Attacks/Breaches
7/26/2012
08:53 AM
Connect Directly
RSS
E-Mail
50%
50%

Mahdi Malware Makers Push Anti-American Update

Spy malware, seemingly built by Iranians, gets update that searches for "USA" and "gov" on targeted machines, security researcher says at Black Hat.

Seculert found numerous clues suggesting that the malware had been built by Iranians. "We were able to identify strings within the communication that were in Farsi. Also, part of the strings were dates that were in the Persian calendar, which is different than the Gregorian calendar," said Raff, noting that most developers prefer to code in their native tongue.

Previously, four C&C servers controlled all Mahdi infections. "The interesting part is that one server is used mostly with Israeli targets, while the other three are for Iranian and Arab targets," said Raff. "The one used for Israel also targets other Middle Eastern countries, but there are no Israeli targets on the other three." All four C&C servers were also hosted by the same provider in Canada, although a whois lookup on the IP addresses claims that they're really based in Azerbaijan, and in one case on the premises of that country's Royal Bank. But according to Seculert, "we confirmed with several ISPs that the physical addresses of the C&C servers are indeed located in the headquarters of the Canadian hosting provider."

According to Seculert, about half of the 800 known systems infected by Mahdi--all via targeted attacks--have been in Iran, while roughly 7% of infections were in Israel. "Looking deeper into the Mahdi victims' IP addresses, we did find a few dozen IP addresses which seem to be from non-Middle-Eastern countries, such as the U.S and U.K.," according to Seculert, although it appeared that the infected machines were owned by people who were only visiting those countries. But those Seculert findings differed from research subsequently published by Symantec, which claimed that 72% of all Mahdi infections involved PCs in Israel.

What accounts for that discrepancy? "Symantec may have come up with 72% because they were only looking at variants which communicated with the C&C servers targeting entities from Israel," according to Seculert's latest analysis. "Or, maybe they are looking only at their customer's machines which they found to be infected with Mahdi. As an American company, Symantec is not allowed to sell their products to Iran, and therefore they can't see infections in Iran." But Raff noted that Seculert's analysis had come from identifying PCs that had connected to the Mahdi botnet itself.

One final piece of evidence that the botnet was built by Iranians involves its naming conventions. "Each bot node [infected PC] receives a unique identifier," Raff said, which is a text string combining reused prefixes with unique text strings, so that any individual machine can be quickly identified and controlled. Some of the words used to construct those prefixes include these names: Chabehar, Iranshahr, Khash, Nikshahr, Saravan, and Zabol. All of those names refer to cities or counties in Iran. Another prefix also used by developers, meanwhile, was "Flame."

Is that, finally, evidence of a connection between Mahdi and Flame? The answer is likely no. According to Seculert, "the first targeted victim with the 'Flame' prefix began communicating with the C&C server in early June, right after the Kaspersky Lab discovery of Flame went public." In other words, the inclusion of the word "Flame" in Mahdi appeared to have been made after Flame became public knowledge.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-5142
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.

CVE-2010-5302
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.

CVE-2010-5303
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15 (r85), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to $errorString.

CVE-2014-3562
Published: 2014-08-21
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.

CVE-2014-3577
Published: 2014-08-21
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.