Infrastructure Security

1. Infrastructure Security

Increasingly Malicious PUAs
In this report, we discuss increasingly malicious PUAs, and following on from our last report we cover actual
usage cases for ID management technology, as well as initiatives for bolstering its security. We also look at theIOCs for malware that reprograms HDD firmware.

1.1 Introduction
This report summarizes incidents to which IIJ responded, based on general information obtained by IIJ itself related to thestable operation of the Internet, information from observations of incidents, information acquired through our services, andinformation obtained from companies and organizations with which IIJ has cooperative relationships. This volume covers
the period of time from January 1 through March 31, 2015. In this period a number of hacktivism-based attacks were once
again carried out by Anonymous and other groups, and there was a rash of attacks including SNS account hijackings andwebsite defacements. There were also a large number of information leaks due to unauthorized access. It has been pointed
out that the personal information of up to 80 million people may have leaked in an incident that occurred at a health insurer
in the United States. An issue was also discovered in software pre-installed on PCs. This could potentially allow encrypted
Web browser communications to be intercepted by a third party, or fraudulent websites to be recognized as legitimate. These
examples show that many security-related incidents continue to occur on the Internet.

1.2 Incident Summary
Here, we discuss the IIJ handling and response to incidents that occurred between January 1 and March 31, 2015. Figure 1
shows the distribution of incidents handled during this period*1.
Other 30.4%

Vulnerabilities 28.6%

n The Activities of Anonymous and Other Hacktivists
Attacks by hacktivists such as Anonymous continued during
this period. DDoS attacks and information leaks occurred atgovernment-related and corporate sites in a large numberof countries stemming from a variety of situations andHistory 1.3%

causes. In January, a number of Massachusetts Instituteof Technology (MIT) websites were defaced in memoryof an activist who committed suicide the year before
last. Similarly, in the Philippines a number of government

Political andSocial Situation 0.9%

Security Incidents 38.8%

websites were defaced in protest against a firefight that took
place between Police and an armed group on Mindanao

Figure 1: Incident Ratio by Category (January 1 toMarch 31, 2015)*1

Island in January. In February, DDoS attacks were made on
multiple Saudi Arabian banks in protest against the Saudi

Incidents discussed in this report are categorized as vulnerabilities, political and social situations, history, security incidents or other.
Vulnerabilities: Responses to vulnerabilities associated with network equipment, server equipment or software commonly used over the Internet or inuser environments.
Political and Social Situations: Responses to incidents related to domestic and foreign circumstances and international events such as international
conferences attended by VIPs and attacks originating in international disputes.
History: Historically significant dates; warning/alarms, detection of incidents, measures taken in response, etc., related to attacks in connection with apast historical fact.
Security Incidents: Unexpected incidents and related responses such as wide propagation of network worms and other malware; DDoS attacks against
certain websites.
Other: Security-related information, and incidents not directly associated with security problems, including highly concentrated traffic associated with anotable event.

4Army also continued, with affected companies including French newspaper Le Monde. Other attacks by hacktivists suchas Anonymous continued on government and government-related websites around the world. There were also ongoinghijacking incidents targeting the SNS accounts of government institutions and celebrities.
In addition, there have been a rash of attacks such as SNS account hijackings perpetrated worldwide by those claiming
affiliation with ISIL or associated organizations. During the current survey period, in January there were incidents in which
the official Twitter and YouTube accounts of the U.S. Central Command were hijacked, and the website of Malaysia Airlines

Infrastructure Security

Arabian Royal Family (OpSaudi). SNS account hijackings by unknown attackers claiming affiliation with the Syrian Electronic

was redirected to another website via DNS hijacking*2. Alterations to websites, including those for a number of companies
in Japan, also garnered attention in March. These website alterations are thought to have been caused by attacks exploitinga WordPress plug-in vulnerability*3. Because attacks similar to these alteration incidents are occurring worldwide and notjust in Japan, in April the FBI also issued an alert in the United States*4. In contrast, there were attacks thought to be carriedout by Anonymous on Islamic extremist sites in response to a shooting at a weekly newspaper in France (OpCharlieHebdo),
and attacks that resulted in the publishing of a list of ISIL-related accounts on SNS such as Twitter and Facebook, as well as
account suspensions and the deletion of previous posts (OpISIS). There are also ongoing activities involving the publishingof lists of VPN and websites thought to be connected to ISIL and their hosting companies, with the intent of having them shut
down or deleted.
n Vulnerabilities and their Handling
During this period, fixes were released for Microsoft’s Windows*5*6*7 and Internet Explorer*8*9. Fixes were also released
for Adobe Systems’ Adobe Flash Player. A quarterly update was provided for Oracle’s Java SE, fixing many vulnerabilities.
Several of these vulnerabilities were exploited in the wild before patches were released.
Regarding server applications, a quarterly update was released for a number of Oracle products, including the Oracle
database server, fixing many vulnerabilities. A vulnerability in the BIND9 DNS software that could cause abnormal
operations or service outages on servers under specific conditions due to an issue with the management of DNSSEC trust
anchors was fixed. A number of vulnerabilities that could allow the bypass of ACL rules or cause abnormal termination
through the use of specially-crafted packets were fixed in the ntpd program used for time synchronization. A vulnerability
that could cause the abnormal termination of applications through a buffer overflow was fixed in the GNU C Library (glibc)
included in Linux distributions, etc. It was announced that there was also a vulnerability in SSL/TLS implementations that
could allow encrypted information to be decrypted through MITM attacks exploiting implementations that accept weak
RSA keys of 512 bits or less, which were used due to U.S. encryption export restrictions in the 1990s. This vulnerability
was fixed in OpenSSL*10.
Google’s Project Zero caused a stir when it announced it was possible to elevate privileges using DRAM errors caused byinterference between memory cells when they are accessed due to the high density of cells (the rowhammer problem). A
scheduled semiannual update for Cisco’s IOS was also released, fixing a number of vulnerabilities that could lead to DoS
attacks and memory leaks.

*2

Malaysia Airlines, “Media Statement on Malaysia Airlines’ Website” (http://www.malaysiaairlines.com/my/en/corporate-info/press-room/2015/mediastatement-malaysia-airlines-website.html).

*3

National Police Agency, “Alert regarding website defacements by those claiming affiliation with ‘Islamic State (ISIS)’” (http://www.npa.go.jp/cyberpolice/*4

The Internet Crime Complaint Center (IC3), “ISIL DEFACEMENTS EXPLOITING WORDPRESS VULNERABILITIES” (https://www.ic3.gov/media/2015/*5“Microsoft Security Bulletin MS15-002 - Critical: Vulnerability in Windows Telnet Service Could Allow Remote Code Execution (3020393)” (https://*6“Microsoft Security Bulletin MS15-010 - Critical: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution (3036220)” (https://detect/pdf/20150312.pdf) (in Japanese).
150407-1.aspx).
technet.microsoft.com/library/security/ms15-002).
technet.microsoft.com/library/security/ms15-010).
*7“Microsoft Security Bulletin MS15-011 - Critical: Vulnerability in Group Policy Could Allow Remote Code Execution (3000483)” (https://technet.microsoft.
com/library/security/ms15-011).

*8“Microsoft Security Bulletin MS15-009 - Critical: Security Update for Internet Explorer (3034682)” (https://technet.microsoft.com/library/security/ms15-009).

*9“Microsoft Security Bulletin MS15-018 - Critical: Cumulative Security Update for Internet Explorer (3032359)” (https://technet.microsoft.com/library/
security/ms15-018).

*10“OpenSSL Security Advisory [08 Jan 2015] DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)” (https://www.openssl.org/news/
secadv_20150108.txt).

5

Infrastructure Security

January Incidents
1

S 1st: A number of incidents occurred in which malware was distributed via an ad distribution system used on news sites in Canada and the U.S.
Details can be found in the following Cyphort blog post. “HuffingtonPost Serving Malware via AOL Ad-Network”(http://www.cyphort.com/huffingtonpost-serving-malware/).

2

V 9th: A number of vulnerabilities in OpenSSL that could cause service outages or allow arbitrary code execution were discovered and fixed.
“DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)” (https://www.openssl.org/news/secadv_20150108.txt).

3

O 9th: Microsoft announced they would no longer give an overview of their scheduled monthly security update program in advance via blog
posts and the Web.
“Evolving Microsoft’s Advance Notification Service in 2015” (http://blogs.technet.com/b/msrc/archive/2015/01/08/evolving-advancenotification-service-ans-in-2015.aspx).

4
5

O 9th: The Japanese government established a Cyber Security Strategic Headquarters based on the enactment of the Bill on Cyber Security.
They also set up the National center of Incident readiness and Strategy for Cybersecurity, a renaming of the National Information Security
Center, as an organization to serve as the government’s command post for cyber security.
“Regarding establishment of the National center of Incident readiness and Strategy for Cybersecurity”(http://www.nisc.go.jp/press/pdf/reorganization.pdf) (in Japanese).

67
8

O 12th: President Obama announced a number of legislative proposals aimed at increasing protection of personal information, such as arequirement that companies notify their customers of information leaks within 30 days of them being discovered.
Whitehouse.gov, “FACT SHEET: Safeguarding American Consumers & Families”(https://www.whitehouse.gov/the-press-office/2015/01/12/fact-sheet-safeguarding-american-consumers-families).

910

S 13th: An unknown party hijacked the Twitter (@CENTCOM) and YouTube accounts of the U.S. Central Command, and released a number offiles said to contain classified information.
It was later confirmed that the information in the released files was publically available. U.S. Central Command, “Statement from U.S. Central
Command Regarding Twitter/YouTube Compromise” (http://www.centcom.mil/en/news/articles/statement-from-u.s.-central-commandregarding-twitter-youtube-compromise).

1112

V 14th: Microsoft published their Security Bulletin Summary for January 2015, and released eight updates, including one critical update forMS15-002, as well as seven important updates.
“Microsoft Security Bulletin Summary for January 2015” (https://technet.microsoft.com/library/security/ms15-jan).

13

V 14th: A number of vulnerabilities in Adobe Flash Player that could allow arbitrary code execution were discovered and fixed.
“Security updates available for Adobe Flash Player” (http://helpx.adobe.com/security/products/flash-player/apsb15-01.html).

1415

S 19th: Tokyo Metropolitan University announced that the NAS used on its campus had been accessible from outside via FTP connection,
potentially exposing the personal information stored within.
“Regarding external access to NAS containing personal information at Tokyo Metropolitan University”(http://www.tmu.ac.jp/news/topics/8448.html?d=assets/files/download/news/press_150119.pdf) (in Japanese).

16
17
18

O 19th: ENISA published a collection of information covering formats, standards, and tools for sharing threat information between organizations.
“Standards and tools for exchange and processing of actionable information” (https://www.enisa.europa.eu/activities/cert/support/
actionable-information/standards-and-tools-for-exchange-and-processing-of-actionable-information).

V 21st: Oracle released their quarterly scheduled update for a number of products including Oracle, fixing a total of 169 vulnerabilities, including
19 in Java SE. Additionally, because support for Java 7 ended in April 2015, measures were taken to automatically update to Java 8 in cases
where the auto update function was enabled.
“Oracle Critical Patch Update Advisory - January 2015” (http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html).

1920

O 21st: The FBI issued a warning due to an increase in the damages caused by ransomware such as Cryptolocker and CryptWall.
FBI, “Ransomware on the RiseFBI and Partners Working to Combat This Cyber Threat” (http://www.fbi.gov/news/stories/2015/january/ransomware-on-the-rise).

21
22

V 23rd: A vulnerability in a number of ASUSTeK brand wireless LAN routers that could allow unintended actions to be carried out throughcross-site request forgery or OS command injection when a malicious website is viewed while logged in to the management screen was
discovered and fixed.
“Request to update to firmware that fixes a cross-site request forgery and OS command injection vulnerability in wireless LAN router products(http://www.asus.com/jp/News/PNzPd7vkXtrKWXHR) (in Japanese).

23
24

V 23rd: A vulnerability in Adobe Flash Player that could allow arbitrary code execution was discovered and fixed.
“APSB15-02: Security updates available for Adobe Flash Player” (http://helpx.adobe.com/security/products/flash-player/apsb15-02.html).

25

O 23rd: The Telecom Information Sharing and Analysis Center Japan held an exercise that anticipated a large-scale cyber attack oncommunications infrastructure, with 12 organizations including member ISPs and critical infrastructure providers participating.
“Exercise for anticipating a cyber attack on communications infrastructure [CAE2015: Cyber Attack Exercise]”(https://www.telecom-isac.jp/news/news20150120.html) (in Japanese).

26
27

V 25th: A vulnerability in Adobe Flash Player that could allow arbitrary code execution was discovered and fixed.
“APSB15-03: Security updates available for Adobe Flash Player” (https://helpx.adobe.com/security/products/flash-player/apsb15-03.html).

28

V 26th: A vulnerability was found in wired LAN routers sold in 2004 that could lead to them being used as stepping stones in SSDP reflection
attacks, and information on disabling the UPnP function in settings as a countermeasure was released.
JVN, “JVN#27142693 NP-BBRM vulnerable in UPnP functionality” (http://jvn.jp/en/jp/JVN27142693/).

29
30

V 28th: A vulnerability in the glibc library that could cause service outages or allow remote arbitrary remote code execution through a buffer
overflow was discovered and fixed.
“Qualys Security Advisory CVE-2015-0235 GHOST: glibc gethostbyname buffer overflow”(https://www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txt).

31[Legend]V

Vulnerabilities*Dates are in Japan Standard Time

6

S Security Incidents

P Political and Social Situation

H

HistoryO

Other

During the current survey period, a number of vulnerabilities in home routers were discovered and fixed. Several of thesevulnerabilities could have allowed a third party to gain administrator privileges for the router without authorization, orchange settings arbitrarily. Vulnerabilities that could allow a router to be exploited as a stepping stone in DrDoS attacks*11
were also discovered and fixed. Past attacks targeting home routers that exploited vulnerabilities include incidents that
occurred in Brazil and other countries in 2011. In these incidents, router DNS settings were rewritten so that DNS servers
prepared by the attacker were referenced, redirecting users to fraudulent sites*12. Similar attacks have also taken place more
recently. For example, in March there were reports of an incident in which ads were distributed by exploiting the URL for a

Infrastructure Securityn Attacks Targeting Home Routers

Web access analysis service*13. In Japan, there was an incident in which a provider was arrested for operating a proxy serverused for unauthorized access in 2014. In this incident, it is thought that a vulnerability in home routers that was fixed in 2012
was exploited to obtain PPPoE authentication IDs and passwords unlawfully.
Unlike PCs, which are updated regularly, users tend to neglect to check the settings for home routers and update the firmware
once they are set up. Consequently, even when a vulnerability is fixed, it may remain unpatched for a long time afterwards.
It is expected that attacks targeting network devices such as home routers that are not managed properly in this way willcontinue to occur in the future. That means it will be necessary to manage these devices appropriately by confirming settings
regularly and checking whether updated firmware has been released.
n Unauthorized Login Through Identity Fraud
Since last year there have been many attempts to steal user IDs and passwords, and log in without authorization presumably
using lists of these IDs and passwords. These attempts continued in the current survey period. Attacks have targeted avariety of websites, such as loyalty program sites, newspaper-related sites, and ISP support sites. In some cases these
attacks resulted in monetary damages, such as the exchange of reward points without authorization.
n Information Leaks Due to Unauthorized AccessInformation leaks caused by unauthorized access also continue to occur. In January the website of a professional sports
association in Japan was compromised, resulting in the leak of approximately 20,000 pieces of internal photo data. In
February, there was an incident in which information on up to 80 million people, including past and present customers
and employees, leaked from a U.S. health insurer after its internal database was accessed without authorization. In March,
ICANN (Internet Corporation for Assigned Names and Numbers) was once again compromised, leading to suspensionof the new gTLD system. Furthermore, in February there was an incident of unauthorized access at a domain registrar inJapan, causing damages such as the leak of the administrator information registered at the time of domain registration.
In this incident, the company affected announced it would not resume service due to it being difficult to carry out in atimely manner, and they instead prompted customers to transfer domains to other operators*14. During the current survey
period there were also malware infections and associated information leaks at a number of companies, including a trading
company and a newspaper publisher. In these incidents, it was announced there were traces of client information andemail content being sent to external parties from PCs infected through fraudulent email, which misrepresented the senderand had malware attached.
n Government Agency Initiatives
Government agency initiatives included the January enforcement of the Act on Cyber Security that was passed last year,
and the establishment of the Cyber Security Strategic Headquarters. The National Information Security Center was also
reorganized into the National center of Incident readiness and Strategy for Cybersecurity. Additionally, the first general
meeting of the Cyber Security Strategic Headquarters was held in February. At this meeting, new cyber security strategy
for determining the details of future activities and basic policy for cyber security measures was discussed. In March, a billto amend the Act on the Protection of Personal Information was approved by the Japanese cabinet. This bill is aimed at
protecting personal information while also enabling the creation of new industries and services through promoting the*11

See ”1.4.2 DrDoS Attacks and Countermeasures” in Vol.23 of this report (http://www.iij.ad.jp/en/company/development/iir/pdf/iir_vol23_EN.pdf) for
more information.

*12

For more information, see the following IIJ-SECT blog post, “Home Routers Reference Fake DNS Server due to Unauthorized Configuration Changes”(https://sect.iij.ad.jp/d/2012/06/148528.html) (in Japanese).

*13

Ara Labs Technology, “Ad-Fraud Malware Hijacks Router DNS – Injects Ads Via Google Analytics” (http://aralabs.com/2015/03/25/ad-fraud-malwarehijacks-router-dns-injects-ads-via-google-analytics/).

*14

Telework Communications Co., Ltd., “Apology and report regarding the leak of customer information” (http://www.ariqui.net/) (in Japanese).

7

Infrastructure Security

February Incidents
1

V 1st: A researcher at a security company in the U.K. announced there was a universal cross-site scripting (XSS) vulnerability with no fix
available in Microsoft’s Internet Explorer 11.

2
3

S 2nd: A large-scale DoS attack targeting a specific domain took place over a number of days, causing outages on multiple DNS servers in Japan.

4

V 4th: Vulnerabilities in ntpd were discovered and fixed. These could allow the bypass of ACL rules via IP address spoofing (CVE-2014-9298), or

5cause information leaks and abnormal termination through the use of specially-crafted packets (CVE-2014-9297).
US-CERT, “Vulnerability Note VU#852879 NTP Project Network Time Protocol daemon (ntpd) contains multiple vulnerabilities (Updated)”(http://www.kb.cert.org/vuls/id/852879).

6

S 4th: The man suspected of being behind the Remote Control Virus incident in 2013 received a prison sentence of eight years.

7

S 5th: U.S. health insurer Anthem announced a database containing information on around 80 million current and former customers andemployees had been compromised.
Anthem, “How to Access & Sign Up For Identity Theft Repair & Credit Monitoring Services” (https://www.anthemfacts.com/).

8
9
10
11

V 6th: A number of vulnerabilities in Adobe Flash Player that could allow arbitrary code execution were discovered and fixed.
“APSB15-04: Security updates available for Adobe Flash Player” (https://helpx.adobe.com/security/products/flash-player/apsb15-04.html).

O 6th: IPA published “10 Major Security Threats for the Year 2015.”“10 Major Security Threats for the Year 2015.” (https://www.ipa.go.jp/security/vuln/10threats2015.html) (in Japanese).

1213

O 10th: The Japanese government held the 1st general meeting of the Cyber Security Strategic Headquarters, where discussions were held
regarding establishing cyber security strategies for the comprehensive and effective promotion of cyber security measures.
“1st General Meeting (February 10, 2015)” (http://www.nisc.go.jp/conference/cs/index.html#cs01) (in Japanese).

14
15

V 11th: Microsoft published their Security Bulletin Summary for February 2015, and released nine updates, including three critical updates forMS15-009, MS15-010, and MS15-011, as well as six important updates.
“Microsoft Security Bulletin Summary for February 2015” (https://technet.microsoft.com/library/security/ms15-feb).

16
17

O 13th: In the United States, an executive order calling for information sharing between government agencies and private-sector businesses toprotect against cyberspace threats and system breaches came into effect.
Whitehouse.gov, “FACT SHEET: Executive Order Promoting Private Sector Cybersecurity Information Sharing”(https://www.whitehouse.gov/the-press-office/2015/02/12/fact-sheet-executive-order-promoting-private-sector-cybersecurity-inform).

18
19
20

O 18th: Microsoft announced it had established a Japan satellite of its Cybercrime Center for researching cybercrime countermeasures, andindicated that it intended to provide information and technical support to customers including government agencies and companies.
“‘Microsoft Cybercrime Center - Japan Satellite’ established to reinforce cyber security initiatives in Japan”(http://news.microsoft.com/ja-jp/2015/02/18/150218-cybercrimecenter-japan/) (in Japanese).

21
22
23

V 19th: A vulnerability was discovered and fixed in BIND9. This vulnerability could cause abnormal operations or service outages on servers due
to an issue with the implementation of exception handling for the auto update of trust anchors.
Internet Systems Consortium, “CVE-2015-1349: A Problem with Trust Anchor Management Can Cause named to Crash”(https://kb.isc.org/article/AA-01235).

24
25

S 20th: A number of issues were discovered and fixed in software pre-installed on PCs that could allow MITM attacks or fake websites withfalsified certificates.
See the following Lenovo announcement for more information about this incident. “SuperFish Vulnerability”(http://support.lenovo.com/us/en/product_security/superfish).

26
27

O 20th: The Information Technology Promotion Agency, Japan (IPA) issued an alert regarding problems with unintended information leaks
through the use of Web services, such as information that users enter into a translation service website being published on the Internet.
“Press Release [Alert] Beware of unintended information leaks regarding data entered into cloud services”(http://www.ipa.go.jp/about/press/20150220.html) (in Japanese).

28

S 25th: Europol’s European Cybercrime Center (EC3) announced that the Ramnit botnet had been taken down in a joint operation with a numberof security vendors such as Microsoft and Symantec.
“Botnet taken down through international law enforcement cooperation”(https://www.europol.europa.eu/content/botnet-taken-down-through-international-law-enforcement-cooperation).
[Legend]V

Vulnerabilities*Dates are in Japan Standard Time

8

S Security Incidents

P Political and Social Situation

H

HistoryO

Otherpersonal information, the bill defines personal information more clearly, and establishes rules regarding the handling of datathat is anonymized and cannot be reconstructed into personal information. It also prescribes the creation of a third-party
Personal Information Protection Committee with authority to monitor and supervise the handling of personal information.
Furthermore, in response to information leaks, penalties for the unauthorized supply or theft of data from a database containing
personal information were increased, including the establishment of the Crime of Supplying Personal Information Databases.
This cabinet decision also included an amendment to the systems for promoting the use of specific personal information(information including personal identity numbers), expanding the scope of usage for personal identity numbers in fields such

Infrastructure Security

utilization of personal data, and improving the safety and security of citizens. To contribute to the protection and utility ofas finance and health care.
n Issues with Software Pre-Installed on PCs
During this survey period, issues with software preinstalled on Lenovo PCs received widespread attention. This software,
which was installed on PCs shipped between September 2014 and January 2015 when this practice stopped, was so-calledadware, and contained functions for inserting and displaying ads in a user’s browser screen. One particularly problematic
behavior it exhibited was that it could even insert ads into encrypted SSL/TLS communications, because it installed selfsigned certificates to the local certificate store. A number of other issues were also identified, such as the fact that theencryption method for these installed certificates was not sufficiently strong, and the private key for the installed certificates
was included in software, exposing it. In relation to these issues, alerts were issued after it was revealed that the sameproblems affected a number of other software programs using the same SDK, as this SDK was actually the root cause*15.
Lenovo made these issues public and took measures including the release of a tool for removing this software. After dealing
with the problem together with security vendors and other organizations, they reported that the number of affected PCs
had decreased*16. However, a U.S. nonprofit organization among others has pointed out that efforts to intercept user
communications such as this threaten the privacy and security of users*17.
n Other
In January, a number of incidents occurred in which malware was distributed via an ad distribution system used on newssites in Canada and the U.S. It has been identified that these attacks exhibited similar properties to attacks redirecting users
to malware sites via fake ads on YouTube that occurred in October 2014*18. Attacks using ad distribution systems such asthese are also known as malvertising. In Japan, there were incidents in which ad distribution servers used by a number of
media outlets and news sites were altered through unauthorized access in 2010*19, and similar incidents have been confirmed
since. In addition to alterations, there have also been frequent cases in which users were redirected to malware sites using
legitimate ad spots. This is recognized as an efficient method for making large numbers of malware infections possible. We
expect that attacks exploiting ad distribution systems like this will continue to occur, so ongoing vigilance is required.
One initiative said to be necessary to improve cyber attack response capabilities is information sharing between thegovernment and citizens, as well as between private companies. However, it has been pointed out that sharing informationon threats such as attacks between different organizations or companies is difficult when the handling of said information,
including what kind of information is required and which should be shared, is not clearly defined. The U.S. nonprofit
organization MITRE Corporation (MITRE)*20 is leading moves to develop the STIX (Structured Threat Information eXpression)
description specification using XML. The objective of this specification is to structuralize information on threats such as
cyber attacks, aiding their analysis, identification of characteristic events, response management, and information sharing.
IPA has published an “Outline of the STIX Format for Structuring and Describing Threat Information,” which provides an
explanation of this specification*21.

*15

US-CERT, “Vulnerability Note VU#529496 - Komodia Redirector with SSL Digestor fails to properly validate SSL and installs non-unique root CA*16

Microsoft Malware Protection Center, “MSRT March: Superfish cleanup” (http://blogs.technet.com/b/mmpc/archive/2015/03/10/msrt-march-superfish-certificates and private keys” (http://www.kb.cert.org/vuls/id/529496).
cleanup.aspx).
*17

Electronic Frontier Foundation (EFF), “Dear Software Vendors: Please Stop Trying to Intercept Your Customers’ Encrypted Traffic” (https://www.eff.org/
deeplinks/2015/02/dear-software-vendors-please-stop-trying-intercept-your-customers-encrypted).

*18

Trends Micro Security Intelligence Blog, ”YouTube Ads Lead To Exploit Kits, Hit US Victims” (http://blog.trendmicro.com/trendlabs-security-intelligence/
youtube-ads-lead-to-exploit-kits-hit-us-victims/).

*19

MicroAd, Inc., “Problem Report: Apology and report regarding alterations on our services” (http://www.microad.co.jp/news/information/detail.
php?newid=News-0118) (in Japanese).

*20

MITRE Corporation (http://www.mitre.org/).

*21

IPA, “Outline of the STIX Format for Structuring and Describing Threat Information” (http://www.ipa.go.jp/security/vuln/STIX.html) (in Japanese).

9Infrastructure Security

March Incidents
1

S 3rd: An incident occurred in which the website of an airport company was compromised by an unknown party, and altered to redirect visitors
to another website.
Narita International Airport Corporation, “Apology for Shutdown of Narita Airport Website & Explanation”(http://www.narita-airport.jp/en/news/150305.html).

23

V 4th: A vulnerability in TLS/SSL protocols that could allow MITM attacks under certain circumstances was discovered and fixed. This4

vulnerability was caused by weak RSA encryption from the period when the U.S. restricted encryption exports.
See the following explanation by the discoverer for more information about the attack method. “FREAK: Factoring RSA Export Keys”(https://www.smacktls.com/#freak).

5

S 7th: It was discovered that the µTorrent BitTorrent client software was installing Bitcoin mining software without users’ permission.
See the following µTorrent user forum post for information on the circumstances surrounding this problem. “Warning: EpicScale “riskware”
installed with latest uTorrent” (http://forum.utorrent.com/topic/95041-warning-epicscale-riskware-installed-with-latest-utorrent/).

67

V 10th: It was announced it was possible to elevate privileges using DRAM errors caused by interference between memory cells when they are

8accessed due to the high density of cells (the rowhammer problem).
See the following Google Project Zero announcement for more details. “Exploiting the DRAM rowhammer bug to gain kernel privileges”(http://googleprojectzero.blogspot.in/2015/03/exploiting-dram-rowhammer-bug-to-gain.html)

9

O 10th: Following cabinet approval of a bill to amend the Act on the Protection of Personal Information and Number Use Act, the government
submitted this bill to the Diet.
Cabinet Secretariat, Bill for Submission to the Diet at the 189th Regular Diet Session “Legislative Bill to Amend Part of the Act on theProtection of Personal Information and Act on the Use of Numbers to Identify a Specific Individual in the Administrative Procedure”(http://www.cas.go.jp/jp/houan/189.html) (in Japanese).

10
11
12
13

V 11th: Microsoft published their Security Bulletin Summary for March 2015, and released 14 updates, including five critical updates such as
MS15-018, as well as nine important updates.
“Microsoft Security Bulletin Summary for March 2015” (https://technet.microsoft.com/library/security/ms15-mar).

S 11th: A number of websites in Japan were defaced in incidents thought to have exploited a WordPress vulnerability.
National Police Agency, “Regarding the defacement of websites by parties claiming affiliation with ‘Islamic State (ISIS)’”(http://www.npa.go.jp/keibi/biki/201503kaizan.pdf) (in Japanese).

1415

O 12th: The National Police Agency made an announcement regarding the state of cyberspace threats in 2014. While there was a drop in thenumber of arrests for cybercrimes, prefectural police received more inquiries at their consultation counters than the previous year, reaching arecord-high number. The techniques used also became more devious and sophisticated, and it is stated that the number and total damages ofillegal remittance crimes related to Internet banking were the worst they have ever been.
“Report on Cyberspace Threats for 2014” (http://www.npa.go.jp/kanbou/cybersecurity/H26_jousei.pdf) (in Japanese).

16
17

O 12th: IPA published a revised 7th edition of “Building Secure Websites,” which summarizes points for developers and operators to take into
consideration to prevent unintended damages such as information leaks or alterations affecting websites.
The revised content included the addition of measures regarding a number of attacks such as password list attacks. “How to Secure Your
Website” (https://www.ipa.go.jp/security/vuln/websecurity.html) (in Japanese).

18
19
20
21

V 13th: A number of vulnerabilities in Adobe Flash Player that could allow arbitrary code execution were discovered and fixed.
“APSB15-05: Security updates available for Adobe Flash Player” (https://helpx.adobe.com/security/products/flash-player/apsb15-05.html).

O 17th: The National Diet Library issued their “Problems with Information and Communications” and “Information and Communications
Technology Promotion and Cyber Security” research reports. These summarize the current state and issues of policy regarding informationand communications, as well as the growing problem of cyber security.
“2015-3-17 Research reports ‘Aspects of Information and Communication’ and ‘Advances in Information and Communication Technology andCyber Security’ (Japanese) published.” (http://www.ndl.go.jp/en/news/fy2014/1209642_2113.html).

22
23
24

S 18th: GreatFire.org, which provides information on the status of blocked sites in China, announced it was being targeted by a large-scale
DDoS attack.
See the following GreatFire.org blog post for more information about this attack, “We are under attack”(https://en.greatfire.org/blog/2015/mar/we-are-under-attack).

25
26

V 26th: Cisco released a scheduled semiannual update for IOS, incorporating a total of seven fixes to issues that could lead to DoS attacks orcause memory leaks.
“Cisco Event Response: March 2015 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication”(http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar15.html).

27
28

S 26th: U.S. company GitHub was targeted in a large-scale DDoS attack that spanned several days.
See the following GitHub announcement for more information, “Large Scale DDoS Attack on github.com”(https://github.com/blog/1981-large-scale-ddos-attack-on-github-com).

2930

O 31st: IPA published “Effective Vulnerability Countermeasure Procedures (Practical Edition),” which summarizes advice regarding the collectionof vulnerability information and utilization of such information to deal with vulnerabilities effectively.
“IPA Technical Watch ‘Effective Vulnerability Countermeasure Procedures (Practical Edition)’”(http://www.ipa.go.jp/security/technicalwatch/20150331.html) (in Japanese).

31[Legend]V

Vulnerabilities*Dates are in Japan Standard Time

10

S Security Incidents

P Political and Social Situation

H

HistoryO

Other

that JavaScript on a Chinese search service provider may have been altered by an unknown party when accessed fromoutside China so that it could be used in these attacks*23.
Also in March, there was an incident in which certificates for a number of Google domains were issued without authorization
by an intermediate certificate authority in Egypt. These certificates were each revoked on major browsers. In this incident, it
is said the only confirmation of the validity of an application for a certificate was a check to see whether an email address atthe domain name the certificate was for could be contacted. Additionally, after learning that the confirmation of application

Infrastructure Security

In March, U.S. company GitHub was targeted in a large-scale DDoS attack that spanned several days *22. It has been identified

validity upon issue was lacking at a number of certificate authorities in this way, an alert was issued*24.

1.3 Incident Survey
1.3.1 DDoS Attacks
Today, DDoS attacks on corporate servers are almost a daily occurrence, and the methods involved vary widely. However,most of these attacks are not the type that utilizes advanced knowledge such as that of vulnerabilities, but rather cause large
volumes of unnecessary traffic to overwhelm network bandwidth or server processes for the purpose of hindering services.
n Direct Observations
Figure 2 shows the circumstances of DDoS attacks handled by the IIJ DDoS Protection Service between January 1 andMarch 31, 2015.
This information shows traffic anomalies judged to be attacks based on IIJ DDoS Protection Service standards. IIJ also
responds to other DDoS attacks, but these incidents are excluded from the figure due to the difficulty in accurately ascertaining
the facts of each situation.
There are many methods that can be used to carry out a DDoS attack, and the capacity of the environment attacked (bandwidthand server performance) will largely determine the degree of impact. Figure 2 categorizes DDoS attacks into three types:
attacks on bandwidth capacity*25, attacks on servers*26, and compound attacks (several types of attacks on a single target
conducted at the same time).
Compound Attacks
Bandwidth Capacity Attacks
Server Attacks(No. of Attacks)

14
12
10
8
6
4
2
0
2015.1.1

2015.2.1

2015.3.1(Date)

Figure 2: Trends in DDoS Attacks*22

See the Sophos Naked Security blog post, “Greatfire.org faces daily $30,000 bill from DDoS attack” (https://nakedsecurity.sophos.com/2015/03/20/
greatfire-org-faces-daily-30000-bill-from-ddos-attack/) for more information about this attack.

*23

See the following report for more information on this attack method. “Using Baidu 百度 to steer millions of computers to launch denial of service attacks”(https://drive.google.com/file/d/0ByrxblDXR_yqeUNZYU5WcjFCbXM/view).

*24

US-CERT, “Vulnerability Note VU#591120 - Multiple SSL certificate authorities use predefined email addresses as proof of domain ownership” (http://
www.kb.cert.org/vuls/id/591120)*25

Attack that overwhelms the network bandwidth capacity of a target by sending massive volumes of larger-than-necessary IP packets and fragments. The
use of UDP packets is called a UDP flood, while the use of ICMP packets is called an ICMP flood.

*26

TCP SYN flood, TCP connection flood, and HTTP GET flood attacks. TCP SYN flood attacks send mass volumes of SYN packets that signal the start of TCP
connections, forcing the target to prepare for major incoming connections, causing the wastage of processing capacity and memory. TCP connection
flood attacks establish mass volumes of actual TCP connections. HTTP GET flood attacks establish TCP connections on a Web server, and then send mass
volumes of HTTP GET protocol commands, wasting processing capacity and memory.

11

Infrastructure Security

During the three months under study, IIJ dealt with 384 DDoS attacks. This averages to 4.27 attacks per day, indicating an
increase in the average daily number of attacks compared to our prior report. Server attacks accounted for 69.3% of allincidents, while compound attacks accounted for 23.4%, and bandwidth capacity attacks 7.3%. The largest attack observed
during the period under study was classified as a compound attack, and resulted in 2.83 Gbps of bandwidth using up to
1,179,000 pps packets.
Of all attacks, 82.6% ended within 30 minutes of commencement, 17.4% lasted between 30 minutes and 24 hours, and none
lasted over 24 hours. The longest sustained attack was a compound attack that lasted for ten hours and 37 minutes.
In most cases, we observed an extremely large number of IP addresses, whether domestic or foreign. We believe this isaccounted for by the use of IP spoofing*27 and botnet*28 usage as the method for conducting DDoS attacks.
n Backscatter Observations
Next we present our observations of DDoS attack backscatter using the honeypots*29 set up by the MITF, a malware activity
observation project operated by IIJ*30. By monitoring backscatter it is possible to detect some of the DDoS attacks occurringon external networks as a third party without any interposition.
For the backscatter observed between January 1 and March 31, 2015, Figure 3 shows the sender’s IP addresses classified bycountry, and Figure 4 shows trends in packet numbers by port.
CA 20.3%

Other 17.7%

IT

1.3%

RU 2.3%DE 2.8%
BR 3.2%NL 4.8%KR 5.3%

US 18.4%

FR 9.6%CN 14.3%

Figure 3: DDoS Attack Targets by Country According to
Backscatter Observations(No. of Packets)
80,00070,00060,000other
22/TCP
27015/UDP
443/TCP
411/TCP
25565/TCP
25/TCP
2710/TCP
6667/TCP
53/UDP
80/TCP

50,00040,00030,00020,00010,00002015.1.1

2015.2.1

2015.3.1(Date)

Figure 4: Observations of Backscatter Caused by DDoS Attacks (Observed Packets, Trends by Port)*27

Misrepresentation of a sender’s IP address. Creates and sends an attack packet that has been given an address other than the actual IP address of theattacker to make it appear as if the attack is coming from a different location, or from a large number of individuals.

*28

A “bot” is a type of malware that institutes an attack after receiving a command from an external C&C server. A network constructed of a large numberof bots acting in concert is called a botnet.

*29

Honeypots established by the MITF, a malware activity observation project operated by IIJ. See also “1.3.2 Malware Activities.”*30

The mechanism and limitations of this observation method, as well as some of the results of IIJ’s observations, are presented in Vol.8 of this report (http://
www.iij.ad.jp/en/company/development/iir/pdf/iir_vol08_EN.pdf) under “1.4.2 Observations on Backscatter Caused by DDoS Attacks.”

12

for 38.2% of the total during the target period. This was followed by 53/UDP used for DNS at 31.8%, so the top two ports
accounted for 70% of the total. Attacks were also observed on 6667/TCP used for IRC (Internet Relay Chat), 25/TCP used for
SMTP, and 443/TCP used for HTTPS, as well as the typically unused 2710/TCP, 25565/TCP, and 27015/UDP.
Examining the daily average number of packets for the 53/UDP communications observed often since February 2014, we cansee there is still an upward trend, with it rising to around 6,200 from around 3,900 in the previous survey period.

Infrastructure Security

The port most commonly targeted by the DDoS attacks observed was the 80/TCP port used for Web services, accounting

Looking at the origin of backscatter thought to indicate IP addresses targeted by DDoS by country in Figure 3, Canada
accounted for the largest ratio at 20.3%. The United States and China followed at 18.4% and 14.3%, respectively.
Regarding particularly large numbers of backscatter packets observed, there were attacks on the Web servers (80/TCP) for ahosting provider in Canada on between January 21 and January 26. From March 20 continued attacks on this provider wereobserved, focusing on a number of websites related to a game made in China. Additionally, attacks were observed on a U.S.
hosting provider between March 4 and March 9. Regarding attacks on other ports, between January 22 and January 25 there
were attacks on 25/TCP targeting a game-related site in France.
Notable DDoS attacks during the current survey period that were detected via IIJ’s observations of backscatter included
attacks on a Finnish financial institution group between January 1 and January 4, and attacks on Islamic extremist sites
carried out by Anonymous on January 11 (OpCharlieHebdo). Attacks on GitHub were also detected between March 27 andMarch 29. Regarding these attacks on GitHub, because the reported attack method does not generate backscatter, we knowthat another method was also used at the same time.

1.3.2 Malware Activities
Here, we will discuss the results of the observations of the MITF*31, a malware activity observation project operated by IIJ. The
MITF uses honeypots*32 connected to the Internet in a manner similar to general users in order to observe communications
arriving over the Internet. Most appear to be communications by malware selecting a target at random, or scans attempting
to locate a target for attack.

*31

An abbreviation of Malware Investigation Task Force. The Malware Investigation Task Force (MITF) began activities in May 2007, observing malware
network activity through the use of honeypots in an attempt to understand the state of malware activities, to gather technical information for
countermeasures, and to link these findings to actual countermeasures.

*32

A system designed to simulate damages from attacks by emulating vulnerabilities, recording the behavior of attackers, and the activities of malware.

13

Infrastructure Securityn Status of Random Communications
Figure 5 shows the distribution of sender’s IP addresses by country for communications coming into the honeypots
between January 1 and March 31, 2015. Figure 6 shows trends in the total volumes (incoming packets). The MITF has set
up numerous honeypots for the purpose of observation. We have taken the average per honeypot, showing the trends forincoming packet types (top ten) over the entire period subject to study. Additionally, in these observations we corrected
data to count multiple TCP connections as a single attack when the attack involved multiple connections to a specific port,such as attacks on MSRPC.
Much of the communications arriving at the honeypots demonstrated scanning behavior targeting TCP ports utilized byMicrosoft operating systems. We also observed scanning behavior targeting 1433/TCP used by Microsoft’s SQL Server,
22/TCP used for SSH, 23/TCP used for Telnet, 8080/TCP used for HTTP-proxy, ICMP echo requests, 80/TCP and 443/TCP
used for HTTP, and 3389/TCP used for RDP. The increase in communications targeting Telnet (23/TCP) since November inthe previous survey period continued until February. Upon investigation, we learned that this was mainly received from IP
addresses allocated to China and Japan. Between February 17 and February 20, there was a spike in communications frommany IP addresses allocated to countries such as China, the United States, Hong Kong, Taiwan, and Russia. Most of thesecommunications were scanning behavior attempting to find SSH, Telnet, or proxy servers. Between March 21 and March 23,
there was an increase in communications from a large number of IP addresses allocated to countries including China and theUnited States, and this followed a similar trend.
n Malware Network Activity
Figure 7 shows the distribution of the specimen acquisition source for malware during the period under study, while Figure 8
shows trends in the total number of malware specimens acquired. Figure 9 shows trends in the number of unique specimens.
In Figure 8 and Figure 9, the number of acquired specimens show the total number of specimens acquired per day*33,
while the number of unique specimens is the number of
Outside Japan 92.9%

Within Japan 7.1%

specimen variants categorized according to their digest

IIJ 2.0%

of a hash function*34. Specimens are also identified using

BR

1.1%

ISP A 0.9%

anti-virus software, and a breakdown of the top 10 variants

NL

1.2%

ISP B 0.9%

FR

1.3%

ISP C 0.3%

is displayed color coded by malware name. As with our

DE

1.9%

ISP D 0.3%

KR

2.1%

ISP E 0.3%

RU

2.7%

ISP F 0.3%

TW 3.4%

ISP G 0.2%

HK

7.5%

ISP H 0.2%

US 21.3%

ISP I 0.2%

CN 32.9%

Other 1.5%

Other 17.5%

previous reports, for Figure 8 and Figure 9 we have detected
Conficker using multiple anti-virus software packages, andremoved any Conficker results when totaling data.

Figure 5: Sender Distribution (by Country, Entire Period
under Study)(No. of Packets)
2,000
(954)

1,800
1,600
1,400

other
80/TCP
3389/TCP
8080/TCP
443/TCPICMP Echo request
1433/TCP
135/TCP
22/TCP
445/TCP
23/TCP

1,200
1,000
800
600
400
200
0
2015.1.1

2015.2.1

2015.3.1(Date)

Figure 6: Communications Arriving at Honeypots (by Date, by Target Port, per Honeypot)*33

This indicates the malware acquired by honeypots.

*34

This figure is derived by utilizing a one-way function (hash function) that outputs a fixed-length value for various input. The hash function is designed to
produce as many different outputs as possible for different inputs. While we cannot guarantee the uniqueness of specimens by hash value, given that
obfuscation and padding may result in specimens of the same malware having different hash values, the MITF has expended its best efforts to take thisfact into consideration when using this methodology as a measurement index.

14

investigating the undetected specimens more closely, they included worms observed from IP addresses allocated tocountries such as China, the United States, India and Taiwan. Additionally, about 49% of undetected specimens were in text
format. Because many of these text format specimens were HTML 404 or 403 error responses from Web servers, we believe
this was due to infection behavior of malware such as old worms continuing despite the closure of download websites that
newly-infected PCs access to download malware.
Under the MITF’s independent analysis, during the current period under observation 94.3% of malware specimens acquired

Infrastructure Security

On average, 87 specimens were acquired per day during the period under study, representing 19 different malware. After

were worms, 2.3% were bots, and 3.4% were downloaders. In addition, the MITF confirmed the presence of 105 botnet C&C
servers*35 and 14 malware distribution sites. The number of botnet C&C servers continues to rise sharply as seen in theprevious survey period, but this was due to the appearance of a specimen that used a DGA (Domain Generation Algorithm)
during the current survey period.

Outside Japan 99.5%

Within Japan 0.5%

n Conficker Activity
Including Conficker, an average of 19,434 specimens were

Other 26.1%

ISP A 0.2%

VE

3.1%

ISP B 0.2%

ID

3.9%

Other 0.1%

RU

4.0%

HK

4.6%

BR

4.8%

total number of specimens acquired, and 97.0% of unique

IN

6.9%

CN

7.3%

specimens. This demonstrates that Conficker remains the

EG

7.6%

US

9.1%

acquired per day during the period covered by this report,
representing 608 different malware. While figures rise andfall over short periods, Conficker accounts for 99.5% of themost prevalent malware by far, so we have omitted it fromfigures in this report. Compared to the previous survey

TW 22.1%

period, the total number of specimens acquired increased

Figure 7: Distribution of Acquired Specimens by Source(by Country, Entire Period under Study,
Excluding Conficker)

by approximately 19% during the period covered by thisreport, and the number of unique specimens increased by(Total No. of Specimens Acquired)
400
350
300
other
Trojan.Agent-230163
Trojan.Downloader-73594
Trojan.Agent-173287
Trojan.Agent-71049
Trojan.Dropper-20380
Trojan.Spy-78857
Trojan.Agent-71068
Trojan.Dropper-18535
NotDetected
Empty file

250
200
150
100
50
0
2015.1.1

2015.2.1

2015.3.1(Date)

Figure 8: Trends in the Total Number of Malware Specimens Acquired (Excluding Conficker)(No. of Unique Specimens)
90
80
70
other
Trojan.Agent-71068
Worm.Allaple-2
Worm.Allaple-306
Trojan.Downloader-73594
Win.Trojan.Agent-171842
Win.Trojan.Agent-827451
Worm.Allaple-307
Trojan.Spy-78857
Trojan.Dropper-18535
NotDetected

60
50
40
30
20
10
0
2015.1.1

2015.2.1

2015.3.1(Date)

Figure 9: Trends in the Number of Unique Specimens (Excluding Conficker)*35

An abbreviation of Command & Control Server. A server that provides commands to a botnet consisting of a large number of bots.

15

Infrastructure Security

about 9%. According to the observations of the Conficker Working Group*36, as of April 3, 2015, a total of 707,844 unique
IP addresses are infected*37. This indicates a drop to about 22% of the 3.2 million PCs observed in November 2011, but it
demonstrates that infections are still widespread.

1.3.3 SQL Injection Attacks
Of the types of different Web server attacks, IIJ conducts ongoing surveys related to SQL injection attacks*38. SQL injection
attacks have flared up in frequency numerous times in the past, and remain a major topic in Internet security. SQL injections
are known to occur in one of three attack patterns: those that attempt to steal data, those that attempt to overload databaseservers, and those that attempt to rewrite Web content.
Figure 10 shows the distribution of SQL injection attacks against Web servers detected between January 1 and March 31,
2015. Figure 11 shows trends in the numbers of attacks. These are a summary of attacks detected by signatures on the IIJManaged IPS Service.
China was the source for 90.8% of attacks observed, while the United States and Japan accounted for 2.5% and 2.3%,
respectively, with other countries following in order. There was a dramatic increase in the number of SQL injection attacks
against Web servers compared to the previous report. This was mainly due to a significant spike in attacks from China, withseveral large-scale attacks occurring.
During this period, attacks from multiple attack sources in China directed at specific targets took place on February 13. On
February 16, attacks were also made from a number of other sources directed at multiple targets. Between February 20
and February 23, there were large-scale attacks from a number of sources in China against multiple targets. One of these
attack targets was also attacked from another source in China between March 27 and March 30. Attacks on this target
accounted for 66.3% of the overall attacks that occurred
Other 1.4%

CN 90.8%

BR 0.2%during this survey period. Attacks were made from multiple
sources, with over 400,000 attacks observed from a single

FR 0.2%

attack source in more than one case. Because most of theDE 0.2%
0.3%

companies targeted by attacks were connected to finance,

UK 0.3%

it is believed that these were large-scale attempts to findSA 0.9%vulnerabilities on Web servers of the financial industry.

IT

NL 0.9%JP 2.3%

As previously shown, attacks of various types were properly

US 2.5%detected and dealt with in the course of service. However,attack attempts continue, requiring ongoing attention.
Figure 10: Distribution of SQL Injection Attacks by Source(No. Detected)(795,256) (758,498)

500,000
450,000(602,536)(271,783)(327,910)(299,166)

400,000
350,000

Other
HTTP_GET_SQL_Select_CountHTTP_POST_SQL_Select_CountHTTP_GET_SQL_UnionAllSelectHTTP_GET_SQL_UnionSelect
SQL_Injection_Declare_Exec
HTTP_GET_SQL_Convert_Int
HTTP_GET_SQL_WaitForDelay
HTTP_POST_SQL_WaitForDelay
HTTP_POST_SQL_Convert_Int
SQL_Injection

300,000
250,000(421,129)200,000(394,484)(300,962)

150,000
100,000
50,00002015.1.1

2015.2.1

2015.3.1(Date)

Figure 11: Trends in SQL Injection Attacks (by Day, by Attack Type)*36

Conficker Working Group Observations (http://www.confickerworkinggroup.org/wiki/pmwiki.php/ANY/InfectionTracking).

*37

For some reason Conficker Working Group data appears to be missing between March 28 and April 2, 2015, so we have cited data for April 3, 2015 thatshould not be affected.

*38

Attacks accessing a Web server to send SQL commands, thereby manipulating an underlying database. Attackers access or alter the database content
without proper authorization, and steal sensitive information or rewrite Web content.

16Here we indicate the status of website alterations as surveyed through the MITF Web crawler (client honeypot)*39.
This Web crawler accesses tens of thousands of websites on a daily basis, with a focus on well-known and popular sites inJapan. We also add new target sites on a regular basis. In addition to this, we temporarily monitor websites that have seen
short-term increases in access numbers. By surveying websites thought to be viewed frequently by typical users in Japan, it
is easier to speculate on trends regarding fluctuations in the number of altered sites, as well as the vulnerabilities exploitedand malware distributed.

Infrastructure Security

1.3.4 Website Alterations

The number of drive-by download attacks observed between January and March 2015 continued the declining trend seen in
the October to December 2014 period, and fell by around another 10 percent (Figure 12). In January in particular, almost no
activity was observed. Additionally, following an increase in attack numbers from the latter half of February, there tended to
be sharp drops in the number of attacks detected during weekends. As for the composition of attacks, the majority consistedof either Nuclear, which we have been detecting since we began operating this Web crawler, or Neutrino, which had notdetected since February 2014*40. Each of these exploit kits, like many of the other exploit kits that are popular recently, isequipped with functions for exploiting Flash vulnerabilities (such as CVE-2014-0515, CVE-2014-0569, CVE-2015-0313, andCVE-2015-0336), and functions for exploiting new vulnerabilities are added at a fast pace*41. In most cases, the websites
altered to redirect visitors were observed intermittently acting as a redirection source over an extended period (more than
three months). Regarding trends in content, the sites observed included those that introduce adult video content, as well as
websites for small and medium-scale content providers. These trends remain unchanged.
Overall, although the incidence rate for drive-by downloads was very low, it can be said that it is now in a slight uptrend.
Because Nuclear and Neutrino that were commonly observed in this survey period have been linked to Operation
Windigo*42*43, attacker groups may wield a comparatively large amount of potential power. It is recommended that all parties
continue to exercise caution. Website operators should ensure that measures against the alteration of web content are inplace, and visitors should stay up to date with measures against vulnerabilities in browsers or related plug-ins (Flash Player
in particular).
(%)
0.006
0.005
0.004
0.003
Other
SweetOrange
FiestaAnglerNuclear
Neutrino

0.002
0.001
0
2015.1.1

2015.2.1

2015.3.1(Date)*Covers several tens of thousands of sites in Japan. In recent years, drive-by downloads have been configured to change attack details and whether or not attacks are made based on the clientsystem environment or session information, source address attributes, and the quota achievement status of factors such as number of attacks. This means that results can vary wildly at times
depending on the test environment and circumstances.

Figure 12: Rate of Drive-By Download Incidence When Viewing Websites (%) (by Exploit Kit)

*39

See “1.4.3 Website Defacement Surveys Using Web Crawlers” in Vol.22 of this report (http://www.iij.ad.jp/en/company/development/iir/pdf/iir_vol22_*40

The Neutrino Exploit Kit spread like wildfire in Japan and internationally from around October 2013, but gradually died down, and this Web crawler had

EN.pdf) for an explanation of Web crawler observation methods.
not detected it since February 2014. That said, in November 2014 the release of a new version was reported in an article titled, “Neutrino : The come back!
(or Job314 the Alter EK)” (http://malware.dontneedcoffee.com/2014/11/neutrino-come-back.html).
*41

For example, in “CVE-2015-0336 (Flash up to 16.0.0.305) and Exploit Kits” (http://malware.dontneedcoffee.com/2015/03/cve-2015-0336-flash-up-to1600305-and.html), it is reported that a vulnerability disclosed on March 12, 2015, was confirmed to be exploited by Nuclear on March 19, and by Neutrino
on April 2.

*42

Large-scale attack activity disclosed in the ESET white paper, “OPERATION WINDIGO” (http://www.welivesecurity.com/wp-content/uploads/2014/03/
operation_windigo.pdf). It is reported that since 2011, more than 25,000 servers have been compromised and exploited to send spam or redirect clients.

*43

Regarding connections to Operation Windigo, see “HAPPY NUCL(Y)EAR - EVOLUTION OF AN EXPLOIT KIT” (http://community.websense.com/blogs/
securitylabs/archive/2015/01/15/evolution-of-an-exploit-kit-nuclear-pack.aspx) for more information on Nuclear, and “Exploit Kit Evolution - Neutrino”(https://isc.sans.edu/diary/Exploit+Kit+Evolution+ - +Neutrino/19283) for more information on Neutrino.

17

Infrastructure Security

1.4 Focused Research
Incidents occurring over the Internet change in type and scope from one minute to the next. Accordingly, IIJ works toward
implementing countermeasures by continuing to perform independent surveys and analyses of prevalent incidents. Here wewill present information from the surveys we have undertaken during this period regarding increasingly malicious PUAs, ID
management technology, and evaluation of the IOCs of malware that reprograms HDD firmware.

1.4.1 Increasingly Malicious PUAs
PUA is an abbreviation of Potentially Unwanted Application, and refers to software that is either not needed by users in
the first place, or that includes some inappropriate functions despite being beneficial overall. They are also known as PUPs
(Potentially Unwanted Programs). Adware that forcibly inserts advertising while the software is being used is sometimes
treated as a type of PUA as well. Although some PUAs appear to be harmless and simply provide legitimate functions at
first glance, there are also malicious PUAs that acquire information on user behavior and send it to external sources foruse in advertising, etc., without the user being aware. Additionally, in recent years there has been an increasing number ofmalicious PUAs that use techniques similar to malware, tricking users into installing PUAs, using them to steal information,
and also installing other PUAs, altering Web content, and elevating privileges by bypassing UAC. In this report, we examine
the results of IIJ’s recent analysis of a number of PUAs, and discuss the techniques they used.
n Defining PUAs
The strict definition of a PUA differs even among experts. That is because going by the literal definition, all programs withfunctions that are unwanted by users can be considered PUAs, regardless of whether or not they are malicious. Whether
a program is unwanted by a user varies based on factors such as their attitude, point of view, situation, and environment.
Consequently, here we will define PUAs as all unwanted programs installed in addition to software a user intended to
install, despite having no relation to it. We will refer to examples among these that use techniques similar to malware as
malicious PUAs.
n Examples of Malicious PUAsn Intrusion RouteAttackers often manipulate Web search engine results in advance through techniques such as SEO poisoning*44 to redirect
users to fraudulent sites. For example, when searching for a certain piece of software you want to download by entering thesoftware’s name and version along with keywords such as “download,” there have been cases in which a fraudulent site
is displayed with a higher ranking than the original distribution site. In other cases, fraudulent distribution sites are mixed
in with the ads displayed together with the search results.
Though these closely resemble
download buttons, they are actually
ads that either trigger an automatic
download or redirect users to
fraudulent sites.

Correct download button

Download

Version: Latest
OS: WindowsXP / Vista / 7 / 8Languages: English
License: Free

(Software name)
Download
xxx2-1-1.exe

Another ad

Download Manager
Downloadable at our website
Free download
Size: 547 kb
Version: 2.3.02

Web browser
Screenshot or

The fraudulent sites that users are redirected to sometimes
feature domain names and designs that resemble famous
download sites, making it harder to identify them as
fraudulent. There have also been fake download buttons
that induce users to download malicious PUAs amongst theads on the Web pages of a number of well-known download
sites. Figure 13 shows a sample design for a download site.
There are multiple ad-based fraudulent download buttons
mixed in with others, so users unfamiliar with the website
will be unlikely to know which is the real download button.

(Software name)

Furthermore, several well-known download sites use theirxxx-download.example.com

software description, etc.

Download the latest
Japanese version for free>Figure 13: E xamples of Fake Download Buttons (Ads)
Inserted into Download Sites*44

SEO (Search Engine Optimization) poisoning is a technique for displaying a page you have prepared higher than it normally would be ranked by using thesearch engine optimization algorithm to intentionally manipulate search results. It was originally a marketing technique, but now it is also used to cause
harm to users through malware infections, etc.

18

cases PUAs are bundled in with these tools. There are also cases in which download sites offer installers bundled with PUAs
after obtaining permission from individual software creators.
n PUA Implementation Framework
Some PUAs that users are induced to download are individual pieces of adware, but in other cases they have been downloader
programs that go on to install multiple PUAs. In one example, a diverse range of additional PUAs were downloaded, with thenumber and type varying from one minute to the next. This is thought to indicate that the person who built the PUA framework

Infrastructure Security

own dedicated download tool, and have users download the software they want to install through this tool. However, in some

was running a pay-per-install*45 operation, installing PUAs on user systems based on client requests for financial gain.
Downloader-type PUAs communicate with a C&C server periodically after they are installed, updating themselves anddownloading new PUAs. Additionally, in many cases PUAs also install the software users originally intended to install,making it harder for users to realize they have been deceived.
For installer-type PUAs, there are also cases in which designs that users find confusing are intentionally used to get users tounwittingly consent to install a PUA during the installation process. Figure 14 is an example of an adware installer design. It is
made to appear as the installer for the software the user wants to install, but the terms of license text refers to other adware,and this adware is installed in the background when the user clicks “CONTINUE”. Unless the user is paying close attention
during installation, they are deemed to have consented to installing the adware.
Some PUAs were installed without obtaining user consent. If PUAs like this are executed, even if the user rejected installationof the software shown, it will remain on the PC, and continue to download new PUAs and attempt to update itself. Some
additionally downloaded PUAs were also installed without obtaining user consent.
n Web Content Alteration
Some PUAs were run as Web browser plug-ins or
extensions, or the code for the PUA itself was injected into a
Web browser to hook the send and receive APIs, and hijack(Title of the software the user
originally intended to install)them to steal all the URLs a user had accessed. Ads basedUser consent form
(actually for adware)on these were then inserted into the Web content being

XXXXXXXXXXXXXXXXXXXX

viewed to alter it. Although the content inserted differs,

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

this is similar to banking Trojans such as ZeuS, SpyEye, and
Vawtrak*46 that use the WebInject technique*47. Softwarethat uses this type of attack method is also known as a Web

XXXXXXXXXXXXXXXXXXXX

declineCONTINUE

browser hijacker.
To reject the installation you mustclick decline, but a number of tricks
have been used to make this harder,
such as small text, unfamiliar terms,
and text that appears grayed out
and not clickable.

Although the button says
“CONTINUE”, clicking it at this point
will cause adware to be installed.

Figure 14: Example of PUA Installer Design*45

Pay-per-click reward affiliates are also called pay-per-access, with rewards determined based on the number of ads that are clicked. Similarly, pay-perinstall rewards are determined based on the number of software installations made. For example, if the client is a creator of adware that earns moneyby making users access affiliate sites repeatedly, having this adware installed on as many PCs as possible boosts their potential earnings. That is why
they send requests to organizations with this kind of framework. The consignee is believed to build frameworks like this because they receive a greater
financial reward from the client for inducing more installations. It is said this model has also been used with malware in recent years.

*46

See “1.4.3 ZeuS and its Variants” in Vol.16 of this report (http://www.iij.ad.jp/en/company/development/iir/pdf/iir_vol16_EN.pdf) for more information
on ZeuS. See “1.4.2 SpyEye” in Vol.13 of this report (http://www.iij.ad.jp/en/company/development/iir/pdf/iir_vol13_EN.pdf) for more information on
SpyEye. See “1.4.2 The Vawtrak Malware That Steals Authentication Information, etc. for Japanese Financial Institutions” in Vol.24 of this report (http://
www.iij.ad.jp/en/company/development/iir/pdf/iir_vol24_EN.pdf) for more information on Vawtrak. The Citadel variant of ZeuS with WebInject functions
is also detailed in “1.4.2 The Citadel Variant of ZeuS” in Vol.18 of this report (http://www.iij.ad.jp/en/company/development/iir/pdf/iir_vol18_EN.pdf).

*47

WebInject is a function for altering Web content in browser memory by setting hooks for the Web browser’s communication system API. Most banking
Trojan malware such as ZeuS and SpyEye have functions like this to deceive a user into entering additional information such as a passcode for twofactor authentication when the user logs in to a financial institution. The stolen authentication information is used to attempt to misappropriate funds. A
detailed explanation of WebInject can be found in IIR Vol.18 (http://www.iij.ad.jp/en/company/development/iir/018.html) under “1.4.2 The Citadel Variantof ZeuS,” or IIR Vol.13 (http://www.iij.ad.jp/en/company/development/iir/013.html) under “1.4.2 SpyEye.”

19

Infrastructure Security

Other techniques include installing a self-signed root certificate, and having the PUA itself act as a local proxy for HTTP(S),causing all communications from the Web browser to be sent to it. Certificates from Web servers are then intercepted,
altered, and signed using the root certificate that the PUA installed itself. Some variants discovered use this technique tointercept communications via a MITM*48 attack, and alter content by inserting ads, etc.
Both techniques enable alterations to even encrypted HTTP communications content without users noticing, so they are
extremely dangerous. There are also examples that operate as a Web browser toolbar, forcing the use of a search engine
provided by an adware supplier, and intercepting search keywords.
n Exploiting Windows Specifications
Malware such as PlugX*49 and Dridex*50 each use different techniques to bypass UAC*51 pop-ups, and are equipped withfunctions to automatically gain administrator privileges. A number of the PUAs we analyzed in this survey also incorporatedfunctions for elevating privileges in this way (most using the same method as Dridex). This is because it is necessary for a PUA
to gain administrator privileges to subsequently install multiple additional PUAs to the system folder without the user noticing.
n Obfuscation
A number of PUAs downloaded additional PUAs that were compressed using a custom format or obfuscated, and thesewere difficult to detect using IDS or IPS because they were not in executable format while traveling over the communications
route. Furthermore, the PUAs themselves also implemented code obfuscation or the obfuscation of key character strings,
making it harder to detect and analyze their characteristics.
n Anti-Sandbox Techniques
A number of PUAs were only added to the startup programs when installed, so they were not executed until the next time
the PC was rebooted. This behavior is designed to evade detection by sandbox products that use dynamic analysis for rapid
detection, and this same technique is used by some malware. Even when attempting to execute them manually or reboot
the PC directly after installation, although communications with the C&C server took place, they were configured to not
download new PUAs from the server immediately. Instead, new PUAs were downloaded after anywhere from a few days toseveral months had passed. This is also thought to be a technique for evading detection by sandboxes.

*48

A MITM (Man-In-The-Middle) attack is a technique in which the attacker interposes themselves between two communicating parties to steal*49

See “1.4.1 The PlugX RAT Used in Targeted Attacks” in Vol.21 of this report (http://www.iij.ad.jp/en/company/development/iir/pdf/iir_vol21_EN.pdf)

communications, decrypting them to intercept or alter the content without users noticing.
and the “I Know You Want Me - Unplugging PlugX” Black Hat Asia 2014 presentation (https://www.blackhat.com/docs/asia-14/materials/Haruyama/
Asia-14-Haruyama-I-Know-You-Want-Me-Unplugging-PlugX.pdf) for more information about PlugX. The elevation of privileges by bypassing UAC is also
discussed within.
*50

See the JPCERT/CC Analysis Center article, “The New UAC Bypass Method Used by Dridex” (https://www.jpcert.or.jp/magazine/acreport-uac-bypass.

*51

Windows versions from Windows Vista onward include a function called UAC (User Account Control) that disables key privileges under normalhtml) (in Japanese) for more information on the UAC bypass technique used by Dridex.
circumstances even when an account with administrator privileges is logged in. A pop-up prompting the user for permission is displayed when a program
performs a critical operation that changes the system, and privileges are only given if permission is granted. There are four levels of UAC control, butfrom Windows 7 onward Microsoft made the second highest of the four levels the default due to user requests (in Vista the highest level was the default).
At this level, a UAC popup is not displayed when Windows determines that an action was performed by a user, and privileges are elevated automatically.
In recent years, malware has exploited this specification in a number of attack methods that make actions appear as if they were performed by a user, so
administrator privileges are granted automatically without displaying a UAC pop-up.

20

Many malware specimens have functions for interfering with execution in a virtual environment or sandbox, and similarfunctions were also found in the PUAs we analyzed here. In particular, virtual environments such as Hyper-V, Xen, and KVM
that I have not seen when analyzing malware in the past were also detected. Detection was carried out using the WMI and
WBEM*52 functions to obtain BIOS information. In combination with other techniques, it is possible to detect almost all virtualenvironments, and systems that change the behavior of the PUAs to prevent execution upon detection were incorporated.
This is another way that they interfere with analysis.

Infrastructure Securityn VM Detectionn The Risk of PUA Infections at Organizations
The Web browser hijacker PUAs discussed here send all information such as the URLs of websites visited by users to an
external party. If an organization is infected with this kind of PUA, details such as Intranet server names, URL path information,
and GET parameters will also be leaked. This is undesirable from the perspective of protecting the internal information oforganizations such as companies.
Furthermore, there is a risk of malware being included among the additional programs installed by PUA frameworks. In
recent years there have also been cases in which ad sites themselves have been altered*53, leading to malware being installed
via drive-by downloads*54. The risk of infection through users being redirected to a malicious website when viewing an addisplayed by adware cannot be excluded. To avoid this situation, it is a good idea to carry out monitoring to prevent PUAs
or any software unwanted by the organization or user from being installed. You should also construct a system that enables
you to deal with infections swiftly if they are discovered.
n Countermeasures
To avoid being infected by malicious PUAs, users themselves must first become familiar with the official sites of the softwarethat they use. By always using only the official site, or legitimate mirror sites reached from there, it is possible to preventthe download of malicious PUAs from fraudulent websites. There is also the risk of downloading PUAs by clicking malicious
ads posing as download buttons, so techniques such as checking the hash values listed on the official site are one other way
of preventing people falling for this trick*55. Furthermore, it is always best to avoid installing software that has a dubious
reputation or is from an unreliable source without taking the proper precautions. If you are an administrator, it is a good idea
to consider granting users only general user privileges to prevent them installing software arbitrarily. In addition, becausesome software can be installed in user directories, you can stop users from downloading and using software freely byprohibiting the execution of programs outside the system directory and program files folder, via Windows functions such assoftware restriction policies or AppLocker.
Some well-known or pre-installed software may also attempt to install PUAs when they are installed or updated. Take care
not to click the “Next” button too quickly without reading the details.

*52

WBEM (Web-Based Enterprise Management) is a technical specification for managing distributed computing. It was drawn up by the DMTF (Desktop
Management Task Force) industry standards group. WMI is short for Windows Management Instrumentation, which is an implementation for managing
Windows using WBEM. WMI can perform tasks such as obtaining a variety of local and remote Windows information (all manner of information such as
hardware, software, OS, users, and processes), and changing the status.

*53

The attack technique in which an attacker alters an ad platform to set up an exploit within is called malvertising. Malvertising is a coined term thatcombines “malicious” and “advertising.” In many cases ad platforms distribute ads to multiple websites, and when they are altered it is possible to
distribute an exploit to all of these websites at once. Because this is efficient for attackers, in recent years these platforms have been targeted frequently.
There are also cases in which attackers themselves directly distribute ads for redirecting users to malware sites.

*54

Drive-by downloads cause malware infections by exploiting some kind of vulnerability when a user views Web content. If the computer used by the viewer*55

The importance of confirmation using hash values is discussed in detail under “1.4.3 Alteration of Software Distribution Packages” in Vol.10 of this report

is vulnerable, it is infected with malware merely by viewing the Web content.
(http://www.iij.ad.jp/en/company/development/iir/pdf/iir_vol10.pdf).

21

Infrastructure Security

Additionally, because there have been incidents in which adware has been found in software pre-installed on PCs, caution
must be exercised when procuring PCs. A number of manufacturers specify a list of pre-installed software, so refer to thiswhen selecting PCs. Furthermore, some manufacturers enable the customization of PCs for business use, so you can havethem shipped with the pre-installed software removed. Procuring PCs like this is one method to consider.
Other than that, it will also be necessary to implement similar measures as for malware, due to the possibility of vulnerabilities
being exploited to force installation*56. As we have discussed here, there are also malicious PUAs that exploit Windows
specifications to bypass UAC. For this reason, those managing PCs with an administrator account should look into raising
UAC to the highest level.

1.4.2 ID Management Technology: From a Convenience and Security Perspective
Continuing on from the previous report, here we will once again discuss ID (identity) management. We discussed IDs
under the narrow definition of identifiers, and took a look at the relationship between private token and public credential
information. We also examined the difference between authentication and authorization, and explained the process fromauthentication using tokens and circulation of the various credentials to finally granting access privileges. In this report, we
will talk about how these technologies are actually used, including some specific examples.
n ID and Token Variation
In the previous report, we explained the process by which an entity with an ID is authenticated to associate attributes andauthorization information with the corresponding ID, and issue credential information associated with them. At the time ofauthentication, tokens are used to guarantee the reliability of the entity with that ID. Because authentication is carried out for
an individual realm (valid areas of the authentication and authorization process), entities in each realm generally have ID andtoken pairs. In this report, we will present use cases in which ID and tokens are actually used.
In a realm there is an IdP (identity provider) that performs authentication-related tasks, and an entity in the said realm is
assigned a unique ID. This can be thought of as the registration screen you input the necessary details into when using
an online service for the first time. When registering, there is a “user ID” or similar field for entering an ID, and a check is
performed to ensure that the ID is not already in use by another user. On the other hand, there are cases in which a random
ID is assigned on the service side. In either case, personal data such as an email address or phone number is normally also
entered upon user registration. Registration is only provisional at this stage, so notification is sent along with a “challenge”
by way of an email to the email address entered or a short message to the phone number, and the user’s identity is confirmedby having them input the corresponding challenge. During provisional registration or input of the challenge, a password asa type of token is generally chosen. In this way, use of the service is possible once registration of the ID and password pairis complete.
There are now cases in which an email address is substituted rather than assigning an ID unique to a realm. This is done to
reduce the cost for managing IDs within a realm, and because it has the added benefit of avoiding situations where an ID
selected by the user, or in particular a random ID assigned by the IdP, is forgotten. When assigning IDs unique to a realm, it
is necessary to operate a Web page for providing ID reminders or resetting the password by prompting users to enter theemail address or phone number used to confirm their identity, and this increases the burden on the service side. Meanwhile,when using an email address as the ID, you must consider the fact that it may be targeted in list-based attacks. It could besaid that there is the same risk when identical IDs are reused on each realm. Of course, not reusing the same password is afundamental countermeasure against this, but the name binding or collation of leaked data due to IDs being identical is also arisk*57. Additionally, there have been cases in the past where the leak of private information has been caused by entering theemail address of an acquaintance on a reminder page for the input of IDs on an SNS or shopping site due to email addresses
being used as IDs. In light of these circumstances, we are now seeing systems that issue IDs unique to a realm, but also give
users the right to choose whether or not to use their email address during the login process.

*56

See Vol.21 of this report (http://www.iij.ad.jp/en/company/development/iir/pdf/iir_vol21_EN.pdf) at the end of “1.4.1 The PlugX RAT Used in Targeted
Attacks” for more information about malware infection countermeasures in client environments.

*57

This is of course not limited to ID-based name collation, as the threat of name collation through information such as the name or phone number enteredat the time of registration still remains.

22that they should be kept confidential. We will now examine the concept of using base IDs and derivative IDs as a way to deal
with this issue. When various portal sites or SNS sites are used as IdPs, there are cases in which the site provides a rangeof services with the same ID and token. In these cases, there are situations in which you want to change your perspective
based on the service, and you do not want it to be known that your words or actions are being made by the same entity. This
leads to the idea of treating the ID first assigned to you as your base ID, and deriving different IDs from it for each situationin which an ID is actually used. This serves as a simple way to prevent situations where, as mentioned previously, the leak of
the IDs is in itself a threat. When logging in using a derivative ID, a token associated with the base ID is used, eliminating theInfrastructure Security

This shows that although IDs were thought of as public information in the past, there are also cases where it is recognized

confusion of having to manage individual tokens for each derivative ID. It is also not necessary to re-enter the token whenlogging in again, making it possible to perform actions using different derivative IDs for each service by simply switching
between derivative IDs. One point that should be noted is that there may be cases where you forget which derivative ID you
are logged in under, leading to multiple activities by users that appear different from the perspective of a third party being
associated. For example, it is necessary to pay attention to information such as the nickname displayed when you log in.
The concept of derivative tokens can be considered similar to the idea of derivative IDs. This technique involves the use of abase ID and derivative token pair for authentication by linking a derivative token to a base ID separately from the base token.
When you think of this derivative token as a single-use token, it can also be considered as a type of one-time password.
As far as the actual purpose of this goes, one possible use could be saving derivative tokens for each application on asmartphone (this could include cases in which tokens are encrypted using a master password and stored, rather than using
the actual token itself). This would be a useful function in environments such as smartphones where password input isdifficult. This also has the benefit of limiting the damage caused if a password were to leak from a specific application and be
disclosed. Another advantage is that you only have to disable the derivative password, so the base password does not need
to be changed. From this perspective, you can think of it as delegation and can limit the scope of the authorization when aderivative token is used in comparison to the scope of the authorization for the base token. This enables you to minimize theimpact if the token leaks.
As this demonstrates, it is best to consider the balance between user convenience (forgetting IDs) and security (the reuseof IDs or leak of tokens). Furthermore, by expanding upon the concept of derivative IDs and tokens, authentication andauthorization systems that use neither base IDs nor base tokens are also possible, as shown in Figure 15. There are no
systems actually using a method like this right now, but a new approach like this may be implemented at some point basedon the future needs of users who place emphasis on protecting their privacy.
n One-Time Password Variation
Above we discussed variations regarding the use of IDs and tokens. Next we will examine one-time passwords, which are atype of token that is used once and then discarded. One-time passwords have mainly been used in Internet banking systems
up to this point, and they were seen as a secure authentication method. However, in February 2015, Japan’s National Police

Authentication

Authorization

ID (Identifier)

Token

Credential

Base Form
Authentication
Base Token

Derivative Token

Authorization
Base ID

Credential

Derivative ID

Figure 15: The Concept of Derivative Tokens and IDs

23

Infrastructure Security

Agency published case studies regarding illegal remittances in Internet banking for 2014*58, indicating that over 100 financial
institutions had incurred losses, and that damages were also on the increase. Particular attention was given to attacks
targeting corporate accounts that involve comparatively large remittance amounts, and an alert was issued*59. In addition
to methods that simply use a password, those that incorporate client authentication based on X.509 certificates (strong
authentication) have also been introduced for corporate Internet banking authentication, and these are known to provide
more security. However, when these digital certificates are used there have still been cases disclosed in which automatictransfers have been made from PCs or browsers infected with malware*60. This demonstrates that even authentication
methods using SSL/TLS client certificates are not sufficient.
Based on these circumstances, an effort is being made to improve the authentication methods used in Internet banking
systems. In the past, random number tables listed on paper or card were used, along with hardware devices that display a
one-time password. This latter case is an authentication method in which a temporary password is input at the same timeas the primary PIN number (a 4-digit number) that corresponds to the password used for authentication at ATMs, etc. Even
if the primary PIN number leaked, use of a one-time password that is discarded each time reinforces the identity verification
with particularly important processes, such as address changes or large remittances.
However, as shown by Man-in-the-Browser attacks*61 and MITM attacks, if banking system transaction details such as thedestination account number or transfer amount are re-written, illegal remittances are possible even when a disposable
one-time password is used. This demonstrates the problem of it being impossible for a user to explicitly confirm whether
or not a transaction is legitimate based on the information shown in the browser alone, even if authentication methods are
improved. There is an undeniable possibility that transactions may have actually been rewritten by an attacker. In responseto this problem, progress is being made towards migrating to the use of hardware devices equipped with an input device.
In the past, measures featuring the combined use of hardware devices during authentication have also been adopted at anumber of banking systems. However, because this hardware device was simply a one-time password generator with no
input interface, it could only be used to identify whether the user has the correct token, which has nothing to do with thetransaction at hand. In addition to the abovementioned use of X.509 certificates, corporate banking systems also incorporate
secondary measures such as only accepting transactions from specific IP addresses and PCs. However, because it is possiblethat the transactions a user sees have been rewritten, there is no fundamental countermeasure for Man-in-the-Browser
attacks. In other words, even with improved identity verification the countermeasures were ineffective.
In response, there were announcements from financial institutions in 2015 that they would start using one-time password
cards. Unlike previous devices, these new hardware devices have a keypad input interface, enabling identity verification
while also incorporating techniques that enable users to confirm the legitimacy of transactions that may have been rewritten.
The devices are not merely for outputting the one-time password during authentication like before. They feature functions
for generating and displaying one-time passwords that guarantee the correctness of account numbers, by having users
themselves input the account number they want to transfer money to. This prevents money being sent to the accountintended by an attacker, and by also recording the transaction log generated at this time, it is possible to automaticallycreate blacklists for the attacker’s accounts. Additionally, for user convenience, they can also be used as one-time password
generators with no input device. The technique is based on the assumption that accounts registered by users in advance aresafe, and omits the input of account numbers for transfers to these pre-registered accounts.

*58

National Police Agency, “Status of Incidents of Illegal Remittance Related to Internet Banking in 2014 (February 2015)” (http://www.npa.go.jp/cyber/pdf/
H270212_banking.pdf) (in Japanese).

*59

IPA, “Have you implemented sufficient countermeasures for illegal remittances in corporate Internet banking? (August 2014)” (https://www.ipa.go.jp/
files/000040703.pdf) (in Japanese).

*60

Trend Micro Security Blog, “Analyzing digital certificate theft attacks targeting corporate net banking” (http://blog.trendmicro.co.jp /archives /9417)*61

2nd Secure Systems Symposium - Hiromitsu Takagi and Hajime Watanabe, “The threat of Man-in-the-Browser and fundamental countermeasures”(in Japanese).
(https://www.risec.aist.go.jp/files/events/2014/0313-ja/risec-sympo2014-takagi.pdf) (in Japanese).

24the legitimacy of the transaction amount cannot be guaranteed. For accounts that large numbers of users register, such as
the account of an educational institution for receipt of tuition money, there is a possibility of business being obstructed byattacks that change the transaction amount during a specific short period of time. Secondly, there is the fact that the bank totransfer money to is not specified. In this case, if there was an account at another bank with the same account number under
the control of the attacker, there would be a risk of illegal remittance taking place. Either way, the fact that users only explicitly
confirm the account number is a problem. The more measures that are implemented, such as enabling users to explicitly
check transfer amounts and bank codes for transactions, the more data that users will input into the device. Regarding

Infrastructure Security

Now we will analyze the current state of these countermeasures. First of all, because only the account number is input,

this point, one potential solution is providing a range of options to select from based on how likely a user thinks it is thattransactions will be rewritten. This is based on the same approach as having a user choose whether or not they permit theuse of email addresses as IDs. With regard to this, it is also best to strike a balance between user convenience and security.
Additionally, a browser that implements FIDO Alliance’s Second Factor UX*62 has come onto the scene. This is a standard thatenables identity to be verified without entering a password, through use of a small hardware device via an interface such as
USB. Its use has spread since last year. However, if it becomes more mainstream, the following points will also be of concern.
Just as there are organizations that prohibit USB flash memory being brought on-site, the use of FIDO standard USB devices
may be restricted. Consequently, it is possible that products such as IC card based devices that are always carried whenentering rooms and require secure management like an employee ID card will appear. Currently, these identity verification
methods are in a transitional period. We are approaching the day where other tokens will be required in addition to simply“something you know” like a password. This will include tokens categorized as “something you have” or “something you are”.
This is the dawn of an age in which users can select powerful identity verification systems for important communications byimpairing convenience slightly.

1.4.3 Evaluating the IOCs of Malware That Reprograms HDD Firmware
On February 16, 2015, Kaspersky released information on an attack group called the Equation Group*63. The Equation Groupuse a variety of malware sets including EquationLaser, EquationDrug, DoubleFantasy, TripleFantasy, Fanny, and GrayFish. It
could be said that one of their unique characteristics is the fact that they use a module for reprogramming hard disk drives(HDD) that is embedded as a plug-in in EquationDrug and GrayFish. Kaspersky states that the functions of this module canbe used to sustain malware even after OS reinstallation or reformatting file systems. It is also able to generate invisible data
areas on an HDD, making it harder to detect or delete malware. IIJ has analyzed the initial behavior of this module*64, andevaluated indicators of compromise (IOCs)*65 for detecting its presence in memory.
n Overview of Initial Behavior
The module that reprograms HDD firmware (“nls_933w.dll”) is loaded by a DLL called Platform Orchestrator (mscfg32.
dll). After loading, mscfg32.dll calls a number of function addresses that nls_933w.dll exports, deobfuscates the character
strings, and performs initialization such as the copying of function addresses on the mscfg32.dll side, before executing thefunction that carries out the main processing.

*62

The FIDO Alliance (https://fidoalliance.org/specifications/overview/).

*63

Kaspersky Lab’s Global Research & Analysis Team (GReAT) published a report on the Equation Group. “EQUATION GROUP: QUESTIONS AND ANSWERS”(https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf).

*64

The MD5 hash value of the specimen is 11fb08b9126cdb4668b3f5135cf7a6c5.

*65

IOCs are traces indicating threats such as malware infections or incidents of compromise left behind on a network or device. See “1.4.2 The openioc_
scan Plug-in That Scans for Threats Lurking in Device Memory” in Vol.26 of this report (http://www.iij.ad.jp/en/company/development/iir/pdf/iir_vol26_
EN.pdf) for more information about IOCs in memory.

25

Infrastructure Security

A driver (win32m.sys) is first loaded from the resources in the function that carries out the main process of nls_933w.dll.
Subsequently, win32m.sys is controlled via the DeviceIoControl API to confirm the module version, and initialization suchas the clearing/setting of IO request handlers is carried out. If there are no issues, processing moves on to the queuing of IO
requests for issuing ATA commands.
During this queuing process, a command (IDENTIFY DEVICE) for obtaining HDD information is first sent to win32m.sys.
From the information obtained, details such as the serial number, firmware revision, and model number are checked, andthen a further command (INITIALIZE DEVICE PARAMETERS) may be sent depending on the model number. After this, if it isdetermined from the HDD information that the target can be reprogrammed, a command (DOWNLOAD MICROCODE) related
to firmware updates is sent.
n Evaluation of IOCs
As we stated initially, nls_933w.dll makes it difficult to detect and delete malware from an HDD. However, because the API ofthis DLL is required to access the hidden data space, the same DLL must at least exist in memory. Consequently, based on theinitial behavior detailed earlier, we will evaluate IOCs for detecting this DLL (and the drivers it loads) from a memory image.
First, we will look at IOCs specific to the detection of nls_933w.dll. IOCs that can be detected in both the DLL and the driver
include IoControlCode, which is specified in the DeviceIoControl API. This malware uses the six IoControlCodes shown in
Figure 16, and these can all be defined as IOCs using the AND condition.
Furthermore, defining the binary sequence comprised of the 6 byte structure in nls_933w.dll used to read and write ATA
device registers is also effective if only applied to the detection of nls_933w.dll. This structure consists of register offsets anddata to write, so for the command that obtains HDD information (IDENTIFY DEVICE), for example, the two binary sequencestructures shown in Figure 17 (a total of 12 bytes) exist in memory. Additionally, the module contains many structures that
include ATA commands, so these are defined using AND. Meanwhile, structures like these are not included on the driver side,
but one method to use could be defining the code sequence that parses these structures.
Next, we will evaluate generic IOCs for detecting malware with similar behavior, not limited to nls_933w.dll. The first thingthat comes to mind is the model numbers such as “Maxtor STM” and “WDC WD” that are used during the process ofidentifying HDD firmware. However, in the case of nls_933w.dll these are obfuscated, and after deobfuscation the strings areloaded onto the stack, so it could be said that they are difficult to find in valid memory space after the fact.
Other possible generic IOCs include the APIs used in the driver to read from or write to hardware ports or registers. For
example, an API called WRITE_PORT_UCHAR is used to write to the ATA device registers described earlier, and similar APIs
are also used based on the read or write size. It may be possible to detect drivers with functions like nls_933w.dll by defining
the imported APIs such as these using AND. However, generic definitions like this will result in a higher likelihood of false
positives occurring. Upon verifying detection using this definition with a number of 32-bit Windows XP and Windows 7
memory images, false positives occurred with a number of drivers on Windows 7*66. Consequently, we defined both thepreviously mentioned API group, as well as API groups related to other processing. Specifically, as shown in Figure 18, false
positives can be eliminated by also defining APIs related to IO request queuing (thread generation, DPC queuing).

Figure 16: IoControlCode Used by nls_933w.dll

*66

26

Figure 17: S tructures for the Command that Obtains HDD
Information (IDENTIFY DEVICE)

The specimens we obtained were actually not designed to enable the loading of drivers in Vista or later environments with UAC enabled.

that can be defined. Use of this definition alone is highly likely to result in false positives, so we recommend definition of thepreviously-mentioned API groups that are used via AND.
n SummaryIn this report, we demonstrated that there exist measures against malware that reprograms HDD firmware and hides data,
showing that detection within memory can be effective. Here we evaluated IOCs especially for detecting this malware, as
well as generic IOCs for detecting malware with similar functions*67. However, to produce results with fewer false positives

Infrastructure Security

The presence or lack of the kernel timer function related to the abovementioned queue processing is another generic IOC

in this latter case, it is necessary to create definitions that match the malware functions based on sufficient analysis andverification. As a result, it would be best to determine which approach to take as the occasion demands based on the urgencyof response.

1.5 Conclusion
This report has provided a summary of security incidents to which IIJ has responded. In this report, we discussed increasingly
malicious PUAs, examined ID management technology, and presented our evaluation of the IOCs for malware that reprograms
HDD firmware. IIJ makes every effort to inform the public about the dangers of Internet usage by identifying and publicizing
incidents and associated responses in reports such as this.

Figure 18: Detection Based on API Used

Authors:
Mamoru Saito
Manager of the Office of Emergency Response and Clearinghouse for Security Information, Service Operation Division, IIJ. After working
in security services development for enterprise customers, Mr. Saito became the representative of the IIJ Group emergency response
team, IIJ-SECT in 2001, participating in FIRST, an international group of CSIRTs. Mr. Saito serves as a steering committee member ofseveral industry groups, including Telecom-ISAC Japan, Nippon CSIRT Association, Information Security Operation providers Group
Japan, and others.
Hirohide Tsuchiya (1.2 Incident Summary)
Hirohide Tsuchiya, Tadaaki Nagao, Hiroshi Suzuki, Hisao Nashiwa (1.3 Incident Survey)
Hiroshi Suzuki (1.4.1 Increasingly Malicious PUAs)
Yuji Suga (1.4.2 ID Management Technology: From a Convenience and Security Perspective)
Takahiro Haruyama (1.4.3 Evaluating the IOCs of Malware That Reprograms HDD Firmware)
Office of Emergency Response and Clearinghouse for Security Information, Service Operation Division, IIJ
Contributors:
Minoru Kobayashi, Tadashi Kobayashi, Masahiko Kato, Masafumi Negishi, Yasunari Momoi, Hiroyuki Hiramatsu, Office of Emergency Response andClearinghouse for Security Information, Service Operation Division, IIJ*67

The IOCs we discussed here are listed on the following site (https://github.com/TakahiroHaruyama/openioc_scan).

27