Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/19/2014
04:46 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft Windows Crash Reports Reveal New APT, POS Attacks

Researchers discover zero-day attacks after studying the contents of various "Dr. Watson" error reports

You never know what you'll glean from a Windows crash report: security researchers recently unearthed a previously unknown advanced persistent threat campaign as well as a new point-of-sale system attack by perusing and analyzing those crash reports also known as Dr. Watson.

RSA Conference 2014
Click here for more articles about the RSA Conference.

Researchers at Websense -- who recently exposed weaknesses in Microsoft's Windows crash reports that could be abused by attackers or spies -- today released free source code online for enterprises to employ the crash reports for catching potential security breaches in their organizations. The researchers next week at the RSA Conference in San Francisco will release indicators of compromise for the two attack campaigns that can be incorporated into intrusion prevention systems.

Alex Watson, director of security research for Websense, says his team spotted a targeted attack waged against a mobile network provider and a government agency, both outside the U.S., as well as a Zeus-based attack aimed at the point-of-sale system of wholesale retailers. In both cases, the attacks have been suspended and the command-and-control infrastructures disrupted.

"We wanted to prove that we can detect zero-day or unknown [attacks] by a little information in crash reports," Watson says. So he and his team created crash "fingerprints" to filter and search for real-world attack intelligence in Dr. Watson reports.

Watson says the team scoured some 16 million Microsoft Windows Error Report logs over a four-month period, searching for a crash fingerprint that mimics the behavior of the Internet Explorer zero-day exploit used in attacks last year against Taiwanese high-tech equipment makers and Japanese financial institutions, the CVE-2013-3893 memory corruption vulnerability patched by Microsoft in October of last year.

Websense found five crash reports from four different organizations that appeared to indicate exploit attempts – one of which was the mobile network provider, which it would not name. Websense also spotted traffic going to a remote access Trojan typically associated with targeted attacks called Houdini H-Worm. The government agency target was spotted with a machine communicating to the RAT command-and-control during the same period, according to Websense.

The researchers then found crash reports akin to the POS malware used against Target and other retailers, mostly from a large clothing retailer in the Eastern U.S. "This was massively different from a normal Zeus infection. It appears to be a very targeted Zeus just going after the wholesale industry," Watson says. The Windows crashes appear to indicate code injection attempts, he says, and there's no evidence thus far that the attacks are related to Target or Neiman Marcus.

"As far as we can tell, no information was stolen. The command and control was blocked on outbound," he says. "This Zeus-based malware was able to steal credit cards using RAM-scraping."

Good News, Bad News

The bad news is that Microsoft's automated Windows error report feature mostly transmits crash log data unencrypted and in the clear, leaving organizations that use the function vulnerable to targeted attacks, according to Websense Security Labs. The team studied risks posed by some popular applications and services that use Microsoft Windows Error Reporting, which automatically sends to the software giant details of a system crash. The sensitive information in these reports, which includes the make and model of the machine, BIOS version, ID, and applications, can help bad guys and even the National Security Agency profile potential targeted machines and networks.

Wolfgang Kandek, CTO at Qualys, says it's not so simple for bad guys to glean intel from Windows crash reports, however. "I'm not quite sure bad guys can easily get to that information. That would mean intercepting the communication of your machine to Microsoft. Maybe they would be monitoring your router or your firewall," he says. "I'm not sure it was be that easy unless they are already in your network ... and you would have bigger problems" then, he says.

But the good news is that the reports can also be used for good, as Websense found with its fingerprinting method that exposed the previously unknown targeted attack and POS campaign.

[The NSA is reportedly using crash dumps to collect feedback on its attempts to exploit flaws in targeted companies and networks, but crash dumps still remain a successful defensive technology. See How Windows 'Crash Dumps' Aid Defenders.]

The reports absolutely can provide good information to enterprises, as well as to Microsoft, Kandek says. "A certain number of crashes may be normal across your organization ... but if it spikes up, it's worth investigating," Kandek says.

The full Websense report is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
shjacks55
50%
50%
shjacks55,
User Rank: Apprentice
3/7/2014 | 9:42:21 AM
re: Microsoft Windows Crash Reports Reveal New APT, POS Attacks
Win7/8 not XP.
kjhiggins
50%
50%
kjhiggins,
User Rank: Strategist
2/20/2014 | 4:56:46 PM
re: Microsoft Windows Crash Reports Reveal New APT, POS Attacks
Good point, dritchie. I'll add that to the piece. In the meantime, here's the link:

https://github.com/zredlined/d...
dritchie
50%
50%
dritchie,
User Rank: Strategist
2/20/2014 | 3:26:20 PM
re: Microsoft Windows Crash Reports Reveal New APT, POS Attacks
Why is there no link to the "today released free source code online"?
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-5285
PUBLISHED: 2019-11-15
Null pointer dereference vulnerability exists in K11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime in NSS before 3.26, which causes the TLS/SSL server using NSS to crash.
CVE-2009-5047
PUBLISHED: 2019-11-15
Jetty 6.x before 6.1.22 suffers from an escape sequence injection vulnerability from two different vectors: 1) "Cookie Dump Servlet" and 2) Http Content-Length header. 1) A POST request to the form at "/test/cookie/" with the "Age" parameter set to a string throws a &qu...
CVE-2013-4584
PUBLISHED: 2019-11-15
Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections
CVE-2013-7087
PUBLISHED: 2019-11-15
ClamAV before 0.97.7 has WWPack corrupt heap memory
CVE-2013-7088
PUBLISHED: 2019-11-15
ClamAV before 0.97.7 has buffer overflow in the libclamav component