Attacks/Breaches
7/26/2012
08:53 AM
Connect Directly
RSS
E-Mail
50%
50%

Mahdi Malware Makers Push Anti-American Update

Spy malware, seemingly built by Iranians, gets update that searches for "USA" and "gov" on targeted machines, security researcher says at Black Hat.

Seculert found numerous clues suggesting that the malware had been built by Iranians. "We were able to identify strings within the communication that were in Farsi. Also, part of the strings were dates that were in the Persian calendar, which is different than the Gregorian calendar," said Raff, noting that most developers prefer to code in their native tongue.

Previously, four C&C servers controlled all Mahdi infections. "The interesting part is that one server is used mostly with Israeli targets, while the other three are for Iranian and Arab targets," said Raff. "The one used for Israel also targets other Middle Eastern countries, but there are no Israeli targets on the other three." All four C&C servers were also hosted by the same provider in Canada, although a whois lookup on the IP addresses claims that they're really based in Azerbaijan, and in one case on the premises of that country's Royal Bank. But according to Seculert, "we confirmed with several ISPs that the physical addresses of the C&C servers are indeed located in the headquarters of the Canadian hosting provider."

According to Seculert, about half of the 800 known systems infected by Mahdi--all via targeted attacks--have been in Iran, while roughly 7% of infections were in Israel. "Looking deeper into the Mahdi victims' IP addresses, we did find a few dozen IP addresses which seem to be from non-Middle-Eastern countries, such as the U.S and U.K.," according to Seculert, although it appeared that the infected machines were owned by people who were only visiting those countries. But those Seculert findings differed from research subsequently published by Symantec, which claimed that 72% of all Mahdi infections involved PCs in Israel.

What accounts for that discrepancy? "Symantec may have come up with 72% because they were only looking at variants which communicated with the C&C servers targeting entities from Israel," according to Seculert's latest analysis. "Or, maybe they are looking only at their customer's machines which they found to be infected with Mahdi. As an American company, Symantec is not allowed to sell their products to Iran, and therefore they can't see infections in Iran." But Raff noted that Seculert's analysis had come from identifying PCs that had connected to the Mahdi botnet itself.

One final piece of evidence that the botnet was built by Iranians involves its naming conventions. "Each bot node [infected PC] receives a unique identifier," Raff said, which is a text string combining reused prefixes with unique text strings, so that any individual machine can be quickly identified and controlled. Some of the words used to construct those prefixes include these names: Chabehar, Iranshahr, Khash, Nikshahr, Saravan, and Zabol. All of those names refer to cities or counties in Iran. Another prefix also used by developers, meanwhile, was "Flame."

Is that, finally, evidence of a connection between Mahdi and Flame? The answer is likely no. According to Seculert, "the first targeted victim with the 'Flame' prefix began communicating with the C&C server in early June, right after the Kaspersky Lab discovery of Flame went public." In other words, the inclusion of the word "Flame" in Mahdi appeared to have been made after Flame became public knowledge.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5316
Published: 2014-09-21
Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page.

CVE-2014-5320
Published: 2014-09-21
The Bump application for Android does not properly handle implicit intents, which allows attackers to obtain sensitive owner-name information via a crafted application.

CVE-2014-5321
Published: 2014-09-21
FileMaker Pro before 13 and Pro Advanced before 13 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2319...

CVE-2014-5322
Published: 2014-09-21
Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 13 and Pro Advanced before 13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-3640.

CVE-2014-6602
Published: 2014-09-21
Microsoft Asha OS on the Microsoft Mobile Nokia Asha 501 phone 14.0.4 allows physically proximate attackers to bypass the lock-screen protection mechanism, and read or modify contact information or dial arbitrary telephone numbers, by tapping the SOS Option and then tapping the Green Call Option.

Best of the Web
Dark Reading Radio