Attacks/Breaches
12/18/2012
09:49 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Data-Destruction Attack Targeted 'Few' Select Iranian Computers

'Simplistic' data-destroying malware found on small number of targeted computers in Iran

It's no Stuxnet or Wiper, but the latest data-destroying malware targeting specific computers in Iran still wreaks some serious damage.

Iran's CERT on Sunday first issued an alert about the relatively rudimentary malware, which was discovered to delete data off of various drives at specific times and dates. The malware is a "very simple" knockoff of other wiping malware with no relation to those previously discovered malware attacks, and "very few machines" were infected by it, according to the CERT.

Researchers from Symantec, Kaspersky Lab, AlienVault Labs, and SophosLabs all have studied a sample of the malware, a.k.a. Batchwiper or GrooveMonitor. They concur that it's a simplistic yet lethal piece of malware that doesn't appear to be related to the nation-state built Stuxnet and Wiper that hit Iran's nuclear facility, or the destructive Shamoon that wiped 30,000 workstations of their data at Saudi Aramco, and deleted files at the Iranian oil ministry.

It's the latest in a series of data-destroying malware attacks targeting specific organizations in the Middle East. This return to 1980s and early-'90s malware that damages or deletes data puzzles researchers. "It's not the kind of thing you'd expect a nation-state [to create]," says Chester Wisniewski, a senior security adviser for Sophos.

He says it's odd that Iran sounded the alarm about such an unsophisticated attack. "This [malware] is something anybody could have done," he says.

Batchwiper/GrooveMonitor uses a DOS BAT file that was converted to a Windows Portable executable file. It wipes data off of drivers lettered D through I, as well as files on the user's desktop, and is set to do its dirty deed during specific dates, including between Dec. 10 and 12, and Jan. 21 and 23, as well as various dates that run through 2015.

"That's not something we see almost ever," Wisniewski says. "It's one of the few things that suggests that it's a targeted attack. It's very weird: Why would you care if it's Dec. 12? What those dates mean is a mystery."

The author of the malware even made an obvious typo in the code that prevents one feature from functioning. SophosLabs found a second variant of the malware, but it's still the same basic code.

Kaspersky Lab also saw an error in the code. "Other than the geographic region there doesn't seem to be any commonality with this file-deleting malware and the previous attacks we've seen. Even though the code is extremely simplistic it looks like the author managed to slip in a mistake, by not deleting a line of old code," says Roel Schouwenberg, senior researcher for global research and analysis at Kaspersky Lab, in a blog post.

Just how it spread is unclear. Jaime Blasco, labs manager at AlienVault Labs, thinks it may be via USB. "We don’t have details about the infection vector but based on the dropper it could be deployed using USB drives, internal actors, SpearPhishing or probably as the second stage of a targeted intrusion," Blasco says in a blog post.

The Iranian CERT initially reported that the malware was efficient yet simple, and was wiping out disk partitions and user profile directories without being detected by antivirus software.

"This is as basic as it gets. But if it was effective, that doesn't matter. If it wasn't clear already -- the era of cybersabotage has arrived. Be prepared," Schouwenberg says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?