RottenSys malware found pre-installed on chinese Android devices

RottenSys malware found pre-installed on chinese Android devices

A new strain of malware named RottenSys has been discovered targeting users for fraudulent ad revenues.

Experts at Checkpoint said that the malware has already infected around 5 million devices since 2016 and since the beginning of February 2018 attackers have been discovered testing a new botnet campaign via the same C&C server.

“The Check Point Mobile Security Team has discovered a new widespread malware family targeting nearly 5 million users for fraudulent ad-revenues. They have named it ‘RottenSys’ for in the sample we encountered it was initially disguised as a System Wi-Fi service.”

Researchers discovered the malware after finding an unusual self-proclaimed system Wi-Fi service (系统WIFI服务) on a Xiaomi Redmi phone which does not provide any secure Wi-Fi related service to users. Instead, it asks for various android permissions such as accessibility service, silent download permission, and user calendar access permissions.

The RottenSys malware operates using two evasive technique. The first one is postponing its operation for a set time to avoid the connection between the malicious app and the malicious activity.

The second evasive technique uses a dropper component which at first does not display activity. Once the device is active, it installs the dropper and contacts the command and control server. Then C&C server sends the list of additional components required for its activity.

These additional components consist of actual malicious codes which are downloaded from the command and control server after the dropper receives the list.

The malware uses two open-source projects called Small and MarsDaemon. Small is Android application virtualization framework which allows all components to run in parallel at the same time.

MarsDaemon is used to keeps the processes alive. It helps attackers to inject add even if the user closes them.

Researchers said that the botnet will have features such as silently installing additional apps and UI automation. “Interestingly, a part of the controlling mechanism of the botnet is implemented in Lua scripts. Without intervention, the attackers could re-use their existing malware distribution channel and soon grasp control over millions of devices.”

The malware began infecting from September 2016 and has infected 4,964,460 devices till March 12.

At the time the malware was seen only targeting Chinese users. The top brand models impacted by the malware are  Honor, Huawei, Xiaomi, Oppo, Vivo, and Meizu.

According to the analysis the malware has earned around $115k for last ten days alone. The calculated the revenue from these impressions and clicks according to the conservative estimation of 20 cents for each click and 40 cents for every thousand impressions.

To check if your device is infected with RottenSys, go to Android system settings→ App Manager, and then look for the following possible malware package names:

• com.android.yellowcalendarz
• com.changmi.launcher
• com.android.services.securewifi
• com.system.service.zdsgt

If any of above is in the list of your installed apps, simply uninstall it.

Read More

Backdoored Russian BitTorrent client MediaGet infect 400,000 users

Backdoored Russian BitTorrent client MediaGet infect 400,000 users 

A massive malware outbreak that attempted to infect over 400,000 users during a 12-hour period was caused by a backdoored Russian-based BitTorrent client named MediaGet.

The outbreak happened last Tuesday, on March 6. Microsoft said that the Windows Defender team picked up and stopped a massive malware operation that came out of the blue and attempted to infect mostly Russian and Turkish users with the Dofoil (Smoke Loader) trojan.

Microsoft published an in-depth report of how the malware operated, revealing Dofoil would later try to download and install a Monero miner.

At the time, Microsoft did not reveal how Dofoil landed on users' computers, mainly because it was not entirely sure. Now, the company has published more details, and according to the Windows Defender team, the Dofoil malware landed on users' computers via a file named my.dat, created by mediaget.exe —the MediaGet BitTorrent client's binary.

MediaGet hack happened in mid-February

"Our continued investigation on the Dofoil outbreak revealed that the March 6 campaign was a carefully planned attack with initial groundwork dating back to mid-February," the Windows Defender team said today in a new report.

Microsoft alleges hackers broke into MediaGet's infrastructure, and sometimes between February 12 and 19, attackers managed to replace the official MediaGet installer with one that also included a backdoor.

Hackers then allowed for a two-week window so users would install or update to the new MediaGet versions, the one containing the backdoor.

Attackers started running first tests on March 1, by using the backdoor to plant malware on users' computers and sprung their main attack on March 6, when they delivered the Dofoil+coinminer malware combo.

During their attack, crooks also used a stolen digital certificate to sign the poisoned MediaGet update, in an attempt to avoid detection.

Microsoft said it notified both MediaGet and the company's whose certificate crooks have abused. Bleeping Computer could not reach MediaGet for additional comments on the incident, mainly to clarify how hackers broke into their network.

Supply chain attacks are very efficient

This incident is not the first time when hackers broke into websites to poison a BitTorrent client with malware. Previously, hackers breached the site of the Transmission BitTorrent client on two separate occasions. First, they distributed the KeRanger ransomware, and later the Keydnap infostealer malware, both incidents aimed at Mac users.

Hackers have also breached other software distribution websites in the past to insert malware into downloadable files. Other incidents include phpBB, Elmedia Player, HandBrake, and Linux Mint.

But, of course, the most prominent supply chain attack still remains the NotPetya ransomware outbreak —carried out via a tainted update for M.E.Doc, a Ukrainian accounting software program.

 Source

https://www.bleepingcomputer.com/news/security/400k-malware-outbreak-caused-by-backdoored-russian-torrenting-client/

 

Read More

MOSQUITO attack allows to data extrusion from Air-Gapped computers via leverage connected speakers

MOSQUITO attack allows to data extrusion from Air-Gapped computers via leverage connected speakers

MOSQUITO is new technique devised by a team of researchers at Israel’s Ben Gurion University, led by the expert Mordechai Guri, to exfiltrate data from an air-gapped network computers using speakers, headphones, earphones, or earbuds.

MOSQUITO: Covert Ultrasonic Transmissions between Two Air-Gapped Computers using Speaker-to-Speaker Communication

The attack is only experimental at this point, has not been seen in the real world, but has been proven to work and researchers have also created a custom protocol for transmitting data between two computers  —one air-gapped and one Internet-connected that can relay the data further.

 Attack scenarios include speaker-to-speaker exfiltration, speaker-to-headphones, and headphones-to-headphones.

Jack retasking strikes again!

The attack —nicknamed MOSQUITO— is possible because of a technique called "jack retasking" that reverses output audio jacks to input jacks, effectively turning speakers into (unconventional) microphones.

The same research team explored jack retasking in a previous research project last year, called Speake(a)r, which researchers used to turn headphones into microphones and record nearby audio and conversations.

For the current experiment, researchers argue that malware that managed to infect an air-gapped computer can transform and modulate locally stored files into audio signals and relay them to another nearby computer via connected speakers, headphones, earphones, or earbuds.

The receiving computer, also infected with malware, uses jack retasking to convert connected speakers, headphones, earphones, or earbuds into a makeshift microphone, receive the modulated audio, and convert back into a data file.

MOSQUITO attack supports pretty fast transfer speeds

Researchers created a custom data protocol that modulates binary data into audio signals, and they tested their attack for distances between 1 and 9 meters (3.2 to 29.5 feet).

Researchers said they managed to transfer data between two computers with speeds varying from 1800 bits/s and 1200 bits/s for speakers facing each other and emitting sound in audible frequency bands (lower than 18kHz).

Transfer speeds decreased if the speakers weren't facing each other, the distance between speakers increased, or audio frequency changed (towards low or high frequency). While the first two factors are self-explanatory, the last needs an additional explanation.

"The reason for that is that loudspeakers, and particularly home grade PC loudspeakers, were projected and optimized for human auditory characteristics, and therefore they are more responsive to the audible frequency ranges," said researchers.

Transfer speeds also decreased when using earphones or earbuds (varied between 600 bits/s and 300 bits/s) and went even lower for headphones (around 250 bits/s). The reason was that headphones directed their sound waves in one particular direction, limiting efficient exfiltration cases to very small distances when headphones were close to each other, and when they emitted sound in audible frequencies only.

Other factors that decreased data transfer speeds included environment noise such as music and speech, but researchers said this could be mitigated by moving the data exfiltration frequency above 18kHz.

The research team discusses various mitigation and countermeasures in their research paper entitled "MOSQUITO: Covert Ultrasonic Transmissions between Two Air-Gapped Computers using Speaker-to-SpeakerCommunication." They also released the following demos to showcase their work.

The research center from the Ben-Gurion University of the Negev who came up with this new data exfiltration technique has a long history of innovative and sometimes weird hacks, all listed below:

LED-it-Go - exfiltrate data from air-gapped systems via an HDD's activity LED
SPEAKE(a)R - use headphones to record audio and spy on nearby users
9-1-1 DDoS - launch DDoS attacks that can cripple a US state's 911 emergency systems
USBee - make a USB connector's data bus give out electromagnetic emissions that can be used to exfiltrate data
AirHopper - use the local GPU card to emit electromagnetic signals to a nearby mobile phone, also used to steal data
Fansmitter - steal data from air-gapped PCs using sounds emanated by a computer's GPU fan
DiskFiltration - use controlled read/write HDD operations to steal data via sound waves
BitWhisper - exfiltrate data from non-networked computers using heat emanations

Unnamed attack - uses flatbed scanners to relay commands to malware infested PCs or to exfiltrate data from compromised systems

xLED - use router or switch LEDs to exfiltrate data

Shattered Trust - using backdoored replacement parts to take over smartphones

aIR-Jumper - use security camera infrared capabilities to steal data from air-gapped networks

HVACKer - use HVAC systems to control malware on air-gapped systems

MAGNETO & ODINI - steal data from Faraday cage-protected systems

Source

https://www.bleepingcomputer.com/news/security/data-exfiltration-technique-steals-data-from-pcs-using-speakers-headphones/

Reference

https://arxiv.org/pdf/1803.03422.pdf

Read More

APT Hackers Infect Routers to Covertly Implant Slingshot Spying Malware

Kaspersky Security researchers have identified a sophisticated APT hacking group that has been operating since at least 2012 without being noticed due to their complex and clever hacking techniques. 

CANCUN, Mexico--(BUSINESS WIRE)--Kaspersky Lab researchers have uncovered a sophisticated threat used for cyber-espionage in the Middle East and Africa from at least 2012 until February 2018. The malware, which researchers have called ‘Slingshot,’ attacks and infects victims through compromised routers and can run in kernel mode, giving it complete control over victims’ devices. According to researchers, many of the techniques used by this threat actor are unique and it is extremely effective at stealthy information gathering, hiding its traffic in marked data packets that it can intercept without trace from everyday communications.

.@Kaspersky researchers have identified #Slingshot, a sophisticated #threat used for cyber-espionage. #TheSAS2018

Tweet this

The Slingshot operation was discovered after researchers found a suspicious keylogger program and created a behavioral detection signature to see if that code appeared anywhere else. This triggered a detection that turned out to be an infected computer with a suspicious file inside the system folder named scesrv.dll. The researchers decided to investigate this further. Analysis of the file showed that despite appearing legitimate, the scesrv.dll module had malicious code embedded into it. Since this library is loaded by ‘services.exe,’ a process that has system privileges, the poisoned library gained the same rights. The researchers realized that a highly advanced intruder had found its way into the very core of the computer.

One of the most remarkable things about Slingshot is its unusual attack vector. As researchers uncovered more victims, they found that many seemed to have been initially infected through hacked routers. During these attacks, the group behind Slingshot appears to compromise the routers and place a malicious dynamic link library inside it that is in fact a downloader for other malicious components. When an administrator logs in to configure the router, the router’s management software downloads and runs the malicious module on the administrator’s computer. The method used to hack the routers in the first place remains unknown.

Following infection, Slingshot loads a number of modules onto the victim’s device, including two huge and powerful ones: Cahnadr and GollumApp. The two modules are connected and able to support each other in information gathering, persistence and data exfiltration.

Slingshot’s main purpose seems to be cyber-espionage. Analysis suggests it collects screenshots, keyboard data, network data, passwords, USB connections, other desktop activity, clipboard data and more, although its kernel access means it can steal whatever it wants.

The advanced persistent threat also incorporates a number of techniques to help it evade detection: including encrypting all strings in its modules, calling system services directly in order to bypass security product hooks, using a number of anti-debugging techniques and selecting which process to inject depending on the installed and running security solution processes and more.

Slingshot works as a passive backdoor: it does not have a hardcoded command and control (C&C) address but obtains it from the operator by intercepting all network packages in kernel mode and checking to see if there are two hardcoded magic constants in the header. If this is the case, it means that that package contains the C&C address. After that, Slingshot establishes an encrypted communication channel to the C&C and starts to transmit data for exfiltration over it.

The malicious samples investigated by the researchers were marked as ‘version 6.x,’ which suggests the threat has existed for a considerable length of time. The development time, skill and cost involved in creating Slingshot’s complex toolset is likely to have been extremely high. Taken together, these clues suggest that the group behind Slingshot is likely to be highly organized, professional and probably state-sponsored. Text clues in the code suggest it is English-speaking; however, accurate attribution is always hard, if not impossible to determine, and increasingly prone to manipulation and error.

So far, researchers have seen around 100 victims of Slingshot and its related modules, located in Kenya, Yemen, Afghanistan, Libya, Congo, Jordan, Turkey, Iraq, Sudan, Somalia and Tanzania. Most of the victims appear to be targeted individuals rather than organizations, but there are some government organizations and institutions. Kenya and Yemen account for most of the victims observed so far.

“Slingshot is a sophisticated threat, employing a wide range of tools and techniques, including kernel mode modules that have to date only been seen in the most advanced predators,” said Alexey Shulmin, lead malware analyst, Kaspersky Lab. “The functionality is very precious and profitable for the attackers, which could explain why it has been around for at least six years.”

All Kaspersky Lab products successfully detect and block this threat.

In order to avoid falling victim to such an attack, Kaspersky Lab recommends implementing the following measures:

• Users of Mikrotik routers should upgrade to the latest software version as soon as possible to ensure protection against known vulnerabilities. Further, Mikrotik Winbox no longer downloads anything from the router to the user’s computer.
• Use a proven corporate grade security solution in combination with anti-targeted attack technologies and threat intelligence, like Kaspersky Threat Management and Defense. These are capable of spotting and catching advanced targeted attacks by analyzing network anomalies and give cybersecurity teams full visibility over the network and response automation.
• Provide security staff with access to the latest threat intelligence data, which will arm them with helpful tools for targeted attack research and prevention, such as indicators of compromise (IOC), YARA and customized advanced threat reporting.
• If you spot early indicators of a targeted attack, consider managed protection services that will allow you to proactively detect advanced threats, reduce dwell time and arrange timely incident response.

A report on the Slingshot advanced persistent threat can be found on Securelist.

 Reference

Kaspersky Lab Slingshot technical paper  https://s3-eu-west-1.amazonaws.com/khub-media/wp-content/uploads/sites/43/2018/03/09133534/The-Slingshot-APT_report_ENG_final.pdf

https://securelist.com/apt-slingshot/84312/

Read More

ISP Caught Deploying Crypto Mining Malware in Turkey, Syria and Egypt

Governments in Turkey and Syria have been caught hijacking local internet users connections to secretly inject cryptocurrency mining malware, while the same mass interception technology has been found secretly injecting browser-based cryptocurrency mining scripts into users web traffic in Middle East countries.

This report describes THE CITIZEN LAB investigation into the apparent use of Sandvine/Procera Networks Deep Packet Inspection (DPI) devices to deliver nation-state malware in Turkey and indirectly into Syria, and to covertly raise money through affiliate ads and cryptocurrency mining in Egypt.  

Turkey, Syria and Egypt Fingered

Fingers have been pointed at internet providers in Turkey and Syria which have been secretly injecting surveillance malware, while those in Egypt have been using the same technology to inject browser based mining malware.

According to reports ISPs in these three countries are using Deep Packet Inspection technology from Sandvine to intercept and manipulate web traffic and end users’ computers. The technology allows internet providers to prioritize, degrade, block, inject, and log various types of internet traffic on a packet by packet basis.

Turkey’s Telecom network has been using Sandvine PacketLogic devices to redirect hundreds of targeted users to malicious websites and spyware. Similar incidents were recorded in Syria whereby users have been redirected to spurious versions of antivirus software containing government malware.

In Egypt telecoms operators have taken a step further and are using the technology to secretly inject crypto mining scripts into every HTTP page that users accessed. Researchers at Citizen Lab found that providers were using a scheme called AdHose to covertly raise money by mining the anonymous altcoin Monero;

Reference

https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlogic-devices-deploy-government-spyware-turkey-syria/

Read More