Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    September 2015
    S M T W T F S
    « Aug    
  • Email Subscription

  • About Us

    Author Archive - Philippe Lin (Senior Threat Researcher)

    The dissection of the data from the Hacking Team leak has yielded another critical discovery: Hacking Team uses a UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets’ systems. This means that even if the user formats the hard disk, reinstalls the OS, and even buys a new hard disk, the agents are implanted after Microsoft Windows is up and running.

    They have written a procedure specifically for Insyde BIOS (a very popular BIOS vendor for laptops).  However, the code can very likely work on AMI BIOS as well.

    A Hacking Team slideshow presentation claims that successful infection requires physical access to the target system; however, we can’t rule out the possibility of remote installation. An example attack scenario would be: The intruder gets access to the target computer, reboots into UEFI shell, dumps the BIOS, installs the BIOS rootkit, reflashes the BIOS, and then reboots the target system.

    We’ve found that Hacking Team developed a help tool for the users of their BIOS rootkit, and even provided support for when the BIOS image is incompatible:

    Figure 1. Technical support provided by Hacking Team

    In installation, three modules are first copied from an external source (this might be from a USB key with UEFI shell) to a file volume (FV) in the modified UEFI BIOS. Ntfs.mod allows UEFI BIOS to read/write NTFS file. Rkloader.mod then hooks the UEFI event and calls the dropper function when the system boots. The file dropper.mod contains the actual agents, which have the file name scout.exe and soldier.exe.

    Figure 2. Files copied when the UEFI BIOS rootkit is installed

    This means that when the BIOS rootkit is installed, the existence of the agents are checked each time the system is rebooted. If they do not exist, the agent scout.exe is installed in the following path: \Users\[username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6To_60S7K_FU06yjEhjh5dpFw96549UU. 

    Figure 3. The RCS agents installed in the target systems>

    Although the dropper checks the existence of soldier.exe, it does not install the file for some unknown reason.

    Figure 4. Scoute.exe (the agent’s name in debug mode) is deployed to every user in \Users\[username]\Appdata

    Figure 5. Deployment of scoute.exe

    This finding is only the most recent among the numerous discoveries triggered by the Hacking Team leak. So far, three Adobe Flash zero-day vulnerabilities have been discovered from their files, although this particular finding gives more context on their activities. While we are not certain of who have been affected, the fact that the group dubs the tool “The Hacking Suite for Governmental Interception” which clarifies for whom the tool is intended.

    To prevent being affected by this, we recommend users to:

    • Make sure UEFI SecureFlash is enabled
    • Update the BIOS whenever there is a security patch
    • Set up a BIOS or UEFI password

    Admins managing servers can also opt to buy a server with physical BIOS write-protection, wherein the user will need to put a jumper or turn on a dip switch in order to update the BIOS.


    Timeline of posts related to the Hacking Team

    July 5 The Italian company Hacking Team was hacked, with more than 400GB of confidential company data made available to the public.
    July 7

    Three exploits – two for Flash Player and one for the Windows kernel—were initially found in the information dump. One of these [CVE-2015-5119] was a Flash zero-day.

    The Windows kernel vulnerability (CVE-2015-2387) existed in the open type font manager module (ATMFD.dll) and can be exploited to bypass the sandbox mitigation mechanism.

    The Flash zero-day exploit (CVE-2015-5119) was added into the Angler Exploit Kit and Nuclear Exploit Pack. It was also used in limited attacks in Korea and Japan.

    July 11 Two new Flash zero-day vulnerabilities, CVE-2015-5122 and CVE-2015-5123, were found in the hacking team dump.
    July 13 Further analysis of the hacking team dump revealed that the company used UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets’ systems.
    July 14 A new zero-day vulnerability (CVE-2015-2425) was found in Internet Explorer.
    July 16 On the mobile front, a fake news app designed to bypass Google Play was discovered.
    July 20 A new zero-day vulnerability (CVE-2015-2426) was found in Windows, which Microsoft fixed in an out-of-band patch.
    July 21 Analysis of the RCSAndroid spying tool revealed that Hacking Team can listen to calls and roots devices to get in.
    July 28 A recent campaign compromised Taiwan and Hong Kong sites to deliver Flash exploits related to Hacking Team.



    Compromised websites are part of many attacks online. They can be used to host a variety of threats, ranging from simple spam pages, to redirection pages, to actual malicious files.

    We recently came across a case that highlighted the scale of this threat. A backdoor (detected as BKDR_FIDOBOT.A), was being used to brute-force many WordPress blogs. It tries to log into Joomla and WordPress administrator pages at /administrator/index.php and /wp-login.php. To do this, it connects to a C&C server, where it downloads a list of sites to target as well as passwords to use. (It consistently uses admin as the user name.) Successful logins are also uploaded to the same C&C server.

    Over the course of a single day, this backdoor was used to try and attack more than 17,000 various domains. This would total more than 100,000 domains in the course of a single week. This was from a single infected machine alone; with any botnet of decent size many more sites would have been at risk from this attack.

    The targeted sites were mostly found in the United States, with almost two-thirds of the attacked sites being from that country. Countries in Europe made up the rest of the top five. Majority of the sites affected are either owned by individuals or small businesses, as they are the sectors likely to use WordPress and Joomla as content management system.


    Figure 1. Distribution of targeted sites

    This attack in itself is particularly troubling. However, when looked at a bigger picture, such massive attempts to login into numerous WordPress sites can be a possible precursor of a more menacing attack. The Stealrat botnet operation, for example, uses several compromised WordPress sites to generate spam and conceal its operations.  The notorious Blackhole Exploit kit has also used several WordPress sites to redirect users to its final payload.

    Threats like these highlight how important it is for site administrators to properly secure content management systems (CMSes) like WordPress. Best practices like keeping the software up to date as well as using strong passwords are a must to prevent sites from being compromised. A compromised site could affect many thousands of users, so it is much more important for administrators to secure their passwords. Settings and plug-ins to help secure CMSes are available to administrators, and they should use them appropriately.

    One more interesting thing about the backdoor that was used to carry out this attack. Its file properties claim that it was published by a legitimate software vendor, as well as making a reference to the NSA’s PRISM program:

    Figure 2. File properties

    The Smart Protection Network was able to provide the information necessary to help us analyze this threat, as well as protect our users against it. In addition, we use the Smart Protection Network to provide multiple layers of defense against this threat – including blocking the malicious C&C server and detecting the malicious backdoor.

    Posted in Bad Sites | Comments Off on Joomla and WordPress Sites Under Constant Attack From Botnets


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice