Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/17/2018
05:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Federal Jury Convicts Operator of Massive Counter-Antivirus Service

Scan4You helped thousands of criminals check if AV products could detect and block their malware tools.

A federal jury in Virginia has convicted Latvian resident Ruslans Bondars on charges related to his operation of Scan4You, one of the largest counter-antivirus (CAV) services in the cyber underground before it was shut down in 2016.

After a five-day trial, the jury found Bondars guilty of felony hacking, wire fraud, and other charges connected with operating the service, which offered threat actors a way to check if their malware was detectable by antivirus tools. At least 30,000 people used the illegitimate service to vet their malware before distribution during the period Scan4You was operational, between 2009 and 2016.

Among the many criminal hackers that used Scan4You to test and improve their malware was the group behind the Target breach that exposed data on more than 40 million credit cards in addition to nearly 70 million email addresses. Another threat actor used Scan4You to assist in the development of the widely distributed Citadel Trojan, which infected more than 11 million computers worldwide and resulted in some $500 million in fraud losses, the US Department of Justice said in a statement.

Russian national Jurijs Martisevs, an individual who assisted Bondars in operating Scan4You, pleaded guilty to his role in March and is awaiting sentencing. Both men were arrested last year in Latvia and extradited to the US amid protests by Russia that Martisevs' arrest was actually a kidnapping.

"At its height, Scan4You was one of the largest services of its kind and had at least thousands of users," the DOJ said in its statement this week. "Malware developed with the assistance of Scan4You included some of the most prolific malware known to the FBI and was used in major computer intrusions committed against American businesses."

Security vendor Trend Micro, which played a major role in helping law enforcement take down Scan4You, has described it as the first widely available CAV service that criminals could use to test their malware against modern antivirus tools.  

The service allowed almost anyone to submit a malicious file and verify if antimalware tools would flag it as malicious. Malware authors used the service to scan millions of files, including keyloggers, remote access Trojans, crypters, and entire malware tool kits.

Unlike legitimate malware-scanning services, which share scanning results with the broader community, Scan4You provided the results of its scans only to the individual submitting the file. Bondars and Martisevs offered up to 100,000 scans per month for just $30, with acceptable forms of payment including PayPal, Bitcoin, and WebMoney. Trend Micro estimates that, at its peak, Scan4You earned its operators some $15,000 a month.

Prior to Scan4You's launch in 2009, such anonymous scanning services where only available privately within the most organized of criminal enterprises, says a security analyst at Trend Micro who did not wish to be identified.

Examples of groups that used such services privately include Rove Digital, an Estonian click-fraud gang, and the Mevade group from Israel and Ukraine. "Scan4You made such a service available to the masses — greatly increasing the effectiveness of their malware attacks," the security analyst says.

Over the years, other CAV providers, including resellers of Scan4You services, have popped up, but they haven't been quite as successful. The biggest remaining CAV service is VirusCheckMate, an operation that doesn't appear to have benefited a whole lot from Scan4You's takedown, says the Trend Micro analyst.

One reason could be the relative complexity and low payoffs from operating a CAV service. "To run a CAV service is quite technically challenging, as you need to maintain a separate virtual machine for each of the AV products that your service supports," the analyst says.

"So, if a CAV allowed scanning with 30 AV scanners, that is 30 different virtual machines to maintain." Each of those machines would need to be both constantly up to date with the latest malware definitions and also disabled from sending feedback to the vendors in question, the Trend Micro security analyst notes. CAV operators also need to create code for automating the malware submission process and for retrieving the results out of custom security software logs.

"Being operators of Scan4You was likely quite prestigious in cybercrime circles" for Bondars and Martisevs, which explains why they persisted with the operation for eight years, the analyst says. The pair also was involved with other malicious services and groups—most notably Eva Pharmacy, one of the oldest and largest pharmaceutical spam gangs—which likely also brought in money.

For the moment, it is unclear why cybercriminals that were using Scan4You have not yet migrated to other CAV services like VirusCheckMate. "But this is a welcome trend," the Trend Micro analyst says.

One big hope is that the Scan4You takedown has had a deterrent effect on cybercriminals and will force them to either maintain their own private CAV service or to release their malware without testing. "All of those outcomes drive up the cost of doing business for cybercriminal operators," the analyst says.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...