Input: Less than a week after uncovering Operation SnowMan, the FireEye Dynamic Threat Intelligence cloud has identified another targeted attack campaign-this one exploiting a zero-day vulnerability in Flash.


Input: We are collaborating with Adobe security on this issue.


Input: Adobe has assigned the CVE identifier CVE-2014- 0502 to this vulnerability and released a security bulletin.


Input: As of this blog post, visitors to at least three nonprofit institutions-two of which focus on matters of national security and public policy-were redirected to an exploit server hosting the zero-day exploit.

visitors to at least three nonprofit institutions

an exploit server hosting the zero-day exploit

were redirected

to


Input: We're dubbing this attack'' Operation GreedyWonk.


Input: '' We believe GreedyWonk may be related to a May 2012 campaign outlined by ShadowServer, based on consistencies in tradecraft (particularly with the websites chosen for this strategic Web compromise), attack infrastructure, and malware configuration properties.


Input: The group behind this campaign appears to have sufficient resources (such as access to zero-day exploits) and a determination to infect visitors to foreign and public policy websites.

The group behind this campaign

visitors to foreign and public policy websites

infect


Input: The threat actors likely sought to infect users to these sites for follow-on data theft, including information related to defense and public policy matters.

The threat actors

users to these sites

follow-on data theft

infect

for


Input: On Feb. 13, FireEye identified a zero-day Adobe Flash exploit that affects the latest version of the Flash Player (12.0.0.4 and 11.7.700.261).


Input: Visitors to the Peter G. Peterson Institute for International Economics (www.piie [.] com) were redirected to an exploit server hosting this Flash zero-day through a hidden iframe.

Visitors to the Peter G. Peterson Institute for International Economics (www.piie [.] com)

an exploit server hosting this Flash zero-day

a hidden iframe

were redirected

to

through


Input: We subsequently found that the American Research Center in Egypt (www.arce [.] org) and the Smith Richardson Foundation (www.srf [.] org) also redirected visitors the exploit server.

We subsequently found that the American Research Center in Egypt (www.arce [.] org) and the Smith Richardson Foundation (www.srf [.] org)

visitors

the exploit server

redirected


Input: All three organizations are nonprofit institutions; the Peterson Institute and Smith Richardson Foundation engage in national security and public policy issues.


Input: To bypass Windows' Address Space Layout Randomization (ASLR) protections, this exploit targets computers with any of the following configurations: Users can mitigate the threat by upgrading from Windows XP and updating Java and Office.

bypass

targets

Windows' Address Space Layout Randomization (ASLR) protections

this exploit

computers with any of the following configurations


Input: If you have Java 1.6, update Java to the latest 1.7 version.


Input: If you are using an out-of-date Microsoft Office 2007 or 2010, update Microsoft Office to the latest version.


Input: These mitigations do not patch the underlying vulnerability.


Input: But by breaking the exploit's ASLR-bypass measures, they do prevent the current in-the-wild exploit from functioning.


Input: GreedyWonk targets a previously unknown vulnerability in Adobe Flash.


Input: The vulnerability permits an attacker to overwrite the vftable pointer of a Flash object to redirect code execution.

an attacker

the vftable pointer of a Flash object

redirect code execution

overwrite

to


Input: The attack uses only known ASLR bypasses.

The attack

only known ASLR bypasses

uses


Input: Details of these techniques are available from our previous blog post on the subject (in the'' Non-ASLR modules'' section).


Input: For Windows XP, the attackers build a return-oriented programming (ROP) chain of MSVCRT (Visual C runtime) gadgets with hard-coded base addresses for English ('' en'') and Chinese ('' zh-cn'' and'' zh-tw'').

For

with

Windows XP

the attackers

a return-oriented programming (ROP) chain of MSVCRT (Visual C runtime) gadgets

hard-coded base addresses for English ('' en'') and Chinese ('' zh-cn'' and'' zh-tw'')

build


Input: On Windows 7, the attackers use a hard-coded ROP chain for MSVCR71.dll (Visual C++ runtime) if the user has Java 1.6, and a hard-coded ROP chain for HXDS.dll (Help Data Services Module) if the user has Microsoft Office 2007 or 2010.

On

if

if

Windows 7

the attackers

a hard-coded ROP chain for MSVCR71.dll (Visual C++ runtime)

the user has Java 1.6

a hard-coded ROP chain for HXDS.dll (Help Data Services Module)

the user has Microsoft Office 2007 or 2010

use


Input: Java 1.6 is no longer supported and does not receive security updates.


Input: In addition to the MSVCR71.dll ASLR bypass, a variety of widely exploited code-execution vulnerabilities exist in Java 1.6.


Input: That's why FireEye strongly recommends upgrading to Java 1.7.


Input: The Microsoft Office HXDS.dll ASLR bypass was patched at the end of 2013.


Input: More details about this bypass are addressed by Microsoft's Security Bulletin MS13-106 and an accompanying blog entry.


Input: FireEye strongly recommends updating Microsoft Office 2007 and 2010 with the latest patches.


Input: The shellcode is downloaded in ActionScript as a GIF image.

The shellcode

ActionScript

a GIF image

is downloaded

in

as


Input: Once ROP marks the shellcode as executable using Windows' VirtualProtect function, it downloads an executable via the InternetOpenURLA and InternetReadFile functions.

it

an executable

the InternetOpenURLA and InternetReadFile functions

downloads

via


Input: Then it writes the file to disk with CreateFileA and WriteFile functions.

it

the file

disk

CreateFileA and WriteFile functions

writes

to

with


Input: Finally, it runs the file using the WinExec function.

it

the file

the WinExec function

runs

using


Input: Once the exploit succeeds, a PlugX/Kaba remote access tool (RAT) payload with the MD5 hash 507aed81e3106da8c50efb3a045c5e2b is installed on the compromised endpoint.

a PlugX/Kaba remote access tool (RAT) payload with the MD5 hash 507aed81e3106da8c50efb3a045c5e2b

the compromised endpoint

is installed

on


Input: This PlugX sample was compiled on Feb. 12, one day before we first observed it, indicating that it was deployed specifically for this campaign.


Input: This PlugX payload was configured with the following command-and-control (CnC) domains: Sample callback traffic was as follows: Both java.ns1 [.

This PlugX payload

the following command-and-control (CnC) domains

was configured

with


Input: ] name and adservice.no-ip [.


Input: ] org resolved to 74.126.177.68 on Feb. 18, 2014.


Input: Passive DNS analysis reveals that the domain wmi.ns01.us previously resolved to 103.246.246.103 between July 4, 2013 and July 15, 2013 and 192.74.246.219 on Feb. 17, 2014.


Input: java.ns1 [.


Input: ] name also resolved to 192.74.246.219 on February 18.


Input: Further research uncovered a number of older malware samples connecting to the same domain wmi.ns01 [.] us.

a number of older malware samples

the same domain wmi.ns01 [.] us

connecting

to


Input: The Poison Ivy variants that connected to the domain wmi.ns01 [.] us had the following unique configuration properties: We found a related Poison Ivy sample (MD5 8936c87a08ffa56d19fdb87588e35952) with the same'' java7'' password, which was dropped by an Adobe Flash exploit (CVE-2012-0779).

The Poison Ivy variants

the domain wmi.ns01 [.] us

a related Poison Ivy sample (MD5 8936c87a08ffa56d19fdb87588e35952) with the same'' java7'' password

an Adobe Flash exploit (CVE-2012-0779)

connected

was dropped

to


Input: In this previous incident, visitors to the Center for Defense Information website (www.cdi [.

visitors to the Center for Defense Information website


Input: ] org-also an organization involved in defense matters-were redirected to an exploit server at 159.54.62.92.

were redirected

to

an exploit server at 159.54.62.92


Input: This exploit server hosted a Flash exploit file named BrightBalls.swf (MD5 1ec5141051776ec9092db92050192758).


Input: This exploit, in turn, dropped the Poison Ivy variant.

This exploit

the Poison Ivy variant

dropped


Input: In addition to using the same password'' java7,'' this variant was configured with the mutex with the similar pattern of'' YFds* & ^ff'' and connected to a CnC server at windows.ddns [.] us.

this variant

a CnC server at windows.ddns [.] us

connected

to


Input: Using passive DNS analysis, we see the domains windows.ddns [.


Input: ] us and wmi.ns01 [.


Input: ] us both resolved to 76.73.80.188 in mid-2012.


Input: During another earlier compromise of the same www.cdi.org website, visitors were redirected to a Java exploit test.jar (MD5 7d810e3564c4eb95bcb3d11ce191208e).

visitors

a Java exploit test.jar (MD5 7d810e3564c4eb95bcb3d11ce191208e)

were redirected

to


Input: This jar file exploited CVE-2012-0507 and dropped a Poison Ivy payload with the hash (MD5 52aa791a524b61b129344f10b4712f52).

This jar file

a Poison Ivy payload with the hash (MD5 52aa791a524b61b129344f10b4712f52)

dropped


Input: This Poison Ivy variant connected to a CnC server at ids.ns01 [.] us.

This Poison Ivy variant

a CnC server at ids.ns01 [.] us

connected

to


Input: The domain ids.ns01 [.


Input: ] us also overlaps with the domain wmi.ns01 [.


Input: ] us on the IP 194.183.224.75.


Input: The Poison Ivy sample referenced above (MD5 fd69793bd63c44bbb22f9c4d46873252) was delivered via an exploit chain that began with a redirect from the Center for European Policy Studies (www.ceps [.] be).

The Poison Ivy sample referenced above (MD5 fd69793bd63c44bbb22f9c4d46873252)

an exploit chain that began with a redirect from the Center for European Policy Studies (www.ceps [.] be)

was delivered

via


Input: In this case, visitors were redirected from www.ceps [.] be to a Java exploit hosted on shop.fujifilm [.] be.

visitors

www.ceps [.] be

a Java exploit hosted on shop.fujifilm [.] be

were redirected

from

to


Input: In what is certainly not a coincidence, we also observed www.arce [.] org (one of the sites redirecting to the current Flash exploit) also redirect visitors to the Java exploit on shop.fujifilm [.] be in 2013.

www.arce [.] org

the current Flash exploit

visitors

the Java exploit on shop.fujifilm [.] be

redirecting

redirect

to

to

in


Input: This threat actor clearly seeks out and compromises websites of organizations related to international security policy, defense topics, and other non-profit sociocultural issues.


Input: The actor either maintains persistence on these sites for extended periods of time or is able to re-compromise them periodically.


Input: This actor also has early access to a number of zero-day exploits, including Flash and Java, and deploys a variety of malware families on compromised systems.

This actor

a variety of malware families

compromised systems

deploys

on


Input: Based on these and other observations, we conclude that this actor has the tradecraft abilities and resources to remain a credible threat in at least the mid- term.


Input: The energy sector has become a major focus for targeted attacks and is now among the top five most targeted sectors worldwide.


Input: Companies in the sector are facing a growing risk of having their services interrupted or losing data.


Input: The threat to energy firms is only likely to increase in the coming years as new developments, such as further extensions of smart grids and smart metering expose more infrastructure to the Internet.


Input: Equipment that is not connected to the Internet and other networks is not immune to threats and there has already been a number of successful attacks against isolated systems.


Input: Operators of critical infrastructure, as well as energy utility companies, need to be aware of these threats and prepare accordingly.


Input: The threat to energy firms comes from several different sources.


Input: In some cases, espionage from competitors is the primary motive, with data on new projects, exploration and finances being targeted.


Input: Disruption and destruction are the goals of other attacks.


Input: Some instances appear to be state sponsored, such as the disruption of the Iranian nuclear program by the Stuxnet worm in 2010, one of the attacks that began this trend.


Input: Others appear to be the work of hacktivists with political or environmental agendas.


Input: Internal attackers, like disgruntled employees, are also a major source of attacks that often lead to service disruption.


Input: The majority of the actors behind these attacks have grown more sophisticated in the way they attack.


Input: During the monitoring period from July 2012 to June 2013, we observed an average of 74 targeted attacks per day globally.


Input: Of these, nine attacks per day targeted the energy sector.


Input: Accounting for 16.3 percent of all attacks, the energy sector was the second most targeted vertical in the last six months of 2012, with only the government/public sector exceeding it with 25.4 percent of all attacks.


Input: The high ranking was mainly due to a major attack against a global oil company, which we observed in September 2012.


Input: However, in the first half of 2013 the energy sector continued to attract a high proportion of attacks, ranking in fifth place with 7.6 percent of targeted attacks.


Input: Not all of the attacks analyzed used highly sophisticated tools.


Input: Most of them could have been prevented by following best practice guidelines for protecting the IT infrastructure and the industrial components, indicating that despite high revenues and strategic importance, many energy sector companies are not prioritizing cybersecurity.


Input: The number of targeted cyberattacks in general has risen in the past few years.


Input: In addition to this, the rate of attack exposure has also risen, with more companies becoming aware of attacks, expecting them and searching for indications of compromise.


Input: It is not a new phenomenon, but its importance has grown.


Input: The Council on Foreign Relations, a US think tank, reported that energy companies, including oil and gas producers, were often the focus of targeted attacks during summer 2012.


Input: In May 2013 the US Department of Homeland Security (DHS) warned of an increase in sabotage attacks against US energy companies located in the Middle East.


Input: The government had tracked multiple attacks and issued a warning together with the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT).


Input: A report by the US Congress supported this picture, stating that many power utilities companies were under constant or daily attack through cyberspace.


Input: Taking into account that successful breaches of critical infrastructures are still rare and that these numbers included generic malware infections, it nevertheless highlights the potential for cyberattacks in the energy sector.


Input: As in most sectors, attackers are often after valuable information.


Input: For example, we have seen attackers target intellectual property such as technology for photovoltaic research and wind turbines, or data on gas field exploration.


Input: Information such as this is of high value and can generate huge profits for attackers or their sponsors.


Input: The same information can also be misused for an act of sabotage.


Input: Many power utilities companies fear disruptive attacks the most, regardless of whether it is done by internal or external attackers.


Input: The energy sector has a high potential for critical disruption through sabotage attacks.


Input: Any interruption to the power grid would cause substantial chaos and cascading effects resulting in financial loss.


Input: In the past there have been quite a few attacks that included targets in the energy sector.


Input: Some of these were more focused, like Stuxnet, Duqu, Shamoon/Disttrack and Night Dragon.


Input: Others saw power companies targeted among many other sectors, such as Hidden Lynx, Nitro, Flamer, Net Traveler and Elderwood to name a few.


Input: One of the biggest examples, and a game changer for many organizations, was Stuxnet.


Input: This targeted sabotage attack, which is believed to have been aimed against uranium enrichment facilities in Iran, made clear what could be done through cyberattacks.


Input: It is also clear that the energy sector is not exempt from the generic attacks that every company faces, such as ransomware that locks PCs or financial Trojans that attempt to steal passwords and credit card details.

ransomware

PCs

financial Trojans

passwords and credit card details

locks

steal


Input: For example, such a case happened in May 2013, when a small fuel distribution company in North Carolina fell victim to a cyberheist that transferred US $800,000 from the company's bank account.


Input: Such threats spread broadly and might impact any person, regardless of their employer.


Input: These attackers aim at infecting as many computers as possible in order to maximize their chances of profits.


Input: These attacks can include nonspecific data breaches where employee or customer records get stolen, as happened to the US Department of Energy in July 2013.

employee or customer records

stolen


Input: For this paper we focused on email data from targeted attacks between July 2012 and June 2013.


Input: Even though watering holes are becoming more frequently used in targeted attacks, it is unfortunately quite difficult to reliably map these to individual campaigns.


Input: A blocked drive-by download attempt does not give any indication if it was a targeted attack or just general noise.


Input: In quite a few cases we see the same common malware, like Poison Ivy, being used by generic attackers and by targeted attacks.


Input: In such cases the sole difference between a sophisticated targeted attack and a generic one lies in the person commanding the malware.


Input: Historically most industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems were in separated networks not connected to the Internet or any other network.


Input: Unfortunately this security through segregation approach does not fully protect against cyberattacks.


Input: In reality, networks are rarely completely isolated.


Input: Often some configuration updates are periodically installed or log files are transferred.


Input: If systems are not directly connected, the method of choice for these types of interactions is usually through a USB stick or a non-permanent modem connection, which provides a way into the restricted networks.


Input: This allows malware to spread into such isolated networks as demonstrated many times by threats such as Stuxnet.

malware

such isolated networks

demonstrated many times by threats such as Stuxnet

spread

into

as


Input: If networks are truly segregated, this would mean that there would be no software updates installed, leaving old vulnerabilities open.


Input: There are also issues around processes.


Input: For example, the revocation lists for digital certificates are seldom updated and therefore certificates which are no longer valid can not be checked properly and would still be accepted.


Input: With the increasing desire for connectivity now reaching industrial plants, many operators have started to connect their ICS to the Internet.


Input: New adapters can bridge to older technology which was never intended to be controlled over the Internet, allowing it to be connected easily.


Input: This allows for efficient centralized monitoring and, to some extent, remote control of equipment.


Input: Depending on the type of machinery controlled through the human-machine interface (HMI) of the ICS, not all modifications are possible.


Input: Some systems are physically connected in a pure read-only mode for monitoring.


Input: And even if they are fully connected, some turbines have physical limitations or emergency systems based on physical effects that can not be overridden by the digital controller.


Input: Thus, not all Hollywood scenarios of open flood gates or turbines that fly through the air are possible.


Input: However, sabotage attacks that damage equipment are definitely possible, as has already been demonstrated.

sabotage attacks

equipment

damage


Input: In the future, more systems are going to implement the failsafe switches in software, opening up the vector for malware attacks.


Input: An additional source of concern is that some countries have started to open the energy market for smaller private contributors.


Input: This means that almost anyone can use mini power plants like water, wind or photovoltaic sites to feed energy back into the power grid.


Input: Often these operators do not have a full IT staff supporting the facilities at hand, which might lead to more vulnerable installations.


Input: Furthermore they may deploy new technology which might be untested and contain some unknown vulnerabilities.


Input: While these smaller sites make up only a small portion of the grid, new decentralized power input feeds are a challenge for the balance of the power grid as well and need to be carefully monitored.


Input: Small outages or changes can have a domino effect for the whole power grid.


Input: To increase the exposure of energy firms even further, sites like SHODAN, which is essentially a search engine for devices, enable anyone to easily find exposed controllers on the Internet.


Input: Of course not all of the industrial control systems connected to the Internet are critical systems or even real ones.


Input: Some researchers have started to create honey pot systems in order to study the attackers, which have apparently already attracted attackers like the Comment Crew/APT1 group, who have broken into these decoy systems.


Input: Smart grids and smart metering are bringing significant change to the world's power systems.


Input: Experts predict that billions of smart meters and sensors will be installed worldwide over the next ten years.


Input: They enable utility companies to measure energy consumption at a more granular level, creating better flow patterns and enabling different prices for consumption based on the time of day and location.


Input: This development brings new opportunities, as well as new challenges.


Input: As with any connected infrastructure, it is important to secure the network and its endpoint on multiple levels.


Input: There have already been proof of concept attacks that demonstrate how smart meters could be manipulated to send back false information or report incorrect billing IDs, leading to power theft.

smart meters

send back false information or report incorrect billing IDs, leading to power theft

be manipulated

to


Input: In addition to the issue of securing these devices, smart grids will produce a huge amount of data which, depending on regulations, will need to be kept for audits.


Input: Some of this data may be sensitive and could raise privacy concerns if not properly protected.


Input: This could easily grow to petabytes of data that needs to be safely stored and managed.


Input: It is beyond the scope of this paper to address all the challenges associated with smart grids and smart meters.


Input: Symantec has created a dedicated whitepaper for this topic: How to protect critical infrastructure, mitigate fraud and guarantee privacy.


Input: As a member of the CRISALIS project, Symantec is following these developments closely and is helping to secure critical infrastructure together with partners from academia and different industry sectors.


Input: There have been numerous cyberattacks against the energy sector over the past few years.


Input: Not all of them were the work of sophisticated attackers; some incidents were just collateral damage caused by malware infections or bad configuration issues.


Input: These incidents highlight the fact that such attacks can happen and that they can have real life consequences.


Input: In 2013 part of the Austrian and German power grid nearly broke down after a control command was accidentally misdirected.


Input: It is believed that a status request command packet, which was broadcast from a German gas company as a test for their newly installed network branch, found its way into the systems of the Austrian energy power control and monitoring network.


Input: Once there, the message generated thousands of reply messages, which generated even more data packages, which in turn flooded the control network.


Input: To stop this self-inflicted DDoS attack, part of the monitoring and control network had to be isolated and disconnected.


Input: Fortunately the situation was resolved without any power outages.


Input: In 2008, Tom Donahue, a senior Central Intelligence Agency (CIA) official told a meeting of utility company representatives that cyberattacks had taken out power equipment in multiple cities outside the United States.

cyberattacks

power equipment in multiple cities outside the United States

taken out


Input: In some cases the attacker tried to extort money from the energy companies, threatening them with further blackouts.


Input: In 2003 the safety monitoring system of the Ohio nuclear power plant apparently went offline for several hours due to a Slammer worm infection.

the safety monitoring system of the Ohio nuclear power plant

offline

several hours

a Slammer worm infection

went

for

due to


Input: Fortunately the power plant was already offline due to maintenance and the installed secondary backup monitoring system was unaffected by the worm.


Input: Nevertheless the incident raised safety concerns.


Input: At the beginning of 2003 a marine terminal in Venezuela was targeted by a sabotage attack.

a marine terminal in Venezuela

a sabotage attack

was targeted


Input: Details of this attack are scarce and vague, but it seems that during a strike an attacking group managed to get access to the SCADA network of the oil tanker loading machinery and overwrote programmable logic controllers (PLCs) with an empty program module.

an attacking group

access to the SCADA network of the oil tanker loading machinery

programmable logic controllers (PLCs)

an empty program module

get

overwrote

with


Input: This halted machinery, preventing oil tankers from loading for eight hour till the unaffected backup code was reinstalled on the PLCs.

This

machinery

oil tankers

loading

eight hour

the unaffected backup code was reinstalled on the PLCs

halted

preventing

from

for

till


Input: The attack was not too sophisticated as it was easily spotted.


Input: A small modification of the PLC code instead would probably have gone unnoticed for a long time.


Input: In 2001 an attack took place against California's power distribution center, which controls the flow of electricity across California.


Input: Due to apparently poor security configuration, the attacker was able to compromise two Web servers that were part of a developer network and penetrate further from there.


Input: Fortunately the attackers were stopped before they managed to attack any systems which were tied into the transmission grid for the Western United States.


Input: According to Russian officials, the largest natural gas extraction company in the country was successfully attacked in 2000.


Input: The attackers used a Trojan to gain access to the control for the gas pipelines.

The attackers

a Trojan

gain access to the control for the gas pipelines

used

to


Input: Through this switchboard, the flow for individual gas pipelines could have been modified, which would easily have caused widespread disruption.


Input: Aside from these incidents, there have also been a number of more serious and well-documented targeted attacks against the energy sector: The Stuxnet incident and its relatives Duqu, Flamer and Gauss are some of the most talked-about cases of targeted attacks.


Input: As far as we know today, the Stuxnet operation began in November 2005 with the registration of the command and control (C & C) servers used in the attacks.

the Stuxnet operation

November 2005

the registration of the command and control (C & C) servers used in the attacks

began

in

with


Input: The first recorded appearance of what we now call Stuxnet version 0.5 was in November 2007.


Input: Since then, a handful of different versions have been found and analyzed.


Input: Stuxnet 1.x is based on what is now known as the'' tilded'' platform; whereas Stuxnet 0.5 is based on the Flamer framework.


Input: The code segments and programming style differ, which indicates that two different programming teams were most likely responsible for the different branches of Stuxnet.


Input: Thorough investigation into the mechanism and functions of this threat started in July 2010.


Input: Stuxnet is the first known autonomous threat to target and sabotage industrial control systems to such an extent.

Stuxnet

industrial control systems

target and sabotage


Input: Stuxnet is a sophisticated piece of malware, which uses seven vulnerabilities to spread and infect its targets.

Stuxnet

seven vulnerabilities

spread and infect its targets

uses

to


Input: The most notable vulnerability is the Microsoft Windows Shortcut'LNK/PIF' Files Automatic File Execution Vulnerability (CVE-2010-2568), which allows it to auto-execute on USB drives.


Input: Spreading through infected portable media drives allowed it to also infect networks isolated by air gaps that are unreachable from the Internet.

Spreading

infect

through

infected portable media drives

it

networks isolated by air gaps that are unreachable from the Internet


Input: This was most likely the first infection vector used by Stuxnet.


Input: In addition, it is able to infect Step7 project files, which are used to control Programmable Logic Controllers (PLCs).

it

Step7 project files, which are used to control Programmable Logic Controllers (PLCs)

infect


Input: This allowed the worm to infect computers whenever the engineer exchanged the project files.

the worm

computers

the engineer exchanged the project files

infect

whenever


Input: Besides this, it also spread through network shares, a printer spooler vulnerability, an old Windows RPC (remote procedure calls) vulnerability and a known password in the WinCC database.

it

network shares

a printer spooler vulnerability

an old Windows RPC (remote procedure calls) vulnerability

a known password in the WinCC database

spread

through


Input: In the end, Stuxnet propagated further than its authors probably intended.


Input: We have monitored more than 40,000 infected IP addresses in 155 countries.


Input: Many of those systems are most likely just collateral damage and were not intended to be infected by the attackers.


Input: For example multiple computers at Chevron were infected by Stuxnet, without any damage being done.


Input: Part of the malware code was signed with stolen digital certificates making it harder to detect by security tools.

Part of the malware code was signed with stolen digital certificates

it

harder to detect by security tools

making


Input: To hide its activity even further, Stuxnet executed slightly different infection routines depending on the security software installed on the target.

To

hide its activity even further

Stuxnet

slightly different infection routines depending on the security software installed on the target

executed


Input: On the USB drive itself, the malware would hide its own files and even delete itself from it after three successful propagations.

the malware

its own files

itself

it

three successful propagations

hide

delete

from

after


Input: Tricks like these, to make the detection of the malware more difficult, are now frequently used in modern targeted attacks.

Tricks like these

the detection of the malware

more difficult

make


Input: Stuxnet's payload focused on PLCs, which are used to control different industrial components.


Input: The target of the Stuxnet operation is believed to be a uranium enrichment facility in Iran.


Input: The sabotage payload disrupted and partially destroyed the cascaded high frequency gas centrifuges.

The sabotage payload

the cascaded high frequency gas centrifuges

disrupted and partially destroyed


Input: The early version of Stuxnet targeted the S7- 417 PLCs and modified its valve settings.

The early version of Stuxnet

the S7- 417 PLCs

its valve settings

targeted

modified


Input: Closing the valves at certain points in time would lead to an increase of pressure that could damage the equipment.


Input: The later version of the threat focused on the S7-315 PLCs, manipulating the spinning frequency of the rotating motors.

The later version of the threat

the S7-315 PLCs

the spinning frequency of the rotating motors

focused

manipulating

on


Input: By speeding the centrifuges up and slowing them down repeatedly, the output quality could be spoiled and the centrifuges themselves could be damaged.


Input: The payload would only become active if the fingerprint in the found PLC setup matched a given configuration setup.

The payload

active

the fingerprint in the found PLC setup matched a given configuration setup

become

if


Input: This minimized the collateral damage at other facilities and showed that the attackers had in-depth knowledge of the targeted uranium enrichment facilities.


Input: To avoid detection by personnel monitoring the human machine interface (HMI) of the plant, the threat recorded measurement readings during normal operation and played those back in a loop.

To

avoid detection by personnel monitoring the human machine interface (HMI) of the plant

the threat

measurement readings during normal operation

those back in a loop

recorded

played


Input: Operation Night Dragon, which was uncovered in 2010, is a typical example of global oil companies being targeted, but this time not with the aim of disruption in mind.


Input: The attacks started in late 2009 and were directed at finding project details and financial information about oil and gas field exploration and bids.

The attacks

project details and financial information about oil and gas field exploration and bids

finding


Input: The attackers started by compromising public facing Web servers through SQL injection and installing Web shells on them.

The attackers

public facing Web servers

SQL injection and installing Web shells on them

compromising

through


Input: Once they had control over the server they used common hacking tools to harvest local passwords, dump password hashes, sniff authentication messages and exploit internal active directory configuration.

they

local passwords

password hashes

authentication messages

harvest

dump

sniff


Input: This allowed them to move on to other internal computers using the gathered passwords.

them

other internal computers

the gathered passwords

move

on to

using


Input: In addition, spear phishing messages were used to compromise additional computers.

spear phishing messages

compromise additional computers

were used

to


Input: The attackers did not use any zero-day vulnerabilities during their attacks.


Input: Rather they used publicly available tools for each individual job.


Input: On compromised computers a common Backdoor.Trojan was installed that communicated back to the C & C server, allowing remote access to the computer.

On

back to

compromised computers

a common Backdoor.Trojan

the C & C server

remote access to the computer

was installed

communicated

allowing


Input: This allowed the attacker to find and extract valuable information.

the attacker

valuable information

find

extract


Input: In August 2012 an extremely destructive cyberattack hit an estimated 30,000 computers at one of the largest oil producers of the world in Saudi Arabia.


Input: The W32.Disttrack malware used in this attack, also known as Shamoon, consists of three components: a dropper, a wiper and a reporter module.


Input: The dropper component is responsible for creating all the required files on the system, registering a service called'' TrkSvr'' in order to start itself with Windows.

The dropper component

all the required files on the system

a service called'' TrkSvr''

itself

Windows

creating

registering

start

with


Input: It also attempts to copy itself to accessible network shares and execute itself remotely if successfully copied.

It

itself

accessible network shares

itself

remotely

successfully copied

copy

execute

to

if


Input: The wiper component is only activated when a hardcoded configuration date has been passed.


Input: This enables a coordinated,'' time bomb'' scenario.


Input: The module then drops a legitimate and digitally signed device driver that provides low level disk access from user space.

The module

a legitimate and digitally signed device driver that provides low level disk access from user space

drops


Input: The malware collects file names and starts overwriting them with a JPEG image or 192KB blocks of random data.

The malware

file names

them

a JPEG image or 192KB blocks of random data

collects

overwriting

with


Input: At the end Disttrack finishes the computer off by wiping the master boot record with the same data.

Disttrack

the master boot record

the same data

wiping

with


Input: The reporter component is responsible for sending back a HTTP GET request to the C & C server.

The reporter component

a HTTP GET request

the C & C server

sending

back

to


Input: It reports the domain name, IP address and number of files overwritten.

It

the domain name, IP address and number of files overwritten

reports


Input: By acquiring user credentials and gaining access to the domain controller the attackers were able to push the malware on to many systems before they triggered the destructive payload.

acquiring

push

user credentials

the attackers

the malware

many systems

they triggered the destructive payload

on to

before


Input: Disttrack's secondary goal may have been to steal valuable information from infected computers, but the main intent was to render the computers unusable by wiping the operating system and master boot record, causing disruption and downtime at the targeted company.

Disttrack

valuable information

infected computers

the computers unusable

the operating system and master boot record

steal

render

wiping

from


Input: Although wiping is also frequently used to destroy evidence of the attack and make forensics more difficult.

wiping

evidence of the attack

forensics

more difficult

destroy

make


Input: The malware does not contain any payload against ICS, like Stuxnet does for PLCs, and is not as sophisticated.


Input: According to the company, no computer related with the production or distribution of oil was affected, since the operational network is separated and specially protected.


Input: One group that claimed responsibility for the attack posted on Pastebin that it was an anti-oppression hacker group.


Input: The attack was prompted by disappointment with some of the regimes in the Middle East, the group said.


Input: True or not, this shows that it is not necessarily only state-sponsored attackers who are carrying out disruptive attacks.


Input: Sabotage attacks usually fall into the orbit of hacktivists, who seek attention rather than profit.


Input: Some sources reported that the attackers had help from insiders, which would explain the so far unclear infection vector.


Input: Soon after this attack became known, a Qatari gas company was attacked in a similar way.


Input: Spear phishing is, along with watering hole attacks, one of the most common attack vectors used to attack companies.

Spear phishing

attack companies

used

to


Input: The attacks are simple to carry out.


Input: They often follow the same pattern, starting with a reconnaissance phase to gather all publicly available information.


Input: This is followed by the incursion phase of breaking in and compromising computers.

breaking in and compromising

computers


Input: After that comes the discovery phase, where the attacker gathers passwords and maps the internal network.

the attacker

passwords

the internal network

gathers

maps


Input: The final stage is capture and exfiltration, where the valuable information is copied and sent back to the attacker.

the valuable information

the attacker

is copied

sent back

to


Input: The last phase may also involve a disruption attack if the goal is sabotage.


Input: For a more detailed analysis of the attack phases, see Appendix C. A spear phishing attack consists of an email with either a malicious attachment or a link to a malicious website.


Input: Such emails are sent in bulk to a handful of key users.


Input: These waves are often repeated till enough people fall for the bait and compromise their computers.


Input: For analysis on the social engineering themes used, attack details and attachment types used, see Appendix A.


Input: Some of the spear phishing campaigns are smaller in scale and are focused on specific targets.


Input: For example, on January 1, 2013 a global energy research company was targeted.


Input: A wave of spear phishing emails were sent from two Freemailer accounts to 291 individuals at the targeted company.

A wave of spear phishing emails

two Freemailer accounts

291 individuals at the targeted company

were sent

from

to


Input: All receiving email addresses started with a letter between G and R, covering half of the alphabet.


Input: Whether there was a second wave of emails using the other half of the alphabet or whether the attackers only got their hands on part of the address book remains unknown.


Input: All emails had either the subject line'' 2013, Obama QE4! Merry Christmas!'' or'' 2013, Obama QE4!''.


Input: It is common to see spear phishing attacks take place around holidays, as people are receiving more emails during these times and are less likely to perform due diligence while opening them.


Input: All of the emails contained the same Trojan.Dropper disguised as an attachment with the filename AVP.dll.

All of the emails

the same Trojan.Dropper

an attachment with the filename AVP.dll

contained

disguised

as


Input: The malware itself drops a malicious Downloader'' clbcatq.dll'' into a newly created'' wuauclt'' directory, posing as Windows update and taking advantage of the DLL search order hijack weakness in order to load the malicious code in Windows.

The malware itself

a malicious Downloader'' clbcatq.dll''

a newly created'' wuauclt'' directory

Windows update

the malicious code

Windows

drops

posing

load

into

as

in


Input: The same family of dropper has been used in previous targeted attacks against other sectors, indicating that a group with multiple interests is behind the attacks.


Input: The back door provided full access to the compromised computers.

The back door

full access to the compromised computers

provided


Input: A week later, on January 7, 2013, the group attacked the same company again.


Input: Seventy emails were sent to 58 individuals using either'' 2012-13 NFL Playoffs Schedule'' or'' Re: 2012-13 NFL Playoffs Schedule'' as a subject line.


Input: In this wave, the attackers used a similar AVP.dll to the one used before.


Input: In some of the emails, an additional CHM file with an old exploit was used in an effort to maximize the chances of a successful infection.


Input: After this second wave, the attack ceased.


Input: It is unknown if the attackers successfully retrieved the information they were seeking, if they installed other back door Trojans or gained passwords that allowed them to directly access the computers, or if they have given up on the target.

they

other back door Trojans

installed


Input: A global oil company, with offices around the world, had been under continuous attack for some time, but in September 2012 we noticed an upsurge in activity, with 34 times more suspicious emails than on average.


Input: This provided a clear indication that something suspicious was going on.


Input: At the end of this wave of emails, a hotel chain, a rental car company and two financial institutions were also targeted by the same attacker.


Input: This may have been an attempt to find further information that could be used in a future social engineering attack against the oil company.


Input: In total, 136 email accounts at the oil company were targeted.


Input: A regional sales manager in Greece received 412 emails over the 12 month period, with 155 different attachments.


Input: A HR person in the same country received the second largest amount of emails with 90 in total.


Input: Seventeen other people were targeted between 70 and 90 times, many in the same region.


Input: The rest of the targeted people received less than five emails each, in what seems to have been an undirected spraying in the hope that at least some would fall for the bait.


Input: Clearly the one person that received the highest volume of emails was deemed to be of high value to the attackers.


Input: Possible explanations for the attack could be that a competitor wanted to know more about some upcoming deal or details on the oil field exploration, but this would be highly speculative.


Input: The spear phishing emails came from 234 spoofed addresses.

The spear phishing emails

234 spoofed addresses

came

from


Input: They were made to appear to be linked to the company in relation to the subject and attachment chosen.

They

appear to be linked to the company in relation to the subject and attachment chosen

were made

to


Input: Many of the emails came from the same country as the main targeted sales manager.


Input: The emails all contained malicious attachments.

The emails all

malicious attachments

contained


Input: None of them linked to third party sites for drive-by downloads.


Input: Of the attachments, 1,588 had a .exe


Input: extension.


Input: Of those, 842 had a .pdf.exe


Input: extension.


Input: The malware chosen was a variant of the Poison Ivy Trojan Backdoor.Darkmoon and, in some minor cases, Trojan droppers that would download additional malware.

The malware chosen

a variant of the Poison Ivy Trojan Backdoor.Darkmoon

Trojan droppers

additional malware

was

download


Input: The attackers did not use any zero-day exploits to drop a payload.


Input: The social engineering messages concentrated mainly around the following two themes: Once installed, the back door would create a registry run key in order to restart with Windows and connect to one of three C & C servers located in Greece.

installed

create

restart

connect

the back door

a registry run key

Windows

one of three C & C servers located in Greece

with

to


Input: The last C & C server has been used since 2010 in similar attacks against other companies.

The last C & C server

similar attacks against other companies

been used

since

in


Input: Other sub-domains at the same free host and DNS service have been used by other groups to spread malware in the past.


Input: The chosen names of the C & C server domains imitates legitimate services in a bid to be overlooked by the system administrators when checking their logs.

The chosen names of the C & C server domains

legitimate services

be overlooked by the system administrators when checking their logs

imitates

in a bid to


Input: The back door provides full remote access to the compromised computers, allowing for extraction of any data.

The back door

full remote access

the compromised computers

extraction of any data

provides

allowing

to

for


Input: It is unknown if the attackers succeeded in their goal and if valuable information has been extracted.


Input: The attacks did not completely disappear, but the email volume decreased significantly to only a few emails per week afterwards.


Input: As with all targeted attacks, there are many different groups of attackers operating in this field.


Input: These attacks can not be attributed to only one group or geographical region.


Input: We have seen individuals, competitors, hacktivist groups and possible state sponsored agents carrying out attacks against energy companies.


Input: Some of the attacks have been purely opportunistic, seeking any valuable information available.


Input: Other campaigns look like they were planned over a lengthy period and carried out methodically with a clear goal in mind.


Input: The attackers tend to go after valuable information, including maps of new gas fields or research on efficient photovoltaic generators.


Input: This information can be of great value to competitors or nations that want to make progress in the same field.


Input: Another motivation for attackers is to profit from the information stolen by blackmailing the company.


Input: The same information can be used to carry out sabotage attacks designed to disrupt ICSs, as the energy sector is also a primary target for sabotage attacks which will not generate direct profit for the attacker.


Input: A competitor might be interested in generating bad press and bad customer experience for a rival company, in order to win some new clients.


Input: For example, in January 2013 a group claiming to be related to Anonymous posted access details for what they said were Israeli SCADA systems for power plants and other systems.


Input: Meanwhile,'' Operation Save the Arctic'' targeted multiple oil companies around the globe in protest against drilling plans in the Arctic.


Input: Disgruntled employees are also a source of attacks that should not be underestimated.


Input: With their knowhow about internal critical processes and systems they often know how to inflict serious damage.


Input: They may be able to perform system modifications that could go unnoticed for a long periods.


Input: For all regular client computers, the well-established best practice guidelines apply.


Input: These computers are often the first ones to be attacked.


Input: Once compromised, the attacker will use these computers and try to explore deeper into internal networks.


Input: Securing and hardening of deployed operating systems with a working strategy for patch deployment is important.


Input: Reoccurring security awareness training can help users to identify social engineering attempts and prevent them from falling victim to them in the first place.


Input: The company can perform penetration testing on Web and network applications but also on ICSs to identify and remedy any vulnerability.


Input: For examples Web applications should be tested against SQL injection attacks.


Input: This can also help confirm if applied polices are followed through, if the patch level is correct on all computers and if systems are compliant.


Input: Companies can monitor the Internet for information about attacks in the same vertical and apply lessons learned where possible.


Input: In addition, different layers of security products can help achieve better overall protection.


Input: • Security Information and Event Manager system (SIEM): Using a SIEM can help correlate all related alerts in one place.


Input: This centralized view can be cross referenced with threat intelligence data to generate prioritization and an action plan.


Input: Painting the bigger picture of the overall security state can reveal previously unnoticed attacks.


Input: For example failed login attempts on internal servers could indicate a password breach.


Input: This includes logging of critical systems and synchronization of time among multiple systems.


Input: • Ingress and egress filtering: Filtering the network traffic with firewalls, content filters and IPS allows the control of data flows.


Input: This can prevent attackers from reaching internal systems.


Input: It is important to also monitor outbound traffic, as data exfiltration is a key point for cyberespionage.


Input: It should be noted that with the increased use of cloud services and mobile devices, some traffic might never pass through the company's gateways.


Input: Where traffic blocking is too disruptive at least monitoring should be implemented.


Input: • Data loss prevention (DLP): DLP solutions can track the access and flow of critical information and prevent it from leaving the company or encrypt it automatically.


Input: • Endpoint protection: Depending on the usage pattern of the computer, different solutions are available to protect the endpoint.


Input: Antivirus solution with proactive detection methods like behavioral analysis and reputation scanning can prevent unknown malware from installing itself.


Input: HIPS (host based intrusion prevention systems), behavioral lockdown or whitelisting can protect computers from any kind of unwanted tampering without the need of constant updates.


Input: • System protection: For non-standard IT systems, hardening can increase the security.


Input: On industrial systems which are not often updated or that can not be updated, exploitation can be prevented with the help of lockdown solutions like Symantec Critical System Protection (CSP).


Input: Through policies, only trusted system applications are allowed to run.


Input: ICS should be regularly checked and upgraded if new firmware exists.


Input: Where this is not possible HIPS and behavioral lockdown tools can be used to secure computers.


Input: • Email filtering: Proper email filtering can prevent many spear phishing attempts from reaching users.


Input: They can help minimize the risk of an untrained user falling for social engineering tricks.


Input: • Authentication: Some of the ICS contain hardcoded passwords and, wherever possible, these should be changed.


Input: ICS frequently use weakly authenticated protocols that allow for impersonation attacks.


Input: Where possible those authentication methods should be upgraded or at least closely monitored.


Input: Strong authentication or PKI should be used where applicable.


Input: Industrial control systems (ICS) should be specially protected and monitored.


Input: The control system and control network should be secured.


Input: Where possible, ICS should be separate from the Intranet.


Input: Isolating these networks alone is often not enough to protect the control network, but it can make it more difficult for attackers to succeed.


Input: For some systems it can make sense to have a plan to quickly disconnect or separate critical machines in the event of a detected cyberattack.


Input: Cyberespionage campaigns and sabotage attacks are becoming increasingly common, with countless threat actors attempting to gain a foothold in some of the best protected organizations.


Input: At this stage, roughly five targeted attacks per day are being mounted on firms in the energy sector.


Input: These attacks have become increasingly sophisticated, although the capabilities and tactics used by these threat actors vary considerably.


Input: In the second half of 2012, the energy sector was the second most targeted with 16 percent of all the targeted attacks.


Input: This strong increase was mainly due to a large scale attack against one global oil company.


Input: In the first half of 2013, the energy sector was ranked fifth with 7.6 percent of all attacks focused on this sector.


Input: In general we have observed that attackers are becoming more efficient and focusing on smaller operations that attract less attention.


Input: The attackers tend to go after valuable information–such as maps of a new gas field–but the sector is also a major target for sabotage attacks, which will not generate direct profit for the attacker.


Input: Such disruptive attacks do already happen and may lead to large financial losses.


Input: State sponsored agents, competitors, internal attackers or hacktivists are the most likely authors of such sabotage attacks.


Input: Fortunately, there have not been many successful sabotage attacks against energy companies to date.


Input: However, the increasing number of connected systems and centralized control for ICS systems means that the risk of attacks in the future will increase.


Input: Energy and utility companies need to be aware of these risks and plan accordingly to protect their valuable information as well as their ICS or SCADA networks.


Input: Social engineering is an essential part of spear phishing campaigns.


Input: A cleverly chosen, enticing message may prompt the user into opening an attachment.


Input: It is evident that most attackers are carefully selecting the themes that they use for their attacks.


Input: Some groups use real news stories and copy the text directly from the newspaper websites.


Input: Others try to appeal to personal hobbies in order to get the user's attention.


Input: In the energy sector the most commonly used theme for spear phishing emails was money related (e.g.


Input: '' Wage Data 2012'') followed by sports related themes (e.g.


Input: '' 2012-13 NFL Playoffs Schedule'').


Input: As an example, the subject line'' Wage Data 2012'' was used in 944 emails, sent from 26 different email addresses to targets in nine different sectors.

'' Wage Data 2012''

944 emails

26 different email addresses

targets in nine different sectors

was used

sent

in

from

to


Input: The attack was carried out over eight days and used the same infected Microsoft Word document in every instance.

The attack

the same infected Microsoft Word document

every instance

used

in


Input: In general any topic can be used in a social engineering attempt, which makes it even harder for regular users to spot the attacks.


Input: Here are a few examples of subject lines used, listed by category: In the last six month of 2012 the average number of targeted attacks observed per day was 87 (with 14 in the energy sector).


Input: In the first six month of 2013 the average number decreased to 60 targeted attacks per day (five in the energy sector).


Input: The spike in August and September 2012 is mostly related to a large scale attack against a global oil company.


Input: The increase in May 2013 was due to multiple attacks against financial services, public sector and IT service organizations.


Input: The government and public sector was quantitatively the most attacked sector, with 25.4 percent of all targeted attacks falling in this sector for the last half of 2012 and 24 percent for the first half of 2013.


Input: The energy sector accounted for 7.6 percent of all targeted attacks, making it the fifth most targeted sector in the first six month of 2013.


Input: This was a big decrease from 16.3 percent of all attacks in the last half of 2012, when it was the second most attacked sector.


Input: This spike in 2012 is mainly due to a large attack campaign against a global oil company which took place in September 2012.


Input: On average we saw 18.6 mail accounts being attacked for any given target company in the last half of 2012 (60.7 in the energy sector) and 5.6 email accounts in the first half of 2013 (10 in the energy sector).


Input: Overall, we see a trend of the attacker conducting more focused attacks against fewer individuals.


Input: This generates less noise and the risk of getting noticed or discovered is smaller.


Input: These emails are sent in small bursts and then repeated against a changing target space till enough computers are compromised.


Input: Half of all the attachments analyzed used an extension that would run directly when double clicked.


Input: This old method is still the most common scheme used.


Input: Of all attachments analyzed, 38 percent were .exe


Input: and 12 percent were .src


Input: files.


Input: In total only 6 percent used double extensions like .pdf.exe


Input: to fool the user.


Input: It should also be noted that 23 percent were Microsoft Word documents using some exploit to execute custom code on the computer.


Input: There were also some more exotic extensions used like AutoIt scripts (.au3


Input: ) and ZX-Edit files (.zed


Input: ), but these are the exception rather than the rule.


Input: It might be that the attackers tried to bypass some email filtering software by experimenting with different attachment types.


Input: Sometimes even older exploits like the Microsoft DirectX DirectShow Length Record Remote Code Execution Vulnerability (CVE- 2009-1539) in .mp4


Input: files are still occasionally used.


Input: This indicates that either not all attackers have the knowhow to use newer exploits that are publicly available or they speculate that the target has not patched all computers.


Input: Some of the attackers do not seem to be too sophisticated.


Input: For example they used'' www.


Input: [COMPANY-NAME] .com.exe


Input: '' as an attachment name, clearly missing that the'' .com


Input: '' at the end would be sufficient to run it and the additional'' .exe


Input: '' was not needed.


Input: To identify a series of targeted attacks that are likely performed by the same individuals, we have used a novel attack attribution methodology named TRIAGE.


Input: Developed by Symantec Research Labs, TRIAGE is data mining software that relies on multi-criteria decision analysis and intelligent data fusion algorithms to reliably link different attacks to the same source.


Input: This framework has been developed in order to automate cyberintelligence tasks and reduce the time needed to get insights into organized cybercrime activities.


Input: By enabling rapid analysis of large security data sets, Symantec analysts can then quickly and more efficiently attribute various waves of cyberattacks to a specific attack campaign likely run by the same individuals.


Input: The TRIAGE framework was recently enhanced with novel visualizations thanks to VIS-SENSE, a European research project aiming at developing visual analytics technologies for network security applications.


Input: Since its original conception, TRIAGE has been successfully used to analyze the behavior of cybercriminals involved in various types of Internet attack activities, such as rogue antivirus websites, spam botnets operations, scam campaigns and targeted attacks performed via spear phishing emails.


Input: As with any other targeted attacks, attacks against the energy sector often follow the same pattern.


Input: It can be broken down in different phases of attack.


Input: It should be noted that we have seen attackers modify their behavior and exceptions from the norm and this is possible especially if the target company has special circumstances or security measures in place.


Input: During this phase the attacker tries to learn as much as possible about the targeted organization.


Input: Information sources often include social networks, job posting sites and press releases.


Input: This enables the attacker to learn the contact details of possible target individuals as well as context that can be used in social engineering scenarios.


Input: The attacker will often create a list of implemented security software used at the targeted company from whatever information is available.


Input: These investigations often start completely passively without any direct contact with the company, since there are many data sources publicly available.


Input: Subsequently the attacker can use more interaction if needed.


Input: Some attackers go through all the effort of creating a fake social media account and befriending key employees.


Input: After a period of small talk, to create a false sense of security, such a connection can then be used to pass on an infected document or find out about some key information.


Input: Depending on the targeted location, physical reconnaissance and eavesdropping may also be used.


Input: The actual break-in occurs during this phase.


Input: The attacker usually compromises the network by delivering targeted malware to vulnerable systems or employees.

The attacker

the network

targeted malware

vulnerable systems or employees

compromises

delivering

to


Input: There are two main avenues of attack.


Input: One is to send spear phishing emails, where a link to a malicious website or a malicious attachment is delivered using social engineering techniques.

send

is delivered

spear phishing emails

a link to a malicious website or a malicious attachment

social engineering techniques

using


Input: The second method, which is gaining traction, is watering hole attacks, where the attacker infects a website that has a high likelihood of being visited by the intended victim.

The second method

watering hole attacks

the attacker

a website that has a high likelihood of being visited by the intended victim

is

infects


Input: By using IP address filters before infecting any visitor of such sites, the attacker can reduce the number of infected systems and bring it to a manageable quantity which can be assessed manually at another time.

using

IP address filters

infecting any visitor of such sites

the attacker

before


Input: Some groups carefully plan watering hole attacks.

Some groups

watering hole attacks

plan


Input: For example the Hidden Lynx group stopped using a zero-day vulnerability in a large watering hole attack after Microsoft released details on the vulnerability.


Input: This helped to cover their activities and avoid unwanted attention.


Input: A few days later the group resumed the watering hole attack again, this time using a different exploit.

the group

the watering hole attack

a different exploit

resumed

using


Input: For more difficult targets, man-in-the-middle attacks can be used.


Input: These can be performed either at the same physical location, posing as a genuine Wi-Fi hotspot or through supply chain attacks.

posing

as

a genuine Wi-Fi hotspot


Input: This can enable the attacker to swap an update of legitimate software for a maliciously crafted version.

the attacker

an update of legitimate software

a maliciously crafted version

swap

for


Input: Once the victim installs the genuine looking update, the attacker effectively gains control over the computer.

Once

the victim installs the genuine looking update

the attacker

control over the computer

gains


Input: Due to the complexity of such an attack, they are rarely used.


Input: Depending on the skills of the attacker and the time available, the attacker might also attack systems at the perimeter, such as Web servers, and try to break in from there.


Input: The malware used is not always sophisticated.


Input: Sometimes a regular off-the-shelf back door Trojan is used.

a regular off-the-shelf back door Trojan

is used


Input: In these cases the person behind the malware orchestrating the commands is what makes the difference between a targeted attack and a broad generic infection.


Input: Having said this, on very unique targets, we will often see the use of a specifically designed piece malware, such as in the case of Stuxnet.


Input: Depending on the protection measures implemented by the target, the attackers may also digitally sign their malware creation.


Input: In the past there have been quite a few cases where code signing certificates were stolen and later misused to sign malware in order to pass it unnoticed to high value targets.


Input: Once the attacker has a foothold on one system, the next step is to create a plan for lateral movement through the network until the interesting data is found.


Input: With more specialized teams of attackers, we can often observe that the infected system is first analyzed to ensure that it is of interest to them.

the infected system

ensure that it is of interest to them

is first analyzed

to


Input: With watering hole attacks especially, it can happen that computers that were not targeted get infected.


Input: Infected computers need to be assessed by the attacker and, if necessary, removed to keep the profile, and with that the chances of exposure, low.


Input: One of the obvious tasks performed by attackers is to install key loggers, dump local credentials, search local storage for saved accounts and sniff the network for passwords.

attackers

key loggers

local credentials

local storage

saved accounts

the network

passwords

install

dump

search

sniff

for

for


Input: Any account detail can be useful to them.


Input: Domain administrator passwords are of especially high value, as they can help greatly in moving further through the Intranet.


Input: Often small scripts or even manual commands are used to comb through local files and create network mappings.

Often small scripts or even manual commands

comb through local files and create network mappings

are used

to


Input: Simple system commands can help the attacker to learn about installed security tools, saved links to internal platforms and local address books.

the attacker

installed security tools, saved links to internal platforms and local address books

learn

about


Input: Once new systems are identified the attacker will attempt to hop onto them as well.


Input: In some instances they might even use zero-day vulnerabilities to spread further into the network.

they

zero-day vulnerabilities

spread further into the network

use

to


Input: One method which is gaining more relevance is the hijacking of local software distribution systems for further distribution.

hijacking

local software distribution systems

further distribution

for


Input: This can either be proprietary systems, such as the case of Trojan.Jokra in South Korea, or OS-specific, such as hijacking Windows Update, in the case of Flamer.


Input: Once the attackers have successfully managed to create and distribute their own package, they can easily infect all connected systems at once.

they

all connected systems

once

infect

at


Input: Especially in cases of wiping attacks, such Trojan.Jokra, this is a very efficient way to disrupt as many computers as possible.


Input: If the target is assumed to be in a separated network not connected to the Internet, the malware used might try and autonomously infect removable drives, like USB sticks, or project files for PLCs.

the malware

removable drives, like USB sticks, or project files for PLCs

autonomously infect


Input: This could allow the malware to be manually introduced to the destination network, without the knowledge of the carrier, essentially jumping air gaps into isolated networks.

the malware

the destination network

air gaps

isolated networks

introduced

jumping

to

into


Input: At the end of the discovery phase the attackers should know the internals of the infected networks and have identified systems with interesting data or with connected industrial control systems.

the attackers

the internals of the infected networks

systems with interesting data or with connected industrial control systems

know

identified


Input: The capture and exfiltration phases are not always present.


Input: If the sole goal of the attackers is to cause a disruption they may directly jump to a destructive payload.


Input: However, in most cases information is extracted first, which in turn allows the sabotage to be constructed more efficiently at a later phase.


Input: In this phase the interesting data is gathered and sent back to the attackers.

the interesting data

the attackers

is gathered

sent back

to


Input: This can be done with different levels of sophistication.


Input: The simple attacks compress the files and upload them through FTP or through a HTTP POST request to a remote drop server.

The simple attacks

the files

them

FTP

a HTTP POST request to a remote drop server

compress

upload

through

through


Input: More sophisticated attackers obfuscate the data by XOR-ing it, encrypting it with proper asymmetric encryption or embedding it into media files using steganography to hide the data from traffic inspection.

More sophisticated attackers

the data

XOR-ing it, encrypting it with proper asymmetric encryption or embedding it into media files using steganography

hide the data from traffic inspection

obfuscate

by

to


Input: In addition to this, the amount of data sent and the timing can be chosen in a smart way.


Input: For example, some malware samples will send the data in smaller bursts so as not to swamp the network or generate network spikes that might attract attention.

some malware samples

the data

smaller bursts

not to swamp the network or generate network spikes that might attract attention

send

in

so as


Input: Since most employees use laptops, the malware can use location awareness to detect if the compromised computer is outside of the corporate network and send the data once it's directly connected to the Internet, such as from a Wi-Fi hotspot at an airport.

the malware

location awareness

detect if the compromised computer is outside of the corporate network

the data

it's directly connected to the Internet, such as from a Wi-Fi hotspot at an airport

use

send

to

once


Input: This might allow the traffic to bypass perimeter security and receive less scrutiny.

the traffic

perimeter security

less scrutiny

bypass

receive


Input: In some instances the infected computer might not have a direct connection to the Internet.


Input: In such cases, a previously compromised computer in the DMZ can act as a proxy, forwarding all the collected data.

a previously compromised computer in the DMZ

a proxy

all the collected data

act

forwarding

as


Input: This is when any destructive payload is launched.


Input: If the attackers are only after information this phase might not happen at all.


Input: The targets and the goals for disruption attacks can be very different, there is no such thing as one- size-fits-all for disruption attacks.


Input: For example, Stuxnet was tailored to attack a specific uranium enrichment facility and would not work against a different target.


Input: In recent times, wiper Trojans have been popular in attacks against the energy sector.


Input: The malware deletes all files on a computer and then deletes the master boot record, rendering the computer unusable.

The malware

all files on a computer

the master boot record

the computer

unusable

deletes

deletes

rendering


Input: This can happen on any operating systems and we have seen scripts for different UNIX flavors being used as well.


Input: Depending on the disaster recovery plan in place, these computers can be remotely recovered.


Input: However, there may still be an outage while the computers are being restored.


Input: By 2014, the number of Android users has grown to 1.1 billion and the number of Android devices has reached 1.9 billion.


Input: At the same time, enterprises are also embracing Android- based Bring Your Own Device (BYOD) solutions.


Input: For example, in Intel's BYOD program, there are more than 20,000 Android devices across over 800 combinations of Android versions and hardware configurations.


Input: Although little malware has been found in Google Play, both Android apps and the Android system itself contain vulnerabilities.


Input: Aggressive ad libraries also leak the user's private information.

Aggressive ad libraries

the user's private information

leak


Input: By leveraging all these vulnerabilities, an attacker can conduct more targeted attacks, which we call'' Sidewinder Targeted Attacks.

an attacker

more targeted attacks

conduct


Input: '' In this paper we explain the security risks from such attacks, in which an attacker can intercept and use private information uploaded from ad libraries to precisely locate targeted areas such as a CEO's office or specific conference rooms.

an attacker

private information uploaded from ad libraries

precisely locate targeted areas such as a CEO's office or specific conference rooms

intercept and use

to


Input: When the target is identified, a'' Sidewinder Targeted Attack'' exploits popular vulnerabilities in ad libraries, such as Javascript-binding-over-HTTP or dynamic- loading-over-HTTP, etc.


Input: It is a well-known challenge for an attacker to call Android services from injected native code that doesn't have Android application context.


Input: Here, we explain how attackers can invoke Android services for tasks including taking photos, calling phone numbers, sending SMS, reading from/ writing to the clipboard, etc.

attackers

Android services

taking photos

calling phone numbers

sending SMS

reading from/ writing to the clipboard

invoke

for


Input: Furthermore, the attackers can exploit several Android vulnerabilities to get valuable private information or to launch more advanced attacks.

the attackers

several Android vulnerabilities

get valuable private information

launch more advanced attacks

exploit

to

to


Input: Finally, we show that this threat is not only real but also prevalent due to the popularity of Android ad libraries.


Input: We hope this paper kickstarts the conversation on how to better protect the security and privacy in third-party libraries and how to further harden the Android security framework in the future.


Input: To understand the security risks brought by a Sidewinder Targeted Attack, we first explain one possible attack mechanism (illustrated in Figure 1) that is similar to that of Sidewinder missiles.


Input: The attacker can hijack the network where the targeted victim resides.

The attacker

the network where the targeted victim resides

hijack


Input: Like an infrared homing system, the attacker then seeks'' emission'' from ad libraries running on the target device to track and lock on it.


Input: Once the target is locked on, the attacker can launch advanced persistent attacks.


Input: To minimize detection chances, the attacker can choose to take action on important targets only, ignoring all other devices.

the attacker

take action on important targets only

choose

to


Input: In later sections, we discuss attacking ('' warhead'') and targeting ('' homing'') components in detail and show how a combination of these components can launch powerful and precise attacks on target devices.

a combination of these components

powerful and precise attacks

target devices

launch

on


Input: Table 1 proposes different attacks that an attacker can launch remotely on target devices through vulnerable ad libraries.

different attacks

an attacker

remotely

target devices

vulnerable ad libraries

launch

on

through


Input: Figure 2 shows a proof-of-concept attack control interface.


Input: This attack targets one of the ad libraries described in this paper.


Input: The security risks become obvious by looking at what the attacker can do with this control interface.


Input: The left panel enables the attacker to command the victim's device, including uploading local files, taking pictures, recording audio/video, manipulating the clipboard, sending SMS, dialing numbers, implanting bootkit, or installing the attacker's apps uploaded to Google Play, etc.

The left panel

the attacker

command the victim's device

local files

pictures

audio/video

the clipboard

SMS

numbers

bootkit

the attacker's apps uploaded to Google Play

enables

uploading

taking

recording

manipulating

sending

dialing

implanting

installing

to


Input: The right panel lists all information stolen from the victim's device.

all information

the victim's device

stolen

from


Input: In this screenshot, the victim's installed app list, clipboard, a photo taken from the back camera, an audio clip, and a video clip have been uploaded, with the GPS location intercepted from the ad library.

the victim's installed app list, clipboard, a photo taken from the back camera, an audio clip, and a video clip

the GPS location

the ad library

been uploaded

intercepted

from


Input: The panel also pins down the GPS location of the victim's device onto a Google Map widget.

The panel

the GPS location of the victim's device

a Google Map widget

pins

down

onto


Input: Based on this precise position information, it is easy to identify individuals or groups of'' VIP'' targets by which offices they are in.


Input: In this section, we explain in more detail the risks of remote attacks on the Android devices.


Input: Android uses the JavaScript binding method addJavascriptInterface to enable JavaScript code running inside a WebView to access the app's Java methods (also known as the Javascript bridge).


Input: However, it is widely known that this feature, if not used carefully, presents a potential security risk when running on Android API 16 (Android 4.1) or below.


Input: As noted by Google:'' Use of this method in a WebView containing untrusted content could allow an attacker to manipulate the host application in unintended ways, executing Java code with the permissions of the host application.

an attacker

the host application

unintended ways

Java code

the permissions of the host application

manipulate

executing

in

with


Input: '' In particular, if an app running on Android API 16 or below uses the JavaScript binding method addJavascriptInterface and loads the content in the WebView over HTTP, an attacker over the network could hijack the HTTP traffic (e.g., through WiFi or DNS hijacking) to inject malicious content into the WebView and to control the host application.

an attacker over the network

the HTTP traffic

WiFi or DNS hijacking

inject malicious content into the WebView

control the host application

hijack

through

to

to


Input: Listing 1 is a sample Javascript snippet to execute shell command.

a sample Javascript snippet

shell command

execute


Input: We call this the JavaScript-Binding-Over-HTTP (JBOH) vulnerability.


Input: This applies to insecure HTTPS channels as well.


Input: If an app containing such vulnerability has sensitive Android permissions such as access to the camera, a remote attacker could exploit it to perform sensitive tasks such as taking photos or recording video, over the Internet, without consent.

a remote attacker

photos

video

the Internet

consent

taking

recording

over

without


Input: Based on the official data in June 2014, ~60% of Android devices are still running API≤16.


Input: Note that API > 16 platforms are not necessarily secure.


Input: If the app is targeting at a lower API level, Android will still run it with the lower API level for compatibility reasons.


Input: Figure 3 shows the targeted API of popular Google Play apps, each of which has over 50,000 downloads.


Input: We can see that a large portion of apps are targeting at API≤16.


Input: Starting with Android 4.2 (API > 16), Google introduced the @JavascriptInterface anno- tation to explicitly designate and restrict which public Java methods in the app were accessible from JavaScript running inside a WebView.


Input: However, if an ad library uses the @JavascriptInterface annotation to expose security-sensitive interfaces, and uses HTTP to load content in the WebView, it is vulnerable to attacks where an attacker over the network could inject malicious content into the WebView to misuse the interfaces exposed through the JS binding annotation.

an attacker over the network

malicious content

the WebView

misuse the interfaces exposed through the JS binding annotation

inject

into

to


Input: We call these exposed JS binding annotation interfaces'' JS Sidedoors.


Input: '' For example, we found a list of sensitive Javascript interfaces that are publicly ex- posed from certain versions of a real-world ad library: createCalendarEvent, makeCall, postToSocial, sendMail, sendSMS, takeCameraPicture, getGalleryImage, registerMicListener, etc.


Input: Given that this ad library loads ads using HTTP, if the host app has the corresponding permissions (e.g., CALL PHONE), attackers over the network can abuse these interfaces to do malicious things (e.g., utilizing the makeCall interface to dial phone numbers without the user's consent).

attackers over the network

the makeCall interface

dial phone numbers without the user's consent

utilizing

to


Input: Similar to JBOH, DEX loading over HTTP or insecure HTTPS (DLOH) is another serious issue raised by ad libraries.


Input: If the attackers can hijack the communication channels and inject malicious DEX files, they can then control the behaviors of the victim apps.

the attackers

the communication channels

malicious DEX files

they

the behaviors of the victim apps

hijack

inject

control


Input: After getting local access, the attacker can upload private and sensitive files from the victim's device, or modify files that the host app can write to (e.g., the directory of the host app and SD Card with FAT file system).

getting

upload

modify

local access

the attacker

private and sensitive files

the victim's device

files that the host app can write to

from


Input: To launch more sophisticated attacks like sending SMS or taking pictures, the attackers may use Java reflection to call other APIs from the Javascript bridge.

sending

taking

SMS

pictures

the attackers


Input: It appears this method makes sending SMS easy.


Input: However, some other operations require Android context or registering Java callbacks.


Input: Android context provides an interface to the global information about an app's environment.


Input: Many Android functionalities, especially remote call invocations, are encapsulated in the context.


Input: We discuss attacks requiring context in a later section.


Input: In this section, we explain attacks that don't need Android context, and discuss their security risks.


Input: One direct threat posed by JBOH is to use the JBOH shell (Listing 1) to download exe- cutables and use them to root the device.

use

use

the JBOH shell

download exe- cutables

them

root the device

to

to


Input: Commercial one-touch root apps claim they can root more than 1,000 brands (> 20,000 models).


Input: towelroot, which exploits a bug found recently in Linux kernel, claims that it can root most new devices released before June 2014.


Input: Thus, as long as attackers can get the JBOH shell, they have the tools to obtain root on most Android phone models.

they

root

most Android phone models

obtain

on


Input: Even if the attackers can't obtain root, they can attempt ptrace to control the host app.

they

ptrace

control the host app

attempt

to


Input: Although only processes with root privilege can ptrace others, child processes are able to ptrace their parents.


Input: Because the shell launched from the Javascript bridge is a child process of the host app, it can ptrace the host app's process.


Input: Note that only apps with android: debuggable set as'' true'' in the manifest can be ptraced, which limits its adoption.


Input: Sending SMS does not require context or user interaction.


Input: A simple call does the job, as shown in Listing 2 To make calls from the Javascript bridge without user consent, we can invoke the telephony service to dial numbers directly via binder, as shown in Listing 3, where phone is the remote Android telephony service and the number 2 represents the second remote call.

make

invoke

calls

the Javascript bridge

user consent

we

the telephony service

dial numbers directly via binder

from

without

to


Input: s16 is the type marker represents'' 16 bit string,'' and packageName is the host app's package name, where we can obtain from the information posted from the ad libraries.


Input: The sequence number of the remote calls can be found in the corresponding Android Interface Definition Language (AIDL) files.


Input: Many other Android services can be invoked in the same way, including sending SMS As mentioned, it is more convenient to directly obtain the Android context via the Javascript bridge.


Input: Code in Listing 4, for example, is an easy way to get context from anywhere of the application.


Input: Operations like taking pictures and recording videos need to register Java callbacks.


Input: The attackers either need to boot a Java VM from the Javascript bridge, or to inject code into the host app's Java VM.


Input: Fortunately, Android Runtime offers another way to load Java Native Interface (JNI) code into the host app using Runtime.load ().


Input: As shown in Listing 5, an attacker can load executables compiled from JNI code.

an attacker

executables compiled from JNI code

load


Input: Once loaded, the code can obtain context as described in Listing 4, or call DexClassLoaderload to inject new classes from the attackers' DEX files to register callbacks to take pictures/ record videos.

the code

DexClassLoaderload

inject new classes from the attackers' DEX files to register callbacks to take pictures/ record videos

call

to


Input: There are other ways to obtain Android context, like reflecting to the private static context variable of WebView.


Input: However, without Java VM instances, it's difficult to take pictures and record videos.


Input: After our submission to Black Hat in April 2014, we noticed that MWR was also concurrently and independently working on this issue.


Input: They published a similar mechanism in June 2014.


Input: With the Android context, an attacker can monitor or tamper with the clipboard.

an attacker

the clipboard

monitor or tamper

with


Input: Android users may perform copy-paste on important text content.


Input: For example, there are many popular password-management apps in Google Play, enabling the users to click-and-copy passwords and paste them into login forms.


Input: Malicious apps can steal the passwords if they can read the contents on clipboard.

Malicious apps

the passwords

they can read the contents on clipboard

steal

if


Input: Android has no permissions restricting apps from accessing the global clipboard.


Input: Any UID has the capability to manipulate clipboard via the API calls in Listing 6: Using these APIs, the attackers can monitor changes to a clipboard and transfer the clipboard contents to some remote server.

the attackers

changes to a clipboard

the clipboard contents

some remote server

monitor

transfer

to


Input: They can also alter the clipboard content to achieve phishing goals.

They

the clipboard content

achieve phishing goals

alter

to


Input: For example, the user may copy a link to visit and the background malicious service can change that link to a phishing site.

the background malicious service

that link

a phishing site

change

to


Input: We have notified Google about this issue.


Input: Android Open Source Project (AOSP) classifies Android permissions into several protec- tion levels:'' normal,'''' dangerous,'''' system,'''' signature'' and'' development'',,.


Input: Dangerous permissions'' may be displayed to the user and require confirmation before pro- ceeding, or some other approach may be taken to avoid the user automatically allowing the use of such facilities.


Input: '' In contrast, normal permissions are automatically granted at installation,'' without asking for the user's explicit approval (though the user always has the option to review these permissions before installing)''.


Input: If an app requests both dangerous permissions and normal permissions, Android only displays the dangerous per- missions by default.


Input: If an app requests only normal permissions, Android doesn't display any permission to the user.


Input: We have found that certain'' normal'' permissions have dangerous security impacts.


Input: For example, the attackers can manipulate Android home screen icons using two normal permissions: launcher READ SETTINGS and WRITE SETTINGS permissions.

the attackers

Android home screen icons

two normal permissions: launcher READ SETTINGS and WRITE SETTINGS permissions

manipulate

using


Input: These two permissions enable an app to query, insert, delete, or modify all launcher configuration settings, including icon insertion or modification.


Input: As a proof-of-concept attack scenario, a malicious app with these two permissions can query/insert/ alter the system icon settings and modify legitimate icons of some security- sensitive apps, such as banking apps, to a phishing website.

a malicious app with these two permissions

the system icon settings

legitimate icons of some security- sensitive apps, such as banking apps

a phishing website

query/insert/ alter

modify

to


Input: After our notification, Google has patched this vulnerability in Android 4.4.3 and has released the patch to its OEM partners.


Input: However, according to Google, by 7 July 2014, 17.9% Android devices are using Android 4.4.


Input: Given that Android 4.4.2 and below has this vulnerability, over 82.1% Android devices are vulnerable.


Input: With the CHANGE WIFI STATE permission, Android processes can change the proxy settings of WIFI networks (not solely the currently connected one).


Input: To do this, the attacker can use the remote calls exposed by WifiManager to obtain the WifiConfiguration objects, then create new proxySettings to replace to a corresponding field.


Input: Note that the proxySettings field is a private Java field not intended to be accessed by other processes.


Input: Unfortunately, the flexible and powerful Java reflection mechanism (especially the forName (), getField (), setAccessible () calls) exposes such components to the attackers for arbitrary read or write operations.


Input: Android audio recording via the MediaRecorder APIs does not need user interaction or consent, which makes it easy to record sound in the background.


Input: On the contrary, taking pictures and recording videos are more challenging.


Input: First, this requires registering Java callbacks.


Input: Second, Android warns that'' Preview must be started before you can take a picture''.


Input: It seems that taking pictures and recording videos without user notification is impossible.


Input: However, security largely depends on the correct implementation and enforcing a flawless implementation is difficult.


Input: On some of the popular phones (models anonymized for security consideration), startPreview () is required to take pictures/record videos; However, it's highly possible that on these devices takePicture () fails to check whether a view has been presented to the user.


Input: Fortunately, we have never witnessed a case where the MediaRecorder can shoot videos without calling setPreviewDisplay.


Input: But we were able to create and register a dummy SurfaceView to the WindowManager, which made taking photos and videos possible even on devices that properly checked for an existing preview.


Input: With both the GET ACCOUNTS and the USE CREDENTIALS permissions, Android pro- cesses can get secret tokens of services (e.g., Google services) from the AccountManager and use them to authenticate to these services.

With

from

to

both the GET ACCOUNTS and the USE CREDENTIALS permissions

Android pro- cesses

secret tokens of services (e.g., Google services)

the AccountManager

them

authenticate to these services

get

use


Input: We verified that Android apps with these two permissions can authenticate themselves with the user's Google account, allowing access to Google Play and the ability send app installation requests.

Android apps with these two permissions

themselves

the user's Google account

authenticate

with


Input: Through the Javascript bridge, attackers can install apps of choice (e.g., an attacker's phishing app) to any devices registered in user's account in the background without user consent.

attackers

apps of choice (e.g., an attacker's phishing app)

any devices registered in user's account in the background

user consent

install

to

without


Input: Combined with the launcher modification attack introduced earlier, the attackers can redirect other app icons (e.g., bank or email app icons) to the phishing app and steal the user's login credentials.

the attackers

other app icons (e.g., bank or email app icons)

the phishing app

the user's login credentials

redirect

steal

to


Input: In this section, we explain the risks of victims' devices being tracked and targeted through ad traffic.

victims' devices

ad traffic

being tracked and targeted

through


Input: It is well known that communication via HTTP is prone to hijacking and data tamper- ing.


Input: Though ad libraries may not have the incentive to abuse users' private and sensitive data, this is not the case with the attackers eavesdropping or hijacking the HTTP traffic.

the attackers

the HTTP traffic

eavesdropping or hijacking


Input: Switching to HTTPS may not solve this issue since the HTTPS security relies on a flawless implementation, which is difficult.


Input: For example, there are cases where the developer failed (intentionally or unintentionally) to check the server's certificate.


Input: We found that some of the most popular ad libraries (see Table 3) have this issue.


Input: We successfully launched Man-in-the- Middle (MITM) attacks and intercepted the data uploaded to the remote server.

We

Man-in-the- Middle (MITM) attacks

the data uploaded to the remote server

launched

intercepted


Input: Note that even if the ad libraries have a correct and rigorous implementation, the SSL library itself may contain serious vulnerabilities that can be exploited by MITM attacks,.


Input: Almost every ad library uploads local information from Android devices.


Input: Based on our observations, they do so mostly for purposes such as checking for platform compatibility and user interest targeting.


Input: The information most frequently uploaded includes IMEI, Android version, manufacturer, Android ID, device specification, carrier information, host app information, installed app list, etc.


Input: Table 3 lists the info uploaded from the top five popular ad libraries.


Input: Listing 7 is a captured packet posted to the remote ad server by one of the ad libraries.


Input: It is captured from a popular Google Play app.


Input: From this packet we can tell the device's screen density (d-device-screen-density), screen size (d-device- screen-size), host app's pack- age name (u-appBId), host app's name (u-appDNM) 1, host app's version (u-appVer), user agent (h-user-agent), localization (d-localization), mobile network type (d-netType), screen orientation (d-orientation), and GPS location (u-latlong-accu).


Input: The most important infor- mation is the GPS location, where the victim's latitude, longitude and the location precision are shown.


Input: It is reasonable for an ad to obtain this information to improve the ad-serving experience.


Input: However, with this information, an attacker can precisely locate the victim and acquire the device's specifications.

an attacker

the victim

the device's specifications

locate

acquire