Aug 192013
 

Feds Are Suspects in New Malware That Attacks Tor Anonymity

 

WIRED / Threat Level
by Kevin Poulsen
August 5, 2013

Feds Are Suspects in New Malware That Attacks Tor Anonymity

Feds Are Suspects in New Malware That Attacks Tor Anonymity (Photo: Andrewfhart / Flickr)

 

Security researchers tonight are poring over a piece of malicious software that takes advantage of a Firefox security vulnerability to identify some users of the privacy-protecting Tor anonymity network.

The malware showed up Sunday morning on multiple websites hosted by the anonymous hosting company Freedom Hosting. That would normally be considered a blatantly criminal “drive-by” hack attack, but nobody’s calling in the FBI this time. The FBI is the prime suspect.

“It just sends identifying information to some IP in Reston, Virginia,” says reverse-engineer Vlad Tsyrklevich. “It’s pretty clear that it’s FBI or it’s some other law enforcement agency that’s U.S.-based.”

If Tsrklevich and other researchers are right, the code is likely the first sample captured in the wild of the FBI’s “computer and internet protocol address verifier,” or CIPAV, the law enforcement spyware first reported by WIRED in 2007.

Court documents and FBI files released under the FOIA have described the CIPAV as software the FBI can deliver through a browser exploit to gather information from the target’s machine and send it to an FBI server in Virginia. The FBI has been using the CIPAV since 2002 against hackers, online sexual predators, extortionists, and others, primarily to identify suspects who are disguising their location using proxy servers or anonymity services, like Tor.

The code has been used sparingly in the past, which kept it from leaking out and being analyzed or added to anti-virus databases.

The broad Freedom Hosting deployment of the malware coincides with the arrest of Eric Eoin Marques in Ireland on Thursday on an U.S. extradition request. The Irish Independent reports that Marques is wanted for distributing child pornography in a federal case filed in Maryland, and quotes an FBI special agent describing Marques as “the largest facilitator of child porn on the planet.”

Freedom Hosting has long been notorious for allowing child porn to live on its servers. In 2011, the hactivist collective Anonymous singled out Freedom Hosting for denial-of-service attacks after allegedly finding the firm hosted 95 percent of the child porn hidden services on the Tor network.

Freedom Hosting is a provider of turnkey “Tor hidden service” sites — special sites, with addresses ending in .onion — that hide their geographic location behind layers of routing, and can be reached only over the Tor anonymity network.

Tor hidden services are ideal for websites that need to evade surveillance or protect users’ privacy to an extraordinary degree – which can include human rights groups and journalists. But it also naturally appeals to serious criminal elements.

Shortly after Marques’ arrest last week, all of the hidden service sites hosted by Freedom Hosting began displaying a “Down for Maintenance” message. That included websites that had nothing to do with child pornography, such as the secure email provider TorMail.

Some visitors looking at the source code of the maintenance page realized that it included a hidden iframe tag that loaded a mysterious clump of Javascript code from a Verizon Business internet address located in Virginia.

By midday Sunday, the code was being circulated and dissected all over the net. Mozilla confirmed the code exploits a critical memory management vulnerability in Firefox that was publicly reported on June 25, and is fixed in the latest version of the browser.

Though many older revisions of Firefox are vulnerable to that bug, the malware only targets Firefox 17 ESR, the version of Firefox that forms the basis of the Tor Browser Bundle – the easiest, most user-friendly package for using the Tor anonymity network.

“The malware payload could be trying to exploit potential bugs in Firefox 17 ESR, on which our Tor Browser is based,” the non-profit Tor Project wrote in a blog post Sunday. “We’re investigating these bugs and will fix them if we can.”

The inevitable conclusion is that the malware is designed specifically to attack the Tor browser. The strongest clue that the culprit is the FBI, beyond the circumstantial timing of Marques’ arrest, is that the malware does nothing but identify the target.

 

The payload for the Tor Browser Bundle malware is hidden in a variable called “magneto”.

The payload for the Tor Browser Bundle malware is hidden in a variable called “magneto”.

The heart of the malicious Javascript is a tiny Windows executable hidden in a variable named “Magneto.” A traditional virus would use that executable to download and install a full-featured backdoor, so the hacker could come in later and steal passwords, enlist the computer in a DDoS botnet, and generally do all the other nasty things that happen to a hacked Windows box.

But the Magneto code doesn’t download anything. It looks up the victim’s MAC address — a unique hardware identifier for the computer’s network or Wi-Fi card — and the victim’s Windows hostname. Then it sends it to the Virginia server, outside of Tor, to expose the user’s real IP address, and coded as a standard HTTP web request.

“The attackers spent a reasonable amount of time writing a reliable exploit, and a fairly customized payload, and it doesn’t allow them to download a backdoor or conduct any secondary activity,” says Tsyrklevich, who reverse-engineered the Magneto code.

The malware also sends, at the same time, a serial number that likely ties the target to his or her visit to the hacked Freedom Hosting-hosted website.

In short, Magneto reads like the x86 machine code embodiment of a carefully crafted court order authorizing an agency to blindly trespass into the personal computers of a large number of people, but for the limited purpose of identifying them.

But plenty of questions remain. For one, now that there’s a sample of the code, will anti-virus companies start detecting it?

Update 8.5.13 12:50:  According to Domaintools, the malware’s command-and-control IP address in Virginia is allocated to Science Applications International Corporation. Based in McLean, Virginia, SAIC is a major technology contractor for defense and intelligence agencies, including the FBI. I have a call in to the firm.

13:50  Tor Browser Bundle users who installed or manually updated after June 26 are safe from the exploit, according to the Tor Project’s new security advisory on the hack.

14:30:  SAIC has no comment.

15:10:  There are incorrect press reports circulating that the command-and-control IP address belongs to the NSA. Those reports are based on a misreading of domain name resolution records. The NSA’s public website, NSA.gov, is served by the same upstream Verizon network as the Tor malware command-and-control server, but that network handles tons of government agencies and contractors in the Washington DC area.

8.6.13 17:10:  SAIC’s link to the IP addresses may be an error in Domaintools’ records. The official IP allocation records maintained by the American Registry for Internet Numbers show the two Magneto-related addresses are not part of SAIC’s publicly-listed allocation. They’re part of a ghost block of eight IP addresses that have no organization listed. Those addresses trace no further than the Verizon Business data center in Ashburn, Virginia, 20 miles northwest of the Capital Beltway. (Hat tip: Michael Tigas)
Direct Link:  http://www.wired.com/threatlevel/2013/08/freedom-hosting/

 

Jul 182013
 

Dropbox used by Chinese hackers to spread malware


TechNewsDaily

by Paul Wagenseil
July 15, 2013
Dropbox Chinese Hackers Infecting you through Drop Box. Dropbox is one of the better-known cloud-based services.

Dropbox
Chinese Hackers Infecting you through Drop Box. Dropbox is one of the better-known cloud-based services.

Popular cloud-based file-sharing service Dropbox wants to be all things to all people, with big plans to share application metadata — game saves, settings preferences and so forth — as well as raw files across devices and platforms.

But when Dropbox CEO Drew Houston announced last week that Dropbox intends to “replace the hard drive,” he probably didn’t expect Chinese hackers to take him up on it so quickly.

Comment Crew, the same Chinese cyberespionage team thought to be behind the recent attack on The New York Times, has been using publicly shared Dropbox folders to spread malware, reports Arlington, Va., digital-security firm Cyber Squared.

“The attackers have simply registered for a free Dropbox account, uploaded the malicious content and then publicly shared it with their targeted users,” a Cyber Squared blog posting explained last week.

For malicious hackers, Dropbox is an attractive malware distribution platform because it’s widely used in the corporate environment and is unlikely to be blocked by IT security teams.

In this way, Cyber Squared wrote, “the attackers could mask themselves behind the trusted Dropbox brand, increasing credibility and the likelihood of victim interaction with the malicious file from either personal or corporate Dropbox users.”

When a Dropbox file is publicly shared, the persons with whom it’s shared receive emails from Dropbox informing them of the share, along with a link to the file on the Dropbox website.

In the attack Cyber Squared examined, normal procedure was followed, but the shared file was an infected Word document of interest to China’s neighbors, indicating a “spear phishing” attack.

The Word document concerned commercial relations between the United States and the 10 members of the Association of Southeast Asian Nations, nine of which ring the South China Sea.

Embedded in the Word document was what seemed to be a PDF file on the same topic, but which was really malware exploiting a hole in Adobe Flash Player.

The malware copied itself to the targeted user’s hard drive, then reached out for instructions to a WordPress blog, which itself appeared to be a boring recitation of Asian trade statistics.

But seemingly decorative strings of text nestled among the postings on the WordPress blog were full of meaning.

For example, the strings “@@@@@@207.86.128.60@@@@@@” or “######443######” may not look like much to the untrained eye.

The first string includes an Internet Protocol address, which computers use to find websites; the second string references port 443, which the Internet Protocol sets aside for encrypted Web connections.

The WordPress blog was thus telling the malware where to go for further instructions and which port to connect on. (The URL in the example above is TechNewsDaily’s own.)

Cyber Squared didn’t wait to see what would happen after the malware received its instructions. Previous Comment Crew attacks have included mass penetration of organizational network, theft of intellectual property and other data and installation of spyware to keep track of a targeted user’s online activities and communications.

 

Related Article:

** 8 Simple Tips for Securing Your Computer

 

Direct Link:  http://www.nbcnews.com/technology/dropbox-used-chinese-hackers-spread-malware-6C10642402

Jul 122013
 

Google: Hacked sites far worse than attack sites

The new Safe Browsing section of Google’s Transparency Report shows that you face a significantly bigger threat from compromised legit sites than intentionally dangerous sites.

 

C/NET News
by Seth Rosenblatt
June 25, 2013

This map from the Google Transparency Report on Safe Browsing shows that only two percent of sites hosted in the U.S. contain malware. (Credit: Screenshot by Seth Rosenblatt /CNET)

This map from the Google Transparency Report on Safe Browsing shows that only two percent of sites hosted in the U.S. contain malware.
(Credit: Screenshot by Seth Rosenblatt /CNET)

 

Web sites you think are safe but have been compromised to distribute malicious software are far more prevalent than sites that are intentionally dangerous, according to a new Transparency Report from Google released on Tuesday.

The new Safe Browsing section of the report reveals some of the security trends that Google has been seeing. While Google reiterated that its Safe Browsing program flags up to 10,000 sites a day, the report showed that hacked sites remain a major problem — with about 60 percent hosting malware and 40 percent being used for phishing attacks.

Dedicated attack sites numbered in the hundreds until late 2009, when they began to increase. They crested at the end of last year above 6,000, but that number has since dropped. As of June 9, 2013, Google reports the number of these malicious sites at 3,891.

Dramatically worse is the problem of compromised sites, Web sites that are supposed to be legitimately safe but that have been hacked to infect visitors.

During the week of June 9, Google tallied 39,247 hacked sites, down from more than 60,000 last July and more than 76,000 in June 2009.

Webmaster response time to fixing those compromised sites has accelerated remarkably, although it has been slowly getting worse over past 18 months. Response time began to drop from more than 90 days in 2008 to a low of 12 days in May 2009. As of March 2013, the response time hovered around 50 days.

The full Google Transparency Report on Safe Browsing can be read here.

Originally posted at Internet & Media

Direct Link:   http://news.cnet.com/8301-1009_3-57591008-83/google-hacked-sites-far-worse-than-attack-sites/