꿈 꾸는 사람

Gh0st RAT 3.78은 Gh0st RAT - Bot간 Gh0st 통신 시, 기존 Gh0st Protocol 형식에

zlib + Data 부분을 xor하여 전송하게 된다. 

기존 78 9c (zlib) 기준으로 생성된 패턴으로 탐지가 불가하므로 이에 확인 필요

78 9c가 아닌 다른 값을 가지고 있어서 확인해보니... 

XOR 하는 부분이 존재한다. 이는 기존 snort 및 보안 장비 우회를 위해 변형한 것으로 보인다.

-- 2014. 10. 30

Gh0st RAT 3.78은 사용자가 임의로 XOR Key 값을 지정할 수 있으며

해당 Key 값은 byte마다 적용되는데 적용되는 범위는 통신 상 payload 길이에 따라 달라질 수 있다.

사례 참고 : http://blog.sucuri.net/2014/09/quick-analysis-of-a-ddos-attack-using-ssdp.html

http://blog.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/page=8

Flow는 아래와 같다.

-------------------------------------------------------------------------------------------------------------

1. 공격자는 취약한 UPnP 디바이스를 확인하기 위해 M-Search 패킷을 네트워크에 전송한다.

2. 취약한 UPnP 디바이스로부터 M-Search 패킷을 응답받는데, 디바이스의 Location, Description, UUID 값을 받는다.

3. 공격자는 취약한 디바이스 리스트를 수집하고 타겟에 위변조 반사 패킷 유발을 위해 악성 패킷 (Malicious) 요청을 하게 된다.

(response 패킷의 크기의 사이즈는 디바이스의 Description의 내용에 따라 달라진다. )

-------------------------------------------------------------------------------------------------------------

정상과 동일한 트래픽 이라면 어떻게 방어를 할 수 있을까?

ATM 악성 코드 출현

1) msxfs.dll 을 이용하기 위해 system32 하위에 해당 파일을 찾는다.

2) msxfs.dll (Extension for Financial Services) 로 알려진 라이브러리로 오직 ATM이 설치된 호스트에만 존재

3) 번역 예정

4) 원문 (기사 출처 : http://www.pcworld.com/article/2824572/leaked-programming-manual-may-help-criminals-develop-more-atm-malware.html)

A leaked programming manual for interacting with the physical components of automated teller machines might have helped attackers create malware programs that were used to steal cash from ATMs in various parts of the world this year.

Security researchers from antivirus vendor Kaspersky Lab reported Tuesday that at least 50 ATMs in Eastern Europe and elsewhere have been infected with a malware program dubbed Tyupkin that can be controlled through the machines’ keypads to dispense bills stored in their cassettes. It’s believed that Tyupkin was used to steal millions, but it’s not the first threat of its kind.

In October 2013 security researchers from Symantec warned about an ATM backdoor program dubbed Ploutus, which was used to steal money in Mexico. In May theydocumented another ATM Trojan, dubbed Padpin, that’s very similar to Tyupkin.

Eighteen ATMs were infected with malware in Malaysia recently, allowing criminals to steal 3 million Malaysian Ringgit, or over US$900,000, according to a local media report. It’s not clear which malware program was used in the attack, but Padpin is one of the possibilities.

Security researchers from F-Secure analyzed Padpin samples recently and determined that the malware is designed to interact with a particular DLL library known as Extension for Financial Services (XFS) that only exists on ATMs. The library, called MSXFS.dll, provides a special API (application programming interface) that enables software to communicate with an ATM’s PIN pad. According to researchers from the Kaspersky Lab, Tyupkin also uses MSXFS.dll.

“Analyzing the code, we started wondering how the malware author knows which pin pad service name to provide to the API so that the program is able to interact with the pin pad device,” the F-Secure researchers said in a blog post, noting that Microsoft doesn’t provide any official documentation for this library’s functions. “It’s a valid question because the pin pad service name used in the code is quite unique and it is very unlikely one can figure out the service name without documentation.”

The answer was eventually found in a programmer’s reference manual from NCR, a U.S. manufacturer of ATMs, point-of-sale devices and self-service kiosks, that was posted on an ebook site owned by Chinese online search company Baidu.

It’s possible that this manual was uploaded by someone other than Pinpad’s authors and that the malware was created by programmers experienced in writing ATM applications. However, the leaked document could allow others to easily create ATM malware, according to the F-Secure researchers.

After skimming through the documentation, the researchers concluded that writing a program that interacts with ATMs would be easy even for someone with no prior knowledge about how to write software communicating with the devices. “The documentation is helpful enough to give programmers some sample code as well,” the researchers said.

Unlike credit card skimming, the theft of money from ATMs via malware does not directly impact consumers, as the losses are incurred by the financial institutions that own the compromised machines. There are methods to prevent such attacks since they require physical access to the ATMs—like changing the default locks on the machines, disabling their internal CD-ROMs and USB ports or installing additional alarm systems.

In the past, banks might have weighed the cost of locking down ATMs against the actual probability of those machines being attacked and concluded that the risk was acceptable. However, if the number of attacks using malware like Tyupkin, Padpin or Ploutus increases, as security researchers predict, then financial institutions might be forced to reconsider their ATM security practices.