Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/7/2017
05:33 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

RIG Exploit Kit Takedown Sheds Light on Domain Shadowing

Threat actors hid tens of thousands of shadow domains behind legitimate domains to carry out malicious activity.

A coordinated effort to disrupt activities related to the RIG Exploit Kit has once again revealed how extensively threat actors abuse legitimate domains and websites to build the operational infrastructure for their criminal campaigns.

Researchers from RSA Security, domain registrar GoDaddy, and several other organizations worked together to recently take down over 40,000 active shadow domain resources that were being used as infrastructure for the RIG EK.

The campaign has resulted in a complete cessation of activity related to EITEST and PseudoDarkleech, two major RIG EK campaigns for distributing banking Trojans, ransomware, and other malware, says Alex Cox, director of RSA Research. "But it remains to be seen how that will affect the RIG ecosystem as a whole," he says.

Domain shadowing refers to the tactic by threat actors to create malicious subdomains behind a legitimate domain using credentials stolen from the domain registrant. Organizations often do not notice the activity because domain registrant accounts are rarely used or checked once the initial domain registration is completed. Criminals employ the technique to hide malware-laden pages and exploit kits behind legitimate domains, making it hard for defenders to spot and eradicate them.

"Domain shadowing is extremely effective because it allows malicious subdomains to leverage the good reputation of the parent domain, and thus bypass reputation based filters," says Shimon Modi, director of product at security intelligence sharing company TruStar Technology.

In the case of the RIG Exploit Kit, the threat actors used the shadow domains they created to host RIG landing pages. Most victims were directed to the landing pages from previously compromised websites injected with iframes. The landing pages were designed to inspect and exploit incoming client systems and to install a diverse set of malicious payloads on them.

The more than 40,000 RIG EK-related subdomains that RSA and the others succeeded in shutting down affected over 800 legitimate domains, many of them registered with GoDaddy. Most of the subdomains were being served out of near bulletproof hosting providers based in Eastern Europe. The hosting providers often had enough legitimate traffic not to be obvious candidates for blacklisting.

"A common way for defenders to attack these systems is to provide proof of malicious activities to the hosting providers, so they will suspend the systems," Cox says. Criminals understand that and deliberately seek out hosting providers that are willing to go along with or are negligent about the activity. "They’ll re-use these hosts until the defenders pinpoint them and then they’ll move onto others," Cox says.

An inspection of the DNS records associated with each of the shadow domains in the RIG Exploit Kit infrastructure showed that most of them were up for barely five to 10 days before being deleted. The duration for which they were actually used was likely closer to 24 and 48 hours according to RSA. Threat actors often rapidly rotate shadow domain to make it even harder for defender to get them.

There is little that was common among the compromised domains and most of them were likely just victims of opportunistic phishing and malware campaigns to steal login credentials to domain registrant accounts, Cox says.

The domain shadowing issue is a challenging problem to solve with 100% effectiveness, Modi says. "But a mix of block [and] tackle techniques and anomaly detection can help in detecting and preventing domain abuse," he says.

In order to ensure their domains are not being abused, organizations should make sure to monitor for unusual numbers of changes to DNS records, block bad IP address from their ISPs DNS systems and check for subdomains that have unusual alphanumeric character patterns, Modi says.

"Monitor organizational DNS records looking for unauthorized changes or additions on a regular, and preferably automated basis," adds Cox.  

Related content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Now this is the worst micromanagment I've seen.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17210
PUBLISHED: 2019-07-20
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass t...
CVE-2019-12934
PUBLISHED: 2019-07-20
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
CVE-2019-9229
PUBLISHED: 2019-07-20
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can...
CVE-2019-12815
PUBLISHED: 2019-07-19
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
CVE-2019-13569
PUBLISHED: 2019-07-19
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.