Page 80 – Unit 42

Protecting Users from iOS App Provisioning Profile Abuse

Posted on November 24, 2014August 17, 2022 by Zhi Xu

Recently, we announced the discovery of WireLurker, a new family of malware that abuses app provisioning profiles to install potentially malicious apps on any iOS device, regardless of whether it is jailbroken. Shortly after, FireEye highlighted the Masque Attack, which also relies on malware apps signed by provisioning profiles and had previously been disclosed by Steffen Esser. Both attacks highlight the importance of provisioning profile management in Mobile Device Management (MDM) solutions. In this post, we explain how to protect users from iOS app provisioning profile abuse attacks with Palo Alto Networks GlobalProtect Mobile Security Manager product.

Provisioning Profiles on iOS

As stated in the iPhone Developer Program: Continue reading "Protecting Users from iOS App Provisioning Profile Abuse"

Don’t Forget to Subscribe to Unit 42 Threat Intelligence Alerts

Posted on November 21, 2014 by Chad Berndtson

Want to have all of the latest insights, research and threat intelligence from our research team delivered right to your inbox? You can.

Provide us your e-mail here in the "Get Updates" box, and you’ll receive updates to the Unit 42 threat intelligence blog as they happen, as well as information on upcoming Unit 42 whitepapers and appearances at industry events. Continue reading "Don’t Forget to Subscribe to Unit 42 Threat Intelligence Alerts"

Tracking the WireLurker Arrests

Posted on November 17, 2014 by Jen Miller-Osborn

Well that was fast.

Not quite ten days after we released our white paper on WireLurker, arrests have already been made in China. WireLurker is a new family of malware specifically targeting iOS devices via USB. There is WireLurker malware for both Mac OS X and Microsoft Windows operating systems.

WireLurker works by looking for any iOS devices connected via USB with an infected OS X or Windows computer. When it detects one, it installs downloaded third-party applications or automatically generated malicious applications onto the device, regardless of whether it is jail broken. This is the reason we call it “wire lurker”. Continue reading "Tracking the WireLurker Arrests"

Palo Alto Networks Identifies 3 Critical Internet Explorer Vulnerabilities

Posted on November 11, 2014 by Ryan Olson

Palo Alto Networks researcher Bo Qu discovered three new critical Internet Explorer (IE) vulnerabilities impacting IE versions 8, 9, 10 and 11. The discoveries include two IE Memory Corruption Vulnerability and an IE ASLR Bypass Vulnerability. All three are part of the November 2014 Security Bulletin and documented in Microsoft Security Bulletin MS14-065. Continue reading "Palo Alto Networks Identifies 3 Critical Internet Explorer Vulnerabilities"

The Question of WireLurker Attribution: Who Is Responsible?

Posted on November 10, 2014 by Jen Miller-Osborn

After news of WireLurker began circulating in handful Chinese-language tech forums over the summer, a Chinese-language technology blogger conducted online research in an attempt to track down the author of WireLurker and engage him in an online chat. While it is unclear whether he found the actual author, it appears he was able to locate someone associated with the company that produced WireLurker and controlled the Command and Control (C2) domain.

The following is a translated summary of the Chinese blogger’s investigation with supplemental research and analysis conducted by Unit 42. Due to the amount of personal information the original blog contains, we will make the blog address available only upon request.

Continue reading "The Question of WireLurker Attribution: Who Is Responsible?"

Kuluoz Trends – October 2014

Posted on November 7, 2014 by Rob Downs

The Asprox/Kuluoz malware family has a special place in our hearts at Palo Alto Networks. This botnet-related Trojan malware has evolved from its 2007 roots into a simple and yet robust mass e-mail phishing threat that is the origin of a significant percentage of Internet spam today. This post further explores trends for this malware family, based on October 2014 data from our WildFire platform.

Some Background

The modern Kuluoz is known for the following:

High distribution volume through geolocation-associated spam e-mail templates
Use of e-mail attachments and Web links that masquerade as document or media files
Modular design, promoting extensibility
Distinct, default botnet node roles of spam generator for continued botnet propagation, downloader of additional malware and distributor of generalized commercial spam
Platform-specific malware delivery based on user agent detection

Themes for Kuluoz propagation spam have ranged across legal notices (e.g., court order), package delivery messages (e.g., FedEx, UPS, DHL), voicemail service notifications (e.g., WhatsApp), general current events (e.g., 2014 polar vortex), and online deals (e.g., free pizza from Pizza Hut) – to name a few. Continue reading "Kuluoz Trends – October 2014"

WireLurker for Windows

Posted on November 6, 2014August 17, 2022 by Claud Xiao

Summary

Yesterday we published a whitepaper introducing WireLurker, the first malware attacking both non-jailbroken and jailbroken iOS devices from a Mac OS X system. Shortly after we released the paper, Jaime Blasco from AlienVault Labs notified us that he’d found a Windows executable file that contains WireLurker’s command and control server address. We analyzed and investigated the sample and have confirmed that it is an older version of WireLurker.

This variant is being distributed by a different Chinese source that is hosting 180 Windows executables and 67 Mac OS X applications, each of which contains a version of the WireLurker Trojan. The Windows variant opens a new vector for iOS users to be infected with WireLurker, but appears to have been less successful than its Mac OS X descendent. Continue reading "WireLurker for Windows"

WireLurker: A New Era in OS X and iOS Malware

Posted on November 5, 2014 by Claud Xiao

Today we published a new research paper on WireLurker, a family of malware targeting both Mac OS and iOS systems for the past six months. We believe that this malware family heralds a new era in malware attacking Apple’s desktop and mobile platforms based on the following characteristics:

Of known malware families distributed through trojanized / repackaged OS X applications, it is the biggest in scale we have ever seen
It is only the second known malware family that attacks iOS devices through OS X via USB
It is the first malware to automate generation of malicious iOS applications, through binary file replacement
It is the first known malware that can infect installed iOS applications similar to a traditional virus
It is the first in-the-wild malware to install third-party applications on non-jailbroken iOS devices through enterprise provisioning

WireLurker was used to trojanize 467 OS X applications on the Maiyadi App Store, a third-party Mac application store in China. In the past six months, these 467 infected applications were downloaded over 356,104 times and may have impacted hundreds of thousands of users.

How It Works

Continue reading "WireLurker: A New Era in OS X and iOS Malware"

Examining a VBA-Initiated Infostealer Campaign

Posted on October 29, 2014November 1, 2018 by Vicky Ray

While Microsoft documents that leverage malicious, embedded Visual Basic for Applications (VBA) macros are not a new thing, their use has noticeably increased this year, thanks in part to their simplicity and effectiveness.

Some threat actors commonly use this class of malware to drop a second stage payload on victim systems. Even though Microsoft attempts to mitigate this threat by disabling macros by default, the percentage of users who explicitly bypass this protection and enable macros remains high.

Exploiting the human factor, the most effective attacker strategy is the tried and true spear phishing attack, ideally made to look authentic by appearing to originate from a legitimate organization/individual and containing role-relevant or topic-of-interest content to entice its intended target. This post examines an information stealer campaign that leveraged a VBA macro script, focusing on its progression, from delivery to Command and Control (C2), and its attribution to a malicious actor for context on objectives and motivation.

Delivery and Exploitation

The recent campaign started with an email sent to an employee responsible for processing financial statements at a global financial organization (Figure 1). The sender’s email address was spoofed as originating from an energy company. Subsequent analysis would show that this façade was very thin; yet, it is often all that is required to encourage a user to open an attachment or click on a link that then executes malicious code. Continue reading "Examining a VBA-Initiated Infostealer Campaign"

Dridex Banking Trojan Distributed Through Word Documents

Posted on October 24, 2014 by Ryan Olson

Dridex, the latest descendent of the Bugat/Feodo/Cridex banking Trojan lineage has been a constant source of attacks using the malware since its release in July. To date, Dridex has centered on sending executable attachments via e-mail. That seems to have changed this week, as we’ve seen a tactical shift to sending those executable attachments via Microsoft Word documents loaded with macros that download and execute the malware.

Like its precursors, Dridex is a sophisticated Banking Trojan, similar to the infamous Zeus malware. Its core functionality is to steal credentials of online banking websites and allow a criminal to use those credentials to initiate transfers and steal funds. Dridex uses an XML-based configuration file to specify which websites it should target and other options for the malware. For instance, the configuration specifies which websites to capture form submissions from, and which to ignore with the following XML. Continue reading "Dridex Banking Trojan Distributed Through Word Documents"

Tracking New Ransomware CryptoWall 2.0

Posted on October 22, 2014January 28, 2022 by Ryan Olson

The latest development in the ransomware world is CryptoWall 2.0, a new version of this malware family that uses the Tor network for command and control.

F-Secure was the first to spot this new version on October 1, but since then the attacks have ramped up and new variants of the malware are emerging daily. Our WildFire analysis platform has picked up 84 CryptoWall 2.0 variants since September 30, delivered primarily through e-mail attachments but also through malicious PDFs and web exploit kits.

CryptoWall 2.0 is similar to other ransomware attacks that have plagued users and businesses for nearly a decade. Once it is running on a system, CryptoWall 2.0 seeks out document files and encrypts them using the RSA encryption algorithm. The attacker holds the key necessary to decrypt the files unless the victim agrees to pay a $500 ransom.

Unlike previous versions of CryptoWall, 2.0 communicates with its command and control (C2) server through the Tor anonymization network. This allows attackers to hide their communications and avoid having their C2 servers shut down, but also makes it easy for organizations to block the threat. CryptoWall isn’t the only threat that communicates over Tor and if your network doesn’t have an explicit reason to allow anonymization networks, you should consider blocking the application altogether with your firewall.

If your system has already been infected with CryptoWall 2.0, you’ll see a pop-up just like this one shortly after the malware has encrypted your documents.

Continue reading "Tracking New Ransomware CryptoWall 2.0"

POODLE like it’s 1999

Posted on October 16, 2014 by Ryan Olson

1999 was a pretty interesting year for the Internet and security. To jog your memory, here are just a few of the major events from the ultimate (or penultimate, depending on your point of view) year of the last millennium.

The Melissa Virus was infecting millions of hosts using malicious e-mails.
Both Napster and MySpace made their first public appearances.
Internet Explorer 5.0 was released for Windows 3.1, 95 and 98.
The TLSv1 specification was published to replace SSLv3 to improve security of Internet communications.

In the 15 years since TLS was introduced it has been widely adopted, but in many ways SSLv3 has hung on. The two specifications are very similar, but not interoperable and applications that implement TLS are often capable of falling back to SSL to support legacy servers. Cryptologists have slowly chipped away at the security of SSL over the last decade, discovering ways to reveal larger and larger pieces of information from encrypted sessions. Continue reading "POODLE like it’s 1999"

Super Tuesday: A Patch Tuesday We Won’t Forget

Posted on October 15, 2014 by Ryan Olson

Sometimes “Patch Tuesday” comes and goes with little excitement or fanfare; yesterday was not one of those days. In just one day, Oracle released patches for 154 new vulnerabilities, Adobe issued updates for Flash and ColdFusion, and Microsoft released 24 patches of their own. On top of the sheer volume of patches, we learned that three of the Microsoft vulnerabilities were being exploited in targeted attack campaigns.

Sandworm

Continue reading "Super Tuesday: A Patch Tuesday We Won’t Forget"

Palo Alto Networks Identifies Critical Internet Explorer Vulnerability

Posted on October 14, 2014 by Ryan Olson

Palo Alto Networks researcher Bo Qu discovered a new critical Internet Explorer (IE) vulnerability impacting IE versions 6, 7, 8, 9 and 10. The vulnerability allows for full remote code execution using a memory corruption flaw. The vulnerability is documented in Microsoft Security Bulletin MS14-056 and is part of the October 2014 Security Bulletin.

In our continuing commitment to the security research community, these vulnerabilities were disclosed to Microsoft through our participation in the Microsoft Active Protections Program (MAPP), which ensures the timely, responsible disclosure of new vulnerabilities and creation of protections from security vendors. Continue reading "Palo Alto Networks Identifies Critical Internet Explorer Vulnerability"

Rovnix and the Declaration Generation Algorithm

Posted on October 10, 2014 by Ryan Olson

Since the success of Conficker in 2008, multiple malware families have started using Domain Generation Algorithms (DGAs) to make their command and control infrastructure more resilient to take-down. By generating new domains every day, the attacker can re-capture their botnet even if one of the command and control domains is taken down or if security teams block access to them. Most DGAs create new domains somewhat randomly based on the day, month and year, along with some predefined inputs that allow the attacker to predict which domain the malware will use on a particular day. On October 9, CSIS published a blog on the latest version of Rovnix, which appears to use the text of the US Declaration of Independence as an input to its DGA. Continue reading "Rovnix and the Declaration Generation Algorithm"