Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/7/2014
03:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Attack Harbors Malware In Images

'Lurk' click-fraud campaign now employing steganography.

BLACK HAT USA -- Las Vegas -- Steganography long has been a tool in the intelligence community and most recently terror groups, but a cyber crime gang has been spotted using the stealth technique of embedding information or code inside digital images.

A researcher at Dell SecureWorks investigating an attack in an incident response engagement at a customer site discovered that the malware involved--Lurk--had been spread via a phony digital image as part of a click-fraud campaign. Steganography typically is used in targeted attack scenarios, so the use of the method of hiding and slipping malware onto machines for click-fraud purposes is rare, says Brett Stone-Gross, a researcher with Dell SecureWorks' Counter Threat Unit.

The attackers have infected some 350,000 victims in less than a year's time, amassing a quarter of a million dollars in profit in just a few months, according to Dell SecureWorks.

Most intrusion detection and intrusion prevention products can't detect malware hidden with steganography, so the stealth method of spreading malicious code within an image is tough to catch, according to Stone-Gross. "This is something that's not very complex, but difficult to detect," he says.

Lurk was reported earlier this year by researcher Kafeine, which found the downloader malware spreading via iFrames on websites via an Adobe Flash exploit. Among the websites compromised in that campaign were eHow and Livestrong.

The attack requires the victim have a vulnerable version of Adobe Flash, triggering the exploit which then downloads Lurk. In the case of the steganography payload, the malware is downloaded as a plain white image, which contains an encrypted URL that downloads a second payload.

Researchers at Symantec three years ago spotted the cyber espionage gang behind Operation Shady RAT using steganography to hid commands controlling infected machines. Images of a pastoral waterside scene to a suggestive photo of a woman in a hat were used to mask commands ordering the infected machines to phone home to the command-and-control (C&C) server.

"In general, steganography is becoming a much more popular trend," Stone-Gross says. The KINS variant of Zeus, for instance, uses non-digital steganography file to append a configuration file or command to an image file, he says.

Digital steganography, which was used in the Lurk click-fraud campaign, is more difficult to detect. The attack campaign remains active.

Defending against steganography-borne malware is more about prevention: "Make sure you don't get infected in the first place. Basic techniques--make sure your software is updated," Stone-Gross says. The method of hiding and spreading malware will grow, he says.

A full technical analysis of the attack is here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14540
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-16332
PUBLISHED: 2019-09-15
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
CVE-2019-16333
PUBLISHED: 2019-09-15
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
CVE-2019-16334
PUBLISHED: 2019-09-15
In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636.
CVE-2019-16335
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.