Operation Tovar: The Latest Attempt to Eliminate Key BotnetsCoordinated botnet disruptions have increased in pace and popularity
over the last few years as more private companies work with
international law enforcement agencies to combat malware infections on
a grand scale. href="http://www.justice.gov/opa/gameover-zeus.html">Operation
Tovar, announced on June 2 2014, is the latest to make headlines.
The target of the investigation, href="http://www.justice.gov/opa/documents/dgzc/complaint.pdf">Evgeniy
Mikhailovich Bogachev, was indicted by the Department of Justice
and is wanted by the FBI for his role as alleged leader of the href="http://www.secureworks.com/cyber-threat-intelligence/threats/The_Lifecycle_of_Peer_to_Peer_Gameover_ZeuS/">Gameover
ZeuS and href="http://www.us-cert.gov/ncas/alerts/TA13-309A">CryptoLocker
botnets. Four other defendants were indicted using their pseudonyms.
Though Bogachev’s current activities aren’t known, the Operation Tovar
task force has maintained control of the botnet infrastructure and
remediation efforts are ongoing.
While new malware strains are released with increasing frequency,
it’s easy to forget why Gameover and CryptoLocker are worthwhile
targets for takedown operations. Both offered more advanced features
than their peers and typified the increasingly sophisticated
cybercriminal enterprises behind botnets.
Gameover ZeuS
Since the ZeuS source code was released in 2011, several new variants
have appeared in the wild. Citadel, KINS, ICE IX, and Gameover have
all improved upon the basic ZeuS model by introducing new features,
using better encryption, and modifying command and control (C2)
communication methods.
Gameover uses a peer-to-peer (P2P) system for C2 communication.
Though other P2P botnets such as Kelihos exist, Gameover is notable
for its use of proxy nodes to introduce complexity into the standard
P2P infrastructure. These proxy nodes are specific machines designated
as relay points through which the botnet operators send commands and
receive stolen information. This minimizes the number of systems that
actually communicate with C2 servers. C2 commands are signed using
RSA-2048 and encrypted with RC4 making it very difficult to tamper
with the botnet.
Additionally, Gameover maintains a failsafe mechanism: a domain
generation algorithm (DGA) that produces 1,000 domains each week. This
feature enables the operators to maintain control of their botnet even
if the P2P infrastructure is compromised. The DGA produces long,
nonsensical strings at one of six top-level domains: .com, .net, .org,
.biz, .info, and .ru that can be registered and used to send commands
to the botnet.
ZeuS and all its variants are information-stealing trojans. We refer
to them as banking trojans because that’s where they excel and
Gameover is no exception. Gameover is able to trick the user into
handing over personal information and can even defeat two-factor
authentication. It accomplishes this by injecting custom code into the
browser when a victim visits certain websites. Gameover’s arsenal of
bank account takeover tools includes href="http://youtu.be/tJM8V3lfMj8">1,500 web injections that
were custom-made to target the websites of more than 700 financial
institutions worldwide.
In addition to its exceptional abilities as a banking trojan,
Gameover is capable of a wider variety of data theft activities. An
Operation Tovar task force member, speaking to href="http://krebsonsecurity.com/2014/06/backstage-with-the-gameover-botnet-hijackers/">Brian
Krebs on the condition of anonymity, said they have evidence of
additional harvested data and that Gameover targeted proprietary information.
CryptoLocker
Not content with merely engaging in widespread banking credential and
information theft, the Gameover criminal operators decided to maximize
returns by infecting systems with href="http://www.slate.com/articles/technology/technology/2014/06/evgeniy_bogachev_gameover_zeus_cryptolocker_how_the_fbi_shut_down_two_viruses.html">CryptoLocker.
It is a type of ransomware that encrypts the files on infected
machines and then demands a ransom of hundreds of dollars in order to
receive a decryption key. Typically, victims were given 72 hours to
pay the ransom in bitcoins or risk losing their data.
Unwilling to miss out on any opportunity to generate revenue, the
criminal operators set up a website to assist victims in paying the
ransom in bitcoins. Through this website, victims could complete the
transaction and track the status of their “order” – the ransom payment
in exchange for the decryption key. Some victims, unwilling or unable
to pay the ransom, missed the 72-hour deadline only to see the ransom
demand increase fivefold.
Law enforcement officials discouraged people from paying the ransom
since it would fund a criminal organization, but without back ups many
victims had little choice but to pay. A US href="http://www.heraldnews.com/x2132756948/Swansea-police-pay-750-ransom-after-computer-virus-strikes">police
department paid $750 for two Bitcoins as ransom after CryptoLocker
was installed on a system used for police reports and booking photos.
CryptoLocker encrypts files using asymmetric encryption, making use of
a public and a private key. Without the private key, located on the
criminals’ servers, infected files probably cannot be decrypted.
The Target
Operation Tovar’s investigation began with a server in the UK. A
trail of wire transfers, money mules, criminal servers, and at least
one confidential source led investigators to Bogachev. He is a Russian
citizen wanted on charges of conspiracy to participate in racketeering
activity, bank fraud, conspiracy to violate the Computer Fraud and
Abuse Act, conspiracy to violate the Identity Theft and Assumption
Deterrence Act, aggravated identity theft, conspiracy, computer fraud,
wire fraud, and money laundering. The FBI estimates the financial toll
of Gameover at over $100 million and another estimate is that more
than $27 million in ransom payments were made in the first two months
of CryptoLocker’s distribution.
Obtaining an indictment against a Russian national who will likely
never be extradited to the United States isn’t sufficient to put an
end to a criminal organization. In 2011, Russian citizen href="http://www.fbi.gov/atlanta/press-releases/2014/cyber-criminal-pleads-guilty-to-developing-and-distributing-notorious-spyeye-malware">Aleksandr
Andreevich Panin was indicted in the US on 23 counts related to
the development and distribution of SpyEye but was not arrested until
2013 when he flew through Hartsfield-Jackson Atlanta International
Airport. The Russian government, in a href="http://www.mid.ru/brp_4.nsf/newsline/AEE7072D0D06CE4144257BDA00444438">travel
warning to its citizens, specifically mentions Panin and
recommends that Russians facing legal action in the US should refrain
from travelling internationally.
The Takeover
Drawing on the technical expertise of its members, the Operation
Tovar task force was able to exploit flaws in the design of Gameover’s
P2P network to manipulate the peer list and redirect traffic to nodes
under its control. The specific technical details have not been
released to the public in order to prevent the criminals from
regaining control.
Gameover’s failsafe mechanism, the DGA that was supposed to have
allowed the criminals to maintain control in the event of a P2P
disruption, was reverse engineered by task force members. The FBI then
obtained a href="http://www.fbi.gov/news/stories/2014/june/gameover-zeus-botnet-disrupted/documents/temporary-restraining-order-and-order-to-show-cause">restraining
order to redirect any attempts to register those domains to a
government-run server. Furthermore, US service providers are required
to block connections to the Russian .ru domains generated by the DGA
since the US has no jurisdiction to prevent their registration.
CryptoLocker also used a href="http://blog.fortinet.com/A-Closer-Look-at-Cryptolocker-s-DGA/">DGA
for determining C2 locations. The algorithm was reverse engineered and
the C2 servers were identified and seized by the Operation Tovar task
force. Due to the use of an asymmetric key algorithm, CryptoLocker
victims whose files remain encrypted currently have no avenue of remediation.
Operation Tovar’s success can be measured by two factors: (1) Have
the criminals regained control of their botnets and (2) Is the malware
being removed from infected machines? While we can’t say for certain
that the people responsible for Gameover and CryptoLocker have ceased
all criminal activity, they have not regained control of the network
disrupted by Operation Tovar. Based on this fact alone, the task force
should be commended. Successful botnet disruptions are very
challenging. Attempted takeovers over Kelihos have been undone after
only two weeks.
The remediation of infected machines is an even more difficult task.
US-CERT
has published a list of recommended actions and resources, and a
number of the private companies involved in Operation Tovar have
released scanning tools. The onus remains on individuals and
organizations to use these resources to determine if they are infected
and take the appropriate steps to remediate the problem. Statistics
published by The
Shadowserver Foundation show the number of machines infected
with Gameover has remained essentially flat since the takeover. There
are simply not enough people taking advantage of the resources
available to remediate their systems.
class="aligncenter size-full wp-image-5919 landscape-lg"
alt="tovar1"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/07/tovar1.png"
width="900" height="264" />
The task force has taken control of the C2 network and now some
people may believe that the malware is neutered and no further action
is required. It is important to remember that any malware is
unauthorized code running on a computer. The integrity of the system
is still compromised, regardless of who is in control of the botnet.
Source:
Operation Tovar: The Latest Attempt to Eliminate Key Botnets
