Still got Bitcoin? Protect it from malware, experts warn

<div dir="ltr" style="text-align: left;" trbidi="on"> <a href="https://www.blogger.com/blogger.g?blogID=6380879847017191063" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"></a><a href="https://www.blogger.com/blogger.g?blogID=6380879847017191063" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"></a><a href="https://www.blogger.com/blogger.g?blogID=6380879847017191063" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"></a><span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Businesses considering accepting Bitcoins or other forms of cryptocurrency should be prepared to battle a rising number of malware aimed at emptying digital wallets.That’s the takeaway from a new study by SecureWorks, computer maker Dell’s security unit. Researchers found that the number of malware targeted at stealing cryptocurrency from Windows PCs increased along with the rise in value of Bitcoin since the beginning of 2013. </span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">As of January of this year, SecureWorks had identified on the Internet 100 unique families of malware capable of stealing wallet files or digital currency from users’ exchange accounts. The increase in the number of cryptocurrency-stealing malware made it “one of the fastest-growing categories of malware,” the study said.</span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">While Bitcoin is not the only type of cryptocurrency, it is the most popular and the most valuable. The price has ranged from a high of roughly $1150 in early December to a low of $420 on February 25. Bitcoin’s price on Thursday was about $565. Other digital currencies include Namecoin, Litecoin, Dogecoin, PPCoin, and Mastercoin.</span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The recent shutdown of Mt. Gox, which once had the largest market share of all digital currency exchanges, highlights the risk of cryptocurrency traded over the Internet. The Bitcoin exchange closed this month after cybercriminals stole $400 million. The heist is under investigation by U.S. federal authorities.</span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The rising popularity of digital currency has led to its adoption by retailers. Overstock.com became the first major online retailer to accept Bitcoins, and industry observers expect others to follow. The site SpendBitcoins lists many places on the web where people can spend their digital currency.</span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">To protect the digital wallets used in conducting transactions, SecureWorks researchers recommend the use of a “split wallet,” which has a portion of the file on the computer connected to the Internet and the rest on a system with no network connection.</span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The file kept on the Internet-enabled system would let the business track its running balance and perform transactions with customers. On the offline system is the private key for authorizing a transaction before it is transmitted.</span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Electrum is an example of a split wallet done through software. Examples of hardware-based products include Hardware Wallet and Trezor, which plans to release its product soon.</span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">By using the proper security, businesses can significantly reduce the risk of accepting digital currency, Pat Litke, security researcher for Dell SecureWorks’ Counter Threat Unit, said.</span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">“It’s simply a matter of understanding how to do it safely, and that’s where the general population falls short,” Litke said.</span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The SecureWorks study found several categories of PC malware targeting digital currency. One form searched an infected system’s hard drive for the typical file names used for wallets, such as “wallet.dat.” The file was copied and then sent to a remote server.</span><br /> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><br /></span> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Another malware family would set up a man-in-the-middle-like attack in which the address of the recipient in a transaction is altered, so the money goes into the thief’s account.</span><br /> <br /></div>

Bitcoin experts Malware Protect Still Still got Bitcoin? Protect it from malware, experts warn

Businesses considering accepting Bitcoins or other forms of cryptocurrency should be prepared to battle a rising number of malware aimed at...

Read more »

Notorious Malware named "Gameover" gets itself a kernel-mode rootkit

<div dir="ltr" style="text-align: left;" trbidi="on"> <div dir="rtl" style="text-align: right;"> <a href="https://www.blogger.com/blogger.g?blogID=6380879847017191063" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-right: 1em;"></a><a href="https://www.blogger.com/blogger.g?blogID=6380879847017191063" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-right: 1em;"></a><a href="https://www.blogger.com/blogger.g?blogID=6380879847017191063" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-right: 1em;"></a><span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Zeus, also known as Zbot, is a malware family that we have written about many times on Naked Security. </span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Currently, the most widespread Zbot derivative is the Gameover bot, also known as Zeus P2P because of its use of peer-to-peer network connectivity for command and control.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The Gameover gang has been trying new techniques recently: hot on the heels of code to target logged-in users of cloud-based CRM Salesforce.com comes the introduction of a kernel-mode rootkit.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The code for this rootkit comes from another notorious malware family known as Necurs.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Malware in the Zbot family is built to steal information, primarily login credentials, and it is good at its job. </span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Early Zbot versions employed a user-mode rootkit that would hide the Zbot directory and registry entries from user-land tools. </span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">However, by Version 2 of the malware, this rootkit had been dropped as it was largely ineffective. </span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Instead Zbot began to inject its code into system processes and browsers, hooking important software functions in order to snoop on the data passing through the system.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">In the latest Gameover development, the Necurs rootkit has been added to protect the malware files on disk and in memory, making it harder to find and remove once the malware is active.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">This particular strain of Gameover is being delivered through spam messages containing fake invoices.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The attachments don't contain the malware itself; instead, they contain downloader malware known as Upatre.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Downloaders do exactly what their name suggests: they call home and fetch the latest malware version that the crooks want to distribute.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Fake invoice emails are similarly straightforward but effective: they claim to contain some sort of payment advice for a purchase you know you didn't make; the crooks hope you will open the attachment as the first step in contesting the payment.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Here is an example message:</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><img height="203" src="http://sophosnews.files.wordpress.com/2014/02/go-email-5001.png?w=500&h=203" width="500" /></span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">In this case the campaign is targeted at French speakers and purports to be from HSBC France.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The Upatre downloader is attached as an EXE file (a Windows program) inside a ZIP file named Avis.de.Paiement.zip.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">If you launch the file, it downloads an unstructured lump of data - known to programmers as a BLOB, short for "binary large object" - which is actually an obfuscated and compressed copy of the Gameover malware:</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><img height="381" src="http://sophosnews.files.wordpress.com/2014/02/upatre-500.png?w=500&h=381" width="500" /></span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The downloader then unscrambles and launches Gameover.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">When it launches, Gameover installs into your Application Data directory, tagging itself with a short block of system-specific binary data.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">This "tagging" serves two purposes: the installed copy is tied to your computer, so it won't run anywhere else if it is taken away for analysis; and your copy of the malware is unique, so that simple checksum-based file matching can't be used to detect it.</span></div> <div dir="rtl" style="text-align: right;"> Normally, Gameover then injects itself into other processes and exits. </div> This is where the new variant drops and installs the Necurs rootkit, which is implemented as a kernel driver.<br /> Two drivers - a 32-bit and a 64-bit version - are decrypted using different RC4 keys:<br /> <img height="431" src="http://sophosnews.files.wordpress.com/2014/02/rc4-500.png?w=500&h=431" width="500" /><br /> Then, further shellcode is decrypted and executed to setup and load the appropriate driver.<br /> We can see that the code first checks to see if the Necurs device object NtSecureSys already exists:<br /> <img height="322" src="http://sophosnews.files.wordpress.com/2014/02/kernobj-500.png?w=500&h=322" width="500" /><br /> If it does not, the appropriate driver will be loaded.<br /> If the system is 32-bit and you do not have administrator rights, the malware tries to exploit an aging vulnerability known as CVE-2010-4398 to elevate its privilege so it can load the driver.<br /> The exploit relies on a specially-crafted registry entry and, somewhat curiously, the use of a system function associated with End-User Defined Characters (EUDCs), as seen here:<br /> <img height="420" src="http://sophosnews.files.wordpress.com/2014/02/eudc-500.png?w=500&h=420" width="500" /><br /> If you are patched against this vulnerability, then the loading of the rootkit will trigger a User Account Control (UAC) prompt - an immediately-suspicious side effect, considering that the file you just opened was supposed to be an invoice.<br /> If you are running XP, which doesn't have UAC, and you aren't an administrator, the rootkit can't prompt for permission to load, ironically making you very slightly safer.<br /> The 64-bit driver is digitally signed, but with an unsigned and obviously bogus certificate:<br /> <img height="124" src="http://sophosnews.files.wordpress.com/2014/02/digsig-500.png?w=500&h=124" width="500" /><br /> 64-bit versions of Windows usually insist that drivers are signed with verified certificates, so the malware tries to reconfigure your system so that it will accept unverified drivers.<br /> The malware uses the BCEDIT Boot Configuration Editor utility to set the TESTSIGNING boot option, allowing the malicious driver to be loaded:<br /> <img height="124" src="http://sophosnews.files.wordpress.com/2014/02/bcdedit-500.png?w=500&h=124" width="500" /><br /> Once active, the rootkit protects the Gameover malware so that you can't delete it:<br /> <img height="46" src="http://sophosnews.files.wordpress.com/2014/02/rk-del-500.png?w=500&h=46" width="500" /><br /> It also stops you killing off the Gameover process: <br /> <img height="278" src="http://sophosnews.files.wordpress.com/2014/02/rk-proc-500.png?w=500&h=278" width="500" /><br /> The rookit greatly increases the difficulty of removing the malware from an infected computer, so you are likely to stay infected for longer, and lose more data to the controllers of the Gameover botnet.<br /> What does this apparent collaboration between the Gameover and Necurs gangs mean?<br /> We don't know for sure - perhaps the the two groups are joining forces, or perhaps the Necurs source code has been acquired by the Gameover gang.<br /> Whatever the reason, the addition of the Necurs rootkit to an already-dangerous piece of malware is an unwelcome development. <br /> Gameover is just one of many bots and botnets that are currently at large on the internet.<br /> If you'd like to know more about the what, how and why of these threats, you might like to listen to our Techknow podcast on the subject: <br /> This post was made using the <a href="http://www.webmagnates.org/auto-blogging-software.html" title="auto-blogging software">Auto Blogging Software</a> from <a href="http://www.webmagnates.org/" make="" money="" online="" title="">WebMagnates.org</a> This line will not appear when posts are made after activating the software to full version.</div>

Gameover itself kernelmode Malware named news Notorious rootkit Notorious Malware named "Gameover" gets itself a kernel-mode rootkit

Zeus, also known as Zbot, is a malware family that we have written about many times on Naked Security. Currently, the most widespread Zb...

Read more »