Attacks/Breaches
7/26/2012
08:53 AM
50%
50%

Mahdi Malware Makers Push Anti-American Update

Spy malware, seemingly built by Iranians, gets update that searches for "USA" and "gov" on targeted machines, security researcher says at Black Hat.

Seculert found numerous clues suggesting that the malware had been built by Iranians. "We were able to identify strings within the communication that were in Farsi. Also, part of the strings were dates that were in the Persian calendar, which is different than the Gregorian calendar," said Raff, noting that most developers prefer to code in their native tongue.

Previously, four C&C servers controlled all Mahdi infections. "The interesting part is that one server is used mostly with Israeli targets, while the other three are for Iranian and Arab targets," said Raff. "The one used for Israel also targets other Middle Eastern countries, but there are no Israeli targets on the other three." All four C&C servers were also hosted by the same provider in Canada, although a whois lookup on the IP addresses claims that they're really based in Azerbaijan, and in one case on the premises of that country's Royal Bank. But according to Seculert, "we confirmed with several ISPs that the physical addresses of the C&C servers are indeed located in the headquarters of the Canadian hosting provider."

According to Seculert, about half of the 800 known systems infected by Mahdi--all via targeted attacks--have been in Iran, while roughly 7% of infections were in Israel. "Looking deeper into the Mahdi victims' IP addresses, we did find a few dozen IP addresses which seem to be from non-Middle-Eastern countries, such as the U.S and U.K.," according to Seculert, although it appeared that the infected machines were owned by people who were only visiting those countries. But those Seculert findings differed from research subsequently published by Symantec, which claimed that 72% of all Mahdi infections involved PCs in Israel.

What accounts for that discrepancy? "Symantec may have come up with 72% because they were only looking at variants which communicated with the C&C servers targeting entities from Israel," according to Seculert's latest analysis. "Or, maybe they are looking only at their customer's machines which they found to be infected with Mahdi. As an American company, Symantec is not allowed to sell their products to Iran, and therefore they can't see infections in Iran." But Raff noted that Seculert's analysis had come from identifying PCs that had connected to the Mahdi botnet itself.

One final piece of evidence that the botnet was built by Iranians involves its naming conventions. "Each bot node [infected PC] receives a unique identifier," Raff said, which is a text string combining reused prefixes with unique text strings, so that any individual machine can be quickly identified and controlled. Some of the words used to construct those prefixes include these names: Chabehar, Iranshahr, Khash, Nikshahr, Saravan, and Zabol. All of those names refer to cities or counties in Iran. Another prefix also used by developers, meanwhile, was "Flame."

Is that, finally, evidence of a connection between Mahdi and Flame? The answer is likely no. According to Seculert, "the first targeted victim with the 'Flame' prefix began communicating with the C&C server in early June, right after the Kaspersky Lab discovery of Flame went public." In other words, the inclusion of the word "Flame" in Mahdi appeared to have been made after Flame became public knowledge.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0750
Published: 2015-05-22
The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786.

CVE-2012-1978
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admi...

CVE-2015-0741
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.

CVE-2015-0742
Published: 2015-05-21
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registrati...

CVE-2015-0746
Published: 2015-05-21
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.