Endpoint
8/7/2014
03:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Attack Harbors Malware In Images

'Lurk' click-fraud campaign now employing steganography.

BLACK HAT USA -- Las Vegas -- Steganography long has been a tool in the intelligence community and most recently terror groups, but a cyber crime gang has been spotted using the stealth technique of embedding information or code inside digital images.

A researcher at Dell SecureWorks investigating an attack in an incident response engagement at a customer site discovered that the malware involved--Lurk--had been spread via a phony digital image as part of a click-fraud campaign. Steganography typically is used in targeted attack scenarios, so the use of the method of hiding and slipping malware onto machines for click-fraud purposes is rare, says Brett Stone-Gross, a researcher with Dell SecureWorks' Counter Threat Unit.

The attackers have infected some 350,000 victims in less than a year's time, amassing a quarter of a million dollars in profit in just a few months, according to Dell SecureWorks.

Most intrusion detection and intrusion prevention products can't detect malware hidden with steganography, so the stealth method of spreading malicious code within an image is tough to catch, according to Stone-Gross. "This is something that's not very complex, but difficult to detect," he says.

Lurk was reported earlier this year by researcher Kafeine, which found the downloader malware spreading via iFrames on websites via an Adobe Flash exploit. Among the websites compromised in that campaign were eHow and Livestrong.

The attack requires the victim have a vulnerable version of Adobe Flash, triggering the exploit which then downloads Lurk. In the case of the steganography payload, the malware is downloaded as a plain white image, which contains an encrypted URL that downloads a second payload.

Researchers at Symantec three years ago spotted the cyber espionage gang behind Operation Shady RAT using steganography to hid commands controlling infected machines. Images of a pastoral waterside scene to a suggestive photo of a woman in a hat were used to mask commands ordering the infected machines to phone home to the command-and-control (C&C) server.

"In general, steganography is becoming a much more popular trend," Stone-Gross says. The KINS variant of Zeus, for instance, uses non-digital steganography file to append a configuration file or command to an image file, he says.

Digital steganography, which was used in the Lurk click-fraud campaign, is more difficult to detect. The attack campaign remains active.

Defending against steganography-borne malware is more about prevention: "Make sure you don't get infected in the first place. Basic techniques--make sure your software is updated," Stone-Gross says. The method of hiding and spreading malware will grow, he says.

A full technical analysis of the attack is here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7437
Published: 2015-03-29
Multiple integer overflows in potrace 1.11 allow remote attackers to cause a denial of service (crash) via large dimensions in a BMP image, which triggers a buffer overflow.

CVE-2013-7438
Published: 2015-03-29
Multiple buffer overflows in pbm212030 allow remote attackers to cause a denial of service (crash) or possible execute arbitrary code via a crafted PBM image, related to (1) stream line data, which triggers a heap-based buffer overflow, or (2) vectors related to an "internal intermediate heap-based ...

CVE-2014-5427
Published: 2015-03-29
Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to read pa...

CVE-2014-5428
Published: 2015-03-29
Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integratio...

CVE-2014-9205
Published: 2015-03-29
Stack-based buffer overflow in the PmBase64Decode function in an unspecified demonstration application in MICROSYS PROMOTIC stable before 8.2.19 and PROMOTIC development before 8.3.2 allows remote attackers to execute arbitrary code by providing a large amount of data.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.