CVE-2013-0640 今年度最新 PDF 漏洞 被用在 APT 攻擊

今年最新的惡意文件漏洞被發現在真實攻擊中 !

我們在4月初收到這個新的 PDF Exploit, CVE-2013-0640。這個 Exploit非常特別 ! 因為自從 Adobe 10之後新版改良成 Protected Mode (Sandbox)模式起動後，駭客要做出 PDF Exploit來攻擊 Adobe Reader並不容易，也導致這一年半來PDF樣本在台灣算是很少見的。不過今年的2月初，國外的駭客在我們農曆春節間作出最新的攻擊 Adobe  Reader 11，這個惡意文件是用了兩個漏洞結合起來的，分別為 CVE-2013-0640, CVE-2013-0641這是非常高端設計的惡意文件，漏洞的利用非常的複雜。

在今年2月時候也被用在國外的APT攻擊中，當時 Xecure Lab就進行了分析。

http://www.fireeye.com/blog/technical/cyber-exploits/2013/02/the-number-of-the-beast.html

http://www.infosecisland.com/blogview/22926-Latest-Adobe-Zero-day-is-Serious-Business.html

這個Exploit在2月當時還是 Zero-Day Exploit, 不過目前已經有修補

http://www.adobe.com/tw/support/security/advisories/apsa13-02.html

苦等了2個月... 我們終於在台灣的實際APT樣本中看到

Let's gossip what happens in South Korea

Last week a big cyber operation called DarkSeoul got massive attention on security community as well as on the whole world - South Korea under cyber attacks. Since then for almost a week we can't easily reach any Korean friends, and all sorts of news came out on the Web.

So here is our version. We first shared with CHROOT, HITCON, close partners, then you our readers.

Well, first, how bad?
Let's rereview the impacts on the day March 20th: (Thanks GD/Chroot for the summary)

Nonghyup Bank: 2,000 computers in 30 branches got affected, front desk activities suspended, more than half of ATM got shutdown
Shinhan Bank: 57 branches got affected, all database system crashed or stopped functioning, all transactions halted for 2 hours
Jeju Bank: unknown number of employees' PC got affected, all ATM got shutdown
KBS TV station: 5,000 computers got compromised, radio broadcasting stopped, official websites shutdown
MBS TV station: 800 computers got compromised, half of employees' PC shutdown, internet connections suspended, all using notebooks
YTN TC station: 500 computers got compromised, News broadcasting stopped
LG UPlus ISP: intranet computers got compromised, website got defaced

3 hours after the cyber attack, the military's INFOCON raised from 4 to 3 (normally it's 5).

Xecure Lab did some research on the malware and here's what we like to share.

南韓大顆首爾( DarkSeoul) 大規模APT攻擊事件

上禮拜資安界發生一個大事件 - 韓國被APT大規模攻擊，也被稱為 DarkSeoul 大顆首爾事件(目前還沒有中文對應的翻譯，所以統一用我翻的...嘿嘿)。規模之大也是前所未有，整個故事值得各界借鏡。各大媒體與廠商都出來嘴砲，不免俗地，我們也來給它湊一嘴 :)

先幫大家回憶一下 3/20 發生哪些事 ? (感謝GD/Chroot 整理)

農協銀行：30 分行 2000台電腦受害，櫃檯業務停止，半數 ATM 停機
新韓銀行：57 分行受害全資料庫停止，全服務停2小時，簽帳卡無法刷
濟州銀行：受害狀況不明行員電腦為主，全部 ATM 停止
KBS 電視：5000 電腦受害，廣播電台停播，釜山晚間停播，官方網站關閉
MBS 電視：800 電腦受害，半數員工停機，外部片源斷線一律筆電作業
YTN 電視：500 電腦受害，電視播送正常，新聞系統停機
LG UPlus ISP：內部電腦被破壞，網站被置換

這三間銀行幾乎是韓國前三大銀行，事件剛發生，甚至韓國國家軍方INFOCON由4提升到3。

Xecure Lab 針對這個事件的惡意程式樣本作了一些研究與探討...

Prepare for the "Advanced Persistent Threat" Warfare

Advanced Persistent Threat (APT) has became a tough security challenge that large organizations and important individuals must be prepared for worst sooner or later. Last year at Defcon 2011, we shared our novel DNA approach in detecting and clustering APT document exploits. We were able to find 8 sizable APT attacker groups from our collections. At that time, it was a pool close to one thousand APT samples. A year later, we expand our study to cover more than a dozen thousand samples. Last week we had shared these interesting results to the attendees of HITCon 2012.
In this talk, we co-speak with Mr. Li (Director of Computer Center, National Police Agency of Taiwan) on the current status of APT cyber operations. Highlights of our findings include:

• APT happens almost everywhere. Some locations were confirmed as the targets were willing to share with us their stories. Other than that, we studied the content of APT samples, looking for clues of the potential targets. The legitimate content could be in some unique languages, e.g. Traditional Chinese, Simplified Chinese, etc. The exploits might required unique environment to be triggered. We also found some callback destinations tend to be located near the targets. 

• Taiwan (28.2%) had most APT callbacks or C2 (command & control) servers, followed by United States (17.2%), South Korea (14.4%) and China (10.5%).

• Document exploits (97.62%) have been an all-time favorite for APT targeted attacks. Among these malicious documents, PDF (39.31%) ranked the most commonly-seen file type, followed by the office family: RTF (22.92%), DOC (17.45%), XLS (10.51%), and PPT (7.43%).

• In recent years, the popularity of RTF (51.4%), DOC (14.5%), XLS (24.9%) had increased dramatically, surpassing PDF. And very often RTF is being disguised as DOC.

• We saw a significant rise of password-protected document starting this year 2012. One particular attacker group leverage this trick heavily (65.9%) as it bypassed all antivirus and sandbox.

• A great amount of exploits could be dig from these APT documents. A 2-year old RTF exploit CVE-2010-3333 is still very popular. In the wild, this exploit is very easy to be triggered successfully. 

• We identified 33 sizable APT attacker groups around the world. Each node in the graph represents a species (yup, DNA), the color of each species indicate the time it's firstly seen (built). Yellow color means 2012, green is 2011, blue is 2010, orange is 2009, pink/white is 2008, etc. Different species might be linked with one or several edges. Each edge represents there is some similarity of the two nodes. Each cube or rectangular means the nodes inside belong to the same APT family - the same APT attacker group.  

In summary, we found APT cyber operations are happening around the world. They mostly use document exploits and starting this year password-protection trick is added. At least one callback is located near the target for testing network connection, or it's actually the C2 server with smooth bandwidth. After all, we identified 33 notable APT attacker groups, indicating advanced cyber operations typically are conducted in groups, well-organized and highly disciplined.

Finally, we would like to say big thank you to friends in the community and our users who are willing to feedback to us. Security is all about collaborative defense. It's everyone's work.
"If we know both ourselves and our enemy, we can win numerous battles without jeopardy". (The Art of War)

Sincerely,
Jeremy Chiu (Birdman), Benson Wu and Anthony Lai
Xecure Lab

[ 特別通報 ] APT 惡意文件新攻擊手法 ! 擊敗所有自動化分析沙盒與掃毒軟體 !

最近這半個月來我們持續收到一些特別惡意文件，這些惡意文件有一個特色都是沙盒與掃毒軟體偵測全都是 0 !而且是完美的免殺。 上傳到VirusTotal, ThreatExpert 與 CWSandbox 全都無法分析 ! 看來駭客已經找到躲過目前所有 Anti-APT 完美方案。

9plus的 Brandon 在他的Blog(http://blog.9bplus.com)也有發現最近這些樣本

就是這麼神奇 ! XecScan在不需要更新下就可以全部捕獲，沒有誤判漏報 !
http://scan.xecure-lab.com

Malicious PDF used in APT attacks exploiting new variants of CVE-2012-0754

Xecure Lab has discovered a new CVE-2012-0754 Flash player exploit variant being used in recent APT activities. The earliest version came from a Word document named "Iran's Oil and Nuclear Situation.doc" (see Mila's blog), where the embedded Flash codes would download an MP4 file from a remote server that contains the actual exploit codes for triggering the Flash bug. Today, the new variant we found is a malicious PDF and the MP4 is self-contained in the PDF!

新版免費APT鑑識服務上線啦 XecScan release!

新版免費 APT 鑑識服務上線啦
XecScan http://scan.xecure-lab.com/


這是之前 aptdeezer的改版，聯名字也改版了，一樣都是分析APT的惡意文件為主，所以是不支援 EXE的分析喔 :P


這次除了原本的APT sample clustering功能之外,還多了malware的forensics report分析，他會透過非VM且特殊到不行的特殊分析方式
分析APT的 Malware，反正你多用就對了 :)

有時候前面很多同學在上傳，大家守秩序，耐心排隊 :D

這個新功能還是 Beta 中，為來還會陸續改版，大家多多測試，可以給我們更多建議!


info@xecure-lab.com
實驗室工友敬上