Auteur Sujet: [MMPC]Piecing the malware puzzle ? Exploring a spike in exploit activity (Lu 4715 fois)

igor51 · « **le:** juin 29, 2012, 08:00:42 »

Piecing the malware puzzle ? Exploring a spike in exploit activity

In this post, we explore a telemetry spike in <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader:Java/OpenConnection">Java/OpenConnection</a> and <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3544">CVE-2011-3544</a> exploit activity.
While reviewing user feedback from the <a href="http://www.microsoft.com/security/portal/">Microsoft Malware Protection Center</a> recently, we noticed an unprecedented amount of feedback on one particular <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader:Java/OpenConnection">Java/OpenConnection</a> variant -- <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader:Java/OpenConnection.PK">TrojanDownloader:Java/OpenConnection.PK</a>. Such interest in this type of Java applet-based exploit is quite unusual, and prompted us to investigate further.
A signature for this threat was introduced on February 22, 2012, and spiked to 7.5k reports on the first day. In the following days, the daily report volume fluctuated between 7.8k and 5k reports a day (this kind of spike is not entirely expected for this kind of threat, and such a peak is not very common), until on 28th February the volume started to subside and broke through 5k support, plateauing around 2.5k reports a day, as shown in the figure below:
<a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/6862.BID83_2D00_01.5.png"><img border="0" alt="" src="http://blogs.technet.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/6862.BID83_2D00_01.5.png" width="396" height="406" /></a><a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/6204.030612_5F00_0902_5F00_Piecingthem1.png"></a>
Figure 1 – daily report volume of Java/OpenConnection.PK
Looking at prevalent reported samples of <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader:Java/OpenConnection.PK">TrojanDownloader:Java/OpenConnection.PK</a>, we see that there's no clear leader in the volume per sample distribution. A long tail spike in the distribution may point out a file of interest; however in this case, the top range numbers were quite flat and didn't appear in any way skewed, as shown in the graph below:
<a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/0020.030612_5F00_0903_5F00_Piecingthem1.png"><img style="border: 0px;" alt="Top 10 samples" src="http://blogs.technet.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/0020.030612_5F00_0903_5F00_Piecingthem1.png" width="400" /></a><a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/6204.030612_5F00_0902_5F00_Piecingthem1.png"></a>
Figure 2 – top 10 Java/OpenConnection.PK samples
 Closer examination confirmed all of the top reported files to be malware, detected legitimately.
The detected TrojanDownloader:Java/OpenConnection.PK class file contains mangled strings and variables which suggests that its code was generated by a machine or an obfuscation tool. In other words, it could be a product of one of the Java exploit toolkits, an obfuscation tool, or both.
Some of most prevalent toolkits around today are <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Blacole">Blackhole</a> and <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Phoenix_Exploit_Kit">Phoenix</a>. This particular threat, however, does not seem to be associated with either Blackhole or Phoenix, indicating that possibly another (less-utilized) expolit kit was used. A reminder that there are exploit kits out there that, while not as popular, are still causing users a considerable amount of pain.
What we know is that currently, most of the popular web malware exploit kits attack vulnerabilities described in <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Java/CVE-2010-0094http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0094">CVE-2010-0094</a>, <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Exploit:Java/CVE-2010-0840">CVE-2010-0840</a> and <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Exploit:Java/CVE-2011-3544">CVE-2011-3544</a> Java Runtime Environment vulnerabilities (among other techniques), which fall under our <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader:Java/OpenConnection.PK">Java/OpenConnection</a> family detections.
When new updates to exploit kits are released, it's not uncommon to see a spike in the exploits used for malicious purposes. This is just one of the many things we watch for while monitoring our detections.
These particular Java exploits are patched, but in the event a Java-user doesn't update a vulnerable version, or remove older versions of Java, they can be exploited by these attacks. As such, we recommend you <a href="http://www.java.com/en/download/manual.jsp">update your version of Java</a>, and <a href="http://www.java.com/en/download/faq/remove_olderversions.xml">remove older versions</a> to thwart such attacks.
 
--Oleg Petrovsky & Jasmine Sesso<div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3487758" width="1" height="1">
Source: Piecing the malware puzzle ? Exploring a spike in exploit activity

Auteur Sujet: [MMPC]Piecing the malware puzzle ? Exploring a spike in exploit activity (Lu 4715 fois)

igor51

[MMPC]Piecing the malware puzzle ? Exploring a spike in exploit activity