Attacks/Breaches
2/19/2014
04:46 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft Windows Crash Reports Reveal New APT, POS Attacks

Researchers discover zero-day attacks after studying the contents of various "Dr. Watson" error reports

You never know what you'll glean from a Windows crash report: security researchers recently unearthed a previously unknown advanced persistent threat campaign as well as a new point-of-sale system attack by perusing and analyzing those crash reports also known as Dr. Watson.

RSA Conference 2014
Click here for more articles about the RSA Conference.

Researchers at Websense -- who recently exposed weaknesses in Microsoft's Windows crash reports that could be abused by attackers or spies -- today released free source code online for enterprises to employ the crash reports for catching potential security breaches in their organizations. The researchers next week at the RSA Conference in San Francisco will release indicators of compromise for the two attack campaigns that can be incorporated into intrusion prevention systems.

Alex Watson, director of security research for Websense, says his team spotted a targeted attack waged against a mobile network provider and a government agency, both outside the U.S., as well as a Zeus-based attack aimed at the point-of-sale system of wholesale retailers. In both cases, the attacks have been suspended and the command-and-control infrastructures disrupted.

"We wanted to prove that we can detect zero-day or unknown [attacks] by a little information in crash reports," Watson says. So he and his team created crash "fingerprints" to filter and search for real-world attack intelligence in Dr. Watson reports.

Watson says the team scoured some 16 million Microsoft Windows Error Report logs over a four-month period, searching for a crash fingerprint that mimics the behavior of the Internet Explorer zero-day exploit used in attacks last year against Taiwanese high-tech equipment makers and Japanese financial institutions, the CVE-2013-3893 memory corruption vulnerability patched by Microsoft in October of last year.

Websense found five crash reports from four different organizations that appeared to indicate exploit attempts – one of which was the mobile network provider, which it would not name. Websense also spotted traffic going to a remote access Trojan typically associated with targeted attacks called Houdini H-Worm. The government agency target was spotted with a machine communicating to the RAT command-and-control during the same period, according to Websense.

The researchers then found crash reports akin to the POS malware used against Target and other retailers, mostly from a large clothing retailer in the Eastern U.S. "This was massively different from a normal Zeus infection. It appears to be a very targeted Zeus just going after the wholesale industry," Watson says. The Windows crashes appear to indicate code injection attempts, he says, and there's no evidence thus far that the attacks are related to Target or Neiman Marcus.

"As far as we can tell, no information was stolen. The command and control was blocked on outbound," he says. "This Zeus-based malware was able to steal credit cards using RAM-scraping."

Good News, Bad News

The bad news is that Microsoft's automated Windows error report feature mostly transmits crash log data unencrypted and in the clear, leaving organizations that use the function vulnerable to targeted attacks, according to Websense Security Labs. The team studied risks posed by some popular applications and services that use Microsoft Windows Error Reporting, which automatically sends to the software giant details of a system crash. The sensitive information in these reports, which includes the make and model of the machine, BIOS version, ID, and applications, can help bad guys and even the National Security Agency profile potential targeted machines and networks.

Wolfgang Kandek, CTO at Qualys, says it's not so simple for bad guys to glean intel from Windows crash reports, however. "I'm not quite sure bad guys can easily get to that information. That would mean intercepting the communication of your machine to Microsoft. Maybe they would be monitoring your router or your firewall," he says. "I'm not sure it was be that easy unless they are already in your network ... and you would have bigger problems" then, he says.

But the good news is that the reports can also be used for good, as Websense found with its fingerprinting method that exposed the previously unknown targeted attack and POS campaign.

[The NSA is reportedly using crash dumps to collect feedback on its attempts to exploit flaws in targeted companies and networks, but crash dumps still remain a successful defensive technology. See How Windows 'Crash Dumps' Aid Defenders.]

The reports absolutely can provide good information to enterprises, as well as to Microsoft, Kandek says. "A certain number of crashes may be normal across your organization ... but if it spikes up, it's worth investigating," Kandek says.

The full Websense report is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
shjacks55
50%
50%
shjacks55,
User Rank: Apprentice
3/7/2014 | 9:42:21 AM
re: Microsoft Windows Crash Reports Reveal New APT, POS Attacks
Win7/8 not XP.
kjhiggins
50%
50%
kjhiggins,
User Rank: Strategist
2/20/2014 | 4:56:46 PM
re: Microsoft Windows Crash Reports Reveal New APT, POS Attacks
Good point, dritchie. I'll add that to the piece. In the meantime, here's the link:

https://github.com/zredlined/d...
dritchie
50%
50%
dritchie,
User Rank: Apprentice
2/20/2014 | 3:26:20 PM
re: Microsoft Windows Crash Reports Reveal New APT, POS Attacks
Why is there no link to the "today released free source code online"?
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2227
Published: 2014-07-25
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.

CVE-2014-5027
Published: 2014-07-25
Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.

CVE-2014-5100
Published: 2014-07-25
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_...

CVE-2014-5101
Published: 2014-07-25
Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) TPL_name, (2) TPL_nick, (3) TPL_email, (4) TPL_year, (5) TPL_address, (6) TPL_city, (7) TPL_prov, (8) TPL_zip, (9) TPL_phone, (10) TPL_pp_email, (11) TPL_authn...

CVE-2014-5102
Published: 2014-07-25
SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.