JoongAng Ilbo cyber attack

In June 2012 the South Korean newspaper JoongAng Ilbo(중앙일보) was hit by a major cyber attack (해킹, 차원 다른 악의적 수법으로) which attempted to destroy the papers article database, editing and distribution system. News reports indicate that this attack was likely carried out by North Korean state actors and follows a threat made by North Korea earlier this year against several South Korean news outlets. In addition the attack left the following image on the paper's website joongang.co.kr

The text in yellow is a message from the hackers written using SQL and is as follows .

select count (*) from tbTarget // 1000000
select domain, d-day, method from tbTarget WHERE seqnumber = 2048 //www.joongang.co.kr, 2012-06-09, APT
select domain, d-day, method from tbTarget where seqnumber = 2049 //???.??????.???,2012 -??-19,???? < br /> select domain, d-day, method from tbTarget where seqnumber = 2050 //???.?????.???,2012 -??-29,??
select count (*) from tbHacker // 10000
select name, birthday, sex from tbHacker where age < 5 //IsOne, 2011-06-09, woman

There is a purported SQL query followed by the supposed result. This is threatening further attacks on the 19th and 29th day of an unknown month in 2012. The hacking group is calling itself "IsOne".

Only seven cyber attacks. The term is widely over used.

Many analysts misuse the term cyber attack, making it seem that operations better classed as espionage or vandalism are more dramatic than they really are. According to the Department of Defense, Computer Network Attack(CNA) consists of actions taken through the use of computer networks to disrupt, deny, degrade, or destroy information resident in computers and computer networks, or the computers and networks themselves(see Joint Pub 3-13). I would be even more strict that the DoD and suggest that denial of service operations have to be extremely significant for them to be classed as an attack. A bank or government website being unusable for a few days is hardly in the same class of operation as destroying information throughout an organization to cripple its operations.

I would argue that there has been only 7 publicly known cyber attacks in history and 3 of them are probably by North Korea. It is not surprising that all the attacks relate to significant real world conflicts.

June 2012, South Korean Newspaper JoongAng Ilbo
In June 2012 cyber actors linked to North Korea attempted to destroy the newspaper's article database and the editing system which moves articles through the paper's intranet. Link.

April 2012, Iranian Oil Ministry
Unknown cyber actors launched an attack against the Oil Ministry to destroy key ministry information. Link.

March 2012, Al Qaeda forums knocked offline
Unknown cyber actors disabled several major Al Qaeda online forums, the forums remained offline for many weeks. Link.

February 2012, BBC news
In early 2012 cyber actors linked to Iran launched an attack against the BBC's Persian language service, the attack seemed to be coordinated with Iranian satellite jamming efforts. Link.

April 2011, South Korean National Agricultural Co-operative Federation(NACF, Nonghyup Bank)
In April 2011 cyber actors linked to North Korea destroyed 100s of the Nonghyup Bank's internal computer servers disrupting banking services for millions of customers for over a week. Link.

March 2011, DDoS against South Korean websites
In March 2011 an advanced DDoS attack was launched against a number of South Korean websites, the computers used by the botnet which launched the attack were rendered unusable after the attack by overwriting the hard drive's Master Boot Record(MBR). Link.

2008-2010 Natanz, the Iranian centrifuge plant
According to the New York Times the US launched a cyber attack against Natanz to destroy centrifuges. Link.

Internet infrastructure

It is good to remember that cyberspace is maintained by physical hardware. Here are some great links to information on the physical infrastructure that keeps the global Internet running.

Global submarine cable map

Bundled,Buried and Behind Closed Doors by Ben Mendelsohm via The Atlantic

Gizmodo on Internet infrastructure

Intelsat's satellite fleet footprint

Eutelsat fleet

Asiasat fleet

PKI infrastructure attacks, Flame

Some excellent analysis of Flame's usage of compromised certificates

Matthew Green's Cryptographic engineering blog

The unmitigated risk blog 

Didier Stevens' blog

CrySys Blog

Microsoft Security Research and Defense blog

Adobe Systems, a national security threat?

Slopping coding and software development practices by Adobe Systems has made things easier for China based cyber espionage actors. The number one vector for these intrusions has been carefully crafted e-mails containing malicious attachments or links. And the most commonly targeted vulnerable applications have been Adobe Systems products. Let's look at this a little closer. Below is a table listing the number of high severity vulnerabilities within the National Vulnerability Database for several different products. Adobe product vulnerabilities dominate those of Microsoft Windows. But there are obviously serious issues across the entire software industry which may be a subject for another post.

Year	Adobe	Adobe Reader	Adobe Flash	Microsoft Powerpoint	Microsoft Windows XP SP3
2012	44	9	0	14	12
2011	166	49	19	57	90
2010	184	63	25	59	62
2009	77	42	33	18	73
2008	34	12	17	11	23
2007	13	3	2	3	3

Looking in further detail, here are the vulnerabilities which have actually been exploited in the wild during the period January, 2011 to today, Adobe Systems vulnerabilities dominate those of Microsoft 7 to 2. This information can be found from searching the National Vulnerability Database for the string "exploited in the wild" and cross correlating with the analysis of virus researchers.

Adobe:CVE-2012-0779,CVE-2011-4369,CVE-2011-2462,CVE-2011-2110,CVE-2011-0627,CVE-2011-0611,CVE-2011-0609

Microsoft:CVE-2012-0158,CVE-2011-3402

Should software firms be held liable for the losses their bugs impose on customer's? Why are people
still using Adobe products? This points to wider issues of market failure within the software and information security industry which has now caused issues of national security concern to governments world wide.

US government publications/statements link China to decade long campaign of cyber espionage operations

The last 6 months has seen a series of extraordinary revelations by US government officials who have revealed that China based actors are responsible for an extensive industrial cyber espionage campaign and, further, link this activity to the Chinese government itself. This started in October 2011 when the Office of the National Counterintelligence Executive issued the 2011 report on Foreign Economic Collection and Industrial Espionage which is available here. The report has many interesting details and is well worth reading but from the executive summary we have the key paragraph.

"Chinese actors are the world’s most active and persistent perpetrators of economic espionage. US private sector firms and cybersecurity specialists have reported an onslaught of computer network intrusions that have originated in China, but the IC cannot confirm who was responsible.”

This is the first time the US government has officially named Chinese actors as carrying out extensive cyber espionage, but it is worded carefully to not say the Chinese government or name any entities within China. Then in January 2012 Mike McConnell,Michael Chertoff, and William Lynn writing in the Wall Street Journal stated something stronger, naming the Chinese government as responsible.

"Only three months ago, it would have been a violation of national security rules for us to share what we are about to say, even though, as the former Director of National Intelligence (DNI), Secretary of Homeland Security, and Deputy Secretary of Defense, we have long known this to be true: The Chinese government has a national policy of economic espionage in cyberspace. In fact, the Chinese are the world’s most active and persistent practitioners of cyber espionage today.”

"Evidence of China’s economically devastating thefts of proprietary technologies and other intellectual property of U.S. companies is growing exponentially, and only in October 2011 were the details declassified in a report to Congress by the Office of the National Counterintelligence Executive. By contrast, as a matter of official national policy, the United States does not engage in or allow economic espionage.”

The full article is available here.

Then from a Senate Armed Service Committee hearing on Cyber Command from March 2012(transcript and video is available here) we have the following.

From Chairman Levin's opening remarks.

Chairman LEVIN."...General Alexander has stated that the relentless industrial espionage being waged against U.S. industry and Government chiefly by China constitute ‘‘the largest transfer of wealth in history.’’ The committee needs to understand the dimensions of this technology theft and its impact on our national security and prosperity..."

From an exchange between Chairman Levin and General Alexander(commander Cyber Command and Director NSA).

Chairman LEVIN."...The industrial espionage campaign I noted in my opening statement, and you made reference to it in your statement, particularly China’s aggressive and relentless industrial espionage campaign through cyberspace. I wonder. Can you us some examples in open session of the technologies that have been stolen through penetration of major DOD contractors and perhaps the Department itself."
General ALEXANDER. "...We are seeing a great deal of DOD-related equipment stolen by the Chinese. I cannot go into the specifics here, but we do see that from defense industrial base companies throughout. There are some very public ones, though, that give you a good idea of what is going on. The most recent one, I think, was the RSA exploits. RSA creates the two-factor authentication for things like PayPal. So when you get on and order something and pay for it over the network, the authentication is done by encryption systems that RSA creates. The exploiters took many of those certifications and underlying software which makes it almost impossible to ensure that what you are certifying or what someone else is certifying is in fact correct.
Now, RSA acted quickly and is replacing all those certificates and has done that in priority order for the Defense Department and others.
But when you think about it, the ability to do it against a company like RSA is such a high-order capability, RSA being one of the best, that if they can do it against RSA, that makes most of the other companies vulnerable."

(The Chinese state actor then used the stolen RSA information to attempt to breach Lockheen Martin and other Defense contractors, see for example this article in the New York Times.)
From an exchange between Senator McCain and General Alexander.

Senator MCCAIN. "I want to thank the witnesses. I would ask General Alexander. Do you agree that Secretary Panetta and the FBI have said that cyberattacks may soon be the number one threats to the United States?"
General ALEXANDER. "Absolutely, Senator."
Senator MCCAIN. "And would you agree that the major threats to our national security come from outside the United States specifically, obviously from unclassified information, from China"
General ALEXANDER. "Absolutely."

In late April 2012 Rep. Mike Rogers (R-Mich,chairman) and Rep. Dutch Ruppersberger (D-Md,ranking member) of the House Permanent Select Committee on Intelligence wrote an op-ed for Politico which opens with a very strongly worded article.
"The Chinese government has been quietly pursuing a strategy to help project that nation into superpower status. China steals as much intellectual property as it can from U.S. companies and uses it to artificially and unfairly compete in the global marketplace. Beijing uses this information to further its military modernization and, most important, to help fuel economic growth."
and continues
"Every morning in China, thousands of highly trained computer spies now wake up with one mission: Steal U.S. intellectual property that the Chinese can use to further their economic growth. American companies are hemorrhaging research and development on products ranging from fighter engines, to pesticides, to cutting-edge information technology."
The full op-ed is available here.
Then on the 18, May 2012 the Department of Defense released its 2012 report on "Military and Security Developments involving the People's Republic of China" which mentions concerns regarding China and cyber espionage. At the news conference launching this report there was the following exchange between a reporter and Dave Helvey, the acting deputy assistant secretary of defense for East Asia. The official is much more cautious than the members of congress and only talks about China based actors.

Q:David, Bob Burns from AP."On the topic of cyber espionage, which you mentioned very prominently in the report, do you see signs of them accelerating this capability, in particular as it could be applied against U.S. targets?"

MR. HELVEY:"Well, we continue to highlight in this report some of the concerns that we have about China's investment in cyber capabilities.We note that China's investing in not only capabilities to better defend their networks but also they're looking at ways to use cyber for offensive operations.We also highlight a number of areas where we see China engaging in cyber activity focused on computer network exploitation.That continues to be a concern of ours, and we've raised it and we've talked to the Chinese about it, most recently during the Strategic Security Dialogue in Beijing.As well, Secretary Panetta raised that with General Liang in their visit. So this is something that we continue to pay very careful attention to, and we've raised these concerns with the Chinese."
The full transcript is available here.

Turning now to non-government sources we have the following from the March 26,2012 testimony of Richard Bejtlich, CSO,Mandiant before the U.S.-China Economic and Security Review Commission.

"For the most part, our team and I use the strict definition of APT as created by the Air Force in 2006, namely as an unclassified reference to intrusions sets ultimately traced back to actors in China. Our intelligence team currently tracks approximately twenty distinct APT groups. These groups include all of the parties identified by reports publicly released by other security companies, as well as actors that we believe are unknown to many of those other companies. “
"Most of the APT groups we track target the US defense industrial base (DIB). Some of these groups also target US government agencies, think tanks and political organizations, and other commercial or private targets.”

So there are at least 20 distinct groups of cyber espionage actors tied to China. Is further attribution possible? Yes of course, despite what is commonly said regarding the difficultly of attribution. A Reuters report based on authoritative information clearly attributes at least some Chinese cyber espionage activity to the People's Liberation Army's Third Department Technical Reconnaissance Bureaus. The report also links this activity with the intrusions detailed within the 2009 Information Warfare Monitor report “Tracking GhostNet: Investigating a Cyber Espionage Network”, the subsequent IWR report “Shadows in the Cloud: Investigating Cyber Espionage 2.0” details similar activity. These reports make for fascinating reading and are available here. A couple of actors involved in these activities have even been named, in particular, Lost33 and Yinan Peng. An excellent report on the PLA Third Department is available from the Project 2049 Institute, “The Chinese People's Liberation Army Signals Intelligence and Cyber Reconnaissance Infrastructure”. Further information on the PLA and Cyber Espionage is available from a report prepared for the U.S.-China Economic and Security Review Commission, “Occupying the Information High Ground: Chinese Capabilities for Computer Network Operations and Cyber Espionage”.

Early reporting on Titan Rain suggest Chinese based cyber operations have been underway for many years.
http://www.time.com/time/magazine/article/0,9171,1098961-1,00.html

Here is some links to useful summaries of significant cyber events over the last few years.

• Center for Strategic and International Studies, cyber events since 2006 report.
• Jamie Metzl at the Asia Society on China and cyber espionage.
• Foreign Policy's The Cable's Top 10.
• Bloomberg report on 760 companies which have experienced cyber espionage intrusions.
• Command Five consulting research papers, here.

Of course others do it too, see reports below on Buckshot Yankee.

• William Lynn (writing when he was United States Deputy Secretary of Defense) in Foreign Affairs magazine on "Defending a New Domain".
• Extensive Washington Post article with many interesting details, here
• Here is a LA Times article which suggests the intrusion came from Russia.

Revisting recent oscommerce mass compromise

Open source commerce(oscommerce) “is an e-commerce and online store-management software program. It can be used on any web server that has PHP and MySQL installed. It is available as free software under the GNU General Public License.”[1,2]

In the first half of 2011 an attack targeted e-commerce sites running oscommerce using the Blackhole Exploit Kit. The attacks scans millions of web servers for oscommerce vulnerabilities. Many servers run old or badly configured servers which are vulnerable so the mass attack was very successful. In particular the attacks are searching for the vulnerabilities below[3]. Some aspects of the attack have changed over the months. As defenders have blacklisted or de-registered domain names, the attackers have responded by changing domains, exploits and payloads.

osCommerce Remote Edit Site Info Vulnerability

osCommerce 2.3.1 (banner_manager.php) Remote File Upload Vulnerability

Oscommerce Online Merchant v2.2 File Disclosure And Admin ByPass.

The above vulnerabilities target a problem with securing remote admin access to an oscommerce site. According to the oscommerce site,

"The Administration Tool is used to configure the online store, insert products for sale, administrate customers, and process orders. The Administration Tool is protected by a login mechanism which only allows verified administrators to login and to administrate the online store. "[4]

while a security patch was issued to address the critical issues with remote admin, again from the oscommerce site we have,

 

“The Administration Tool log-in feature introduced in v2.2RC2 can be bypassed on Apache web servers with AcceptPathInfo enabled by manipulating the URL. “[5]

Once compromised the attacking group will insert a hidden malicious link which points to the first in a chain of re-directors which ultimately lead to a site which attempts to exploit the user and install malicious programs, for example the Zeus banking trojan. As mentioned earlier the attacking group has responded to defenders by changing domains, exploits and payloads so over the months the details of the attack as changed.

Let's look at an example of a compromised oscommerce e-commerce site from August 2011.

The site hxxp://cledwilliams.co.uk looks to be a forgotten/half completed e-commerce site for a small coach tour company in the UK.

The site would have been compromised at some point in the past and a look at the HTML code for the page shows the malicious link left by the attackers. The attackers use the oscommerce vulnerability to edit the "Store Name" variable which is used to construct the page header/title and below the malicious link is seen in the code for the page header.[6]

The orangeblue site is the first in a re-direction chain that, in a process completely invisible to the average user, leads to an attack on their computer.

Stage one

The following obfuscated javascript is pulled from the orangeblue site. Code obfuscation has been used to evade detection by antivirus engines. In the code below h gets the value -2, this is used to modify the values in the array n which then become the correct ASCII decimal code values e.g the first three 9=TAB,9=TAB,105=i. This array is used to create the string ss which is then passed to an eval for execution.

This decodes to the following which implants a hidden malicious iframe.

Stage two

Gzipped compressed data is now pulled from the zapto domain given above, when decompressed this reveals the following javascript(shown in the below 4 images).

Lines 1-23 are obfuscated while lines 25-76 attempt to contact the Blackhole command & control server, and finally lines 77-88 reach out to a counter. Note the Russian comments within the code(I have added the English translations). Similar to stage one, in line 18 o gets the value 2 which is used to create the ASCII array m. This is then used in the lines 22-23 to construct the string s which is then executed. The obfuscated script decodes to the following.

Stage 3

The above script now reaches out to the rinzestark site. This last link is the one that actually pulls down code which attempts to exploit the unsuspecting user. The code is obfuscated and appears as follows. The obfuscation is more complex than the earlier stages. The crucial line is 21 which when variable values are substituted becomes z[substr](a[i],1), this uses the array a as an index to grab length 1 substrings from z which are concatenated to form string s, this is then executed in line 27.

This decodes to over 900 lines of javascript which is the Blackhole Kit attempting to exploit the end user. The code attempts to determine a number of things about the users software configuration and then launches an exploit tailored to the configuration found. A snippit of this code is shown below.

If the exploit is successful then further stages follow as the attackers now have control of the user machine and can install and do anything they wish, often this group has installed a banking trojan designed to steal information users enter when visiting e-commerce and e-banking sites.

Defense and counter attack

Soon after this attack was first noticed steps were taken by the information security community to blacklist and de-register the domains involved, for example the orangeblue.cl domain. Of course the attackers are watching closely and quickly respond by changing domains. Over the months this wack-a-mole process continued with the following domains being used by the attackers for the first stage(later stage domains also changed over time). These sites may be specifically created by the attackers or in the case of lamacom, adorabletots, orangeblue and ayba be legitimate sites that the attackers have compromised and turned into part of their exploitation network.

hxxp://willysy.com/images/banners/

hxxp://exero.eu/catalog/jquery.js

hxxp://1see.ir/j/

hxxp://lamacom.net/images/j/

hxxp://orangeblue.cl/js/

hxxp://gibu.de/js/

hxxp://tiasissi.com.br

hxxp://eponim.mk

hxxp://adorabletots.co.uk

hxxp://ayba.co.uk/j/

Let's look at defense efforts in more detail. The main tools available to defenders are blacklisting, de-registering and of course contacting the owners of compromised e-commerce sites with advice on how to clean and secure their sites. Blacklisting involves listing the domains in a blacklisting service like hphosts or MDL while de-registering involves reaching out to the domain registrar or hosting company to ask for the domain to be deleted.

Domain name analysis

The third phase address hxxp://rinzestark.co.cc, is on the notorious co.cc domain. A Korean based company owns the co.cc domain and offers a subdomain registration service with DNS. According to the companies website two domains can be obtained for free while bulk sets of domains can be obtained very cheaply, 100 domains for $10 up to 15000 domains for $1000[7]. In July 2011 all subdomains of co.cc were removed by Google from it's search results because of the prevalence of phishing and malware sites[8]. According to a recent report by the Anti-Phishing Working Group(APWG) co.cc was the most abused subdomain service in the world[9,10].

The second phase address gdgfddhfghk.zapto.org is also a subdomain address. Zapto.org is owned by US company No-IP/Vitalwerks Internet Solutions[11].

The majority of first phase addresses have been legitimate websites which have been compromised by the attackers and used to host the javascipt file.

Further information

The Register
Stopmalvertising analysis
Sucuri research blog
Zscaler research blog

Bibliography

[1] http://en.wikipedia.org/wiki/OsCommerce

[2] http://www.oscommerce.com/

[3] http://blog.armorize.com/2011/07/willysycom-mass-injection-ongoing.html

[4] http://www.oscommerce.info/confluence/display/OSCOM23/Administration+Tool+(Backend)

[5] http://www.oscommerce.info/confluence/display/OSCOM23/(A)+(SEC)+Administration+Tool+Log-In+Update
[6]  http://stopmalvertising.com/malware-reports/oscommerce-attacks-leads-to-blackhole-exploit-kit-via-adorabletotscouk.html

[7] http://www.co.cc/
[8] http://www.theregister.co.uk/2011/07/06/google_cans_11m_dot_co_dot_cc_sites/
[9] http://www.antiphishing.org/reports/APWG_GlobalPhishingSurvey_2H2010.pdf

[10] http://www.antiphishing.org/reports/APWG_Advisory_on_Subdomain_Registries.pdf
[11] http://www.no-ip.com/