Android Malware March 2012 Roundup

 Originally posted by elmo.

Date	Name
Mar 14, 2012	Faketoken
Mar 15, 2012	Boxer
Mar 20, 2012	Antammi
Mar 22, 2012	TGLoader
Mar 29, 2012	DKFBootKit

Read More

Fake Google Play

Originally posted by elmo.

This fake google play site serves a malicious file called, google_play.apk which tricks russian users into thinking that they are the legitimate site.

Read More

Google Authenticator updated

Originally posted by elmo.

Google recently updated Google Authenticator to version 2.15.

What's in this version:
1. New entry for Google Play, same great app
2. Updated look and feel
3. "Scan barcode" and "Manually add account" options moved to Menu > Add account.

When your phone is not connected to any network, Google Authenticator can be used to generate a valid verification code.

The verification code generated is then used in Google's 2-step verification process when signing in from a new device or phone.

Please visit this site for more info.

[gallery]

Read More

VX Heavens goes offline

Originally posted by elmo.

Read More

NSA Mobility Program

Originally posted by elmo.

The NSA or National Security Agency recently established the NSA Mobility Program to focus on delivering secure mobile capability using commercial technologies to the United States Government (USG) and Department of Defense (DOD).

They have also identified 5 major categories of the mobile ecosystem in a document called Mobility Capability Package:
1. Secure Voice
2. OS/Apps & Mobile Device
3. Mobile Transport (Carrier)
4. Mobile Enterprise Infrastructure
5. Interoperability

You may visit this site for more info.

Read More

The 2012 Cyber Defence University Challenge

Originally posted by elmo.

To raise awareness in cyber security, the Australian government in partnership with Australian universities  and Telstra challenges university undergraduates to join in the Challenge.

The Challenge is 24 hour competition related to security and will start on April 3 and end on April 4, 2012.

The winner will have the opportunity to travel to Las Vegas, USA in July 2012 to join in Black Hat's 2012 Conference.

For more info, you may visit this site.

Read More

Double Winrar self-executable archive packed Fakeav

Originally posted by marc.

Malware authors have been using packers/compression programs to confuse AV detection engines. Here's one mildly annoying technique that I stumbled upon last week.

Step 1. Pack file with Asprotect packer

Step 2. Create a password protected Winrar sfx archive using the file in step 1.

Step 3. Create another Winrar sfx archive using the file created in step 2, but this time, include the password in the execution script.


Most AV engines will usually have some trouble unpacking password protected files wherein the password is in another compression layer of the file. A quick Virus Total scan shows that this is indeed the case.

Password protected RAR SFX archive
Avast Win32:FakeAV-CYX [Trj]
DrWeb Trojan.Fakealert.29018
GData Win32:FakeAV-CYX
Kaspersky Trojan-Dropper.RAR.Agent.a
McAfee Generic Dropper.ady
Microsoft Rogue:Win32/FakePAV
VIPRE Win32.Malware!Drop

Unpacked file
AntiVir TR/Fraud.Gen
Avast Win32:FakeAV-CYL [Trj]
AVG Suspicion: unknown virus
ClamAV PUA.Packed.ASPack
GData Win32:FakeAV-CYL
Kaspersky HEUR:Trojan.Win32.Generic
McAfee FakeAlert-FCG!F72024F90A24
Microsoft Rogue:Win32/FakePAV
NOD32 a variant of Win32/Adware.WintionalityChecker.AA
Panda Suspicious file
Sophos Mal/FakeAV-MJ
VIPRE WindowsShieldTool

Notice how some AV engines didn't even bother detecting the password protected archive and how the same AV engine detects the same malware with two different names. This usually means that the AV vendor couldn't automatically unpack the file and had the write two different detections, one for the password protected file and one for the unpacked file.

An advantage of this technique is that when hosting the file on hacked servers, or when going through email gateways, there is a greater chance that the file remains undetected, since the file is never executed, and the underlying asprotected file is never revealed.

On a related note, here's a screenshot of a variant of the same malware, except this time with excerpts from Romeo and Juliet included in its winrar script. This is done to change the file hash and give AV detection automation a hard time. The process is most likely automated too, so they could be generating thousands of files containing the same malware with a different file hash with each click of a button.

Read More

Fake Skype Vouchers website leads to Java Exploits

Originally posted by kazmot.

I stumbled upon a fake website that targets Skype users through vouchers or gift certificates. Below is the definition of Skype vouchers from their website:

Skype vouchers are electronic Skype Credit vouchers sold in various retail outlets. You don’t have to pay for the vouchers online and they make a great gift for family and friends so that you can keep in touch through Skype.

Vouchers are sometimes included with Skype accessories, or as part of a promotion.

Let's have a look of what is inside the said fake page:

[caption id="attachment_514" align="aligncenter" width="300" caption="Figure 1: Source of the fake website"][/caption]

Figure 1 shows the misleading title. You can also see a hidden iframe connecting to a different website.

Following the hidden iframe, we will now get an obfuscated script.

[caption id="attachment_512" align="aligncenter" width="300" caption="Figure 2: Obfuscated script"][/caption]

Some variables are highlighted in Figure 2. These variables will eventually become a window.eval() function when the script is executed. Now, let us modify the script in order for our script emulator to capture the result of the eval() function:

[caption id="attachment_510" align="aligncenter" width="300" caption="Figure 3: Modification part 1"][/caption]

Figure 3 shows that we need to remove some "if-statements" to make sure that our script will execute. You will also notice that one if-statement checks for the current year. The script will not run properly if it was not satisfied. In addition, proper deobfuscation of the script also depends on the value of the integer in the year check. We will tackle more about this in a while. For now, let's just deobfuscate this script.

[caption id="attachment_511" align="aligncenter" width="300" caption="Figure 4: Modification part 2"][/caption]

Figure 4 shows which variable will become the eval() function. After the modifications, execute the script and then dump the eval result. Figure 5 below will show you the result.

[caption id="attachment_513" align="aligncenter" width="300" caption="Figure 5: Deobfuscated script code"][/caption]

Now, you will see another set of hidden iframes that connect to another site. The said site will now load 2 malicious Java files:

[caption id="attachment_515" align="aligncenter" width="300" caption="Figure 6: Load Java applets"][/caption]

Sample 1: Java Exploit
MD5 hash: d3f933524c85c96a76f7ffd516d335c0
Virus Total scan result available here

Sample 2: Java Exploit
MD5 hash: 58db6e6e25d9b8e4742f2ef9b43c3818
Virus Total scan result available here

These Java files exploit the following vulnerability:

CVE-2011-3544 - Oracle Java Applet Rhino Script Engine Remote Code Execution

Going back to the date check and value change, Figure 7 shows that we changed the integer value from "012" to "011".

[caption id="attachment_524" align="aligncenter" width="300" caption="Figure 7: Integer value modification"][/caption]

Now, let's dump the result to a file.

[caption id="attachment_521" align="aligncenter" width="300" caption="Figure 8: Result of the wrong value"][/caption]

You can see in Figure 8 that the result is now just a bunch of non-readable strings.

Source:
malwaredomainlist


References:
Skype
Virustotal
cve.mitre.org
Sourceforge

Read More