Month: April 2018

While performing in-depth analysis of various malware samples, security researchers at Cyberbit found a new code injection technique, dubbed

Early Bird

, being used by at least three different sophisticated malware that helped attackers evade detection.

As its name suggests, Early Bird is a “simple yet powerful” technique that allows attackers to inject malicious code into a legitimate process before its main thread starts, and thereby avoids detection by Windows hook engines used by most anti-malware products.

The

Early Bird

code injection technique “loads the malicious code in a very early stage of thread initialization, before many security products place their hooks—which allows the malware to perform its malicious actions without being detected,” the researchers said.

The technique is similar to the

AtomBombing code injection technique

that does not rely on easy-to-detect API calls, allowing malware to inject code into processes in a manner that no anti-malware tools can detect.

How Early Bird Code Injection Works

Early Bird code injection method relies on a Windows built-in APC (Asynchronous Procedure Calls) function that allows applications to execute code asynchronously in the context of a particular thread.

Here’s a brief step-by-step explanation of how an attacker can inject malicious code into a legitimate process in a way that it gets executed earlier before an anti-malware program starts scanning.

• Create a suspended process of a legitimate Windows process (e.g., svchost.exe)
• Allocate memory in that process (svchost.exe) and write the malicious code into the allocated memory region,
• Queue an asynchronous procedure call (APC) to the main thread of that process (svchost.exe),
• Since APC can execute a process only when it is in an alertable state, call NtTestAlert function to force kernel into executing the malicious code as soon as the main thread resumes.

According to the researchers, at least three following-mentioned malware were found using Early Bird code injection in the wild.

• “TurnedUp” backdoor, developed by an Iranian hacking group (APT33)
• A variant of “Carberp” banking malware
• “DorkBot” malware

Initially

discovered

by FireEye in September 2017, TurnedUp is a backdoor that is capable of exfiltrating data from the target system, creating reverse shells, taking screenshots as well as gathering system information.

Dates back to 2012,

DorBot

is botnet malware distributed via links on social media, instant messaging apps or infected removable media and is used to steal users’ credentials for online services, including banking services, participate in distributed denial-of-service (DDoS) attacks, send spam and deliver other malware to victims’ computers.

Researchers have also provided a video demonstration, which shows the new Early Bird code injection technique in action.

While performing in-depth analysis of various malware samples, security researchers at Cyberbit found a new code injection technique, dubbed

Early Bird

, being used by at least three different sophisticated malware that helped attackers evade detection.

As its name suggests, Early Bird is a “simple yet powerful” technique that allows attackers to inject malicious code into a legitimate process before its main thread starts, and thereby avoids detection by Windows hook engines used by most anti-malware products.

The

Early Bird

code injection technique “loads the malicious code in a very early stage of thread initialization, before many security products place their hooks—which allows the malware to perform its malicious actions without being detected,” the researchers said.

The technique is similar to the

AtomBombing code injection technique

that does not rely on easy-to-detect API calls, allowing malware to inject code into processes in a manner that no anti-malware tools can detect.

How Early Bird Code Injection Works

Early Bird code injection method relies on a Windows built-in APC (Asynchronous Procedure Calls) function that allows applications to execute code asynchronously in the context of a particular thread.

Here’s a brief step-by-step explanation of how an attacker can inject malicious code into a legitimate process in a way that it gets executed earlier before an anti-malware program starts scanning.

• Create a suspended process of a legitimate Windows process (e.g., svchost.exe)
• Allocate memory in that process (svchost.exe) and write the malicious code into the allocated memory region,
• Queue an asynchronous procedure call (APC) to the main thread of that process (svchost.exe),
• Since APC can execute a process only when it is in an alertable state, call NtTestAlert function to force kernel into executing the malicious code as soon as the main thread resumes.

According to the researchers, at least three following-mentioned malware were found using Early Bird code injection in the wild.

• “TurnedUp” backdoor, developed by an Iranian hacking group (APT33)
• A variant of “Carberp” banking malware
• “DorkBot” malware

Initially

discovered

by FireEye in September 2017, TurnedUp is a backdoor that is capable of exfiltrating data from the target system, creating reverse shells, taking screenshots as well as gathering system information.

Dates back to 2012,

DorBot

is botnet malware distributed via links on social media, instant messaging apps or infected removable media and is used to steal users’ credentials for online services, including banking services, participate in distributed denial-of-service (DDoS) attacks, send spam and deliver other malware to victims’ computers.

Researchers have also provided a video demonstration, which shows the new Early Bird code injection technique in action.

Facebook dropped another bombshell on its users by admitting that all of its 2.2 billion users should assume malicious third-party scrapers have compromised their public profile information.

On Wednesday, Facebook CEO Mark Zuckerberg revealed that "malicious actors" took advantage of "Search" tools on its platform to discover the identities and collect information on most of its 2 billion users worldwide.

The revelation once again underlines the

failure of the social-media

giant to protect users’ privacy while generating billions of dollars in revenue from the same information.

The revelation came weeks after the disclosure of the

Cambridge Analytica scandal

, wherein personal data of 77 million users was improperly gathered and misused by the political consultancy firm, who reportedly also helped Donald Trump win the US presidency in 2016.

However, the latest scam revealed by the social media giant about the abuse of Facebook’s search tools over the course of several years impacts almost all of its 2.2 billion users, making it the worst year for the world’s largest social network.

"It is clear now that we didn’t do enough, we didn’t focus enough on preventing abuse," Zuckerberg told press reporters. "We didn’t take a broad enough view of what our responsibility is, and that was a huge mistake."

The company said it had disabled the feature—which allows anyone to look up users by entering phone numbers or email addresses into Facebook’s search tool—in its site’s search function that enabled malicious actors to scrape public profile information.

Here’s How Scrapped Data Could Have Helped Cybercriminals

As mentioned above, the source of this scam was Facebook’s search function, which was turned on by default. Hackers took help of "Dark Web," where criminals post personal information of users stolen from data breaches over the years, to collect.

Once they had their hands on email addresses and phone numbers, the hackers then used automated computer programs to feed the email addresses and phone numbers into Facebook’s "search" box.

This scan allowed them to find out the full names of people associated with the email addresses or phone numbers, along with the Facebook profile information they chose to make public, which often includes names, profile photos, and hometown.

This collected information was then more likely to be used by cybercriminals to target particular individual using social engineering or other cyber attacks.

"Until today, people could enter another person’s phone number or email address into Facebook search to help find them. This has been especially useful for finding your friends in languages which take more effort to type out a full name, or where many people have the same name," Facebook Chief Technology Officer Mike Schroepfer said in a blog post describing changes the company has made to its service to protect its users’ data better.

"However, malicious actors have also abused these features to scrape public profile information by submitting phone numbers or email addresses they already have through search and account recovery. Given the scale and sophistication of the activity we’ve seen, we believe most people on Facebook could have had their public profile scraped in this way."

While apologizing "second time" to its users, Zuckerberg said this feature has immediately been turned off, noting that the scraped profile information was only limited to what was publically viewable.

However, Zuckerberg defended gathering users’ data for a business model, arguing "People tell us that if they’re going to see ads, they want the ads to be good."

"On the one hand, people want relevant experiences, and on the other hand there is some discomfort about how data is used," Zuck added. "I think the overwhelming feedback is for wanting a good experience."

Also, it was initially reported that Cambridge Analytica quiz app gathered data on some 50 million Facebook users, but Facebook revised that number upward by 74 percent, i.e., over 77 million.

In an effort to protect its users private data, Facebook is now restricting third-party apps from accessing users’ information about their relationship status, religious or political views, work history, education, habits, interest, video watching, and games—basically almost every information data brokers and businesses collect to build profiles of their customers’ tastes.

The company is all set to roll out a new feature on Monday that will inform users who were affected by the Cambridge Analytica data leak.

Facebook dropped another bombshell on its users by admitting that all of its 2.2 billion users should assume malicious third-party scrapers have compromised their public profile information.

On Wednesday, Facebook CEO Mark Zuckerberg revealed that "malicious actors" took advantage of "Search" tools on its platform to discover the identities and collect information on most of its 2 billion users worldwide.

The revelation once again underlines the

failure of the social-media

giant to protect users’ privacy while generating billions of dollars in revenue from the same information.

The revelation came weeks after the disclosure of the

Cambridge Analytica scandal

, wherein personal data of 77 million users was improperly gathered and misused by the political consultancy firm, who reportedly also helped Donald Trump win the US presidency in 2016.

However, the latest scam revealed by the social media giant about the abuse of Facebook’s search tools over the course of several years impacts almost all of its 2.2 billion users, making it the worst year for the world’s largest social network.

"It is clear now that we didn’t do enough, we didn’t focus enough on preventing abuse," Zuckerberg told press reporters. "We didn’t take a broad enough view of what our responsibility is, and that was a huge mistake."

The company said it had disabled the feature—which allows anyone to look up users by entering phone numbers or email addresses into Facebook’s search tool—in its site’s search function that enabled malicious actors to scrape public profile information.

Here’s How Scrapped Data Could Have Helped Cybercriminals

As mentioned above, the source of this scam was Facebook’s search function, which was turned on by default. Hackers took help of "Dark Web," where criminals post personal information of users stolen from data breaches over the years, to collect.

Once they had their hands on email addresses and phone numbers, the hackers then used automated computer programs to feed the email addresses and phone numbers into Facebook’s "search" box.

This scan allowed them to find out the full names of people associated with the email addresses or phone numbers, along with the Facebook profile information they chose to make public, which often includes names, profile photos, and hometown.

This collected information was then more likely to be used by cybercriminals to target particular individual using social engineering or other cyber attacks.

"Until today, people could enter another person’s phone number or email address into Facebook search to help find them. This has been especially useful for finding your friends in languages which take more effort to type out a full name, or where many people have the same name," Facebook Chief Technology Officer Mike Schroepfer said in a blog post describing changes the company has made to its service to protect its users’ data better.

"However, malicious actors have also abused these features to scrape public profile information by submitting phone numbers or email addresses they already have through search and account recovery. Given the scale and sophistication of the activity we’ve seen, we believe most people on Facebook could have had their public profile scraped in this way."

While apologizing "second time" to its users, Zuckerberg said this feature has immediately been turned off, noting that the scraped profile information was only limited to what was publically viewable.

However, Zuckerberg defended gathering users’ data for a business model, arguing "People tell us that if they’re going to see ads, they want the ads to be good."

"On the one hand, people want relevant experiences, and on the other hand there is some discomfort about how data is used," Zuck added. "I think the overwhelming feedback is for wanting a good experience."

Also, it was initially reported that Cambridge Analytica quiz app gathered data on some 50 million Facebook users, but Facebook revised that number upward by 74 percent, i.e., over 77 million.

In an effort to protect its users private data, Facebook is now restricting third-party apps from accessing users’ information about their relationship status, religious or political views, work history, education, habits, interest, video watching, and games—basically almost every information data brokers and businesses collect to build profiles of their customers’ tastes.

The company is all set to roll out a new feature on Monday that will inform users who were affected by the Cambridge Analytica data leak.