Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/7/2017
05:33 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

RIG Exploit Kit Takedown Sheds Light on Domain Shadowing

Threat actors hid tens of thousands of shadow domains behind legitimate domains to carry out malicious activity.

A coordinated effort to disrupt activities related to the RIG Exploit Kit has once again revealed how extensively threat actors abuse legitimate domains and websites to build the operational infrastructure for their criminal campaigns.

Researchers from RSA Security, domain registrar GoDaddy, and several other organizations worked together to recently take down over 40,000 active shadow domain resources that were being used as infrastructure for the RIG EK.

The campaign has resulted in a complete cessation of activity related to EITEST and PseudoDarkleech, two major RIG EK campaigns for distributing banking Trojans, ransomware, and other malware, says Alex Cox, director of RSA Research. "But it remains to be seen how that will affect the RIG ecosystem as a whole," he says.

Domain shadowing refers to the tactic by threat actors to create malicious subdomains behind a legitimate domain using credentials stolen from the domain registrant. Organizations often do not notice the activity because domain registrant accounts are rarely used or checked once the initial domain registration is completed. Criminals employ the technique to hide malware-laden pages and exploit kits behind legitimate domains, making it hard for defenders to spot and eradicate them.

"Domain shadowing is extremely effective because it allows malicious subdomains to leverage the good reputation of the parent domain, and thus bypass reputation based filters," says Shimon Modi, director of product at security intelligence sharing company TruStar Technology.

In the case of the RIG Exploit Kit, the threat actors used the shadow domains they created to host RIG landing pages. Most victims were directed to the landing pages from previously compromised websites injected with iframes. The landing pages were designed to inspect and exploit incoming client systems and to install a diverse set of malicious payloads on them.

The more than 40,000 RIG EK-related subdomains that RSA and the others succeeded in shutting down affected over 800 legitimate domains, many of them registered with GoDaddy. Most of the subdomains were being served out of near bulletproof hosting providers based in Eastern Europe. The hosting providers often had enough legitimate traffic not to be obvious candidates for blacklisting.

"A common way for defenders to attack these systems is to provide proof of malicious activities to the hosting providers, so they will suspend the systems," Cox says. Criminals understand that and deliberately seek out hosting providers that are willing to go along with or are negligent about the activity. "They’ll re-use these hosts until the defenders pinpoint them and then they’ll move onto others," Cox says.

An inspection of the DNS records associated with each of the shadow domains in the RIG Exploit Kit infrastructure showed that most of them were up for barely five to 10 days before being deleted. The duration for which they were actually used was likely closer to 24 and 48 hours according to RSA. Threat actors often rapidly rotate shadow domain to make it even harder for defender to get them.

There is little that was common among the compromised domains and most of them were likely just victims of opportunistic phishing and malware campaigns to steal login credentials to domain registrant accounts, Cox says.

The domain shadowing issue is a challenging problem to solve with 100% effectiveness, Modi says. "But a mix of block [and] tackle techniques and anomaly detection can help in detecting and preventing domain abuse," he says.

In order to ensure their domains are not being abused, organizations should make sure to monitor for unusual numbers of changes to DNS records, block bad IP address from their ISPs DNS systems and check for subdomains that have unusual alphanumeric character patterns, Modi says.

"Monitor organizational DNS records looking for unauthorized changes or additions on a regular, and preferably automated basis," adds Cox.  

Related content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DHorse2
50%
50%
DHorse2,
User Rank: Strategist
9/2/2019 | 9:21:36 PM
A solutions question.
Hi Mr. Vijayan. Your article led me to read a few others as I was puzzled. QUOTE: "The domain shadowing issue is a challenging problem to solve with 100% effectiveness, Modi says. "But a mix of block [and] tackle techniques and anomaly detection can help in detecting and preventing domain abuse," he says." END QUOTE. Yet you and your peers point out how limited that is. Heuristics seemed to the most effective. I use DDNS illegitimately BTW. MITIGATION MAYBE? Two step auth is widely accepted and would be needed. Which the industry could not coerce everyone to use I imagine. Yikes. Even then you would need to constrain changing contact information in creative ways to avoid costs and address a global simple system tweak. Even that isn't strictly required if you carefully watch domains where the two step contact info changed. If you got cooperation. Would you?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27885
PUBLISHED: 2020-10-29
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s pass...
CVE-2020-25646
PUBLISHED: 2020-10-29
A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality
CVE-2020-26205
PUBLISHED: 2020-10-29
Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.
CVE-2020-14323
PUBLISHED: 2020-10-29
A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.
CVE-2020-27886
PUBLISHED: 2020-10-29
An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the username_available function of the includes/functions.php file (which is called by login.php).