When it comes to exploit kits, it’s all about the timing. Exploit kits often integrate new or zero-day exploits in the hopes of getting a larger number of victims with systems that may not be as up-to-date with their patches. We found two vulnerabilities that were now being targeted by exploit kits, with one being the recent Pawn Storm Flash zero-day.
Starting on October 28, we found that these two vulnerabilities were being targeted by the Angler and Nuclear exploit kits. (The second vulnerability was a Flash vulnerability that worked on versions up to 18.0.0.232; we are currently working with Adobe to confirm the CVE number for this exploit.)
“Figure 1. Angler EK .saz snapshot for CVE-2015-7645 (click to enlarge)”
“Figure 2. Nuclear EK .saz snapshot for CVE-2015-7645 (click to enlarge)”
“Figure 3. Angler EK .saz snapshot for the second exploit (click to enlarge)”
Diffie-Hellman Protocol Misuse
Our latest research confirms that the two exploit kits abusing the Diffie-Hellman key exchange, with some minor differences from the previous usage. This is being done to hide their network traffic and to get around certain security products.
The changes are an attempt to make analysis of their key exchange by researchers more difficult. The Angler EK has made the following changes to its usage of the Diffie-Hellman protocol. They add some obfuscation to what had previously been a relatively clear and obvious process.
- It will no longer send g and p from the client to server. Instead, it sends an ssid which identified the g and p pair.
- The random key K is 128-byte, rather than 16-byte. The use of a 128-byte key makes it harder to decrypt the raw data.
“Figure 4. Diffie-Hellman protocol, using SSID to identify g, p pair”
“Figure 5. Code snippet showing 128-byte key”
Multiple Payloads
Multiple payloads were downloaded onto user systems by these exploit kits. We saw instances wherein the final payload were BEDEP and CryptoLocker—at the same time. In other cases, backdoor ROVNIX malware, TeslaCrypt/CryptoWall ransomware, and KASIDET infostealers were downloaded onto user machines.
“Figure 6. BEDEP C&C server activity”
Feedback from the Smart Protection Network indicates that activity for the Angler exploit kit was higher in the earlier weeks of October; perhaps the addition of these vulnerabilities is an attempt to raise the traffic levels of the exploit back to the earlier levels. Users in Japan, the United States, and Australia were the most affected.
Countermeasures
Trend Micro is already able to protect users against this threat. The existing Sandbox with Script Analyzer engine, which is part of Trend Micro™ Deep Discovery, can be used to detect this threat by its behavior without any engine or pattern updates.
Trend Micro Deep Security and Vulnerability Protection, on the other hand, protect user systems from threats that may leverage the Pawn Storm Flash vulnerability with the DPI rule 1007119 – Identified Malicious Adobe Flash SWF File.
The SHA1 of the Flash exploits and payloads are:
- 0e05229784d993f1778bfc42510c1cd2d90f3938
- 4cf3361c750135eaa64946292ea356f4a75b9b1c
- 56a96c79b027baa70fc5f388412c6c36e4aa3544
- 600fd58cdd0d162dd97be1659c5c0c4b9819e2e3
- 69143d6bd45f99729123531583c54740d6be190d
- af6c40b12e5cd917bb02440d8f3db85c649b8ba9
- c332856b0b85b06235c440c4b1d6a48afdf9775b
- f6b6287240323f914bd0c7ddf768d850d8002592
