Friday, February 20, 2015

Mobile App Wall of Shame: Tinychat for iPhone


Price : Free
Category : Social Networking
Updated : December 29, 2014
Version : 5.0
Size : 19.41 MB
Language : English
Vendor : Tinychat Co
Operating system : iOS


Tinychat is a group video chat application that allows users to chat online and also create their own chart rooms. Currently, this application is ranked among the top 200 apps in the Social Networking category on the iTunes app store. Tinychat claims 5 million minutes of usage per day, making it one of the largest voice and video chat communities on the Internet today.

A user must submit their email address and password in order to create an account. Alternately, a user can also use their Facebook or Twitter account to login to this application.

 Vulnerability - Clear text username/password

App Login page
The current Tinychat App (verified on Version 5.0) has a serious information leakage flaw whereby username & password information for the Tinychat user is sent in clear text (unencrypted) to the application server. This vulnerability woud make it possible for an attacker to easily sniff network traffic and compromise the user account.

Below is the sample capture of a Tinychat user login attempt. As seen in the request, the username & password information is sent in clear text.

Login Capture

Similarly, when a user attempts to register an account on Tinychat, the following HTTP request is generated. The username, password and email address information of the user passes in clear text as seen in the request below:

Account registration:
Registration Capture

An attacker can easily takeover the victim's account by sniffing the vulnerable application's network traffic. This can further lead to more sophisticated attacks and can often lead to the compromise of other applications/services due to password reuse.

ZAP Analysis:
ZAP in action.

This flaw was identified using Zscaler Application Profiler (ZAP). ZAP is a free online tool that can be used to analyze mobile applications for vulnerabilities and privacy issues as seen in the above screenshot. We have reached out to Tinychat developers, informing them of this security flaw.


This type of security flaw can be uncovered by simply analyzing the network traffic sent by the application. It is disappointing to see such applications getting uploaded to Apple iTunes store without basic security tests like checking for clear text username/passwords being conducted. This is not the first time we have seen a popular iOS application with this security flaw, but Apple continues to ignore performing a basic security check as part of their vetting process for adding new applications to the app store.

Credit: Analysis by Lakshmi.

Wednesday, February 11, 2015

Ongoing Angler Exploit Kit and Bedep Fraud Campaign

In our recent post covering CVE-2015-0311, two of the Command and Control (C&C) domains used in the Domain Generation Algorithm (DGA), mapped back to the same Server IP address - They were also using the same nameservers for resolution:
We took a closer look at the domains using these nameservers and found a distinct correlation between the C&C servers being used in this and other, possibly unrelated campaigns. In the past month, we've tracked over 70 domains involved in malware C&C or other malicious activity involving Click Fraud & Ransomware campaigns. These domains were registered via "Domain Context" and use "" nameservers for resolution.

To recap, we saw the initial binary was executed via the CVE-2015-0311 exploit, which then attempted resolution of multiple domains that were generated through a DGA:

Below is partial whois information for the two domains that resolved at that time:

Taking a closer look at these domains, we noticed that they share some commonalities, specifically their nameservers and IPs:

Comparison of C2 Domains
Domain IP Observed Method Registrar Creation Date Contact Nameserver(s) POST / domaincontext 2015-01-19 contact, POST / domaincontext 2015-01-21 yingw90,

Taking a look at other domains registered around that time via "Domain Context" by '' and also utilizing "" for resolution, we find the following 39 domains:

Looking at the same time period for domains registered through "Domain Context", using "Privacy Protect", and using "" for resolution, we find an additional 32 domains, which also seem to fit the general theme of a DGA:

The vast majority of these domains were resolving to Bedep's C&C servers. The following is a POST request to a C&C server from a Bedep infected system containing base64 encoded data:

However, some of the domains are being used in other seemingly unrelated malicious campaigns. For example the domain '' was identifed by Kafeine as hosting a Reveton ransom page. 

Other domains being used to monetize Bedep infections via click fraud include:

And the following domains are intermediaries hosting encrypted files:

Unfortunately, there are several different IPs in use on various ASNs:

C2 IP Information
IP Netblock ASN OVH ISPOVH_65488197 OVH Static IP AS16276 OVH SAS AS16276 OVH ISPOVH OVH SAS Dedicated Servers AS16276 OVH SAS AS16276 OVH ISPOVH_65488197 OVH Static IP AS16276 OVHOVH OVH SAS Dedicated servers AS16276 RR-RC-Enet-ColumbusEE3-DOM AS10297 for Nobis Technology Group, LLCNETBLK-NOBIS-TECHNOLOGY-GROUP-18 AS15003 for Nobis Technology Group, LLCNETBLK-NOBIS-TECHNOLOGY-GROUP-18 AS15003 OVHIUNET-BNET80 OVH SAS AS1267 AS29073 Route objectNL-ECATEL-20100816 Ecatel LTD AS29073 LimitedRSDEDI-KBPNNOIL Dedicated Server Hosting AS35662 route objectRSDEDI-IBOBAPEP Dedicated Server Hosting AS35662 WorldStream IPv4.19 AS49981 Solutions InternationalHSI-3 AS30083 Solutions InternationalHSI-3 AS30083 Solutions InternationalHSI-4 AS30083 routeHSI-2 AS30083


Attackers continue to move away from single IPs and small IP pools, preferring to distribute the infrastructure across multiple netblocks. This ensures their infrastructure is more resilient to blocks and takedown attempts allowing the attackers to continue to profit from compromised devices. Likewise, if a registrar or nameserver with poor reputation is found, specific actors will continue to leverage them until mitigations are put in place. 

Monday, February 2, 2015

Android Banking Trojan and SMS stealer floating in the wild

We recently came across an Android Banking Trojan with a very low antivirus detection rate that is targeting Chinese mobile users. This Android malware is capable of stealing banking information by intercepting SMS messages looking for certain keywords. It also steals all the contact information from the user's mobile device and relays it to a remote Command & Control (C2) server.

Malicious Android package details
  • Name : 888.apk.
  • MD5 :  ff081c1400a948f2bcc4952fed2c818b.
  • VT : 7/56 (at the time of analysis)
  • Source: http://wap{.}jhgxc{.}com/888.apk

  •  Intercept and capture all incoming and outgoing SMS messages
  •  Intercept incoming calls and the ability to end calls
  •  Receive C2 commands via SMS
  •  Sends stolen data via SMS, e-mail, and possibly web requests to the C2 server
Let's take a look at some of the above mentioned malware features and how they have been implemented:

Email sent SMS

In the screenshot above, you can see that it is e-mailing the captured outbound SMS messages using a hardcoded email address. It e-mails the stolen data to itself with the subject "Send SMS".

Email and SMS all sniffed data

Here you can see that it is e-mailing the captured inbound SMS messages using the same parameters that it used for outbound SMS messages. Additionally, it is also relaying the same information via SMS to a hardcoded Chinese phone number "15996581524".

Intercepting call

The above screenshot shows the ability to intercept incoming calls and send the caller's number via e-mail with subject "Intercept incoming call once the call!". It also has the ability to end the call.

Receives SMS as commands.

It's also capable of receiving C2 commands via SMS from the malware author to act further.

Commands to act

As seen in the screenshot above, the attacker can start the data capturing activity by sending the SMS command "intercept#" and can also stop the capturing activity by sending SMS command "interceptstop#".

Banking strings

In the screenshot above, you can see that there are string checks in place which are related to online banking transactions. It checks for strings like "Pay","Check","Bank","Balance","Validation"  which clearly shows the intent of the malware author to sniff banking related information.

Setting high priorities

The malware sets the SMS receiver and outgoing call services to high priority. This will ensure that the malicious application will get a higher preference for these events compared to other applications.

Web request for sending stolen contacts

We also saw some code that can allow the malware to send stolen contact information & SMS data through web requests. However, it appears to be non-functional in this version and the malware author might still be testing out this feature, as seen by the usage of the private IP address:


Web request for sending stolen SMS data


The following are screenshots showing a sample of stolen information that the malware author has been able to capture through these malicious APK infections till now:

Sent email section
E-mailed stolen SMS message
Intercepted incoming call notification

SMS matching online banking strings

Stolen contact information

Infected mobile users.
Intercepted online banking SMS
Intercepted online banking SMS

Here you can see some serious financial information sniffed by this malware illustrating the impact of such banking sniffers.