ANTI-MALWARE.info | The Reference in Independent Anti-Malware Advice and Information
Subscribe | Log in

Blog

Regin, an old but sophisticated cyber espionage toolkit platform

Malware can be named in one breath with Stuxnet & Co.

Regin is one of the latest cyber espionage toolkits targeting a range or organizations, companies and individuals around the world. This malware is very sophisticated and it can mentioned in the same breath with other cyberespionage campaigns like Duqu, Stuxnet, Flame, Uroburos (aka Snake/Turla). First reported about by Symantec[1], Regin kept itself under the radar for years.

As G DATA experts worked on this rootkit for quite a while we also gathered some data. The first Regin version we identified was used in March 2009 and the compilation date is July 2008:

paul@gdata:~/regin$ ./pescanner.py b12c7d57507286bbbe36d7acf9b34c22c96606ffd904e3c23008399a4a50c047
Meta-data
================================================================================
File:    b12c7d57507286bbbe36d7acf9b34c22c96606ffd904e3c23008399a4a50c047
Size:    12608 bytes
Type:    PE32 executable (native) Intel 80386, for MS Windows
MD5:     ffb0b9b5b610191051a7bdf0806e1e47
SHA1:    75a9af1e34dc0bb2f7fcde9d56b2503072ac35dd
ssdeep:
Date:    0x486CBA19 [Thu Jul  3 11:38:01 2008 UTC]
EP:      0x103d4 .text 0/4

Some sources go even back to 2003 but this in unclear at this moment however we can confirm that this campaign appeared at least early 2009.

An Open Source detection tool provided by G DATA

We identified the use of an encrypted virtual file system. In the version mentioned above, the file system is a fake .evt file in %System%\config. The header of the virtual file system is always the same:

typedef struct _HEADER {
uint16_t SectorSize;
uint16_t MaxSectorCount;
uint16_t MaxFileCount;
uint8_t FileTagLength;
uint16_t crc32custom;
}

During our analysis, the checksum was a CRC32. A generic approach to detect the infection could be a detection of the existence of a virtual file system on the infected system by checking the custom CRC32 value at the beginning of the file system.
Download the python script by going to the original G DATA article (link see below).

regin-detect.py SHA256: 98ac51088b7d8e3c3bb8fbca112290279a4d226b3609a583a735ecdbcd0d7045
regin-detect.py MD5: 743c7e4c6577df3d7e4391f1f5af4d65

And here is the output when a virtual file system is scanned:
paul@gdata:~regin$ ./tool.py security.evt
SectorSize:  1000
MaxSectorCount:  0500
MaxFileCount:  0500
FileTagLength:  10
CRC32custom:  df979328
CRC of the file: df979328
Regin detected

Victims:

So far, victims of Regin were identified in 14 countries:

  • Algeria
  • Afghanistan
  • Belgium
  • Brazil
  • Fiji
  • Germany
  • Iran
  • India
  • Indonesia
  • Kiribati
  • Malaysia
  • Pakistan
  • Russia
  • Syria

Perhaps one of the most publicly known victims of Regin is Jean Jacques Quisquater, a well-known Belgian cryptographer. Kaspersky Lab stated this in their report which you can find at
securelist.com/blog/research/67741/regin-nation-state-ownage-of-gsm-networks/ .

Even more interesting is the fact that Regin seems to be the spyware behind the Belgacom case, a big Belgian Telecom provider hacked in 2013. Belgacom acknowledged the hack, but never provided details about the breach. Ronald Prins from Fox-IT, which helped with the forensics and investigation of the Belgacom case, confirmed on his Twitter page that Regin could possibly be the malware behind the Belgacom case.

The Intercept, a publication of First Look Media, not only connects Regin to Belgacom, but also names the European Union as potential victim in an article published on November 24th.
(more…)

The evolution of anti-virus solutions continues – Antivirus is not dead!

Anti-virus has evolved for the last 25 years and will continue to do so for the next 25 years

“Anti-virus is dead” – again. AV has been dying for the last decades. 15 years ago Dr. Alan Solomon, a highly respected security expert and founder of a pioneering anti-virus software company, made the same statement. AV also deceased when the first behavior-based products entered the market. Whenever there are new threats, the failure of AV products is pointed out and their critical illness is claimed. But – surprise, surprise – AV is still there!

Actually, this is exactly what Alan Solomon wanted to point out: AV is and always will be in an evolving state. He showed that the future of anti-virus programs would evolve, from pure signature-based detection to different kinds of technologies like heuristics and behavioral detection and even to more advanced protection methods. And now, with targeted attacks (aka APTs) and nation-state spying as new players in the threat landscape, AV is making another step in its evolution.

AV solutions are an important layer in the defense for enterprises

So what is it about this time? A couple of days ago, it was Brian Dye, Senior Vice President of Information Security at Symantec, who has claimed that anti-virus is dead, during an interview with The Wall Street Journal. Unfortunately though, the headline “AV is dead” has the potential to be misinterpreted by a wide audience, if it is put in another context.
The statement was part of a description of Symantec’s product strategy for business customers. It is nothing new that AV-solutions are a baseline protection against common threats. They are established and therefore only play a minor role when it comes to outlining the strategic aspects of upcoming security solutions for dedicated attacks. And in the complex environment of a company network, a wide range of special protections are at charge. But Dye’s statement never meant to say that AV products are useless. He just said that it needs more than an AV product to protect a company’s IT infrastructure. And this is undoubtedly true. (more…)

IoT: The Internet of Things… ehm… Trouble?!

A balancing act between usability and security

It is 20 years ago that I first included a slide in my presentation about sending spam via a refrigerator. At the time, most people found that ridiculous. Yet last year, it became a reality. Refrigerators have now become ‘smart’ and can do a whole lot more than just keep things cool.

The Internet of Things (IoT) gives everything an IP address so that everything can communicate with more or less anything and anyone else. The benefits and possibilities are almost infinite. But aren’t these technological developments evolving rapidly, maybe too rapidly? Smart TVs, gaming consoles, tablets, smartphones and cars can eavesdrop on us. Cameras in your laptop, smartphone and smart TV can watch us when we don’t want them to. Samsung is amending its user agreements to reassure people about the voice control on its smart TVs. BMW is rolling out a software update for the ConnectedDrive system in 2.2 million cars to prevent hackers easily being able to open the doors of the cars. These are the first signs that possibly too much has been started without reflection.

(more…)