Amieltech LLC

Technical Support

Windows, Linux, BSD, Cisco

Contact: Amiel

Phone : 678-292-3086

Email : mail at amieltech.com

pk (cell/tablet): 70adde25964610fd

pk (offline): FAB2AEDD5E7F3F71

TA16-336A: Avalanche (crimeware-as-a-service infrastructure)

Original release date: December 01, 2016 | Last revised: December 14, 2016

Systems Affected

Microsoft Windows

Overview

“Avalanche” refers to a large global network hosting infrastructure used by cyber criminals to conduct phishing and malware distribution campaigns and money mule schemes. The United States Department of Homeland Security (DHS), in collaboration with the Federal Bureau of Investigation (FBI), is releasing this Technical Alert to provide further information about Avalanche.

Description

Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to victims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive personal information stolen (e.g., user account credentials). Victims’ compromised systems may also have been used to conduct other malicious activity, such as launching denial-of-service (DoS) attacks or distributing malware variants to other victims’ computers.

In addition, Avalanche infrastructure was used to run money mule schemes where criminals recruited people to commit fraud involving transporting and laundering stolen money or merchandise.

Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies.

The following malware families were hosted on the infrastructure:

Avalanche was also used as a fast flux botnet which provides communication infrastructure for other botnets, including the following:        

Impact

A system infected with Avalanche-associated malware may be subject to malicious activity including the theft of user credentials and other sensitive data, such as banking and credit card information. Some of the malware had the capability to encrypt user files and demand a ransom be paid by the victim to regain access to those files. In addition, the malware may have allowed criminals unauthorized remote access to the infected computer. Infected systems could have been used to conduct distributed denial-of-service (DDoS) attacks.

Solution

Users are advised to take the following actions to remediate malware infections associated with Avalanche:

          ESET Online Scanner

          https://www.eset.com/us/online-scanner/  

          F-Secure

          https://www.f-secure.com/en/web/home_global/online-scanner

          McAfee Stinger

          http://www.mcafee.com/us/downloads/free-tools/index.aspx

          Microsoft Safety Scanner

          https://www.microsoft.com/security/scanner/en-us/default.aspx

          Norton Power Eraser

          https://norton.com/npe

         Trend Micro HouseCall

          http://housecall.trendmicro.com/

References

Revision History


This product is provided subject to this Notification and this Privacy & Use policy.


TA16-288A: Heightened DDoS Threat Posed by Mirai and Other Botnets

Original release date: October 14, 2016 | Last revised: November 30, 2016

Systems Affected

Internet of Things (IoT)—an emerging network of devices (e.g., printers, routers, video cameras, smart TVs) that connect to one another via the Internet, often automatically sending and receiving data

Overview

Recently, IoT devices have been used to create large-scale botnets—networks of devices infected with self-propagating malware—that can execute crippling distributed denial-of-service (DDoS) attacks. IoT devices are particularly susceptible to malware, so protecting these devices and connected hardware is critical to protect systems and networks.

Description

On September 20, 2016, Brian Krebs’ security blog (krebsonsecurity.com) was targeted by a massive DDoS attack, one of the largest on record, exceeding 620 gigabits per second (Gbps).[1 (link is external)] An IoT botnet powered by Mirai malware created the DDoS attack. The Mirai malware continuously scans the Internet for vulnerable IoT devices, which are then infected and used in botnet attacks. The Mirai bot uses a short list of 62 common default usernames and passwords to scan for vulnerable devices. Because many IoT devices are unsecured or weakly secured, this short dictionary allows the bot to access hundreds of thousands of devices.[2 (link is external)] The purported Mirai author claimed that over 380,000 IoT devices were enslaved by the Mirai malware in the attack on Krebs’ website.[3 (link is external)]

In late September, a separate Mirai attack on French webhost OVH broke the record for largest recorded DDoS attack. That DDoS was at least 1.1 terabits per second (Tbps), and may have been as large as 1.5 Tbps.[4 (link is external)]

The IoT devices affected in the latest Mirai incidents were primarily home routers, network-enabled cameras, and digital video recorders.[5 (link is external)] Mirai malware source code was published online at the end of September, opening the door to more widespread use of the code to create other DDoS attacks.

In early October, Krebs on Security reported on a separate malware family responsible for other IoT botnet attacks.[6 (link is external)] This other malware, whose source code is not yet public, is named Bashlite. This malware also infects systems through default usernames and passwords. Level 3 Communications, a security firm, indicated that the Bashlite botnet may have about one million enslaved IoT devices.[7 (link is external)]

Impact

With the release of the Mirai source code on the Internet, there are increased risks of more botnets being generated. Both Mirai and Bashlite can exploit the numerous IoT devices that still use default passwords and are easily compromised. Such botnet attacks could severely disrupt an organization’s communications or cause significant financial harm.

Software that is not designed to be secure contains vulnerabilities that can be exploited. Software-connected devices collect data and credentials that could then be sent to an adversary’s collection point in a back-end application.

In late November 2016, a new Mirai-derived malware attack actively scanned TCP port 7547 on broadband routers susceptible to a Simple Object Access Protocol (SOAP) vulnerability. [8 (link is external)] Affected routers use protocols that leave port 7547 open, which allows for exploitation of the router. These devices can then be remotely used in DDoS attacks. [9, 10 (links are external)]

Solution

Cybersecurity professionals should harden networks against the possibility of a DDoS attack. For more information on DDoS attacks, please refer to US-CERT Security Publication DDoS Quick Guide and the US-CERT Alert on UDP-Based Amplification Attacks.

Mitigation

In order to remove the Mirai malware from an infected IoT device, users and administrators should take the following actions:

Preventive Steps

In order to prevent a malware infection on an IoT device, users and administrators should take following precautions:

References

Revision History


This product is provided subject to this Notification and this Privacy & Use policy.




Atlanta Computer Repair Center, Metro Atlanta Computer Repair, Data Recovery, Atlanta Computer Service, Computer Troubleshooting, hardware upgrades, Wireless Internet, Wireless Network, Home Office Computer Setup, Atlanta Computer Repair Center, Providing On-Site Computer Repairs, Virus Removals, Data Recovery, Computer Upgrades in the Metro Atlanta Areas, Atlanta's Premier Laptop Repairs. We Build Custom Computers, Wireless Networking, Data Recovery, and Virus / Spyware Removals. Serving the entire Metro Atlanta Area. Home or Office Computer Repair, Virus Removal, Hardware Installations, Software Installations, Windows XP Troubleshooting, Printer Troubleshooting, Wireless Networking, Wireless Internet, Virus Protection, Speed up Computer, Acworth computer repair, Alpharetta computer repair, Atlanta computer repair, Buckhead computer repair, Chamblee computer repair, Doraville computer repair, Kennesaw computer repair, Marietta computer repair, Norcross computer repair, Roswell computer repair, Sandy Springs computer repair, Windows, Smyrna computer repair, Woodstock computer repair, Linux, Debian Linux, Treasure Coast Ubuntu, dell computer repair, HP computer repair, Compaq computer repair, Toshiba computer repair, Sony computer repair, Samsung computer repair, Gateway computer repair, Emachines computer repair, IBM computer repair, Acer computer repair, Computer, repair, repairs, service, pc repairs, custom, system, pc, onsite, home, repairs, help, guru, business, company, technician, network, crash, maintenance, contract, repairs, virus repair, treasure coast computer repair, virus removal, preventive maintenance, tech support, Open BSD, computer cleaning service, at home, Free BSD, service center, repair price, on site, specialist, compaq, dell, gateway, upgrade, upgrades, in home, support, search engine guru, on-site, cpu, amiel, amiel summers, business, georgia, east atlanta, fulton county,cobb county, dekalb county,atlanta, GA

¹²³