{"id":14695,"date":"2019-02-26T09:10:08","date_gmt":"2019-02-26T17:10:08","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2019\/02\/26\/news-8444\/"},"modified":"2019-02-26T09:10:08","modified_gmt":"2019-02-26T17:10:08","slug":"news-8444","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2019\/02\/26\/news-8444\/","title":{"rendered":"New Golang brute forcer discovered amid rise in e-commerce attacks"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 26 Feb 2019 16:00:08 +0000<\/strong><\/p>\n

E-commerce websites continue to be targeted by online criminals looking to steal personal and payment information directly from unaware shoppers. Recently, attacks have been conducted via skimmer, which is\u00a0a piece of code that is either directly injected into a hacked site or referenced externally. Its purpose is to watch for user input, in particular around online shopping carts, and send the perpetrators that data, such as credit card numbers and passwords, in clear text.<\/p>\n

Compromising e-commerce sites can be achieved in more than one way. Vulnerabilities in popular Content Management Systems (CMSes) like Magento, as well as in various plugins are commonly exploited these days. But because many website owners still use weak passwords, brute force attacks where multiple logins are attempted are still a viable option.<\/p>\n

Our investigation started following the discovery of many Magento websites that were newly infected. We\u00a0pivoted on the domain name used by the skimmer and found a connection to a new piece of malware that turned out to be a brute forcer for Magento, phpMyAdmin, and cPanel. While we can’t ascertain for sure whether this is how the skimmer was injected, we believe this may be one of many campaigns currently going after e-commerce sites.<\/p>\n

Compromised website<\/h3>\n

The malicious code was found injected directly into the site’s homepage, referencing an external piece of JavaScript. This means that the shopping site had been compromised either via a vulnerability or by brute forcing the administrator password.<\/p>\n

\"\"<\/a><\/p>\n

The online store is running the Magento CMS and using the OneStepCheckout<\/a> library to process customers’ shopping carts.\u00a0As the victim enters their address and payment details, their data is\u00a0exfiltrated via a POST request with the information in Base64 format to googletagmanager[.]eu<\/em>. This domain has been flagged before as part of criminal activities related to the Magecart<\/a> threat groups.<\/p>\n

\"\"<\/a><\/p>\n

Using VirusTotal Graph<\/a>, we found a connection between this e-commerce site and a piece of malware written in Golang, more specifically a network query from the piece of malware to the compromised website. Expanding on it, we saw that the malware was dropped by yet another binary written in Delphi. Perhaps more interestingly, this opened up another large set of domains with which the malware communicates.<\/p>\n

\"\"<\/a><\/p>\n

Payload analysis<\/h3>\n

Delphi downloader<\/h4>\n

The first part is a downloader we detect as Trojan.WallyShack<\/em><\/strong> that has two layers of packing. The first layer is UPX. After unpacking it with the default UPX, we get the second layer: an underground packer using process hollowing.<\/p>\n

The downloader is pretty simple. First, it collects some basic information about the system, and then it beacons to the C2. We can see that the domain names for the panels are hardcoded in the binary:<\/p>\n

\"\"<\/a><\/p>\n

The main goal of this element is to download and run a payload file:<\/p>\n

\"\"<\/a><\/p>\n

Golang payload<\/h4>\n

Here the dropped payload installs itself in the Startup folder, by first dumping a bash script in %TEMP%, which is then deployed under the Startup folder. The sample is not packed, and looking inside, we can find artifacts indicating that it was written in Golang version 1.9. We detect this file as Trojan.StealthWorker.GO<\/em><\/strong>.<\/p>\n

\"\"<\/a><\/p>\n

The procedure of reversing will be similar to what we have done before with another Golang sample<\/a>. Looking at the functions with prefix “main_”,\u00a0 we can distinguish the functions that were part of the analyzed binary, rather than part of statically-linked libraries.<\/p>\n

\"\"<\/a><\/p>\n

We found several functions with the name “Brut,” suggesting this piece of malware is dedicated to brute forcing.<\/p>\n

\"\"<\/a><\/p>\n

This is the malware sample that communicated with the aforementioned compromised e-commerce site. In the following section, we will review how communication and tasks are implemented.<\/p>\n

Bot communication and brute forcing<\/h3>\n

Upon execution, the Golang binary will connect to 5.45.69[.]149.\u00a0Checking that IP address, we can indeed see a web panel:<\/p>\n

\"\"<\/a><\/p>\n

The bot proceeds to report the infected computer is ready for a new task via a series of HTTP requests announcing itself and then receiving instructions. You can see below how the bot will attempt to brute force Magento sites leveraging the \/downloader\/directory<\/a>\u00a0point of entry:<\/p>\n

\"\"<\/a><\/p>\n

Brute force attacks can be quite slow given the number of possible password combinations. For this reason, criminals usually leverage CMS or plugin vulnerabilities instead, as they provide a much faster return on investment. Having said that, using a botnet to perform login attempts allows threat actors to distribute the load onto a large number of workers. Given that many people are still using weak passwords for authentication, brute forcing can still be an effective method to compromise websites.<\/p>\n

Attack timeframe and other connections<\/h3>\n

We found many different variants of that Golang sample, the majority of them first seen in VirusTotal in early February (hashes available in the IOCs section below).<\/p>\n

\"\"<\/a><\/p>\n

Checking on some of these other samples, we noticed that there’s more than just Magento brute forcing. Indeed, some bots are instead going after WordPress sites, for example. Whenever the bot checks back with the server, it will receive a new set of domains and passwords.\u00a0Here’s an example of brute forcing phpMyAdmin<\/a>:<\/p>\n

\"\"<\/a><\/p>\n

POST:  set_session=&pma_username=Root&pma_password=Administ..&server=1&target=  index.php&token=    User-Agent:  Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko\/20100101 Firefox\/62.0<\/pre>\n
As we were investigating this campaign, we saw a tweet<\/a> by Willem de Groot noting a recent increase in skimmers related to googletagmanager[.]eu<\/em>,\u00a0tied to Adminer<\/a>, a database management utility. The shopping site on which we started our research was compromised only a few days ago. Without server logs and the ability to perform a forensic investigation, we can only assume it was hacked in one of many possible scenarios, including the Adminer\/MySQL flaw or brute forcing the password.<\/p>\n
Multiple weaknesses<\/h3>\n
There are many different weaknesses in this ecosystem that can be exploited. From website owners not being diligent with security updates or their passwords, to end users running infected computers turned into bots and unknowingly helping to hack web portals.<\/p>\n
As always, it is important to keep web server software up-to-date and augment this protection by using a web application firewall to fend off new attacks. There are different methods to thwart brute force attacks, including the use of the .htaccess<\/em> file to restrict which IP address<\/a> is allowed to log in.<\/p>\n
Skimmers are a real problem for online shoppers who are becoming more and more wary of entering their personal information into e-commerce websites. While victims may not know where and when theft happened, it does not bode well for online merchants when their platform has been compromised.<\/p>\n
Malwarebytes detects the malware used in these attacks and blocks the skimmer gate.<\/p>\n
With additional contributions from @hasherezade<\/a>.<\/em><\/p>\n
Indicators of Compromise (IOCs)<\/h3>\n
Skimmer domain<\/p>\n
googletagmanager[.]eu<\/pre>\n
Delphi downloader<\/p>\n
cbe74b47bd7ea953268b5df3378d11926bf97ba72d326d3ce9e0d78f3e0dc786<\/pre>\n
Delphi C2<\/p>\n
snaphyteplieldup[.]xyz  tolmets[.]info  serversoftwarebase[.]com<\/pre>\n
Golang bruteforcer<\/p>\n
fdc3e15d2bc80b092f69f89329ff34b7b828be976e5cbe41e3c5720f7896c140<\/pre>\n
Similar Golang bruteforcers<\/p>\n
46fd1e8d08d06cdb9d91e2fe19a1173821dffa051315626162e9d4b38223bd4a  05073af551fd4064cced8a8b13a4491125b3cd1f08defe3d3970b8211c46e6b2  fdc3e15d2bc80b092f69f89329ff34b7b828be976e5cbe41e3c5720f7896c140  96a5b2a8fdc28b560f92937720ad0dcc5c30c705e4ce88e3f82c2a5d3ad085aa  81bd819f0feead6f7c76da3554c7669fbc294f5654a8870969eadc9700497b82  5e7581e3c8e913fe22d56a3b4b168fd5a9f3f8d9e0d2f8934f68e31a23feabd5  d87b4979c26939f0750991d331896a3a043ecd340940feb5ac6ec5a29ec7b797  36d62acd7aba4923ed71bfd4d2971f9d0f54e9445692b639175c23ff7588f0a7  7db29216bcb30307641b607577ded4a6ede08626c4fa4c29379bc36965061f62  4e18c0b316279a0a9c4d27ba785f29f4798b9bbebb43ea14ec0753574f40a54f  91a696d1a0ef2819b2ebb7664e79fa9a8e3d877bedcb5e99f05b1dc898625ed5  8b1b2dee404f274e90bd87ff6983d2162abee16c4d9868a10b802bd9bcbdbec6  046c5b18ec037ec5fbdd9be3e6ee433df3e4d2987ee59702b52d40e7f278154d  6b79345a2016b2822fd7f7bed51025b848b37e026d4638af59547e67078c913e  181ebf89a32a37752e0fc96e6020aa7af6dbb00ddb7ba02133e3804ac4d33f43  5efd1a27717d3e41281c08f8c048523e43b95300fb6023d34cb757e020f2ff7f  5dccce9b5611781c0edee4fae015119b49ce9eb99ee779e161ec0e75c1c383da<\/pre>\n
C2 server<\/p>\n
5.45.69[.]149:7000<\/pre>\n
The post New Golang brute forcer discovered amid rise in e-commerce attacks<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n
https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 26 Feb 2019 16:00:08 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
E-commerce sites are a hot commodity these days. We dig into how compromised PCs are helping to hack into them to inject skimmers, whether via vulnerabilities in the websites themselves or through a new malware we discovered gaining entry via brute force.<\/p>\n
Categories: <\/p>\n