Kaspersky and Microsoft Security Products Abused to Install Spying Trojan

[JerkyMcDilerino]

Source:  http://news.softpedia.com/news/kaspersky-and-microsoft-security-products-abused-to-install-spying-trojan-495993.shtml

 

Bookworm trojan can be used to spy on infected victims.

 

A new trojan discovered by Palo Alto Networks uses security software installed on the user's computer to side-load DLLs needed to install itself.

 

This new trojan named Bookworm by Palo Alto's staff, which also observed some similarities with the PlugX RAT.

 

For now, Palo Alto reports that the trojan has been seen in the campaigns of an advanced persistent threat(APT) group activating only in Thailand.

 

 

 

A layered approach to malware delivery
As for its internal structure and MO, Bookworm seems to be part of the new, rising trend of modular malware, malicious threats that slowly install themselves in multiple steps to avoid detection, while also using a remote C&C server to control what components to load based on the profile of infected targets.

The internal architecture of a Bookworm trojan is simple. Multiple malicious DLLs are encrypted using an XOR algorithm and bunched together into a readme.txt file.

This readme.txt file is then put together with clean executables and some DLLs into a self-extracting RAR archive, which in turn is encapsulated with the Smart Installer Maker, an application for building installation packages.

The installer this application produces is the one that hackers are distributing. When executed, the installer triggers the self-extracting hardware that unloads the malicious readme.txt, the clean DLLs, and the clean EXE.

The trojan uses security products to install itself
After the installer finishes, it also automatically launches the clean EXE which it just extracted. This executable starts to look for executables from Microsoft Malware Protection (MsMpEng.exe) and Kaspersky Anti-Virus (ushata.exe).

When it finds one, it side-loads the clean DLLs into these executables and uses the permissions of those applications to install itself as a Microsoft service.

From here on out, Bookworm has all the permissions it needs to extract other modules from the readme.txt file, start communications with its C&C server, load other modules, and send stolen data to the C&C server.

Palo Alto researchers did not mention what other modules can be downloaded. They were hindered in their research by the fact that Bookworm used at least four encryption algorithms when talking to its C&C server (RC4, AES, XOR, and LZO).

 

 

[Trik'Stari]

Dayum, Malware is getting pretty damned sophisticated.

[AresKrieger]

It is always an arms race when it comes to software and right now I wouldn't say security is winning.

[GoodBytes]

And, this is why i use Malwarebytes.

Ideally you want to use something good and NOT popular.

[SurvivorNVL]

Ideally you want to use something good and NOT popular.

What do you normally recommend / use?  I personally use malwarebytes and ESET NOD 32 or F-Secure, but open to try others.

[GoodBytes]

So, they're going after everything?

Yup, Pretty much. That is why Microsoft is recommending that you install a third party Anti-virus, and not rely on Windows Defender. While it sounds bad, it does makes sense.  The idea of Windows Defender (Microsoft Security Essentials back in Win7 days), was to offer SOMETHING to users with expired or outdated anti-virus solution. While good at first, due to the popularity of the software, especially now with Windows 10, expect it to be compromised a lot.

[Gr0egercesg]

Shit!, im on kaspersky.

Although there was an update a few days ago so that might be a fix

[iwasaperson]

​

Yup, Pretty much. That is why Microsoft is recommending that you install a third party Anti-virus, and not rely on Windows Defender. While it sounds bad, it does makes sense.  The idea of Windows Defender (Microsoft Security Essentials back in Win7 days), was to offer SOMETHING to users with expired or outdated anti-virus solution. While good at first, due to the popularity of the software, especially now with Windows 10, expect it to be compromised a lot.

Security through obscurity is not real security, and is a terrible long-term solution.

​

​If I can't see the source code, how do I know the software is really doing its job? If anyone can see the source code ​and crackers still can't break it, that's real security.

​

​I wouldn't know how to accomplish that with an AV though, since I'm no security researcher.

[GoodBytes]

​

Security through obscurity is not real security, and is a terrible long-term solution.

​

​If I can't see the source code, how do I know the software is really doing its job? If anyone can see the source code ​and crackers still can't break it, that's real security.

​

​I wouldn't know how to accomplish that with an AV though, since I'm no security researcher.

There is an open source A/V if you want, like: clamwin

[Linus_torvalds]

And, this is why i use Malwarebytes.

And you think you are safe? on Microsofts software? LOL windows itself is biggest malware you can ever get "windows 10"

 

That is why i use LINUX (elementary OS)

[Linus_torvalds]

I use Linux and Windows.  Malwarebytes is not by Microsoft, but windows is.  Oh, and before you keep acting like Linux is so safe!

 

http://linustechtips.com/main/topic/482143-ransomware-reaches-linux/

I know that malwarebytes is not from MS, i was talking about windows.

 

Do you know that you have much more chance to win 5 million in lottery then get that virus on linux system

[MG2R]

So, I don't hate Linux and the reason Linux is like that, for security, is because a majority of the market/consumers are on Windows.

Actually, that's incorrect. Linux is more secure than Windows, due to its permission layout and strong separation between root and regular users, combined with the fact that open source development means you have thousands of people checking the source code for bugs and issues daily.

 

From the Wikipedia article about Linux malware:

 

There has not yet been a single widespread Linux virus or malware infection of the type that is common on Microsoft Windows; this is attributable generally to the malware's lack of root access and fast updates to most Linux vulnerabilities.^[2]

[Albatross]

Yikes!

 

Ideally you want to use something good and NOT popular.

 

But it is good? I have used it to destroy super infected computers for a while now, where others wouldn't work or even let me open them on an infected computer. What would you recommend instead?

[BuckGup]

Yup, Pretty much. That is why Microsoft is recommending that you install a third party Anti-virus, and not rely on Windows Defender. While it sounds bad, it does makes sense.  The idea of Windows Defender (Microsoft Security Essentials back in Win7 days), was to offer SOMETHING to users with expired or outdated anti-virus solution. While good at first, due to the popularity of the software, especially now with Windows 10, expect it to be compromised a lot.

Ehhh I use windows defender and make sure I know what I am downloading. 

[Sharkyx1]

This is less than a 4hr average

If people on average played 4hrs of GTA VV on console it would be over 200M hours

[Linus_torvalds]

Yes, but some of us need windows. I dual boot into 10 for more DX support since I am a game dev major. We can't all just work with Linux or OSX for that simple lack of API support. Yes, you can use WINE, but that doesn't have complete support and comes with far more problems. Using primarily OpenGL is not as profitable and supported as you'd hope. I do tri-boot actually. Fedora Live Workstation, Ubuntu, and Windows 10. University requires Windows 10 for our tools, but I like using Windows and Linux while I actually despise Apple products because of the type of person that Steve Jobs was. I even have a RPI model b for more Linux. So, I don't hate Linux and the reason Linux is like that, for security, is because a majority of the market/consumers are on Windows. It has nothing to do with the kernel at all. But, for gaming and game development...just using a Linux or UNIX based system is not enough.

You can develop on Vulkan. It's like DX12 if not better and it is crossplatform and has preaty good features. it runs on windows, linux, android. i do not know about mac but who cares.

[Dabombinable]

You can develop on Vulkan. It's like DX12 if not better and it is crossplatform and has preaty good features. it runs on windows, linux, android. i do not know about mac but who cares.

It runs on all platforms. And if it has all of the features of DX12, and is as easy to program for if not easier, MS will have to start another "get people using our API" campaign.

[GoodBytes]

You can develop on Vulkan. It's like DX12 if not better and it is crossplatform and has preaty good features. it runs on windows, linux, android. i do not know about mac but who cares.

Apple OpenGL is old, as Apple want you to use Metal.

As for Android support, it will depend on the smartphone GPU. Most GPUs on smartphones don't fully support OpenGL. You have however, OpenGL ES a subset of OpenGL.