In “Shadows in the Cloud: An investigation into cyber espionage 2.0” my co-authors and I analyzed the command and control infrastructure of a network that extracted secret, confidential and restricted documents from the Indian government and military. The Shadow Network used a complex and tiered command and control infrastructure that leveraged Twitter, Google Groups, Blogspot, Baidu Blogs, blog.com and Yahoo! Mail in order to maintain persistent control over the compromised computers. As we noted in the report, the use of these services as elements of command and control is certainly not new:
The use of social networking sites as elements of command and control for malware networks is not novel. The attackers leverage the normal operation of these systems in order to maintain control over compromised system. In 2009, researchers found that Twitter, Jaiku, Tumblr, Google Groups, Google AppEngine and Facebook had all been used as the command and control structure for malware. In August 2009, Arbor Networks’ Jose Nazario found that Twitter was being used as a command and control component for a malware network. In this case, the malware was an information stealer focused on extracting banking credentials from compromised computers located mostly in Brazil. Twitter was not the only channel being used by the attackers. They also used accounts on Jaiku and Tumblr (Nazario 2009a). Furthermore, Arbor Networks found another instance of malware that used the Google AppEngine to deliver malicious URLs to compromised computers (Nazario 2009b). The Unmask Parasites blog found that obfuscated scripts embedded in compromised web sites used the Twitter API to obscure their activities. While the method was clever, the code was unreliable and appeared to have been abandoned by the attackers (Unmask Parasites 2009). Symantec found that Google Groups were being used as command and control for another instance of malware. In this case, a private Google group was used by the attackers to send commands to compromised computers which then uploaded their responses to the same Group (Symantec 2009a) Symantec also found an instance of malware that used Facebook status messages as a mechanism of command and control. (Symantec 2009b). The use of these social networking and Web 2.0 tools allows the attackers to leverage the normal operation of these tools to obscure the command and control functions of malware.
Earlier this year, Sunbelt found a Twitter botnet creator and Trend Micro reports that the “Here You Have” worm used GMail accounts. As we found with the Shadow Network malware authors learn from each other. And in the case of the Shadow Network they didn’t just use one service they used six of them, including Yahoo! Mail. And while indiscriminate malware may be rather noisy, the malware used in targeted attacks tends to be (but is certainly not always) more discrete.
A recent sample posted at contagiodump.blogspot.com caught my attention for this very reason. The sample, “Conference Information_2010 IFANS Conference on Global Affairs (1001).pdf” (which was sent from 221.9.247.17 and was detected by 14 /43 (32.6%) AV products at Virustotal) arrived with the subject line “Nuclear Challenges and Responses in the Century” and exploited a vulnerability in Adobe Reader/Acrobat (CVE-2010-2883) to drop malware on the targets’ computers. For those of you who follow Mila’s awesome blog, this scenario is hardly surprising.
But a few things caught my attention. There were references in the strings dumped from a file the malware created (syschk.ocx) that referenced GMail (mail.google.com) and DriveHQ (drivehq.com), which describes itself as a “cloud based storage, backup, group sharing and collaboration service.” When you look at the traffic generated by the malware you’ll see connections to these locations.
There is nothing about these locations that is very suspicious — everyone checks their GMail right? Moreover, the connection to GMail is SSL encrypted.
Image may be NSFW.
Clik here to view.
Using Burp (which made the process very simple) I MITM’d the traffic between the malware and GMail. The malware logs in to the GMail account and sends an email to another GMail address. The content of this email is encrypted. However, I believe that what it is sending — although this is just a hunch — is the content of another file the malware generates: form.ocx. This file contains what appears to be a unique ID assigned by the malware, the hostname and IP address, the default home page of the default browser and a listing of installed programs on the computer. The end of the file contains information about executables the malware has impacted. In addition to the encrypted message sent through the GMail account, the Unique ID in form.ocx appears at the beginning of the message.
IEXPLORE.EXE done
CHROME.EXE done
FIREFOX.EXE doneC:\WINDOWS\system32\form.ocx
Infect OK!
I have not looked into what exactly the malware does to these applications, but it basically disables the operation of FireFox and Chrome and instead connect to the Gmail account when you try to start these applications. Internet Explorer seems to function normally.
The connection to fuechei.chang.drivehq.com results in the download of an additional file rename.ocx which appears to be very similar, when its strings are compared with, syschk.ocx. It then renames syschk.ocx to syschk.ocx1. You can see that this correlates with text in the strings dumped from syschk.ocx.
%s\rename.ocx
http://%s/rename
%s\syschk.ocx1
After the initial connections to GMail and DriveHQ the malware went quiet. I never did get it to connect again.
As network defenses continue to include traffic analysis, I believe that we will continue to see a move toward using popular services, especially web mail as command and control elements. Unlike connections to well-known dynamic DNS services like 3322.org or abnormal connections to geographic regions, connections to GMail and other popular services do not necessarily stand out. Moreover, the connections to the services, such as GMail are encrypted, further obfuscating the malicious activity that is occurring.