Attacks/Breaches
7/22/2014
05:45 PM
Sara Peters
Sara Peters
Quick Hits
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Nigerian 419 Scammers Evolving Into Malware Pushers (But Not Very Good Ones)

"Silver Spaniel" attacks use commodity malware to damage others' security, but they aren't very good at protecting their own.

Nigeria's 419 scammers are evolving. Instead of just using charm to con wealthy marks into handing over their cash, these actors are now also using malware, according to a Palo Alto Networks report released today.

Palo Alto has dubbed this series of attacks "Silver Spaniel." Fortunately, "these individuals are often experts at social engineering, but novices with malware."

The attackers are primarily using the NetWire remote access tool along with DataScrambler, a crypter used to evade anti-virus software. These are relatively inexpensive commodity tools that can be easily obtained at online marketplaces. So far, the attackers are delivering these executables as email attachments. "Silver Spaniel attacks have thus far not exploited any software vulnerabilities and have instead relied entirely on social engineering to trick victims into installing malware," according to the report.

The attackers are using dynamic DNS domains from NoIP for command-and-control, but in an effort to make it easier to manage their malicious activity, they're making it easier for law enforcement officials to locate them. From the report:

    At least one attacker configured their system to use the Dynamic Update Client (DUC) provided by NoIP.com to automatically direct traffic destined for their domain to the IP address of their PC. This automated the assignment process, but also exposed their non-VPN IP address and location. These non-VPN IP addresses belong to ISPs that provide mobile Internet access to much of Nigeria.

Not only are they doing a poor job of hiding their IP addresses, but they're also doing a poor job of hiding their own identities. Palo Alto provided the example of Ojie Victor, a rather hapless fellow who may or may not be involved in Silver Spaniel attacks but is certainly attempting to commit acts that are consistent with the style.

Victor was found posting messages on social networks and forums, publicly seeking assistance buying and using malware. For example, he tweeted: "I NEED A SPOOFER FOR MY CYBERGATE RAT... CAN SOMEBODY HELP ME OUT HERE? ojeyvictor19999@yahoo.com."

Read the full report at paloaltonetworks.com/resources/research/419evolution.html (registration required).

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/28/2014 | 12:23:42 PM
Re: Executables in Emails?
My thinking is that the earlier good practices can be drummed in the better. I've seen many tweens with smartphones! Then by the time the judgement kicks in in the mid 20s, presumaby some of the basics will be already baked in...
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/28/2014 | 12:23:37 PM
Re: Executables in Emails?
My thinking is that the earlier good practices can be drummed in the better. I've seen many tweens with smartphones! Then by the time the judgement kicks in in the mid 20s, presumaby some of the basics will be already baked in...
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/28/2014 | 12:23:32 PM
Re: Executables in Emails?
My thinking is that the earlier good practices can be drummed in the better. I've seen many tweens with smartphones! Then by the time the judgement kicks in in the mid 20s, presumaby some of the basics will be already baked in...
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/28/2014 | 12:20:04 PM
Re: Executables in Emails?
This does make sense from an impulse perspective but then what are the action items? Educating people at a younger age to protect against phisihing? My high school had CISCO Networking classes and basic computer classes but I have not seen a InfoSec related class or one that taught InfoSec related principles. 

Or would this be better projected at the university level which comprises the age most susceptible for exploitation?
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/25/2014 | 9:56:53 AM
Re: Executables in Emails?
As the parent of a 24-year old (who probably should know better), I'm not surprised that that demographic is more susceptiable to a phishing attack. That's a very impulsive age at which point the "judgement" brain cells have not fully matured. The rental car industry figured that out a long time ago when they set 26 as the minimum age that people can rent a car without a big  surcharge.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/25/2014 | 8:46:13 AM
Re: Executables in Emails?
Very interesting thanks for the reply. Some of the most interesting pieces from that article was that ages 18-25 are the most susceptible age bracking for phishing attacks. I thought it would be the opposite.

Also, that women are more susceptible than men statistically. The article attributes this to less technical training however I am not convinced. In the study was half women and half men with men receiving 48% training materials and women receiving 52% which is pretty much even. So I don't think the results support their hypothesis. But I cannot think of other reasoning as to why this would be true. 
Manos Chatzikyriakos
50%
50%
Manos Chatzikyriakos,
User Rank: Apprentice
7/24/2014 | 10:56:02 AM
Re: Executables in Emails?
You might find this paper interesting. It's about a study on the subject you mentioned, different factors that might have an impact someone's behaviour susceptibility to falling victims of phising attacks. 

http://lorrie.cranor.org/pubs/pap1162-sheng.pdf

The paper is a derivative of a thesis which you can find online if you need the full information.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/24/2014 | 10:30:24 AM
Re: Executables in Emails?
Understood, does anyone know if there is an age demographic that shows those who respond to phishing attacks? I am just curious because I know a large percentage of exploited individuals are elderly in terms of technology/financial scams. I would be interested to see if they are the largest group who open unknown attachements.
Manos Chatzikyriakos
50%
50%
Manos Chatzikyriakos,
User Rank: Apprentice
7/24/2014 | 10:00:01 AM
Re: Executables in Emails?
Unfortunately you would be surprised by how many people would actually do that. It doesn't take more than poor social enginnering skills and a .exe file named "picture.exe.jpg"
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/23/2014 | 8:47:16 AM
Executables in Emails?
Some of this was actually quite comical. But on a serious note, to confirm with your article, they are sending .exe's in the email attachment? Just to be clear, I am unsure as to why anyone would use an executable from an email. 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.