Europol Announces 27 ATM Black Box arrests

On 18MAY2017 Europol announced that 27 thieves have been arrested across Europe for participating in a ring that conducts ATM Black Box attacks.  The arrests were conducted in France (11), Estonia (4), Czech Republic (3), Norway (3), the Netherlands (2), Romania (2), and Spain (2) over the course of 2016 and 2017.  Much of the data about how the attacks are conducted is being shared between member countries and the institutions within those countries by a little-known group called E.A.S.T. and their Expert Group on ATM Fraud (EGAF).  When EAST holds their Financial Crime & Security Forum next month members will want to also attend the Expert Group on ATM Physical Attacks (EGAP).

What is an ATM Black Box attack?

In an ATM Black Box attack, criminals have identified access points in the physical architecture of the ATM that would grant them access to cables or ports allowing them to attach a laptop to the internal computer of the ATM.  Once attached, the laptop can issue commands to the ATM resulting in the ultimate payout, a full distribution of all of the cash in the machine!   

The technique of causing an ATM machine to dump all of its cash is called "Jackpotting."  Most of us first heard about jackpotting as a result of the Barnaby Jack presentation at BlackHat 2010 and repeated on two models of ATMs for DEF CON 18 (video link below):

Barnaby Jack at DEF CON 18

Last September, Kaspersky demonstrated an ATM Black Box, however in their proof of concept approach, the criminals physically open the computer using a maintenance workers key, and flip a physical switch in the ATM to cause it to enter Supervisor mode.   The Black Box is connected to the ATM through a simple USB port that was at that time available in most ATM machines.

Black box demo video from Kaspersky

The new Europol arrest report shows that the current evolution on ATM Black Box attacks is to physically cut in to the ATM with drills, saws, or acetylene torches, and gain physical access to cables to which the laptop or black box will be attached.  In the current round of Black Box attacks, the target is not the ATM Computer, but rather the cables that connect the ATM computer to the Banknote Dispenser.  By directly connecting to the Dispenser, the connected laptop's malware simply issues commands to the Dispenser that normally would come from the ATM Computer and gives the order to dispense bills.

Image from Europol

Image from Europol

Information shared in the EAST working groups has produced some uncharacteristic good news in this space!  Although the number of ATM Black Box attacks went up considerably, with 15 attacks in 2015 and 58 attacks in 2016, many of these attacks were unsuccessful.  In their 11APR2017 report, EAST explained:

[In 2016] a total of 58 such attacks were reported by ten countries, up from 15 attacks during 2015.  ‘Black Box’ is the connection of an unauthorised device which sends dispense commands directly to the ATM cash dispenser in order to ‘cash-out’ the ATM.  Related losses were down 39%, from €0.74 million to €0.45 million.

 and illustrated this information with the following chart:

from EAST Report on ATM Fraud

The mitigation guidelines issued by EAST should be significantly updated at the upcoming meeting with guidance on Logical Attacks, Black Box Attacks, and Explosive Attacks, as well as Regional ATM Crime trend reports from Europol, Russia, the US Secret Service, Latin America,and ASEANAPOL.

Other ATM Attacks Still Dominate 

While ATM Black Box attacks are interesting, as the chart above shows they aren't where most of the money is being stolen.  Traditional skimming and white-carding is still stealing over 300 Million Euros per year, while physical attacks of other sorts are claimed nearly 50 Million Euros in 2016 alone!

One other trend that is sweeping Europe is the technique of pumping an ATM full of an explosive gas to blow the front off the machine giving the criminals access to the full contents of the dispenser.   The Italian police shared this interesting video of the technique:

Italian police shared this video from Feb 2013

This technique was recently used by two British men to blow up at least thirteen ATMs along the Costa del Sol in Southern Spain.  In the first half of 2016, 492 ATM Explosive attacks occurred across Europe, yielding the criminals an average of $18,300 per attack!  For the full year-over-year comparison, in 2015 there were 673 ATM Explosive attacks in Europe, and in 2016 there were 988 such attacks.  This accounts for roughly 1/3rd of the Physical attacks on ATMs in the EAST reporting.

Skimming dominates arrests to date

While we aren't sure exactly which attacks are included in the statistics above, several major ATM attacking gangs have been previously arrested and disclosed. While jackpotting arrests are rare, there must be a hundred reports of arrests for implanting skimming devices and creating counterfeit ATM cards based on the results.

One rare Jackpotting arrest was in January 2016 when a Romanian ATM attack gang was arrested for attacks in Germany, France, Norway, Sweden, Poland, and Romania.  In that case, the Tyupkin trojan, targeting a particular model of NCR ATMs, was inserted by gaining physical access to the ATM and booting a malicious CD in the ATM computer.  (See www.zdnet.com/article/atm-malware-gang-behind-euro-attacks-targeted-in-police-swoops/ ).

In April 2016, the Italian police arrested 16 Romanians for running a large ATM skimming ring who stole at least €1.2 million. 

In May 2016, the French Gendarmerie of Pau, in cooperation with the Italian State Police and Europol, arrested nine for running an ATM Skimming Ring that stole more than 500,000 Euros.

In March 2017, a group of five Romanians were arrested for skimming in York County, Pennsylvania as well.

Kelihos infection spreading by Thumb Drive and continues geo-targeting

I've mentioned before how proud I am that my students are extremely passionate about CyberCrime. My guest blogger 'Arsh Arora' is on a visit to his hometown New Delhi, India to attend a wedding. Instead of having fun, he is monitoring Kelihos botnet from a different geographical location than US to determine if the behavior is any different. Seems fairly consistent, but Arsh explains more in this next edition of his Kelihos guest-blogging:

Kelihos botnet geo-targeting Canada and Kazakhstan 

After laying low for a while, the Kelihos botnet is back to its business of providing 'spam as a service'. The Kelihos botnet continues "geo-targeting" based on the ccTLD portion of email addresses. Today, those recipients whose email address ends in ".ca" are receiving links to web pages of Tangerine Bank Phish websites. While recipients whose email address ends in ".kz" are receiving a link to the Ecstasy website.

Tangerine Bank Phish geo-targeted to Canadians

The spam body consists of a webpage that will be displayed as a webpage, seeking the user to click a button with the subject line of "TANGERINE online account has been suspended". Tangerine is internet/telephone base bank formerly known as ING Direct (Tangerine).

Fig. 1 Raw Text of  Spam message

The html version is displayed to the victim receiving the email. Thus, instigating the victim to click on the "Learn More" Button (link is "hxxp://tangeerine[dot]com/InitialTangerine/index.php"). Once clicked the victim is redirected to a phishing site, seeking the user to enter  "Enter your Client Number, Card Number or Username".

Fig. 2 Html version of the Phish

Fig. 3 Redirected link seeking user to enter details

Second version of the similar-themed message was with the subject line of "Your account is disabled. Please verify your information is correct" and the corresponding redirect link once you hit the start button was "hxxp://sec-tangrene[dot]online/". 

Fig. 4 Raw Text of second spam message

Fig. 5 Html version of Tangerine Phish

Unfortunately, the following link was down and not accessible.

Canadian Banks take great pride in their infrastructure and preventive measures. This gives the attackers an extra challenge of trying to penetrate inside these banks. Therefore, targeting them like in previous instances, one such case of Desjardins phish. 

Fcuk Spam geo-targeted to Kazakhstan 

This behavior is never observed before as Kelihos botnet was geo-targeting email addresses ending with ".kz". The spam message contained a link (www[dot]almatinki[dot]com) to a Fcuk website with the subject line in Russian "Глубокий м" when translated it is stated as"Deep m". Attached are the screenshot of email message and website.

Fig. 6 Email message of the spam

Fig. 7 Website

Kelihos spreading via executables copied to flash drives

There is a saying that when an Academic has an accident we call it "research!"  After completing a successful infection of Kelihos, a thumb drive was accidentally connected to the virtual machine instead of the host machine. Upon inspection, the thumb drive appeared to have acquired a new hidden executable name “porn.exe”, as well as a few shortcuts that were not there before. On further analysis of the file "porn.exe", it revealed that it was a copy of the original Kelihos binary. 

Fig. 8 VT analysis of porn.exe

By repeating the process with ProcMon running, we found the Create File function linked to the E:\porn.exe. In the moments leading up to this, several other file names are tried with CreateFile, in an attempt to open them. It appears that if none of these files are opened, then it defaults to creating a porn.exe file, and then writing the binary to this file. After binary creation, the shortcuts for the hidden directories, and executables are created.

Fig. 9 Create File of porn.exe

Fig. 10 Various instances of trying to Create File

An Autorun.inf is not created to run this file, however, a shortcut to the file with the command C:\WINDOWS\system32\cmd.exe F/c "start %cd%\porn.exe" can be found on the drive, as well as shortcut to several other hidden directories on the drive (not malicious).

Fig. 11 Executable and shortcut placed on thumb drive

Running porn.exe works like a normal Kelihos run, however, we were unable to infect a thumb drive with this binary. Further analysis is required to determine the mechanism by which thumb drive infection occurs, as this executable appears to be identical to the original binary.

Thanks a lot Eli Brown for sharing great insights on the infection behavior of Kelihos. 

We continue our research on the Kelihos botnet and try to provide as much insights about the botnet.

"Microsoft notification" leads to Pharma Redirector on Steroids

Today while investigating spam in the PhishMe spam collection, I started looking at a spam campaign that used two distinct subject lines:

Subject: Microsoft notification
Subject: Windows notification

The body of the email looked like this:

NOT Your Friend!

In true botnet style, every single email had a different "friend name."  The three links at the bottom, all go to "real" Microsoft locations, but the "View invitation" button is the place we need to be concerned about today.  While this delivery mechanism certainly COULD be used to deliver malware, right now, all we knew was that it was certainly not from Microsoft and was potentially dangerous.  With at least 310 different sending IP addresses sending us the spam, it seemed a deeper investigation was called for.

Since the spam did not have an attachment, the method to determine whether the URL may be malicious is normally to fetch the URL, but first we ran some statistics.  In this case of the 410 "Microsoft" and the 377 "Windows" versions of the spam there were 773 different redirection destinations, each a hacked website where the criminals placed a small .php program.

Here are just a few examples of the many hundred redirection URLs:

• lsa48.ru / populace.php
• longevidadeativa1.hospedagemdesites.ws / valences.php
• regionp.primor.biz / trowels.php
• vesinhxanh.net / wp-content / gillian.php
• nord-okna.pl / timeout.php
• serax.es / bustles.php
• nethraprophoto.com / i/wp-content/plugins / contour.php
• hassanstudio.com / muttons.php

Each PHP file is a program that will cause the visitor to be automagically redirected to an additional website! To determine what directions will occur, and what we might encounter at the ultimate "landing site" we visit the redirection pages to see where it sends our web browser.
Here's a sample redirection script from pro-kisti.ru / irving.php, which caused us to visit an illicit pharmaceutical sales website:


(meta name="keywords" content="crowds, nothing, mountains, fulfilld")
(title) ice32044 Pain. Era - ran earth heaven. Nigh spotted relief, found.(/title)

function palee() { palea=61; paleb=[180,166,171,161,172,180,107,177,172,173,107,169,172,160,158,177,166,172,171,107,165,
175,162,163,122,100,165,177,177,173,119,108,108,173,175,166,179,158,177,162,173,166,
169,169,179,158,169,178,162,107,175,178,100,120]; palec=""; for(paled=0;paled lessthan paleb.length; paled++) (palec+=String.fromCharCode(paleb[paled]-palea); return palec;
++++++++++++++++++
This code will subtract the number 61 from each value in the row of integers that begins with 180,166, and will then concatenate each character to the previous and convert it to a string.  Then it will wait 1.295 seconds, and forward the visitor to the website by using the document property "window.top.location.href".

We'll decode a bit of this one by hand:
180 - 61 =  119 which is 77 hex which is an ASCII "w"
166 - 61 = 105 which is 69 hex which is an ASCII "i"
171 - 61 = 110 which is 6E hex which is an ASCII "n"

Rather than do this by hand, I told Excel to separate values by the "," into columns and made a simple spreadsheet.  Update the "Shifter" value (in this case the "palea=61") and then paste the comma separated list into the "Values" portion of the spreadsheet.

the "pro-kisti.ru" redirector (Click for full-size)

Row one is the original values
Row two contains the same values, decremented by "Shifter"
Row three contains the same values, displayed in Hex
Row four contains the decoded to English values, in this case reading:

"windows.top.location.href = http : // privatepillvalue dot ru" (altered for safety)

The next URL we tried, zacpower dot com slash destined.php, had used  "unripea=78" for the Shifter value.  We cut and pasted the comma separated values in and see that it redirects to "healingdrugdeal dot ru".

the "zacpower.com" redirector (click for full-size)

The question though, was how many different sites did these 770 redirectors send us to? and were they all illicit pharmaceutical websites? or was it possible that some would redirect us to malware?  The only solution seemed to be to fetch and decode all of them!

A simple wget script took care of the fetching, and we soon had 559 unique .txt files, each containing the redirection program from one of the "still live" redirection sites. (As soon as a webmaster finds such a program, they hopefully delete it!  We were glad to see more than 100 of the websites, mostly ones from over the weekend, were not available any longer!)

Now for a small shell script to yank out the Shifter value and the comma separated integers for each.  There are certainly better shell scripters than me, but here was my quick-and-dirty script:

cat filelist |while read a; do printf '\n'; printf $a;printf ' Shifter:  '; grep -o '=[0-9][0-9]' $a|tr -d '\n'; printf ' values: '; grep -o '[0-9]*,[ ]*[1-9][0-9]*' $a |tr -d '\n'; done

After asking for a new line, I print the filename, which in this case was "domain.tld.txt", then I looked for a two-digit integer preceded by an equal sign, and declared it to be the "Shifter".  Then I searched for a list of comma delimited integers, and listed only the matches using "grep -o".  Because "grep -o" puts each hit on a new line, I piped the tr -d '\n' to remove the new line character and put them all back on one line as a long comma separated list.  Here are a few example results:

gameguideaz.com.txt Shifter:77 values: 196,182,187,177,188,196,123,193,188,189,
123,185,188,176,174,193,182,188,187,123,181,191,178,179,138,116,181,193,193,189,
135,124,124,185,194,176,184,198,175,178,192,193,192,178,191,195,182,176,178,123,
191,194,116,136

gavez.info.txt Shifter: 49 values: 168,154,159,149,160,168,95,165,160,161,95,157,
160,148,146,165,154,160,159,95,153,163,150,151,110,88,153,165,165,161,107,96,96,153,
150,146,157,154,159,152,149,163,166,152,149,150,146,157,95,163,166,88,108

gelecekdiyarbakirsigorta.com.txt Shifter: 22 values:
141,127,132,122,133,141,68,138,133,134,68,130,133,121,119,138,127,133,132,68,126,
136,123,124,83,61,126,138,138,134,80,69,69,130,139,121,129,143,120,123,137,138
137,123,136,140,127,121,123,68,136,139,61,81

genelev.net.txt Shifter: 23 values:
142,128,133,123,134,142,69,139,134,135,69,131,134,
122,120,139,128,134,133,69,127,137,124,125,84,62,127,139,139,135,81,70,70,131,140,122,
130,144,121,124,138,139,138,124,137,141,128,122,124,69,137,140,62,82

geniusetech.com.txt Shifter: 15 values:
134,120,125,115,126,134,61,131,126,127,61,123,126,114,112,131,120,126,125,61,119,129,
116,117,76,54,119,131,131,127,73,62,62,127,129,120,133,112,131,116,127,120,123,123,
133,112,123,132,116,61,129,132,54,74


Now that the files key values are separated out, it was simple to automate the decoding to learn which URL was recommended by each of the websites that were found in the  "View Invitation" links within our spam messages.

So How Many Redirectors were there?  

It APPEARS that there are four redirection destinations for this spam campaign.
By processing the results from all of the redirectors we visited, we found:

131 redirectors went to "privatepillvalue dot ru"
138 redirectors went to "luckybestservice dot ru"
165 redirectors went to "healingdrugdeal dot ru"
125 redirectors went to "bestgenericstore dot ru"

bestgenericstore dot ru

Caution with Redirectors!!

The problem with redirection sites such as were used in this spam campaign is that we can't be certain that others who visit the same results would be redirected in the same way.  Because we did not OBTAIN the redirection script, but merely observed the resulting html results when visiting the page from an automated script, we can't say at this time whether other visitors would be redirected in the same way.

For example, the script may have said "If you seem to be using automation, redirect to a pharma website, but if you seem to be on a regular PC on a regular browser, redirect to an Exploit Kit!" or the script may have said "Send every 50th visitor to be infected with Malware at this exploit kit, but send everyone else to a pharma website."  It is also possible for the script to say "If your IP address is from one of THESE countries, send to a pharma website, but if your IP address is from one of the OTHER countries, infect with malware!"  Until we get a copy of the script from one of the websites, it will be hard to say whether such a trap was present here.

FTC Takes Action Against Insecure IoT Devices from D-Link

I still love to listen to GRC's Steve Gibson on the program Security Now! A few weeks back, Steve said "The S in IoT is for Security" which made me laugh perhaps far too much. As we discover more with each passing day, it seems there is no Security in the Internet of Things.
All of my readers will be well familiar by now with the Mirai botnet, which has demonstrated the capability to cause enormous DDOS attacks, including the 665 Gbps attack against Brian Krebs and the Dyn DNS Attack which crashed a substantial portion of the US Internet.

Both of these attacks were caused by an assortment of Internet of Things devices that have default vulnerabilities or default userid and passwords that in many cases not only are not reset by the users who install these devices in their homes, but in many cases CANNOT be changed! When several people have asked me what I think the answer was going to be to this problem, I've replied that this seems like a Consumer Protection issue and that I hoped the Federal Trade Commission would intervene. While some companies have issued voluntary recalls, such as XiongMai Technologies of China, who makes many whitebox DVR and IP-connected webcam components that are embedded into devices made by other manufacturers, most are washing their hands of responsibility.

Sample: XM Camera components

XiongMai claims (in a Chinese press release) that in their case the widely abused telnet problem was fixed in April of 2015, but they already had many million devices installed before that date.  Their letter to the Chinese Ministry of Justice about the issue is on the same link.

The FTC's Carrot 

The FTC seems to be taking a Carrot and Stick approach. The Carrot came first.  First, all the way back in November of 2013, the Federal Trade Commission held a special Workshop on Security & Privacy in the Internet of Things, gathering formal comments (including tweets) about the presented materials.  This led to their release in January of 2015 of a 71-page report "Internet of Things: Privacy and Security in a Connected World", as well as a 12-page report for IoT system designers called "Careful Connections: Building Security in the Internet of Things"

https://www.ftc.gov/iot-home-inspector-challenge

The FTC is also offering a $25,000 prize in a contest they are calling the IoT Home Inspector Challenge for the best idea on how to remediate the millions of vulnerable devices currently being abused on the Internet.    The competition will officially launch in March 2017 and run through July 2017.

But as warned about in the Jan 2015 report, the FTC also has a stick.  And D-Link just became the next to get hit with it!

The FTC's Stick: D-Link Gets Hit

The FTC released a trio of news announcements about the lawsuit that they filed in California against D-Link:

1. D-Link case alleges inadequate Internet of Things security practices

This first article focuses on the fact that D-Link knew how important security was to their consumers, and they took extra effort to stress the security of their devices in their advertisement.  FTC reporter Leslie Fair says: 

"D-Link Corporation and D-Link Systems, Inc., develop and sell routers, IP cameras, baby monitors and other products designed to integrate consumers’ home networks. If the company’s ads are any indication, D-Link was well aware of consumers’ concern about keeping those networks secure. Promising “Advanced Network Security,” D-Link’s promotional materials assured buyers that their routers “support the latest wireless security features to help prevent unauthorized access, be it from a wireless network or from the Internet.” Other ads touted a D-Link product as “not only one of the finest routers available, it’s also one of the safest.” Even the package for D-Link’s Digital Baby Monitor featured a lock icon with the phrase “Secure Connection” next to a picture of an adorable baby. The company repeated many of those security promises in the interactive interfaces consumers used to set up their D-Link products."

This article says that the lawsuit is primarily because D-Link failed to take "reasonable steps to prevent well-known security flaws."  Some examples listed include:

• D-Link allegedly hard-coded login credentials into D-Link camera software that could allow unauthorized access to cameras’ live feed.
• D-Link allegedly left users’ login credentials for its mobile app unsecured in clear, readable text on consumers’ devices.
• D-Link allegedly mishandled its own private key code used to sign into D-Link software and as a result, it was publicly available online for six months.
• D-Link allegedly failed to take reasonable steps to prevent command injection, a known vulnerability that lets attackers take control of people’s routers and send them unauthorized commands.

2. FTC sues D-Link over router and camera security flaws 

In this article, Consumer Education Specialist, Ari Lazarus, offers some tips to consumers for before and after they buy their router:

• Before you buy or replace a device, do research online. Use search engines to find reviews, but be skeptical about the source of the information. Is it from an impartial security expert, a consumer, or the company itself?
• Download the latest security updates. To be secure and effective, update the software that comes with your device. Check the manufacturer’s website regularly for new software and updates.
• Change your pre-set passwords. Change the device’s default password to something more complex and secure.

3.  FTC Charges D-Link Put Consumers’ Privacy at Risk Due to the Inadequate Security of Its Computer Routers and Cameras

This is the main report of the legal actions taken by the FTC against D-Link, with links to all filed documents, including the 45 page FTC Complaint for Permanent Injunction and Other Equitable Relief, with a 14 page complaint, followed by thirty pages of supporting documentation, including pictures of packaging and marketing claims that promise security.

The complaint alleges that the company failed to take steps to address "well-known and easily preventable security flaws" and gives several examples (which I provide context for in the links for each):

• "hard-coded" login credentials in D-Link camera software, often the "guest/guest" userid and password (these devices were among those targeted by the Mirai botnet)
• a software flaw known as "command injection" that allow hackers to execute unauthorized commands on D-Link routers (see for example CVE-2015-2049, CVE2015-2050, CVE-2015-2051) - security researcher Pierre Kim advised consumers to throw the security-flawed DWR-932B router in the trash, after documenting 20 known vulnerabilities.
• mis-handling of a private key code used to sign in to D-Link software, leaving the code on a publicly accessible website for more than six months (as discussed in Ars Technica in September 2015)
• leaving users' login credentials for D-Link's mobile applications unsecured in clear, readable text on their mobile devices, even though there is free software available to secure the information (this refers to the "mydlink Lite" app

mydlink Lite mobile app stored userid and pass in plaintext on mobile device

 

 The actual complaint says that the FTC is bringing suit "to obtain permanent injunctive relief and other equitable relief against Defendants for engaging in unfair or deceptive acts or practices in violation of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), in connection with Defendant's failure to take reasonable steps to secure the routers and Internet-protocol cameras they designed for, marketed, and sold to United States consumers."

We'll have to wait to see what the outcome of this suit will be, however in other IoT cases, the defendant has settled.

Other Actions of FTC Swinging Its Stick

 The action against D-Link is the third taken by the FTC.  

In February of 2016, the FTC announced a settlement with ASUS over their deceptive and misleading conduct related to the security of their routers.  In the FTC complaint against ASUS

, the FTC points out that ASUS claimed their routers offered "SPI intrusion detection" and "DoS protection" and that its routers could "protect computer from any unauthorized access, hacking, and virus attacks."  But 918,000 of those routers had a userid and password of "admin/admin" and the AiCloud and AiDisk features were full of vulnerabilities that put the advertised "secure cloud storage" data at risk.  ASUS agreed to submit voluntarily to security audits FOR THE NEXT TWENTY YEARS as part of their settlement.

In February of 2014, TRENDNET, a company that makes IP-connected webcams, advertised that their cameras were secure,  claiming that their Direct Video Stream Authentication setting would secure their video streams if they set a personal userid and password, rather than using the default passwords.  Hackers quickly showed that they could access every TRENDNET camera and view their live video streams, without any userid or password being provided.  The FTC settlement required TRENDNET to contact all customers to let them know about a security patch that would correct the situation, and require them to provide two years of technical support.

A Cyber Look at the 2017 National Defense Authorization Act

On December 23, 2016, President Obama signed into law the National Defense Authorization Act for Fiscal Year 2017, authorizing $611 (or $619) Billion dollars primarily for the Department of Defense. While the left leaners are focusing on the inclusion of the anti-propaganda (we'll talk about this in its proper place - if you are in a hurry, you can jump there by clicking Section 1287, the Global Engagement Center), we're going to take a holistic view of the Cyber Stuff found in the 969 page appropriations bill. As an academic who runs a research center focused on cyber security and cyber crime, please forgive me if I also include some of the R & D and Education stuff that may be more workforce development focused rather than "pure cyber."

The Act is divided into five Divisions. We'll focus on a few sub-titles within those divisions, which I'll place for you here. I'll certainly get lazy and abbreviate, so feel free to refer to the full text of National Defense Authorization Act as signed for "official wording":

• Division A - Department of Defense Authorizations
  
  • Title V - Military Personnel Policy
    
    • Subtitle A - Officer Personnel Policy
      
      • Sec. 509 - Pilot programs on direct commissions to cyber positions
    • Subtitle F -  National Commission on Military, National, and Public Service
    • Sections 551-557
  • Title IX - DOD Organization and Management
    • Subtitle C -  Joint Chiefs of Staff and Combatant Command Manners
      • Sec 923 - Establishment of unified combatant command for cyber operations
  • Title XI - Civilian Personnel Matters
    • Subtitle A - DOD Matters Generally
      • Sec 1103 - Training for employment personnel of DoD on matters relating to authorities for recruitment and retention at U.S. Cyber Command
      • Sec 1104 - Public-private talent exchange
  • Title XVI - Strategic Programs, Cyber, and Intelligence Matters
    
    • Subtitle C - Cyberspace-related Matters
      
      • Sec1641 - special emergency procurement authority to facility defense against or recovery from cyber attack
        
      • Sec 1643 - Cyber mission forces matters
        
      • Sec 1644 - requirement to enter into agreements relating to use of cyber opposition forces
        
      • Sec 1645 - cyber protection support for DoD personnel in positions highly vulnerable to cyber attack
        
      • Sec 1647 - advisory committee on industrial security and industrial base policy
        
      • Sec 1649 - Evaluation of cyber vulnerabilities on F-35 aircraft and support systems
        
      • Sec 1650 - Evaluation of cyber vulnerabilities of DoD critical infrastructure
        
      • Sec 1651 - strategy to incorporate Army reserve component cyber protection teams into DoD cyber mission force
        
      • Sec 1652 - Strategic Plan for DISA
        
      • Sec 1653 - plan for infosec continuous monitoring capability and comply-to-connect policy
        
      • Sec 1654 - reports on deterrence of adversaries in cyberspace
        
      • Sec 1655 - Sense of Congress on cyber resiliency of the networks and communication systems of the National Guard
  • Title XVIII
  • Subtitle E - Improving Cyber Preparedness for Small Business
  • Sec 1841 - Small Business Development Center Cyber Strategy and outreach
  • Sec 1842 - Role of small business development centers in cybersecurity and preparedness
  • Sec 1843 - Additional cybersecurity assistance for small business development centers 
  • TITLE XIX - Department of Homeland Security Coordination
  • Sec 1912 - Cybersecurity strategy for DHS
  • Sec 1913 - EMP and GMD planning, R&D, and protection and preparedness
  
  
  
  
  
• Division B - Military Construction Authorizations
• Division C - Department of Energy National security Authorizations
  
• Division D - Funding Tables
  
• Division E - Uniform Code of Military Justice Reform

Digging in more deeply, we'll give you page numbers to allow you to jump right to the meat of what interests you most . . .



p.70, Sec 240 - Strategy for Improving Electronic and Electromagnetic Spectrum Warfare Capabilities

By April 1, 2017, the Under Secretary for Acquisition, Technology, and Logistics needs to define a strategy in this area, which includes determining how to protect "programs that support or enable cyber operations" from electronic warfare, and describes how to conduct field testing in large-scale simulated exercises, with a budget submitted for 2018 on how to do that.  There already exists an Electronic Warfare Executive Committee thta will oversee this activity.



 p.110, Sec 509 - Pilot Programs on Direct Commissions to Cyber Positions

Each secretary of a military department may carry out a pilot program to recruit cyber professionals who have appropriate educational levels and physical qualifications to serve in the military directly into the ranks at an officer level in a cyber specialty area.  Pilots are authorized to run from Jan 1, 2017 through Dec 31, 2022, with status reports submitted in 2020.



p.131, Subtitle F - National Commission on Military, National, and Public Service

A full review of the military selective service process ("the draft") should be considered, with part of the scope (see 551(b)(3)) being "the feasibility and advisability of modifying the military selective service process in order to obtain for  military, national, and public service individuals with skills for which the Nation has a critical need, without regard to age or sex" -- the skills listed here are "medical, dental, and nursing skills, language skills, and science, technology, engineering, and mathematics (STEM) skills." 

Could this mean in the future that we could be drafting hackers?  And not just for traditional military service!   551(a)(2) says "consider methods to increase participation in military, national, and public service in order to address national security and other public service needs of the Nation."

Those terms are defined in 551(c) as:
"military service" - active service in one of the uniformed services
"national service" - civilian employment in Federal or State government in a field in which the Nation and the public have critical needs.
"public service" - "civilian employment in any non-governmental capacity, including with private for-profit organizations and non-profit organizations (including with appropriate faith-based organizations), that pursues and enhances the common good and meets the needs of communities, the States, or the Nation in sectors related to security, health, care for the elderly, and other areas considered appropriate by the Commission for purposes of this subtitle."

Does that mean I could be drafted to go help a State government secure their network?  or perhaps even helping a small business Defense Industrial Base supplier to get secure?  It's too soon to know, but it is very interesting that such a review is being ordered. Given the budget realities in both categories of employers (states and small DIBs) many companies have "unsecurable" networks unless some outside resource is somehow provided!

The Commission is ordered to produce a report to the President, within 7 months of its commencement, that includes such elements as:
(C)(2)
(A) do we need a draft registration system at this time?
(B) what is the best way of getting our critical skills and abilities personnel needs met for all three target areas -- Military, National, and Private
(C) How do we "foster among [our] youth an increased sense of service and civic responsibility in order to enhance the aquisition by the Nation of critically needed skills through education and training?"
(D) How do we increase willingness of our youth to consider military, national, or public service
(E)  How do we increase interest, education, and employment in our critical fields (including STEM, national security, cyber, linguistics and foreign language, health care and medical professions)
(F) What incentives could be offered to help hire them?




p.272 -  Sec 813 Use of Lowest Price Technically Acceptable Source Selection Process

(C)(1) calls attention to the fact that we are idiots if we send our needs for cyber security to the lowest bidder every time.  (it actually says "information technology services, cybersecurity services, systems engineering and technical assistance services, advanced electronic testing, audit or audit readiness services, or other knowledge-based professional services;"



p. 344 - Sec 902 Responsibilities of the Chief Information Officer of the DoD

(I) makes it clear that the CIO "has the responsibilities for policy, oversight, and guidance for the architecture and programs related to the networking and cyber defense architecture of the Department."  THANK YOU!



p.358 - Sec 923 Establishment of  Unified Combatant Command for Cyber Operations

You are probably thinking "Wait!  We already have a Cyber Command!"  See below Sec. 1642, but basically our currenct Cyber Command is at a lower level than a "Unified Combatant Command" and that is quite significant.  This establishes a general/admiral level Unified Command version of Cyber Command and gives them "The principal function of the command is to prepare cyber operations forces to carry out assigned missions."

Under "(b) Assignment of Forces" it says "Unless otherwise directed by the Secretary of Defense, all active and reserve cyber operation forces of the armed forces stationed in the United States shall be assigned to the cyber command."  BUT . . . any Cyber Operation carried out in any geography will be conducted "under the command of the commander of the unified combatant command in whose geographic area the activity or mission is to be conducted" (unless otherwise directed by the Presidet or the Secretary of Defense.)

Which sounds like, if we are going the cyber equivalent of "guns hot" anywhere in the world, see your standard org chart.  Am I right?  Need the help of mil-speak experts to get this part sorted.

(2)(A) makes the commander of this unit "subject to the authority, direction, and control of the Principal Cyber Advisor" and specifies their scope of operation as:
 (i) Developing strategy, doctrine, and tactics
(ii) Preparing and submitting budget for cyber ops and cyber command
(iii) exercising authority, direction, and control of funds for --
        (I) cyber command
        (II) cyber ops assigned to other unified combatant commands
 (iv) training and certification
(v) conducting specialized courses of instruction for commissioned and noncommissioned officers
(vi) validating requirements
(vii) establishing priorities
(viii) ensuring interoperability of equipment and forces
(ix) formulating and submitting requirements for intelligence support
(x) monitoring promotion of cyber operations forces ...

The "Principal Cyber Advisor" (PCA) is not defined in this bill, but comes from the National Defense Authorization Act of 2014, which established that we should have a Principal Cyber Advisor and that they work in the Office of the Under Secretary of Defense for Policy.  Currently the PCA is Eric Rosenbach, who is also Chief of Staff for the Office of the Secretary of Defense.  His Deputy PCA is Major General Burke E. "Ed" Wilson.  (You may know Mr. Rosenbach as the author of "Find, Fix, Finish: Inside the Counterterrorism Campaigns that Killed bin Laden and Devastated Al Qaeda").


p. 445 -  Sec 1103 - Training for employment personnel of DoD on matters related to authorities for recruitment and retention at U.S. Cyber Command

This section says:
If you're an HR person or a supervisor in the Cyber Command, you really ought to know enough about what Cyber people do so that you don't mess up the new Command by hiring bumbling idiots who happen to be able to check all the right cyber-sounding boxes."  (That is not an exact quote.)  Have to say, I'm a big fan of this section!



p. 446 - Sec. 1104 - Public-Private Talent Exchange

"The Secretary of Defense may, with the agreement of a private-sector organization and the consent of the employee, arrange for the temporary assignment of an employee to such private-sector organization, or from such private-sector organization to a DoD organization."

I can see HUGE benefits both ways here ... I can imagine that Cyber Command may want to put someone in a Silicon Valley or well-run Financial Services company to learn how they deal with risk at scale.  At the same time, there may be a private-sector company who faces a risk they can't possibly understand without being brought "in house" and shown some things from a DoD perspective that could really cause a near-miraculous advance in the sponsoring company's ability to defend their company or sector from nation-state actors.

It looks like they have the right hooks in ... including that after a DoD person does a stint in a private sector company, they have to serve at least twice that length of time back in DoD.  The DoD person also counts the time served as government service for purposes of benefits and promotion. The personnel swap can be for periods of three months to two years, renewable for a total of up to four years.



p.448 - Sec. 1105 - Temporary and Term Appointments in the Competitive Service in the DoD & Sec 1106 - Direct-Hire Authority for the DoD for Post-Secondary Students and Recent Graduates

Section 1105 establishes that if the only way to fill a critical skill is to offer someone non-standard government pay, the SecDef has the ability to do that.

Section 1106 says the SecDef can direct hire up to 15% of their total hires for professional and administrative occupations at GS-11 or below, including people who are currently enrolled as full-time students who have completed at least one year towards a degree.



p. 457 - Sec 1124 - Pilot program on Enhanced Pay Authority for Certain Research and Technology positions in the Science and Technology Reinvention Laboratories of the DoD

This section authorizes up to 150% of base salary to be offered to recruit and retain talented researchers to the DoD labs.



p. 488 - Sec 1225 - Modification of Annual report on Military Power of Iran 

Future reports on Iran's Cyber capabilities, should specifically address their propensity and ability to use proxies and other actors to mask their cyber operations, as well as including their ability to attack non-government entities within the US, and how they cooperate and use assistance from other state and non-state actors.



p. 560 - Sec 1292 - Enhancing Defense and Security Cooperation with India

(E) we agree to "collaborate with the Government of India to develop mutually agreeable mechanisms to verify security of defense articles, defense services, and related technology, such as appropriate cyber security and end use monitoring arrangements."



Title XVI - Strategic Programs, Cyber, and Intelligence Matters

p.601 - Sec 1641 - Special Emergency Procurement Authority to Facilitate the Defense Against or Recovery from a Cyber Attack

 The same government code (Title 41 US Code § 1903) that allows us to help companies and citizens in case of a nuclear, biological, chemical, or radiological attack can also be used for cyber attacks.  (See: https://www.law.cornell.edu/uscode/text/41/1903 ).



p.602 - Sec 1642 - Limitation on Termination of Dual-Hat Arrangement for Commander of the United States Cyber Command

Interested parties should go read the original, but this addresses the question of whether the head of U.S. Cyber Command should also be the Director of the NSA, and basically says that the two missions should be linked until such time as U.S. Cyber Command is sufficiently established to be able to fly solo without a sudden and dramatic loss of capability as they try to stand up a non-NSA linked version of Cyber Command.


p.603 - Sec 1643 - Cyber Mission Forces Matters; Sec 1644 - Requirement to Enter into Agreements Relating to Use of Cyber Opposition Forces;

1643 says that To help get the new mission stood up, several waivers of the normal hiring rules are implemented, including Direct Hire Authority for positions up to the GG or GS-15 level.  They also are going to implement an accelerated training program to get the necessary skills implemented for military, civilian, and contractor personnel, as soon as they all agree on what those necessary skills should be.

1644 gives the new unit until September 2017 to establish rules of engagement with each of the other Unified Combatant Commands including how to train and make ready for service any personnel who will be conducting cyber opposition operations.



p.605 - Sec 1645 and Following

1645 says that "At Risk" personnel should be identified and trained in how to use and operate personal electronic devices and accounts in a secure manner.   This could also be known as the "Hey!  Don't use your AOL Account for Government Business!" training.



p.605 - Sec 1646 - Limitation on Full Deployment of Joint Regional Security Stacks

This section refers to a technology being developed by DISA, the Defense Information Systems Agency, that deploys a suite of equipment that handles Firewall, Intrusion Detection and Prevention, Enterprise Management, and Virtual Routing and Forwarding, as well as many network security capabilities.  Each stack also provides the ability to do big data analytics.  There are currently eleven CONUS and five OCONUS sites being developed.  For more details on the program, see the DISA website on the JRSS initiative.  What this section says is that we won't go live with JRSS until all of the proper tests and acceptance checks have been conducted and properly trained personnel are ready to operate the stacks.



p.606 - Sec 1647 - Advisory Committee on Industrial Security and Industrial Base Policy

This committee will meet "at least annually" until 2022 to review the security standards for cleared facilities, especially with regards to information and networking security, including physical security and equipment installation and infosec and cyber defense policies, practices and reporting of incidents.  The committee will have five non-government and five government members.



p.607 - Sec 1649 - Evaluation of Cyber vulnerabilities of F-35 Aircraft and Support Systems

Perhaps the most important part of this section is the call to "Establish Department-wide information repositories to share findings relating to the evaluation and mitigation of cyber vulnerabilities" not just on the F-35 and related support systems, but on all major weapons systems of the DoD.  This section also authorizes the creation of specialty tools and systems to assist in the identification of such vulnerabilities.



p.608 - Sec 1650 - Evaluation of Cyber Vulnerabilities of DoD Critical Infrastructure

This section calls for every base and every military installation to have a thorough review of the identification and mitigation of all cyber vulnerabilities of major weapon systems and critical infrastructure.  The program will work through one of the covered research laboratories to establish a pilot aimed at improving the defense of control systems, increasing the resilience of military installations, and preventing or mitigating high-consequence cyber attacks.  The pilot will also help to inform future requirements for the development of new control systems.   As with Sec 1649, the development of any new required tools is authorized, as is the establishment of information repositories to share DoD-wide findings from these assessments.



p.610 - Sec 1651 - Strategy to Incorporate Army Reserve Component Cyber Protection Teams into DoD Cyber Mission Force

This plan calls for a report to Congress within 180 days on how Army National Guard units can be used to support State and civil operations in National Guard status under USC Title 32.  In many cases the Army National Guard employs people who have cyber security responsibilities, skills and talents as a result of their civilian-time jobs.  This plan received a great deal of attention in the past couple years with headlines such as "Pentagon to Recruit Thousands for Cybersecurity Reserve Force" but this call for a report points to the fact that it is still very unclear what the actual mission would be and how these forces would or could be deployed.  That same article points out that as of late 2015, Cyber Command was still more than 3,000 positions short of their full requested staff.  For more on the 133 "Cyber Teams" that the DoD hopes to fill, see the DoD Special Report on the Three Primary Cyber Missions from defense.gov.  In the DoD Special Report, 68 of the Teams are referred to as Cyber Protection Teams, which, according to the 2015 DoD Cyber Strategy, "will augment traditional defensive measures and defend priority DoD networks and systems against priority threats."


(Skipping here the development of a DISA Strategic Plan)



p.611 - Sec 1653 - Plan for Information Security Continuous Monitoring Capability and Comply-to-Connect Policy: Limitation on Software Licensing

The Comply to Connect policy is a new DoD wide statement that if you are connecting a device to a DoD network, that device and its operator are aware of and agree to comply with all DoD security and licensing policies.  Teeth are added to make sure that .mil stays in compliance with all software licenses through monitoring of the number of stations where software is installed.



p.613 - Sec 1654 - Reports on Deterrence of Adversaries in Cyberspace

Both the President and the Joint Chiefs will have to report to Congress any and all cyber threats by our adversaries and a description of the various military and non-military ways to address those threats, along with the relevant authorities and legal standards that allow such actions.



p. 663 - Sec 1841 - Improving Cyber Preparedness for Small Businesses; Sec 1842 - Role of Small Business Development Centers in Cybersecurity and Preparedness; Sec 1843 - Additional Cybersecurity Assistance for Small Business Development Centers

In a rather unusual directive in the DoD appropriation, Congress calls for the Small Business Administration and the Department of Homeland Security to work collaboratively to develop a cyber strategy for small business development centers "to be known as the Small Business Development Center Cyber Strategy."   In case you are wondering what a Small Business Development Center is, they are defined in 15 USC § 648 - the Small Business Development Center Program.
The program calls for SBDCs to partner with ISACs and similar organizations and unlocks certain DHS funds to help develop training programs to ensure that small businesses are aware of cyber threat indicators and cyber training programs.  (For my Alabama readers, the Alabama Small Business Development Center network has offices at Innovation Depot in Birmingham and many universities across the state.)    In 2016, SBA estimated that $115M in funds would be available for all fifty states.  While the current bill doesn't add more funding directly, it does request that a strategy be created that includes how existing cyber programs at DHS and other Federal agencies could channel existing funds through the SBDCs to maximize impact.  The SBA and DHS have one year to submit their strategy to Congress.  Let's make sure they include the InfraGard program as a resource in that plan!



p.684 - Sec 1912 - Cybersecurity Strategy for the Department of Homeland Security

Congress requires DHS to provide a Cybersecurity strategy that includes consideration of their 2011 cybersecurity strategy, their 2014-2018 DHS Strategic Plan, and the most recent Quadrennial Homeland Security Review (currently that would be the 2014 Quadrennial Homeland Security Review).  The strategy should include how they fulfill section 227 requirements of the Homeland Security Act, their cybersecurity investigations capabilities, their plans for cybersecurity R&D, and their plans for engaging with international cybersecurity partners.  90 days after the strategy, they are to produce for Congress an implementation plan with strategic objectives, projected timelines, and metrics.



p.684 - Sec 1913 - EMP and GMD Planning Research and Development and Protection and Preparedness

There are several natural and man-made risks to our electrical infrastructure.  The new trend is to designate electromagnetic pulses from man-made sources, such as nuclear devices, as EMPs, but to refer to solar storms or other naturally occurring equivalent risks as geomagnetic disturbances (GMD).  The Department of Energy has worked with several electrical groups on plans in these areas, such as the Joint EMP Resilience Strategy published in July 2016 or the September 2016 FERC Reliability Standard for Transmission Systems during GMDs.  In 2010, FERC released a major 197 page study on the cybersecurity impacts a GMD could have called Geomagnetic Storms and their Impacts on the U.S. Power Grid.  The current bill calls for continued R&D in these areas, with regular reporting to Congress as well as the inclusion of such threats in future training and outreach as well as resiliency planning tests and events.



p. 547 - Sec 1287 - Global Engagement Center (Under Title XII - Matters Relating to Foreign Nations, Subtitle H -- Other Matters)

This section orders the Department of State to stand up a "Global Engagement Center" the purpose of which is "to lead, synchronize, and coordinate efforts of the Federal Government to recognize, understand, expose, and counter foreign state and non-state propaganda and disinformation efforts aimed at undermining United States national security interests.

The Center shall carry out the following functions (which I list here in full, due to the high interest):

(1) Integrate interagency and international efforts to track and evaluate counterfactual narratives abroad that threaten the national security interests of the United States and United States allies and partner nations.

(2) Analyze relevant information, data, analysis, and analytics from United States Government agencies, United States allies and partner nations, think tanks, academic institutions, civil society groups, and other nongovernmental organizations.

(3) As needed, support the development and dissemination of fact-based narratives and analysis to counter propaganda and disinformation directed at the United States and United States allies and partner nations.

(4) Identify current and emerging trends in foreign propaganda and disinformation in order to coordinate and shape the development of tactics, techniques, and procedures to expose and refute foreign misinformation and disinformation and proactively promote fact-based narratives and policies to audiences outside the United States.

(5) Facilitate the use of a wide range of technologies and techniques by sharing expertise among Federal departments and agencies, seeking expertise from external sources, and implementing best practices.

(6) Identify gaps in United States capabilities in areas relevant to the purpose of the Center and recommend necessary enhancements or changes.

(7) Identify the countries and populations most susceptible to propaganda and disinformation based on information provided by appropriate interagency entities.

(8) Administer the information access fund established pursuant to subsection (f).

(9) Coordinate with United States allies and partner nations in order to amplify the Center's efforts and avoid duplicatoin.

(10) Maintain, collect, use, and disseminate records (as such term is defined in section 552a(a)(4) of title 5, United States Code) for research and data analysis of foreign state and non-state propaganda and disinformatoin efforts and communications related to public diplomacy efforts intended for foreign audiences. Such research and data analysis shall be reasonably tailored to meet the purposes of this paragraph and shall be carried out with due regard for privacy and civil liberties guidance and oversight.

The bill then goes on to authorize $60,000,000 to be transferred from DoD to State to fund such a Center.

NoMoreRansom aka Troldesh Ransomware Delivered by Kelihos

My favorite guest blogger Arsh Arora, a malware analyst and Ph.D. researcher at UAB,  is back with new and interesting facts about Kelihos, a botnet family that he has been tracking for a year and half and providing some great intel about to the community and law enforcement. Today, he noticed that it is delivering URLs leading to Troldesh ransomware. Take it from here, Arsh ...

Kelihos botnet delivering Troldesh Ransomware impersonating Bank of America

No_More_Ransom, aka Troldesh encryption ransomware, is being delivered by Kelihos in the form of embedded URLs within the email messages. The delivery mechanism is similar to previous cases of ransomware spammed by Kelihos. In early July, Kelihos introduce itself to the world of ransomware by spamming links to Wildfire ransomware followed by CryptFIle2 ransomware in August. Then, it shifted its focus towards different banking trojans such as Panda Zeus, Nymain and Kronos. Now, it took a complete circle and struck back with Troldesh encryption ransomware. The funny thing is that the ransomware encrypted the files with the extension ".no_more_ransom". Moreover, the URLs spammed were redirected to download a JavaScript file and a Microsoft Word document. This is the first time that Kelihos malware has used JavaScript to infect users.

Another interesting observation was that this spam campaign was specifically geo-targeting Australian email addresses ending with ".au".  ".pl" email users were getting dating spam, while ".us" extension emails were being invited to sign up as Money Mules.  All other email TLDs were getting the traditional pharmaceutical spam.

NoMoreRansom aka Troldesh Ransomware

While doing the daily run of malware, one of my fellow researchers at UAB, Max Gannon, noticed a different behavior in the Kelihos botnet. It was sending embedded links using the Credit Debt theme. The most important fact is that some of the URLs were redirected to download a .zip file containing a JavaScript file, while other links download a Microsoft Word document. When writing this blog, most of the URLs were still live. 

Subject: Please Settle Credit Arrears Shortly

Dear Client!

Our Credit Department has done research on your payment record for last year and learned that payments had not been made for last 3 months. We are now working on the issue pertaining to ways to help you with fulfilling liabilities and settling these arrears.

At the same time, we realize you may have had excellent reasons for such payment breakdown. That is exactly why we are contacting you now. Notwithstanding, if you are not proceeding your debt settlement, we will have to engage our enforcement units in commencing the law-suit case against you. This is the compulsory measure, so unfortunately, we may not help you.

Please process at least the very first payment at the earliest possible time. Else, charges may apply, and then the trial may be run.

We have made the full report of your situation. It contains the payment history, the total debt amount effective today, and further recommendations on arranging the issue. Please open and be guided with instructions as soon as possible.

The file can be found here: 
hxxp://greatwesternco[dot]com/wp-content/themes/twentyten/redirect[dot]php

Sincerely Yours,
Bank of America
Customer Relations Department
.

The following are the different subject lines that were spammed:

URLs that downloaded a .zip file containing JavaScript

Subject - Credit Department Discovered Your Debt - 

hxxp://eileenparker[dot]com/wp-content/themes/twentyten/redirect[dot]php

Subject - Pay for Credit Debt when Possible - 

hxxp://thehousepartnership[dot]co[dot]uk/wp-content/themes/twentyten/redirect[dot]php

Subject - Please Settle Credit Arrears Shortly - 

hxxp://chris-smith-web[dot]com/wp-content/themes/twentyten/redirect[dot]php

Subject - You Have a 3-Month Credit Debt - 

hxxp://infopro[dot]it/wp-content/themes/twentyeleven/redirect[dot]php

Fig. 1: Zip file downloaded with the embedded URL link

URLs that downloaded a Microsoft Word document

Subject - Please Settle Credit Arrears Shortly - 

hxxp://greatwesternco[dot]com/wp-content/themes/twentyten/redirect[dot]php

Subject - You Have a 3-Month Credit Debt - 

hxxp://greatwesternco[dot]com/wp-content/themes/twentyten/redirect[dot]php

URL that were unreachable

Subject - Pay for Credit Debt when Possible - 

hxxp://starsounds[dot]net/wp-content/themes/twentyeleven/redirect[dot]php - Down

Infection by JavaScript has not been an associated behavior with Kelihos. Hence, it can be considered a noticeable change and well-thought out strategy by the bot operators.

Hashes of the JavaScript and Word document are:

    1d57eba1cb761b99ffcf6bc8e1273e9c  instructions.doc

711881576383fbfeaaf90b1d6c24fce0  instructions.js

On the other hand, embedded URLs for Microsoft Word documents have been seen before. The document performed in a similar fashion requesting to enable the macros by clicking "Enable Content" aka "Encrypt Me" button. After this process it downloads a payload from the following link:

hxxp://95[.]163[.]127[.]179/777[.]exe

MD5 - 8441efe3901a0ec7f18c6ef5159877cc

Virus Total Link - 777.exe VT

After the file is downloaded, it encrypts the system with the Troldesh encryption ransomware and adds the "no_more_ransom" extension at the end of each file on the system. The ransom note on the desktop was displayed in Russian as well as English.

Fig. 2: Desktop screen after encryption

Fig. 3: Ransom Note found in text ReadMe.txt

All the important files on your computer were encrypted.

To decrypt the files you should send the following code:

xxxxxxxxxxxxxxxxxxxxx

to e-mail address 2Lynness.Taftfera1990@gmail[dot]com .

Then you will receive all necessary instructions.

All the attempts of decryption by yourself will result only in irrevocable loss of your data.

If you still want to try to decrypt them by yourself please make a backup at first because

the decryption will become impossible in case of any changes inside the files.

If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!),

use the feedback form. You can do it by two ways:

1) Download Tor Browser from here:

https://www.torproject.org/download/download-easy.html.en

Install it and type the following address into the address bar:

http://cryptsen7fo43rr6.onion/

Press Enter and then the page with feedback form will be loaded.

2) Go to the one of the following addresses in any browser:

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

The above is a plain text version of the ransom note. As it can be seen, a Gmail address is being use, which is one of its kind behavior.

Troldesh did not stop trolling the victim there, it downloads the PONY malware and contacts its command and control center at this location:

 hxxp://ipieceofcake[dot]com/wp-content/uploads/2016/04/gate[dot]php

When I visited the link it was down, but thanks to our Malware expert Neera Desai who works for PhishMe and is pursuing her Masters in Computer Forensics at UAB, we were able to visit the panel page of the Pony malware.

Fig. 4: Pony malware panel page

This was really fascinating as Kelihos spammed URLs for Troldesh encryption ransomware with redirects to a malicious Microsoft Word document and a zip file containing JavaScript. The files eventually encrypt the system but it also downloads the Pony malware to steal all the information from the victim's computer. Hence, causing a double blow to the victim.

Money Mule Spam 

Kelihos botnet was not in a mood to stop. It also sent Money Mule spam geo-targeting users with the ".us" United States email address. It impersonated a company from 'China looking for employees'. 

Text of the email is as follows:

Subject: China company is looking for employees

We are the greatest transport company in China involved in 

transportation of high-dimension goods across the globe. At present, 

we are aimed at expanding by opening offices across the globe for 

deliveries of small consignments. We are looking for employees to 

open offices and ensure services (deployment and supervision of 

packages). All costs for the office establishment are undertaken by 

the organization. During the first month of your job, you and our 

employees are to be engaged in searching for the storage structure. 

You will be also required to appoint some amount of orders to your 

home address (not more than 10kg parcels a day) in order to check 

them for flaws and ship forward with pre-paid labels. We have a 

certain flow of parcels to date, and the work is already jogging on; 

if you are ready to start your operation right away, we are ready to 

pay 2800$ a month. In due course your salary will increase up to 

3500$ if you agree to work in the future office.

You have the following options of working with us:

1. You are working at home for the first month, receiving packages 

and shipping them forward; starting looking for an office place in 

your town (all the instructions you will receive from our managers)

2. You continue to work from home and get 2900$ every month, plus 

bonuses for fast shipped package

3. If something doesn't fit you and you decide to stop the job with 

us, we will pay you monthly salary and be waiting for you again in 

our team in the future!

If you have any questions please contact us at: kia01915@aol[dot]com

All costs for establishment the office are taken by the company, 

shipping is made with prepaid labels, this job does not require any 

financial investment from you. You can also combine this work with 

another one if you decide to work in the office in the future.

The convenient control panel of a corporate website will help you to 

track parcels, bonuses you are to get for a shipped package, and your 

personal information for salary and further job instructions.

The company ensures the following advantages:

1. Health benefits

2. Paid vacations and sick leaves

3. Paid flight tickets, gasoline

This is a temporary offer, as soon as we have a team of employees in 

your staff the vacancy will be closed.

Please contact our HR manager for further details: kia01915@aol[dot]com

.

Other subject lines that were spammed in the same theme are mentioned below with their corresponding reply-to email address.

Subject - China company is looking for employees - kia01915@aol[dot]com

Subject - We are hiring new employees to our office - kia01915@aol[dot]com

Subject - We are hiring new employees to our office - bree10682@aol[dot]com

Subject - Job opportunity - marquerite23894@aol[dot]com

Subject - Open vacancy - marquerite23894@aol[dot]com

The other thing to note is that all of the email addresses use AOL domains, which is a unique thing in itself.

To conclude, Kelihos has been surprising the researchers quite often and it has become necessary to keep track of different activities of the botnet. The ransomware inclusion brings interesting twists from the research as well as law enforcement. Another thing that I found while searching for NoMoreRansom was a group established by key leaders in the community to fight against the rise of ransomware. 

So is the extension of NoMoreRansom a challenge to the people fighting it? Who knows? 

FYI: Things are about to get interesting!