Endpoint
8/7/2014
03:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Attack Harbors Malware In Images

'Lurk' click-fraud campaign now employing steganography.

BLACK HAT USA -- Las Vegas -- Steganography long has been a tool in the intelligence community and most recently terror groups, but a cyber crime gang has been spotted using the stealth technique of embedding information or code inside digital images.

A researcher at Dell SecureWorks investigating an attack in an incident response engagement at a customer site discovered that the malware involved--Lurk--had been spread via a phony digital image as part of a click-fraud campaign. Steganography typically is used in targeted attack scenarios, so the use of the method of hiding and slipping malware onto machines for click-fraud purposes is rare, says Brett Stone-Gross, a researcher with Dell SecureWorks' Counter Threat Unit.

The attackers have infected some 350,000 victims in less than a year's time, amassing a quarter of a million dollars in profit in just a few months, according to Dell SecureWorks.

Most intrusion detection and intrusion prevention products can't detect malware hidden with steganography, so the stealth method of spreading malicious code within an image is tough to catch, according to Stone-Gross. "This is something that's not very complex, but difficult to detect," he says.

Lurk was reported earlier this year by researcher Kafeine, which found the downloader malware spreading via iFrames on websites via an Adobe Flash exploit. Among the websites compromised in that campaign were eHow and Livestrong.

The attack requires the victim have a vulnerable version of Adobe Flash, triggering the exploit which then downloads Lurk. In the case of the steganography payload, the malware is downloaded as a plain white image, which contains an encrypted URL that downloads a second payload.

Researchers at Symantec three years ago spotted the cyber espionage gang behind Operation Shady RAT using steganography to hid commands controlling infected machines. Images of a pastoral waterside scene to a suggestive photo of a woman in a hat were used to mask commands ordering the infected machines to phone home to the command-and-control (C&C) server.

"In general, steganography is becoming a much more popular trend," Stone-Gross says. The KINS variant of Zeus, for instance, uses non-digital steganography file to append a configuration file or command to an image file, he says.

Digital steganography, which was used in the Lurk click-fraud campaign, is more difficult to detect. The attack campaign remains active.

Defending against steganography-borne malware is more about prevention: "Make sure you don't get infected in the first place. Basic techniques--make sure your software is updated," Stone-Gross says. The method of hiding and spreading malware will grow, he says.

A full technical analysis of the attack is here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4403
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.ph...

CVE-2012-2930
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers...

CVE-2012-2932
Published: 2015-04-24
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the (1) selitems[] parameter in a copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/...

CVE-2012-5451
Published: 2015-04-24
Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.

CVE-2015-0297
Published: 2015-04-24
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methos via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.