Tag Archives: trojan horse

Botnet Targeted Unpatched Counter-Strike Vulnerabilities

In mid-March the security firm Dr. Web published details of a botnet (defined) they were able to shut down affecting players of the classic first-person shooter (FPS) game; Counter-Strike 1.6.

Why should this development be considered significant?
The report made available by Dr. Web showed that at it’s height the botnet resulting from the distribution of the Trojan (defined) Belonard numbered up to 39% of all the available game servers (1951 out of 5000) listed for Counter-strike gamers to choose from.

How were gamers systems infected?
One of the popular services offering servers to play on exploited 2 zero day (defined) remote code execution vulnerabilities within the 1.6 version of the Counter-Strike client to install Trojan Belonard within a gamer’s system. Researchers from Dr. Web found that this game remains very popular and can be played by 20,000 individuals on average at a time.

Counter-Strike can make use of dedicated servers that gamers can choose to connect to. These servers offer reduced lag, greater reliability while some monetised servers offer access to special weapons and protection against bans.

In an example scenario, a gamer might launch the official Steam gaming client. The client automatically will display a list of servers the player can connect to. Those with the lowest (lower is better) ping rate will be displayed at the top of the list. This list will also contain publicly available Valve (the company which created and maintains the Steam client) servers. However, the Trojan Belonard once it has infected a system it re-orders the servers offered to another system (placing them high in the list you see) in order to spread further. You may think you are connecting to a server with a low ping when in fact connecting to a malicious server which then infects your system with the Trojan. It does this by exploiting a remote code execution (defined: the ability for an attacker to remotely carry out any action of their choice on your device) vulnerability within the Counter-Strike client. A more detailed description and diagram is available from Dr. Web’s analysis of this threat. Your system will now contribute to spreading the Trojan by re-ordering the server list we discussed above.

The botnet herder did this in order to make more money since their other more legitimate servers would also be displayed high in the list of servers and those charge a fee for their use.

What happened to this botnet?
Dr. Web was successful in disrupting this botnet by coordinating with the registrar of the reg.ru domain name to shut down the websites used by the Trojan thus protecting new gamers from becoming infected. Furthermore, the domain generation algorithm (DGA)(defined); is being monitored by Dr. Web in order to continue to sinkhole (defined) the domains the malware attempts to use to continue spreading itself.

How can I protect myself from this threat or clean it from my system if I am already infected?
Unfortunately; the only way to prevent this botnet from being re-activated by whoever created it is for the zero-day vulnerabilities within the Counter-Strike client to be patched. Given the age and lack of financial reward to Valve to do this; that is unlikely.

If you suspect or know your system is infected with this malware; update your anti-malware software and run a full system scan. If this does not remove the malware you can use the free version of Malwarebytes to perform a scan and remove the malware. If you suspect any remnants remain you can use the additional anti-malware scanners linked to on this blog to remove them. In this case; RogueKiller, AdwCleaner and PowerEraser would be the most suitable for this malware.

Thank you.

Proton Trojan targeting Apple macOS discovered

Earlier this month Sixgill, a cyber intelligence company provided information on a recently discovered trojan for Apple macOS systems. It is being sold on the underground Russian cybercrime forums and acts as a remote administration tool (RAT)(defined). It sells under the name of Proton for 100 Bitcoin (more than USD$100,000) but now allows unlimited installations for 40 Bitcoin or a single installation for 2 Bitcoin.

Since the trojan is a RAT (discussed above) it allows an attacker to have full control of a victim’s system which includes controlling file uploads and downloads, monitoring keyboard presses, taking screenshots and webcam surveillance.

Sixgill theorizes the trojans developers bypassed/worked around Apple’s Developer ID program allowing this “application” to appear harmless while possibly exploiting an unknown zero day vulnerability (defined) within macOS to root privileges (defined) over the victim system.

How can I protect myself from this malware?
Since the trojan allows full control of an over an infected system, this will complicate removal since the attackers could easily attempt to resist or undo removal actions. Malwarebytes state this trojan is not in widespread use and they have been unable so far to obtain a sample of it. Moreover, VirusTotal did not have a sample to provide to them.

Apple added detections for this trojan to their XProtect (defined) anti-malware security feature; however as detailed in this TechRepublic article the trojans creators can easily modify it to avoid Apple’s signatures.

Further information on this trojan is available in this Softpedia article. TechRepublic provides a detailed list of recommendations within their article to prevent infection by this threat.

Thank you.

Malware uses DNS protocol for command and control

In early March two Cisco Talos security researchers Edmund Brumaghin and Colin Grady released details of a multi-stage trojan horse which communicates with it’s creator(s) using the Domain Name Service (DNS)(defined) protocol.

Since DNS is a widely used essential protocol it is often allowed to pass through corporate and personal firewalls. The source of the malware is an email containing an attachment reportedly secured with McAfee. The attachment is a Microsoft Word document which when opened requests to enable macros (defined). If the user enables macros the macros unpacks a Microsoft PowerShell script (a computer programming language usually used for automating system administration tasks) which forms the second stage of the attack.

Next the script checks if currently logged in user has administrator rights for their Windows account and checks the installed version of PowerShell. The script then adds a backdoor (defined). If the earlier check for administrative privileges was positive the backdoor will persist after restarting or powering off the system. This backdoor uses DNS to receive and carry out commands from it’s creators.

While analysing this threat, the above mentioned security researchers did not witness the malware receiving DNS commands due to its targeted nature.

How can I protect myself from this threat?
Sine this malware arrives via email, please verify the emails you receive are genuine and not attempting to deliver malware. SANS recently provided extra advice on this (March 6th : source)

=======================
Don’t Trust Links Sent in Email Messages March 6, 2017
A common method cyber criminals use to hack into people’s computers is to send them emails with malicious links. People are tricked into opening these links because they appear to come from someone or something they know and trust. If you click on a link, you may be taken to a site that attempts to harvest your information or tries to hack into your computer. Only click on links that you were expecting. Not sure about an email? Call the person to confirm they sent it.
=======================

In addition if you inspect network traffic within your corporate network, please consider adding DNS to the list of protocols analysed. Attackers are likely to leverage this widely allowed protocol for command and control (defined) going forward.

Thank you.

Malware Uses Linux Systems as Proxies

A Trojan horse (defined) is compromising Linux systems by exploiting poorly implemented SSH (Secure Shell)(defined) remote access. Many are already compromised systems first have a new account created with a notification to the Trojans authors providing the details of the system enabling a remote connection. The Trojan then installs the Satanic Socks Server utility to set up proxy server (defined) for use by the attackers or any individual they chose to connect to your system (very likely for a fee). More information on this threat is available here and here.


How Can I Protect Myself from This Threat?

If you are an administrator of Linux servers/workstations you should ensure remote SSH access uses a strong authentication mechanism. If this access is not required, strongly consider disabling SSH access.

To check if your Linux system has already been compromised, you can list the user accounts from a Linux system using the commands below. If you locate any suspicious accounts, you can delete them. I will also provide other useful commands below:

cat /etc/passwd
: this will list the name of user accounts
grep :0: /etc/passwd : will find accounts with the string “”:0″” within them (accounts with root privileges)

crontab -l -u root : display cron jobs (defined) scheduled by root and any other UID 0 accounts

Attackers often schedule jobs that include backdoors on the machine guaranteeing the attacker return access to the system.

The above commands are particularly useful if you already know the outputs of these commands when your system is working fine/as expected. You can then compare those known good outputs to the current output to more easily determine if your system has been compromised.

If you find a rogue/unknown user account; you can delete it using the following command:

userdel -r [account name]

where [account name] is the name of the user account that you wish to delete.

I hope that the above information is useful to you in protecting your Linux systems against this threat.

Thank you.