4 ms·

He said the Poison Ivy backdoor wasn't advanced - did the attacker create this trojan or is it something available? If it's available, why didn't the virus sca

by watty 15y ago

He said the Poison Ivy backdoor wasn't advanced - did the attacker create this trojan or is it something available? If it's available, why didn't the virus scanner catch it?

jgrahamc 15y ago
It is easily available: http://www.poisonivy-rat.com/ http://www.poisonivy-rat.com/
- probablyrobots 15y ago
  If this software is so widely available why didn't ECM's antivirus software detect it?
  - statenjason 15y ago
    This is answered in a response[1] to the grandparent post. "The reason that PI was not detected is because the attacker embedded a Flash object inside the Excel file. The Flash file was a 0day exploit that could download and execute a file, which in this case was the attacker's PI client." [1]:http://news.ycombinator.com/item?id=2928223 http://news.ycombinator.com/item?id=2928223
    - waitwhat 15y ago
      The reason that PI was not detected is because the attacker embedded a Flash object inside the Excel file. The Flash file was a 0day exploit that could download and execute a file, which in this case was the attacker's PI client. The Poison Ivy client was downloaded to the target system. Why did the anti-malware software installed there not pick it up? (Attempting to hand-wave this away by talking about 0-day flash exploits really isn't answering the question.)
      - zxw 15y ago
        It's common for the free detectable version of popular trojans to be used as the advertisement for the paid undetectable one. Looking at the poison ivy website they have a customer portal, so presumably this is how they did it. There are also methods to pay without leaving a paper trail back to you (pre-paid cards I think). Edit: It's also possible to modify detectable executables to make them undetectable if you don't want to pay. Virus scanners for the most part work by reading a few bytes from an executable at a particular point, hashing those bytes and if they match a known virus, report it as one. By finding those parts of the executable (there are often multiple signatures, and different vendors will have different signatures too) and modifying them slightly, the resultant hash will be different and the executable undetected.
- skcin7 15y ago
  So if I download (which I already did) and install this file, how can I know it's not going to inject code into my own computer?
  - chopsueyar 15y ago
    Trust no one.
    - skcin7 15y ago
      What's the best way to scan a file (Windows) then to ensure it's clean? I believe this file to be clean, I suppose I'm just asking to better understand the theory.
      - chopsueyar 15y ago
        Specifically for poisonivy, off the top of my head, I would run a virtualized instance of windows inside of a different OS, and then monitor all network activity between the virtualized OS and the host system and verify every IP it is connecting to during installation and once installed. Maybe somebody else can jump in here and offer better advice?
        oconnore 15y ago
        The virtual machine isn't guaranteed to work: http://www.zdnet.co.uk/news/security-threats/2009/06/09/virtual-machine-exploit-lets-attackers-take-over-host-39661637/ http://www.zdnet.co.uk/news/security-threats/2009/06/09/virt... Unless you know exactly what it can do, you should probably run it on an old machine without [direct] internet access.
        chopsueyar 15y ago
        From your link: Cloudburst uses a vulnerability in the virtual-machine display functions of VMware Workstation that can be exploited by a specially crafted video file. and... However, the Cloudburst exploit currently has certain limitations: it will only succeed on Workstation 6.5.0 or 6.5.1 or the associated Player versions. In addition, the guest and host must be Windows-based, among other requirements, Immunity said in its release notes.
ianhawes 15y ago
Poison Ivy is the new Sub7 (or new Back Orifice, if that's your thing). While it is actually an advanced trojan, the stub (small file it begins with) is relatively easy to detect. PI will commonly inject itself into the default browser's process. PI is a reverse connecting trojan, so an attacker must host the PI server somewhere. PI also encrypted the data back and forth using RC4. So if the attacker is really smart, they'll have PI attach to the default browser and connect to a remote server on port 443. To the average user it looks like HTTPS traffic. The reason that PI was not detected is because the attacker embedded a Flash object inside the Excel file. The Flash file was a 0day exploit that could download and execute a file, which in this case was the attacker's PI client. From there, the game is up. Once inside the network, an attacker has a whole new set of doors to open. The simplest route, if the target is on an older operating system, is to dump the SAM file, which contains both local passwords as well as cached passwords. Cached passwords are nice because they are network logins, however 9 times out of 10 the local Administrator password is the same on all systems because system administrators frequently use the same local admin password when imaging lots of computers. Additionally, cached passwords are sometimes out of date due to password update policies. Local passwords are usually not subject to this, or if they are, it becomes irrelevant since a system administrator hasn't likely gone through and changed each local password. Once you have a network password or local password, things get fun. There are 2 routes here. The attacker can go the frontend route, and attack the internal CRM that EMC has, or they can attack the development servers. Alternatively, they could just keep hacking each workstation, but that is unnecessary. Assuming we went the CRM route, we likely have or can easily obtain a valid login from our first target's computer. Once inside, unless there are solid permissions, we may have won. RSA likely had a record of each customer's purchase, which then had a record of each device and potentially some sort of key or code needed to predict the next token. I'll give RSA the benefit of being slightly smart, so those sort of keys probably won't be on the same CRM, or perhaps our login doesn't have access. Either way, we are in, and with some dissemination of materials available on other drives or within emails, the attacker could easily determine the location of the keys. Once the attacker has whatever he needs, it's a quick trip to LinkedIn to find people that work at Lockheed Martin or whatever company you fancy. Then it's another spear phishing attack on that target to a page that looks like the target companies VPN. Grab the username, password, and PIN (also log the time) and you're good to go. Now repeat the part where you enter the internal network and scour for information. Congratulations, you're now an Adaptive Persistent Threat. Pick your certificate up at the door.

by watty 15y ago

He said the Poison Ivy backdoor wasn't advanced - did the attacker create this trojan or is it something available? If it's available, why didn't the virus scanner catch it?

jgrahamc 15y ago

It is easily available: http://www.poisonivy-rat.com/ http://www.poisonivy-rat.com/

probablyrobots 15y ago
If this software is so widely available why didn't ECM's antivirus software detect it?
- statenjason 15y ago
  This is answered in a response[1] to the grandparent post. "The reason that PI was not detected is because the attacker embedded a Flash object inside the Excel file. The Flash file was a 0day exploit that could download and execute a file, which in this case was the attacker's PI client." [1]:http://news.ycombinator.com/item?id=2928223 http://news.ycombinator.com/item?id=2928223
  - waitwhat 15y ago
    The reason that PI was not detected is because the attacker embedded a Flash object inside the Excel file. The Flash file was a 0day exploit that could download and execute a file, which in this case was the attacker's PI client. The Poison Ivy client was downloaded to the target system. Why did the anti-malware software installed there not pick it up? (Attempting to hand-wave this away by talking about 0-day flash exploits really isn't answering the question.)
    - zxw 15y ago
      It's common for the free detectable version of popular trojans to be used as the advertisement for the paid undetectable one. Looking at the poison ivy website they have a customer portal, so presumably this is how they did it. There are also methods to pay without leaving a paper trail back to you (pre-paid cards I think). Edit: It's also possible to modify detectable executables to make them undetectable if you don't want to pay. Virus scanners for the most part work by reading a few bytes from an executable at a particular point, hashing those bytes and if they match a known virus, report it as one. By finding those parts of the executable (there are often multiple signatures, and different vendors will have different signatures too) and modifying them slightly, the resultant hash will be different and the executable undetected.
skcin7 15y ago
So if I download (which I already did) and install this file, how can I know it's not going to inject code into my own computer?
- chopsueyar 15y ago
  Trust no one.
  - skcin7 15y ago
    What's the best way to scan a file (Windows) then to ensure it's clean? I believe this file to be clean, I suppose I'm just asking to better understand the theory.
    - chopsueyar 15y ago
      Specifically for poisonivy, off the top of my head, I would run a virtualized instance of windows inside of a different OS, and then monitor all network activity between the virtualized OS and the host system and verify every IP it is connecting to during installation and once installed. Maybe somebody else can jump in here and offer better advice?
      - oconnore 15y ago
        The virtual machine isn't guaranteed to work: http://www.zdnet.co.uk/news/security-threats/2009/06/09/virtual-machine-exploit-lets-attackers-take-over-host-39661637/ http://www.zdnet.co.uk/news/security-threats/2009/06/09/virt... Unless you know exactly what it can do, you should probably run it on an old machine without [direct] internet access.
        chopsueyar 15y ago
        From your link: Cloudburst uses a vulnerability in the virtual-machine display functions of VMware Workstation that can be exploited by a specially crafted video file. and... However, the Cloudburst exploit currently has certain limitations: it will only succeed on Workstation 6.5.0 or 6.5.1 or the associated Player versions. In addition, the guest and host must be Windows-based, among other requirements, Immunity said in its release notes.

ianhawes 15y ago

Poison Ivy is the new Sub7 (or new Back Orifice, if that's your thing). While it is actually an advanced trojan, the stub (small file it begins with) is relatively easy to detect. PI will commonly inject itself into the default browser's process. PI is a reverse connecting trojan, so an attacker must host the PI server somewhere. PI also encrypted the data back and forth using RC4. So if the attacker is really smart, they'll have PI attach to the default browser and connect to a remote server on port 443. To the average user it looks like HTTPS traffic. The reason that PI was not detected is because the attacker embedded a Flash object inside the Excel file. The Flash file was a 0day exploit that could download and execute a file, which in this case was the attacker's PI client. From there, the game is up. Once inside the network, an attacker has a whole new set of doors to open. The simplest route, if the target is on an older operating system, is to dump the SAM file, which contains both local passwords as well as cached passwords. Cached passwords are nice because they are network logins, however 9 times out of 10 the local Administrator password is the same on all systems because system administrators frequently use the same local admin password when imaging lots of computers. Additionally, cached passwords are sometimes out of date due to password update policies. Local passwords are usually not subject to this, or if they are, it becomes irrelevant since a system administrator hasn't likely gone through and changed each local password. Once you have a network password or local password, things get fun. There are 2 routes here. The attacker can go the frontend route, and attack the internal CRM that EMC has, or they can attack the development servers. Alternatively, they could just keep hacking each workstation, but that is unnecessary. Assuming we went the CRM route, we likely have or can easily obtain a valid login from our first target's computer. Once inside, unless there are solid permissions, we may have won. RSA likely had a record of each customer's purchase, which then had a record of each device and potentially some sort of key or code needed to predict the next token. I'll give RSA the benefit of being slightly smart, so those sort of keys probably won't be on the same CRM, or perhaps our login doesn't have access. Either way, we are in, and with some dissemination of materials available on other drives or within emails, the attacker could easily determine the location of the keys. Once the attacker has whatever he needs, it's a quick trip to LinkedIn to find people that work at Lockheed Martin or whatever company you fancy. Then it's another spear phishing attack on that target to a page that looks like the target companies VPN. Grab the username, password, and PIN (also log the time) and you're good to go. Now repeat the part where you enter the internal network and scour for information. Congratulations, you're now an Adaptive Persistent Threat. Pick your certificate up at the door.