Attacks/Breaches
8/9/2012
11:18 AM
50%
50%

Flame 2.0: Gauss Malware Targets Banking Credentials

Stuxnet, Duqu, and Flame cousin has been used in targeted attacks, operating undetected for at least a year, primarily in Middle Eastern countries.

Malware watchers, meet Flame and Stuxnet's cousin, known as Gauss, which is espionage software apparently commissioned by a nation state and first used as early as August 2011.

Here's what's known about Gauss: The surveillance malware has been designed to collect banking details, is apparently used only in highly targeted attacks, and has infected an inordinate number of PCs in Lebanon. Still, its exact purpose--including the potential motive that a nation state would have in stealing people's banking credentials--so far remains a mystery.

"In 140 chars or less, Gauss is a nation state sponsored banking Trojan which carries a warhead of unknown designation," according to an analysis of Gauss published by the global research and analysis team at Kaspersky Lab. "Besides stealing various kinds of data from infected Windows machines, it also includes an unknown, encrypted payload which is activated on certain specific system configurations."

[ Keep your identity safe. See 8 Ways To Avoid Getting Your Life Hacked. ]

There are clear links between the modules used by Gauss and Flame, which is related to Stuxnet, which in turn is related to Duqu. In other words, all four pieces of malware appear to have been commissioned--if not developed--by the same entity. "Just like Duqu was based on the 'Tilded' platform on which Stuxnet was developed, Gauss is based on the 'Flame' platform," according to Kaspersky Lab. "It shares some functionalities with Flame, such as the USB infection subroutines."

As with Flame, whoever controls Gauss can push various plug-ins to infected PCs. These plug-ins can do everything from relaying system configuration data and intercepted browser cookies and passwords to attackers, to stealing credentials used for Middle Eastern banks as well as social network login credentials. "The modules have internal names which appear to pay tribute to famous mathematicians and philosophers, such as Kurt Godel, Johann Carl Friedrich Gauss, and Joseph-Louis Lagrange," according to Kaspersky Lab. "The module named 'Gauss' is the most important in the malware as it implements the data stealing capabilities and we have therefore named the malware toolkit by this most important component."

Kaspersky Lab said it discovered Gauss while continuing to participate in an effort commissioned by the International Telecommunications Union (ITU), which Kaspersky said is behind a program "aimed at mitigating the risks posed by cyber-weapons, which is a key component in achieving the overall objective of global cyber-peace."

Interestingly, an ITU request to Kaspersky, earlier this year, to evaluate unknown malware that was found to be deleting sensitive information led to the discovery of Flame. Since then, Kaspersky has been analyzing other malware to see if it resembled Flame, and found "glaring similarities" in Gauss.

One feature of Stuxnet, Flame, and Gauss is that they've tended to operate undetected for significant periods of time. Flame, for example, was used in highly targeted attacks since at least 2010, and perhaps as far back as 2007, before being discovered in June 2012. "Flame is a prime example of why governments and industry must work together to tackle cybersecurity at the global level," said ITU secretary-general Hamadoun Toure in a statement, issued after Flame was discovered. "Early warning of new threats is vital."

In the case of Gauss, the first known variant appeared in August 2011, which is interesting, since that's the month when Hungary's CrySyS Lab announced that it had discovered Duqu. Meanwhile, the most recent version of Gauss debuted in January 2012. Kaspersky said it's logged only 2,500 Gauss infections since May 2012, though it estimates that the total number of infections will number in the tens of thousands. Finally, it said that the five command-and-control servers giving Gauss-infected PCs instructions and retrieving targeted data went dark in July 2012, though they could be restarted at any time.

Thanks to the developers forgetting to remove debugging information, Kaspersky noted some file designations with the name "white," which it said appears to refer to Lebanon, the name of which comes from the Semitic root word that means "white." On a related note, it's seen the vast majority of Gauss infections in Lebanon, followed by Israel and Palestine. Meanwhile, a handful of infections have been traced to PCs in the United States, United Arab Emirates, Qatar, Jordan, Germany, and Egypt.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] Assessing Cybersecurity Risk
[Strategic Security Report] Assessing Cybersecurity Risk
As cyber attackers become more sophisticated and enterprise defenses become more complex, many enterprises are faced with a complicated question: what is the risk of an IT security breach? This report delivers insight on how today's enterprises evaluate the risks they face. This report also offers a look at security professionals' concerns about a wide variety of threats, including cloud security, mobile security, and the Internet of Things.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.