Citadel: a cyber-criminal’s ultimate weapon?

In old times, a citadel was a fortress used as the last line of defense. For cyber criminals it is a powerful and state-of-the-art toolkit to both distribute malware and manage infected computers (bots). Citadel is an offspring of the (too) popular Zeus crimekit whose main goal is to steal banking credentials by capturing keystrokes and taking screenshots/videos of victims’ computers. Citadel came out circa January 2012 in the online forums and quickly became a popular choice for criminals. A version of Citadel (1.3.4.5) was leaked in late October and although it is not the latest (1.3.5.1), it gives us a good insight into what tools the bad guys are using to make money.
In this post, I will show you how criminals operate a botnet. This is not meant as a tutorial and I do want to stress that running a botnet is illegal and could send you to jail.

A nice home
In order to get into business the bad guys need a server that is hosted at a company that will turn a blind eye on their activities and also guarantee them some anonymity. Such companies are called Bulletproof hosting and can be found in most underground forums (Figure 1).

Figure 1: an ad for Bulletproof hosting

Those hosting firms are for the most part located in countries like China or Russia and therefore in their own jurisdiction where so long as you don’t commit crimes against your own people not a whole lot can happen to you. To cover their tracks even more, the bad guys use proxy or VPN services that disguise their own IP address.
A shiny new toy
Once set up with a server, it is time to install what will be the mastermind program to create and organize an entire array (botnet) of infected computers worldwide. A variety of crimekits exist but in this post we will concentrate on Citadel.
Once again, the core installation files can be found in the underground community or through your own connections. Recently, the Citadel kit was withdrawn from forums to prevent too much exposure and attention. It costs around $3000 USD.

Figure 2 shows what the package looks like. An instruction manual in both Russian and English is provided. The kit requires server software such as Apache, and PHP with a MySQL database to work properly.

Figure 2: the citadel package

 To install Citadel, you simply browse to the install folder with your browser (Figure 3) and set up the main access username and password as well as database information.

Figure 3: Citadel’s installation screen

In this testing, the installer did not automatically create the database but you can do so by hand (Figure 4):

Figure 4: creating a database for Citadel’s exploit pack

To finally access the login page, you need to browse to the cp.php file (Figure 5):

Figure 5: Citadel’s login page

 Before logging in, I want to show you the other component that makes this package complete. It is called the builder (Figure 6) and is essentially used to create the piece of malware that criminals will distribute (forced installs through infected websites) and that links to their crimekit.

Figure 6: creating the Citadel bot with the builder

 The malware is built to avoid AV detection and is tested with online virus scanners like Scan4You, an equivalent to the popular VirusTotal except this one is totally anonymous and does not share uploaded samples with antivirus vendors. Speaking of which, once installed on the victim’s machine, the malware will prevent access to security sites (Figure 7).

Figure 7: a list of antivirus vendors that are blocked by Citadel’s malware

Here is an example of an infection from a Citadel Trojan.
Infected PCs all report to the mothership and wait for orders. This is where it gets interesting because making malware is one thing but actually managing your own campaigns is the key to success. The Citadel control panel is well designed and puts a lot of features at your fingertips (Figure 8).

Figure 8: Citadel’s Control Panel

Each feature is actually a module written in PHP as seen on Figure 9. The control panel gives you an overview of the machines that have been infected. It’s a sort of Malware Analytics with stats by country, Operating System, etc…

Figure 9: Citadel’s modules

 The main purpose of Citadel is to steal banking credentials and so it’s no big surprise to see advanced search features to specifically look for financial institutions (Figure 10).

Figure 10: Citadel’s advanced search features

A password is a password whether it’d be for a bank or something more common like a Facebook or Gmail account. In fact, you can customize any site that is of interest to you and capture the credentials.  Notifications of successfully stolen passwords can be sent via Instant Message through the Jabber protocol (Figure 11).

Figure 11: Citadel’s custom rules and notifications

Stolen credentials are harvested by various means:

• Keystroke logging
• Screenshot capture
• Video capture

A powerful feature used to trick users into revealing confidential information is dubbed WebInject. It is powerful because it happens in real time and is completely seamless. A WebInject is a piece of code that contains HTML and JavaScript which creates a fake pop-up that asks the victim for personal information within the context of logging into a site. The bad guys can trigger it in two ways: either automatically when a site of interest is opened by the victim, or manually on the fly.
It is the ultimate phishing tool because it does not go against any known proper precautions a user would normally take. For instance, the site’s URL is unchanged and shows the secure pad lock with the financial institution’s SSL certificate (Figure 12). This type of hack is also called a man-in-the-middle attack.

Figure 12: Man-in-the-middle attack through webinject

In case this method does not work (some people might get suspicious), the bad guys can always revert to a more direct approach with some ransomware. Citadel is also involved in the distribution of the FBI Moneypak (also known as Reveton) malware which locks the user out of his computer and demands $200 (Figure 13). It is customized based on the victim’s country of origin.

Figure 13: Reveton ransomware distributed by Citadel Trojan

Since a lot of people download music and movies from torrents or other shady sites, the message tricks them into thinking they have been caught by the local authorities. It’s a very smart scare tactic which works quite well, unfortunately. To add to the drama, the malware will attempt to turn on the user’s webcam as if they were already under surveillance.
The FBI has posted an article regarding this scam (http://www.fbi.gov/news/stories/2012/august/new-internet-scam) and urges people to not pay any money as it could get you into even more troubles.
Malwarebytes users are protected against the FBI Moneypak malware. If you aren’t one of them and are already infected you can remove this ransomware by following these 3 steps:

1. Reboot your computer into Safe Mode with Networking. (Instructions from Microsoft here)
2. Download Malwarebytes Anti-Malware.
3. Run Malwarebytes Anti-Malware and remove all malware (Figure 14)

That’s it!

Figure 14: Reveton ransomware Trojan detected by Malwarebytes Anti-Malware.

What’s next for Citadel?
The latest version (1.3.5.1) whose code name is Rain Edition is getting pricey at $3931 but it includes a lot of valuable features (advanced support for Chrome and Firefox, improved WebInjects, smarter ‘on-the-fly’ updates to the Trojan, etc…).
The makers of Citadel are trying to keep a low enough profile to avoid gathering too much attention which could result in efforts to go after them (as we have seen with Zeus). Getting your hands on Citadel is more difficult because of a stricter validation process within the Russian underground.
How to protect yourself
When seeing such technically advanced crimekits it puts a lot of things into perspective. The methods used to steal personal information are so advanced and sneaky that even the most cautious user may get fooled. It is best to avoid infection in the first place by using a solution such as Malwarebytes Anti-Malware PRO that constantly protects your computer by blocking malicious sites and files. Using a combination of both safe online practices (if you ever feel uncomfortable disclosing personal information, give your bank a call or ask a friend) and a good anti malware solution will keep you safe(r).

Android Malware Allows Hackers to Send Texts, Make Calls and Access Your Camera

The Bluebox Security Firm discovered a weakness in Android's operating system that would allow hackers into the phone without alerting the app store, the phone or the user, according to a report from the company's chief technology officer Jeff Forristal.
    The weakness could affect any phone manufactured since the release of Android's operating system 1.6 "Donut," which is any phone made in the last four years - nearly 900 million. The security flaw may expose personal information stored in select apps or on the phone itself.
 
Forristal wrote the operating system's weakness makes it easier for hackers to install Trojan malware on a phone by accessing an application on the device. From there, the hacker can obtain information from that app and, if the app is developed by the phone's manufacturer, from the device itself (texts, e-mails, contact info). The malware can also "take over the normal functioning of the phone and control any function thereof," he wrote.
That means the Trojan virus can send random texts, place arbitrary calls and even operate the phone's camera.
"Finally, and most unsettling, is the potential for a hacker to take advantage of the always-on, always-connected, and always-moving (therefore hard-to-detect) nature of these "zombie" mobile devices to create a botnet," Forristal wrote.
All Android applications are designed with their own cryptographic signature that makes it easy to verify if the app has been tampered with.  The vulnerability essentially makes it possible for hackers to break into the app, and into the phone, without altering the signature at all, leaving the user, the phone and the app oblivious.
Forristal wrote that Bluebox reported the bug to Google and said it will now be up to the manufacturers to develop updates to their firmware that will fix the problem.
Forristal is set to be a keynote speaker at the Black Hat USA 2013 conference at the end of July and will give a talk on the Android bug. Afterwards, he will follow up his talk with a blog post giving further details with elements of the address.

 

Android is a hacker’s paradise

Security firm McAfee warns that Google’s mobile operating system is being targeted by hackers more than any other platform. Android accounts for nearly all mobile malware and more than 14,000 threats have been discovered in the first three months of 2013 alone. Mobile attacks have expanded beyond Russia and China and are now found to be affecting users in South Korea, India, Italy, Thailand and Australia. Targeted trojans that steal personal information made up a majority of these attacks, while malicious spyware, phishing attacks and botnets accounted for the rest. Mobile malware is expected to increase in 2013, with some calling it “the year of mobile malware” for Android users. It is recommended that mobile users use caution when downloading applications outside of approved app stores and avoid pirating apps illegally or clicking on suspicious links.

Magna Carta Holy Malware: Hackers sabotage Jay-Z's Android app

Jay-Z can now add at least one more to his list of 99 problems.

Two weeks ago, the rapper and entrepreneur announced that he was dropping Magna Carta Holy Grail—his 12th studio album—on July 4 via an Android app exclusively for a select number of Samsung smartphones. The move has seen some success: More than half a million people have downloaded the sponsored app. But according to security company McAfee, some who thought they were getting the new album actually ended up downloading malware.

The company announced on its blog that a group of hacktivists had launched a malicious version of the app that derided the United States and PRISM, the National Security Agency’s online snooping program recently exposed by former contract analyst Edward Snowden.

"On the surface, the malware app functions identically to the legit app. But in the in the background, the malware sends info about the infected device to an external server every time the phone restarts," the blog explains.

'The malware then attempts to download and install additional packages. The only visible indication that a user is infected comes via a time-based trigger that is set to activate on July 4, Independence Day in the United States. On that day, the malware will replace the wallpaper on the infected device with an altered image (below, second from right) of President Obama that comments on recent events in the United States."

 

Photo via McAfee

McAfee also believes that the spoof app could potentially be used to obtain financial information or other critical data from users.

The malware is only the latest hiccup for the much anticipated app. On Monday, Atlanta-based rapper Killer Mike tweeted a screenshot of the terms of services for the Magna Carta Holy Grail  app to point out just how much information it was requesting from the user.

Hackers steal South Korea military secrets

A mysterious group of computer hackers has spent four years spying on the South Korea military, US security software maker McAfee has said, citing evidence uncovered from malicious software samples.
The findings, which were not confirmed by authorities in Seoul, provide one possible motive for ongoing attacks on South Korea that date to 2009.
McAfee, a division of Intel Corp, did not identify a sponsor for the attacks but said they were carried out by a hackers group known as the New Romanic Cyber Army Team. Seoul has blamed North Korea for some of the cyber attacks although Pyongyang denies responsibility and says it too has been a victim.
Officials at the South Korean Embassy in Washington were not immediately available for comment. A Pentagon spokesman said he was unaware of McAfee's findings and declined comment.
Experts with Symantec, another security software maker, last month definitively linked the four-year string of attacks to a single group of hackers. The attacks hit government and corporate computers.
McAfee released a 29-page technical paper on Monday that analysed the code of the software used by those hackers, whose identity is still not known.
It said the hacking gang infected PCs with sophisticated software that automatically sought out documents of interest by scanning computers for military keywords in English and Korean.
Once the software identified documents of interest, it encrypted those files then delivered them to the hackers' servers, McAfee said.
The paper also described in detail how the attackers siphoned data from infected computers using a sophisticated infrastructure known as a "botnet."
McAfee named the attacks "Operation Troy," because the word Troy frequently appeared in the code of the malicious software. The New Romanic Cyber Army Team makes frequent use of Roman and classical terms in their code.
On July 4, 2009, it launched its first significant attack, unleashing malicious software that wiped data on PCs and also disrupted some government and business websites in South Korea and the United States.
In March, the gang knocked tens of thousands of PCs off line at South Korean companies by destroying data on their hard drives. It was one of the most destructive cyber attacks on private computer networks to date.
McAfee published its report on the gang on its website: