Google Blocks Spyware Family From Android App Store

Google this week released details of a sophisticated new family of spyware tools that the company recently blocked from its Play mobile app store after discovering the malware being used against some Android users.

Dubbed Lipizzan, the Android spyware appears to be developed by Equus Technologies, an Israeli startup that Google referred to as a 'cyber arms' seller in a blog post published Wednesday. In total, with the help of Google Play Protect, the Android security team has found Lipizzan spyware on 20 apps distributed in a targeted fashion to less than 100 Android devices. 

Google has quickly blocked and removed all of those Lipizzan apps and the developers from its Android ecosystem, and Google Play Protect has notified all affected victims. Google has also enhanced its Google Play Protect app scanning features to detect and prevent Lipizzan and similar targeted spyware from being uploaded to the mobile app store.

Sophisticated Multi-Stage Spyware

Google described Lipizzan as a two-stage spyware tool designed to monitor and steal a victim's email and SMS messages, intercept voice calls and media and steal location data.

In the first stage, attackers distribute Lipizzan by typically impersonating it as an innocuous-looking legitimate app such as "Backup" or "Cleaner" through various Android app stores, including the official Play store. When a victim installed the software, the first stage Lipizzan components would then download a second separate data monitoring and theft component. The second component was designed to work only if it determined the device was safe for it to do so.

If given the all-clear, the second stage would then root the device with known exploits and begin to ex-filtrate device data to a command and control server

Gathers Data from Other Popular Apps

Lipizzan's second application component was capable of a wide range of malicious activities such as to record voice calls, record from a phone's microphone, monitor the victim's location, take screenshots and take photos from the device's camera.

It can also gather data from specific apps, undermining their encryption, which includes WhatsApp, Snapchat, Viber, Telegram, Facebook Messenger, LinkedIn, Gmail, Skype, Hangouts, and KakaoTalk.

The second Lipizzan application shared a common signing certificate with the first components showing that the same authors likely developed both. When Google managed to block the first set of Lipizzan applications from Google Play, the authors managed to quickly upload a new set of apps with the same capabilities but slightly different properties. Instead of impersonating backup applications for instance, the new malware mimicked other innocuous sounding applications such as a sound recorder app and an alarm manager. Despite such changes Google managed to detect and block the malware, the three members of Google's security team said.

Earlier this year, Google found and blocked a dangerous Android spyware, called Chrysaor, allegedly developed by NSO Group, which was being used in targeted attacks against activists and journalists in Israel, Georgia, Turkey, Mexico, the UAE and other countries. Like Lipizzan, Chrysaor was also used for targeted cyber-spying. The malware was discovered on what Google described as a few dozen Android devices.

Protect your Android device

• Android users are strongly recommended to follow these simple steps in order to protect themselves.
• Ensure that you have already opted into Google Play Protect.
• Download and install apps only from the official Play Store.
• Enable 'verify apps' feature from settings.
• Protect their devices with pin or password lock.
• Keep "unknown sources" disabled while not using it.
• Keep your device always up-to-date with the latest security patches.

The Biggest CyberSecurity Incidents Of 2017 At A Glance

It's only July, and already there's been viral, state-sponsored ransomware, leaks of spy tools from intelligence agencies, and full-on campaign hacking. And that's just the beginning. The first six months of 2017 have seen an inordinate number of cyber security meltdowns. And they weren't just your standard corporate breaches. 

Let this recap of 2017's biggest cyber-incidents so far serve as a reminder of just how chaotic things have already gotten–and the year's only halfway done.

SHADOW BROKERS

The mysterious hacking group known as the Shadow Brokers, claiming to have breached the spy tools of the elite NSA-linked operation known as the Equation Group. The identity of the Shadow Brokers is still unknown, but the group's leaks have revived debates about the danger of using bugs in commercial products for intelligence-gathering. Agencies keep these flaws to themselves, instead of notifying the company that makes the software so the vendor can patch the vulnerabilities and protect its customers.

WANNACRY

WannaCry spread around the world, walloping hundreds of thousands of targets, including public utilities and large corporations. Though powerful, the ransomware also had significant flaws, including a mechanism that security experts effectively used as a kill switch to render the malware inert and stem its spread. In total, WannaCry netted almost 52 bitcoins, or about $130,000—not much for such viral ransomware. Microsoft had released the MS17-010 patch for the bug in March, but many institutions hadn't applied it and were therefore vulnerable to WannaCry infection.

PETYA

This malware, called Petya, NotPetya and a few other names, was more advanced than WannaCry in many ways, but still had some flaws, like an ineffective and inefficient payment system. Researchers suspect that the ransomware actually masked a targeted cyber-attack against Ukraine. The ransomware hit Ukrainian infrastructure particularly hard, disrupting utilities like power companies, airports, public transit and the central bank.

WIKILEAKS CIA VAULT 7

WikiLeaks published a data trove containing 8,761 documents allegedly stolen from the CIA that contained extensive documentation of alleged spying operations and hacking tools. Revelations have detailed individual tools for things like using Wi-Fi signals to track a device's location, and persistently surveilling Macs by controlling the fundamental layer of code that coordinates hardware and software. Wiki Leaks claims that Vault 7 reveals "the majority of hacking arsenal including malware, viruses, Trojans, weaponize 'zero day' exploits, malware remote control systems and associated documentation.

CLOUDBLEED

The internet infrastructure company Cloudflare announced that a bug in its platform caused random leakage of potentially sensitive customer data. Cloudflare worked with search engines ahead of and after the announcement to remove the leaked data from caches, and experts noted that it was unlikely that hackers used the data malevolently; the random leaks would have been difficult to weaponize or monetize efficiently. A bug or a damaging attack affecting a company like Cloudflare can impact, and potentially endanger, a significant portion of the web.

198 MILLION VOTERS RECORDS EXPOSED

Unfortunately, it's not uncommon to hear that a trove of voter data was breached or exposed somewhere in the world. But on June 19, researcher Chris Vickery discovered a publicly accessible database that contained personal information for 198 million US voters—possibly every American voter going back more than 10 years. The group had misconfigured it, though, such that some data on the server was protected, but more than a terabyte of voter information was publicly accessible to anyone on the web. Misconfiguration isn't a malicious hack in itself, but it is a critical and all-too-common cybersecurity risk for both institutions and individuals.

MACRON CAMPAIGN HACK

Hackers dumped a 9GB trove of leaked emails from the party of left-leaning front-runner (now French president) Emmanuel Macron. The attack was less strategic and explosive than the WikiLeaks releases of pilfered DNC emails that dogged Hillary Clinton's presidential campaign. Researchers did find evidence that the Russian-government-linked hacker group Fancy Bear attempted to target the Macron campaign in March.

Remote Code Execution Vulnerability: Microsoft CVE-2017-8570

Description:

A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. It has been classified as critical. Affected is an unknown function of the component Object Handler. The manipulation with an unknown input leads to a privilege escalation vulnerability. CWE is classifying the issue as CWE-269. This is going to have an impact on confidentiality, integrity, and availability.

Overview of Attack:

An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. Exploitation of this vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software.

In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.

Technologies Affected:

• Microsoft Office 2007 Service Pack 3
• Microsoft Office 2010 Service Pack 2 (32-bit editions)
• Microsoft Office 2010 Service Pack 2 (64-bit editions)
• Microsoft Office 2013 RT Service Pack 1
• Microsoft Office 2013 Service Pack 1 (32-bit editions)
• Microsoft Office 2013 Service Pack 1 (64-bit editions)
• Microsoft Office 2016 (32-bit edition)
• Microsoft Office 2016 (64-bit edition)

Recommendations:

1. Run all software as a non-privileged user with minimal access rights.
2. Deploy network intrusion detection systems to monitor network traffic for malicious activity.
3. Do not accept or execute files from untrusted or unknown sources.
4. Do not follow links provided by unknown or untrusted sources.
5. Implement multiple redundant layers of security.

References:

• CVE-2017-8570
• Microsoft - Microsoft Homepage
• Microsoft - Microsoft Office Product Homepage

Part 2: Android SpyDealer Trojan (Detailed Technical Analysis)

In our previous post we were looking at the newly detected Trojan SpyDealer which is able to spy on more than 40 communication apps in your Android device. Let's have a look at the detailed technical analysis of this case today. (Credits: Palo Alto)

• Service Launching and Configuration:

After installed on an Android device, SpyDealer shows no application icon. However, it registers two broadcast receivers to listen for events related to the device booting up and network connection status. At the first launch, it retrieves configuration information from the local asset file named readme.txt. The first line of this file indicates the IP address of a remote C2 server, the second line configures what actions the malware can take on mobile networks, and the third line specifies what actions are allowed under a Wi-Fi network.

Fig 1. Content of the readme.txt

• Rooting and Persistence

SpyDealer uses two different rooting procedures to gain root (superuser) privilege. Rooting applications like this one are created for users who want to gain low-level access to their phone which wouldn’t be possible without removing some security protections. This is not the first time that Android malware has stolen root exploits from existing commercial rooting tools. SpyDealer 1.9.1 and 1.9.2 gain root privilege by abusing “Baidu Easy Root”.

The downloaded file “raw.zip” contains the exploits from “Baidu Easy Root” version 2.8.3. For example, 022d251cf509c2f0 is an executable binary file observed in the “raw.zip”, and the original file in “Baidu Easy Root” is actually in gzip format. It’s interesting that we can recover its original file name which is fb_mem_root.

Fig 2. Files in the downloaded raw.zip and Baidu Easy Root v2.8.3

• Command & Control

SpyDealer is capable of receiving commands from remote servers via a number of different channels by either actively initiating connections to C2 servers or passively receiving instructions from C2 servers. These channels include via SMS, UDP and TCP connections. This section details how the malware utilizes each of these channels to communicate with the remote C2 servers.

• SMS

SpyDealer registers a broadcast receiver with a higher priority than the default messaging app to listen for the commands via incoming SMS messages. The commands received through SMS are first decoded for further parsing and processing. Each SMS command contains a command index and arguments split by a newline. The command index ranges from 1 to 5 and each command is detailed in below table.

Fig 3. SMS Command List

To get the geographical location based on the GSM cell information, SpyDealer takes advantage of the interface of Baidu map service. It first collects the GSM cell identity, area code and network operator and then posts the encoded data to the Baidu map service to retrieve the geographical location. With this tactic, a compromised device’s location is exposed to the attacker even there is no GPS available.

Fig 4. Utilize the interface of Baidu map service to get geographical location

Besides the commands listed above, SpyDealer can also set the remote server’s IP address under the following two conditions:

1. The length of the command index received in the SMS (Table 3) is larger than 4, then the command index is actually the remote server’s IP address
2. The incoming SMS message body starts with the string “L112 ” which is followed by the remote server’s IP address

• TCP Server

SpyDealer creates a TCP server on the compromised device listening at port 39568 and waits for incoming commands. The command format and description are listed below table:

Fig 5. Commands via TCP channel

However, there is no authentication mechanism implemented before accepting the incoming commands, which means anyone can connect to a compromised device and control it as long as one knows the target device’s IP address.

• UDP/TCP Client

SpyDealer can also actively connect to the remote server with the configured IP address to ask for commands through UDP or TCP. At first launch, the remote server’s IP address is retrieved from the local asset readme.txt, and the use of UDP or TCP protocols is determined based on another local asset named socket. The command data received by the client is encrypted by the server using Tiny Encryption Algorithm (TEA) Once the client receives a command, the malware decrypts the data.

Fig 6. TEA algorithm used to decrypt incoming comman

• Private Data Collection

As discussed in section Command & Control, we have seen this malware employ many mechanisms to collect private data. Additionally, with root privilege, SpyDealer also tries to gather data from more than 40 common apps falling in different categories including social, communication, browser, mobile mail client, etc. The targeted apps are listed in the below table:

List full of targeted apps

ID	Package Name	App Name
1	com.facebook.katana	Facebook
2	com.tencent.mm	WeChat
3	com.whatsapp	WhatsApp
4	com.skype.raider/com.skype.rover	Skype
5	jp.naver.line.android	Line
6	com.viber.voip	Viber
7	com.tencent.mobileqq	QQ
8	org.telegram.messenger	Telegram
9	com.alibaba.mobileim	Ali WangXin
10	kik.android	Kik
11	com.icq.mobile.client	icq video calls & chat
12	com.keechat.client	KeeChat Messenger
13	com.oovoo	ooVoo Video Call, Text & Voice
14	com.instanza.cocovoice	Coco
15	com.bbm	BBM
16	com.gtomato.talkbox	TalkBox Voice Messenger
17	com.rebelvox.voxer	Voxer Walkie Talkie Messenger
18	com.immomo.momo	MOMO
19	com.zing.zalo	Zalo
20	com.loudtalks	Zello PTT Walkie Talkie
21	com.duowan.mobile	手机YY
22	im.yixin	易信
23	cn.com.fetion	飞信
24	com.sgiggle.production	Tango
25	com.renren.mobile.android	人人
26	net.iaround	遇见
27	com.sina.weibo	Sina Weibo
28	com.tencent.WBlog	Tencent Weibo
29	org.mozilla.firefox	Firefox Browser
30	com.oupeng.browser	Oupeng Browser
31	com.android.browser	Android Native Browser
32	com.baidu.browser.apps	Baidu Browser
33	com.tencent.mtt	Tencent QQ Browser
34	com.lenovo.browser	Lenovo Browser
35	com.qihoo.browser	Qihoo Browser
36	com.taobao.taobao	Taobao
37	com.netease.mobimail	NetEase Mail
38	com.tencent.androidqqmail	Tencent QQ Mail
39	com.corp21cn.mail189	189 Mail
40	cn.cj.pe	139 Mail
41	com.baidu.netdisk	Baidu Net Disk
42	com.l	Smart Shopping List – Listonic
43	com.dewmobile.kuaiya	Zapya
44	com.funcity.taxi.passenger	Kuaidi Taxi

• Accessibility Service Abuse

An increasing number of apps encrypt data before storing it into databases, especially for some popular communication and social apps. App developers do this to protect user data from malicious attacks like this one. To avoid this obstacle, starting in version 1.9.3, SpyDealer implemented an extra accessibility service to steal plain messages by directly extracting texts from the screen.

Fig 7. Configuration of the accessibility service

• Surveillance

SpyDealer is capable of surveilling a compromised victim through multiple means including recording phone call and surrounding audio, recording video, taking photos, capturing screenshots, and monitoring geographical locations. It takes these actions based on commands it receives from the command and control channels described above.

• Record Phone Call and Surrounding Audio

SpyDealer registers a PhoneStateListener to monitor the phone call status. Once there is an active phone call, the audio recording procedure is triggered. The recorded audio data is finally compressed in zip format and stored to

/sdcard/.tmp/audio/<current_time_in_yyyyMMddHHmmss>_<phone_call_num><phone_call_ date>.zip

A message in the format “audio\n<IMSI>\n<IMEI>\n<zip_file_path>” will be sent to the remote server after audio is successfully recorded.

In addition to recording phone calls, SpyDealer is also capable of recording surrounding, ambient audio. It can be configured to record audio at a specific time range. The recorded audio file is stored to the following path in zip format

/sdcard/.tmp/environmentaudioaudio/<current_time_in_yyyyMMddHHmmss>.zip

Audio files recorded more than seven days ago are automatically deleted from the directory /sdcard/.tmp/environmentaudioaudio.

• Record Video

SpyDealer checks to see if the camera is available to record a video every three seconds. In the Android system, a preview surface is required to take a video, which means the user is aware of the video recording event. To avoid this, SpyDealer intentionally sets a very tiny preview surface which, in this case, is 3.0dip * 3.0dip in dimensions. Each video is recorded for 10 seconds and is finally stored to

/data/data/<package_name>/files/cameravideo/<current_time_in_yyyyMMddHHmmss>.zip

If a network connection is available, SpyDealer sends a message in the format “cameravideo\n<IMSI>\n<IMEI> \n<zip_file_path>” to the remote server.

Fig 8. A tiny surface view is defined for recording video silently

• Take Photos

Similar to recording video without a user’s awareness, this malware creates another tiny preview surface which is 0.100000024dip * 0.100000024dip in dimensions before taking a photo. Using the front or rear camera depends on the configuration which the attacker can set remotely. The taken photo is stored to

/data/data/<package_name>/files/camerapic/camera_<current_time_in_millseconds >.jpg

A message indicating a photo is taken is then sent to the remote server and the message is in the format “camerapic\n<IMSI>\n<IMEI>\n<picture_path>”.

• Monitor Geographic Location

SpyDealer dynamically registers a broadcast receiver listening for screen’s status. Whenever the screen is turned off, it tries to get the geographical location via GPS. At the same time, a location listener is registered to track the device’s location. This location listener is notified with the updated location every 10 seconds or whenever 100 meters of movement occurs between location updates. If a network connection is available, the location data will be sent to the remote server in the format

LGPS\n<IMEI>\n<IMSI>\n<longitude>\n<latitude>\n<current_time_in_yyyy-MM-dd hh:mm:ss>

However, the location data is saved locally if there is no network connection and will be uploaded later when the connection is restored.

Conclusion:

SpyDealer makes use of the commercial rooting app “Baidu Easy Root” to gain root privilege and maintain persistence on the compromised device. It employs a wide array of mechanisms to steal private information. At the same time, it accesses and exfiltrates sensitive data from more than 40 different popular apps with root privilege. With accessibility service, this malware is also capable of extracting plain text messages from target apps at real time. To remotely control the victim device, the malware implements three different C2 channels and support more than 50 commands.

Part 1: What if your android applications spy your communications?

What if you come to know that your application is able to spy on you? Steal your data from your android phone? automatically answer your incoming phone calls from a specific number? Just imagine the consequences of such a scenario we have come across recently. Yes you heard it right, your own android phone, where a malware has sneaked into all your applications gaining root privilege which enables the subsequent data theft.

Palo Alto Networks' researchers recently discovered an advanced Android malware, named 'SpyDealer' which reportedly exfiltrates private data from over 40 apps. The trojan is said to steal information from communication apps by abusing the Android accessibility service feature. SpyDealer steals messages from communication apps using the Android accessibility service feature and leverages the exploits from a commercial rooting app called Baidu Easy Root to gain rooting privileges and to maintain persistence on the target.

The 40 popular apps that the malware has sneaked into include WeChat, Facebook, WhatsApp, Skype, Line, Viber, QQ, Tango, Telegram, Sina Weibo, Tencent Weibo, Android Native Browser, Firefox Browser, Oupeng Brower, QQ Mail, NetEase Mail, Taobao and Baidu Net Disk. The mobile malware only works Android versions from 2.2 up to 4.4 releases (roughly 25% of all Android devices), that are the versions supported by the rooting tool. Once installed, the malware registers two broadcast receivers to listen for events related to the device booting up and network connection status. Even when the malware is not able to root the device, it is able to steal a significant amount of sensitive data.

According to researchers SpyDealer can harvest an exhaustive list of personal information including phone number, IMEI, IMSI, SMS, MMS, contacts, accounts, phone call history, location and connected Wi-Fi information. It can also automatically answer incoming phone calls from a specific number. The trojan can also spy on a user by recording the phone call and the surrounding audio and video. It can even take photos as well as screenshots with using device's both front and rear cameras. Attackers can remotely control the infected Android device via UDP, TCP and SMS channels. PaloAlto Networks believe the malware is under active development, the researchers already detected 1,046 samples of SpyDealer belonging to at least three differed variants.

The good news is that SpyDealer isn’t distributed through the official Google Play store, the malware experts observed Chinese users being infected compromised wireless networks. Though the trojan came to light recently, researchers have traced its activity to as far as October 2015. Also, at this point, the malware can only affect Android devices running on Android 4.4 KitKat and older. This means some 25% of the Android OS' total user base. On devices running later versions of Android, it can still significant amounts of information, but it cannot take actions that require higher privileges.

Antivirus Companies Releases Decryptor for the Dharma Ransomware

What is Dharma Ransomware

Dharma Ransomware is newer version of Crysis Ransomware, extremely dangerous file-encrypting virus. Dharma uses asymmetric cryptography to block user access to personal files. It's easy to recognize files affected by it because they will have the extension: .[email_address].dharma, where the email address is the one used by the attacker as a point of contact.

Computer users who have been affected by the Dharma ransomware and have held onto their encrypted files can now restore them for free. Researchers have created decryption tools for this ransomware strain after someone recently leaked the decryption keys. The private decryption key is stored on a remote server, and there currently impossible to break the encryption of the latest version. Kaspersky and other antivirus companies are working on it, and has decryptor for older versions.

How Dharma Ransomware infected your PC

Dharma Ransomware virus developers still use spam e-mails with malicious attachments for distribution. Usually, attachments are DOC or XLS documents. Such documents contain built-in macros, that runs in the background when user opens the document. This macros downloads and runs main executable with random name. Since that moment Dharma starts encryption process.

How to decrypt and restore .dharma, .wallet, .xtbl files

It is not recommended to remove Dharma Ransomware manually, for safer solution use Removal Tools instead. There is no purpose to pay the ransom, because there is no guarantee you will receive the key, but you will put your bank credentials at risk.

Using Windows Previous Versions option:

• Right-click on infected file and choose Properties.
• Select Previous Versions tab.
• Choose particular version of the file and click Copy.
• To restore the selected file and replace the existing one, click on the Restore button.
• In case there is no items in the list choose alternative method.

Using Shadow Explorer:

• Download Shadow Explorer program.
• Run it and you will see screen listing of all the drives and the dates that shadow copy was created.
• Select the drive and date that you want to restore from.
• Right-click on a folder name and select Export.
• In case there is other dates in the list choose alternative method.

If you are using Dropbox:

• Login to the DropBox website and go to the folder that contains encrypted files.
• Right-click on the encrypted file and select Previous Versions.
• Select the version of the file you wish to restore and click on the Restore button.

To clean up the backup encrypted files, you can use CryptoSearch to move them to another folder that can be archived or deleted.

Korea's Biggest Bitcoin Exchange "Bithumb" Hack Leads to Millions in Bitcoin Losses

The largest bitcoin and ether exchange in South Korea by volume, Bithumb, was recently hacked. Monetary losses from compromised accounts have started to surface, and are quickly reaching into the billions of won.

A cyberattack targeting Bithumb, South Korea’s largest bitcoin and ethereum exchange by trading volume, has resulted in the loss of personal data belonging to an estimated 31,000 users, or 3% of its members. Bithumb is one of the five largest bitcoin exchanges in the world and hosts over 13,000 bitcoins worth of trading volume daily, or roughly 10 percent of the global bitcoin trade.

While admitting to being hacked on their website, Bithumb maintained that there was no direct access to funds stored on the exchange. Nonetheless, many customers are reporting their digital currency wallets being emptied. The exchange further claims that the breach was made to a personal computer belonging to an employee, and not the exchange’s internal network, servers nor digital currency wallets. While victim accounts of exactly how their funds were stolen have widely differed, attackers appear to have stolen enough credentials to begin a process of “voice phishing,” where the scammers call up victims one at a time and pose as representatives of Bithumb.

One victim claims that the attacker posed as an executive at Bithumb and phoned to say that he was "suspicious of a foreign hacking transaction,” and instructed his victim to give him an “identification number written on the letter from Bithumb.” The number in question was the victim’s One-Time Password, (OTP) which granted the attacker immediate access to ten million won, worth about US$ 8,700.

Such cases organizations should emphasize the need for businesses to have clearly defined security policies and procedures around the use of personal devices for work purposes and the re-use of passwords; For e.g.: Employees should not be using their work passwords for personal use. Instead of waiting for something to happen at the extreme levels, businesses should consider investing in technical security layers, from threat intelligence solutions to two factor authentication—which would surely have helped in this matter.

Multiple Vulnerabilities with Pre-installed Software expose Dell Systems to hack

Security vulnerabilities in pre-installed software expose Dell systems to code execution attacks which allow attackers to disable security mechanisms, escalate privileges and execute arbitrary code within the context of the application user.

CVE-2016-9038

The first vulnerability in Invincea-X, Dell Protected Workspace 6.1.3-24058, tracked as CVE-2016-9038, is a double fetch in the SboxDrv.sys driver. An attacker can exploit the flaw by sending crafted data to the \Device\SandboxDriverApi device driver which is read/write accessible to everyone. The attacker can exploit the issue to write an arbitrary value to kernel memory space in order to gain local privilege escalation.

CVE-2016-8732

The second flaw tracked as CVE-2016-8732 affected the Invincea Dell Protected Workspace version 5.1.1-22303, that is a security solution for endpoints. This security vulnerability found in one of the driver components, ‘InvProtectDrv.sys’ with version 5.1.1-22303 and the vulnerability is fixed with version 6.3.0.

According to Talos, the flaws exist within one of the driver components, ‘InvProtectDrv.sys’ that is included in version 5.1.1-22303 of this security software. Weak restrictions on the driver communications channel and insufficient validation could allow an attacker controlled application that is executed on an affected system to leverage the driver to disable protection mechanisms.

CVE-2017-2802

A third flaw, tracked as CVE-2017-2802, affects the Dell Precision Optimizer application and could lead to the execution of arbitrary code. The vulnerabilities affects the Dell Precision Tower 5810 with nVidia graphic cards, PPO Policy Processing Engine 3.5.5.0, and ati.dll (PPR Monitoring Plugin) 3.5.5.0.

An attacker could supply a malicious DLL having the same name of the “atiadlxx.dll” in one of the directories specified by the PATH environment variable to achieve arbitrary code execution. The security implications for the flaws are serious because the Invincea Dell Protected Workspace is an application is commonly deployed to secure workstations within high-security environments.

Vulnerability exists with PPR Monitoring Plugin 3.5.5.0 and versions from v4.0 onward are not vulnerable.

Talos recommend's that organizations using affected versions of this solution update to the latest version as quickly as possible to ensure that the protections provided by this software cannot be bypassed by an attacker. Organizations need to carefully consider the risks and benefits of software bundled with devices. It is important anyway to carefully assess any pre-installed software to avoid that flaws affecting them can be exploited by attackers.

Vault 7 Leaks CIA malware targets Linux machines

The CIA has developed strains of malware specifically designed to target Linux computers. The existence of the malware, known as OutlawCountry, was revealed by WikiLeaks. The leaked user manual — dated 04 June 2015 — details a kernel module for Linux 2.6 that allows CIA operatives to divert traffic from a Linux machine to a chosen destination. The Vault 7 leaks continue to flow thick and fast from WikiLeaks, shedding more and more light on the hacking and infiltration capabilities of the CIA.

With Linux-based operating systems usually lauded for their impenetrability, news of a possible chink in the armour will undoubtedly cause concern. With OutlawCountry, it seems the CIA was able to redirect network traffic from a target machine to an agency-controlled machine for infiltration. Shell access and root privileges are needed to install OutlawCountry, meaning CIA operatives must compromise machines via other means before deploying this malware strain.

OutlawCountry redirects outgoing Internet traffic:

OutlawCountry allows for the redirection of all outbound network traffic on the target computer to CIA controlled machines for ex- and infiltration purposes. The malware consists of a kernel module that creates a hidden netfilter table on a Linux target; with knowledge of the table name, an operator can create rules that take precedence over existing netfilter/iptables rules and are concealed from a user or even system administrator.

The installation and persistence method of the malware is not described in detail in the document; an operator will have to rely on the available CIA exploits and backdoor to inject the kernel module into a target operating system. OutlawCountry v1.0 contains one kernel module for 64-bit CentOS/RHEL 6.x; this module will only work with default kernels. Also, OutlawCountry v1.0 only supports adding covert DNAT rules to the PREROUTING chain.

Spying on Linux servers:

OutlawCountry can be used for both servers and regular desktops. Once Victims Traffic successful Redirected to CIA operator Control, then CIA can able to sniff Victims Activities and it will be used for other Attacks and it leads to compromise entire Victims network. If the Malware leads to occur more damage if its performed with Linux Based servers and it cause to sniff many users traffic which under the compromised server control.

Below is a list of the most notable WikiLeaks "Vault 7" dumps:

ᗙ Weeping Angel - tool to hack Samsung smart TVs

ᗙ Fine Dining - a collection of fake, malware-laced apps

ᗙ Grasshopper - a builder for Windows malware

ᗙ DarkSeaSkies - tools for hacking iPhones and Macs

ᗙ Scribble - beaconing system for Office documents

ᗙ Archimedes - a tool for performing MitM attacks

ᗙ AfterMidnight and Assassin - malware frameworks for Windows

ᗙ Athena - a malware framework co-developed with a US company

ᗙ Pandemic - a tool for replacing legitimate files with malware

ᗙ CherryBlossom - a tool for hacking SOHO WiFi routers

ᗙ Brutal Kangaroo - a tool for hacking air-gapped networks

ᗙ ELSA - malware for geo-tracking Windows users

Understanding DOM based XSS in DVWA

Cross-site Scripting (XSS) is a well-known web application vulnerability among developers, so there is no need to explain what XSS is. The most important part of a Cross-site Scripting attack developers should understand is its impact; an attacker can steal or hijack your session, carry out very successful phishing attacks and effectively can do anything that the victim can.

Let us first see what is DOM XSS?

In order to understand DOM XSS, we need to describe a bit what DOM is, and why is it relevant to this context. The Document Object Model is a convention for representing and working with objects in an HTML document (as well as in other document types). Basically all HTML documents have an associated DOM, consisting of objects representing the document properties from the point of view of the browser.

DOM XSS is a type of cross site scripting attack which relies on inappropriate handling, in the HTML page, of the data from its associated DOM. Among the objects in the DOM, there are several which the attacker can manipulate in order to generate the XSS condition, and the most popular, from this perspective, are the document.url, document.location and document.referrer objects.

Simple DOM Based Cross-site Scripting Vulnerability Example:

Let’s take the basic example of a page which provides users with customized content, depending on their user name which is encoded in the URL, and uses their name on the resulting page:

In this case the HTML source of http://www.example.com/userdashboard.html would look like this:

The result of http://www.example.com/userdashboard.html?context=Mary would be a customized dashboard for Mary, containing the string “Main Dashboard for Mary” at the top.

The malicious script can be embedded in the URL as follows:

Furthermore, the victim’s browser receives the above URL and sends a HTTP request to http://www.example.com, receiving the static HTML page described above. Then, the browser starts building the DOM of the page, and populates the document.url property, of the document object with the URL containing the malicious script.

When the browser arrives to the script which gets the user name from the URL, referencing the document.urlproperty, it runs it and consequently updates the raw HTML body of the page, resulting in

Next, the browser finds the malicious code in the HTML body and executes it, thus finalizing the DOM XSS attack. In reality, the attacker would hide the contents of the payload in the URL using encoding so that it is not obvious that the URL contains a script.

Note however, that some browsers may encode the < and > characters in the URL, causing the attack to fail. However there are other scenarios which do not require the use of these characters, nor embedding the code into the URL directly, so these browsers are not entirely immune to this type of attack either.

How is DOM XSS different?

Using the above example, we can observe that:

1. The HTML page is static, and there is no malicious script embedded into the page, as in the case of other types of XSS attacks;
2. The script code never gets to the server, if the “#” character is used; it is seen as fragment and the browser does not forward it further. Hence server-side attack detection tools will fail to detect this attack; in some cases, depending on the type of the URL, the payload might get to the server and it may be impossible to hide it.

Defending against DOM XSS attacks

The best way to fix DOM based cross-site scripting is to use the right output method (sink). For example if you want to use user input to write in a <div> element don't use innerHtml, instead use innerText/textContent. This will solve the problem, and it is the right way to remediate DOM based XSS vulnerabilities.

Effective conceptual defense methods against the DOM XSS include, but are not limited to

1. Avoiding client-side sensitive actions such as rewriting or redirection, using client-side data;
2. Sanitization of the client-side code by inspecting and securely handling references to DOM objects that pose a threat, such as url, location and referrer, especially in cases when the DOM may be modified;
3. Using intrusion prevention systems which are able to inspect inbound URL parameters and prevent the inappropriate pages to be served.

Attack Characteristic	Classic XSS	DOM XSS
Root cause	Source code	Source code
Premises	Inappropriate embedding of client side data in outbound HTML pages (by the server).	Inappropriate referencing and use in the client-side code, of DOM objects which are not entirely controlled and verified by the server-generated HTML pages.
Page type	Dynamic	Static or Dynamic
Detection	Intrusion detection systems, logs	Cannot be detected server side, if proper evading techniques are being used by the attacker.
Detection of vulnerabilities	Attack simulation;	Attack simulation;
	Code review – server-side;	Code review – client-side;
	Vulnerability detection tools that perform automatic penetration testing	Vulnerability detection tools that perform automatic penetration testing
Defending	Sanitization – server side	Sanitization – client-side
	Intrusion prevention systems	Intrusion prevention systems –to a lesser extent