Adobe has released a software update that addresses a number of critical vulnerabilities in its products. There is a good overview of this patch and what you need to do in order to apply it on security researcher Brian Krebs’ blog, Krebs on Security. Krebs has noted that the update comes a week after Adobe warned that a number of miscreants were exploiting the Flash vulnerability to launch targeted attacks on users. Cyber criminals have also discovered how to exploit a user’s Google Alert to gain access to sensitive information. Let’s explore how.

Targeted Attacks

The concept of targeted attacks and the use of this technique to punch through the security defenses of organizations is gaining momentum. This week, for example, we’ve seen a lot of coverage about yet another targeted attack against a large enterprise: RSA.

When reading about these attacks, it’s worth keeping in mind that most do not make the news for several reasons. One obvious reason is the fact that many of them have not yet been discovered. When an enterprise does discover an attack, those involved often fail to understand its implications. They simply disinfect their system and move on. IBM has been researching targeted attacks for years, and we have concluded that these types of attacks represent the future of online fraud and financial industry darkware.

To demonstrate the power of targeted attacks and why we should take them so seriously, I’d like to share with you one example of a simple and very effective targeted attack method. We’re in no way suggesting that this attack hit RSA, and we do not have any information about that particular attack. Let’s call this attack example Vanity Infection from Google News Searches (VIGNS). The purpose of the VIGNS attack is to place under-the-radar malware on a computer owned by an executive who has access to sensitive corporate information. Once the malware is on the executive’s computer, it can transmit information on an ongoing basis to an IP address of the hacker’s choice.

The attack process, as with any targeted attack, starts with some form of reconnaissance. The attacker searches the business social networking site LinkedIn for executives at the targeted organization. LinkedIn is the perfect tool for that: Cyber criminals can find victims easily by searching the company name and the role they are after. An attacker then reads the victim’s professional profile and decides whether he or she is a good fit. If the executive is a good fit, then all the attacker needs to continue the attack is the name of the victim.

Next, the attacker needs to build a Web page that infects its visitors. It doesn’t matter where the page is placed; criminals we have observed have access to a large number of compromised servers. The page itself exploits a zero-day or recently discovered browser or browser add-on vulnerability. The recently announced Adobe vulnerabilities are a perfect example and can be used to achieve this goal easily.

At any given time, it’s easy to find vulnerabilities that can be used for this purpose. The attackers now have a Web page that can be used to infect visitors with malware and the name of the victim whose computer they want to compromise.

Download Free e-Book: Stopping Zero-Day Exploits For Dummies

Using a Google Alert to Lure Victims

But how do they get the victim to visit this page? With the help of Google and their own vanity. Most executives tend to have a Google Alert set up on their name. By placing the victim’s name within the malicious Web page, it is possible to get Google to index the page and generate a Google Alert on the executive’s name. The executive will receive the alert and will most likely click the link to check on who is mentioning him or her. Clicking the link will take the executive to a malicious Web page that will then infect their computer — simple.

Here’s where it gets interesting. Our researchers have discovered a number of ways to get this attack to fly under the radar of IT security software. The first method is to delay posting the exploit on the Web page until after Google’s indexing systems have visited the page in question. This will minimize the time frame that the exploit is active and detectable. The attackers can easily check when Google visits the malicious Web page and turn on the exploit only after the search engine has made its pass.

The second method is to take the Web page off immediately after the malware reports back that it gained access to the executive’s computer. The malware will know where it has landed by looking at information such as the email account on the computer. This approach minimizes the time of exposure for the malicious Web page, as well.

The next method is to have the malicious Web page redirect to an old news page that legitimately mentions the executive’s name. When the executive accesses the malicious page the malware infects the computer, but since only an old news page appears, the victim does not suspect any problems.

Another method involves blocking any bots from visiting the malicious website other than those that the attacker wants to let in, such as Google. This prevents bots that are looking for compromised Web pages from tagging the page as infected or otherwise malicious.

It’s also worth noting that it is possible to apply a number of hacker techniques to ensure that the malware goes undetected. Even if the cyber criminals decide to use a known malware kit such as Zeus or SpyEye, they can generate a variant that is undetectable by antivirus products without much trouble. After testing the code with anti-malware software, they can limit its distribution to only the specified — and malicious — Web page. This will keep antivirus solutions from classifying it as a threat. The cyber criminals can even make the attack harder to detect by programming the malware to remove itself if it reaches the wrong computer, again by looking at simple parameters such as the email account configured on the computer.

For those readers who think we may be teaching criminals how to execute a targeted attack, rest assured that our research suggests that the criminals are much more sophisticated. This is, as I mentioned, a simple targeted attack, and we have seen far more complex and sophisticated attacks in the wild.

Protecting Yourself and Your Enterprise

So how do you protect against this type of attack? Being cautious is not enough. I consider myself to be fairly sophisticated when it comes to security awareness, yet even I would fall for this type of attack. Keeping systems and antivirus software up to date won’t help, either. The attack uses zero-day unpatched exploits and the malware is completely unknown to antivirus vendors.

One possible solution is to use tools that specialize in zero-day attack prevention, such as IBM Security Trusteer Apex Advanced Malware Protection. Our R&D teams are continuously incorporating new knowledge into the Secure Web Access product to block zero-day malware.

The difference between Trusteer Apex and other desktop security solutions is in our data-centric approach. We look at sensitive data and applications on the computer and identify unknown pieces of software that attempt to access them. Our software can then block access, report the attempt or remove the violating software from the computer. Since all of these attacks are ultimately looking for sensitive information, this approach is the most likely to detect and block any malicious software that has not yet been seen.

The methodology I have presented above is just one in a series of sophisticated targeted attacks we expect will be launched against organizations in the near future. We strongly recommend that organizations reevaluate their approach to targeted attacks. As we have witnessed with various incidents in the press, they represent the most dangerous type of threat to their business.

More from Malware

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

A View Into Web(View) Attacks in Android

James Kilner contributed to the technical editing of this blog. Nethanella Messer, Segev Fogel, Or Ben Nun and Liran Tiebloom contributed to the blog. Although in the PC realm it is common to see financial malware used in web attacks to commit fraud, in Android-based financial malware this is a new trend. Traditionally, financial malware in Android uses overlay techniques to steal victims’ credentials. In 2022, IBM Security Trusteer researchers discovered a new trend in financial mobile malware that targets…

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Raspberry Robin and Dridex: Two Birds of a Feather

IBM Security Managed Detection and Response (MDR) observations coupled with IBM Security X-Force malware research sheds additional light on the mysterious objectives of the operators behind the Raspberry Robin worm. Based on a comparative analysis between a downloaded Raspberry Robin DLL and a Dridex malware loader, the results show that they are similar in structure and functionality. Thus, IBM Security research draws another link between the Raspberry Robin infections and the Russia-based cybercriminal group 'Evil Corp,' which is the same…