Map It. Zap It. Covid-19 and Rural America #GoodCovidDomains

This post may seem off-topic for my regular cybercrime and cyber security readers, but these are unusual times. Regular readers know that part of what my team at the UAB Computer Forensics Research Lab has been working on is looking for scams and fraud related to Covid-19 / CoronaVirus.  Part of that process has been watching for malicious or scammy emails (see "CAUCE Spamfighters Rally Aainst Corona Health Fraud Affiliate Programs") and part has been monitoring the creation of new domain names which MIGHT be used for fraud or scams ( see "Covid-19 / CoronaVirus Domains: A looming threat?") In that latter article, I encouraged people to share #GoodCovidDomains or #BadCovidDomains that they found.

Today I wanted to highlight a #GoodCovidDomain that is used by a project launched by some amazing UAB researchers.

HelpBeatCovid19.org  :: MAP IT.  ZAP IT.

The project asks people to complete a simple survey to determine if they have COVID-19 symptoms.  Then it maps their responses to help identify areas where there may be an emerging cluster of COVID-19.

Dr. Sue Feldman directs the Health Informatics program at UAB, and is a fantastic leader in her space.  She's been an R.N. for 30 years in some of the coolest and most high pressure environments in the US (I was joking with her once about how silly television shows were where doctors and nurses fly out in helicopters to accident scenes ... she said "no, that's what I used to do in Los Angeles!), and she has PhDs in both Information Technology and Education!  We've worked together on some of her creative projects, such as teaching a cyber security tabletop simulation for future health care informaticists as part of one of her classes.

Dr. Sarah Parcak is one of UAB's most famous scientists, best known as "the Space Archaeologist" for her ground-breaking work in using satellite imagery to uncover buried remnants of ancient civilizations.  After being featured on BBC specials and winning the TED Prize and publishing an award-winning science book "Archaeology from Space" I was shocked to hear her say of this Covid-19 project "Its the coolest and most important thing I've ever done!" She brings her expertise in all things geo-spatial and Geographic Information Systems to a new focus area with this project. (@IndyFromSpace)

Their colleague Mohanraj Thirumalai worked for more than a decade as the Senior Web Developer at University of Illinois Chicago before getting a PhD in Management and Information Systems and moving to Alabama to be the Director of ICT at UAB/Lakeshore Research.  He's also an Assistant Professor in the School of Health Professions.

In a state like mine, Alabama, we have a great disparity in ease-of-access to medical care and as a citizen, I am concerned about whether that may be allowing Covid-19 to spread without detection in rural parts of our state.  When I look at this map, I ask myself "does this say that rural counties have a form of natural social distancing?  Or does this say that they are entirely lacking in basic medical infrastructure and testing capability?"

Alabama Public Health on ArcGIS

I used the Alabama Department of Public Health’s data to see what testing and infection rates looked like on a county-by-county basis in Alabama. In our ten most populous counties, we have 965 cases with 5,658 people tested (as of 10PM 3APR2020).

 In our thirty smallest counties, we have 133 cases with 858 people tested. Population-wise that isn’t as bad as it sounds. The combined population of our ten largest counties is 2.6 million people, while the thirty smallest counties have 534,000 people.

But it does point to scarcity of testing. Of those thirty smallest counties, most have had less than fifty people tested IN THE WHOLE COUNTY. (Bibb = 76, very likely in the prison there! Marion = 60, and Marengo = 65.) Ten counties have had LESS THAN TWENTY PEOPLE tested in their county.

Encourage your friends to go to HELPBEATCOVID19.org and report “how they are feeling” - whether sick or healthy! ESPECIALLY if you have contacts in our more rural parts of our state.

The project actually hopes to gather data from across the SouthEast, so despite my focus on Alabama, please do encourage anyone in "the SouthEast" to share information about this project with their friends.

As more data is gathered, UAB and their partners will be able to provide a more targeted response to Covid-19 in Alabama and across the SouthEast ... looking forward to seeing what emerges as we go from 10,000 participants to 100,000, to 200,000, to a million!

County statistics as of 03APR2020

County	Population	Infected	Tested	Dead	% Infected	% tested
Jefferson	658327	356	1920		.0541%	.2916%
Mobile	413590	103	652	5	.0249%	.1576%
Madison	342762	122	588	1	.0356%	.1715%
Montgomery	229293	61	448	1	.0266%	.1954%
Shelby	200983	112	535	4	.0557%	.2662%
Tuscaloosa	198694	41	556		.0206%	.2798%
Baldwin	190675	28	430	1	.0147%	.2255%
Lee	147808	99	190	3	.067%	.1285%
Morgan	120157	24	224		.02%	.1864%
Calhoun	117253	19	115		.0162%	.0981%
Etowah	104311	21	133	2	.0201%	.1275%
Houston	103298	12	118	1	.0116%	.1142%
Marshall	94413	17	134		.018%	.1419%
Lauderdale	92682	14	271	2	.0151%	.2924%
Limestone	87384	30	348		.0343%	.3982%
St. Clair	85167	23	134		.027%	.1573%
Talladega	81666	12	154		.0147%	.1886%
Elmore	80417	19	284		.0236%	.3532%
Cullman	80409	15	112	1	.0187%	.1393%
DeKalb	70977	10	109		.0141%	.1536%
Walker	66169	48	133		.0725%	.201%
Blount	57807	9	48		.0156%	.083%
Russell	57721	4	32		.0069%	.0554%
Autauga	55265	12	102		.0217%	.1846%
Colbert	54424	5	133		.0092%	.2444%
Jackson	53048	12	90	1	.0226%	.1697%
Coffee	51276	6	54		.0117%	.1053%
Dale	50348	1	51		.002%	.1013%
Chilton	43800	15	83		.0342%	.1895%
Dallas	42692	7	44		.0164%	.1031%
Tallapoosa	41157	20	46	1	.0486%	.1118%
Escambia	38070	2	50		.0053%	.1313%
Covington	37856	4	44		.0106%	.1162%
Chambers	34074	80	82	5	.2348%	.2407%
Lawrence	33777	4	91		.0118%	.2694%
Pike	33113	10	110		.0302%	.3322%
Franklin	31685	5	95		.0158%	.2998%
Marion	30538	16	60	2	.0524%	.1965%
Barbour	27232	1	21		.0037%	.0771%
Geneva	26969				.%	.%
Cherokee	26056	5	44		.0192%	.1689%
Clarke	25220	3	44		.0119%	.1745%
Winston	24153	3	39		.0124%	.1615%
Randolph	22720	10	25	1	.044%	.11%
Bibb	22662	4	76		.0177%	.3354%
Monroe	22629	5	36		.0221%	.1591%
Marengo	20389	8	65		.0392%	.3188%
Butler	20384	1	38		.0049%	.1864%
Macon	20383	5	27		.0245%	.1325%
Pickens	19331	11	29		.0569%	.15%
Henry	17285	2	20		.0116%	.1157%
Washington	17115	5	19	1	.0292%	.111%
Fayette	17005	1	38		.0059%	.2235%
Hale	15420	3	23		.0195%	.1492%
Cleburne	14885	7	19		.047%	.1276%
Lamar	14265	1	26		.007%	.1823%
Crenshaw	13981	1	46		.0072%	.329%
Choctaw	13585	4	15		.0294%	.1104%
Clay	13458	8	34		.0594%	.2526%
Sumter	13407	7	19		.0522%	.1417%
Conecuh	13009	1	21		.0077%	.1614%
Wilcox	11406	6	20		.0526%	.1753%
Coosa	11000	6	17		.0545%	.1545%
Lowndes	10846	2	15		.0184%	.1383%
Bullock	10605	2	10		.0189%	.0943%
Perry	10194				.%	.%
Greene	8848	5	12		.0565%	.1356%
					.%	.%
TOTALS	4817528	1515	9601	32	.0314%	.1993%

IcedID New Tricks: Where Banking Trojan meets Phishing

IcedID Expanding Target List

Although ransomware has been getting all the headlines in the news, banking trojans continue to be an issue.  New variants are constantly evolving and offering new risks. At UAB, we have been looking closely at banking trojans such as Ramnit, TrickBot, IcedID and so on. Recently, Cliff Wilson, malware analyst at UAB malware lab, contributed in establishing that TrickBot is spamming. TrickBot was silent for the past week, so he was asked to take a dive in at IcedID banking trojan.

IcedID Banking Trojan

This analysis focuses on the malware sample with the hash:
3f4d7a171ab57b6c280ad4aed9ebf8f74e5228658cb4a576ada361a7d7ff5df4

This sample is identified by ESET as "Win32/Spy.Icedid.A", although many AV engines, including Ahn, Aegis, and Kaspersky, refer to it as being part of the Andromeda family.  As with most malware, most AV engines offer the meaningless identifier "Generic" such as AVG (Win32:Malware-Gen), McAfee (Generic  Trojan.i), Symantec (Trojan.Gen.2), TrendMicro (TROJ_GEN.R002C0WL517),

While testing this sample, we noticed the same behavior we have observed before: web injects and phishing pages on financial websites. During further analysis of the IcedID process and its web-injects, Cliff made an interesting observation.

The URL https[:]//financebankpay[.]com/ was found in the web-injects and contains dozens of ‘mock’ web pages and phishing pages to IcedID’s targeted sites. The pages we have observed in the past IcedID sample were present: pages for Discover, Citi, Chase, Amazon, Amex and few others. Several new pages were discovered, which we had not observed before.

FinanceBankPay.com was purchased from Chinese registrar EraNet and hosted on a Russian IP address.  The WHOIS information was bogus, borrowing the name of a man from Texas, but saying he lived in the city of "Kileen" with the state "DK", using a throw-away email from "pokemail.net" for his WHOIS email address.

When visiting a targeted URL, the webinject was loaded by the malware by pulling a page from FinanceBankPay.com from one of the following paths, and presenting it as if it were content from the true brand.

amazon
amex
cashpro  (a banking portal for Bank of America)
chase
citiBussiness
citiCard
discover
gmail
jpmorgan
ktt_key  (Key Bank) 
live        (Microsoft email services)
wellsfargo
wellsoffice


A few examples of the new emulated pages with injected code are as follows.

Gmail

https://www.financebankpay[dot]com/gmail/

Fig. 1: Login Page for Google Account

The google web-inject can be reached by trying to login through any Google service (Gmail, Hangouts, Youtube) when infected with IcedID

Outlook

https://www.financebankpay[dot]com/live/

Fig. 2: Login Page for Outlook

US based banks

https://www.financebankpay[dot]com/citiCards/

Fig 3. Stealing credit card details and PIN for a US bank

https://www.financebankpay[dot]com/wellsoffice/

Fig. 4: Business Portal Login for US Based Bank

Additional findings

This sample, along with other recently tested IcedID samples exhibited these similar behaviors.

• created the directory \onaodecan in \AppData\Local
• created “sonansoct.exe” within this directory
• soon after created a .TMP file within \AppData\Local\Temp
• opened this file as a process, then closed the main process
• this file was updated throughout the testing period
• other .TMP files were also created, but not executed (further analysis of these files is needed)
• any visited URL could be found in the memory strings of the .TMP process after visiting

Researchers will continue to provide regular and interesting updates about the different types of Banking Trojans floating in the wild. We need a consistent and combined effort from all the financial institutions to deal with such a malaise for the banking sector and end users.

Ten Years of Cybercrime & Doing Time

On October 10, 2006 while I was sitting in my office at Energen I decided to start a blog.  I had been an InfraGard member for five years at that time, and was realizing based on the feedback I was getting from other InfraGard members around the country that while many people knew about Cyber Security, very few knew about CyberCrime.  I was working on a daily basis with the FBI Cybercrime Squad in Birmingham, so I had a fairly good view on the topic, so I decided to try to share what I knew by starting this blog.  One year later I had taken things to a whole new level by quitting my job at the Oil & Gas company and moving to the University of Alabama at Birmingham to dedicate the next decade to training new cybercrime fighters!

While the blog has seen ups and downs in the regularity of the posts, even being named "Most Popular Security Blog" by SC Magazine back in 2010, overall we've averaged one post per week and have been visited by nearly 3 million readers.

As I tried to decide how to mark the 10th Anniversary of the blog, I thought one way to do it would be to share what has been our most popular stories each year.

One of the strengths of the blog has always been to document "big campaigns" that are attacking people and try to help them understand the nature of the scam so that they could avoid being a victim themselves.  The three most popular stories on the blog have all been of that nature:

1. "More ACH Spam from NACHA" (March 11, 2011) and "ACH Transaction Rejected payments lead to Zeus" (Feb 25, 2011) were both of that type.  Even years later, spikes in visitors to these stories were an indication that someone was imitating NACHA again.   In these spam campaigns, the spammers would claim to be sending email from the  "National Automated Clearing House Association" the organization that handles all electronic payments between American banks.  We later came to call these type of campaigns "Soft-Targeting" as most Americans have never heard of NACHA, but those who are involved in regularly moving money most certainly would have -- making them also the most likely to fall victim to such a spam message.  The first entry in this series, "Newest Zeus = NACHA: The Electronic Payments Association" (November 12, 2009) was also very popular.

2. Coming much later, November 7, 2014, was "Warrant for your Arrest phone scams." It was great to see the heavy traffic to that blog post and receive the emails letting me know that someone had just "proven" to them that they were about to be scammed by sending them a link to the article!

3. During 2014 one of the largest spamming botnets was the ASProx botnet.   This malware blasted out high volume spam campaigns that used a variety of social engineering ploys to make their campaigns convincing, leading to huge victimization rates.   The most popular, based on hits to the blog, was the E-Z Pass Spam.  "E-Z Pass Spam Leads to Location Aware Malware" (July 8, 2014) had tens of thousands of visitors.  A close second, also ASProx, was "Urgent Court Notice from GreenWinick Lawyers delivers malware."   ASProx had been dominate from the holiday season in 2013, when "package delivery failure" messages really hit a profound number of victims.  (See for example "Holiday Delivery Failures Deliver Kuluoz Malware" (December 26, 2013)

Rather than go through the top campaigns in order, I thought it might be more interesting to see the most popular posts for each of our ten years as a blog.

Top Cybercrime & Doing Time Blog Posts of 2016
Vovnenko / Fly / MUXACC1 pleads guilty	24JAN2016
Kelihos botnet delivering Dutch WildFire Ransomware	09JUL2016
Is the Bank of Bangladesh ready for the Global Economy?	23APR2016
Unlimited ATM Mastermind Ercan Findikoglu pleads guilty	06MAR2016

In 2016, two of our four top stories were about arrests of top cybercriminals, which is a trend that I love to say is growing and rising as we see a higher level of cooperation internationally, and a growing ability among our Law Enforcement partners. One of the highest volume spam botnets, Kelihos, is regularly in our blogs and is quite popular with the readers, indicating how often they also see the spam. The Bank of Bangladesh SWIFT theft was also a high interest story!

Top Cybercrime & Doing Time Blog Posts of 2015
Tech Support "pop-ups"	30MAR2015
Hillary"s Email Server and the New York City malware	03OCT2015
Passwords, Password Cracking, and Pass Phrases	29OCT2015
Darkode guilty pleas: Phastman, Loki, & Strife	24AUG2015

In 2015, the Darkode forum was a top story for us. Readers responded well to the Tech Support "pop-up" scams, indicating that they were also seeing it quite a bit! Hillary's email server gave us a chance to show the value of a long-term spam repository. And the story on password cracking seems to be regularly accessed from people teaching others about strong passwords.

Top Cybercrime & Doing Time Blog Posts of 2014
Warrant for Your Arrest phone scams	07NOV2014
E-ZPass Spam leads to Location Aware Malware	08JUL2014
Urgent Court Notice from GreenWinick Lawyers delivers malware	13JUL2014
GameOver Zeus now uses Encryption to bypass Perimeter Security	02FEB2014

The phone scams claiming that a warrant has been issued for your arrest have been popular on a daily basis for most of the two years since this story was first released. EZ Pass and Urgent Court Notice spoke to the popularity of the ASProx botnet. Gameover Zeus was also quite interesting as it changed the way spam-delivered malware defeated perimeter security.

Top Cybercrime & Doing Time Blog Posts of 2013
Holiday Delivery Failures lead to Kuluoz malware	26DEC2013
Vietnamese Carders arrested in MattFeuter.ru case	05JUN2013
When Parked Domains Still Infect - Internet.bs and ZeroPark	10AUG2013
New Spam Attack accounts for 62% of our spam!	10APR2013

Kuluoz, later called ASProx, had its first big Christmas in 2013. One of the first arrests of Vietnamese hackers spoke to internationally cooperation.

Top Cybercrime & Doing Time Blog Posts of 2012
Operation Open Market: The Vendors	25MAR2012
Paypal "You Just Sent a Payment" spam leads to malware	01MAY2012
DNS Changer: Countdown clock reset, but still ticking	28MAR2012
Operation Open Market: Jonathan Vergnetti	17MAR2012

In 2012, the DNS Changer malware was on everyone's minds (we later blogged about the successful prosecution of the leaders of that campaign, all now in prison in New York.) Operation Open Market was the big Forum take-down that year.

Top Cybercrime & Doing Time Blog Posts of 2011
More ACH Spam from NACHA	11MAR2011
ACH Transaction Rejected payments lead to Zeus	25FEB2011
Federal Reserve Spam	14MAR2011
The Epsilon Phishing Model	08APR2011

I've already mentioned the ACH/NACHA spam campaigns that delivered Zeus. The Epsilon Phishing model focused on hacking email delivery services and using validated accounts to deliver phishing and malware. (This is the group that Neil Schwartzman of CAUCE labeled "The Adobers" for the many times their malware claimed to be Adobe software.)

Top Cybercrime & Doing Time Blog Posts of 2010
New York FBI: 17 Wanted Zeus Criminals	30SEP2010
PakBugs Hackers arrested	12JUL2010
Lin Mun Poo: Hacker of the Federal Reserve and ...?	20NOV2010
Iranian Cyber Army returns - target: Baidu.com	12JAN2010

The Iranian Cyber Army, and a variety of international cyber criminals captured the headlines in 2010.

Top Cybercrime & Doing Time Blog Posts of 2009
Newest Zeus = NACHA: The Electronic Payments Association	12NOV2009
The FBI's Biggest Domestic Phishing Bust Ever	08OCT2009
Who is the "Iranian Cyber Army"? Twitter DNS Redirect	18DEC2009
Traveler Scams: Email Phishers Newest Scam	09FEB2009

Our 2009 "Traveler Scams" post was for years the most successful post on the blog, as many people shared the post with their friends to warn about the scam. NACHA was just becoming the leading scam-victim related to Zeus, and the FBI celebrated a huge phishing victory!

Top Cybercrime & Doing Time Blog Posts of 2008
The UAB Spam Data Mine: Looking at Malware Sites	09AUG2008
Anti-Virus Products Still Fail on Fresh Viruses	12AUG2008
ICE: Operation Predator - Solving Intertwined Child Porn cases	05NOV2008
Bank of America Demo Account - DO NOT CLICK	26NOV2008

In 2008, we were just getting seriously up to ability with the UAB Spam Data Mine, and found many interesting malware campaigns using these techniques, which eventually led to the creation of Malcovery Security, later acquired by PhishMe

Top Cybercrime & Doing Time Blog Posts of 2007
Is Your Fifth Grader Smarter Than a Laughing Cat?	15OCT2007
Google Referrer Only malware sites	13DEC2007
AffPower Indictments Scare Affiliates!	06AUG2007
TJX: From Florida to the Ukraine?	04SEP2007

In 2007, the Storm Worm was one of the top spreaders of malware. The Laughing Cat story pointed out that if you share your computer with younger family members, they may very well click on lures that any educated adult would reject. The AffPower case remains one of my favorite law enforcement actions against online pharmaceutical affiliate programs. The TJX story tracked some of the carders involved in the TJX data breach.

Top Cybercrime & Doing Time Blog Posts of 2006
Pump & Dump: SEC gives us a peek!	21DEC2006
Counterfeit Checks? Who cares!	12OCT2006
Birmingham InfraGard - October 2006	10OCT2006
FAL$E HOPE$ @ CHRI$TMA$	22DEC2006

In 2006, our inaugural year, we didn't have a lot of stories, honestly. Pump & Dump spam was interesting that year, and we blogged about some of the holiday scams we were seeing.

Unfortunately, several of the graphics in the older stories are unavailable due to changes in hosting. Hopefully we'll get those recovered eventually. Sorry for any loss of enjoyment that may cause while strolling down Cybercrime Memory Lane with me!

Looking forward to another Ten Years informing the public about Cybercrime & Doing Time!

Thanks to all of my friends and students who encouraged this blog along the way, and helped through their dedication to fighting Cybercrime and sharing in the analysis we did together. While there have been tons of great contributors in the lab, with regards to things that ended up in the blog I'd like to especially thank: Heather McCalley, Matthew Grant, Chun Wei, Brad Wardman, Brian Tanner, Tommy Stallings, Sarah Turner, Josh Larkins, Jui Sonwalker, JohnHenri Ewerth, Brendan Griffin, and Kyle Jones.

Thanks also to my inspirations in blogging, Brian Krebs, and Graham Cluley. This amateur blogger is truly grateful for what you guys do and share!

Kelihos Botnet sending geo-targeted Desjardins Phish to Canadians

As we mentioned in our blog last week (see: Kelihos botnet sending Panda Zeus to German and UK Banking Customers), the Kelihos botnet is now using "geo-targeting" based on the ccTLD portion of email addresses.  Today, those recipients whose email address ends in ".ca" are receiving a French language spam message advertising one of many Desjardins phishing websites:

<== French Desjardins Phishing Email || Google Translate ==> 

Some of the email subjects being used include:

Subject:  Renouvellement de votre compte Desjardins
Subject:  Solutions en ligne Desjardins
Subject:  Veuillez regulariser votre compte Acces
Subject:  Desjardins Reactivation
Subject:  Reactivation de votre compte AccesD

Each of these URLs is currently resolving to the IP address 5.166.183.135:

  hxxp://client.accesd.com-page-reactivation-4955-accesd-desjardins[.]com/web 
  hxxp://espace.client.accesd.com-page-reactivation-3953-accesd-desjardins[.]com/login 
  hxxp://connection.desjardins.com-page-reactivation-3953-accesd-desjardins[.]com/id 
  hxxp://membre.espace.desjardins.com-page-reactivation-1734-accesd-desjardins[.]com/page
  hxxp://membre.accesd.com-page-reactivation-5354-accesd-desjardins[.]com/enligne
  hxxp://membre.desjardins.com-page-reactivation-5354-accesd-desjardins[.]com/accesd 
  hxxp://espace.client.accesd.com-page-reactivation-1734-accesd-desjardins[.]com/login

Here is a pictorial walk-through of the phishing website:

We begin by entering a Credit Card number -- it must be a number that passes a Luhn check:

After entering a valid CC#, the next page asks the phishing victim for three security questions and their answers:

And lastly, the phisher's try to get any and all possible additional information they can!

 
Only after entering a valid password and a number that matches the mathematical rules for a Canadian Social Insurance Number does the phisher send the victim to the real Desjardins website!

Beware, Canadian friends!   And let us hope that our shared victimization increases our mutual law enforcement agencies desire to stop this botnet!