Year: 2018

Brazilian Banking Trojan Communicates Via Microsoft SQL Server

Threatpost Security News May 29, 2018 1

Researchers have discovered a banking trojan making waves in Brazil with an array of tricks up its sleeve, including using an unusual command and control (C&C) server and a full-screen social-engineering overlay form.

Researchers at IBM X-Force research on Tuesday revealed that attackers are using the malware – dubbed MnuBot –mainly in Brazil to perform illegal transactions on victims’ open banking sessions.

“MnuBot… has the same capabilities as most RATs,” Tomer Agayev, threat research team lead at IBM security, told Threatpost. “It allows the attacker to gain remote access to the infected machine, including displaying fake windows of various banks on the victim’s machine.”

The remote access trojan (RAT) is unique in that it constantly queries the Microsoft SQL Database server for commands to be performed, giving attackers better dynamic configurations and anti-research capabilities.

“Most malware in the wild today use a C&C server which is based on some form of a web server or an IRC channel,” Agayev wrote in a blog post. “In contrast, the MnuBot malware uses Microsoft SQL Server database server to communicate with the sample and send commands to be executed on the infected machine.”

Once it has infected a system, MnuBot also uses a tricky social engineering method called a full-screen overlay form, which keeps the user waiting while the attacker commits the fraud.

Overlay forms, similar to those used by many other malware families in the region, are used to prevent the victims from accessing their open banking session inside the browser. A pop-up appears, and meanwhile, in the background, the attacker takes control over the user endpoint and attempts to perform an illegal transaction via that open banking session.

Agayev said that data about the scope of the malware campaign is not public: “MnuBot was discovered during active research of new Brazilian malwares, and… we can’t disclose any additional information about its methods,” he told Threatpost.

Two-Stage Attack Flow

The majority of Brazilian malware infects systems via malicious email, although X-Force is still examining the infection methods, Agayev told Threatpost. After this initial infection, MnuBot is built from two base components making up a two-stage attack flow, said researchers.

In its first stage, MnuBot looks for a file called Desk.txt within the AppData Roaming folder, which places data from applications onto whatever machine the user happens to be logged in on. This enables MnuBot to know which desktop is currently running; the malware then constantly checks for a window name that is similar to one of the bank names in its configuration.

Once it discovers one, it will query the server for the second stage executable according to the bank name that was found. The subsequent downloaded executable (C:UsersPublicNeon.exe) contains the meat of the attack by providing the attacker with full control over the victim’s machine, according to Agayev.

This executable also gives attackers abilities like keylogging, taking screenshots of desktops, restarting the victim’s machines, creating a form to overlay the bank’s forms and stealing user data in the form.

C&C Server

MnuBot connects to the Microsoft SQL Database server in order to fetch the initial configuration by using SQL server details – such as server address, port, username and a password – which are hardcoded inside the sample.

Attackers can dynamically change MnuBot’s malicious activity, and once the authors take down the server, it becomes almost impossible for a researcher to reverse engineer the malware sample behavior.

“It is most likely that MnuBot authors wanted to try to evade regular AV detection, which is based on the malware traffic. To do so they tried to wrap their malicious network communication using seemingly innocent MS SQL traffic,” said researchers.

Some of MnuBot’s tricks are typical traits of malware families in Brazil, researchers said.

“MnuBot is an excellent example of many malware families in the Brazilian region,” said Agayev. “It holds many characteristics that are typical of other recently discovered malware strains. For example, the overlaying forms and the new desktop creation are well-known techniques that malware authors in the region use today.”

SEVered Attack Extracts the Memory of AMD-Encrypted VMs

Threatpost Security News May 29, 2018 0

Virtual machines that use AMD’s Secure Encrypted Virtualization (SEV), a hardware-based encryption scheme, have been found to be vulnerable to attacks that can extract the full contents of their main memory – in plaintext.

SEV is a feature specifically designed for securely encrypting VMs, developed to protect VM memory from remote and physical attackers. It is meant to give users a modicum of control over their virtual environments, so they don’t have to place all of their trust in the vendors providing the virtualized environment.

Hypervisors act as controllers for VMs and as such, can easily access sensitive data stored in VM memory, such as keys, passwords or classified information. SEV was built to encrypt individual VMs using a secure processor (SP). It’s a hardware-based approach that removes the memory from being open to prying hypervisor eyes – in theory.

Ironically, SEV can be “SEVered,” so to speak, laying open the VMs to attacks from malicious hypervisor.

“SEVered [the coined term for the attack method] neither requires physical access nor colluding virtual machines, but only relies on a remote communication service, such as a web server, running in the targeted virtual machine,” explained Fraunhofer AISEC researchers Mathias Morbitzer, Manuel Huber, Julian Horsch and Sascha Wessel, in an research paper (PDF) released last week. “SEVered reliably and efficiently extracts all memory contents, even in scenarios where the targeted virtual machine is under high load.”

AMD confirmed the vulnerability to Threatpost, saying, “AMD is currently working with the ecosystem to protect against vulnerabilities that are more difficult to exploit, such as malicious hypervisor attacks like those recently detailed by German researchers.” No patch is yet available.

The chipmaker also characterized SEV as continuing to protect VM from inadvertent vulnerabilities in typical operating environments.

“SEV provides what was previously unavailable protection of memory in a virtual environment and is a first step to improving security for virtualization,” the company said in a statement provided to Threatpost.

Malicious Mapping

According to the German researchers, the problem is that SEV’s encryption of main VM memory lacks integrity protection. To wit, even with SEV enabled, hypervisors are responsible for second-level address translation (SLAT), meaning that they maintain the VM’s General Physical Access (GPA) to Host Physical Address (HPA) mapping in main memory. That allows an attacker with access to the hypervisor to change that mapping and identify linked information when the RAM is queried.

“We use this capability to trick a service in the VM, such as a web server, into returning arbitrary pages of the VM in plaintext upon the request of a resource from outside,” the paper outlined. “We first identify the encrypted pages in memory corresponding to the resource, which the service returns as a response to a specific request. By repeatedly sending requests for the same resource to the service while re-mapping the identified memory pages, we extract all the VM’s memory in plaintext.”

After completion, attackers can cover their tracks by restoring the mapping of the resource pages to their original HPAs.

The paper’s authors said that SEVered neither requires detailed knowledge of the target VM or service, nor a malicious process running inside the VM; however, several techniques have to be combined to reliably identify the encrypted pages that are being queried – and this supports AMD’s characterization of the flaw as being difficult to exploit.

Real-World Feasibility

Exploitation may be difficult, but it is certainly possible, as the researchers demonstrated.

Using a Debian GNU/Linux test server running on an AMD Epyc 7251 processor with SEV enabled, they spun up an Apache web server and an OpenSSH in separate VMs. They then modified the system’s KVM hypervisor, so that it could see when software accessed physical RAM. Within seconds, after multiple requests for the same information, they were able to narrow down what resource corresponded with which query, in order to extract it.

In this way, the hypervisor eventually was able to extract 2GB of memory from the victim machine.

“Our evaluation shows that SEVered is feasible in practice and that it can be used to extract the entire memory from a SEV-protected VM within reasonable time,” the researchers wrote. “The results specifically show that critical aspects, such as noise [activity] during the identification and the resource stickiness are managed well by SEVered.”

Mitigations

As mentioned, there is no patch or fix for the issue. And, researchers said, issuing a fix will be tricky.

For one, shoring things up in software isn’t an answer. “Integrity protection can hardly be achieved in software as the VM would require efficient and reliable software mechanisms to protect itself from modification of memory mappings and contents, e.g., by maintaining hashes in a safe location,” the researchers noted. “Both mechanisms seem hard to realize to reliably protect an entire VM at all times, and would probably incur an intolerable performance overhead. We thus consider software-based countermeasures insufficient solutions against our attack.”

Hardware-based solutions come in two flavors. First, a modification of AMD SEV to include the integrity protection. That’s likely a costly endeavor and would require labor and overhead to install.

The second approach is more low-cost and efficient. “Securely combine the hash of the page’s content with the guest-assigned GPA,” researchers noted. “This ensures that pages cannot easily be swapped by changing the GPA to HPA mapping. Adding a nonce additionally ensures that an old page for the GPA cannot be replayed into the guest by a malicious [hypervisor].”

Sonic Tone Attacks Damage Hard Disk Drives, Crashes OS

Threatpost Security News May 29, 2018 0

Using sonic and ultrasonic soundwaves as a weapon, researchers can disrupt the read, write and storage functions of a hard disk drive (HDD). The method can also be used to crash the host operating system, and in some cases damage targeted drives.

Researchers said the attack can be performed by “nearby emitters” that target a computer’s HDD; so, the attacks could be performed by an adversary using inexpensive off-the-shelf speakers or could also be carried out via laptop or desktop speakers. In one scenario, a victim visits a website or receives a phishing message and a damaging ultrasonic tone plays.

The attack scenarios were outlined by researchers from the University of Michigan and Zhejian University in China. The group presented their research last week in San Francisco at the IEEE Symposium on Security and Privacy.

“Adversaries without special-purpose equipment can cause errors in the hard disk drive using either audible or ultrasonic acoustic waves. Audible waves vibrate the read/write head and platters; ultrasonic waves alter the output of the HDD’s shock sensor, intentionally causing the head to park,” according to the research paper entitled (PDF): How Intentional Acoustic Interference Damages Availability and Integrity in Hard Disk Drives and Operating Systems.

Both of these types of errors can lead to operating system-level or application-level problems, including persistent corruption and system reboots.

“Our experiments show that audible sound causes the head stack assembly to vibrate outside of operational bounds; ultrasonic sound causes false positives in the shock sensor, which is designed to prevent a head crash,” they wrote.

In one attack scenario against a PC with a Western Digital Blue WD5000LPVX drive, researchers exposed the drive to vibrations induced by a 5 kHz tone at 115.3 dB SPL and a 5 kHz tone at 117.2 dB SPL. Those noise levels are roughly equivalent to sound of a car horn, live rock music or chainsaw, according to a comparison chart hosted at a Purdue University website.

Prolonged exposure to those levels can cause “permanent data loss, program crashes and unrecoverable physical loss in HDDs.”

Tests were conducted on three different HDD manufacturers: Western Digital, Toshiba and Seagate. Attack scenarios also involved vibrations created by ultrasonic tones, which is sound that is created at a frequency higher than can be heard by humans (20 kHz and up).

“Ultrasonic attacks are less likely to cause a head crash, but could be damaging the drive in other ways such as causing the head to become unstable over time because of excessive parking,” researchers said.

In tests using a Toshiba HDD exposed to ultrasonic signals, researchers said they were able to make the HDD’s read/write head park in rapid succession on the hard disk platter, “possibly causing damage to the head controller.”

They added, “This instability could make the drive less reliable in its reads and writes, leading to sectors being marked as bad.”

A third type of attack targeted a HP Elite Minitower desktop PC equipped with an internal HP DC7600U speaker. Using the system’s own speaker, the proof of concept was able to cause intermittent freezing of the system running a Western Digital Blue WD5000LPVX HHD.

“For self-stimulation attacks, the victim accesses the adversary’s website — perhaps through a phishing attack or a link within a malicious email,” researchers wrote. “The site then plays malicious audio without permission over the system’s built-in speaker to attack the HDD. The frequency response of a built-in speaker may limit the ability for an adversary to deliver ultrasonic attacks, but some speakers may be able to deliver ultrasonic or near ultrasonic tones.”

The answer to why sound vibrations cause system interruptions and crashes varies. In one case, researchers analyzed the Windows 10 system crash dump files of a targeted computer. They were able to establish that the hardware driver called “miniport” was returning a device error that the OS could not handle properly.

“The operating system does not seem to handle this error correctly, leading to UNEXPECTED_STORE_EXCEPTION. This indicates that the memory manager required data from the disk, but was unable to write into memory because of an in-page I/O error,” researchers said.

Disproportionately vulnerable to these type attacks, say researchers, are older systems that still rely on legacy magnetic HHD technology. This is typically found in medical devices and other systems that are difficult to retire, such as CCTV surveillance camera storage, according to the paper.

As far as defenses, the researchers said that techniques include “mitigating attacks in vulnerable frequency bands with attenuation controllers, using sensor fusion to detect attacks, and noise dampening materials to attenuate the signal.”

Google Patches reCAPTCHA Bypass

Threatpost Security News May 29, 2018 0

Google has fixed a bypass for its reCAPTCHA authentication mechanism – the Turing test-based methodology for proving that website users aren’t robots, commonly spotted on log-in pages online. The news comes as Google releases a new version of reCAPTCHA in beta.

Google has been working on refining and strengthening reCAPTCHA for years, and last year extended it to mobile websites for Android users. Essentially, web developers can drop in a reCAPTCHA code fairly easily using Google’s API. Once embedded, it determines whether to trust website visitors based on their ability to solve a simple puzzle, such as clicking on all street signs in a presented photo, solving an audio challenge, or typing in a word or number that’s presented in distorted form.

The internet giant said that more than over 300 million reCAPTCHAs are solved each day.

Behind the scenes, a handshake is going on. Once a user solves the challenge and clicks verify, the reCAPTCHA function sends an HTTP request to the web application. That in turn sends its own request to the Google reCAPTCHA API, which both verifies itself as a trusted application and requests verification that the visitor solved the reCAPTCHA correctly.

An exploit for the bypass vulnerability required an HTTP parameter pollution in the web application, according to independent app security expert Andres Riancho, who reported the bypass (and earned $500 from the Google bug-bounty program for his efforts). In other words, the web application would need to send verification requests to the reCAPTCHA API in an insecure way. This reduces the severity of the flaw, but also leads to a 100-percent success rate.

“When this situation occurred the attacker was able to bypass the protection every time,” Riancho said in a post on the flaw posted on Monday, adding that Github searches showed that about 60 percent of reCAPTCHA integrations contain this kind of vulnerability.

“HTTP parameter pollution is almost everywhere: client-side and server-side, and the associated risk depends greatly on the context,” explained Riancho. “In some specific cases it could lead to huge data breach, but in most cases it is a low-risk finding.”

An attacker in this case can send a specially crafted response to the vulnerable web application, which contains a hard-coded secret key which disables reCAPTCHA response verification. The key is provided to developers as an easy way to disable reCAPTCHA’s verification in staging environments. If a malicious actor inserted the key within the string ahead of the regular response from the API, he or she could get around the reCAPTCHA.

“Note that the request contains two secret parameters, the first one is controlled by the attacker (due to the HTTP parameter pollution in the vulnerable web application) and the second one is controlled by the application itself…the reCAPTCHA API [always] uses the first one,” Riancho said.

Google has fixed the security issue upstream in the reCAPTCHA REST API, which fortunately means no modifications are required to the affected web applications.

This is not the first time an exploit has been designed for the mechanism. Last Fall saw the debut of unCAPTCHA, an artificial intelligence-based automated system designed at the University of Maryland. It was able to break Google’s audio-based reCAPTCHA challenges (offered as an option for people with disabilities), with an accuracy of 85 percent. It could in fact solve 450 reCAPTCHA challenges with that accuracy level in just 5.42 seconds: less time than it takes to listen to the challenge in the first place.

unCaptcha combines free, public, online speech-to-text engines with a phonetic mapping technique. The system downloads the audio challenge, breaks it into several digital audio clips, then runs them through several text-to-speech systems to determine exact and near-homophones, weights the aggregated results by confidence level, and then sends the most probable answer back to Google.

reCAPTCHA 3

Meanwhile, Google recently announced the beta version of a fresh approach to reCAPTCHA that eliminates the puzzles. reCAPTCHA 3 instead returns a trustability score for each request based on interactions with a website.

Google said that the mechanism won’t interrupt users, and website administrators will be able to decide when to run it. The scores are based on user interactions with a site, with behavioral characteristics like mouse movements used to determine a visitor’s level of humanity. A “good” score is 1.0, while a bot interaction will be scored a zero.