4 ms·

We reverse engineered the IOC's included in Thursday's report from the FBI that released malware data that is supposedly associated with the 'Russian' election

We reverse engineered the IOC's included in Thursday's report from the FBI that released malware data that is supposedly associated with the 'Russian' election hack. Turns out it's a hacking group in Ukraine, anyone can get it for free (but if you're nice you'll donate to their BTC account) and the DHS and FBI sample was several versions behind. https://www.wordfence.com/blog/2016/12/russia-malware-ip-hack/ https://www.wordfence.com/blog/2016/12/russia-malware-ip-hac... The trouble is that the report was released at the same time as the expulsion of 35 Russian diplomats and the whole context around it, including some of the language used in the report, implies it's proof of a Russian election hack. We also analyzed the IP's they shared and they're just a mish-mash of known attack IP's around the world - probably hacked hosts being used as an attack platform by everyone. ISP's include Linode and Digital Ocean. I'm having serious Colin Powell UN flashbacks here: IC releases questionable data as justification for military policy decisions. I've done two interviews this morning about this story and I'm told by one very well known journalist that publications both on the left and right think this whole thing stinks. Here's RS's take. www.rollingstone.com/politics/features/something-about-this-russia-story-stinks-w458439

DominoTree 10y ago
I was curious about a couple of things that weren't clear in the article. 1) Did you actually verify that the IPs provided were part of the Tor network, or did you just see that their rDNS records currently have the string "tor" in them, as you described in the article? 2) Did you identify the malware you reversed by file hash, or did you find something that hit on the provided Yara sig? I think adding these details to the article might give technical readers some more insight into and more confidence in the methods used.
- codedokode 10y ago
  The file that yara signature refers to is probably a Ukranian "web shell" (a backdoor written in PHP that contains a file manager and simple SQL client) that is distributed freely at http://profexer.name/pas/ http://profexer.name/pas/. Anyone can download it and check. There is also a forum thread at https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567 started by this software developer in 2011. He answers the questions from the users of his software and asks them to donate to continue development. So it is a publicly available software, not a private tool made by some hacker group for themselves. That is why other people could find it in their systems.
  - codedokode 10y ago
    I also checked the web archive for web shell download page [1]. It turns out that the notice with the text "Made in Ukraine" appears in version on August 31, 2015 [2] but is not present at earlier versions. The forum thread [3] shows that the software has been developed at least since 2011. I also looked through the code of a web shell. The code is written to be compatible with PHP4 and has some complicated parts, like building a zip archive by bytes. It has a lot of fallback methods, for example if some PHP functions are not available or not enabled, it would try several other ways to solve the task. I didn't like the style (a lot of two-letter variables, HTML and PHP code mixed together, hard to read and maintain). It looks like it was written by one person, but it would take some time, not a project one can write in a week. I guess the motivation for developer was to prove that he could write a better web shell than others. Here is a link to a formatted source code [4] if anyone would like to see it and maybe learn some PHP4 programming tricks. [1] https://web.archive.org/web/20150601000000*/http://profexer.name/pas/download.php https://web.archive.org/web/20150601000000*/http://profexer.... [2] https://web.archive.org/web/20150831091357/http://profexer.name/pas/download.php https://web.archive.org/web/20150831091357/http://profexer.n... [3] https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567 [4] http://pastebin.com/vUpKb3FL http://pastebin.com/vUpKb3FL
- mmaunder 10y ago
  Not sure why the post above has been downvoted to 0. Too bad. It's some of the best research we've ever done. We didn't look at the hashes or using hashing to identify anything. It's quite a story actually: The report provided a Yara sig for PHP malware. We used that to search our own attack data that we log and we found the full malware sample that matched the sig. But it was encrypted. It's a small piece of PHP that gets a key from a POST param or COOKIE and decrypts the executable code and runs it. Quite smart actually if you want to obfuscate code. So we needed the key. We looked at our attack data and thankfully we logged one of the attempts by an attacker to access the malware including their key. It was just 4 lowercase chars so we could have bruteforced it. We decrypted the malware. That gave us the name and version. We googled that and found the distro site. Claim they're a Ukrainian group and the version DHS has a Yara sig for is several versions behind. We downloaded it. It's a standard PHP 'shell' malware which means it's just a utility to manage a compromised site. File management, upload, OS info, OS command running etc. Nothing super scary and the most common malware we see. Nothing that would infect a workstation in a watering-hole attack. Regarding the IPs: No we just did a PTR lookup and assumed they're Tor exit nodes as they say they are. Mark.
  - downandout 10y ago
    > Not sure why the post above has been downvoted to 0. Too bad. It's some of the best research we've ever done. Any post on HN that implies that anyone other than Vladimir Putin himself is responsible for Clinton's defeat will get downvotes...I've lost about 15 points on various posts downplaying this narrative. The Silicon Valley crowd simply cannot tolerate any hint of an alternate narrative.
    - solarengineer 10y ago
      HN participants are now from all over the world. I'm an Indian in Singapore, for e.g.
      - topynate 10y ago
        True enough (I'm in Israel. Hi!) but despite a good measure of international interest, it's the Americans who are most likely to have a strong emotional reaction to this topic. It's their election, after all. I really dislike +/- voting on political comments for just this reason; too easy to convince oneself that a downvote is merited.
loeg 10y ago
Is that the same Rolling Stone that just lost a defamation suit for a blatantly false 2014 story[0]? I'm all for dismissing this Russia story but I don't find RS an especially credible source right now. [0]: https://www.washingtonpost.com/local/education/jury-finds-reporter-rolling-stone-responsible-for-defaming-u-va-dean-with-gang-rape-story/2016/11/04/aaf407fa-a1e8-11e6-a44d-cc2898cfab06_story.html https://www.washingtonpost.com/local/education/jury-finds-re...
snowwrestler 10y ago
> I'm having serious Colin Powell UN flashbacks here: IC releases questionable data as justification for military policy decisions. Which military policy decisions are those? What does expelling a few diplomats have to do with the military? Nothing, of course. I think this is an irresponsible comment. I think it's irresponsible to compare this to the run-up to the Iraq War when absolutely no one is talking about war. There is no ulterior motive or unfinished business between the Obama administration and Russia. As recently as 2012 Obama mocked Romney for calling Russia the U.S.'s biggest geopolitical foe. They're not, and Obama does not think that they are. And I think it's irresponsible because you are relying on incomplete data (the DHS report) to attack a conclusion that rests on a much broader base than that data. And IMO, you're doing it knowingly, in an attempt to raise your professional profile and burnish your infosec credentials. I have to say, though, linking to a Matt Taibi piece is not going to do that. He is an entertaining writer, but when it comes to cybersecurity, no one who knows what they are talking about thinks that he knows what he is talking about. I use Wordfence and appreciate it. It's a good product. But I think you're on shaky ground here. There's a saying that goes "extraordinary claims require extraordinary evidence." But the claim that Russia hacked the DNC is not extraordinary. The Russians hack, or try to hack, everyone in DC. Within the last few years, they successfully hacked both State and White House unclassified systems. I don't recall everyone jumping onto the airwaves to dispute that assessment. Why? Because the govt did not issue any public data about it. Now they have, in an attempt to help other institutions. Their thanks for improved transparency is a series of opportunistic misinterpretations, each of which hold up a limited report and declare it to be limited.
- Waterluvian 10y ago
  I think you're being myopic about the reference Mark is making. The way I read it, he's not suggesting there is a 1:1 relationship between the two, and therefore isn't trying to suggest the military has anything to do with diplomats. It's that the U.S. Government and alphabet soup organizations are providing scary but ultimately benign evidence in order to back policy decisions. We want into Iraq. How do we justify it? We want to keep Trump away from Putin, how do we justify it?
  - 10y ago
stock_toaster 10y ago
Could it be just a crap attempt at parallel construction?
- rdtsc 10y ago
  Or just plain old bullshit. I imagine someone was assigned a task to produce some document about how Russians hacked us to justify all the propaganda narrative so far. That person handed it to their subordinate, who handed to their and someone came up with that paper. It looks technical enough with jargon that someone from the street will see it as proof. Now an interesting thing to think about is if someone who wrote this understands that this is bullshit and wrote it as such. Those who know what's what will see it too and this was a wink to them. Their superiors though will think this is some solid proof.

DominoTree 10y ago

I was curious about a couple of things that weren't clear in the article. 1) Did you actually verify that the IPs provided were part of the Tor network, or did you just see that their rDNS records currently have the string "tor" in them, as you described in the article? 2) Did you identify the malware you reversed by file hash, or did you find something that hit on the provided Yara sig? I think adding these details to the article might give technical readers some more insight into and more confidence in the methods used.

codedokode 10y ago
The file that yara signature refers to is probably a Ukranian "web shell" (a backdoor written in PHP that contains a file manager and simple SQL client) that is distributed freely at http://profexer.name/pas/ http://profexer.name/pas/. Anyone can download it and check. There is also a forum thread at https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567 started by this software developer in 2011. He answers the questions from the users of his software and asks them to donate to continue development. So it is a publicly available software, not a private tool made by some hacker group for themselves. That is why other people could find it in their systems.
- codedokode 10y ago
  I also checked the web archive for web shell download page [1]. It turns out that the notice with the text "Made in Ukraine" appears in version on August 31, 2015 [2] but is not present at earlier versions. The forum thread [3] shows that the software has been developed at least since 2011. I also looked through the code of a web shell. The code is written to be compatible with PHP4 and has some complicated parts, like building a zip archive by bytes. It has a lot of fallback methods, for example if some PHP functions are not available or not enabled, it would try several other ways to solve the task. I didn't like the style (a lot of two-letter variables, HTML and PHP code mixed together, hard to read and maintain). It looks like it was written by one person, but it would take some time, not a project one can write in a week. I guess the motivation for developer was to prove that he could write a better web shell than others. Here is a link to a formatted source code [4] if anyone would like to see it and maybe learn some PHP4 programming tricks. [1] https://web.archive.org/web/20150601000000*/http://profexer.name/pas/download.php https://web.archive.org/web/20150601000000*/http://profexer.... [2] https://web.archive.org/web/20150831091357/http://profexer.name/pas/download.php https://web.archive.org/web/20150831091357/http://profexer.n... [3] https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567 [4] http://pastebin.com/vUpKb3FL http://pastebin.com/vUpKb3FL
mmaunder 10y ago
Not sure why the post above has been downvoted to 0. Too bad. It's some of the best research we've ever done. We didn't look at the hashes or using hashing to identify anything. It's quite a story actually: The report provided a Yara sig for PHP malware. We used that to search our own attack data that we log and we found the full malware sample that matched the sig. But it was encrypted. It's a small piece of PHP that gets a key from a POST param or COOKIE and decrypts the executable code and runs it. Quite smart actually if you want to obfuscate code. So we needed the key. We looked at our attack data and thankfully we logged one of the attempts by an attacker to access the malware including their key. It was just 4 lowercase chars so we could have bruteforced it. We decrypted the malware. That gave us the name and version. We googled that and found the distro site. Claim they're a Ukrainian group and the version DHS has a Yara sig for is several versions behind. We downloaded it. It's a standard PHP 'shell' malware which means it's just a utility to manage a compromised site. File management, upload, OS info, OS command running etc. Nothing super scary and the most common malware we see. Nothing that would infect a workstation in a watering-hole attack. Regarding the IPs: No we just did a PTR lookup and assumed they're Tor exit nodes as they say they are. Mark.
- downandout 10y ago
  > Not sure why the post above has been downvoted to 0. Too bad. It's some of the best research we've ever done. Any post on HN that implies that anyone other than Vladimir Putin himself is responsible for Clinton's defeat will get downvotes...I've lost about 15 points on various posts downplaying this narrative. The Silicon Valley crowd simply cannot tolerate any hint of an alternate narrative.
  - solarengineer 10y ago
    HN participants are now from all over the world. I'm an Indian in Singapore, for e.g.
    - topynate 10y ago
      True enough (I'm in Israel. Hi!) but despite a good measure of international interest, it's the Americans who are most likely to have a strong emotional reaction to this topic. It's their election, after all. I really dislike +/- voting on political comments for just this reason; too easy to convince oneself that a downvote is merited.

loeg 10y ago

Is that the same Rolling Stone that just lost a defamation suit for a blatantly false 2014 story[0]? I'm all for dismissing this Russia story but I don't find RS an especially credible source right now. [0]: https://www.washingtonpost.com/local/education/jury-finds-reporter-rolling-stone-responsible-for-defaming-u-va-dean-with-gang-rape-story/2016/11/04/aaf407fa-a1e8-11e6-a44d-cc2898cfab06_story.html https://www.washingtonpost.com/local/education/jury-finds-re...

snowwrestler 10y ago

> I'm having serious Colin Powell UN flashbacks here: IC releases questionable data as justification for military policy decisions. Which military policy decisions are those? What does expelling a few diplomats have to do with the military? Nothing, of course. I think this is an irresponsible comment. I think it's irresponsible to compare this to the run-up to the Iraq War when absolutely no one is talking about war. There is no ulterior motive or unfinished business between the Obama administration and Russia. As recently as 2012 Obama mocked Romney for calling Russia the U.S.'s biggest geopolitical foe. They're not, and Obama does not think that they are. And I think it's irresponsible because you are relying on incomplete data (the DHS report) to attack a conclusion that rests on a much broader base than that data. And IMO, you're doing it knowingly, in an attempt to raise your professional profile and burnish your infosec credentials. I have to say, though, linking to a Matt Taibi piece is not going to do that. He is an entertaining writer, but when it comes to cybersecurity, no one who knows what they are talking about thinks that he knows what he is talking about. I use Wordfence and appreciate it. It's a good product. But I think you're on shaky ground here. There's a saying that goes "extraordinary claims require extraordinary evidence." But the claim that Russia hacked the DNC is not extraordinary. The Russians hack, or try to hack, everyone in DC. Within the last few years, they successfully hacked both State and White House unclassified systems. I don't recall everyone jumping onto the airwaves to dispute that assessment. Why? Because the govt did not issue any public data about it. Now they have, in an attempt to help other institutions. Their thanks for improved transparency is a series of opportunistic misinterpretations, each of which hold up a limited report and declare it to be limited.

Waterluvian 10y ago
I think you're being myopic about the reference Mark is making. The way I read it, he's not suggesting there is a 1:1 relationship between the two, and therefore isn't trying to suggest the military has anything to do with diplomats. It's that the U.S. Government and alphabet soup organizations are providing scary but ultimately benign evidence in order to back policy decisions. We want into Iraq. How do we justify it? We want to keep Trump away from Putin, how do we justify it?
- 10y ago

stock_toaster 10y ago

Could it be just a crap attempt at parallel construction?

rdtsc 10y ago
Or just plain old bullshit. I imagine someone was assigned a task to produce some document about how Russians hacked us to justify all the propaganda narrative so far. That person handed it to their subordinate, who handed to their and someone came up with that paper. It looks technical enough with jargon that someone from the street will see it as proof. Now an interesting thing to think about is if someone who wrote this understands that this is bullshit and wrote it as such. Those who know what's what will see it too and this was a wink to them. Their superiors though will think this is some solid proof.