The past few years have seen a rapid growth of threats targeting the Russian system of RBS (Shiz, Carberp, Hodprot, RDPdoor, Sheldor). Attackers can steal huge amounts of money, estimated at tens of millions monthly. The speaker will describe the study of the most common banking malware, as well as the discovery of interesting vulnerabilities by using two-factor authentication and smart cards. The report also discusses techniques and tricks that are used by hackers to conduct anti-forensics.

1. Smartcard vulnerabilities in
modern banking malware
Aleksandr Matrosov
Eugene Rodionov

2. Agenda
 Evolution of Carberp distribution scheme
 drive by downloads
 detection statistics
 Carberp modifications
 the story of BK-LOADER
 antiRE tricks
 Banks attacking algorithms
 Smartcard attacks

3. Evolution drive by downloads: Carberp case

4. Exploit kits used in distribution scheme
 Impact since 2010 (probivaites.in)
• Java/Exploit.CVE-2010-0840
• Java/Exploit.CVE-2010-0842
• Java/TrojanDownloader.OpenConnection
 Blackhole since 2011 (lifenews-sport.org)
• JS/Exploit.JavaDepKit (CVE-2010-0886)
• Java/Exploit.CVE-2011-3544
• Java/Exploit.CVE-2012-0507
• Java/Agent
 Nuclear Pack since 2012 (nod32-matrosov-pideri.org)
• Java/Exploit.CVE-2012-0507

5. Blackhole drive by download scheme
legitimate
site
TRUE search FALSE
vuln
exploitation stage
/getJavaInfo.jar dropper execution
/content/obe.jar /w.php?f=17&e=2
/content/rino.jar

6. Blackhole drive by download scheme
legitimate
site
TRUE search FALSE
vuln
exploitation stage
/getJavaInfo.jar dropper execution
/content/obe.jar /w.php?f=17&e=2
/content/rino.jar

7. Blackhole drive by download scheme
legitimate
site
TRUE search FALSE
vuln
exploitation stage
/getJavaInfo.jar dropper execution
/content/obe.jar /w.php?f=17&e=2
/content/rino.jar

8. Blackhole drive by download scheme
legitimate
site
TRUE search FALSE
vuln
exploitation stage
/getJavaInfo.jar dropper execution
/content/obe.jar /w.php?f=17&e=2
/content/rino.jar

9. Exploit kit migration reasons
• most popular = most detected
1
• frequently leaked exploit kit
2 • most popular exploit kit for research
• auto detections by AV-crawlers
3 • non-detection period is less than two hours

10. Blackhole migration to Nuclear Pack

11. Nuclear pack drive by download scheme
legitimate
site
check real
user
TRUE search FALSE
vuln
exploitation stage dropper execution
//images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>

12. Nuclear pack drive by download scheme
legitimate
site
check real
user
TRUE search FALSE
vuln
exploitation stage dropper execution
//images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>

13. Nuclear pack drive by download scheme
legitimate
site
check real
user
TRUE search FALSE
vuln
exploitation stage dropper execution
//images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>

14. Nuclear pack drive by download scheme
legitimate
site
check real
user
TRUE search FALSE
vuln
exploitation stage dropper execution
//images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>

15. Nuclear pack drive by download scheme
legitimate
site
check real
user
TRUE search FALSE
vuln
exploitation stage dropper execution
//images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>

16. Nuclear pack drive by download scheme
legitimate
site
check real
user
TRUE search FALSE
vuln
exploitation stage dropper execution
//images/274e0118278c38ab7f4ef5f98b71d9dc.jar /server_privileges.php?<gate_id>=<exp_id>

17. BlackSEO & Nuclear Pack

18. BlackSEO & Nuclear Pack

19. Carberp detection statistics

20. Carberp detection statistics by country
Cloud data from Live Grid
Russia
Ukraine
Belarus
Kazakhstan
Turkey
United Kingdom
Spain
United States
Italy
Rest of the world

21. Carberp detections over time in Russia
Cloud data from Live Grid
0.18
0.16
0.14
0.12
0.1
0.08
0.06
0.04
0.02
0

22. Evolution of Carberp modifications

23. Different groups, different bots, different C&C’s
G***o
D*****v
Hodprot

24. functionality G***o D*****v Hodprot
Dedicated dropper   Win32/Hodprot
Java patcher   
Bootkit    based on Rovnix
RDP backconnect  Win32/RDPdoor Win32/RDPdoor
TV backconnect Win32/Sheldor Win32/Sheldor Win32/Sheldor
HTML injections IE, Firefox, Opera IE, Firefox, Opera, IE, Firefox, Opera,
Chrome Chrome
Autoloads   
Unique plugins minav.plug sbtest.plug sber.plug
passw.plug cyberplat.plug ddos.plug
killav.plug

25. commands G***o D*****v Hodprot Description
ddos    download DDoS plugin and start attack
updatehosts    modify hosts file on infected system
alert    show message box on infected system
update    download new version of Carberp
updateconfig    download new version of config file
download    download and execute PE-file
loaddll    download plugin and load into memory
bootkit    download and install bootkit
grabber    grab HTML form data and send to C&C
killos    modify boot code and delete system files
killuser    delete user Windows account
killbot    delete all files and registry keys
updatepatch    download and modify java runtime
deletepatch    delete java runtime modifications

26. The Story of BK-LOADER
from Rovnix.A to Carberp

31. Interesting Carberp sample (October 2011)

32. Interesting Carberp sample (October 2011)

33. Interesting strings inside Carberp with bootkit

34. Carberp bootkit functionality
Inject user-mode
payload
Bootkit Load unsigned
bootstrap code driver injector

35. Carberp bootkit functionality
Inject user-mode
payload
Bootkit Load unsigned
bootstrap code driver injector

36. Carberp bootkit functionality
Inject user-mode
payload
Bootkit Load unsigned
bootstrap code driver injector

37. Callgraph of bootkit installation routine

38. Rovnix kit hidden file systems comparison
functionality Rovnix.A Carberp with bootkit Rovnix.B
VBR modification   
polymorphic VBR   
Malware driver   
storage
Driver encryption custom custom custom
algorithm (ROR + XOR) (ROR + XOR) (ROR + XOR)
Hidden file system  FAT16 FAT16
modification modification
File system  RC6 RC6
encryption algorithm modification modification

39. Comparison of Carberp file system with Rovnix.B

40. Comparison of Carberp file system with Rovnix.B

41. AntiRE tricks

42. Removing AV hooks before installation

43. Calling WinAPI functions by hash

44. Plugin encryption algorithm

45. Communication protocol encryption algorithm

46. Banks attacking algorithms

47. Bank attacking algorithm Gizmo Dudorov Origami
HTML injections   
autoload 2010  2011 (Sep)
dedicated plugins for major banks   
intercepting client-banks activity   
patching java   
webmoney/cyberplat   
stealing money from private persons   

53. Smartcard attacks

54. Applications used by smartcards User Application
User interface Access provider
Smartcard resource manager
Smartcard Subsystem
Call reader device driver
Specific reader Specific reader
…
device driver device driver
Reader device … Reader device
Hardware Support
Smartcard … Smartcard

55. Win32/Spy.Ranbyus

56. Win32/Spy.Ranbyus

57. Win32/RDPdoor v4.x

58. Win32/RDPdoor v4.x

59. Win32/RDPdoor v4.x

60. Win32/RDPdoor v4.x

62. References
 Exploit Kit plays with smart redirection
http://blog.eset.com/2012/04/05/blackhole-exploit-kit-plays-with-smart-redirection
 Dr. Zeus: the Bot in the Hat
http://blog.eset.com/2010/11/05/dr-zeus-the-bot-in-the-hat
 Blackhole, CVE-2012-0507 and Carberp
http://blog.eset.com/2012/03/30/blackhole-cve-2012-0507-and-carberp
 Evolution of Win32/Carberp: going deeper
http://blog.eset.com/2011/11/21/evolution-of-win32carberp-going-deeper
 Hodprot: Hot to Bot
http://go.eset.com/us/resources/white-papers/Hodprot-Report.pdf
 Carberp Gang Evolution: CARO 2012 presentation
http://blog.eset.com/2012/05/24/carberp-gang-evolution-at-caro-2012

63. Thank you for your attention!
Aleksandr Matrosov Eugene Rodionov
matrosov@eset.sk rodionov@eset.sk
@matrosov @vxradius
amatrosov.blogspot.com