Články

Aktuálne informácie zo sveta bezpečnosti IT riešení

Aktuálne hrozby podľa Fortinetu za 27.10 - 2.11. 2018 viac článkov »

Aktuálne hrozby podľa Fortinetu za 27.10 - 2.11. 2018

Vďaka nášmu partnerovi Fornitet, vám aj tento týždeň prinášame report odhalených hrozieb za predchádzajúci týždeň. Report si môžete precitať nižšie v anglickom jazyku. V prípade otázok nás neváhajte kontaktovať.


Activity Summary - Week Ending November 2, 2018

 

 

Cybercrime-as-a Service has created an entry point for novice distributed denial-of-service (DDoS) attackers by offering simple options to anonymously attack nearly any website and forcing it offline. Due to the public release of source code for some popular bots, building a botnet to provide these sort of services is easier than ever. Minor modifications to the source code allow cyber criminals to create their own versions that continue to spread mayhem.

FortiGuard Labs recently discovered a new platform offering a DDoS-for-hire service called "0x-booter". This service comes with an explicitly defined user interface which enables nearly anyone to learn and use the service. And like any other DDoS-for-hire, initiating a DDoS attack through a web user interface avoids the need for direct contact between the user and the bot master. In the attack hub interface the details of the host or domain, port, attack duration, and the type of attack can all be configured before launching an attack.

0x-booter is available to anyone who signs up on the website. The price for the 0x-booter service ranges from $20 to $150, depending on the number of attacks, the duration of an attack, and customer support. In today's current cybercrime economy, a few dollars combined with malicious intent can translate to considerable damage to virtually any target. 

After analyzing both the website and the associated botnet, Bushido, we discovered that the codes used have been copy and pasted from an open source and modified for their own purposes. In fact, the 0x-booter website was based on another 'booter/stresser' called Ninjaboot, the source code of which was leaked in hacking forums last year. Bushido borrows a lot of its code from Mirai and is still considered a fork of Mirai. Bad actors tend to reuse capabilities that were proven successful in the past - why reinvent the wheel.

You can read more details of our analysis on our blog, including the details of our detection and the associated IOCs. DDoS-for-Hire Service Powered by Bushido Botnet

 

Application Vulnerabilities / IPS

 

Rank

Name

Prevalence

1

MS.IIS.WebDAV.PROPFIND.ScStoragePathFromUrl.Buffer.Overflow

46,608

2

Apache.Struts.2.Jakarta.Multipart.Parser.Code.Execution

45,020

3

Avtech.Devices.HTTP.Request.Parsing.Multiple.Vulnerabilities

44,627

4

D-Link.DSL-2750B.CLI.OS.Command.Injection

39,357

5

Linksys.Routers.Administrative.Console.Authentication.Bypass

36,131

 

NUUO.NVRmini.OS.Command.Injection – NUUO is a company that delivers video management solutions since 2004, and today is one of the leaders in global surveillance solutions for the enterprise. In 2016, a security researcher discovered that NUUO products suffered from multiple remote command injection vulnerabilities, and attempted to contact NUUO in order to carry out the responsible disclosure process, as disclosed by the author (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5351.php), but the company failed to commit to fixing the issue at that time. So on August 6, 2016, the vulnerability was publicly disclosed. The vulnerability affects NUUO versions <=3.0, and the vulnerabilities are all exploited through injection of commands when sending an http request to the web interface. A simple request can be sent and executed by the underlying operating system. This signature has been in the top of our telemetry reports and is now triggering on 14.81% of all sensors that are reporting any given IPS signature, indicating it is most likely the work of a botnet. The most-affected countries were the United States (17.71%), Japan (6.03%), and Taiwan (4.36%).

Signatures: NUUO.NVRmini.OS.Command.Injection

EnGenius.EnShare.IoT.Gigabit.Cloud.Service.Command.Injection – EnGenius EnShare is a solution that allows for seamless access to content hosted on a USB storage attached to the router. Even when you are outside your home, when connected to the Internet you will have your files at your fingertips. A remote code execution vulnerability was found on the 'usbinteract.cgi' script, which allows an attacker to inject any command it wishes to execute via the path parameter as parsed by the vulnerable script. This can be abused by crafting a special HTTP request with the command and sending it to the HTTP server.

Affected versions are ESR300 (1.4.9, 1.4.7, 1.4.2, 1.4.1.28, 1.4.0, 1.3.1.42, 1.1.0.28) ESR350 (1.4.11, 1.4.9, 1.4.5, 1.4.2, 1.4.0, 1.3.1.41, 1.1.0.29) ESR600 (1.4.11, 1.4.9, 1.4.5, 1.4.3, 1.4.2, 1.4.1, 1.4.0.23, 1.3.1.63, 1.2.1.46, 1.1.0.50) EPG5000 (1.3.9.21, 1.3.7.20, 1.3.3.17, 1.3.3, 1.3.2, 1.3.0, 1.2.0) ESR900 (1.4.5, 1.4.3, 1.4.0, 1.3.5.18 build-12032015@liwei (5668b74), 1.3.1.26, 1.3.0, 1.2.2.23, 1.1.0)ESR1200 (1.4.5, 1.4.3, 1.4.1, 1.3.1.34, 1.1.0) ESR1750 (1.4.5, 1.4.3, 1.4.1, 1.4.0, 1.3.1.34, 1.3.0, 1.2.2.27, 1.1.0).

This is a signature that has shown rapid growth over the last month; it jumped from less than 0.1% to close to 14% in a month. The most-affected countries were the United States (17.57%), Japan (6.09%), and Taiwan (4.37%).

Signatures: EnGenius.EnShare.IoT.Gigabit.Cloud.Service.Command.Injection

 

Malware Activity

 

Rank

Name

Prevalence

1

VBA/Agent.5B37!tr

10,534

2

Android/Agent.FJ!tr

9,286

3

W32/Agent.AJFK!tr

6,547

4

MSOffice/CVE_2017_11882.A!exploit

6,226

5

Riskware/CoinHive

3,720

 

WannaMine; Wanna Patch Your Systems? –  FortiGuard Labs is aware of a new WannaMine attack discovered earlier this week by researchers. As usual with WannaMine attacks, this campaign focuses on installing via the infamous EternalBlue exploit, which was released in 2016 by the Shadow Brokers, then downloads various Trojans to gain a stronger foothold within the network. The Trojans are made up of three components: RecentFileProgrom.exe, res.exe, and tor.exe, which perform the following:

  • RecentFileProgrom.exe – Looks for other machines to compromise via EternalBlue and spread
  • res.exe – Contains mining processes. What is interesting is that the files dropped use JPG files which actually are PE files that contain an MZ header to bypass AV detections, and the JPG files ultimately contain the mining components that mine cryptocurrency in the background.
  • tor.exe – And finally, to make matters worse, this file is responsible for connecting the malware to the Nitol botnet.

Other interesting observations seen as well were the usage of Linux binaries that also performed mining processes by compromising telnet connections via UDP injection techniques, and then taking advantage of a known vulnerability in the Linux kernel (CVE-2016-5195) called "Dirty COW," which is a privilege escalation vulnerability to install the miners. Thankfully, mitigation against this exists, in the form of MS17-010.

Signatures: W32/Banload.YCQ!tr.dldr, W32/CVE_2015_1701!exploit, W64/CVE_2015_1701.A!tr, Linux/CVE_2016_5195.A!exploit, W32/ShadowBrokers.AO!tr, W32/Delf.CJX!tr.dldr, ELF/Ganiw.A!tr, W32/UACMe.E!tr, W32/ServStart.GL!tr, W32/CVE_2015_1701.AQ!tr

Indicator(s):
cache[.]windowsdefenderhost[.]com
online[.]srentrap[.]com
d4uk[.]7h4uk[.]com


Yet Another Ransomware-as-a-Service –
 FortiGuard Labs has observed a new Ransomware-as-a-Service (RaaS), dubbed Kraken, being distributed in the underground forums. Discovered earlier this week by researchers, Kraken is a new ransomware variant that is written in C#. What makes this ransomware unique is its use of various encryption algorithms, such as AES, RC4, and Salsa20, for speed and to ultimately compromise a victim where it would be impossible to recover encrypted data without the help of the attackers. Similar to GandCrab, Kraken provides rolling updates and support to its user base every 15 days. The affiliates who target victims with Kraken must pay the developers a percentage of the payment to obtain the key. This provides the developers a level of protection and anonymity, essentially removing themselves from any attacks affiliates create themselves. It is interesting to note that Kraken developers have stated that the ransomware may not be used in former Soviet republics, or in Iran.

Observations during analysis are that the ransomware encrypts data on the disk very quickly. It also uses well-known external tools, such as SDelete from the Sysinternals suite, to wipe files from the victim machine, to ultimately make recovery more difficult. The Kraken encryption routine in a nutshell is distributed via the Fallout Exploit Kit, which installs and runs the Kraken payload, then connects to a command and control server at basze.tk where it performs cursory checks to ensure it is not running on a machine in one of the blacklisted countries. It then drops files into the %TEMP% folder, which tries to bypass UAC, and performs the encryption routine, deletes various files, and as an ultimate insult to incident responders, deletes itself off the machine.

Signatures: W32/Ransom.FAQ!tr, MSIL/Filecoder.PI!tr, W32/TorJok.PI!tr, W32/Encoder!tr, W32/Encoder.B!tr, W32/Malicious_Behavior.SBX, MSIL/Filecoder.PI!tr.ransom, W32/SelfDel.PI!tr

Web Filtering Activity


Meet Khalesi! – FortiGuard Labs Web Filtering team has observed Khalesi, an infostealing Trojan during the end of August 2018. Discovered by researchers, this malware is associated with the KPOT malware campaign. Khalesi variants used in this campaign were compiled with a Visual Basic 6 (VB6) compiler, while others were compiled using a Portable Executable (PE) compiler. The malware is capable of stealing Windows and browser credentials, credit card information, virtual coins, and data from messaging apps. The malware also collects a variety of data from various sources on the affected systems by communicating with a command and control (C2) domain. All of the IPs are located in Eastern Europe, and FortiGuard Labs Web Filtering team has blacklisted all the related IOCs.

Indicator(s):
seeyouonlineservice[.]com
botsphere[.]biz
174[.]138[.]48[.]29
80[.]233[.]248[.]109

 

Source : https://fortiguard.com/resources/threat-brief/2018/11/02/fortiguard-threat-intelligence-brief-november-02-2018

 

Prečo si vybrať nás?

Dôveryhodnosť

Na trhu pôsobíme už od roku 2008 a našu dôveryhodnosť potvrdzujú partnerstvá popredných spoločností v oblasti IT a hlavne množstvo spokojných zákazníkov, ktorí využívajú naše služby. Nie sme nováčikom a vieme, čo vaša IT infraštruktúra potrebuje a radi vám to ponúkneme. O našej kvalite hovorí aj certifikácia systémov manažérstva podľa normy ISO 9 001.

Profesionalita

Bezpečnosť vašich dát nedokáže chrániť len tak niekto. Obráťte sa teda na profesionálneho partnera. Naše bohaté skúsenosti potvrdzujú školenia, ktoré naši zamestnanci absolvujú pravidelne, aby vám vedeli vždy poskytnúť adekvátne rady a zabezpečiť tak plynulý a ničím nerušený chod vašej infraštruktúry. Sme vlastníkom certifikácie 27 001, takže vaše dáta sú u nás v bezpečí.

Efektivita

Neponúkame vám riešenia, ktoré sú pre vás zbytočné, len aby sme na vás zarobili. Našim cieľom nie je nanútiť vám robustné riešenie, ktoré budete využívať na minimum, no zároveň návrh štruktúry berieme vážne aj s ohľadom na prípadné plány rozvoja vašej spoločnosti. Prioritou pre nás je vaša spokojnosť a bezpečnosť vašich dát.

Referencie

Slovak Telekom, a.s.
Správa služieb diplomatickému zboru, a.s.
PosAm, spol. s r.o.
Ministerstvo školstva, vedy, výskumu a športu SR
Motor-Car Group
UPC BROADBAND SLOVAKIA s.r.o.

Kontakt


ReFoMa, s.r.o.
Dolné Rudiny 1
010 01 Žilina, Slovakia

+421 41/202 88 80 – sekretariát
+421 41/202 88 81 – technická podpora
+421 41/202 88 82 – obchodné oddelenie
IČO: 43892345
DIČ: 2022541378
IČ DPH: SK2022541378
Okresný súd Žilina, odd.: Sro, vl. číslo 20197/L

Bankové spojenie (IBAN):
SK13 1100 0000 0026 2582 3735