Frankenstein Malware

Frankenstein Malware Extra Credit Blog Post

Crystal Hansen for CIS 127

                Frankenstein Malware is a method of malware creation deliberately designed to slip past anti-virus/anti-malware software.  The intention, I believe, is to discover and create a new and stronger potential threat so that we can find the tools to combat it, and secure our systems. 

                It’s built upon past obfuscation methods, and pieced together using prior work, but in a different way, with differing results.   There’s more to it than that, as Vishwath Mohan and Kevin W. Hamlen, from the University of Dallas, Texas, School of Electrical and Computer Science, explain in their paper.  This research was funded in part by the Air Force and National Science Foundation.  There is a footnote included though, that the contents of their paper in no way expressed the views of either of these institutions.

                In very simple terms, Frankenstein uses code, binaries, and “gadgets” already on a computer (legitimate programs) to piece together malware that goes undetected.  If a program is considered benign, Frankenstein can use pieces of it and others like it to stitch together a mutant.  This technique relies primarily on return-oriented programming for gadget discovery.  Their definition of a gadget here is “any sequence of bytes that are interpretable as valid x86 instructions” ( (Mohan and Hamlen 2).

They found that only a very small number of binaries from sys32 folder in Windows was enough to yield a diverse amount of gadgets.  Diversity is key since the point is to blend in with as many benign codes as possible. 

For each successful gadget assignment, Frankenstein masks
all external calls in the code by converting them into computed
jumps. As a result, Frankenstein’s mutants have no noteworthy
system calls in their import address tables, concealing them
from detectors that rely upon such features for fingerprinting.
The last step is injecting the finished code into a correctly
formatted binary so it can be propagated. Frankenstein has a
binary parsing component and a seed binary that it uses as a
template. For each mutant, it injects the code into the template
file and updates all relevant metadata in the header. At this
point the new mutants are natively executable programs (5).

The size of these mutant programs ends up being almost double the original versions but if they can still go undetected, I suppose that would be worth it.  That is, if you think creating a mutant malware is worth it.  I assumed they called it Frankenstein because it’s an attention grabber even for people who have never read the actual book.  The scientist who created the creature (in this case our mutant malware), was Frankenstein, and the creature was nameless.  He was stitched together as well from harmless parts.  At first, he was harmless himself, but enormous and frightening.  The fear, I suppose it that this, too, can get out of hand and become yet another security threat that we might have trouble combatting. 

Hamlen and Vishwath would be the Frankenstein scientists here, and their malware formula would be the creature we’ll just have to wait and see about.  I do doubt that it will take over.  If you can make it, you can unmake it, and assessing security threats and how to combat them, especially potential security threats, to get ahead of the game, is a work worth pursuing. 

Works Cited

Mohan, Vishwath and Kevin W. Hamlen. Frankenstein: Stiching Malware from Benign Binaries. Paper. Berkeley: USENIX, 2012. PDF. 25 Oct 2015. <https://www.usenix.org/conference/woot12/workshop-program/presentation/Mohan>.

Fake Anti-Virus Software: The Scam is Real

                My name is Crystal Hansen and this is a class project on the article, “The Underground Economy of Fake Antivirus Software", an investigative report on a type of scareware in the form of fake anti-virus software.  This article was a collaborative effort between the Dept. of Computer Science and the Dept. of Economics at the University of California, Santa Barbara, with funding and grants from the Office of Naval Research, the National Science Foundation, and by Secure Business Austria. 

                The majority of their investigation revolved around the financial aspects of three fraudulent anti-virus companies that were surprisingly sophisticated in their methods.  This would have to be so, though, wouldn’t it, for the venture to be lucrative and stay lucrative.  These companies could not be revealed by name due to ongoing investigations that I’m sure will result in some criminal charges.  Unfortunately, not all involved are likely to be caught, and if there’s still a market for fraud, more will “pop up” to take the places of ones that get shut down.  I do believe that additional research, education of computer users, vigilant credit card companies, and more sophisticated FREE anti-virus and browser plug-ins will see this tapering off.  Thanks, in part, to this article.
                The researchers obtained access to three major fraudulent anti-virus companies’ back-servers by utilizing ANUBIS to analyze unique signatures used by fake AV software.  Anyone can go to https://anubis.iseclab.org/ and get any suspicious Windows or Android program analyzed for malware.  Give them a URL and receive a report on exactly what it does in Internet Explorer.  Some pages contain malicious scripts, but we will get to that in a bit.  The researchers found similar signatures in fake AV software.  They then contacted the servers these companies were using, submitted their evidence, and were gladly handed over information that was further analyzed and went into the making of this one-of-a-kind article.

                The internet can be a dangerous and costly place for the uninformed and trusting.  These people are often target victims for tech-savvy cybercriminals.  I’ve often wondered why someone would bother to make a virus, send spam, or want to shut down, modify, or disrupt anyone else’s computer.  When it’s not just a prank, it’s all about the money.  To make it work, though, you need the cooperation of other unscrupulous services (some, partially legitimate businesses), and people.  I’ll try to highlight a few of the concepts, and add my own thoughts as well.

                First, what IS a fake anti-virus program?  It’s malware that, once on your machine, sends multiple notifications of various virus detections.  The only virus is this rogue security software itself.  I’ve actually come across one of these on a friend’s laptop.  I considered it a virus and ended up reverting to factory condition, wiping everything.  It went a little something like this:  When you boot up, a lower-right message pop-up that appeared to be from Windows (she was running Vista), would say that a virus was detected and a scan must be run.  Here’s an example from the article that closely resembles what I saw:

                Now, since I didn’t know much at the time, and she had brought it to me saying she had a virus, I ran the program.  It pretended to scan, but all other anti-virus programs and even Firefox, the internet, were locked down and unusable.  This is what’s called a DoS attack (denial-of-service), but its purpose was to keep me from looking up the program or using a real anti-virus to get rid of this fake AV.  I do not know how she got it, and I don’t recall it asking for money, but I was too busy trying to get rid of it to notice.  There are numerous ways a program like this one can slither its way onto your computer.  Conversely, there are very simple things you can do (or not do) to prevent this. 

                Some nefarious websites will display “pop-ups” that look much like the above picture, or maybe a simple clickable text box.  They will claim your computer is infected and if you click, the fake AV is executed and installed on your computer.  This is “social-engineering” and scareware is an apt name for it.  It’s aimed at users who are concerned about viruses and privacy, but uninformed and so, vulnerable. 

                A slightly more concerning method is a “drive-by-download”, where script in the webpage is designed to install the fake software without your knowledge.  (That is what I was referring to when discussing Anubis.)  This technique exploits vulnerabilities in your web browser or a plug-in, so it’s a very good idea – in fact, it’s a MUST – that you make sure your browser is updated, as well as any plug-ins.  Do not use Internet Explorer to surf the web.  Use it only to download Chrome or Firefox and set that as your default browser.  In their study of scam victims, the majority were using Internet Explorer 7.  The manipulation of search engine results using Blackhat SEO’s and TDS to get a person to their page with the malicious script isn’t an issue if you use an anti-virus that gives you a level of safety icon next to each search result.  The SEO's are designed to get pages filled with popular search terms to rank higher on your search engine list.  Once clicked, TDS will redirect you to their pages.  Botnets are yet another way, but if your computer is already a zombie (bot – part of the bot-network and under someone else’s control through a “back-door”, remotely), then a fake AV is maybe the least of your worries.  Unless you’re desperate enough to fix your machine that you DO pay for it.  I imagine that happens a lot more than I’d like and it IS listed as a large source of revenue. 

                If you take nothing else from my post, please let it be this: ignore ads.  All of them.  On the sides, top, or bottom of your screen, at the top of your email inbox, the 1^st or 2^nd option in a google search – ignore it.  Background noise.  You will see things that you’ve been looking for online, because of cookies, and these may be legitimate ads, but ignore it anyway.  Do not click on any ads for free porn, games, or singles near you – just don’t do it.  Some of these ads are links to these fake AV’s, or worse.

                The one thing that did surprise me at first was that people were actually willing to pay for these anti-viruses that had just shown up on their computer.  The revenue will stun you.  Then I thought of who these people probably were, and I got angry.  Not at them, but at how downright awful people can be to each other and the lengths they’ll go to in perpetrating theft.  These are charts of the revenue made by these three large fraudulent companies in the time-span that the authors had access to their back-servers.  The money is in exponential USD:

                This brings us to what keeps them in business.  Once a customer realizes that they’ve been scammed, they generally get very angry and want their money back.  Makes sense, right?  All three offered “customer service” and “tech support”, in an effort to look like a legitimate business, and to perhaps dissuade upset people from getting a chargeback issued from their credit card. 

                Chargebacks are bad for business.  These questionable businesses use payment processors (also questionable, but with a fraction of legitimacy) to handle credit card transactions.  If a company is getting too many in too short of a time period, then major credit cards will stop doing business with them.  This is not in any fraudster’s best interest.  So, rather, the fake AVs more apt to issue refunds.  It may seem counterintuitive for someone tricking you out of your money to just give it back, but in reality, it makes good (or bad, depending on how you look at it) business sense.  Below is another chart depicting the three companies’ rates of chargebacks vs refunds:

Notice how much higher that dashed blue line is compared to the red, and how they seem to correspond.  To stay afloat, they have to keep their amount of chargebacks under a certain limit, by tempering them with refunds.  Nevertheless, the article reports that less than 10% of victims actually sought refunds.  The payment processors can charge a high commission for their part in this risky business.  If the fake AV company goes down, they’re liable to be left handing out the refunds themselves. 

                Fake AV companies must open many bank accounts under what’s known as Shell companies (about as real as their anti-virus programs), and rotate the deposit and withdrawal from each, so as to avoid suspicion.  Here is a flow-chart model of the structure and movement of funds that might make it clearer:

                More involved than you thought, right?  I suspect this is how most nefarious internet based scams work.  There are more of them out there and of different types.

                Technological and information literacy is CRUCIAL to protecting yourself.  If you know or have an older relative unfamiliar with their new computer, set it up for them and explain the ways firewalls and pop-up blockers work.  Explain about the ads and not to click or open attachments, or run programs that they didn’t install.  Aside from a reputable anti-virus, that is.  There are many free ones out there, and with a little googling, you can find a good one.  I’m not going to be a shill for the one I use.  Read reviews, do your research.  Just because the option is there to upgrade for a fee, doesn’t mean you have to do it.  If the program is nagging you too much, choose another.  Don’t expect that Windows Defender will be enough.  Still, don’t run two downloaded AVs at the same time.  You won’t be doubly protected; they’ll just get in each other’s way and report quarantined files, or updated virus lists.  Have your AV auto-update, as often as possible.   It shouldn’t slow your machine down; runs in the background. 

                That is all the advice I have for now on this subject.  You don’t have to be a victim.  Stay safe out there!

Works Cited

Stone-Gross, Brett, et al. "The Underground Economy of Fake Antivirus Software."

         Department of Computer Science and Department of Economics,

         University of California, Santa Barbara (2011): n. pag. Web. 24 Sept 2015.

        <http://www.cs.ucsb.edu/~chris/research/doc/weis11_fakeav.pdf>.