Internet Explorer 8 Exploit Found in Watering Hole Campaign Targeting
Chinese DissidentsOn March 16th, we discovered a premeditated waterhole campaign that
hosts exploits and malware on websites frequented by a specific target
group. In this case the target includes Chinese dissidents. For the
attacker, this approach is highly attractive since it is very
difficult to discover the attacker’s identity. Moreover, this attack
is a form of social engineering, leveraging the fact that the target
group visits specific websites. By exploiting these “watering holes”
the attacker benefits by investing little time in targeting.
This attack exploits a fresh vulnerability ( href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1288">CVE-2013-1288,
href="http://technet.microsoft.com/en-us/security/bulletin/MS13-021">MS13-021)
in Internet Explorer 8—just four days after Microsoft released a
patch. Why did attackers use a fresh vulnerability? Cost could be a
factor. Zero-days tend to be expensive to either research or purchase
on black markets.
We found this exploit being employed in attacks on two hacked
Chinese news websites known to promote dissidence against the Chinese
government. This is clearly a targeted attack on a very narrow portion
of the Chinese populous. However, since cyber attackers are quick
copycats, we expect this exploit to be replicated quickly. For this
reason, anyone using IE 8 must install a patch immediately or upgrade
their browser to new versions. Today, according to href="http://www.w3schools.com/browsers/browsers_explorer.asp">W3Schools.com,
IE is the third most popular browser with about 15% market share. In
addition, IE 8 is used by half of all IE users.
Based on the similarity in TTPs (Tools, Techniques, and Procedures),
we believe the threat actor is the same as the one behind previous
watering hole attacks targeting activists and people with certain
political affiliations. In the past this campaign has used various
hacked websites such as the Council on Foreign Relations or href="/content/fireeye-www/en_US/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html">CFR,
href="https://blog.avast.com:2013:01:22:reporters-without-borders-website-misused-in-wateringhole-attack:">Reporters
Without Borders, and a leading American university (that we
cannot name).
In general, based on our observations, this watering hole attack is
like many others we have observed: highly targeted and hard to
trace—indicative of a very sophisticated attacker. Why? The attack:
- Used hacked websites to deliver the exploit to targeted groups
of people. In this case it particularly targets certain group of
Chinese speaking people. - Used hacked website to host
exploit code and malware payload, and also second stage of payload,
which makes it very hard to trace the origin of the attack.
- Takes tremendous effort to compromise websites relevant to the
target group. It would require knowledge of web application
security. - Leverages the zero-day exploits and fresh
exploits. - Was multi-stage, and the second stage of payload is
encrypted and downloaded from a 404-like response page, and is
injected dynamically. Once they shut down the operation, it’s hard
to trace the attacker’s intention.
[caption id="attachment_1348" align="alignnone"
width="540"] href="/content/dam/legacy/blog/2013/03/waterhole1.png"> width="540" height="414"
src="/content/dam/legacy/blog/2013/03/waterhole1.png"
alt="waterhole1" class=" wp-image-1348 landscape-med" />
Figure 1[/caption]
Exploit technique
The exploit code is hosted on a hacked religious website. This
site hosts both IE ( href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1288">CVE-2013-1288)
and Java exploits ( href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0422">CVE-2013-0422,
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3544">CVE-2011-3544).
On mining our database we found that the web server has a history of
hosting malware. We will focus on the chain of execution for the
exploit. The first part of the exploit checks the language of browser,
and constructs two separate ROP chains for English and Chinese
languages as shown in Figure 2. The second part of the exploit is
obfuscated and it triggers the vulnerability. Upon successful
exploitation it will download a file dd.exe from the same server and
execute it.
[caption id="attachment_1349" align="alignnone"
width="540"] href="/content/dam/legacy/blog/2013/03/waterhole2.png"> width="540" height="324"
src="/content/dam/legacy/blog/2013/03/waterhole2.png"
alt="waterhole2" title="Figure 1"
class=" wp-image-1349 landscape-med" /> Figure 2[/caption]
Malware Payload:
The file dd.exe (651fad35d276e5dedc56dfe7f3b5f125) is the stage 1
payload and makes the request show in in Figure 3. The response to
this request is a HTML page. In the case of Java exploit we found it
serving 9ac8277b848496b28279f57cb959e2fb.
[caption id="attachment_1352" align="alignnone"
width="539"] href="/content/dam/legacy/blog/2013/03/waterhole5.png"> width="539" height="247"
src="/content/dam/legacy/blog/2013/03/waterhole5.png"
alt="waterhole5" class=" wp-image-1352 landscape-med" />
Figure 3[/caption]
The HTML page displays a page not found message repeatedly using a
script on the page if opened in the browser.
[caption id="attachment_1374" align="alignnone"
width="554"] href="/content/dam/legacy/blog/2013/03/Screen-Shot-2013-03-20-at-1.38.10-PM.png"> width="554" height="66"
src="/content/dam/legacy/blog/2013/03/Screen-Shot-2013-03-20-at-1.38.10-PM.png"
alt="Screen Shot 2013-03-20 at 1.38.10 PM"
class=" wp-image-1374 landscape-med" /> Figure 4[/caption]
Interestingly the html page returned also contains Base64 encoded
data within a script tag, which is in fact the stage 2 payload. This
Base64 encoded data is decrypted and written to %AppData%\network.inf.
The decoded file is read in another part of the code and is subject to
further transformations. The first 68 bytes of this the decoded data
contains the decryption routine shown in Figure 5. It uses a rolling
byte XOR decryption scheme and applies it to the data starting at
offset 69. The decrypted data is position independent code, which is
injected into an instance of iexplorer.exe launched in suspended state.
[caption id="attachment_1350" align="alignnone"
width="649"] href="/content/dam/legacy/blog/2013/03/waterhole3.png"> width="649" height="156"
src="/content/dam/legacy/blog/2013/03/waterhole3.png"
alt="waterhole3" class=" wp-image-1350 landscape-med" />
Figure 5[/caption]
This injected second stage payload is a Backdoor PoisonIvy RAT also
discovered in other similar watering hole campaigns. This code
attempts to connect to a remote server in Hong Kong over port 443. It
uses a dynamic DNS provider with the hostname dd.tc.ikwb.com, which
translates to 58.64.179.189. The server is not responding at the time
of analysis. We found other domains associated with this IP address on
robtex.com as shown in Figure 6.
[caption id="attachment_1356" align="alignnone"
width="378"] href="/content/dam/legacy/blog/2013/03/waterhole41.png"> width="378" height="230"
src="/content/dam/legacy/blog/2013/03/waterhole41.png"
alt="waterhole4" class=" wp-image-1356 landscape-sm" />
Figure 6[/caption]
Similarity to previous watering hole campaigns:
Let us examine the techniques and code used in the current campaign
and correlate it with previous attacks. It sets a cookie and forwards
to the appropriate exploit page based on the version of the browser as
shown in the code snippet below. This same cookie was found being set
in earlier campaigns as well.
[caption id="attachment_1375" align="alignnone"
width="554"] href="/content/dam/legacy/blog/2013/03/Screen-Shot-2013-03-20-at-1.42.58-PM.png"> width="554" height="484"
src="/content/dam/legacy/blog/2013/03/Screen-Shot-2013-03-20-at-1.42.58-PM.png"
alt="Screen Shot 2013-03-20 at 1.42.58 PM"
class="size-full wp-image-1375 landscape-med" /> Figure 7[/caption]
When we examine the Java exploit chain of execution we noticed that
the code is similar and it re-uses the same naming convention, namely
“AppletHigh.jar” and “AppletLow.jar” as shown in the code snippet
below. The classnames and vulnerabilities used are also the same.
[caption id="attachment_1376" align="alignnone"
width="558"] href="/content/dam/legacy/blog/2013/03/Screen-Shot-2013-03-20-at-1.43.16-PM.png"> width="558" height="456"
src="/content/dam/legacy/blog/2013/03/Screen-Shot-2013-03-20-at-1.43.16-PM.png"
alt="Screen Shot 2013-03-20 at 1.43.16 PM"
class="size-full wp-image-1376 landscape-med" /> Figure 8[/caption]
The exploit traffic for three different campaigns is shown in Table
1. It is evident right away that there are similarities in the URI
scheme and the exploit naming convention for Java attacks for the U.S.
university and Chinese news site attacks. They both use AppletHigh.jar
and AppletLow.jar.
As also noted by Jindrich Kubec and Eric Romang on their blog,
today.swf from CFR attack was replaced by logo1229.swf. Similarly,
news.html was replaced by DOITYOUR02.html and robots.txt was replaced
by DOITYOUR01.txt. This establishes the similarity between the U.S.
university attacks and the CFR attack.
href="/content/dam/legacy/blog/2013/03/Screen-Shot-2013-03-20-at-1.43.50-PM.png"> width="555" height="607"
src="/content/dam/legacy/blog/2013/03/Screen-Shot-2013-03-20-at-1.43.50-PM.png"
alt="Screen Shot 2013-03-20 at 1.43.50 PM" class="alignnone size-full wp-image-1377 portrait-med" />
In summary, the previous watering hole campaigns have the following
similarities with the current attack:
- The websites used for watering hole and hosting payloads are
always compromised sites. - It sets a cookie with 1 day
expiration and the name 'Somethingbbbbb'. - It checks the
browser and its version. - If the browser is Internet
Explorer and IE8, it delivers exploit targeting IE8(CVE-2013-1288)
otherwise it triggers a java exploit based on the java version
installed. - It uses similar naming conventions for exploit
files. For example, if the java version is 7 or above
it serves CVE-2013-0422 through AppletHigh.jar and else it
serves CVE-2011-3544 through AppletLow.jar. - The URI
patterns are similar across campaigns. - Similar RAT payloads
were used in previous campaigns.
Our very own Darien Kindlund has done a href="http://www.issa.org/resource/resmgr/journalpdfs/feature0213.pdf">detailed
study on such premeditated watering hole attacks and mitigation
strategies, which is a good read.
We want to acknowledge Microsoft’s href="http://www.microsoft.com/security/msrc/collaboration/mapp.aspx">MAPP
program for sharing intelligence with partners and helping us protect
our customers.
Source:
Internet Explorer 8 Exploit Found in Watering Hole Campaign Targeting
Chinese Dissidents
