detail confirmation requests, or some obscure social engineering whatever. We’ve all seen them, and most of us recognize them for what they are – broad spectrum Internet scam campaigns launched by online crooks.

Again, if you’re anything like me, sometimes you’ll catch yourself laughing at the content of the spam emails. Too often the language is all mixed up, has misspellings, and was obviously written by someone to whom English is a second language).

For the victims, these messages are the start of their problems. For the attackers, the distribution of these messages is roughly a halfway point in their current fraud campaign. For some specialized criminal operators, the content of that email is the culmination of their efforts and contribution.

I was reminded recently by the following very funny (and obviously not serious) tweet that there hasn’t been much attention to the organized crime aspects of translation – in particular, the realm of cybercrime-as-a-service (CaaS).

Figure 1: Humorous tweet in Chinglish with misspellings

It should be no surprise that there are CaaS providers that offer boutique translation services to other Internet criminals.

For quite a few years now there have been folks working behind the scenes translating the content supplied by foreign criminals into the messages arriving in your inbox. I’m not talking about those pigeon-English things you receive and rapidly reject, but rather the ones you’re probably missing based upon a first-pass grammar and spell check. Translation services are rather lucrative for those involved. If you happen to be a fluent English speaker/writer and based in Russia, you can make a couple hundred dollars for each phishing email template you convert or social engineering message you construct. For some CaaS operators a percentage of any fraudulently gained funds may be part of the deal – tying the payment to their translation capability and the success of the attacker’s campaign.

Translating the written language is one thing, it is quite another if you have to speak it. As such, there are a number of CaaS operators that specialize in what could be best described as translation call centers. A common name for these kinds of criminal services are “ProRing” – basically “professional ringing” services, tuned to the requirements of criminals (not just online ones either!).

Supporting a small number of languages, ProRing services are often utilized by cyber-criminals in a variety of ways:

* Account change confirmation for stolen and hijacked accounts

* Money mule coordination and bank account management

* Package tracking and delivery

* Vishing message construction

* Spear phishing “helpdesk” impersonation

* Social engineering

Figure 2: ProRing service supporting multiple languages

The larger more established ProRing providers tend to support the most common languages encountered in Western countries (i.e. English, German, French and Spanish), although other languages may be included – depending upon staffing arrangements and access to external contractors (e.g. Dutch, Serbian, Hebrew, etc.). Several providers also offer male and female speakers.

Rates vary considerably between ProRing providers, but are generally in the realm of $10-$15 per call (made/received), and will increase in price if the speaker does not possess a foreign accent.

The phone numbers being used for the calls will often use callerID spoofing and/or local POP exchanges to hide the international nature of the call. However, it is important to note that many of these ProRing CaaS operators are themselves international and may not necessarily need to obscure their phone number.

Figure 3: ProRing CaaS provider with disclaimers

As with many CaaS providers, ProRing services often come complete with disclaimers and service-level agreements (SLA), which may require financial retainers for participation in longer-running attack campaigns.

So, the next time you’re inspecting your morning email or cycling through those voice-mail messages, you may want to remember that this rapidly evolving cyber-crime ecosystem has your number (literally). Professional ProRing service providers are out there making sure that the next attack is more successful than the last.

Cyber-siege Strategy

The tactical view of cyber-warfare is that of hacking in to systems, infiltrating data and causing systems to self-destruct. It's all a bit Hollywood in many ways, or at least that's the perception of many not intimately involved in dealing with the threat.

I recently wanted to address the strategic concepts of cyber-warfare - in particular the non-destructive aspects of an attack. The first article covering the strategic objectives of modern cyber-war was published yesterday on eSecurityPlanet with the subject "Siege Warfare in the Cyber Age".

In the article I point out the value of non-kinetic attacks and the restoration of device control at the end of hostilities (or regime change), and how future cyber-warfare can take on a siege-like approach.

Predicting Crime Hotspots

There’s a new sheriff in town and he’s riding the horse of “predictive policing”. Back in July the Santa Cruz Police Department began deploying police officers to places where crime is likely to occur in the future – making use of new predictive modeling programs that are designed to provide daily forecasts of crime hotspots – thereby allowing the Department to preempt more serious crimes before they occurred. You can find a story describing how Santa Cruz is sending in the police before there’s a crime in The New York Times.

In essence, this is another physical-world application of machine learning and clustering technologies – applied to preempting a criminal problem. In the cyber-world we’ve been applying these techniques for a number of years with great success. In fact many of the most important advances in dealing with cybercrime revolve around the replacement of legacy IP reputation systems and domain filtering technologies with dynamic reputation systems – systems easily capable of scaling with both the threat and an ever-expanding Internet (e.g. IPv6).

Just last week Manos Antonakakis (a principal scientist at Damballa Labs) presented at the USENIX Security 2011 conference in San Francisco about a new generation of technology capable of identifying domain names being used for malicious purposes weeks, if not months, in advance of malware samples being intercepted, analyzed and “protected” against by legacy anti-virus approaches.

The patent-pending technology utilizes passive DNS observations within the upper DNS hierarchy, and the paper describing the first generation of research (and cybercrime proof-points) can be found in the paper “Detecting Malware Domains at the Upper DNS Hierarchy“. The system running here within Damballa Labs is affectionately known as “Kopis” and has proved its worth time and again preemptively identifying new botnets and cybercrime campaigns – keeping our Threat Analyst team busy with enumerating the real-world criminals behind the domain abuse.

The Kopis system extends many of the principles and research we learnt and formulated when developing the Notos technology – a next generation dynamic reputation system for DNS.

In several ways the Santa Cruz Police Department’s modeling systems approximates an early generation of such a dynamic reputation system – utilizing a mix of long term observations and historical information, combined with real-time crime updates, the output of which is a forecast capable of predicting hotspots for daily crime.

Damballa Labs utilizes Notos and its derivative output evolutions in a number of ways. For example, we’re able to take any observed DNS record (e.g. domain name and resolved IP address) and provide a real-time score of its reputation – even if this is the first time anyone on the Internet has ever tried to resolve that particular domain name. In practice this means that we can predict (with a scale of confidence) that connecting to a device utilizing that particular domain name (or IP) is malicious (or good) and the nature of the threat it represents – all done through passive means, and without having to have observed the maliciousness directly associated with the device anytime in the past.

Systems like Notos make use of big data (i.e. colossal volumes of historical and streaming data) gathered from a global array of sensors. The mix of historical observations and real-time data feeds means that prediction models can be dynamic enough to keep pace with truly agile threats (and threat operators) – and can yield new approaches in unveiling advanced and sophisticated threats. For example, a possible query could be “provide me a list of domain names that are pointing to residential DSL IP addresses within Villianstan, that have never been looked up by any hosts within the country of Villanstan, that have only been looked up by hosts located within Fortune-100 companies in the USA, and that the number of Fortune-100 companies doing so is less than 5 over the last 12 months.” The result of the query would be a (long) list of domain names that are very high contenders for APT victims, which then drives specialist counter-intelligence analysts and law enforcement to uncover the nature of the threat.

In the meantime I’ll be watching with keen interest the successes of the Santa Cruz Police Department and their new modeling programs. Here at Damballa we’ve had phenomenal success in using machine learning and advanced clustering techniques in unveiling and forecasting new threats.

Practical Packet Analysis Book Review

This week I had the opportunity to read Chris Sanders’ newly released book “Practical Packet Analysis” (second edition) – published by No Starch Press. While I’m not a frequent reader of technical computing books (they’re always a little too bulky for flights and carryon), I was looking for a book I could recommend and pass on to junior security consultants and threat analysts (as well as a few engineers).

Practical Packet Analysis proved to be a good read and I even managed to pick up a few tips on recent features within Wireshark that I’d not previously had a chance to experiment with; but am now looking forward to applying to real-world traffic.

While the book isn’t deeply technical (it’s not meant to be), it performs a very nice walk through of the practical aspects of performing network analysis and investigating packet captures. All too often in the past I’ve encountered network analysis books that either skim through the real-world problems an analyst or engineer will encounter, and rapidly descends in to the weeds of some obscure and contrived examples. Chris manages to navigate these waters is a clear and informative way. The practical analysis examples provide a breadth of understanding of not only the nuances and features of Wireshark, but also the common problems encountered by analysts tasked with troubleshooting their own networks. The sort of things they need to know asap if they’re going to be productive in a minimal amount of time

A chapter I particularly appreciated for its inclusion centered on how and where you should tap a network in order to perform analysis. You wouldn’t believe how many times that chapter alone could have prevented much wasted effort – if only folks had had access to it (and read it).

On the whole, I’d recommend this book to junior network analysts, software developers and newly minted MCSE/CISSP/etc. – folks that just need to roll up their sleeves and get started troubleshooting network (and security) problems. My copy of the book has already been passed on to a third pair of hands for reading and brushing up on the practical application of Wireshark. Great work Chris!