Page 81 – Unit 42

Palo Alto Networks Identifies Critical Internet Explorer Vulnerability

Posted on October 14, 2014 by Ryan Olson

Palo Alto Networks researcher Bo Qu discovered a new critical Internet Explorer (IE) vulnerability impacting IE versions 6, 7, 8, 9 and 10. The vulnerability allows for full remote code execution using a memory corruption flaw. The vulnerability is documented in Microsoft Security Bulletin MS14-056 and is part of the October 2014 Security Bulletin.

In our continuing commitment to the security research community, these vulnerabilities were disclosed to Microsoft through our participation in the Microsoft Active Protections Program (MAPP), which ensures the timely, responsible disclosure of new vulnerabilities and creation of protections from security vendors. Continue reading "Palo Alto Networks Identifies Critical Internet Explorer Vulnerability"

Rovnix and the Declaration Generation Algorithm

Posted on October 10, 2014 by Ryan Olson

Since the success of Conficker in 2008, multiple malware families have started using Domain Generation Algorithms (DGAs) to make their command and control infrastructure more resilient to take-down. By generating new domains every day, the attacker can re-capture their botnet even if one of the command and control domains is taken down or if security teams block access to them. Most DGAs create new domains somewhat randomly based on the day, month and year, along with some predefined inputs that allow the attacker to predict which domain the malware will use on a particular day. On October 9, CSIS published a blog on the latest version of Rovnix, which appears to use the text of the US Declaration of Independence as an input to its DGA. Continue reading "Rovnix and the Declaration Generation Algorithm"

New Indicators of Compromise for APT Group Nitro Uncovered

Posted on October 3, 2014March 23, 2022 by Jen Miller-Osborn

In mid-July of this year, we noticed yet another legitimate website had been compromised by APT actors and was serving malware. In this case, it was a group commonly referred to as “Nitro,” which was coined by Symantec in its 2011 whitepaper.

As we dug deeper, we found additional compromised legitimate websites and malware from the same group back through March of this year. In most instances, the malware is one commonly referred to as “Spindest,” though we also found “PCClient” and “Farfli” variants in use by the group. We don’t have enough data to say for certain that all of the malware in this blog was delivered via compromised legitimate websites.

Historically, Nitro is known for targeted spear phishing campaigns and using Poison Ivy malware, which was not seen in these attacks. Since at least 2013, Nitro appears to have somewhat modified their malware and delivery methods to include Spindest and legitimate compromised websites, as reported by Cyber Squared’s TCIRT. Our findings indicate they are continuing to evolve with the addition of PCClient and Farfli variants. The Maltego screenshot below shows the activity we describe in this blog.

Continue reading "New Indicators of Compromise for APT Group Nitro Uncovered"

Palo Alto Networks Addresses Bash Vulnerability Shellshock: Mitigation for CVE-2014-6271

Posted on September 25, 2014 by Ryan Olson

Around 6:00 am PST on September 24, the details of a vulnerability in the widely used Bourne Again Shell (Bash) were disclosed by multiple Linux vendors. The vulnerability, assigned CVE-2014-6271 by Mitre, was originally discovered by Stephane Chazelas, a Unix and Linux network and telecom administrator and IT manager at UK robotics company SeeByte, Ltd.

While this vulnerability didn’t come with quite the fanfare or a catchy name like Heartbleed, the security community quickly dubbed it “Shellshock.” Bash is present in most Linux and Unix distributions as well as Apple’s Mac OS X, and there’s a good chance anyone reading this has a system they need to patch.

Palo Alto Networks initiated an emergency IPS content release to detect this vulnerability last night with Signature ID: 36729 "Bash Remote Code Execution Vulnerability.”

All versions of PAN-OS and Panorama include the vulnerable version of Bash, but we’ve determined the issue is only exploitable by authenticated users. Normal PAN-OS maintenance release updates will provide a fix for the vulnerability. We have posted the advisory on our product vulnerability page. Read on for more details.

Continue reading "Palo Alto Networks Addresses Bash Vulnerability Shellshock: Mitigation for CVE-2014-6271"

We Know It Before You Do: Predicting Malicious Domains

Posted on September 24, 2014 by Wei Xu

Today at the 2014 Virus Bulletin International Conference (VB2014) in Seattle, Palo Alto Networks is presenting a paper entitled “We Know It Before You Do: Predicting Malicious Domains.” We’re excited to share the key points of our paper and presentation here for everyone who couldn’t see it in person.

Malicious domains are key to the success of nearly all popular attack vectors, supporting malware distribution, command and control (C2) server hosting and traffic distribution. Most modern domain reputation systems are designed to detect and block malicious domains based on observation of suspicious activity. This activity can include detection of malicious content (e.g., malware, web pages with exploit code, web pages with drive-by downloads, etc.) and observed behavior (e.g., communication with infected hosts to collect private information, launch attacks, etc.).

To bypass such defenses, an increasing trend is that many malicious domains are only used for a very short period of time. There are two factors that make this practice appealing to an attacker: Continue reading "We Know It Before You Do: Predicting Malicious Domains"

Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy

Posted on September 19, 2014November 1, 2018 by Jen Miller-Osborn

We’ve uncovered some new data and likely attribution regarding a series of APT watering hole attacks this past summer. Watering hole attacks are an increasingly popular component of APT campaigns, as many people are more aware of spear phishing and are less likely to open documents or click on links in unsolicited emails. Watering hole attacks offer a much better chance of success because they involve compromising legitimate websites and installing malware intended to compromise website visitors. These are often popular websites frequented by people who work in specific industries or have political sympathies to which the actors want to gain access.

The attacks discussed in this blog are related to an APT campaign commonly referred to as “th3bug”, named for the password the actors often use with their Poison Ivy malware. Of note, only the older of the samples we cover in this blog used that password. We don’t know the reason the actors changed this, but it could possibly be in reaction to information widely published on the Internet about their activities, which use that password as a key component to tie the activity together. FireEye in particular published a paper describing several APT campaigns whose activity they correlate using Poison Ivy passwords. Continue reading "Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy"

Privacy: Why Apple Pay will be Better than Google Wallet

Posted on September 18, 2014 by Ryan Olson

On September 9, Apple announced that the latest iPhone models would come with a new technology called Apple Pay which allows people to purchase items with their phones, both in stores and online. Many smug Android users looked at the announcement and thought “Sounds like Google Wallet. Welcome to 2011 Apple.” As an individual who is well entrenched in the Google ecosystem, (I have a Nexus 5 on in my pocket and a Moto 360 on my wrist) I initially had the same reaction. But, after looking at the two systems more closely, I think Apple Pay will be the better platform for users, and the reason for that is privacy.

apple pay v google wallet Continue reading "Privacy: Why Apple Pay will be Better than Google Wallet"

AppBuyer: New iOS Malware Steals Apple ID and Password to Buy Apps

Posted on September 12, 2014 by Claud Xiao

Palo Alto Networks recently found and analyzed a new iOS malware affecting jailbroken iOS devices in the wild. The malware will connect to C&C server, download and execute malicious executable files, hook network APIs to steal user’s Apple ID and password and upload to the attacker’s server, and simulate Apple’s proprietary protocols to buy apps from the official App Store by victim’s identity. We named this new family AppBuyer.

Background

The AppBuyer was first mentioned by four members of the WeiPhone Technical Group at May 18th, 2014. They remotely assisted a user to find out why some apps periodically had been installed onto his jailbroken iPhone, and finally located two strange files on that device. They found that these files would download, execute and delete other executable files from the Internet. Lastly, they tried to identify the attacker through analyzing the C&C server’s domain name through the samples used. They also provided these samples for downloading. Continue reading "AppBuyer: New iOS Malware Steals Apple ID and Password to Buy Apps"

Palo Alto Networks Identifies 15 Critical Internet Explorer Vulnerabilities

Posted on September 9, 2014 by Ryan Olson

Palo Alto Networks researchers discovered 15 new critical Internet Explorer (IE) vulnerabilities covering IE versions 6, 7, 8, 9, 10 and 11.

Each of these discoveries allows full remote code execution using memory corruption vulnerabilities in IE. They have been documented in Microsoft Security Bulletin MS14-052 and part of the September 2014 Security Bulletin. Palo Alto Networks researcher Bo Qu is credited with these 15 vulnerabilities. Continue reading "Palo Alto Networks Identifies 15 Critical Internet Explorer Vulnerabilities"

Stolen Email Accounts of World’s Top Universities Selling on China’s Largest C2C Platform

Posted on September 4, 2014November 1, 2018 by Claud Xiao

Recently, we found email accounts from top universities across the world being sold on Taobao, the largest consumer-to-consumer (C2C) e-commerce platform in China. Advertised uses for these accounts included registering for special accounts under software developer programs, receiving student discounts or coupons from retailers, and obtaining access to academic databases. This post describes the scope, associated risks, and implications of this activity.

Our investigation began with a Chinese language search for "edu mailbox" in Taobao, which returned 99 results related to stolen university email accounts. The most expensive account was listed at ¥2400 RMB ($390.80 USD), while the cheapest was only ¥0.98 RMB ($0.16 USD).

taobao 1

Figure 1: Results for Chinese language "edu mailbox" search on Taobao.

These accounts, which include an education (EDU) top-level domain email address with valid password, represent 42 of the world’s top universities, across 10 countries: Continue reading "Stolen Email Accounts of World’s Top Universities Selling on China’s Largest C2C Platform"

Bad Certificate Management in Google Play Store

Posted on August 28, 2014November 1, 2018 by Zhi Xu

Following a recent study of apps in the Google Play Store, let’s discuss several security risks caused by the bad certificate management practiced in many Android apps, from social to mobile banking.

All Android apps must be digitally signed with a certificate from the developer. As described in Google’s official document, the app developer is required to create a keystore with a set of private keys, and then use the private key to generate a signed version of apps. This key has to be valid for at least 25 years. These certificates do not have to be generated by a certificate authority and can instead be self-signed. Because this is simpler and allows the author to retain the private key, the majority of Google store apps use self-signed certificates. This means it is the developer’s responsibility to keep the private key safe, whether that developer is a 13-year-old or a multi-national company. As this means the security protecting private keys varies widely, the security risks of bad certificate management cannot be ignored and must be identified, and where necessary, mitigated. Continue reading "Bad Certificate Management in Google Play Store"

Listen: How Evolved 419 Scammers Are Targeting the Enterprise

Posted on August 27, 2014 by Chad Berndtson

Unit 42, the Palo Alto Networks threat intelligence team, will be appearing on a live webcast and Q&A with Dark Reading tomorrow, Thursday, August 28 at 2:00 p.m. EDT.

NetWire and MITRE ChopShop

Posted on August 25, 2014November 1, 2018 by Phil Da Silva

On August 4, Unit 42, the Palo Alto Networks threat intelligence team, released a tool to decrypt the traffic from a Remote Administration Tool (RAT) named NetWire (part of the NetWiredRC malware family). For details of the encryption protocol used please see our earlier post here.

The previously released protocol decoder and parser was originally built as a stand-alone module. As part of Unit 42’s mission to contribute to the security community, we have developed, and are releasing today, a version of the NetWire decryption tool that works within ChopShop, a great open source tool from MITRE that provides a framework for protocol analysis. To use the tool, simply grab the public_tools repo from the Unit 42 GitHub repository. Be sure to point your ChopShop command to that directory using the -M flag.

We hope that this integration of the decryptor tool with ChopShop will provide value to incident responders and security researchers. Continue reading "NetWire and MITRE ChopShop"

Pivot on Google Code C2 Reveals Additional Malware

Posted on August 21, 2014November 1, 2018 by Rob Downs

Last week, we reported on attacks observed against East Asia that used Google Code for command and control (C2). As follow-on to that work, we pivoted on the C2 indicators of compromise (IoCs) within our WildFire platform, looking for additional malicious activity.

One sample in particular caught our attention, downloaded on June 18 from 211.233.89.182 via FTP. While all of the other near-proximity samples downloaded from this Korean IP were flagged as malware by VirusTotal, this one was not at that time. Deeper inspection revealed what this malware was and how it evaded detection by antivirus programs.

The FTP download in question was for a resource innocuously named “p”. Continue reading "Pivot on Google Code C2 Reveals Additional Malware"

Background

Peace of mind comes from staying ahead of threats. Subscribe today.

Default Heading