/Launch Malicious PDF

Wow - I'm posting!! :)

Today I, and others around the Internet, received an email that stated:

Subject: setting for your mailbox are changed

SMTP and POP3 servers for YOUREMAILADDRHERE mailbox are
changed. Please carefully read the attached instructions
before updating settings.

The email had a PDF attached to it. Given the number of malicious PDFs that have been seen lately, this was likely a bad thing.

Examining the PDF with Didier Steven's pdfid.py showed that there was an OpenAction in the PDF, but no JavaScript. Interesting. Using pdf-parser.py, the object pointed to by the OpenAction was examined:


This shows that the /Launch vulnerability/feature of PDFs is being used to drop a VB script and execute it. What is interesting is the VB script (named script.vbs) parses the original PDF for another VBS to run! A quick look at the PDF finds the other VBS:



(The image above has had code removed for brevity.)

The new VBS (named batscript.vbs) contains an executable broken up into its hex bytes. The script will write each byte out to a file named game.exe and then will execute it. After executing, it sleeps for 3 seconds then covers its tracks by deleting game.exe, batscript.vbs and script.vbs.

game.exe, meanwhile, will copy itself to c:\program files\microsoft common\svchost.exe and set itself up to run in the registry whenever explorer.exe runs.

While I know the /Launch vulnerability has been exploited recently, this is the first I've seen on a mass-email scale (but isn't the first ever). I'm sure we'll be seeing more of these as time goes on.

Who are the APT targets?

I've been publicly quiet on the whole APT discussions as of late, with good reason. There are lots of blogs out there which share (and do not share) my opinion, so there is no need for me to chime into the myriad of voices out there.

However, an anonymous comment on one of the recent taosecurity posts brought up a point that I have not seen anyone else talk about. The comment stated:

Reading the Mandiant Report, we see:

1.) Government
2.) Defense Contractors
3.) Fortune XXX acquiring a Chinese compnay
4.) A Law Firm involved in a Chinese civil litigation case
5.) A non-profit trying to spread "democracy and free enterprise in China" (maybe they could also do that in the USA).

Look, it doesn't take Arthur Conan Doyle to piece together the storyline here. This clearly isn't "everyone's problem". It's a problem for those that are seen as an enemy of certain nation-states.

The part I'd like to focus on is the last statement. The APT problem is not only the problem of those seen as the enemy of certain nation states. It is the problem of everyone.

If you read Mandiant's excellent report, you will see specific examples (mentioned in the comment above) which are documented APT targets. Yes, these are what you think of as nation-state attack targets.

However, I have personally seen the APT attack and compromise systems in networks which have no ties to that nation-state and you would not consider enemies of that nation-state (or any for that matter). In these cases, the organizations were small-medium sized companies whose systems were compromised in order to be used as command and control systems for the APT's backdoors.

Of course, there are those that will say that this is the same technique that all attackers use - compromise less secure systems and use them as a go-between to attack other systems. And I will 100% agree with them on that! But that re-enforces my point as well! No one is safe from attack from APT and therefore there should be no reason why organizations should not take every reasonable precaution to against these (or any) attackers and learn as much as they can.

Yes, there will be those companies that use the term APT as a marketing tool. Yes, there will be those who say this is a limited threat to some organizations (and to some extent I agree with that). But in the end, it is a real threat that exists and any organization that does not perform the due diligence to at least learn about the potential threat will be at a disadvantage when they do get attacked; maybe not by the APT but by the next threat.

Funky Ivy

I was testing out some functionality with the Poison Ivy backdoor today when I grabbed this screenshot. Very psychedelic!

Malware Analysis in the Incident Response Process followup

I just finished giving my webcast of Malware Analysis in the Incident Response Process at brighttalk.com. A few questions came in after the presentation ended so I'll answer them here and hopefully those who asked will see it.

You indicated it is inevitable to get malware. What is the best prevention…having dedicated PCs for missions critical functions (e.g. online banking)?

I honestly believe that the best way to prevent getting malware on systems is to run users with reduced privileges. I have seen first hand where restricting what activities a user can do on their system (install software, etc) will significantly decrease the amount of malware compromises you have.

Of course, there are other options as well. A good defense in depth strategy will make it more difficult for malware to compromise your systems. Using up-to-date AV on the desktop and your email systems, restricting Internet access and requiring all web-traffic to go through filtering proxy servers will help.

Are there any books you would recommend for beginners to learn malware analysis?

There are lots of great books out there that I would recommend to anyone who wants to learn malware analysis. The following are just a few of the ones I've read.

Malware Forensics by Aquilina, Casey and Malin
The Art of Computer Virus Research and Defense by Peter Szor
Malware: Fighting Malicious Code by Skoudis and Zeltser

There are others, but these are a good start.

Can you post a recent example of an analysis?

Unfortunately, I do not have one. However, I recommend checking out the results from the 2008 Malware Challenge for some analysis reports. I will also try to post something in the next few weeks.


Thanks to those who listened to the webcast. If you have any other questions, feel free to post them in the comments or send me an email!

Malware Analysis in the Incident Response Process

Next week I'll be giving an online presentation at BrightTalk on Malware Analysis in the Incident Response Process. The description of the talk is:

Malware has become the primary vector of compromise within organisations. Due to this, it has become necessary for incident response teams to have the ability to perform in-house malware analysis. This presentation will discuss how malware analysis can benefit an organisation and what options are available.

The talk is scheduled for next Tuesday, January 12 at 6PM EST and is part of their Intrusion Prevention Summit. The summit has alot of interesting talks all day, so I recommend checking it out.

To attend my talk, you can go to the following URL:

http://www.brighttalk.com/webcasts/7977/attend

Hope you can join!

SANS Incident Detection Summit Wrapup

This past week I was able to attend the SANS Incident Detection Summit in Washington DC. [In full disclosure, I should point out that I was on two of the panels so I did not have to pay admission to attend.] I'll fully admit that the summit blew away all expectations I had of it!

The SANS 'What Works' Summits are not like their typical SANS conferences. The summits, or at least this one, are a single track where each session will either have a briefing (a presentation by someone) or a panel of experts discussing a specific topic. The audience gets to participate by asking questions via yellow note cards that are given to the moderator. The moderator then chooses which questions to ask.

Many of the briefings and panels were amazing and gave great insights into different techniques to detect bad guys. if I had to choose my favorites they probably were Seth Hall discussing Bro, the Honeynet Project briefing and AAron Walters and Brendan Dolan-Gavitt's talk on memory analysis. Matt Richard's after-hours talk on analyzing PDF and office malware was amazing as well.

As great as the panels and briefings were, the best part was being able to talk to the people afterwards. The whole summit had less than 100 people (I'm guessing here) and everyone was willing and happy to talk. Where else do you get a chance to sit down and talk with people such as AAron Walters, Matt Jonkman, Andre Ludwig, Bamm Visscher, David Bianco, Ken Bradley, Matt Olney and Ken Dunham in one place?

I will definitely be coming back next year if I can.

SANS Intrusion Detection Summit

On December 9th and 10th I will be at the SANS Intrusion Detection Summit in Washington DC. speaking on two different panels, UNIX and Windows: Tools and Techniques and CIRTs and MSSPs. I highly recommend attending if you can. There are going to be a number of amazing speakers there. (Yes, I'm not sure how I got on the panels either.)

Following the success of the 2008 and 2009 editions of the SANS WhatWorks in Forensics and Incident Response Summits, SANS is teaming with Richard Bejtlich to create a practioner-focused event dedicated to incident detection operations. The SANS Incident Detection Summit will share tools, tactics, and techniques practiced by some of the world's greatest incident detectors in two full days of content consisting of keynotes, expert briefings, and dynamic panels.

Hope to see you there!

http://www.sans.org/incident-detection-summit-2009/