Cryptocurrency-Mining Malware: 2018’s New Menace? By Menard Osena
Will cryptocurrency-mining malware be the new ransomware? The popularity and increasing real-world significance of cryptocurrencies are also drawing cybercriminal attention — so much so that it appears to keep pace with ransomware’s infamy in the threat landscape. In fact, cryptocurrency mining was the most detected network event in devices connected to home routers in 2017.
It’s been 4 years na pala since my last blog post at TrendLabs Security Intelligence Blog, and I really feel great that I’m writing again there. I am still not decided if my other follow up insights will be for menardconnect.com or for AVSecurityProductManager.com but definitely there will be some follow up posts at #TrendLabs #Security Intel Blog and my blogs… Soon!
But for now just let me do a repost and some shoutouts and mentions 🙂
Special thanks to John, JR, Dianne, Bri, Caloy, Kerr and Gelo. You guys rock!
And some waves and hugs to my TrendLabs CoreTech XRS Ops Team 🙂 I love you all!
Our company, Trend Micro is hosting a cybersecurity event called Threat Experts Summit for students!!! It will be this Friday, November 10, 2017 1:00 PM – 5:30 PM at the Hotel Novotel, Araneta Center, Cubao, Quezon City.
IT students, this is your chance to learn cybersecurity in-depth straight from the experts! We will be discussing cool topics like Cybersecurity, Machine Learning and lots of other infosec/geeky stuff so if you’re free, come and join our event!
Interested students can register HERE
For more details visit Trend Micro Pilipinas FB page (https://www.facebook.com/TrendMicroPH)
Before I end the post, the usual disclaimer/disclosure:
I work at Trend Micro. The information contained in this post is taken from Trend Micro Pilipinas Facebook Page.
To know more on what I do full-time, kindly visit my blog’s about page or visit my Linkedin page. To read my blog’s disclosure policy visit my disclosure page.
For other infosec, malware and tech (and not so techie) stuff, please follow me in Twitter 🙂
When your father dies, people say many things to you, much of it the same thing. Sorry for your loss. Condolences. May he rest in peace. You will not remember words. You will remember kindness.
Mary Schmich, Chicago Tribune
I had a privilege of being under one of Raimund Genes teams as he led the Core Technology group in Trend Micro. He was a lively speaker, a vibrant storyteller and a true visionary.
I remember my happy moments with Raimund; when he caught me wearing a controversial shirt in the office (and his reaction was precious), when one time he complimented me on a blog article I did for the TrendLabs Security Intelligence Blog :), while attending his training on presentation skills, he asked me why I have that kinda evil smile on my face while he was presenting one slide and I awkwardly have to explain the reason why. And who would forget all his hilariously catchy costumes at our TrendLabs Christmas Parties. Fun times indeed!!!
I will greatly miss his presentations, his cute way of saying “The malware, the threats, the cybercriminals”, his unique accent, his explanations on European laws (he usually discussed it together with the US ones) and his thoughts on how it may impact my projects and modules plus a lot of other technical and geeky discussions. I will forever cherish the learning and insights from Raimund.
Words cannot express my sadness so let me share some lines from an old article I’ve read.
When your father dies, it doesn’t matter that other people’s fathers have died, that fathers have been dying since human time was born. What matters in the moment of his death is that he was your father. Your one and only. Your loss is unique, profound, yours alone.
…
When your father dies, people say many things to you, much of it the same thing. Sorry for your loss. Condolences. May he rest in peace. You will not remember words. You will remember kindness.
…
When your father dies, the small particulars of his life, the kind you barely noticed when he was alive, grow into revelations.
…
When your father dies, you will become more intrigued by the life he built from the childhood he was given.
…
When your father dies, you start to know him better. “Oh,” you think, a long time later, “now I get it.”
…
But every now and then, when the sky is a particular shade of blue, or you spot a man with a familiar build on the street, or you hear the chatter of a ballgame on the radio, you will feel a knot in your chest, and to no one in particular, you’ll say, “Dad.”
🙁
More of that touching article here courtesy of Chicago Tribune and Mary Schmich.
My thoughts are with Raimund’s family, his wife Martina, and his two sons.
And I am offering a short prayer for Raimund to end this post.
Eternal rest grant unto him, O Lord,
And let Your perpetual light shine upon him,
May he rest in peace, Amen!
but by the end of the week things are getting a little bit serious as my colleagues found some live malicious files in the wild
As part of the usual sharing of good tech info to my blog readers and friend and as part of public service of a responsible netizen, here are some cool links about this vulnerability:
Infographic from TrendLabs on the Bash Bug aka Shellshock vuln
Before I end the post, the usual disclaimer/disclosure:
I work at Trend Micro. The information contained in this post is taken from Trend Micro website and TrendLabs Security Intelligence Blog. To know more on what I do full-time kindly visit my blog’s about page or visit my linkedin page. To read my blog’s disclosure policy, kindly visit my disclosure page.
For infosec, malware and tech (and not so techie) stuff, please follow me in Twitter🙂
I recently attended an information security conference in San Francisco, CA, USA (hence some lull moments with the posting frequency for this blog late last month and early March). I was able to collect some insights and posted them in TrendLabs Security Intelligence Blog. TrendLabs posted it yesterday and so I am reposting it here at menardconnect.com:
RSA Conference 2014: The Way Forward
I attended the RSA 2014 Conference in San Francisco, which has held about two weeks ago. This year the conference offered new insights to today’s threat landscape, which will help us all plan for and protect users in 2014 and beyond.
Largest Security Conference of 2014
The attendance numbers for RSA are always impressive: this year had more than 25,000 attendees, 400+ sponsors and exhibitors, with more than 550 speakers. Such was the number of vendors that two large Exposition Halls – one each in the Moscone Center’s North and South buildings were used for vendor exhibits. The various sessions – including most of the technical track talks I attended – were in the Moscone West hall.
Earlier my colleague JM Hipolito shared her own thoughts about RSA; here is what I found most interesting there.
Opening Keynote: Finding a Path Forward in an Increasingly Conflicted Digital World
The Executive Chairman of RSA, Art Coviello, delivered the opening keynote. He gave his first public comment on the RSA and NSA controversy, as well as the need to separate the NSA’s offensive and defensive functions. But what I will remember most on his keynote is his call to governments and the security industry as a whole to adopt four guiding principles to help maintain a safer Internet for everyone:
Renounce the use of cyberweapons, and the use of the Internet for waging war
Cooperate internationally, in the investigation, apprehension and prosecution of cyber criminals
Ensure that economic activity on the Internet can proceed unfettered and that intellectual property rights are respected
Respect and ensure the privacy of all individuals
He also reiterated the need for the security industry and governments to work hand in hand to create a safer digital world that will benefit this and the generations to come. All of the guiding principles are all equally important, but I would like to highlight the first and second ones as being the most important.
The topic of cyberwar and cyberweapons is very sensitive, but I found the correlation between cyberweaponry and nuclear weapons compelling. I totally agree with Coviello’s statement that “we must have the same abhorrence to cyberwar as we do nuclear and chemical war.”
As for cooperation in prosecuting cybercrime, this is a topic where Trend Micro’s positions are well-known. We’ve frequently spoken about the need for researchers and law enforcement agencies to work together to prosecute the actual “threat actors”, as we believe that this is the most effective way to catch cybercriminals. These partnerships allow researchers and police to combine their strengths and ensure that Our efforts have netted effective results, most recently being the arrest of the creator of SpyEye.
Bitcoin Is Here: How to Become a Successful Bitcoin Thief
Uri Rivner of Biocatch and Etay Maor of Trusteer co-presented the one technical session at RSA dedicated to Bitcoins. They discussed the basics of cryptocurrency and how one can use it. They also discussed the usual use cases of Bitcoin: from creating a wallet and having your very own address, to filling the wallet with Bitcoins using an online Bitcoin exchange.
The highlight of the session for me was the a live demonstration of a hack using a SpyEye variant. In the demo, they performed a man-in-the-browser (MiTB) attack and stole the user’s Bitcoin from his wallet.
They also discussed the top cybercriminal activities that Bitcoin has been tied to. These include phishing attempts to steal Bitcoin-related website credentials, deploying RATs (Remote Access Trojans) to have direct access to desktop wallets, up to using botnets to mine Bitcoins (even though this is no longer particularly attractive).
They also explained why cybercriminals are interested in cryptocurrencies like Bitcoin. Because the cybercriminals believe that cryptocurrencies offers anonymity, they think that these will help in laundering money made from illegal activites. In addition, advanced services available in the cybecrime underground (like Bitcoin fogging services) may enable threat actors to further increase their anonymity tenfold.
In summary, the presenters said that Bitcoin is a new exciting frontier and encouraged everyone in the room to try and delve into it so that they understand its potential. They warned about the increasing phishing and malware attacks related to cryptocurrencies. They also pointed out that online Bitcoin exchanges and online wallets are low hanging fruit that may be a big opportunity for the cybercriminals. (The troubles of many online exchanges recently, including erstwhile leader Mt. Gox, have only reinforced this last point.)
The talk mirrored many of the points we have discussed. In December, we had discussed the possibility of Bitcoin’s then-record prices causing thefts of Bitcoin wallets. We had also earlier discussed how users can help secure their cryptocurrency. Overall, we share their sentiments: Bitcoin is the object of much potential, but is the subject of multiple threats as well.
Definitely I will do a follow up post/s with my other insights on RSA, the keynotes and on Bitcoin. But not yet sure if it will be for menardconnect.com or my other tech blog.
Like my previous posts on RSA, I would like to convey my thanks to Jonathan and JM for their assistance with the article.
And of course some shout-out to my RSA 2014 buddies (Jamz, Malen, JM and Ian) for their ideas and thoughts that kept me sane in RSA. Another special shout-out to other pinoy AV dudes I’ve met in SF.
Lastly some disclosure:
I work at Trend Micro. The views expressed in this blog post are mine and mine alone and do not necessarily represent my employer’s positions, strategies or opinions.
To know more about me (work and other stuff), kindly visit my about page.
To know more about my blogs full disclosure policy, kindly visit my disclosure page
It’s been a long time since I featured a game here at menardconnect.com. And since this Flappy Bird game is such a hit let me do some Flappy Bird Cheats post.
Flappy Bird is really an addicting game for most people. I am not really sure why. Maybe because its so simple and yet so difficult. The game was released last year (around May 2013) and was removed from both Apple AppStore and Google Play last week.
The first Flappy Bird Cheat I found out was this: there were lots of Flappy Bird cheaters out there. By cheaters I mean really nasty people creating and releasing fake and malicious apps and games. They are taking advantage that the author have removed it from the App Store and Google Play. Quoting my colleagues report at Trendlabs Security Intel Blog
The interesting turn of events surrounding the game Flappy Bird has had the Internet buzzing: after becoming massively popular (downloaded more than 50 million times), the developer suddenly announced that he will take down the game from app stores, and then actually did it. The decision brought the interest around the game to an even greater scale, with similar apps seen emerging in app stores, and even auctions for devices with the app installed.
The next development we saw, however, is a less desirable one: we found a bunch of fake Android Flappy Bird apps spreading online”
Its really sad to see that bad guys (read: cybercriminals) are always up-to-date on the latest buzz and trends. And they will take each opportunity to constantly make money/quick bucks on popular games (like Flappy Bird and Temple Run 2). I guess because that’s where the money is.
While sharing and tweeting that gaming/security blog post last week:
I discovered my next Flappy Bird Cheat: Twitter have its own share of Flappy Bird cheaters.
By just twitting about Flappy Bird, (match it with #hashtag #flappybird) Twitter autobots will reply to your tweet offering Flappy Bird cheats and Flappy Bird hacks.
Flappy Bird Unlimited Lives? What?
I was really lost on how Harry Potter got in the picture here 😀
Don’t worry I am always a responsible internet citizen and I reported these spammers to Twitter Spam Team.
So for those looking for Flappy Bird cheats and hacks, be careful ok? Don’t blame me if you get something bad and malicious in the internetz!!!
For me I think I will still be on the lookout for other legit tricks. Why? Because my Flappy Bird high score is still…
not that high 😀
I hope you like my Flappy Bird cheat warning post.
If you’re answer is YES to the questions above, then I’ve got great news for you…
My teammates at TrendLabs will be having a Mac Power User event on Saturday, August 17, 2013 1pm-4pm. They are looking for tech-savvy Mac owners who would like to participate in some intensive and exciting testing with our Mac OS security solution, DirectPass 2.0, a password management solution.
Image Credit: www.trendmicro.com
So what is DirectPass?
Trend Micro™ DirectPass™ is Trend Micro Password Manager solution. It manages website passwords and login IDs in one secure location, so users only need to remember one password. Other DirectPass features include: keystroke encryption, secure password generation, and a secure browser.
You think you fit that criteria for Mac Geek? then register via this surveymonkey link
All qualified participants who will attend the Power User event will get a Trend Micro gift item and Sodexo GC. If you are really lucky + uber-geeky and can find some critical bug, you might also win bigger prizes.
Registration closes on Friday August 16, 2013, 12 noon (GMT+8)
Feel free to forward this blog post to your friends (online and in-real-life), family members, relatives or classmates to share this wonderful opportunity with them. If you have Facebook/Twitter/Google+/Linkedin/etc, feel free to share/tweet/+1 this blog post too so that others can know about it.
And of course the traditional disclaimer at the end of the post:
I work at Trend Micro. This blog post is _NOT_ a paid post by Trend Micro. The information contained in this post is taken from Trend Micro Beta Team members. To know more on what I do officially full-time kindly visit my about page or visit my linkedin page. To read my blog’s disclosure policy, kindly visit my disclosure page.
As mentioned in my previous post, I recently attended a security conference in San Francisco. As a result of that trip I was able to collect some insights and posted an article for TrendLabs Security Intelligence Blog. I am reposting that article here at menardconnect.com:
RSA Conference 2013: On Security Awareness, Hacking Back and Going Offensive Legally
by Menard Osena (Solutions Product Manager)
Two weeks ago, I attended RSA 2013 Conference in San Francisco and was impressed by the number of participating security vendors. The addition of the Human Element and Breaking Research in the technical track sessions also provided a refreshing stroke to this year’s presentations.
Below are some of my experiences and insights on some noteworthy discussions involving security awareness, hacking back, and going offensive legally.
The 7 Highly Effective Habits of a Security Awareness Program
Samantha Manke and Ira Winkler of Secure Mentem discussed their views on the difference between security training and security awareness. They highlighted the importance of a security culture in companies in enabling employees to apply best computing practices on a daily basis, resulting to long-term security awareness within the organization.
They presented the results of their recent study conducted among Fortune 500 companies in the Health, Manufacturing, Food, Financial and Retail sectors. This study focuses on security awareness campaigns that companies implemented and how effective these were. They came up with key findings that lead them to create their 7 Highly Effective Habits of a Security Awareness Program, which are:
Create a Strong Foundation
(Have) Organizational Buy-in
(Encourage) Participative Learning
(Have) More Creative Endeavors
Gather Metrics
Partner with Key Departments
Be the Department of HOW
My key takeaway for this session is of course the last part. We, the information security professionals, should be the “Department of HOW” and not the “Department of NO”. We must focus on how to allow users to do what they want safely, not simply saying no to our own customers and further locking down systems.
While I understand the need to establish dos and don’ts in company security policies, we should raise the bar and let security be a key part of solving business challenges, not an obstacle to it.
On Hacking Back and Going Offensive Legally
During the conference, I attended several sessions discussing intriguing concepts like hacking back and going offensive legally. One of the sessions was Highway to the Danger Zone…Going Offensive…Legally presented by George Kurtz and Steven Chabinsky of CrowdStrike. The discussion focused on the idea of active defense as a form of offense against targeted attacks affecting companies. They clearly differentiated this concept from hacktivism and online vigilantism. However, Steven Chabinsky, being a lawyer, also expounded on its complexities like the differences of laws and legislation in different countries, making the concept difficult to define as of the moment.
Another session that covered very similar ground was Is it Whack to Hack Back a Persistent Attack?. Trend Micro’s Dave Asprey moderated this session. He was joined by Davi Ottenheimer of EMC Corporation, David Willson of Titan Info Security Group and again George Kurtz from CrowdStrike. The panelists discussed the active defense/ hacking back phenomenon and its legal, ethical and business liabilities and complexities when practiced over the Internet.
Conclusion
My personal key takeaway from these sessions is the active defense concept entails risks and complications that may spur more problems instead of solving the situation. Instead, organizations, in particular security administrators, should have the correct mindset when it comes to targeted attacks and deploying an inside-out protection.
For now, I would stick with law enforcement agencies and private sector partnership as the best (and safest) path to combat targeted attack, exemplified by the Rove Digital Takedown last year.
My special thanks to Jonathan, Gelo and Badette for their assistance with the article. Special mentions to my RSA 2013 session buddies (Benj, Cathy, Paul) their ideas and encouragement (they really kept me awake and sane during the RSA week)!!!
I miss my free six series so I will post more SF and RSA stuff here in menardconnect.com soon…
Since I have promised in my Temple Run 2 Download for iPad post that I will give updates whenever I already have Free Temple Run 2 For Android download links, I am constantly looking out for that Temple Run 2 for Android in Google Play Store.
Around 11:35 PM (GMT+8) of January 19, I found these apps in Google Play Store
Wow! got 2 hits for Temple Run 2 HD and they are using the new Temple Run 2 logo, really they have it in Android and its in HD (another wow!) am I lucky that day?
Looking closely at the first app I discovered something fishy.
Because original developers of the Temple Run is Imangi Studios and _NOT_ IMANGHI (take note of the H). 5900+ ratings. I looked further at the description of the app and its the same cut and paste description text found in the iTunes:
Description
The sequel to the smash hit phenomenon that took the world by storm!
With over 170 million downloads, Temple Run redefined mobile gaming. Now get more of the exhilarating running, jumping, turning and sliding you love in Temple Run 2!
Looking at the second suspicious Temple Run 2 HD for Android app
the descriptionIS the same text description found in iTunes. Lazy Ctrl+C – Ctrl+V
Researching further, I looked at the reviews and this KSGBLUEAPPS version already have 122 5-stars. Wow!
Reading the full description of the apps and some of the user reviews I confirmed my suspicions: users are already complaining that these apps are just a puzzle/wallpaper apps, they are _NOT_ the legit Temple Run 2 app and they come with a big twist, with lots of Ads/Advertisement links (and by the sound of the 1-star reviewers comment, loads of Ad/Advertisement-related links for your mobile phone). This is very PREDICTABLE if you will ask me, as Ad/Adverts will bring in cash (kaching-kaching) and that is where the money is 🙂
What I find really amazing is “they” ARE FAST. In less than 2 days after the legit version Temple Run 2 for iOS was released, suspicious Temple Run 2 Android apps already made it in the Google Play Store.
So I did NOT download it and I forgot about it already (Either I’m getting old or I’m a very busy guy yah know :p)
Fast forward to January 22 around 4PM (GMT+8), a teammate send me an email asking about some malicious Android app related to Temple Run 2. So I checked their concern and remembered my weekend ad-friendly apps. I also searched for them, yup the previous Temple Run 2 HD for Android apps by Imanghi and KSGBlueApps from Google Play. Alas! both apps are already _NOT_ available via Google Play. I have several (conspiracy) theories on why they were removed but I will keep them to myself. What is important now is that Trend Micro already detects the said apps as ANDROIDOS_FAKETEMPLRUN.A, a Malware Blog post is already publicly available:
and the said malicious apps are already kicked out in Google Play Store 🙂
Some questions remain:
Are the apps (I screen captured) exact copies of those apps that my teammates analyzed for the Malware Blog post: Maybe. If we will base it from company name, description and related strings, most probably its the same.
Am I sure about this? Not 100%. Sorry I do not have the exact APK file to compare it byte per byte to come up with a conclusion.
Why did Google removed them from Google Play? I don’t know. You better ask them not me :p
Do you see where these questions are leading you? (hehe conspiracy theorist = menard)
Lesson learned. Back to basic security tip: Be cautious of what you search, download and install to your mobile phone (this also applies to desktop/PCs). Be careful also with other unofficial Android Markets and websites offering free apps.
Better be safe than sorry OK?
AI: Do a blog post as an awareness campaign. Check!
Again be careful: malicious Temple Run 2 Android apps are out there in the wild.
Lastly some disclosure:
I work at Trend Micro. The views expressed in this blog post are mine and mine alone and do not necessarily represent my employer’s positions, strategies or opinions.
To know more about me (work and other stuff), kindly visit my about page.
To know more about my blogs full disclosure policy, kindly visit my disclosure page.
ScreenCapture Credits: Me and Gorehowldroid
Update: 2013.01.26
Legit Temple Run 2 For Android available now via Google Play Store:
I’m always excited when I encounter some #security meets #gaming issue. So I’m eagerly re-posting my blog article published in the TrendLabs Malware Blog entitled World of Warcraft Scams: Mist of Pandaria, Free Mounts and Phishing Galore.
World of Warcraft: Mists of Pandaria is the fourth expansion for the massively multiplayer online role-playing game (MMORPG) World of Warcraft. It was first unveiled to the public last October 2011 during the BlizzCon 2011 conference in Anaheim, California.
TrendLabs researchers started seeing increased phishing activity inside World of Warcraft after Blizzard started the closed beta testing for Mists of Pandaria last March 2012.
In these new rounds of phishing attempts, scammers are trying to abuse the WoW’s in-game mail system. In this phishing attempt, the malicious URLs are sent via in-game mail and are received by players in their in-game mailboxes.
In this phishing try, the scammer entices would-be victims to join the Mist of Pandaria beta testing and win an exclusive in-game item, the Dragon Turtle Mount, by visiting and registering in their website. The Dragon Turtle Mount was previously announced by Blizzard as the racial mount for the Pandarens, the new additional playable character race available in the Mist of Pandaria expansion.
The phishing URL in the in-game email goes to a phishing website that closely resembles the actual Battle.net website. The phishing URL tried to add some credibility by adding the string Mist of Pandaria abbreviation (MOP) to the domain name.
If unsuspecting users input their Battle.net credentials it will definitely result to Battle.net account theft. Battle.net is the central account management for all Blizzard games like World of Warcraft, Starcraft 2, and Diablo III.
In contrast to what we discussed in our previous World of Warcraft post, we observed that recent scamming attempts seem to be targeted at low level characters and not high level or level-capped (Level 85) ones. This may be part of the scam detection avoidance strategy of the bad guys, as high level characters may have more awareness to this security issue as they have spent more time in the game.
We analyzed the malicious domain further and found some great discovery: The same server also hosts other phishing sites targeting World of Warcraft players:
http://{BLOCKED}p.us-support.net
http://{BLOCKED}p.wow-support.net
http://for{BLOCKED}t-eu-wow-account-blizzard.com
http://for{BLOCKED}t-wow-us-account-blizzard.com
http://{BLOCKED}a-pandaria.net
The newly discovered malicious websites are using Mist of Pandaria, World of Warcraft, and their corresponding abbreviations in their URLs.
Trend Micro users need not worry about these threats, as they are protected from these World of Warcraft phishing attacks via the Trend Micro™ Smart Protection Network™, which blocks access to the phishing websites.
It is interesting to note that some of the phishing websites were registered just days after Blizzard announced that Mist of Pandaria will be the next World of Warcraft expansion. This clearly shows that the bad guys are up to date and are always in the lookout for events and opportunities to expand their nefarious schemes.
Blizzard on their part have stepped up their security measures. They have published a dedicated security page to help users understand their security commitment; raise awareness on different types of account thefts, highlight a gamer’s security checklist, and a step by step guide on what to do when users suspect that their account is being compromised.
Blizzard also promoted their authenticator (available as an app for iOS and Android devices, and as a keychain fob) by giving away an exclusive World of Warcraft Corehound pet to users availing the authentication services.
We also advice our readers, casual and hardcore gamers alike to view our latest Security and Gaming e-Guide to get helpful tips to help secure their online game experience.
Thanks to Paul Pajares for additional technical details.
My special thanks to Paul, JM, Tin, Gelo and Badette for their help in the article. You guys and gals rock!!!
I will give my personal insights on this article (World of Warcraft, Mist of Pandaria, Phishing and Security) here in menardconnect.com soon. Watch out for it OK?
