New Malware Uses Windows BITS Service to Stealthy Exfiltrate Data

Mohit Kumar in 09/09/2019 - The Hackers News

Cybersecurity researchers have discovered a new computer virus associated with the Stealth Falcon state-sponsored cyber espionage group that abuses a built-in component of the Microsoft Windows operating system to stealthily exfiltrate stolen data to attacker-controlled server.

Active since 2012, Stealth Falcon is a sophisticated hacking group known for targeting journalists, activists, and dissidents with spyware in the Middle East, primarily in the United Arab Emirates (UAE).

Dubbed Win32/StealthFalcon, named after the hacking group, the malware communicates and sends collected data to its remote command-and-control (C&C) servers using Windows Background Intelligent Transfer Service (BITS).

BITS is a communication protocol in Windows that takes unused network bandwidth to facilitate asynchronous, prioritized, and throttled transfer of files between machines in the foreground or background, without impacting the network experience.

BITS is commonly used by software updaters, including downloading files from the Microsoft servers or peers to install updates on Windows 10, messengers, and other applications designed to operate in the background.

According to security researchers at cyber-security firm ESET, since BITS tasks are more likely permitted by host-based firewalls and the functionality automatically adjusts the data transfer rate, it allows malware to stealthily operate in the background without raising any red flags.

"Compared with traditional communication via API functions, the BITS mechanism is exposed through a COM interface and thus harder for a security product to detect," the researchers say in a report published today.

"The transfer resumes automatically after being interrupted for reasons like a network outage, the user logging out, or a system reboot."

Besides this, instead of exfiltrating the collected data in plain text, the malware first creates an encrypted copy of it and then uploads the copy to the C&C server via BITS protocol.

After successfully exfiltrating the stolen data, the malware automatically deletes all log and collected files after rewriting them with random data in order to prevent forensic analysis and recovery of the deleted data.

As explained in the report, Win32/StealthFalcon backdoor has not only been designed to steal data from the compromised systems but can also be used by attackers to further deploy more malicious tools and update its configuration by sending commands through C&C server.

"The Win32/StealthFalcon backdoor, which appears to have been created in 2015, allows the attacker to control the compromised computer remotely. We have seen a small number of targets in UAE, Saudi Arabia, Thailand, and the Netherlands; in the latter case, the target was a diplomatic mission of a Middle Eastern country," the researchers say.

According to the researchers, this newly discovered malware shares its C&C servers and code base with a PowerShell-based backdoor attributed to the Stealth Falcon group and tracked by the Citizen Lab in 2016.

Shadow Brokers Leaks Another Windows Hacking Tool Stolen from NSA’s Arsenal

Swati Khandelwal
Em 07/09/2017 no site The Hacker News.

The Shadow Brokers, a notorious hacking group that leaked several hacking tools from the NSA, is once again making headlines for releasing another NSA exploit—but only to its "monthly dump service" subscribers.

Dubbed UNITEDRAKE, the implant is a "fully extensible remote collection system" that comes with a number of "plug-ins," enabling attackers to remotely take full control over targeted Windows computers.

In its latest post, the hacking group announced a few changes to its monthly dump service and released encrypted files from the previous months as well.

Notably, the September dump also includes an unencrypted PDF file, which is a user manual for the UNITEDRAKE (United Rake) exploit developed by the NSA.

According to the leaked user manual, UNITEDRAKE is a customizable modular malware with the ability to capture webcam and microphone output, log keystrokes, access external drives and more in order to spy on its targets.

The tool consists of five components—server (a Listening Post), the system management interface (SMI), the database (to store and manage stolen information), the plug-in modules (allow the system capabilities to be extended), and the client (the implant).

Snowden Leak Also Mentions UNITEDRAKE

UNITEDRAKE initially came to light in 2014 as a part of NSA's classified documents leaked by its former contractor Edward Snowden.

The Snowden documents suggested the agency used the tool alongside other pieces of malware, including CAPTIVATEDAUDIENCE, GUMFISH, FOGGYBOTTOM, GROK, and SALVAGERABBIT, to infect millions of computers around the world.

• CAPTIVATEDAUDIENCE is for recording conversations via the infected computer's microphone
• GUMFISH is for covertly taking control over a computer’s webcam and snap photographs
• FOGGYBOTTOM for exfiltrating Internet data like browsing histories, login details and passwords
• GROK is a Keylogger Trojan for capturing keystrokes.
• SALVAGERABBIT is for accessing data on removable flash drives that connect to the infected computer.

New Terms for Shadow Brokers Monthly Dump Service

The Shadow Brokers is now only accepting payments in ZCash (ZEC) from its monthly subscribers, rather than Monero since it uses clear text email for delivery, and has also raised the rates for exploits, demanding nearly $4 Million.

The group demanded 100 ZEC when it started its first monthly dump service in June, but now the hackers are demanding 16,000 ZEC (which costs $3,914,080 in total) for all NSA dumps. Zcash currently trades at $248 per unit.

Those who want to gain access only to the September dump that includes the new NSA malware files need to pay hackers 500 ZEC.

The Shadow Brokers gained popularity after leaking the SMB zero-day exploit, called Eternalblue, that powered Wannacry ransomware attack that crippled large businesses and services around the world in May.

After that, the mysterious hacking group announced a monthly data dump service for those who want to get exclusive access to the NSA arsenal, which they claim to have stolen from the agency last year.

Malware Campaign Exploits 2012 Windows Bug to Install NewCore Trojan

• DAVID BISSON
• Em 06/09/2017 no site the state of security

A malware campaign is exploiting a 2012 Windows flaw in order to infect a vulnerable machine with the NewCore remote access trojan (RAT).

The campaign begins when a recipient receives an attack email that comes with an Rich Text Format (RTF) attachment. When opened, these documents exploit a 2012 remote code execution vulnerability affecting the Windows common controls (CVE-2012-0158) to drop files in the Microsoft Credentials, Microsoft System Certificates, or Windows Templates folder. These files usually consist of the following resources: a legitimate version of GoogleUpdate.exe, an encrypted blog containing malware, and a decrypter for the malware.

Sample decoy documents. (Source: Fortinet)

To evade the watchful eye of security software, the malware campaign uses DLL hijacking to trick GoogleUpdate.exe into loading a DLL containing malicious code. Doing so calls forth a Trojan downloader as a DLL file that executes in memory only. This downloader, in turn, creates an autostart registry key to ensure its payload executes every time the computer boots up. It then finally downloads NewCore.

Compiled on 16 March 2017, NewCore has thus far evaded the detection of all but a handful of security products. Fortinet’s Jasper Manuel and Artem Semenchenko explainwhy this is so:

“This RAT is a DLL file. Its malicious routines are contained in its imported function ‘ProcessTrans’. However, executing the DLL without using the downloader will not work as the C&C server string is not embedded in its body. When the downloader calls the function ‘ProcessTrans’, it supplies to the function the C&C server string and a handle to the C&C server internet session. In this case, Heuristic detection based on behavior will not work on the DLL alone.”

It’s currently unclear who’s responsible for developing NewCore, malware which can execute files, monitor an infected computer’s screen, and start a command shell. Votiro Labs, which originally detected the campaign targeting Vietnamese organizations in August 2017, identified several domains that a Chinese APT group known as “1937cn” is thought to use. For their part, Manuel and Semenchenko used an embedded PDB file string to identify “hoogle168,” someone whom they believe to be is NewCore’s developer. This individual appears to be active on Chinese coding forums and to possess knowledge when it comes to developing remote control software. Even so, it’s unclear whether they’re actually responsible for the malware.

The embedded PDB file string with “hoogle168” outlined. (Source: Fortinet)

To defend against the above-described malware campaign and others like it that leverage RTF files and Windows vulnerabilities, users should avoid clicking on suspicious links and email attachments. They should also make sure to patch any and all relevant software flaws on a timely basis.

Learn how Tripwire’s solutions can help your organization keep track of its patches here.

CowerSnail — Windows Backdoor from the Creators of SambaCry Linux Malware

Mohit Kumar
Em 27/07/2017 no site the Hacker News

Last month, we reported about a group of hackers exploiting SambaCry—a 7-year-old critical remote code execution vulnerability in Samba networking software—to hack Linux computers and install malware to mine cryptocurrencies.

The same group of hackers is now targeting Windows machines with a new backdoor, which is a QT-based re-compiled version of the same malware used to target Linux.

Dubbed CowerSnail, detected by security researchers at Kaspersky Labs as Backdoor.Win32.CowerSnail, is a fully-featured windows backdoor that allows its creators to remotely execute any commands on the infected systems.

Wondering how these two separate campaigns are connected?

Interestingly, the CowerSnail backdoor uses the same command and control (C&C) server as the malware that was used to infect Linux machines to mine cryptocurrency last month by exploiting the then-recently exposed SambaCry vulnerability.

Common C&C Server Location — cl.ezreal.space:20480

SambaCry vulnerability (CVE-2017-7494), named due to its similarities to the Windows SMB flaw exploited by the WannaCry ransomware that recently wreaked havoc worldwide, affected all Samba versions newer than Samba 3.5.0 released over the past seven years.

Shortly after the public revelation of its existence, SambaCry was exploited by this group of hackers to remotely install cryptocurrency mining software—"CPUminer" that mines cryptocurrencies like Bitcoin, Litecoin, Monero and others—on Linux systems.

But now, the same hackers are targeting both, Windows and Linux computers, with CPUminer by utilising computing resources of the compromised systems in order to make the profit.

"After creating two separate Trojans, each designed for a specific platform and each with its own peculiarities, it is highly probable that this group will produce more malware in the future," Sergey Yunakovsky of Kaspersky Lab said in a blog post.

In separate research, security researcher Omri Ben Bassat‏ reported about more copycat groups of hackers who are exploiting the same SambaCry vulnerability for cryptocurrency mining and installing "Tsunami backdoor," an IRC-based DDoS botnet malware that's been known for infecting Mac OS X and IoT devices in the past.

For those unaware: Samba is open-source software (re-implementation of SMB/CIFS networking protocol) that offers Linux/Unix servers with Windows-based file and print services and runs on the majority of operating systems and IoT devices.

Despite being patched in late May, the SambaCry bug is actively being exploited by hackers. Just last week, researchers spotted a new piece of malware, called SHELLBIND, exploiting the flaw to backdoor Network Attached Storage (NAS) devices.

Código-fonte do sistema operacional Windows chega ao Git

PorRedação iMasters em 26/05/2017

A Microsoft anunciou nesta semana que o código-fonte do sistema operacional Windows está agora no Git. As equipes de engenheiros e desenvolvedores do Windows agora podem usar o repositório Git para construir sistemas operacionais.

O repositório Windows Git tem aproximadamente 3,5 milhões de arquivos e 300 GB de tamanho. Quatro mil engenheiros da equipe do Windows produzem 1.760 “lab builds” diárias em 440 branches, além de milhares de builds de validação de pull request, revelou o site C# Corner.

A escala em que o sistema está operando é realmente incrível. Abaixo, alguns números:

• Há mais de 250 mil commits Git alcançáveis nesse repositório nos últimos quatro meses.
• 8.421 pushes por dia (em média)
• 2.500 pull requests, com 6.600 revisores por dia de trabalho (em média)
• 4.352 branches de tópicos ativos
• 1.760 builds oficiais por dia