Endpoint

8/7/2014
03:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Attack Harbors Malware In Images

'Lurk' click-fraud campaign now employing steganography.

BLACK HAT USA -- Las Vegas -- Steganography long has been a tool in the intelligence community and most recently terror groups, but a cyber crime gang has been spotted using the stealth technique of embedding information or code inside digital images.

A researcher at Dell SecureWorks investigating an attack in an incident response engagement at a customer site discovered that the malware involved--Lurk--had been spread via a phony digital image as part of a click-fraud campaign. Steganography typically is used in targeted attack scenarios, so the use of the method of hiding and slipping malware onto machines for click-fraud purposes is rare, says Brett Stone-Gross, a researcher with Dell SecureWorks' Counter Threat Unit.

The attackers have infected some 350,000 victims in less than a year's time, amassing a quarter of a million dollars in profit in just a few months, according to Dell SecureWorks.

Most intrusion detection and intrusion prevention products can't detect malware hidden with steganography, so the stealth method of spreading malicious code within an image is tough to catch, according to Stone-Gross. "This is something that's not very complex, but difficult to detect," he says.

Lurk was reported earlier this year by researcher Kafeine, which found the downloader malware spreading via iFrames on websites via an Adobe Flash exploit. Among the websites compromised in that campaign were eHow and Livestrong.

The attack requires the victim have a vulnerable version of Adobe Flash, triggering the exploit which then downloads Lurk. In the case of the steganography payload, the malware is downloaded as a plain white image, which contains an encrypted URL that downloads a second payload.

Researchers at Symantec three years ago spotted the cyber espionage gang behind Operation Shady RAT using steganography to hid commands controlling infected machines. Images of a pastoral waterside scene to a suggestive photo of a woman in a hat were used to mask commands ordering the infected machines to phone home to the command-and-control (C&C) server.

"In general, steganography is becoming a much more popular trend," Stone-Gross says. The KINS variant of Zeus, for instance, uses non-digital steganography file to append a configuration file or command to an image file, he says.

Digital steganography, which was used in the Lurk click-fraud campaign, is more difficult to detect. The attack campaign remains active.

Defending against steganography-borne malware is more about prevention: "Make sure you don't get infected in the first place. Basic techniques--make sure your software is updated," Stone-Gross says. The method of hiding and spreading malware will grow, he says.

A full technical analysis of the attack is here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14084
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell().
CVE-2018-14085
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. First, suppose that the owner adds the evil contract address to his sweepers. The evil contract looks like this: contract Exploit { uint public start; function swe...
CVE-2018-14086
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for SingaporeCoinOrigin (SCO), an Ethereum token. The contract has an integer overflow. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell(...
CVE-2018-14087
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for EUC (EUC), an Ethereum token. The contract has an integer overflow. If the owner sets the value of buyPrice to a large number in setPrices() then the "msg.value * buyPrice" will cause an integer overflow in the fallback functio...
CVE-2018-14088
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for STeX White List (STE(WL)), an Ethereum token. The contract has an integer overflow. If the owner sets the value of amount to a large number then the "amount * 1000000000000000" will cause an integer overflow in withdrawToFounde...