2010 and Beyond

The year of 2010 has been an interesting for malware researchers. From the attacks on Google through to the ShadowNet there have been many interesting cases that targeted high profile targets. However, traditional threats such as Zeus, Spyeye and fake antivirus software continue to be what most Internet users face on a daily basis. Moreover, while attacks that are motivated by politics and espionage are increasing, money continues to be the primary driving force in the malware ecosystem. Here's my thoughts on some of the trends I've focused on this year that we can expect to continue into 2011.

Political motivated DoS attacks
Denial of service attacks continue to be used in order to deny access to web sites at critical times. While the attacks by Anonymous in support of Wikileaks (see Arbor's analysis here and here) have received much media attention, the website of Wikileaks was attacked just prior to the release of leaked diplomatic cables. However, as the Berkman Center has documented, (distributed) denial of service attacks against non-governmental and independent media continue with an alarming frequency. These attacks are aimed at disabling access to key information resources at specific points in time.

My colleagues Deibert and Rohozinski argue that "[d]isabling or attacking critical information assets at key moments in time—during elections or public demonstrations, for example—may be the most effective tool for influencing political outcomes in cyberspace." In order to achieve this level of "on demand" disruption, those behind the attacks often outsource these types of attacks to botnets for hire thus blurring the boundaries between cybercrime and politically motivated attacks. We can expect to see a continuation of politically motivated DoS attacks in 2011.

Cyber-espionage
The year of 2010 began with the attacks on Google, dubbed Operation Aurora, which dramatically increased awareness of targeted malware attacks and signified that it is acceptable, and even prudent, that companies disclose such attacks. In fact, some companies began including warnings about such attacks in their SEC filings. However, it is not just companies that are the targets of such attacks, human rights organizations and government systems are compromised as well. In April 2010, the Information Warfare Monitor and the Shadowserver Foundation released a report "Shadows in the Cloud: An investigation into cyber espionage 2.0" in which we document a targeted malware network that extracted secret, confidential and restricted documents from the Indian government and military. (While this report was a follow-up to our previous report on cyber-espionage, "Tracking GhostNet" the networks are quite separate.)

While responsibility for such attacks are often attributed to state entities, 2010 also saw a series of attacks linked to the Zeus malware that appeared a lot more like espionage than crime. After Netwitness released a report on the Kneber botnet, a Zeus-based botnet with domain names registered to hilarykneber@yahoo.com, I focused on the connections between that botnet and a series of attacks against .mil and .gov email addresses using social engineering techniques. Have criminals determined that there is a market for sensitive data? It sure seems that way to me.

Abusing the Cloud
In "Shadows in the Cloud: An investigation into cyber espionage 2.0" my co-authors and I analyzed the command and control infrastructure of a network that used a complex and tiered command and control infrastructure that leveraged Twitter, Google Groups, Blogspot, Baidu Blogs, blog.com and Yahoo! Mail in order to maintain persistent control over the compromised computers. Of course, such techniques are not new, in 2009, researchers found that Twitter, Jaiku, Tumblr, Google Groups, Google AppEngine and Facebook had all been used as the command and control structure for malware. In 2010, Sunbelt found a Twitter botnet creator and Trend Micro reports that the "Here You Have" worm used GMail accounts.

During my analysis of malware posted on the Contagio blog, I noticed that the malware used an encrypted connection to Gmail as a means of command and control. (It also used cloud storage at drivehq.com in order to have the compromised computers download additional malware components). As network defenses continue to include traffic analysis, I believe that we will continue to see a move toward using popular services, especially web mail as command and control elements. Unlike connections to well-known dynamic DNS services, connections to Gmail and other popular services do not necessarily stand out and are encrypted.

Big Money
Although there are interesting target malware attacks that appear to have political motives, money continues to be the driving force behind the bulk of malware encountered by most Internet users. Cybercrime is profitable. In 2010, the Information Warfare Monitor released a report that documented the inner workings of Koobface. Koobface is a notorious botnet that leverages social networking platforms to propagate. The operators of Koobface have been able to successfully monetize their operations. Through the use of pay-per-click and pay-per-install affiliate programs, Koobface was able to earn over US$2 million between June 2009 and June 2010 by forcing compromised computers to install fake antivirus software and engage in click fraud. (BlackHat SEO operators monetize their operations in a similar way., see here and here.)

However, more traditional heists based on stolen banking and credit card credentials continue thanks to malware such as Zeus and SpyEye. This year, law enforcement were able to arrest individuals that used the Zeus malware to steal $70 million dollars. Often, these operations recruit money mules and pack mules to relay stolen money and goods bought with stolen credit cards. This makes it difficult to apprehend those behind these operations.

RX-promotion: A Pharma Shop

More than 65% of spam consists of "pharmaceutical spam" sent through a variety of well known spam botnets such as Rustock and Cutwail. These spam messages use multiple shop brands and sell a variety of drugs, especially Viagra. These pills, sometime fake pills, are shipped to buyers from pharma manufacturers, often in India or China.

There are pharma campaigns that have been found to use thousands of domain names and fast flux DNS techniques which can effectively resist takedown efforts. However, pharma operations are not just centralized campaigns. Much like FakeAV, Pay-Per-Install, and Pay-Per-Click operations, pharma is also organized through affiliate networks. Affiliate networks allow centralized pharma operations to diversify with individual operators maintaining pharma websites and generating incoming traffic through spam or search engine optimization.

This post will focus on RX-promotion (rx-promotion.com) which has been linked to a variety of operations including the payment service ChronoPay. The FDA are aware of Rx-promotion and have sent a warning letter to them in October 2010. Rather than focus on those behind the operation, this post simply focuses on how the affiliate program works and Rx-promotion's pharma brands including:

The Canadian Rx Drugs - http://canadianrx-drugs.com/
Meds Leader - Top Online Pharmacy Supplier - http://medicleader.com/
Health-Refill - http://healthreorder.com/
Men Drugs Shop - http://drugsshopformen.com/
The US Drugs - http://the-us-drugs.com/
Canadian Online Meds - http://canadianonlinemedicine.com/
Trusted Meds Online - http://trusted-drugs-online.com/
MedrugsPlus - http://med-drugs-plus.com/
Internet Drugs Pedia - http://i-drugspedia.com/
The Canadian Rx Drugs - http://herbiedrugs.com/
Always Great - http://always-great.com/
RXED On Green - http://rxed-on-green.com/
StallionsRX - http://stallionsrx.com/
Golden StethoScope - http://golden-stethoscope.com/
Star Of Health - http://star-of-health.com/
RX Pharmacy Center - http://rxpharmacy-center.com/
Cheap Meds List - http://cheap-meds-list.com/
Health Online Leader - http://health-online-leader.com/
Drugs For Us - http://drugsforus.com/
Meds For Us - http://meds-for-us.com/
Great RX Pharmacy - http://great-rx-pharmacy.com/
World Of Drugs - http://world-of-drugs.com/
Number One Clinic - http://numberoneclinic.com/

It is actually quite simple to get started with a pharma affiliate operation and there are even guides that walk users through the process. After creating an account, one can download rx.tar.gz, a package that allows anyone to setup a pharma shop of their own. RX-promotion operates a number pharma brands that are available as themes after setting up the pharma shop. (*See screen shots at the bottom of this post).



Although the brand shops are operated by the affiliates, the shops are connected to the Rx-Promotion infrastructure which provides the backend for the prices, payment and support. The shops make HTTP connections to xml.paymentrx.com and receiving XML updates. Payments are handled through secure.paymentrx.com and customer support is available at rx-drugs-support.com.



As orders are received, the affiliate earns money from Rx-Promotion and can "cash out" through a variety of services.



There is ongoing development of the shop code. Affiliates can easily update their installations through the administrative backend.



In one such update, Rx-Promotion left the "./svn/" directory from the subversion revision control system indicating that their source code and development resides at:

https://nona.smartsol.biz/svn/src/rxpro_shop/public_html

RX-promotion is behind many different pharma brands that are marketed using spam and search engine optimization techniques. RX-promotion provides the backend of the pharma operation while numerous affiliates promote its products in order to receive a portion of the profit generated.

Screenshots of the various pharma brand themes available is the Rx-Promotion shop code:

Always_great



Bench_in_a_park



Bondi_blue



Brushy



canadianonline-lucky



canadianonline



canadianrxdrugs



drugspedia



Golden_sthetoscope



healthrefill



Kettlebell



Life_meant_to_be



Loose_weight_orangy



medsdrugsplus



medsleader



mensdrugs



Modry



Mostly_laconic



Red_on_green



StallionsRx



Star_of_health



theusdrugs-luckymax



theusdrugs



trustedmeds

Pack Mules: The Re-Shipping Fraud & Malware Connection

Malware toolkits are designed to steal information, such as bank account data, and provide cyber criminals with vast quantities of stolen credentials. Every day, credit card numbers stolen by malware such as Zeus and SpyEye are bought and sold in the underground economy. This has given rise to the recruitment of "pack mules."

When using stolen credit card numbers to make purchases online, criminals do not provide their own identity or location information. Instead, criminals post advertisements on job search Web sites in order to lure "pack mules" to act as intermediaries in their criminal operations. These intermediaries receive merchandise on the criminal's behalf and re-ship it to a location under the control of the criminals. This operation is known as "re-shipping fraud" and is similar to the ways in which some criminals recruit "money mules" to open bank accounts for transferring stolen funds.

Re-shipping is tightly intertwined with malware activity. This is demonstrated by the fact that the Web sites used to recruit pack mules are hosted on the same servers that host the command-and-control servers of Zeus botnets. I have been exploring (see Clustering Zeus Command and Control Servers Part 1 and Part 2) clusters of Zeus activity in an attempt to better understand the connections among the criminals behind different functions within the botnet ecosystem. I have found that although Zeus is a popular malware toolkit that any aspiring criminal can use to setup a botnet capable of stealing credit card and banking information, there is a cluster of malicious Zeus servers which indicate that there is a "core" of Zeus operations.

In this blog post, I analyze the pack mule recruiting Web site, "Sullivan and Myers," (sullivanmyers.com) and explore its links with Zeus botnets and the broader malware underground. This investigation indicates that these concentrations of malicious activities go beyond operating command-and-control servers and extracting banking information to other aspects of the criminal enterprise. This includes exploitation (through "exploit packs") and the recruiting of pack and money mules.

Pack Mule Recruitment

In order to recruit pack mules, criminals setup Web sites that purport to belong to a legitimate shipping and receiving business, and post advertisements that link to the "business" on job search Web sites and forums. This can be seen in the case of Sullivan and Myers, a fake business created for the purpose of recruiting pack mules.



Sullivan and Myer's job posting invites interested applicants to complete an online application form and submit a resume to hr@sullivanmyers.com. Sullivan and Myer’s contact information (address, phone, and fax number) is also supplied. The application form, contact information, and the company's Web site appear to have been designed to create a sense of legitimacy. Although there are some indicators that suggest the company may be fake, such as awkward language and occasional errors (using "Myers & Sullivan" instead of "Sullivan and Myers"), the overall presentation is passable. To some applicants, the company may appear to be legitimate.



After submitting a resume, applicants are given additional information about the position. The applicants are informed that they will be receiving packages which they are to re-package and send to the company's "consumers." The applicants are told that they can earn up to USD3000 per month.

Human Resource hr@sullivanmyers.com

Your documents has been verified and checked; you seem to be a suitable
candidate for Junior Packing Specialists' position and we are glad, that you are
interested in this opening.

Following, you'll find information about Sullivan & Myers and additional details
about Junior Packing Specialist position.

Sullivan & Myers (NASDAQ: SUM) is a well known printing and typography company
that offers wide variety of printing, publishing and general advertising
services. Company is based in US with headquarters in GA, Atlanta. If you want
to find out more about Sullivan & Myers, please visit our web site
www.sullivanmyers.com

This is a part-time job with a flexible schedule. Work time is not
limited, but to be successful you need to devote at least 10hrs per week to it,
though those who work up to 20hr/week have best results in the company.

This is a part-time job and it can be rendered at home, thus all but few

communications will be handled online, because of this job requirements include
acceptable level of computer literacy and Internet access. There is no entrance
or any other hidden fee. The company covers all the fees related to this
employment.

Junior packing specialist's job is quite simple, currently Sullivan & Myers
provide a complex package of services for a network of a well-known consumer's
electronics company, you will be receiving scheduled packages from them. The
parcels mostly consist of electronics and consumer goods with no oversized
deliveries. You shall receive a specialized packing paper from Sullivan & Myers
or its affiliates, part of it will be a decal paper, picturing different
advertisements from our client's partner, some might only be protective wrapping
to provide additional security to fragile goods. Junior Packing specialist's job
is simple, you need to repack each package & parcel and make sure that
consistence of package is fully operational or/and lacking visual defects and
forward it to consumers via USPS or FED EX. You might receive up to 10 packages
per week (during your trial period) thus as we already mentioned we require at
least 10hrs to be dedicated to this job.

To the successful applicants we offer a position on a trial period (30
business days, from the first actual assignment). This is the period when you
will be trained and shall receive 24/7 online and phone support, while earning
money. The evaluation of employees on a trial period is usually at least one
week before the end of their trial period. During the trial period, the
supervisor can recommend termination. At the end of the trial period, supervisor
makes his decision.

The trial period is paid $1390 USD per month. For every successful mail/parcel
forwarded you will receive $35, also you shall receive an additional bonus of
$15 per parcel that you send at the day of delivery, for example, if you have
received a parcel at 01.05.2010 and forwarded it at the same day, you shall
receive not $35 but $50 commission. Your total income, with the current volume
of clients, will be added up to $3000 USD per month. Your base salary, after
trial period, will go up to $1900 per month, plus $45 per parcel you forward.

You may ask for additional hours after trial period, or proceed full-time.
If you are interested in this job, please reply to this e-mail and our HR
managers will send you all required paperwork.

Next, applicants are sent a contract and are then instructed to send copies of identification and proof of residency for a background check to minimize fraud. This is an important step because if, at a later point, the applicant determines that the company is not legitimate and wants to quit, the criminals behind this operation could attempt identity theft or otherwise compromise the individual.

Human Resource hr@sullivanmyers.com:

In this e-mail, you will find attached legal document specifically a labor
contract for Junior Packing Specialist position in Sullivan & Myers.

Make sure you read it carefully, familiarize yourself with all aspects of
the agreement and in case if you agree with the terms do the following:

1. Print out two (2) copies of the labor contract.
2. Sign both parts, you must sign it on the bottom of EVERY page,
plus at the end of the document.
3. Forward one part to Sullivan & Myers HR department at
hr@sullivanmyers.com or fax it to 1-(678)-866-2530
4. Keep one signed copy for yourself.

The contract becomes valid from the moment of the reception of the
correctly filled copy of the contract. It should be noted that the validity
of the contract in the electronic form is identical to the contract signed
in personal presence of both parties.

In order to minimize fraudulent activities we have implemented strong
security policy, we are running mandatory background checks for every
successful candidate. Background check includes but is not limited to,
criminal, financial or personal records that are available publicly. In VERY
rare cases, Sullivan & Myers may enforce PI. As a part of our security
policy we ask you to make an electronic copy of your ID, driving license or
any other legal document that may verify your identity (any utility bill
will do, if your domicile is mentioned there) and send it attached with the
same e-mail or fax it to 1-(678)-866-2530.

You will receive additional information when your forwarded contract will
be examined and verified by our attorneys.

*NOTE: Requires manual signature.

After receiving the signed contract, the criminals confirm the mailing address of the new "employee." At this point, the new employee will begin receiving packages of goods bought with stolen credit card information and forwarding these goods to the criminals behind the operation. When law enforcement tracks down the operation, they will be led to the address of the pack mule rather than the masterminds behind the operation.

The Malware Connection

Locating Sullivan and Myers within the malware ecosystem exposes the criminal connections of those behind the re-shipping fraud operation. The Web site sullivanmyers.com is registered to the e-mail address migray71@yahoo.com and resolves to the IP address 194.28.112.11. Migray71@yahoo.com is linked to significant malicious activity.

The hosting history of sullivanmyers.com firmly places the domain within concentrations of malicious activity. Currently, the Web site is hosted on a server with the IP address 194.28.112.11. This server also hosts azkinternational.com (azkint@bronzemail.net), fotosharedownloads.com (hosting@haiau.tv) and fotoshare-dknc.com. Fotosharedownloads.com and fotoshare-dknc.com are Web sites that host malware, and azkinternational.com appears to be another pack mule recruiting Web site.

Sullivanmyers.com has been hosted on a number of servers that have hosted significant amounts of malicious activity in the last year. Currently, these servers are hosting domain names registered to known malicious e-mail addresses.

2010-11-06 223.25.242.61

- binmop.com - migray71@yahoo.com
- glazsystem.net - annepark@gmail.com
- nonameal.com - descartez@hotmail.com
- unknownplaces.net - mcthomas34@first-host.net

2010-09-24 27.131.32.153

- antiviruslab.info - mcthomas34@first-host.net
- bransac.com - descartez@hotmail.com
- myweb-analytics.net - migray71@yahoo.com
- organte.com - ddgrimes@earthlink.net

2010-09-13 113.11.194.158

- trackingcounter.net - trackingcounter.net@protecteddomainservices.com

2010-07-03 113.11.194.148

- baidum.net - edgar.marcha@verizon.net
- hpnet.in - socks5service@list.ru
- kiaz.org - analizsite@gmail.com
- kingolat.com - ddgrimes@earthlink.net
- mainspain.info - edgar.marcha@verizon.net
- maturesdf.com - MillieDiaz4@aol.com
- southdomens.com - southdomens@googlemail.com
- tarstall.ru - boats@qx8.ru
- topmilkyway.net - ddgrimes@earthlink.net
- truetry.org - analizsite@gmail.com
- vuvuzelya.net - edgar.marcha@verizon.net

The domain names listed above resolve to IP addresses of servers that were previously used to host sullivanmyers.com. While some of the domain names have already been linked to malicious activity, some have not. However, they are associated with e-mail addresses that have been used to register malicious domain names in the past.



Using data from MalwareDomainList and ZeusTracker, we can see the extent to which domain names registered by migray71@yahoo.com are engaged in malicious behavior and linked through co-hosting to other malicious domain names. These malicious domain names have been active throughout 2010 and have been used to host exploit packs, such as Pheonix and Eleonore; downloaders, such as Oficla/Sasfis, Fake Antivirus, the RussKill DDoS tool and multiple versions of the Zeus Trojan; and associated drop zones and command-and-control servers. This e-mail address was also used to register sosanni.com, a command-and-control server for the Ambler botnet.



The most interesting connection within this cluster links the activity of domain names registered with migray71@yahoo.com to the Ambler botnet and to a cluster of malicious Zeus activity. The domain name sosanni.com (migray71@yahoo.com – 121.101.216.205) was an Ambler command-and-control server that was operated by the same set of actors that administered a cluster of Zeus command-and-control servers registered with a variety of well- known e-mail addresses, including hilarykneber@yahoo.com, edgar.marcha@verizon.net, and MillieDiaz4@aol.com.

The hilarykneber@yahoo.com e-mail address was made infamous after Netwitness revealed the existence of a Zeus-based botnet associated with that email address that had compromised over 74,000 computers around the world. An association with the Kneber botnet indicates that those behind the operation have no shortage of stolen credit card numbers that could be used to make purchases that are re-shipped through the pack mule operation. Moreover, this cluster was found to be not only operating a Zeus botnet, but a SpyEye and the Ambler botnet as well. This indicates that the criminals are diversifying their operations using multiple forms of malware that are designed to steal credit card numbers, bank account information, and other credentials.

However, there are some limitations to this analysis. Just because domain names are hosted on the same server, it does not mean that there is necessarily a direct connection between them. There are a variety of "bullet proof" Web hosting companies that provide stable hosting to a wide variety of malicious activity. Online criminal prefer these services because the "bullet proof" hosts ensure that malicious Web sites remain online despite efforts of the security community to take them down.

Domain names registered with the same e-mail address provides a stronger link because this indicates that the domain names are under the control of one entity. However, domain names registered to the same e-mail address may not be directly linked. There are a variety of services available within the malware underground that include domain registration. For example, the domain name southdomens.com (southdomens@googlemail.com) is hosted on a server that sullivanmyers.com was formerly hosted on. The server is also associated with a service that provides domain name registration. If domain registration services register domain names for multiple clients with the same e-mail address, it provides a weak (rather than strong) link between malicious activity clustered around domain names registered with the same e-mail address. Domain names registered with the same e-mail address may be distributed by the supplier to an array of disparate criminals. So, rather than indicating a strong connection between the malicious actors using the domain names, it simply shows that disparate malicious actors sought the services of the same domain name provider.



Keeping these limitations in mind, I believe that while there are specialized roles within the malware ecosystem, there appears to be a significant portion that is quite centralized. In this case, domain names registered with the same e-mail addresses not only inhabit servers full of malicious activity, but are also associated with "pack mule" recruitment, exploit packs, and Zeus and Ambler command-and-control servers. While the exact nature of the connections between them are unclear, these concentrations indicate that a discrete set of criminals are behind an operation that goes full circle—from exploiting victims, to harvesting credentials to acquire goods which are relayed through a network of pack mules back to the criminals.