Around July last year, more than a 100 Israeli servicemen were hit by a cunning threat actor. The attack compromised their devices and exfiltrated data to the attackers’ command and control server. In addition, the compromised devices were pushed Trojan updates, which allowed the attackers to extend their capabilities. The operation remains active at the time of writing this post, with attacks reported as recently as February 2017.
The campaign, which experts believe is still in its early stages, targets Android OS devices. Once the device is compromised, a process of sophisticated intelligence gathering starts, exploiting the ability to access the phone’s video and audio capabilities, SMS functions and location.
The campaign relies heavily on social engineering techniques, leveraging social networks to lure targeted soldiers into both sharing confidential information and downloading the malicious applications.
Characterized by relatively unsophisticated technical merit, and extensive use of social engineering, the threat actor targets only IDF soldiers.
IDF C4I & the IDF Information Security Department unit, with Kaspersky Lab researchers, have obtained a list of the victims; among them IDF servicemen of different ranks, most of them serving around the Gaza strip.Attack Flow
The operation follows the same infection flow across the different victims:
Figure 1: Campaign’s attack flowSocial Engineering
The threat actor uses social engineering to lure targets into installing a malicious application, while continuously attempting to acquire confidential information using social networks. We’ve seen a lot of the group’s activity on Facebook Messenger. Most of the avatars (virtual participants in the social engineering stage) lure the victims using sexual innuendo, e.g. asking the victim to send explicit photos, and in return sending fake photos of teenage girls. The avatars pretend to be from different countries such as Canada, Germany, Switzerland and more.Dropper
After the victim downloads the APK file from the malicious URL, the attacker expects the victim to install the package manually. The dropper requires common user permissions as shown in the following screenshot.
Figure 2: Dropper permissions once installed on a victim mobile deviceKey features
The dropper relies on the configuration server which uses queries in order to download the best fitting payload for the specified device.
- Downloader & Watchdog of the main payload
- Payload update mechanism
- Customized payload – the dropper sends a list of installed apps, and receives a payload package based on it
- Obfuscation – The dropper package is obfuscated using ProGuard, which is an open source code obfuscator and Java optimizer, observed in the LoveSongs dropper.
The network protocol between the dropper and the configuration server is based on HTTP POST requests. The following servers implement a RESTful API:
LoveSongs – http://endpointup[.]com/update/upfolder/updatefun.php
YeeCall, WowoMessanger – http://droidback[.]com/pockemon/squirtle/functions.php
Figure 3: Communication with C&C server over HTTP
Most of the communication with the server is in clear-text, except for specific commands which are encrypted using an AES-128 hard coded-key.
Figure 4: WowoMessanger REST-API POST packet capture
Figure 5: Fake WowoMessanger app – logic flow
Along with an ID existence check, the dropper sends a list of the device’s installed apps – if it hasn’t done so already.
The flow between different variants of the dropper is similar, with minor changes. One variant pretends to be a YouTube player, while others are chat apps:
LoveSongs has YouTube player functionality, whereas WowoMessanger does not have any legitimate functionality whatsoever; it erases its icon after the first run.Payload
The payload is installed after one of the droppers mentioned above has been downloaded and executed on the victim device. The only payload we have seen so far is “WhatsApp_Update”.
The payload is capable of two collection mechanisms:
- Execute “On demand” commands – manual commands that are triggered by the operator
- Scheduled process – scheduled tasks that collect information periodically from various sources.
Most of the collected data will be sent only when a WI-FI network is available.C&C Commands
The payload uses the WebSocket protocol, which gives the attacker a real-time interface to send commands to the payload in a way that resembles ‘reverse shell’. Some of the commands are not yet implemented (as shown in the table below). The commands gives the operator basic yet dangerous RAT capabilities:
- Collect general information about the device e.g. Network operator, GPS location, IMEI etc.
- Open a browser and browse to a chosen URL
- Read & send SMS messages, and access contacts
- Eavesdrop at a specific time and period
- Take pictures (using the camera) or screenshots
- Record video and audio.
*Commands which were implemented are in bold.Scheduled Process
Besides the C&C commands, the payload periodically collects data using various Android APIs. The default time interval is 30 seconds. The process collects the following data:
- General data about the device (as mentioned in the C&C command)
- SMS messages, WhatsApp database along with the encryption key (requires root permissions which is not yet fully implemented)
- Browsing & search history along with bookmarks
- Documents and archives ( < 2MB ) found in storage (doc, docx, ppt, rar, etc)
- Pictures taken, auto captures while on an active call
- List of contacts and call logs
- Records calls and eavesdrops
- Updates itself
The attackers implemented all of the malicious logic without any native or third-party sources. The logic behind the automatic call-recording feature is implemented entirely using Android’s API.
Figure 6: Call-Recording implementation in WhatsApp_updateConclusions
The IDF, which led the research along with Kaspersky Lab researchers, has concluded that this is only the opening shot of this operation. Further, that it is by definition a targeted attack against the Israeli Defense Force, aiming to exfiltrate data on how ground forces are spread, which tactics and equipment the IDF is using and real-time intelligence gathering.
Kaspersky Lab GReAT researchers will disclose more behind-the-scenes details of the operation at the upcoming Security Analyst Summit.IOCs Domain names & APK hashes
Yahoo has sent out another round of notifications to users, warning some that their accounts may have been breached as recently as last year. The accounts were affected by a flaw in Yahoo's mail service that allowed an attacker—most likely a "state actor," according to Yahoo—to use a forged "cookie" created by software stolen from within Yahoo's internal systems to gain access to user accounts without a password.
Yahoo informed some users in e-mails this week that "Based on the ongoing investigation, we believe a forged cookie may have been used in 2015 or 2016 to access your account." The messages are regarding possible breaches using the cookie vulnerability in 2014.
The Associated Press' Raphael Satter reports that a Yahoo spokesperson acknowledged the company was notifying users of the potential breach of their accounts, but would not disclose how many users were affected.
News in brief: Nokia to reboot iconic phone; AI assistants set to do voice calls; Yahoo, Verizon ‘agree price’
Two Republican members of Congress sent a formal letter Tuesday to the Environmental Protection Agency’s Office of the Inspector General, expressing concern that “approximately a dozen career EPA officials” are using the encrypted messaging app Signal to covertly plan strategy and may be running afoul of the Freedom of Information Act.
The open source app has gained renewed interest in the wake of the election of President Donald Trump.
As Ars has reported previously, all Signal messages and voice calls are end-to-end encrypted using the Signal Protocol, which has since been adopted by WhatsApp and other companies. However, unlike other messaging apps, Signal’s maker, Open Whisper Systems, makes a point of not keeping any data, encrypted or otherwise, about its users. (WhatsApp also does not retain chat history but allows for backups using third-party services, like iCloud, which allows for message history to be restored when users set up a new device. Signal does not allow messages to be stored with a third party.)
The letter was written by Rep. Lamar Smith (R-Texas) and Rep. Darin LaHood (R-Ill.), who are the chair of the Committee on Science, Space, and Technology and the chair of the subcommittee on Oversight, respectively.
The congressmen note that the EPA has previously examined employee use of text messages to conduct government business and found that only a minuscule fraction of those messages was retained under FOIA.
“Not only does this demonstrate the vast issues presented with using text messages to conduct official business, but raises additional concerns about using messaging applications to conduct official business, which make it virtually impossible for the EPA to preserve and retain the records created in this manner to abide by federal record-keeping requirements,” they concluded.
The two republicans gave the agency until February 28 to respond.
The EPA OIG did not immediately respond to Ars’ request for comment.
UPDATE 5:49pm ET: Jennifer Kaplan, Deputy Assistant Inspector General for Congressional and Public Affairs, e-mailed: "In response to your inquiry below, the EPA OIG takes all congressional requests seriously. This request is under review by the Inspector General and his senior leadership team."