« précédent suivant »
Pages: [1]   En bas

Auteur Sujet: [FireEye]Operation GreedyWonk: Multiple Economic and Foreign Policy Sites Compromised, Serving Up Flash Zero-Day Exploit  (Lu 2921 fois)

0 Membres et 1 Invité sur ce sujet

Hors ligne igor51

  • Admin
  • Mega Power Members
  • *****
  • Messages: 10419
[FireEye]Operation GreedyWonk: Multiple Economic and Foreign Policy Sites Compromised, Serving Up Flash Zero-Day Exploit
« le: février 11, 2018, 00:00:37 »
Operation GreedyWonk: Multiple Economic and Foreign Policy Sites
Compromised, Serving Up Flash Zero-Day Exploit

Less than a week after uncovering     href="/content/fireeye-www/en_US/blog/threat-research/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html">Operation
  SnowMan, the FireEye Dynamic Threat Intelligence cloud has
  identified another targeted attack campaign — this one exploiting a
  zero-day vulnerability in Flash. We are collaborating with Adobe
  security on this issue. Adobe has assigned the CVE identifier
  CVE-2014-0502 to this vulnerability and released a     href="http://helpx.adobe.com/security/products/flash-player/apsb14-07.html">security bulletin.


 

As of this blog post, visitors to at least three nonprofit
  institutions — two of which focus on matters of national security and
  public policy — were redirected to an exploit server hosting the
  zero-day exploit. We’re dubbing this attack “Operation GreedyWonk.”


 

We believe GreedyWonk may be related to     href="http://blog.shadowserver.org/2012/05/15/cyber-espionage-strategic-web-compromises-trusted-websites-serving-dangerous-results/">a
    May 2012 campaign outlined by ShadowServer, based on
  consistencies in tradecraft (particularly with the websites chosen for
  this strategic Web compromise), attack infrastructure, and malware
  configuration properties.


 

The group behind this campaign appears to have sufficient resources
  (such as access to zero-day exploits) and a determination to infect
  visitors to foreign and public policy websites. The threat actors
  likely sought to infect users to these sites for follow-on data theft,
  including information related to defense and public policy matters.


 


  Discovery


 

On Feb. 13, FireEye identified a zero-day Adobe Flash exploit that
  affects the latest version of the Flash Player (12.0.0.4 and
  11.7.700.261). Visitors to the Peter G. Peterson Institute for
  International Economics (www.piie[.]com) were redirected to an exploit
  server hosting this Flash zero-day through a hidden iframe.


 

We subsequently found that the American Research Center in Egypt
  (www.arce[.]org) and the Smith Richardson Foundation (www.srf[.]org)
  also redirected visitors the exploit server. All three organizations
  are nonprofit institutions; the Peterson Institute and Smith
  Richardson Foundation engage in national security and public policy issues.


 


  Mitigation


 

To bypass Windows’ Address Space Layout Randomization (ASLR)
  protections, this exploit targets computers with any of the following configurations:


 
  • Windows XP
  • Windows 7 and Java 1.6
  • Windows 7
        and an out-of-date version of Microsoft Office 2007 or 2010

 

Users can mitigate the threat by     href="/content/fireeye-www/en_US/blog/executive-perspective/2014/02/windows-xp-catch-if-you-cannot-patch.html">upgrading
    from Windows XP and updating Java and Office. If you have Java
  1.6, update Java to the latest 1.7 version. If you are using an
  out-of-date Microsoft Office 2007 or 2010, update Microsoft Office to
  the latest version.


 

These mitigations do not patch the underlying vulnerability. But by
  breaking the exploit’s ASLR-bypass measures, they do prevent the
  current in-the-wild exploit from functioning.


 


  Vulnerability analysis


 

GreedyWonk targets a previously unknown vulnerability in Adobe
  Flash. The vulnerability permits an attacker to overwrite the
  vftable pointer of a Flash object to redirect code execution.


 


  ASLR bypass


 

The attack uses only known ASLR bypasses. Details of these
  techniques are available from     href="/content/fireeye-www/en_US/blog/threat-research/2013/10/aslr-bypass-apocalypse-in-lately-zero-day-exploits.html">our
    previous blog post on the subject (in the “Non-ASLR modules” section).


 

For Windows XP, the attackers build a return-oriented programming
  (ROP) chain of MSVCRT (Visual C runtime) gadgets with hard-coded base
  addresses for English (“en”) and Chinese (“zh-cn” and “zh-tw”).


 

On Windows 7, the attackers use a hard-coded ROP chain for
  MSVCR71.dll (Visual C++ runtime) if the user has Java 1.6, and a
  hard-coded ROP chain for HXDS.dll (Help Data Services Module) if the
  user has Microsoft Office 2007 or 2010.


 

Java 1.6 is no longer supported and does not receive security
  updates. In addition to the MSVCR71.dll ASLR bypass, a variety of
  widely exploited code-execution vulnerabilities exist in Java 1.6.
  That’s why FireEye strongly recommends upgrading to Java 1.7.


 

The Microsoft Office HXDS.dll ASLR bypass was patched at the end of
  2013. More details about this bypass are addressed by Microsoft’s     href="http://technet.microsoft.com/en-us/security/bulletin/ms13-106">Security
    Bulletin MS13-106 and an accompanying     href="https://blogs.technet.com/b/srd/archive/2013/12/09/ms13-106-another-aslr-bypass-is-gone.aspx">blog
  entry. FireEye strongly recommends updating Microsoft Office 2007
  and 2010 with the latest patches.


 


  Shellcode analysis


 

The shellcode is downloaded in ActionScript as a GIF image. Once ROP
  marks the shellcode as executable using Windows’ VirtualProtect
  function, it downloads an executable via the InternetOpenURLA
  and InternetReadFile functions. Then it writes the file to disk
  with CreateFileA and WriteFile functions. Finally, it
  runs the file using the WinExec function.


 


  PlugX/Kaba payload analysis


 

Once the exploit succeeds, a PlugX/Kaba remote access tool (RAT)
  payload with the MD5 hash 507aed81e3106da8c50efb3a045c5e2b is
  installed on the compromised endpoint. This PlugX sample was compiled
  on Feb. 12, one day before we first observed it, indicating that it
  was deployed specifically for this campaign.


 

This PlugX payload was configured with the following
  command-and-control (CnC) domains:


 
  • java.ns1[.]name
  • adservice.no-ip[.]org

    •  
  • wmi.ns01[.]us

 

Sample callback traffic was as follows:


 


  

POST /D28419029043311C6F8BF9F5 HTTP/1.1
Accept: */*




HHV1: 0




HHV2: 0




HHV3: 61456




HHV4: 1




User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; InfoPath.2; .NET CLR 2.0.50727; SV1)




Host: java.ns1.name




Content-Length: 0




Connection: Keep-Alive




Cache-Control: no-cache







 


  Campaign analysis


 

Both java.ns1[.]name and adservice.no-ip[.]org resolved to
  74.126.177.68 on Feb. 18, 2014. Passive DNS analysis reveals that the
  domain wmi.ns01.us previously resolved to 103.246.246.103 between July
  4, 2013 and July 15, 2013 and 192.74.246.219 on Feb. 17, 2014. 
  java.ns1[.]name also resolved to 192.74.246.219 on February 18.


 
   
     
   
     
                  class="c09_td">
        2014-02-19       class="c09_td_value is-hidden-mml">2014-02-19           class="c09_td">
        74.126.177.68       class="c09_td_value is-hidden-mml">74.126.177.68
   
                class="c09_td">
        2014-02-18       class="c09_td_value is-hidden-mml">2014-02-18           class="c09_td">
        2014-02-19       class="c09_td_value is-hidden-mml">2014-02-19           class="c09_td">
        74.126.177.68       class="c09_td_value is-hidden-mml">74.126.177.68
   
                class="c09_td">
        2014-02-18       class="c09_td_value is-hidden-mml">2014-02-18           class="c09_td">
        2014-02-18       class="c09_td_value is-hidden-mml">2014-02-18           class="c09_td">
        192.74.246.219       class="c09_td_value is-hidden-mml">192.74.246.219
   
                class="c09_td">
        2014-02-17       class="c09_td_value is-hidden-mml">2014-02-17           class="c09_td">
        2014-02-17       class="c09_td_value is-hidden-mml">2014-02-17           class="c09_td">
        192.74.246.219       class="c09_td_value is-hidden-mml">192.74.246.219
   
     
                  class="c09_td">
        2014-02-18       class="c09_td_value is-hidden-mml">2014-02-18           class="c09_td">
        103.246.246.103       class="c09_td_value is-hidden-mml">103.246.246.103
   
     
                  class="c09_td">
        2013-09-06       class="c09_td_value is-hidden-mml">2013-09-06           class="c09_td">
        103.246.246.103       class="c09_td_value is-hidden-mml">103.246.246.103
   
     
                  class="c09_td">
        2013-09-06       class="c09_td_value is-hidden-mml">2013-09-06           class="c09_td">
        103.246.246.103       class="c09_td_value is-hidden-mml">103.246.246.103
   
                class="c09_td">
        2013-07-04       class="c09_td_value is-hidden-mml">2013-07-04           class="c09_td">
        2013-07-15       class="c09_td_value is-hidden-mml">2013-07-15           class="c09_td">
        103.246.246.103       class="c09_td_value is-hidden-mml">103.246.246.103
Domain         class="c09_td">First Seen         class="c09_td">Last Seen IP
      Address

        adservice.no-ip[.]org       class="c09_td_value is-hidden-mml">adservice.no-ip[.]org
        2014-02-18       class="c09_td_value is-hidden-mml">2014-02-18

        java.ns1[.]name       class="c09_td_value is-hidden-mml">java.ns1[.]name

        java.ns1[.]name       class="c09_td_value is-hidden-mml">java.ns1[.]name

        wmi.ns01[.]us       class="c09_td_value is-hidden-mml">wmi.ns01[.]us

        proxy.ddns[.]info       class="c09_td_value is-hidden-mml">proxy.ddns[.]info
        2013-05-02       class="c09_td_value is-hidden-mml">2013-05-02

        updatedns.ns02[.]us       class="c09_td_value is-hidden-mml">updatedns.ns02[.]us
        2013-09-06       class="c09_td_value is-hidden-mml">2013-09-06

        updatedns.ns01[.]us       class="c09_td_value is-hidden-mml">updatedns.ns01[.]us
        2013-09-06       class="c09_td_value is-hidden-mml">2013-09-06

        wmi.ns01[.]us       class="c09_td_value is-hidden-mml">wmi.ns01[.]us

 

 


 
   
     
   
     
                  class="c09_td">
        2012-06-09       class="c09_td_value is-hidden-mml">2012-06-09           class="c09_td">
        fuckchina.govnb[.]com       class="c09_td_value is-hidden-mml">fuckchina.govnb[.]com
   
     
                  class="c09_td">
        2010-03-15       class="c09_td_value is-hidden-mml">2010-03-15           class="c09_td">
        microsafes.no-ip[.]org       class="c09_td_value is-hidden-mml">microsafes.no-ip[.]org
   
     
                  class="c09_td">
        2013-03-07       class="c09_td_value is-hidden-mml">2013-03-07           class="c09_td">
        N/A       class="c09_td_value is-hidden-mml">N/A
   
     
                  class="c09_td">
        2012-06-11       class="c09_td_value is-hidden-mml">2012-06-11           class="c09_td">
        N/A       class="c09_td_value is-hidden-mml">N/A
   
     
                  class="c09_td">
        2012-06-11       class="c09_td_value is-hidden-mml">2012-06-11           class="c09_td">
        N/A       class="c09_td_value is-hidden-mml">N/A
MD5       scope="col">Family Compile
      Time		 Alternate C2s

        7995a9a6a889b914e208eb924e459ebc       class="c09_td_value is-hidden-mml">7995a9a6a889b914e208eb924e459ebc
        PlugX       class="c09_td_value is-hidden-mml">PlugX

        bf60b8d26bc0c94dda2e3471de6ec977       class="c09_td_value is-hidden-mml">bf60b8d26bc0c94dda2e3471de6ec977
        PlugX       class="c09_td_value is-hidden-mml">PlugX

        fd69793bd63c44bbb22f9c4d46873252       class="c09_td_value is-hidden-mml">fd69793bd63c44bbb22f9c4d46873252		 Poison
        Ivy           class="c09_td_value is-hidden-mml">Poison Ivy

        88b375e3b5c50a3e6c881bc96c926928       class="c09_td_value is-hidden-mml">88b375e3b5c50a3e6c881bc96c926928		 Poison
        Ivy           class="c09_td_value is-hidden-mml">Poison Ivy

        cd07a9e49b1f909e1bd9e39a7a6e56b4       class="c09_td_value is-hidden-mml">cd07a9e49b1f909e1bd9e39a7a6e56b4		 Poison
        Ivy           class="c09_td_value is-hidden-mml">Poison Ivy

 

The Poison Ivy variants that connected to the domain wmi.ns01[.]us
  had the following unique configuration properties:


 
   
     
   
     
                  class="c09_td">
        2013-12-11       class="c09_td_value is-hidden-mml">2013-12-11           class="c09_td">
        204.200.222.136       class="c09_td_value is-hidden-mml">204.200.222.136
   
     
                  class="c09_td">
        2014-02-12       class="c09_td_value is-hidden-mml">2014-02-12           class="c09_td">
        74.126.177.70       class="c09_td_value is-hidden-mml">74.126.177.70
   
     
                  class="c09_td">
        2013-12-04       class="c09_td_value is-hidden-mml">2013-12-04           class="c09_td">
        74.126.177.241       class="c09_td_value is-hidden-mml">74.126.177.241
Domain         class="c09_td">First Seen         class="c09_td">Last Seen IP
      Address

        fuckchina.govnb[.]com       class="c09_td_value is-hidden-mml">fuckchina.govnb[.]com
        2013-12-11       class="c09_td_value is-hidden-mml">2013-12-11

        microsafes.no-ip[.]org       class="c09_td_value is-hidden-mml">microsafes.no-ip[.]org
        2014-02-12       class="c09_td_value is-hidden-mml">2014-02-12

        microsafes.no-ip[.]org       class="c09_td_value is-hidden-mml">microsafes.no-ip[.]org
        2013-12-04       class="c09_td_value is-hidden-mml">2013-12-04

 

We found a related Poison Ivy sample (MD5
  8936c87a08ffa56d19fdb87588e35952) with the same “java7” password,
  which was dropped by an Adobe Flash exploit (CVE-2012-0779). In this
  previous incident, visitors to the Center for Defense Information
  website (www.cdi[.]org — also an organization involved in defense
  matters — were redirected to an exploit server at 159.54.62.92.


 

This exploit server hosted a Flash exploit file named
  BrightBalls.swf (MD5 1ec5141051776ec9092db92050192758). This exploit,
  in turn, dropped the Poison Ivy   href="http://blog.shadowserver.org/2012/05/15/cyber-espionage-strategic-web-compromises-trusted-websites-serving-dangerous-results/">variant.
  In addition to using the same password “java7,” this variant was
  configured with the mutex with the similar pattern of “YFds*&^ff”
  and connected to a CnC server at windows.ddns[.]us.


 

Using passive DNS analysis, we see the domains windows.ddns[.]us and
  wmi.ns01[.]us both resolved to 76.73.80.188 in mid-2012.


 
   
     
   
                class="c09_td">
        2012-07-07       class="c09_td_value is-hidden-mml">2012-07-07           class="c09_td">
        2012-09-19       class="c09_td_value is-hidden-mml">2012-09-19           class="c09_td">
        76.73.80.188       class="c09_td_value is-hidden-mml">76.73.80.188
   
                class="c09_td">
        2012-05-23       class="c09_td_value is-hidden-mml">2012-05-23           class="c09_td">
        2012-06-10       class="c09_td_value is-hidden-mml">2012-06-10           class="c09_td">
        76.73.80.188       class="c09_td_value is-hidden-mml">76.73.80.188
Domain         scope="col">First Seen Last
      Seen		 IP Address

        wmi.ns01.us       class="c09_td_value is-hidden-mml">wmi.ns01.us

        windows.ddns.us       class="c09_td_value is-hidden-mml">windows.ddns.us

 

During another earlier compromise of the same www.cdi.org website,
  visitors were redirected to a Java exploit test.jar (MD5
  7d810e3564c4eb95bcb3d11ce191208e). This jar file exploited
  CVE-2012-0507 and dropped a Poison Ivy payload with the hash (MD5
  52aa791a524b61b129344f10b4712f52). This Poison Ivy variant connected
  to a CnC server at ids.ns01[.]us. The domain ids.ns01[.]us also
  overlaps with the domain wmi.ns01[.]us on the IP 194.183.224.75.


 
   
     
   
                class="c09_td">
        2012-07-03       class="c09_td_value is-hidden-mml">2012-07-03           class="c09_td">
        2012-07-04       class="c09_td_value is-hidden-mml">2012-07-04           class="c09_td">
        194.183.224.75       class="c09_td_value is-hidden-mml">194.183.224.75
   
                class="c09_td">
        2012-04-23       class="c09_td_value is-hidden-mml">2012-04-23           class="c09_td">
        2012-05-18       class="c09_td_value is-hidden-mml">2012-05-18           class="c09_td">
        194.183.224.75       class="c09_td_value is-hidden-mml">194.183.224.75
Domain         scope="col">First Seen Last
      Seen		 IP Address

        wmi.ns01[.]us       class="c09_td_value is-hidden-mml">wmi.ns01[.]us

        ids.ns01[.]us       class="c09_td_value is-hidden-mml">ids.ns01[.]us

 

The Poison Ivy sample referenced above (MD5
  fd69793bd63c44bbb22f9c4d46873252) was delivered via an exploit chain
  that began with a redirect from the Center for European Policy Studies
  (www.ceps[.]be). In this case, visitors were redirected from
  www.ceps[.]be to a Java exploit hosted on shop.fujifilm[.]be.


 

In what is certainly not a coincidence, we also observed
  www.arce[.]org (one of the sites redirecting to the current Flash
  exploit) also redirect visitors to the Java exploit on
  shop.fujifilm[.]be in 2013.


 


        href="/content/dam/legacy/blog/2014/02/greedywonk-campaign-v2.png">      width="640" height="207"
      class=" wp-image-4577 alignnone landscape-med"
      alt="greedywonk-campaign-v2" src="https://www.fireeye.com/content/dam/legacy/blog/2014/02/greedywonk-campaign-v2.png" />


 


  Conclusion


 

This threat actor clearly seeks out and compromises websites of
  organizations related to international security policy, defense
  topics, and other non-profit sociocultural issues. The actor either
  maintains persistence on these sites for extended periods of time or
  is able to re-compromise them periodically.


 

This actor also has early access to a number of zero-day exploits,
  including Flash and Java, and deploys a variety of malware families on
  compromised systems. Based on these and other observations, we
  conclude that this actor has the tradecraft abilities and resources to
  remain a credible threat in at least the mid-term.


Source: Operation GreedyWonk: Multiple Economic and Foreign Policy Sites
Compromised, Serving Up Flash Zero-Day Exploit
IP archivée
Pages: [1]   En haut
« précédent suivant »
Tags:
 

Le site internet Security-x.fr utilise des cookies. Un cookie est un fichier texte stocké par votre navigateur, qui lui permet de conserver des informations entre les pages internet et les sessions de navigation. Ces fichiers permettent d'améliorer votre navigation sur notre site. Learn more