The latest in the APT detected and analyzed by the team of Norman Shark, has been named “Hangover” due to the strings found within the various binaries.
When I retraced the report in order to arrive at the same conclusion as that by the Norman Team, it was found that :
1: The ELANCE ID of the developer has been deleted, however the Google Cache still exists dated 27 Apr 2013.
As was the case with Mandiant’s report about Chinese APT Group, attempts were made to remove the traces of the identities involved. But traces still remain.
While looking into the domains presented by the report, I came across a few email ids which were used to register the domains and those domains match with those provided in the report. eg. email-id johnygr57@gmail.com.
When a domain is protected by Whois Privacy , many of us find it difficult to ascertain the identity, however when we look into the SOA record of these domains, it is very much possible to find the original email id used for registration. However, in some cases the email-id in SOA records is also changed to point to the Privacy Email-ID.
infocardiology.biz. 21600 IN SOA ns2.infocardiology.biz. johnygr57.gmail.com. 2013050403 86400 7200 3600000 86400Incidentally, strings containing the word“Appin”, “AppinSecurityGroup”, and “Matrix” have appeared in the code-base numerous times. However, it is to be noted that such strings found within the malware samples can be added or changed by anyone. Coincidentally, the organization named in the report also has a product which contains the string ‘Matrix’ and this product is used for pen-testing.
In all probability, the rogue entities must have taken undue advantage of their easy access to these tools/knowledge-base and manufactured a bot-net of their own. This might be the reason as why the reports by Norman have stated that “it looks like a project management”.
However, as the organization in question has already denied any wrongdoings, even though the WHOIS records present in the report have a very different story to tell.
So how do we investigate the evidence provided by Hangover Report and nail the culprit?
Since all the evidence provided by Norman is pointing to a few select individuals, it is all the more imperative to carry on a full investigation, in order to find the entire team of “Hangover” and the investigation should look into the payments made to the register the domains which includes the IP addresses used during registration process. Following the “cash trail” always reaps huge benefits. With this evidence on record, things can get quite interesting and I presume this shouldn’t be difficult to procure.
Conclusion:
Straight from the Norman Report:
There are also indicators of involvement by private sector companies or persons connected to these, though these data are circumstantial and may be attempts to implicate said companies.
[UPDATE] Read the entire article over here
Appin contacted TechWeekEurope to distance itself from any suggestion it was involved in the attacks. As our report noted, there was never any accusation Appin had done anything, only that their name had been mentioned in the attackers’ code.
The company sent an opinion letter from security expert Professor Solange Ghernaouti, in which she said there was no proof Appin was connected to the attacks, as this report had also noted.
“The chain of reasoning can appear attractive, but is subject by its very nature (dynamic addresses, obfuscated code, hidden and mobile website registrations) to a degree of uncertainty and multiple interpretations,” she said. “In any case, it does not constitute solid evidence or prove anything.”
Appin has now asked Norman to issue a retraction. “I cannot comment on Appin’s questions or statements on the report and all I can say is that I stand behind the results that are in the report that are on the website,” Fagerland added.
La ultima detección de APT (Amenaza Persistente Avanzada) ha sido analizado por el equipo llamado Norman Shark, esta detección ha sido llamado “Hangover”.
He encontrado lo mismo en lo siguiente en el reporte para llegar a una conclusión:
- El ID de ELANCE del desarrollador ha sido eliminado, sin embargo el Google Cache todavía existe con la fecha 27 de Abril 2013.
El caso con el reporte sobre el Grupo Chino de APT, los intentos fueron hechos para quitar las evidencias de las identidades. Pero la evidencia aun permanece.
Mientras revisando los dominios presentados en el informe, he encontrado algunos emails que fueron usados para registrar los dominios y esos dominios son iguales en el reporte. Por ejemplo el correo johnygr57@gmail.com.
Cuando un dominio es protegido por Whois Privacy, mucho de nosotros encontramos que es muy difícil de determinar la identidad, sin embargo cuando miramos dentro del registro SOA de estos dominios, es posible a encontrar el email original usado para la registración. Sin embargo en algunos casos el email en el registro de SOA también esta modificado para apuntar al email privado.
Los strings que tienen la palabra “Appin”, “AppinSecurityGroup” y “Matrix” han aparecido en la base de código varias veces. Sin embargo tales caracteres que se encuentran dentro la muestra de malware pueden ser modificados por cualquier persona. La empresa nombrado en el reporte también tiene un producto que tiene el string ‘Matrix y este producto se usa para la prueba de penetración.
Con toda probabilidad, los virus puede haber aprovechado a su fácil acceso a estas herramientas y implementaron su propio botnet. Creo que esta es la razón en porque los informes mencionaron que “esto se mira como un proyecto administrativo”.
Sin embargo, la empresa ha negado toda maldad, aunque lo registros WHOIS están en el reporte.
Entonces como investigamos la evidencia proporcionado por el Informe Hangover y atrapar al culpable?
Hay que hacer una investigación completa para buscar el equipo de “Hangover” y la investigación debe mirar a los pagos realizados para registrar los dominios que incluyen las direcciones IP que se usaban durante el proceso de registro. Con esta evidencia, las cosas pueden ser muy interesantes y supongo que esto no debe ser difícil de conseguir.
Finalización:
Lo siguiente viene del Informe de Norman:
También hay indicadores que han participado de las empresas o personas del sector privado estos datos son circunstanciales y pueden ser intentos de implicar empresas.
Leer artículo aquí
Appin contacto TechWeekEurope para distanciarse de cualquier sugerencia de que estuvo involucrado en los ataques. Nunca hubo ninguna acusación de que Appin había hecho nada, solo que su nombre había sido mencionado en el código del atacante.
La empresa envió una carta de opinión del experto de seguridad Profesora Solange Ghernaouti, que decía que Appin no estaba conectado a los ataques, como también se indico en el informe.
Appin ha pedido a Norman a retractarse. “No puedo comentar sobre cuestiones o declaraciones de Appin sobre el informe y lo único que puedo decir es que yo estoy detrás de los resultados que se encuentran en el informe en el sitio web,” dijo Fagerland.
3 Comments
Sue Z. Humphrey
Why Conficker has been able to proliferate so widely may be an interesting testament to the stubbornness of some PC users to avoid staying current with the latest Microsoft security patches [ 2 ]. Some reports, such as the case of the Conficker outbreak within Sheffield Hospital’s operating ward, suggest that even security-conscious environments may elect to forgo automated software patching, choosing to trade off vulnerability exposure for some perceived notion of platform stability [ 8 ]. On the other hand, the uneven concentration of where the vast bulk of Conficker infections have occurred suggest other reasons. For example, regions with dense Conficker populations also appear to correspond to areas where the use of unregistered (pirated) Windows releases are widespread, and the regular application of available security patches [ 9 ] are rare.
Andres Carroll
Researchers also found multiple references to Appin, an Indian information security software vendor and “ethical hacking” training company. References included “appin” and “appinbot” in “cleartext project and debug path strings,” according to Norman’s report, and some domains used in the APT attacks appeared to have been registered with a corporate Appin email address before being hidden.
R Sachin
When domains are registered via a reseller’s account, it is to be noted that, most of the domain resellers have localized businesses and are in no way ICANN/Registry accredited registrars. So, these resellers have local clientele.