The Hacking Team, RCS, Qatif Today, and Lawful Interception Malware

Is malware still malware if it’s used by legal authorities to track down criminals? How about when it’s used by governmental agencies to monitor citizens’ computers and keep an eye on political dissent? Is it malware if it’s sold by a legitimate software development company and marketed strictly for use in instances of lawful interception? What if there are currently no clear-cut, legal guidelines to determine exactly what lawful interception is? New research from University of Toronto’s Citizen Lab begs all of these questions, and reveals that present-day Internet activity monitoring technology is much more comprehensive, affordable, and user-friendly than any Big-Brother-fearing netizen had ever feared or thought.

They Call Themselves The Hacking Team

And they have a website, too. The Hacking Team is a legitimate software development company based in Italy that makes a product called RCS – Remote Control System. RCS is a full blown computer and mobile device monitoring kit, capable of infecting, controlling, monitoring, and exfiltrating data from a target device. How is this legal? Well, it is legal mostly because it is unprecedented (at least in the commercial sector) – and also because The Hacking Team enforces a strict user policy:

We will refuse to provide or we will stop supporting our technologies to governments or government agencies that:

• We believe have used HT technology to facilitate gross human rights abuses.


• Who refuse to agree to or comply with provisions in our contracts that describe intended use of HT software, or who refuse to sign contracts that include requirements that HT software be used lawfully.


• Who refuse to accept auditing features built into HT software that allow administrators to monitor how the system is being used.

However – and this is a big however – recent research from academics at Citizen Lab has revealed that The Hacking Team’s technology may be being used by the Saudi Arabian government to monitor and suppress political activists who utilize social media to voice their dissent. Of course, there is really no way of ever proving this, as one of RCS’s most potent capabilities is a remote wipe module that allows users to permanently remove the application from an infected device and leave no trace – more on this later – but the evidence presented by Citizen Lab is strong; and, even if it is circumstantial it raises important questions that the future of Internet Security must ask.

A News App Called Qatif Today

Saudi Arabia has long been in the cross hairs of human rights activists. Long story short: they have a reputation for controlling the way their citizens access and use the Internet. Since most people enjoy freedom, this control, combined with numerous other injustices Citizen Lab outlines in part one of their latest post, has caused not a small amount of political dissent amongst Saudi Arabian citizens. Ironically, this has also made the Internet prime territory for dissenters – as in any country with limited free speech, protesting in the streets is a good way to get fire-hosed, thrown in jail, or, sadly, even shot. In this latest development, Citizen Lab found that someone posted a news app called Qatif Today on a third party app market and in a Twitter post. Research revealed that instead of a mobile app that provided news stories relevant to the eastern Saudi Arabian province, this Qatif Today was actually a Trojan that contained technology strikingly similar to The Hacking Team’s RCS. Interestingly enough, there is actually a real Qatif Today app as well. What is particularly relevant about the Saudi’s choice of Trojan, is that the Qatif province has a strong history of active protest against the Saudi Arabian government. This protest still continues to this day, and despite governmental restrictions on Internet usage, Saudi Internet journalists comprise a strong portion of the protest’s voice – Saudi Internet journalists being exactly the type of people who would download a news app called Qatif Today. At this point, nothing has been proven, but Citizen Lab’s rigorous analysis of the malware is about as close to an accusation as one can get. The lab is of course not directly saying that The Hacking Team sold RCS to the Saudi government knowing full well that the software would be abused; but, they are strongly hinting that said government somehow got their hands on RCS – and that since is the case, stronger regulations of RCS and software like it need to be imposed. Citizen Lab was also kind enough to show us exactly how scary and powerful this RCS type stuff is.

Malware Monitoring at Your Service

Again, for the full effect, we recommend setting aside about an hour of your day and diving deep into the official article. There is some very fine journalism and malware analysis going on at the Citizen Lab blog. Important note though: There is no solid proof that what Citizen Lab analyzed was actually RCS. What they found was malware that bore a striking resemblance to what they know about RCS, based on previous analysis and investigation. Nonetheless, it’s still pretty scary what this kind of stuff can do. Here is a list of point-and-click ways through which a Technician – one of the malware kit’s assignable, privilege-based roles – can craft an installer:

• Network Injection:  via injected malicious traffic in cooperation with an ISP


• Tactical Network Injection: on LAN or WiFi


• Melted Application: bundling a Hacking Team dropper alongside a bait application


• Installation Package: a mobile installer


• Exploit: document-based exploit for mobile and desktop


• Local Installation: mobile installation via USB or SD card


• Offline Installation: create an ISO for a bootable SDHC, CD, or USB. This option includes the ability to infect hibernated and powered off devices


• QR Code:  a mobile link that, when pictured, will infect the target


• Applet Web: likely a malicious website (depreciated after v. 8.4)


• Silent Installer: a desktop executable that will install the implant


• Infected U3 USB: an auto-infecting U3 USB


• WAP Push Message: the target will be infected if the user accepts the message (works on all mobile operating systems apart from iOS)

Once infected, here is a list of things someone with Analyst privileges can analyze, or someone with Admin rights can tell the infected device to do:

• Accessed files


• Address Book


• Applications used


• Calendar


• Contacts


• Device Type


• Files Accessed


• Keylogging


• Saved Passwords


• Mouse Activity (intended to defeat virtual keyboards)


• Record Calls and call data


• Screenshots


• Take Photographs with webcam


• Record Chats


• Copy Clipboard


• Record Audio from Microphone with additional Voice and silence detection to conserve space


• Realtime audio surveillance (“live mic:” module is only available for Windows Mobile)


• Device Position


• URLs Visited


• Create conference calls (with a silent 3rd party)


• Infect other devices (depreciated since v. 8.4)

On top of all this, and perhaps most frighteningly, it was found that this Trojan Qatif Today – a malware, mind you, that could be RCS, a legitimate, proprietary software marketed and sold to governments around the world – can:

• Send a “scout” infection agent to “pre-infect” a device, to ensure that the real malware won’t get detected


• Permanently destroy itself if it fails to install or if someone tries to analyze it


• “Define events that trigger particular actions, sub-actions, modules, and sequences.” I.e., you go to a political website, it wakes up and starts recording your screen.

Lawful Interception Malware

Now, before we or anyone else points the finger cursor at The Hacking Team, there is still one very important counterpoint to consider. This is a counterpoint that is largely ignored by a post-Snowden media looking for and loving all things digital that bleed. The counterpoint is: Lawful Interception. Like most nascent legal concepts, what lawful interception is is still open to debate, but in essence it means that legal authorities pursuing criminals should be given the right to employ the usage of technologies like RCS. At an glance and on paper, this definition seems reasonable enough, but laws in a world and for a world of infinite connections legal definitions are never so simple.

• Question one: Can, or rather, should a legal agency use tools like RCS against criminals and terrorists, even if it means they can monitor innocent citizens as well?

• Question two: Should a global, free market economy allow a company to respond to demand by creating malicious software and selling it to anyone who can prove legitimate usage and cash?

• Question three: Is the government watching you… right now?

All of these are important questions – the answers to which have important implications for the future of the web. Because they are complex, these are also answers that extend way beyond the scope of any one blog post that has already exceed 1400 words. But this is why blogs have comment sections. More importantly, and seriously however, this is why we as company do what we do. Which is this: Protect people from malware by making anti-malware – no matter who’s making the malware and no matter who’s using it too. Have a Great (You know what free) Day!

Related Posts:

• Rat Warning: WinSpy and GimmeRAT


• The Federal Trojan Background and a statement from Emsisoft


• Metadata and Mobile Security


• BlackShades RAT Users – Busted


• Emsisoft Alert: Netflix Tech Support Scam

The Hacking Team, RCS, Qatif Today, and Lawful Interception Malware

LinkedIn Lawsuit: Mining Email Contact Lists

Privacy Alert: LinkedIn is facing a lawsuit for using its users’ external contacts lists to send recruitment messages to potential new users. If you have a LinkedIn account, this could be happening to you.

LinkedIn Contact List Mining

When you sign up for a LinkedIn account, you must connect the account to an external email address. When you do so, you also give the company consent to access that email’s contacts list. This is how LinkedIn creates its People you may know function – people you may know are simply LinkedIn users who have registered accounts using an email address that also appears on your contacts list.

As LinkedIn states in its Privacy Policy:

We collect information when you sync non-LinkedIn content – like your email address book, mobile device contacts, or calendar – with your account. We use this information to improve your experience and allow you and your network to be better connected. You can remove your address book and any other synced information whenever you’d like.

The issue at hand, and the reason LinkedIn is facing a lawsuit is that they are also using their users’ external email accounts to send LinkedIn marketing emails to contacts who are not LinkedIn members.

To be clear, as much of the media surrounding this issue is not, LinkedIn is not hacking their users’ external email accounts – they are simply accessing information they have been given consent to access and using pre-existing members’ identities as LinkedIn endorsements.

So, for example, if you are not a LinkedIn member but your friend Bob is and you are on Bob’s email’s contacts list, you might receive an email from LinkedIn saying something to the effect of “Join Bob on LinkedIn.”

The problem, and the reason this lawsuit is moving forward, is that LinkedIn is somewhat aggressive in their email marketing frequency. If a non-member receives a recruitment email and they do not respond, they will subsequently receive multiple recruitment reminders – all to the effect of “Look what you’re missing out on. You should Join Bob.”

According to U.S. District Judge Lucy H. Koh, these reminders may violate California’s right of publicity, “which protects against the appropriation of someone’s name or likeness, without their consent, for commercial purposes,” because “nothing in LinkedIn’s disclosures alerts users to the possibility that their contacts will receive not just one invitation, but three.”

Legitimate Concern or a Class Action Cash Cow?

Those pressing charges against LinkedIn want the company to stop what it is doing. They also want to be compensated for any profit LinkedIn may have earned through the use of their identities in LinkedIn endorsements. Of course, LinkedIn is innocent of all charges until proven guilty, and until that time the question remains:

Should a social network be allowed to extend its reach without its users’ explicit consent?

The answer has important implications that will undoubtedly affect the future of our Internet.

Have a Great (Malware-Free) Day!

Related Posts:

• Emsisoft Fraud Alert: LinkedIn Data Breached by Fake…


• Emsisoft Fraud Alert: LinkedIn Data Breached by Fake…


• Amazon spam: “Your Order Processed Today”


• More malware spam campaigns


• Emsisoft warnt vor Betrug: Datenklau bei LinkedIn mit…

LinkedIn Lawsuit: Mining Email Contact Lists

Brand New Trojan Malware “Pandemiya” Written from Scratch

Attention: A brand new malware has hit the Trojan scene – they call it Pandemiya.

Reportedly written from scratch and consisting of more than 25,000 original lines of code, it is selling on underground markets for $1500-$2000. Those who have discovered Pandemiya report that the malware took over a year to write, but in the wake of last week’s FBI crackdown on CryptoLocker and Zeus Pandemiya’s popularity and distribution is likely to surge.

Pandemiya’s Powers

Pandemiya is a completely original malware, meaning it has been built with completely original code. This is a rare development in malware-land, as doing so requires a great deal of criminal-commitment and work. Usually, malware “authors” just borrow bits and pieces of code from other pre-existing malware; and, in recent years that pre-existing malware has usually been Zeus. Last week’s international Zeus bust has thrown somewhat of a wrench in that strategy, however, and in response we are now seeing the high price emergence of the Trojan Pandemiya.

Accordingly, Pandemiya’s capabilities are relatively standard:

• Steal user credentials through injected web forms and log-in pages


• Steal user files with File Grabber


• Take screenshots of infected computer

Additionally, Pandemiya utilizes a modular design, meaning it can be expanded upon with for-purchase plug-ins – much like you would do with your web browser. This final capability suggests that the malware has been created with a large-scale economy and distribution network in mind. Most notably, an experimental Facebook spreader plug-in has already been discovered.

How to Avoid Pandemiya

Initial research indicates that, like most Trojans, Pandemiya is being distributed through drive-by download websites that automatically initiate install. As such, users should remain vigilant against mysterious links found on social networks or delivered via email.

For added defense, Emsisoft Anti-Malware’s Surf Protection technology can automatically prevent connection to drive-by websites that install Pandemiya.

More on Pandemiya

Pandemiya was discovered by researchers at RSA Security. They have produced a detailed technical analysis of this new malware on their blog.

Notably, researchers write that Pandemiya utilizes a number of advanced features that will unfortunately bolster the malware’s perniciousness. Both encrypted server communication and a function that injects Pandemiya into every newly opened Windows process of an infected computer are among these capabilities.

Most importantly, the blog entry also contains detailed Pandemiya removal instructions for advanced users.

As always, anyone who believes they may be infected by this Trojan is encouraged to contact Emsisoft Support for assistance. Malware removal is free, even if you are not an Emsisoft customer yet.

 

Have a Great (Malware-Free) Day!

 

 

 

 

Related Posts:

• Zberp Banking Trojan: A Hybrid of Carberp and Zeus


• Authorities Crackdown on Gameover Zeus and CryptoLocker


• OldBoot Bootkits – Advanced Android Malware


• Watch out for iBanking Android Rogue on Facebook


• PayPal Vulnerability Publically Disclosed

Brand New Trojan Malware “Pandemiya” Written from Scratch

Warning: File Encrypting Ransomware, Now on Android

Warning: File encrypting ransomware has gone mobile – infection can permanently encrypt all of the files stored on your Android device.

Simplocker Android Ransomware

The Simplocker Android ransomware is the first mobile malware capable of encrypting an Android device’s contents.

Simplocker Capabilities

• Identify files with common extensions, such as .jpg, .mp4, or .doc, and apply an encryption algorithm that blocks user access.


• Demand payment through online money service to unlock.


• Steal device information, such as unique IMEI number and OS version.


• Communicate with C&C server located on the Tor anonymity network.

Simplocker is not the first mobile ransomware ever, but it is the first to have encryption capability. Last month, a less advanced mobile ransomware emerged that utilized screen locking to demand ransom. Simplocker’s added capabilities represent an evolution, and suggest that malware authors are putting a great deal of effort into mobile ransomware development.

How to Avoid Infection

At this point, the chances of Simplocker infection are relatively low. The malicious app it comes on is called Sex xionix, and it can be found on a third-party, Russian language app market. Simplocker does however represent a new step in mobile malware, and it is highly likely that it will be followed by more advanced breeds.

The highly personal nature of most smartphone data (photos, videos, journal entries and notes) makes mobile ransomware a dangerous weapon. To protect yourself from this growing threat, you should take steps to backup your files as soon as possible.

For proactive protection, you can also consider a mobile anti-malware, like Emsisoft Mobile Security.

In the event that you have become infected by Simplocker, or any other type of ransomware we do not recommend paying the ransom unless you absolutely have to regain access to the files. Payment does not ensure reentry, and it only works to encourage cyber criminals more.

Have a Great (Mobile-Malware-Free) Day!

 

 

 

Related Posts:

• BadLepricon Mobile Malware Mines for Bitcoin Gold


• Copycat Ransomware “Locker” Emerges


• Preview: Emsisoft Mobile Security offers protection for your


• OldBoot Bootkits – Advanced Android Malware


• ALERT: Ads on Disney, Facebook, Guardian Lead to Ransomware

Warning: File Encrypting Ransomware, Now on Android

ALERT: Ads on Disney, Facebook, Guardian Lead to Ransomware

Malware Alert: Malicious advertisements hosted on domains owned by Disney, Facebook, and The Guardian have been leading people to hacked websites that serve a file-encrypting ransomware called Cryptowall.

How to Avoid Infection

Malicious advertisements, or “malvertisements,” are banner or side window ads hosted on legitimate websites, which, when clicked, lead users to a malicious website where they will become infected with malware.

This recent malvertising campaign affects many domains owned by many major companies, including:

• apps.facebook.com


• www.theguardian.com


• go.com (owned by Disney)

If you click on a malvertisement hosted on one of these websites – and you are not running a comprehensive anti-malware – you will be led to a hacked WordPress website designed to automatically infect your computer with the Cryptowall ransomware.  Cryptowall will then encrypt your computer’s files and demand payment for recovery.

At present, the best way to avoid infection is to avoid clicking ads hosted on affected websites until the matter is officially resolved. A full list of websites impacted by this campaign can be viewed here.

More Details on this Threat

This latest malvertisement campaign was spotted when Cisco Systems noticed some unusual behavior on systems running their CWS product. Cisco has produced a detailed technical analysis of the campaign and its discovery here.

Anyone running Emsisoft Anti-Malware or Emsisoft Internet Security is automatically protected from the Cryptowall ransomware served in this malvertising campaign. Anyone who thinks they may be infected by Cryptowall can contact Emsisoft Support for help. Our malware removal services are always free, even if you’re not an Emsisoft customer yet.

Finally, because Cryptowall is a ransomware, there is no guarantee for file recovery if your files have been encrypted. For this reason, you should only consider paying the ransom if you absolutely must regain access to the files.

Have a Great (Malware-Free) Day!

Related Posts:

• Emsisoft Malware Warning: Yahoo…


• Emsisoft Malware Warning: Yahoo…


• Emsisoft Malware Warning: Yahoo…


• Special Delivery: Malware via UPS Email Scam


• Warning: Dropbox and Box File Sharing Security Bug

ALERT: Ads on Disney, Facebook, Guardian Lead to Ransomware

Authorities Crackdown on Gameover Zeus and CryptoLocker

The US Department of Justice (DoJ) has just announced that the FBI, Europol, and the UK National Crime Agency have worked together to crackdown on none other than those behind Gameover Zeus and CryptoLocker.

How’s that for a more Malware-Free World

Operation “Tovar” Cracks Down on Gameover Zeus and CryptoLocker

“Gameover Zeus” is a variant of the notorious financial Trojan Zeus, a potent malware designed to steal financial log-in credentials from users who bank online. Gameover is distinct because it has been centrally organized by hackers from Eastern Europe since October 2011, and because it uses P2P technology to build a botnet of zombie computers.

According to the DoJ, Gameover Zeus has infected approximately 500,000 – 1 million computers worldwide, allowing for $100 million in account theft.

The global investigation also revealed that the gang behind Gameover was leveraging the botnet to distribute CryptoLocker – the file locking ransomware which first emerged in September 2013 and which has infected an estimated 234,000 users worldwide.

The DoJ press release notes that authorities are also actively engaged in a separate effort to combat CryptoLocker, unconnected to the Gameover Zeus take down.

2 Week Disruption of Malware Networks – Now is the time to clean

Efforts from authorities have effectively disrupted the computer networks that tie Command and Control servers to infected zombie computers in the Gameover Zeus botnet. The separate campaign against CryptoLocker has also disrupted its distribution.

Authorities emphasize that this disruption will only last for an estimated 2 weeks, after which time cybercriminals will likely reorganize.

This means that if you think you may be infected by Gameover Zeus or CryptoLocker, now is the time to clean up your computer! That these malware have disconnected from their control structures is no guarantee for recovery, but it can greatly increase the odds of removal. If you think you might be infected, please contact our experts at the Help My PC is Infected! support forum as soon as possible. Support is free, even if you’re not an Emsisoft user yet.

Have a Great (Malware-Free) Day!

Interested readers can find more about Operation Tovar at the DoJ’s official website here.

 

Related Posts:

• Alert! Monster.com Serving Gameover Zeus


• Zeus Found Crawling through Salesforce.com


• New Zeus Variant with Digital Certificate


• OldBoot Bootkits – Advanced Android Malware


• ALERT: 18 Million Email Accounts Compromised

Authorities Crackdown on Gameover Zeus and CryptoLocker

Alert: All in One SEO WordPress Plugin Vulnerable

Warning: The popular All in One SEO Pack WordPress plugin has been deemed vulnerable to privilege escalation and cross site scripting attacks. All versions of the plugin prior to the recently released 2.1.6 are affected. To mitigate this threat, download version 2.1.6 as soon as possible.

Privilege Escalation

The discovered privilege escalation vulnerability allows WordPress users to modify your website’s SEO components without needing administrator permissions. A malicious actor could do so to negatively impact your website’s search engine ranking.

Cross Site Scripting

The discovered cross site scripting (XSS) vulnerability allows an attacker to inject malicious Javascript code into a WordPress administrator’s control panel. That code could be designed to perform any number of malicious actions, including the installation of a backdoor for monitoring purposes.

Ensuring Protection

The most immediate method of threat mitigation is to download the official plugin update to version 2.6.1. Additionally, you should evaluate how users interact with your WordPress site. Disabling open registration can increase your site’s security and can help protect it from future threats of this nature.

More details on these vulnerabilities can be found at the Sucuri Blog.

Have a Great (Malware-Free) Day!

Related Posts:

• WordPress Sites Used for DDOS Attacks


• Warning: Internet Explorer Zero Day CVE-2014-1776


• Hack Your Facebook Friends? More Like Hack Yourself.


• Firmware Vulnerabilities Discovered on Linksys and ASUS…


• Security advice: Be careful when using Java

Alert: All in One SEO WordPress Plugin Vulnerable