Researchers Fingerprint Exploit Developers Who Help Several Malware Authors
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-7255 | Win32k Local Privilege Escalation in Windows Vista Through Windows 10 and Server 2016 CVE-2016-7255 is an elevation-of-privilege flaw in the Windows kernel-mode drivers (win32k), affecting Windows Vista SP2 through Windows 10 1607 and the corresponding Windows Server releases. A local attacker who can run a crafted application can leverage the bug — public exploits target the win32k NtSetWindowLongPtr code path — to execute code with elevated kernel privileges. Successful exploitation yields SYSTEM-level privileges, typically used to escape a restricted context or to chain with a separate code-execution bug for full system compromise, including ransomware deployment. Anyone running the affected Windows versions is exposed; the flaw was a zero-day actively exploited at the time of its November 2016 disclosure, with reporting tying use to the Sofacy/'Pawn Storm' APT and Google warning of active exploitation. It was added to CISA KEV on 2021-11-03 with known ransomware use, and EPSS currently puts the 30-day exploitation probability at 81%, so defenders should treat it as actively targeted. Do: Apply Microsoft's security update for CVE-2016-7255 (issued in the November 2016 Patch Tuesday cycle, bulletin MS16-135); on Windows 10 1507/1511/1607 this arrives via the corresponding monthly cumulative update. Prioritize patching internet-reachable servers and any system where unprivileged users can run code, since the flaw is used in the wild for post-exploitation privilege escalation (including ransomware chains per CISA KEV). After patching, hunt for suspicious local-to-SYSTEM activity around the disclosure window on legacy Windows Vista/2008/7/2012 estate that may still be running unpatched builds. | 7.8 | 81% | KEV ransomware PoC ×5 |
| masshundreds of millions of Windows PCs and servers (the listed versions dominated the global installed base at disclosure) | |
| CVE-2019-0859 | Local Privilege Escalation in Microsoft Win32k on Windows CVE-2019-0859 is an elevation of privilege vulnerability in the Win32k kernel component of Microsoft Windows, caused by the component failing to properly handle objects in memory. It is exploited locally: a low-privileged user or process already running on the machine can trigger the mishandling with no user interaction required, per the CVSS vector (AV:L/PR:L/UI:N). Successful exploitation elevates the attacker to kernel privileges, with high impact to confidentiality, integrity and availability, typically used to break out of user-level restrictions after an initial foothold. Any unpatched Windows 7, 8.1, RT 8.1, Windows 10 versions 1507 through 1809, or Windows Server 2008, 1709, or 1803 system is affected; the flaw was fixed in Microsoft's April 2019 security updates. It was reported as actively exploited when patched, was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, and carries an EPSS of 4.2% (90th percentile); no public PoC is known. Do: Apply Microsoft's April 2019 (or later) Windows security updates to all affected Windows 7, 8.1, RT 8.1, Windows 10 1507–1809, and Windows Server 2008/1709/1803 systems, per CISA's required action. Prioritize user-facing and shared systems (workstations, RDS/terminal servers, jump hosts) where an attacker is most likely to gain a local foothold, and verify patch levels through your update-management tooling. | 7.8 | 4% | KEV ransomware |
| mass≈hundreds of millions of Windows devices (Win32k ships in every install of the listed Windows versions, which spanned the bulk of Microsoft's >1-billion-device… |
Full article755 words · extracted from thehackernews.com · click to collapse
Writing advanced malware for a threat actor requires different groups of people with diverse technical expertise to put them all together. But can the code leave enough clues to reveal the person behind it?
To this effect, cybersecurity researchers on Friday detailed a new methodology to identify exploit authors that use their unique characteristics as a fingerprint to track down other exploits developed by them.
By deploying this technique, the researchers were able to link 16 Windows local privilege escalation (LPE) exploits to two zero-day sellers "Volodya" (previously called "BuggiCorp") and "PlayBit" (or "luxor2008").
"Instead of focusing on an entire malware and hunting for new samples of the malware family or actor, we wanted to offer another perspective and decided to concentrate on these few functions that were written by an exploit developer," Check Point Research's Itay Cohen and Eyal Itkin noted.
Fingerprinting an Exploit Writer's Characteristics
The idea, in a nutshell, is to fingerprint an exploit for specific artifacts that can uniquely tie it to a developer. It could be in using hard-coded values, string names, or even how the code is organized and certain functions are implemented.
Check Point said their analysis began in response to a "complicated attack" against one of its customers when they encountered a 64-bit malware executable that exploited CVE-2019-0859 to gain elevated privileges.
Noticing the fact that the exploit and the malware were written by two different sets of people, the researchers used the binary's properties as a unique hunting signature to find at least 11 other exploits developed by the same developer named "Volodya" (or "Volodimir").
"Finding a vulnerability, and reliably exploiting it, will most probably be done by specific teams or individuals who specialize in a particular role. The malware developers for their part don't really care how it works behind the scenes, they just want to integrate this [exploits] module and be done with it," the researchers said.
Interestingly, Volodya — likely of Ukrainian origin — has been previously linked to selling Windows zero-days to cyberespionage groups and crimeware gangs for anywhere between $85,000 to $200,000.
Chief among them was an LPE exploit that leveraged a memory corruption in "NtUserSetWindowLongPtr" (CVE-2016-7255), which has been widely used by ransomware operators like GandCrab, Cerber, and Magniber. It's now believed that Volodya advertised this LPE zero-day on the Exploit.in cybercrime forum in May 2016.
In all, five zero-day and six one-day exploits were identified as developed by Volodya over a period of 2015-2019. Subsequently, the same technique was employed to identify five more LPE exploits from another exploit writer known as PlayBit.
An Extensive Clientele
Stating the exploit samples shared code level similarities to grant SYSTEM privileges to the desired process, the researchers said, "both of our actors were very consistent in their respective exploitation routines, each sticking to their favorite way."
What's more, Volodya also appears to have switched up his tactics during the intervening years, with the developer shifting from selling the exploits as embeddable source code in the malware to an external utility that accepts a specific API.
Besides ransomware groups, Volodya has been found to cater to an extensive clientele, including the Ursnif banking trojan, and APT groups such as Turla, APT28, and Buhtrap.
"The APT customers, Turla, APT28, and Buhtrap, are all commonly attributed to Russia and it is interesting to find that even these advanced groups purchase exploits instead of developing them in-house," Check Point observed in its analysis. "This is another point which further strengthens our hypothesis that the written exploits can be treated as a separate and distinct part of the malware."
With cyberattacks expanding in scope, frequency, and magnitude, using an exploit developer's code signature as a means to track down bad actors could provide valuable insight into the black exploit market.
"When Check Point finds a vulnerability, we demonstrate its severity, report it to the appropriate vendor, and make sure it's patched, so it doesn't pose a threat," Cohen said. "However, for individuals trading these exploits, it's a completely different story. For them, finding the vulnerability is just the beginning. They need to reliably exploit it on as many versions as possible, in order to monetize it to a customer's satisfaction."
"This research provides insight into how that is achieved, and the buyers in this market, which often include nation-state actors. We believe that this research methodology can be used to identify additional exploit writers."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2020/10/exploit-development.html