Cedric PERNET - Computer Security, Forensics, Malware & Cybercrime

Recently I attended the SANS GCIH (GIAC Certified Incident Handler) courses in London. I don't want to make too much advertise for it, it is not the goal of this post but anyway, it's a great course and I had a great time there.

Of course, when you're in a room full of other people learning about compromising computers, you expect strange things to happen on the wireless network.

And something strange happened to me during the second day of the course : my computer couldn't connect anymore to the network. I tried to figure out what was happening but couldn't find any problem.

The machine was an XP SP3, fully patched. I'm not using Windows usually (except at work), but it was better for the course. Anyway, I switched to an Ubuntu and had the same trouble : no connection.

Since it was the end of the day, I got back to my hotel and came back early the next morning, to try to fix the problem. I talked about it with someone from the SANS staff, Tomasz, and he told me he had noticed a strange behaviour from one machine, which was sending a hell of a weird trafic, almost taking all the bandwidth. The machine had quickly been blacklisted on the wireless network, according to its MAC address. And guess what ? The MAC address was my wifi card's one.

Well of course, as an incident handler, I immediately thought : hell, I've been compromised. After telling the SANS dudes I had not been running anything special on my machine and not knowing what was up, we decided to have a look at the trafic sent by my machine. It was sending packets on the network like crazy, but there were only two kind of packets : "BROWSER Election Requests", and "Local Master Announcement" ...

This was definitely not the behaviour of a malicious attacker or malware. For a moment I thought it was a hardware problem with my network card, but under Ubuntu there was no such behaviour.

Anyway, I ended the GCIH course using my Ubuntu, with an XP under VirtualBox.

I left the course on the saturday afternoon, after the capture the flag event (which was really great btw), but I told Tomasz that I would keep in touch, and would investigate the machine later on.

I didn't touch the machine for some weeks (you know this feeling, when you've always got something else to do and can't fight it...) and then I decided I would look at it quickly : I made a full dd of the Windows partition, and decided not to follow the usual forensics rules and just boot the machine. After all, it was mine, and I had a dd in case I would have time to do real forensics on it.

Together with my friend David Bizeul, who was interested in the case, I had put the machine on a hub with another machine, running a network sniffer. The results were the same than before : the machine started to send these crazy packets again, eating a good 25% of the bandwidth I had (10M).

A quick jump in command line, to see more about the activity, immediately proved something was definitely wrong :

All of my UDP ports (except the 256 first ones) were opened, by a unique process.

Now what was the process exactly ? Look here :

My machine was not infected by a malware. It was not compromised. You guessed it right, it was just an incompatibility problem between VMware Player and my hardware,which is from an Asus 1000H (eeepc).

The version I was using :

End of the story... I still wanted to blog about it because it could happen to a lot of other people using the same hardware, and to give a clear answer to my SANS friends about this machine, which had been a curiosity... I'm taking this occasion to say hi to the great people from the SANS : Tomasz Miklas, Terry Neal, Pieter Danhieux... And hi to Ben, and all the nice people I met in London :-)

See ya ! :-)

Just a quick post to wish you all a happy new year 2009 ...

I am wishing you health, joy, love, professionnal success ... I am also wishing you everything else you could wish for, I cannot do more :-p

As for me, as always when starting a new year, I hope I'll be able to post more on this weblog ... As for my real resolutions for the year, I hope to go on my way without any cigarette (6 years already), and to make more sports ... But you know, this whole resolution stuff is not really my cup of tea ... ;-)

2009 is very promising for me, on both professional and personnal ground. Challenges and emotions, that's what makes me run !

See you soon ! :-)

This is just a quick update on my post concerning Atrivo/Intercage.

A lot has been happening during the last few days. Atrivo lost all its upstreams providers, then came back, finding one provider, UnitedLayer, as can be seen on cidr-report. Anyway, while this was happening, some of the malware having its c&c servers hosted by Atrivo suddenly moved to another hosting company, namely CERNEL (.net).

It is interesting to see that Cernel.net has been registered through EstDomains.

Update (2008-09-25) : Cernel.net is unreachable at the moment. The domain is pointing to...an Intercage IP address. Need I say more ? :-)

A new article from the excellent Brian Krebs has been published today on the Washington Post.

The article is spreading Jart Armin's whitepaper about ATRIVO, a famous hosting company ... Well when I say "famous" I should say famous to fraudsters and computer security researchers.

The case is quite similar to the RBN case at the end of last year : a bulletproof hosting company, acting for years, suddenly gets in the spotlights. Several things have been said concerning RBN. Having studied the organisation for a while, I have to say some releases about RBN have been upsetting me. According to almost the whole security community, RBN had disappeared...Only to be spotted and mentionned everywhere for any fraudulent action taking place in the malware/phishing/fraud world. RBN has spread all worldwide malware, has done every phishing case, has hosted all illegal content worldwide, and has attacked Georgia... Crap.

It just seems that most researchers have simply forgotten one thing: RBN had customers. When RBN "died", I heard shouts that they had gone to "AbdAllah" host for example. I think that's totally untrue ; people noticed fraudulent domains had moved from ex-RBN to AbdAllah, and claimed it was a RBN move, which wasn't, in my opinion.
Instead, it was only a move from customers, from one bulletproof hoster to another.

Now Atrivo is "following" the RBN case, being shown as an evil host. Emil K, its founder, is declaring just like Tim Jaret did for RBN, that he is responding to the abuse requests. But he doesn't. He's quite following the same politic of communication than Jaret.

As for Jart's paper, I don't agree totally with him, thought I respect his work. I won't say more, and let you read his paper. What will Atrivo's future be, now that all eyes are on them ? Will they vanish just like RBN did ? Time will tell...

Edit: (2008-09-01) It seems that some people are reacting fast (speaking of GLBX). Read this excellent article from Jose Nazario.
Edit: (2008-09-05) An excellent investigation from Knujon about Directi can be read here. Excellent work.
Edit: (2008-09-08) It seems that everyone is running away from Atrivo :
http://sunbeltblog.blogspot.com/2008/09/more-interesting-atrivointercageestdoma.html
http://voices.washingtonpost.com/securityfix/2008/09/scam-heavy_us_isp_grows_more_i.html
Edit: (2008-09-09) Another striking article from Brian about EstDomains this time. Brian is very active recently against cybercrime hosting companies and registrar, and it seems to work fine. This shows us all the power of the press... But it shouldn't go too far, since it could ruin some LE investigations. I hope it will not be the case.

Update: (2008-09-15): EstDomains declares global war against malware... Can you really believe it ? Article here.

Update (2008-09-15): Thanks to Communautech for a nice french article here.

Update (2008-09-17): Gary Warner has done a great work, showing us a huge amount of domain names pointing to Intercage. Here is the result.
Update (2008-09-22): Atrivo seems to be down for the moment. link here and here.
Update (2008-09-22): Atrivo is back tonight. Some new peering appeared, as can be seen here:

Report for AS27595
Name
INTERCAGE - InterCage, Inc.
AS Adjancency Report
In the context of this report "Upstream" indicates that there is an adjacent AS that lines between the BGP table collection point (in this case at AS2.0) and the specified AS. Similarly, "Downstream" refers to an adjacent AS that lies beyond the specified AS. This upstream / downstream categorisation is strictly a description relative topology, and should not be confused with provider / customer / peer inter-AS relationships.
27595 INTERCAGE - InterCage, Inc.
Adjacency: 1 Upstream: 1 Downstream: 0
Upstream Adjacent AS list
AS23342 UNITEDLAYER - Unitedlayer, Inc.

Thanks to cidr-report.org as usual for the info :-)

Once again, I had no time to post anything here for the last couple of weeks, so I am shamelessly linking to a new post I wrote on CERT Lexsi's blog here.

I am preparing a big post for this blog (in french), but I am lacking time... Anyway, thanks to all friends and readers ! :-)

Well, it's about noon here, on saturday night, and I should be away with friends, drinking a bit, having fun, meeting new people... But things are a bit different this saturday night. Yes, I'm stuck home, being sick. Just like a malware, flue has spread amongst co-workers, and it finally struck me yesterday.

What could I do then, except spending some time on my laptop, lying in my bed ?

As the "social monster" I am supposed to be, like one of my co-worker has called me, I thought I would spend some time talking with one or two friends on IRC or MSN (well, I'm using "pidgin" under my Linux for MSN protocol, of course).

So I've been chatting a bit, and then, suddenly, a friend asked me :

"hey, is this you ? http://members.lycos.co.uk/xxxx/?=myemailaddress"

I immediately tried to tell her that she was having a malware on her computer, but it seems that she didn't get my message. Luckily enough, I had her phone-number so I called her and explained her some things ;-)

Now as curious as I can be, I got to this url and of course, it opened a window asking me if I wanted to download a file called "naked0453.com" , which I did.

I immediately sent this file for analysis to virustotal.com (Hi Julio ;-)) and got this result:

So now I could have googled around to find more information about this Trojan.Win32.Agent.dwd, but it would have been no fun.

Instead, I decided to launch the naked0453.com file ... Of course, under a special environment : a Windows XP SP2 in a VirtualBox. My sniffer (Wireshark) already on of course, to check for the network communication.

Well as soon as I ran the binary, it opened a window containing the "supposed" me :



Ok, it definitely is not me, I feel better, none of my ex-girlfriend has sent naked pics of me through Internet ;-P

Anyway, some files have been dropped on my system when I launched the binary:

* a file "services.exe" in my C:\Documents and Settings\user\localsettings\temp.
* some temporary files (image.jpg for example)

The services.exe binary is immediately run by the "naked" binary.

Once again, I ran the binary on virustotal.com, obtaining the following results:



As you can see, the malware itself is less detected than his dropper, which is usual. And oh, Armadillo is there... But I don't have reversing skills anyway :-p

Of course, the malware has also added himself in Windows registry, so that it will restart when Windows reboots.

Another funny thing is that services.exe (I'll call it the malware from now on) has been reading my autoexec.bat file, but I don't know why.


A remote thread is also injected in c:\windows\explorer.exe

I'm hushing through all these files manipulation because I'm not finding it so sexy : my main interest is to check what the malware has done on the network.

Letting Wireshark run for some time, I see there is quite an amount of communication. After some ten minutes, I stopped it, and put my Windows XP in my VirtualBox in his precedent state. (uninfected)

The first packets sent by the malware are DNS requests :

1 0.000000 192.168.x.x 192.168.x.x DNS Standard query A james.ccpower.ru
2 0.003170 192.168.x.x 192.168.x.x DNS Standard query response A 127.0.0.1
3 3.848609 192.168.x.x 192.168.x.x DNS Standard query A asl.aldanma.net
4 3.852151 192.168.x.x 192.168.x.x DNS Standard query response A 209.205.196.3

james.ccpower.ru points to 127.0.0.1, being useless. But we see that asl.aldanma.net is resolved to 209.205.196.3.

Immediately afterwards (5th packet) the malware establishes a connection to a IRC server at asl.aldanma.net :

NICK FQ[FRA-0H-hebxpefcz
USER heh heh heh :kakap
:log.on.sys 001 FQ[FRA-0H-hebxpefcz :Cisco
:log.on.sys 005 FQ[FRA-0H-hebxpefcz

:log.on.sys 422 FQ[FRA-0H-hebxpefcz :
:FQ[FRA-0H-hebxpefcz MODE FQ[FRA-0H-hebxpefcz :+i
JOIN #.niw
:FQ[FRA-0H-hebxpefcz!heh@AFontenayssB-x-x-x-x.wx-x.abo.wanadoo.fr JOIN :#.niw
:log.on.sys 353 FQ[FRA-0H-hebxpefcz @ #.niw :FQ[FRA-0H-hebxpefcz @abc
:log.on.sys 366 FQ[FRA-0H-hebxpefcz #.niw :End of /NAMES list.
:abc!rL@318BDD43.C22E0C0.495A4415.IP PRIVMSG #.niw :..... ............................................
PING :log.on.sys
PONG :log.on.sys

:abc!rL@318BDD43.C22E0C0.495A4415.IP PRIVMSG #.niw :........ 32415c24f4c28fb144f37921a7f4dc26 .........................
:abc!rL@318BDD43.C22E0C0.495A4415.IP PRIVMSG #.niw :........ a7d10aaf0e52b98963bc13232d4e88f1 .................................
:abc!rL@318BDD43.C22E0C0.495A4415.IP PRIVMSG #.niw :..... ............................................
PING :log.on.sys
PONG :log.on.sys

:abc!rL@318BDD43.C22E0C0.495A4415.IP PRIVMSG #.niw :........ 32415c24f4c28fb144f37921a7f4dc26 .........................
PING :log.on.sys
PONG :log.on.sys

:abc!rL@318BDD43.C22E0C0.495A4415.IP PRIVMSG #.niw :..... ............................................
:abc!rL@318BDD43.C22E0C0.495A4415.IP PRIVMSG #.niw :........ 32415c24f4c28fb144f37921a7f4dc26 .........................
PING :log.on.sys
PONG :log.on.sys

:abc!rL@318BDD43.C22E0C0.495A4415.IP PRIVMSG #.niw :..... ............................................


As we can see, the malware connects to the IRC server using a nick "FQ[FRA-0H-hebxpefcz" which at least contains a country reference.It also uses a user name "heh heh heh :kakap"
The answer from the server, the MOTD, is "Cisco".
The bot (malware) then joins the secret channel #.niw on the server.

We see only one user on the channel, with operator rights, called "abc". I would have liked seeing all bots connected at the same time but it seemed that the server was configured to hide everything. Even whois'ing was forbidden on the server.

After that, my machine started to connect to a lot of different web servers, getting hundreds of files (porn, affiliation, more malware...) but I had no time to keep digging, and furthermore I have to write another post on this blog about "Solutions Linux 2008" ... :-p

So this fast funny analysis is over, and as you can see it took me quite some time to publish it (mainly because I was away on hollidays) ;-)

Once again, I'm sorry but you have to click one step further, HERE, to read a new post from me ;-)

I wrote a post about Joe The Whistler on cert lexsi's weblog ... You can find it here

To make it short, it is about this sad news that shook the phreakers world : "Joe the Whistler" left us some days ago.

Macworld released an interesting spammer interview this week ... It is just confirming what I always thought : spammers became real business men...

Original link is here, but I'll copy/paste you the content here anyway :

“Ed,” a retired spammer, built a considerable fortune sending e-mails that promoted pills, porn and casinos. At the peak of his power, Ed says he pulled in $10,000 to $15,000 a week, storing the money in $20 bills in stacks of boxes.

It was a life of greed and excess, one that preyed especially on vulnerable people hoping to score drugs or win money gambling on the Internet. From when he was expelled from high school at 17 until he quit his spam career at 22, Ed — who does not reveal his full name but sometimes goes by SpammerX — was part of an electronic underworld profiting from the Internet via spam.

“Yes, I know I’m going to hell,” said Ed, who spoke in London on Wednesday at an event hosted by IronPort Systems, a security vendor now owned by Cisco Systems. “I’m actually a really nice guy. Trust me.”

A quick-witted and affable guy who wears an earring and casual clothes, there was a time when Ed wasn’t so nice. He sent spam to recovering gambling addicts enticing them to gambling Web sites. He used e-mail addresses of people known to have bought antianxiety medication or antidepressants and targeted them with pharmaceutical spam.

In short, Ed said he was “basically what people hate about the Internet.”

He spent 10 hours a day, seven days a week studying how to send spam and avoid filtering technologies in security software designed to weed out garbage e-mail. Most spam filters are effective 99 percent of the time; he aimed for that remaining window, using tricks such as including slightly different images in his spam, which can fool filters into thinking the e-mail is legitimate.

“The better I got at spam, the more money I made,” Ed said.

He would start a spam run by finding an online merchant who wanted to sell a product. Then he’d acquire a list of e-mail addresses — another commodity that has spawned its own market in the world of spam. He’d also set up a domain name, included as a link in a spam message, that, if clicked, would redirect the recipient to the merchant’s Web site, enabling Ed to get credit for the referral.

The spam would then be sent from a network of hacker-controlled computers, called botnets. Those machines are often consumer PCs infected with malicious software that a hacker can control. Ed would “rent” time on those computers from another group of hackers that specialized in creating botnets.

If one of the spam recipients bought something, Ed would get a percentage of the sale. For pharmaceuticals the commission was around 50 percent, he said.

Response rates to spam tend to be a fraction of 1 percent. But Ed said he once got a 30 percent response rate for a campaign. The product? A niche type of adult entertainment: photos of fully clothed women popping balloons.

To track the money, merchants set up a “referral sales page” where spammers can see how much they make from a spam run. Ed would log in frequently, watching the money increase. He was paid into electronic payment transfer accounts, such as e-gold or PayPal, or into his debit card account, which he could cash out in $20 bills.

That became problematic when the cash became voluminous. He says he made $480,000 his last year of spamming. But the lifestyle of being a spammer was taking a toll. In essence, he had no life.

It’s hard to go into a bar and explain your job to a woman by saying “I advertise penis enlargement pills online,” Ed said. “It doesn’t go down very well.”

He rationalized his actions by saying spamming is not like robbing someone, although the lurid impact of spam was clear. Some nine million Americans have some dependence on prescription drugs, Ed said, and he noticed that the same people were buying different drugs each month. “These were addicts,” he said.

Additionally, “the product is always counterfeit to some degree. If you’re lucky, sometimes it’s a diluted version of the real thing,” he said. Viagra is cut with amphetamines, and homemade pills are common from sketchy labs in countries such as China, India and Fiji, Ed said.

So Ed got out of the business. He’s written a book, “Inside the Spam Cartel: Trade Secrets from the Dark Side,” which he said has had some take-up in law enforcement circles eager to learn more about the spam business, which he projects will only get worse.

As broadband speeds increase, spammers will increasingly look to market goods by making VOIP (voice over Internet Protocol) calls or sending out videos, Ed said. The ultimate unsolvable problem is users, who continue to buy products marketed by spam, making the industry possible.

“I think in 10 years we’ll still get spam,” Ed said. “Be prepared to be bombarded.”

Well I've been quite busy recently, I'm sorry I didn't post anything for the last weeks...

I also forgot to mention that I started writing on CERT LEXSI's weblog.

From now on you might read some of my thoughts there, but I'll keep feeding this blog with other thoughts.

Typically, my geek thoughts about computer security will still be posted here, while the rest will be on CERT LEXSI's one.

You can read my first post for CERT LEXSI here.