Security Response

On October 9th a German hacker group going by the name of the Chaos Computer Club (CCC) published an analysis of what they claim to be government spying software. The analysis is a 20 page PDF file describing how the software works. In addition, CCC made available a copy of the software on their website in the form of a .dll file and a .sys file (driver file). The CCC has not offered any proof of their claims that these are government affiliated samples.

Symantec has performed an initial analysis on the samples and has confirmed much of the functionality as described in the CCC document. The samples are malware--which Symantec detects as Backdoor.R2D2--that opens a back door allowing a remote attacker to access the compromised computer.

The back door .dll file, mfc42ul.dll, monitors chat and VOIP applications and is able to intercept status changes in the software, such as an incoming or outgoing call. It...

(Note: This blog was written on September 2. We decided to postpone publishing it due to an ongoing joint effort to shut down servers and block domain names. The variant studied is not the latest but accurately reflects the functionalities of the threat.)

Trojan.Bamital appeared in the summer of 2010. The threat really became prevalent at the beginning of 2011, shortly after the discovery of the B variant. Bamital hooks into various browsers in order to modify search results and redirect the user to advertisement links. In this blog, we’re going to dissect a recent variant of Bamital to understand how the click-fraud scheme is implemented.

Installation

Bamital comes as a UPX-packed executable. When executed, it drops two components to the %CommonFiles% folder...

これは、同僚の浜田譲治氏が投稿したブログ、「Firefox を標的としたゼロデイ攻撃が発生」の続報です。

「Mozilla Firefox 3.5/3.6 Remote Heap Buffer Overflow Vulnerability（Mozilla Firefox 3.5/3.6 にリモートヒープバッファオーバーフローの脆弱性）（BID 44425）」が悪用される際には、ヒープスプレーが使用された一連のROP（Return-Oriented Programming）ガジェットで xul.dll のコードを使用することで、データ実行防止（DEP）機能が回避されます。これらの ROP ガジェットが使用されるのは、DEP 機能が無効になった読み取り、書き込み、実行権限があるメモリでシェルコードが再配置および実行される場合のみです。対象となる Windows Vista や Windows 7 のようなオペレーティングシステムでは、この脅威の実行を防ぐ ASLR が xul.dll モジュールで有効になっています。

無防備な被害者のコンピュータにマルウェアを投下するために、この脅威ではちょっとしたテクニックが使われます。被害者のコンピュータに投下される悪意のある実行可能ファイルは、「scvhost.txt」という名前を使用した同じドメインでホストされ、以下のコード例に示すように .html ファイルで指定されています。

これによって、標準設定が使用されているブラウザで、参照ファイルがブラウザのキャッシュに自動的にダウンロードされます。

この Firefox の脆弱性が悪用された場合、実行を開始するシェルコードはコマンドプロセッサ（cmd.exe）を起動し、Firefox...

This is a follow up to the Limited Firefox Zero-Day Attack in the Wild blog posted by my colleague Joji Hamada.

The exploit of the Mozilla Firefox 3.5/3.6 Remote Heap Buffer Overflow Vulnerability (BID 44425) uses a series of heap sprayed ROP gadgets (return-oriented programming) using code in xul.dll to bypass Data Execution Prevention (DEP). These ROP gadgets were only used to relocate and execute the shellcode in read, write, and executable memory no longer subject to DEP. It is noteworthy that the xul.dll module has ASLR enabled in supported operating systems like Windows Vista and Windows 7, which prevents this threat from running in those platforms.

To drop the malware onto an unsuspecting victim’s computer, this exploit employs a little trick: The malicious executable to be dropped onto the victim’s...