Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious update/malware by a semi-advanced adversary

axelp.io

Post reply on HN
Print view View original

11–20 of 37 posts

Re: Malicious update/malware by a semi-advanced adversary

#11

Post by 55555 »

bryanrasmussen wrote: post #10

This is not really my area of expertise so perhaps explains my confusion. I'm not actually getting the domain was taken down reasoning, I mean I understand it was taken down but "but after using an online NS lookup tool, I realized that the DNS records were deleted some time last night. This must have been in response to the next stage having been downloaded. It’s unclear whether deleting the DNS records was automati…

Deletion could be triggered by their systems determining that someone is trying to research their malware/infra.

Re: Malicious update/malware by a semi-advanced adversary

#12

Post by pooper »

I had a similar experience with a typo

I went to visual studio (without the d) dot com and ended up in different places from different connections

I tried it again today and reached a Glassdoor listing for a paralegal wanted post. I made a Google malware report for this over a month ago but if they can simply show something different to Google bot, how will Google verify I was not lying in my report?

Re: Malicious update/malware by a semi-advanced adversary

#13

Post by bryanrasmussen »

55555 wrote: post #11
bryanrasmussen wrote: post #10

This is not really my area of expertise so perhaps explains my confusion. I'm not actually getting the domain was taken down reasoning, I mean I understand it was taken down but "but after using an online NS lookup tool, I realized that the DNS records were deleted some time last night. This must have been in response to the next stage having been downloaded. It’s unclear whether deleting the DNS records was automati…

Deletion could be triggered by their systems determining that someone is trying to research their malware/infra.

right, that's what I figured but the phrasing of the article made me think the assumption was otherwise.

Re: Malicious update/malware by a semi-advanced adversary

#14

Post by netsharc »

bryanrasmussen wrote: post #10

This is not really my area of expertise so perhaps explains my confusion. I'm not actually getting the domain was taken down reasoning, I mean I understand it was taken down but "but after using an online NS lookup tool, I realized that the DNS records were deleted some time last night. This must have been in response to the next stage having been downloaded. It’s unclear whether deleting the DNS records was automati…

In theory they could register many hostnames on the DNS, and serve each individual victim a URL with a different hostname, and delete that host afterwards.

Re: Malicious update/malware by a semi-advanced adversary

#17

Post by londons_explore »

bryanrasmussen wrote: post #10

This is not really my area of expertise so perhaps explains my confusion. I'm not actually getting the domain was taken down reasoning, I mean I understand it was taken down but "but after using an online NS lookup tool, I realized that the DNS records were deleted some time last night. This must have been in response to the next stage having been downloaded. It’s unclear whether deleting the DNS records was automati…

I think it's pretty typical for this type of attack to be put up, run for a few hours, and then be taken down. It will then be put up again on another domain with new code so automated scanners can't link the two.

During those hours, no client will be served twice. By doing it via an ad network, they can make the payload only run once per impression that they bidded on. That means even an advanced user will really struggle to get a copy of the payload.

The code will typically also check if it's running in a VM and will clean up after itself, all to make analysis more difficult.

Post install, the software usually reports to a C&C server and then sits idle till instructed to do something. So far, on installations I've done on test machines, I have never detected any activity beyond this - I guess they do a spray approach, and then only direct specific targets to upload files or anything else.

Re: Malicious update/malware by a semi-advanced adversary

#18

Post by blincoln »

CuckooExe wrote: post #2

Small blog post where I detail a malicious update I got served, try to track what it was doing, who sent it, and my mistakes. Would love to hear your thoughts!

I haven't looked at ad malware for many years, but when I did, it infected the MBR, so reinstalling Windows alone wouldn't remove it. I had to rebuild the MBR. I definitely recommend doing any live testing in a VM on a dedicated testing device. Who knows what sneakier persistence techniques are out there now?

Re: Malicious update/malware by a semi-advanced adversary

#19

Post by neilv »

I can easily believe that this is a grassroots group (we see many examples of that, in many areas, even in childhood), but this did prompt a few questions:

1. Is there any advantage to nation having cyber attack deniability via being able to at least semi-plausibly claim that, although an attack appeared in the interests of the nation, it was by an independent grassroots group, out of the nation's control? If so, would they establish identities for those supposed independent groups ahead of time?

2. Let's say you're a nation with cyber capabilities that are advanced but spread thin. If you're filling the human resource deficit with lower-skilled workers, and not giving them access to your advanced tools for their tasks, would you be concerned that that looks like cyber weakness? If so, would you distinguish the lower-skilled workers from your main brand, and if so, how?

3. Is there any worthwhile external-PR or internal-morale benefit, to appearing to have the active support of independent groups?

Re: Malicious update/malware by a semi-advanced adversary

#20

Post by geocar »

CuckooExe wrote: post #2

Small blog post where I detail a malicious update I got served, try to track what it was doing, who sent it, and my mistakes. Would love to hear your thoughts!

__utma means they were looking for Google Analytics cookies. If you weren't on the landing page after seeing the ad (and just opened the zip file) you wouldn't have these on your test page. Also:

    $ base64 -d
    dj01MDY1NDg3MTIwZTU2ZmQ1ZTZlNCZjaWQ9MjY0
    v=5065487120e56fd5e6e4&cid=264
cid= is common for campaign identifiers. Might also be "channel". This might not be a CNC system but ad fraud.

Using a coffee shop is a great idea, but perhaps one further away from Tyson's Corner since there are a lot of IP addresses there used by netsec people and servers, so they are on a lot of blocklists.

Sometimes the script is looking for special cookies when injecting onto sites like amazon, so I used to use gift cards to buy stuff on amazon on my testrig when examining some malware, and I would get much more interesting ads than without.

Also: Be careful when recording your SSL traffic (with something like MITMPROXY), since ad guys know about this: https://github.com/mitmproxy/mitmproxy/issues/4575 but a lot of netsec people forget about this.

Post reply on HN