Beta exploit pack: one more piece of crimeware for the infection road!

Browser exploit packs (BEPs) or exploit kits are used extensively in drive-by download attacks to infect target systems on the Internet. BEPs are used to distribute advanced malware to end user systems after exploiting vulnerabilities in browsers’ components or embedded plug-ins. BEPs are hosted on compromised domains and victims are coerced into visiting those domains either through spear phishing or through URLs shared on social networks and so on. On visiting a compromised domain, the victim’s browser is fingerprinted and if a vulnerable component is found, the respective exploit is served and malware is downloaded onto the system. In previous papers, we have presented details of the BlackHole [1], Sweet Orange [2] and Styx [3] BEPs to highlight their design and tactics. Several of the techniques used by Beta Browser Exploit Pack (Beta BEP) are very similar to those used by these exploit packs.

Beta BEP (which is unrelated to the Beta bot) is the latest exploit kit in development. At BlackHat USA 2014 [4], we discussed several fundamental weaknesses in the command and control (C&C) panels used by various pieces of crimeware. The idea of that research was to look for potential issues in web-based C&C panels and to reveal how to find security flaws in them in order to gather intelligence. It came as no surprise that we were able to find our way into a Beta BEP C&C panel and gather some intelligence about the structure and working of the Beta exploit pack. The author of the exploit pack did revoke and take down the panel shortly after we had found our way in, but not before we had extracted some meaty details from it.

We have been studying this exploit pack and gathering data for several weeks now – publishing delays are an unavoidable part of the process of releasing intelligence. Meanwhile, we discovered that another researcher had released an analysis of a very similar exploit kit under the name of ‘Sundown EK’ [5]. In his analysis, the researcher covered details of the network traffic and how the infection is triggered. He reported certain things that are very similar to what we found in our analysis of Beta BEP, as well as some that are slightly different:

As a research community, it’s always good practice to collaborate and share intelligence so that we can tackle issues in a more granular way.

Primarily, the Beta BEP consists of the following components:

Listing 1 shows the basic structure of the Beta BEP that was configured on the C&C server.

http://<beta_cpanel.com>:8092/SDDS/private/panel.php?section=stats

http://<beta_cpanel.com>:8092/SDDS/private/panel.php?section=files

http://<beta_cpanel.com>:8092/SDDS/private/panel.php?section=domains 

http://<beta_cpanel.com>:8092/SDDS/private/panel.php

Listing 1: Beta BEP C&C structural components.

Beta BEP has a built-in functionality for determining the effectiveness of the domain that is used to deploy the exploit or executable which is served to the victim’s machine during an attack. When a vulnerability is found and an exploit successfully executed, the infected domain is queried in order to download the malicious executable. Beta BEP uses Scan4You [6], which is a freely available service that will check the robustness of a target domain (hosting exploits or malicious executables) against various anti-virus engines to verify its rate of detection. The idea is to check up front whether or not the configured exploit URL can be detected as malicious. Avoiding exposure to detection solutions is important in order for the malware to be served in a stealthy manner. If the target domain is found to be included on blacklists or flagged as malicious, a new one can easily be configured by the Beta BEP controller in order to continue the infection spreading mechanism. Figure 1 and Figure 2 show how Beta BEP scans the target URLs and domains to verify their detection rate by various security vendors.

Figure 1. Target domains are tested against the Scan4You service.

Figure 2. Beta BEP domain-scanning component.

The structure of the exploit-serving URLs is presented in Listing 2.

http://www.example.com:8092/776576YTU76876867HYTUYTUYTUYHYTUYHTFY/drgdrfydtuytygtryfgtrfgtrfg.php

http://www.example.org:8092/776576YTU76876867HYTUYTUYTUYHYTUYHTFY/drgdrfydtuytygtryfgtrfgtrfg.php

http://example.co.vu:8092/776576YTU76876867HYTUYTUYTUYHYTUYHTFY/drgdrfydtuytygtryfgtrfgtrfg.php

Listing 2: Structure of exploit-service URLs.

Part of the URL uses an encoding scheme, but we are not sure what type of encoding is used. Incorporating obfuscated strings into URLs is a technique commonly used by BEPs in order to bypass certain detection solutions. Figure 3 shows one of the configured domains being tested for maliciousness using the Scan4You service.

Figure 3. Scan4You service in action.

Beta BEP allows only one file at a time to be uploaded to the C&C, which then gets compressed and embedded in the required exploit. At this point, it seems that multiple malware files are not supported: if the malicious executable needs to be replaced, the previous executable (or binary) file must be deleted and cleaned in order to provide a clean environment for the new executable to be incorporated into the exploits. Like the exploit-serving URLs, the uploaded malware executable is scanned to check its rate of detection by anti-virus engines. Figure 4 shows the file uploading and scanning functionality of Beta BEP.

Figure 4. File uploading and scanning capability in Beta BEP.

Table 1 shows the exploits that are supported by Beta BEP as part of its design. There is the possibility for more exploits to be added and/or existing exploits removed later on. As can be seen from the CVEs, Flash exploits are preferred. This is because of the recent rise in the number of remote code execution vulnerabilities in Flash.

We know that most crimeware service providers rent out BEPs to collect money based on successful pay-per infections (PPI). However, BEPs can also be sold directly for a lump sum. We found that Beta BEP collects the following statistics:

Figure 5 shows a snapshot taken from the Beta BEP deployment.

Figure 5. Beta BEP stats panel.

As we have discussed, Beta BEP is not as active in the real market as, for example, Fiesta or Angler, but we believe that we will start to see it being used in the coming months. We were not able to collect enough data to dissect the network-level details of the BEP and understand how exactly the exploits are served, but we believe that revealing as much information as we know about Beta BEP will benefit the security research community, making researchers aware of the upcoming threat so that appropriate defences can be designed and put in place to combat it.