Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

6/16/2015
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

New Malware Found Hiding Inside Image Files

Dell SecureWorks CTU researchers say Stegoloader is third example in a year of malware using digital steganography as a detection countermeasure.

Researchers with Dell SecureWorks' Counter Threat Unit (CTU) this week detailed the kind of Spy-vs.-Spy countermeasures malware authors come up with to evade detection in a new report on a little-known malware family it calls Stegoloader. Targeting organizations in healthcare, education, and manufacturing, Stegoloader uses digital steganography to hide malicious code inside a PNG image file downloaded from a legitimate website.

A longtime spycraft technique, digital steganography is a method of concealing secret information within seemingly non-descript, non-secret files.  Malware authors may be taking a shine to it because it is a relatively simple but effective way to circumvent tools like intrusion detection and prevention systems. Last year, CTU researchers unveiled at BlackHat evidence that the Lurk downloader was one of the first families of malware to use true digital steganography as a countermeasure.

"At the end of 2014, CTU researchers also observed the Neverquest version of the Gozi trojan using this technology to hide information on its backup command and control (C2) server," CTU researchers wrote.

Now with the discovery of Stegoloader, they're wondering if this may be the early signs of a trend toward digital steganography as a malware countermeasure.

"Stegoloader is the third malware family that CTU researchers have observed using digital steganography," the researchers said. "This technique might be a new trend because malware authors need to adapt to improved detection mechanisms."

Of course, the use of steganography is just one of the techniques used by this malware to evade detection. Stegoloader's authors wrote it with a modular design.

"Stegoloader's modular design allows its operator to deploy modules as necessary, limiting the exposure of the malware capabilities during investigations and reverse engineering analysis," the researchers wrote. "This limited exposure makes it difficult to fully assess the threat actors' intent."

Some of the modules used are a geographic localization module to gather information on the compromised system's IP address, browsing history module, password-stealing module, and even a module designed to steal instances of IDA software used by malware analysts and reverse engineers to analyze malicious software if Stegoloader detects it on the compromised system. Additionally, the main module of the malware is not persistent, and before deploying other modules, it performs checks for indication that it is running in an analysis environment.

"For example, the deployment module monitors mouse cursor movements by making multiple calls to the GetCursorPos function," the report said. "If the mouse always changes position, or if it does not change position, the malware terminates without exhibiting any malicious activity."

As of now, the malware looks to be an opportunistic information-stealer and hasn't been observed using exploits or spearphishing, so the researchers say it's more likely a mass-market commodity malware family than one used in targeted attacks.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
6/22/2015 | 1:23:27 PM
Re: Nothing new here?
I agree. We just need to know what paths do these malwares are coming so we can take more precise preventive actions instead of playing catchup game.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
6/22/2015 | 1:21:52 PM
Re: Ingenuity
I agree it starts with simple root cause and goes into a bigger problem. That is the main reason whatever we do we have to a have layered approach.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
6/22/2015 | 1:20:26 PM
Re: Ingenuity
Sure. They have incentive to outsmart security professionals in a way that they are always ahead of all of us. That is the main problem with the security measures it is always trying to catch up.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
6/22/2015 | 1:18:03 PM
steganography
 

One of the oldest technique to hide information inside an image.  They do it in a way that the checksum on the image is not resulting into a different number so it is really hard to catch.
GwenGo
50%
50%
GwenGo,
User Rank: Apprentice
6/18/2015 | 7:06:49 AM
Re: Ingenuity
Thank you for this article on malwares.
I really hope to protect myself against these intrusions but it's hard ...
BertrandW414
50%
50%
BertrandW414,
User Rank: Strategist
6/17/2015 | 4:39:25 PM
Re: Ingenuity
Yes Whoopty, now that would be a great use of our H1B visa system! It is too bad that some of these people working in hacker groups or cartels would probably feel that trying to leave and become legit would put their lives or physical well-being in jeopardy. They might also be worried about getting abducted by an organization in our intelligence community and getting "aggreessively interviewed" for contacts, techniques, and other useful information. 
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
6/17/2015 | 11:52:56 AM
Nothing new here?
While a novel way to effect a network attack, the attack vector and countermeasures remain the same. The adversary has to introduce and execute malcode. Whether that malcode is obfuscated using steganography or appended to a legitimate document is largely irrelevant. And making that determination is quite frankly a fruitless endeavor granted the panoply of evasion mechanisms available. The focus needs to be on the execution chain.
Mark532010
50%
50%
Mark532010,
User Rank: Moderator
6/17/2015 | 11:03:19 AM
Re: Ingenuity
you are right on in that statement. While zero-day and these super-sophisticated attacks gain all the media and keep people awake at night, the reality is that 90+% of breakins are simple basic security 101 problems. users with admin rights, default passwords, no encryption, lax controls or controls that are never actually used, home-grown apps that have never been pen-tested, etc.
Whoopty
100%
0%
Whoopty,
User Rank: Ninja
6/17/2015 | 6:26:37 AM
Ingenuity
The ingenuity of malware makers always impresses me. I'm sure many of them could secure gigs at security outfits or firms that require high-end digital security. They wouldn't even need to be world class, as so many firms seem to have such lax digital defences. 
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: -when I told you that our cyber-defense was from another age
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-3350
PUBLISHED: 2019-11-19
masqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that results in improper privilege dropping.
CVE-2011-3352
PUBLISHED: 2019-11-19
Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifying and deleting themes. A remote attacker with Zikula administrator privilege could use this flaw to execute arbitrary HTML or web script code in the context ...
CVE-2011-3349
PUBLISHED: 2019-11-19
lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. A local user can overwrite root-owned files via a symlink, which can allow possible privilege escalation.
CVE-2019-10080
PUBLISHED: 2019-11-19
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI ...
CVE-2019-10083
PUBLISHED: 2019-11-19
When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.