Malware Report

Q2 2012

Copyright 2012 Kindsight, Inc.. All rights reserved.

Kindsight Security Labs Malware Report Q2 2012

Contents
INTRODUCTION Q2 2012 HIGHLIGHTS Q2 2012 HOME MALWARE STATISTICS Home Network Infection Rates Infection Methods Top 20 Home Network Infections Top High Level Threats Top 20 Internet Threats NEW DEVELOPMENTS IN Q2 Mac Flashback at Number One for 4 Weeks Zeroaccess Modifies C&C Protocol Ad-click Fraud Burns Bandwidth Flame is the Latest Espionage Bot DNSChanger is Still Making News Q2 2012 MOBILE MALWARE STATISTICS Mobile Device Infection Rates Top Android Malware Find and Call Infects iPhones and Androids CONCLUSION ABOUT KINDSIGHT SECURITY LABS 1 1 2 2 2 3 3 4 5 5 5 6 7 7 8 8 8 8 9 10

Kindsight Security Labs Malware Report Q2 2012

ii

Introduction
The Kindsight Security Labs Q2 2012 Malware Report shows general trends for malware infections in home networks or infections in mobile devices and computers connected through mobile adapters. The numbers in this report are aggregated across the networks where Kindsight solutions are deployed.

Infection Rate = 14%

OVER PREVIOUS QUARTER

7.7%

Q2 2012 Highlights

14% of home networks were infected with malware in Q2/2012, thats up from 13% in
the previous quarter.

The Mac Flashback infection led the top 20 lists for four weeks in a row, infecting 10% of home networks with Mac computers during the month of April. The p2p ZeroAccess Botnet changed its C&C protocol and grew to over 1.2 million super nodes resulting in ad-click fraud that can consume the equivalent bandwidth of downloading as many as 45 full length movies per month per subscriber.

0.7% of all devices on mobile networks were infected. The infected devices include Android
phones and laptops connected to the mobile network so this infection rate is significant since the total device count includes a large number of feature phones that are not targets for malware.

In Q2 there was a

three-fold increase

in the number of Android malware samples.

Android Malware Samples

OVER PREVIOUS QUARTER

300%

Kindsight Security Labs Malware Report Q2 2012

Q2 2012 Home Malware Statistics

Home Network Infection Rates
In fixed broadband deployments we found that in Q2/2012 an average of 14% of residential households show evidence of malware infection. In Q1, 13% of residential households showed evidence of infection. 9% of households were infected by high threat level malware such as a botnet, rootkit or a banking Trojan. 6% of households were infected with a moderate threat level malware such as spyware, browser hijackers or adware. Some households had multiple infections. The number of high level infections is a 50% increase from Q1/2012 when only 6% of households were infected with a high-level threat.

Infection Methods
The main infection method continues to be e-mail messages luring victims to web sites running a variety of exploit kits. The victim would typically receive an e-mail message from a business or the government informing them of an issue with their account. This would contain a reasonable looking link a web site. The web site would actually host an exploit kit such as Blackhole. This would probe their system and attempt to infect it. Once infected the attacker would generally install a rootkit botnet such as Alureon or ZeroAccess which is then used to coordinate additional malware activity. In some cases they will directly download fake anti-virus software, a Spambot or a banking Trojan like Zeus or SpyEye. Often the e-mail will simply contain a zip file containing an executable malware file.

Infect ed

Moderat e

14%

6%

Hig h

9%

OVER PREVIOUS QUARTER

HIGH LEVEL THREATS

50%

Home Networks Infected with

Division of Infections by

Malware

Threat Level

Kindsight Security Labs Malware Report Q2 2012

Top 20 Home Network Infections

The chart below shows the top home network infections detected in Kindsight deployments. The results are aggregated and the order is based on the number of infections detected over the 3-month period of this report. Position
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

Name
Hijacker.MyWebSearchToolbar Spyware.SCN-ToolBar Hijacker.StartPage.KS Adware.GameVance Mac.Bot.Flashback.K/I Adware.MarketScore Trojan.NineBall/Gumblar Trojan.Backdoor.TDSS Botnet.ZeroAccess Downloader.Agent.TK Spyware.SBU-Hotbar BankingTrojan.Zeus Trojan.Alureon/TDL Trojan.DNSChanger Hacktool.Binder Downloader.Cred.B Trojan.Agent.Gen Virus.Sality.AT Downloader.Ponmocup.A Trojan.Medfos.A

Threat Level
Moderate Moderate Moderate Moderate High Moderate High High High High Moderate High High High High High High High High High

Top High Level Threats

The table shows the top 20 high threat level malware that leads to identity theft, cybercrime or other online attacks. Well look at the significant ones in more detail below under New Developments. Position
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

Name
MAC.Bot.Flashback.K/I Win32.Botnet.ZeroAccess Win32.Trojan.NineBall/Gumblar Win32.Backdoor.TDSS Win32.Downloader.Agent.TK Win32.BankingTrojan.Zeus Win32.Trojan.Alureon/TDL DNS.Trojan.DNSchanger Win32.HackTool.Binder Win32.Downloader.Cred.B Win32.Trojan.Agent.Gen Win32.Virus.Sality.AT Win32.Downloader.Ponmocup.A Win32.Trojan.Medfos.A Win32.Backdoor.InstallCore.D Win32.Exploit.JS_Blacole Win32.Backdoor.Cycbot.B Win32.Trojan.Proxyier.qk Generic.Spambot Win32.BankingTrojan.SpyEye

Kindsight Security Labs Malware Report Q2 2012

Top 20 Internet Threats

The chart below shows the top 20 most prolific malware found on the Internet. The sort order is based on the number of distinct samples we have captured from the wild. Finding a large number of samples indicates that the malware distribution is extensive and that the malware author is making a serious attempt to evade detection by anti-virus products.
Adware:Win32/Hotbar Adware:Win32/Hotbar Rogue:Win32/Winwebsec Rogue:Win32/Winwebsec Worm:Win32/Allaple.A Worm:Win32/Allaple.A Virus:Win32/Sality.AT Virus:Win32/Sality.AT Worm:Win32/Mydoom.O@mm Worm:Win32/Mydoom.O@mm PWS:Win32/Lolyda.BF PWS:Win32/Lolyda.BF Trojan:Win32/Rimecud.A Trojan:Win32/Rimecud.A Worm:Win32/Rebhip.A Worm:Win32/Rebhip.A TrojanDownloader:Win32/Beebone.BQ TrojanDownloader:Win32/Beebone.BQ TrojanDownloader:Win32/Beebone.BR TrojanDownloader:Win32/Beebone.BR VirTool:Win32/VBInject.UG VirTool:Win32/VBInject.UG Trojan:Win32/Otran Trojan:Win32/Otran Backdoor:Win32/Zegost.L Backdoor:Win32/Zegost.L Worm:Win32/Vobfus.EG Worm:Win32/Vobfus.EG Worm:Win32/Vobfus.gen!R Worm:Win32/Vobfus.gen!R TrojanDropper:Win32/Sirefef.B TrojanDropper:Win32/Sirefef.B PWS:Win32/OnLineGames.IZ PWS:Win32/OnLineGames.IZ Worm:Win32/Mydoom.L@mm Worm:Win32/Mydoom.L@mm VirTool:Win32/VBInject.WX VirTool:Win32/VBInject.WX Backdoor:Win32/Cycbot.G Backdoor:Win32/Cycbot.G
0.00% 0.50% 1.00% 1.50% 2.00% 2.50%

PROLIFIC MALWARE

Kindsight Security Labs Malware Report Q2 2012

New Developments in Q2
Mac Flashback at number one for 4 weeks
For the first time ever, malware targeting the Macintosh platform was in the number one position on the Kindsight Security Labs home network infections list. Our detection statistics for the month of April show that 1.1% of homes were infected with this malware. Based on a Mac market share this translates into about 10% of homes with Mac computers being infected with this malware during the month of April. Security researchers at Symantec have discovered that in addition to stealing passwords, Flashback is also being use for ad-click fraud. The graph below shows the infections observed in network traffic throughout Q2. The percentage represents the number of home networks that have Macs that were infected on that date.
FLASHBACK FLASHBACK INFECTIONS INFECTIONS

6.00% 5.00% 4.00% 3.00% 2.00% 1.00% 2 June 9 June 16 June 23 June 14 April 21 April 28 April 30 June 5 May 12 May 19 May 26 May 0

The chart shows that the infection rate is on the decline, but still significant.

ZeroAccess Modifies C&C Protocol

We have been investigating the appearance of a new variation of the ZeroAccess/Sirefef bot. In February, we published a detailed analysis of the network behavior of this bot and the encrypted p2p protocol that it uses to communicate with its peers. The main purpose of this botnet is to distribute malware responsible for ad-click fraud, which we explain in more detail below. Over the last week of June on one network, we observed 3321 infected computers actively communicating with over 1.2 million Internet peers. This is almost a 2.5x increase in the number of infected computers and an over 50% increase in the number of Internet peers when compared to the last week of Q1.

1 million+ peers
Internet
Kindsight Security Labs Malware Report Q2 2012

Internet

3321 infected users

Home Networks

As can be seen in the bar chart below, the infected peers are widely distributed throughout the Internet with almost 18% in India and 10% in the United States.

IndiaIndia
United States United States Kazakhstan Kazakhstan Iran,Iran, Islamic Republic of Islamic Republic of Brazil Brazil Argentina Argentina Italy Italy ChileChile Venezuela Venezuela Algeria Algeria Romania Romania Russian Federation Russian Federation Japan Japan Ukraine Ukraine Morocco Morocco Colombia Colombia Spain Spain Turkey Turkey Sweden Sweden Indonesia Indonesia
12.00% 14.00% 16.00% 10.00% 18.00% 0.00% 2.00% 4.00% 6.00% 8.00%

ZERO ACCESS SUPERNODES BY COUNTRY

The underlying structure and function of the bot remain the same, but the command and control (C&C) protocol also changed in Q2 to a combination of TCP and UDP. The botnet continues to be very prolific with this new variety infecting about 0.8% of the home networks observed by Kindsight. A detailed description of the new C&C protocol can be found in New C&C Protocol for ZeroAccess/Sirefef Malware Analysis Report.

Ad-click Fraud Burns Bandwidth

The traffic generated by the ad-click fraud can burn through your bandwidth cap. We have been following a number of bots such as ZeroAccess whose primary function is ad-click fraud. These bots receive instructions from a controller directing them to click on ads on specific web sites. The web site owner gets paid by the advertiser on a per click basis usually through the intermediary of an ad network. The advertisers and ad network operator have a number of safeguards in place to protect against click fraud. The bot tries to circumvent these by simulating normal human browsing behavior. This involves using a relatively low click rate and responding to redirects, cookies and scripting as would a regular browser. Despite this low profile, the bot operates 24 hour a day, seven days a week, so the bandwidth utilization for all that browsing adds up over time.

Kindsight Security Labs Malware Report Q2 2012

In one example we observed in the lab, a single bot consumed 0.1 Mbits/second when averaged out. For the infected consumer, this adds up to 32GBytes per month which it is the equivalent of downloading 45 full length movies. For the
x45 service provider, the impact on their network depends on the number of infected subscribers. The observed infection rate

for this bot was about 0.8% of the user population. This means that at any instant this bot alone is consuming 800 Mbits/ sec of bandwidth for every 1M users on the network.
1 Infected Subscriber = 32GB of downloads

x45

1 Infected Subscriber = 32GB of downloads

Service Provider with 1M users = 800 Mbits/sec

Flame is the latest espionage bot

In May 2012 a new espionage bot was discovered by the Iranian National CERT. Detailed analysis was made available from CrySyS Labs who refer to it as SkyWiper and Kaspersky who refer to it as Flame. Both drew parallels with the previous Stuxnet and Duqu malware. Flame is a large complex bot written in the Lua scripting language and Service Provider can spread via USB sticks or via file-sharing on a LAN. Kaspersky estimated in May that about 1000 computers in with 1M users 800 infected, the Middle East=wereMbits/sec mostly in Iran. This appears to be a highly targeted attack, focused on espionage and we have not seen any evidence of this infection in any Kindsight deployments.

DNSChanger is still making news

The FBI took down the DNSChanger domain name servers in November 2011, but despite that it continues to make the news. During Q2 2012, malware related to DNSChanger was consistently on our top 20 infection list. This is because infected computers remain infected even after the takedown. These computers will effectively lose Internet access if they are not fixed before the interim DNS service is decommissioned. The FBI and major security vendors have been working with service providers to get the infections resolved before the interim DNS servers were decommissioned on July 9th. These efforts have been partially successful and over the first half of the year the number of computers using the rogue DNS servers has been significantly reduced. However about 10% of the infected computers remain unfixed. In some cases, service providers have continued to route the traffic for infected computers so that the subscriber does not lose Internet connectivity and has more time to fix the problem. By working together, the industry did a good job of minimizing the number of affected homes.

Kindsight Security Labs Malware Report Q2 2012

Q2 2012 Mobile Malware Statistics

Mobile Device Infection Rates
In mobile networks we found that 0.7% of devices were infected. The infected devices include Android phones and laptops tethered to a phone or connected directly through a mobile hub/USB stick. The infection rate is low because the total device count includes a large number of feature phones that are not malware targets. We also saw a threefold growth in the number of Android malware samples.

Top Android Malware

The table below shows the top Android malware detected in the networks where the Kindsight Mobile Security solution is deployed. The following table shows the top 10 Android infections of Q2. Position
1 2 3 4 5 6 7 8 9 10

Name
Trojan.GGTracker Trojan.Pjapps3.A Spyware.MobileSpy Trojan.DroidDream Adware.SndApp.B BankingTrojan.FakeToken Trojan.Dogowar Spyware.FlexiSpy Trojan.Geimini.A Trojan.DroidKungFu

Android Malware Samples

OVER PREVIOUS QUARTER

300%

For the most part these are all trojanized apps that steal information about the phone or send SMS messages, but the list also includes a banking Trojan that intercepts access tokens for banking web sites and two spyware applications that are used to spy on family members or associates. The top 2 infections are the same as in the Q1 report and are covered in more detail there. Throughout Q2 Kindsight Security Labs continued to collect Android malware. Our sample library grew three-fold in that period.

Find and Call infects iPhones and Androids

After years with a solid security record, Apple was being hit a couple of times in Q2 2012. First Flashback infected the Mac and now it appears that an iPhone app called Find and Call uploads the users contact list to a remote server. The server then sends e-mail and text-message spam to the victims contacts. The messages are in Russian and encourage the recipient to download the app. The app has been removed from the Apple Store. There is also an Android version of the app.

Kindsight Security Labs Malware Report Q2 2012

Conclusion
In this report, we saw an increase in the number of home networks infected as compared to Q1/2012. We also saw a 0.7% infection rate for all devices on mobile networks but more concerning was the 3x increase in the number of Android malware samples. While it has not received the publicity of Flame, malware like the ZeroAccess botnet should be of more concern to consumers as it continues to grow to over 1 million super nodes. It tries to remain unobserved, uses P2P communications that changes to spread which makes it difficult to detect, and most importantly can generate enough ad-click traffic where it impacts bandwidth caps and costs the consumer money. This past quarter also confirmed that Apple is not immune to malware. For the first time ever, malware targeting the Macintosh platform, Flashback, was in the number one position on the Kindsight Security Labs home network infections list. And, an iPhone app called Find and Call uploads the users contact list to a remote server and then sends e-mail and text-message spam to the victims contacts. So while the increases in malware in this report are a concern, it is the types of malware that is driving this growth that is the thing to watch as we move into Q3.

Kindsight Security Labs Malware Report Q2 2012

About Kindsight Security Labs

Kindsight Security Labs focuses on the behavior of malware communications to develop network signatures that detect current threats with low false positives. This approach enables the detection of malware in the service provider network and the signatures developed form the foundation of Kindsight Security Analytics and Kindsight Security Services. To accurately detect that a user is infected, our signature set looks for network behavior that provides unequivocal evidence of infection coming from the users computer. This includes: Malware command and control (C&C) communications Backdoor connections Attempts to infect others (e.g. exploits) Excessive e-mail Denial of Service (DoS) and hacking activity

There are four main activities that support our signature development and verification process. 1. Monitor information sources from major security vendors and maintain a database of currently active threats. 2. Collect malware samples (>10,000/day), classify and correlate them against the threat database. 3. Execute samples matching the top threats in a sandbox environment and compare against our current signature set. 4. Conduct a detailed analysis of the malwares behavior and build new signatures if a sample fails to trigger a signature As an active member of the security community, Kindsight Security Labs also shares this research by publishing a list of actual threats detected and the top emerging threats on the Internet and this report.

Kindsight, Inc 755 Ravendale Drive, Mountain View, CA 94043 U.S.A 555 Legget Drive, Tower B, Suite 132, Ottawa, ON K2K 2X3 Canada
Copyright 2012 Kindsight, Inc. Kindsight is a registerd trademark of Kindsight, Inc. All rights reserved.

T: +1.650.969.7770

info@kindsight.net www.kindsight.net