Via TechWorld -
The Trojan horse which convinced Microsoft to issue an emergency patch for Windows had infected only about 200 computers prior to the fix's October 23 release, a security researcher has claimed.
Joe Stewart, director of malware research at SecureWorks, tracked down "Gimmiv," the Trojan that started the rush to patch. By accessing three control servers used by Gimmiv's makers, downloading log files and then decrypting the encrypted data, Stewart was able to pinpoint its origin, the first evidence of its spread and the overall number of infected PCs.
Twelve days ago, Microsoft warned of a critical vulnerability in the Windows Server service, which is used by all versions of the operating system, including client editions, to connect to file and print servers on a network. Hackers were already exploiting the bug in what Microsoft called "limited, targeted attacks," the company said as it issued a patch outside its normal second-Tuesday-of-the-month schedule.
Gimmiv, which Microsoft tagged as "Win32/MS08067.gen!A" instead, was identified as the malware that prompted the emergency patch.
It first popped up August 20 and was probably written by a South Korean hacker, said Stewart. According to the log files, however, the Trojan was present at only two IP addresses in August, and then only briefly.
"One of these IP addresses, located in Korea, we can tell was running Gimmiv in a VMware virtual machine, exactly the kind of thing you might expect someone testing a piece of malicious mobile code to do," said Stewart.
Not until September 29, however, did Gimmiv show up "in the wild" as log files noted an infected PC in Hanoi, Vietnam. All told, approximately 200 machines in 23 countries were successfully attacked by Gimmiv between Sept. 29 and Oct. 23, when Microsoft released its out-of-cycle fix. Many of the machines were on two networks in Malaysia, and few systems outside of Asia were compromised.
The log files recorded just one hacked machine in North America, for instance.
"But we had just as many questions after this as before," said Stewart, who ticked off a long list of unusual characteristics of Gimmiv. "They weren't the worst programmers ever, but it seemed like this was put together quickly. It almost felt like a half-finished program."
Stewart found lots of debug code in Gimmiv, as well as code that led nowhere. "Sections were supposed to do something, but never did," he said. "For example, it pings a website in China and then if that's not available, Google. It sends a special pattern in the ping but doesn't do anything with the results.
"It also gathers a lot of information about the [infected] system, such as e-mail passwords and the ActiveX controls on the PC, then encrypts the information. But it doesn't send it anywhere," Stewart added. "There are just a lot of thing here that don't fit your typical malware pattern."
One thing Stewart was sure of, though, is that Gimmiv is more than a simple password stealer, which is how some researchers originally described it. Instead, the Trojan uses a two-stage attack process in which the first stage is relatively unsophisticated, with the second significantly more complex.
"The difference between the first and second stages is that the first uses strong encryption but a weak key, while the second uses a much stronger key, and different keys for each function," said Stewart. The pattern led him to speculate that the first stage was a decoy for the second, which included backdoor and propagation components in its payload.
--------------------------
For those interested, a copy of the Gimmiv malware is available @ Offensive Computing.
No comments:
Post a Comment