Hand of Thief, a new Linux virus

Just two weeks after reporting about the commercialization of the KINS banking Trojan, RSA reveals yet another weapon to be used in a cybercriminal’s arsenal.
It appears that a Russia based cybercrime team has set its sights on offering a new banking Trojan targeting the Linux operating system. This appears to be a commercial operation, which includes support/sales agents and software developer(s).

 

 

Meet the “Hand of Thief” Trojan

Hand of Thief is a Trojan designed to steal information from machines running the Linux OS. This malware is currently offered for sale in closed cybercrime communities for $2,000 USD (€1,500 EUR) with free updates.  The current functionality includes form grabbers and backdoor capabilities, however, it’s expected that the Trojan will have a new suite of web injections and graduate to become full-blown banking malware in the very near future. At that point, the price is expected to rise to $3,000 USD (€2,250 EUR), plus a hefty $550 per major version release. These prices coincide with those quoted by developers who released similar malware for the Windows OS, which would make Hand of Thief relatively priced way above market value considering the relatively small user base of Linux.
The Trojan’s developer claims it has been tested on 15 different Linux desktop distributions, including Ubuntu Fedora and Debian. As for desktop environments, the malware supports 8 different environments, including Gnome and Kde.

An Insider’s Glimpse

RSA researchers have managed to obtain the malware builder as well as the server side source code, and a preliminary analysis reveals familiar functionalities of a banking Trojan. Some of the initial features include:

• Form grabber for both HTTP and HTTPS sessions; supported browsers include Firefox, Google Chrome, as well as several other Linux-only browsers, such as Chromium, Aurora and Ice Weasel.
• Block list preventing access to specified hosts (a similar deployment used by the Citadel Trojan to isolate bots from security updates and anti-virus providers)
• Backdoor, backconnect and SOCKS5 proxy
• Anti-research tool box, which includes anti VM, anti-sandbox and anti-debugger

Figure 1: Hand of Thief – Linux Trojan’s Builder

Control Panel Features

The developer wrote a basic administration panel for the Trojan, allowing the botmaster to control the infected machines reporting to it. The panel shows a list of the bots, provides a querying interface, and run of the mill bot management options.
The Trojan’s infrastructure collects the stolen credentials and stores the information in a MySQL database. Captured data includes information such as timestamp, user agent, website visited and POST data. Hand of Thief also exhibits cookie-stealing functionality.

Figure 2: Hand of Thief – Linux Trojan’s Admin Panel View

Although Hand of Thief comes to the underground at a time when commercial Trojans are high in demand, writing malware for the Linux OS is uncommon, and for good reason. In comparison to Windows, Linux’s user base is smaller, considerably reducing the number of potential victims and thereby the potential fraud gains. Secondly, since Linux is open source, vulnerabilities are patched relatively quickly by the community of users. Backing this up is the fact that there aren’t significant exploit packs targeting the platform. In fact, in a conversation with the malware’s sales agent, he himself suggested using email and social engineering as the infection vector.

So What’s Next?

We are left with a number of questions:
Without the ability to spread the malware as widely as on the Windows platform, the price tag seems hefty, and raises the question – will the Linux Trojan have the same value as its Windows counterparts?
Also, with recent recommendations to leave the supposedly insecure Windows OS for the safer Linux distributions, does Hand of Thief represent the early signs of Linux becoming less secure as cybercrime migrates to the platform?
Only time will tell. RSA researchers will continue to closely monitor the development of this Trojan and update accordingly.

US Department of Energy is hacked again

The US Department of Energy has again been hacked, having previously fallen to an attack this February.
The DoE is notifying employees that hackers have gained personal information on 14,000 current and former staff, with the data including names and social security numbers.
The hack is said to have taken place late last month, and those affected are being warned about the potential danger of identity theft with their personal information now in the wild. The previous hack also involved the theft of personal data and affected several hundred staff.
The Wall Street Journal reports the attackers were able to get into the DoE systems by hacking into a human resources system, which included payroll data.
The SANS Institute, a cyber security research organisation, said such attacks can see hackers collect personal information to try and control sensitive US networked infrastructures, like that of the DoE, through compromised log-ins and passwords.
A hacker for instance, could use the personal information of an employee to try and get a new network or database password from the IT department.
In a memo confirming the attack, the DoE said, "No classified data was targeted or compromised. Once the full nature and extent of this incident is known, the Department will implement a full remediation plan."
The DoE said it will be paying the costs of identity theft protection to those affected by the data loss.

Scottish Independence: Yes ‘email hacking’ details

An email at the centre of a hacking inquiry within the official pro-independence campaign concerned payment to an academic for writing a newspaper article.

Yes Scotland filed a police complaint after private emails were allegedly accessed. It became aware after it received a media inquiry last week that appeared to contain information from internal correspondence.
The details of the email in question were not initially released but Yes Scotland revealed it was a correspondence with Dr Elliot Bulmer in connection with an article he wrote for the Herald newspaper titled, ‘a Scottish constitution to serve the common weal’.
The pro-independence group said it had no influence over what he wrote and revealed the details of the email to end “unhelpful speculation”.
A Yes Scotland spokesman said: “This matter was first brought to our attention last Wednesday when we were asked for comment on Dr Bulmer and the article in question. We responded quickly, confirming that a small fee had been paid to Dr Bulmer at his request. We were perfectly relaxed and transparent about this.
Legal advice
“However, later that day it became apparent that an email account at Yes Scotland had been accessed illegally and that the information relating to this matter had been gleaned as a result.
“We alerted the police and British Telecom as well as the enquirer who, upon reflection, decided to not proceed further.
“Given that the illegal breach of Yes Scotland email has become the subject of an extensive and ongoing police inquiry involving detectives from Police Scotland’s Digital Forensics Unit, we have - under legal advice and at the request of the investigating officers - been unable to discuss the content of the email relating to Dr Bulmer.
“However, given persistent unhelpful speculation, we can confirm that in the course of a wide-ranging discussion with Dr Bulmer it was suggested that he, as an academic working in a private capacity, might consider writing an article on matters about constitutional frameworks based on his expertise.
“At his request, he was paid a nominal fee for the considerable time and effort he spent on it. We had no input to, or any influence over, what he wrote.
“We would now ask that this serious criminal investigation is allowed to continue unhindered by further unhelpful speculation, accusation and misinformation.”

NSA unlawfully gathered domestic emails

The National Security Agency (NSA) illegally intercepted thousands of e-mails from Americans with no connection to terrorism and misled the court about the scope of what it was doing, according to latest declassified documents.

Officials disclosed the history of that unlawful surveillance, releasing three partially redacted opinions of the Foreign Intelligence Surveillance Court that detailed the judges’ concerns about how the NSA had been siphoning data from the Internet in an effort to collect foreign intelligence.

The documents were released in response to a Freedom of Information Act lawsuit filed by the Electronic Frontier Foundation, an advocacy group based in San Francisco.

According to a redacted 85-page opinion by the chief judge of the Foreign Intelligence Surveillance Court, the National Security Agency (NSA) may have been collecting as many as 56,000 “wholly domestic” communications each year.

“For the first time, the government has now advised the court that the volume and nature of the information it has been collecting is fundamentally different from what the court had been led to believe,” John D. Bates, the then surveillance court’s chief judge wrote in his October 3, 2011 opinion.

U.S. intelligence officials sought to portray the matter as a technical glitch that the intelligence agencies caught and fixed.

But in the court opinion, judges said the NSA repeatedly had misled them about the scope of what it was doing.

“The court is troubled that the government’s revelations regarding NSA’s acquisition of Internet transactions mark the third instance in less than three years in which the government has disclosed a substantial misrepresentation regarding the scope of a major collection programme,” Mr. Bates wrote.

The latest revelations come amid growing criticism from members of Congress and privacy groups about the NSA surveillance programs and charges that the agency has far overstepped its bounds in collecting information on U.S. citizens.

In a late night statement, the Office of the Director of National Intelligence (ODNI) strongly refuted media reports that the U.S. has unfettered access to some 75 per cent of the country’s online communication.

“The reports leave readers with the impression that NSA is sifting through as much as 75 per cent of the United States’ online communications, which is simply not true. In its foreign intelligence mission, and using all its authorities, NSA “touches” about 1.6 per cent, and analysts only look at 0.00004 per cent, of the world’s Internet traffic,” ODNI said.

Penetration Testing & Ethical Hacking Important reviews

Sense of Security's penetration testing (ethical hacking) service tests the security of your IT systems, by identifying and exploiting weaknesses. We profile your organisation from the perspective of its most likely threats, looking at your business processes, information flows and the technology that supports your operations. This allows us to determine the resilience of your environment to malicious attempts to penetrate your systems.

Penetration Testing Methodology and Tools

Sense of Security has a documented, and tried and tested, penetration testing methodology based on industry best practices such as the OSSTMM (Open Source Security Testing Methodology Manual). This ensures that you receive quality and repeatable results, and minimises the risk to your systems under test.

Our team uses an arsenal of penetration testing tools similar to those used by attackers on the internet - in conjunction with in-house developed, commercial, and the best of breed open source penetration tools. Indeed, keeping up to date with the latest security vulnerabilities, trends and hacking techniques is our business.

We produce a comprehensive report covering the approach taken, the techniques applied, and the vulnerabilities identified and make procedural and strategic recommendations to ensure that your systems are secure against future attack.

Vulnerability Assessment vs Penetration Testing (Ethical Hacking)

Vulnerability assessments use testing tools (vulnerability scanners) to identify security vulnerabilities in a system or environment. While they highlight the technical threat, they do not qualify the business threat nor do they assess common attack methods. Thus, the major distinction between a vulnerability assessment and a penetration test (sometimes referred to as Ethical Hacking) is that the vulnerability assessment does not actively exploit the identified problems to determine the full exposure or validate its existence which can lead to inaccuracies in the report (false positives).

Unfortunately, many organisations claiming to perform penetration tests actually "oversell" their services and just provide vulnerability assessments using scanning tools. Although the initial cost may be less, attack scenarios can be overlooked which can lead to a later security breach. Sense of Security does not engage in these practices, and all identified security issues are reported with step by step instructions and screenshots on how to replicate the exploitable condition. Demonstrating the real risk visually provides value to management who may be unable to grasp some of the complex technical concepts involved in this line of work . and highlights the urgency in fixing some issues.

Types of Pen Tests

Our pen testers can perform a range of assessments that simulate attack testing scenarios from individuals with varying degrees of knowledge and access to your systems.

• External penetration test - casual or focused intruders on the Internet with limited knowledge
• Internal penetration test - disgruntled or careless employees or contractors with legitimate access to the corporate network
• Extranet penetration test - business partners who are part of the corporate Extranet
• Remote access penetration test - casual or focused intruders from known and unknown remote access entry points

Sense of Security penetration testing specialists are also experienced with performing tests which address the PCI DSS quarterly vulnerability scan (ASV) and annual penetration test requirements.

Penetration Testing as Part of Corporate Governance

Penetration tests are a requirement for meeting regulations such as PCI DSS, SOX, and HIPAA. It is also defined in industry standards such as ISO 17799 and ISO 27001 as important security tests an organisation should regularly undertake.

Key Penetration Testing Technology Focus Areas

Traditional pen testing disciplines:

• Network penetration testing (infrastructure penetration testing), e.g. router, switch, firewall, etc.
• Server penetration testing, e.g. operating system, application, etc.

Advanced penetration testing technology disciplines include, but are not limited to:

• Application penetration testing
• Wireless
• PBX / PABX including VoIP
• Citrix
• Interactive Voice Response (IVR)
• Virtualisation
• Database
• SCADA
• BlackBerry Enterprise Server
• Microsoft Office SharePoint Server
• Black box

Vulnerability Management and Protection

Our penetration testing service can be provided as a one-off assessment, or you can leverage our security expertise to provide you with automated, continuous, cost-effective, vulnerability management protection where we work with you to develop a recurring vulnerability assessment program for different segments of your environment. With a recurring program we can highlight current exposures in a timely fashion, and provide you with trending data that allows you to monitor the progress of your IT security initiatives over time.

Penetration Testing Articles and Information

• Does your penetration testing only scratch the surface? - Sense of Security Article

Are you want to do pentest against your application or network in less cost.
Get back to us info@briskinfosec.com, Mobile:9842751133