SWIFT a global provider of secure financial messaging services. He is the big brother in the financial world which facilitates 24-hour secure international exchange of payment instructions between banks, central banks multinational corporations, and major securities firms. He meet his enemy in 21st century, everybody knew it is block chain technology, simple to say it is bit coins, right? However his enemy not limit to block chain technology, noticed that a new born malware was attacks swift member network last month (Oct 2016). The nick name is odinaff.

Technical specification:

malware checksum SHA256: fbede281f54108136a6c73fec7d45386a803793b2a92964ec5355babe6127eec
File name: odinaff_payload.exe [12.0 KB ( 12288 bytes )]

Oh! The payload only 12kb. Security guru you must pay extra attention. My personal comment is that this is a advance type malware, since 30 antivirus vendor can detect this payload. The malware authors will make minor changes or repackage their malware every few days to thwart detection via MD5 checksum or antivirus, and in some cases the malware is repackaged daily. Therefore, often times new samples may not be detected. To be honest, only 12Kb it is easy to repackage.

For correct detect this malware on your malware detector, below details is the pattern for your reference.

Reference: Yara rule

/*
    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.

*/

import "pe"

rule Odinaff_swift : malware odinaff swift raw{
        meta:
                author = "_____"
                date = "2016/10/27"
                description = "Odinaff malware"
                reference = "https://www.symantec.com/security_response/writeup.jsp?docid=2016-083006-4847-99"
                filetype = "binary"

        strings:

                $s1 = "getapula.pdb"
                $i1 = "wtsapi32.dll"
                $i2 = "cmpbk32.dll"
                $i3 = "PostMessageA"
                $i4 = "PeekMessageW"
                $i5 = "DispatchMessageW"
                $i6 = "WTSEnumerateSessionsA"

        condition:
                ($s1 or pe.exports("Tyman32")) and (2 of ($i*))
}

News update on SWIFT:

It looks that SWIFT top management aware the criticality of risk.  To ensure adoption, SWIFT will start requiring customers to provide detailed self-attestation against the mandatory controls from Q2 2017

Begin Enforcing Mandatory Security Controls

1. Restrict Internet Access and Segregate Critical Systems from General IT Environment
1.1 SWIFT Environment Segregation A segregated secure zone safeguards the local SWIFT infrastructure from compromises and attacks from the broader enterprise and external environment.

1.2 Operating System Privileged Account Control

Access to local operating system accounts with system-level administrative rights is restricted to the maximum extent possible. Usage is controlled, monitored, and only permitted for relevant activities such as software installation and configuration, maintenance, and emergency activities. At all other times, the accounts are restricted from being accessed.

2. Reduce Attack Surface and Vulnerabilities

2.1 Internal Data Flow Security
Confidentiality, integrity, and authentication mechanisms are implemented to protect SWIFT data flows within the secure zone, and its link to the user PCs.

2.2 Security Updates All hardware and software inside the secure zone and on user PCs are within the support lifecycle of the vendor, have been upgraded with mandatory software updates, and have had security updates promptly applied.
2.3 System Hardening Security hardening is conducted on all systems and infrastructure within the secure zone and on user PCs.

3. Physically Secure the Environment
3.1 Physical Security Physical security controls are in place to protect access to sensitive equipment, hosting sites, and storage.

4. Prevent Compromise of Credentials
4.1 Password Policy All application and operating system accounts enforce passwords with appropriate parameters such as length, complexity, validity, and the number of failed login attempts.
4.2 Multi-factor Authentication Multi-factor authentication is used for interactive user access to SWIFT-related applications and operating system accounts.

5. Manage Identities and Segregate Privileges
5.1 User Account Management Accounts are defined according to the security principles of need-to-know access, least privilege, and segregation of duties.
5.2 Token Management Authentication tokens are managed appropriately during issuance, revocation, use, and storage.

6. Detect Anomalous Activity to Systems or Transaction Records
6.1 Malware Protection Anti-malware software from a reputable vendor is installed and kept up-to-date on all systems.
6.2 Software Integrity A software integrity check is performed at regular intervals on messaging interface, communication interface, and other SWIFT-related applications.

6.3 Database Integrity
A database integrity check is performed at regular intervals on databases that record SWIFT transactions.
6.4 Logging and Monitoring Capabilities to detect anomalous activity are implemented, and a process or tool is in place to frequently store and review logs.

7. Plan for Incident Response and Information Sharing
7.1 Cyber Incident Response Planning The organisation has a defined cyber incident response plan.
7.2 Security Training and Awareness Annual security awareness sessions are conducted for all staff members, including role-specific training for SWIFT roles with privileged access.
Advisory Security Controls
2. Reduce Attack Surface and Vulnerabilities
2.4A Back Office Data Flow Security Confidentiality, integrity, and authentication mechanisms are implemented to protect data flows between back office systems or middleware and the secure zone.

2.5A External Transmission Data Protection
Sensitive data leaving the secure zone is encrypted.

2.6A User Session Integrity
The integrity and confidentiality of interactive user sessions connecting to the secure zone are safeguarded.
2.7A Vulnerability Scanning
Vulnerability scanning is conducted within the secure zone and on user PCs using an up-to-date industry-standard scanning tool.

2.8A Critical Activity Outsourcing
Critical outsourced activities are protected, at a minimum, to the same standard of care as if operated within the originating organisation.

2.9A Transaction Business Controls
Restrict transaction submission and receipt to the expected bounds of normal business.
5. Manage Identities and Segregate Privileges

5.3A Personnel Vetting Process
Staff operating the locally hosted SWIFT infrastructure are vetted prior to initial employment in that role and periodically thereafter.

5.4A Physical and Logical Password Storage
Any recorded passwords for privileged accounts are stored in a protected physical or logical location, with access restricted on a need-to-know basis.

6. Detect Anomalous Activity to Systems or Transaction Records
6.5A Intrusion Detection
Intrusion detection is implemented to detect unauthorised network access.

7. Plan for Incident Response and Information Sharing
7.3A Penetration Testing
Application, host, and network penetration testing is conducted at least annually within the secure zone and on user PCs.

7.4A Scenario Risk Assessment
Scenario-driven risk assessments are conducted regularly to improve incident response preparedness and to increase the maturity of the organisation’s security programme.

Few days ago, Linux world found potential vulnerability. A memory resources management , a technique so called COW (Copy-on-write) struggles IT world. The problem was that an unprivileged local user could use this bug to gain write access to additional read-only memory mappings. And thus execute a privilege escalation.

What is Copy-on-write memory structure?

Copy-on-write finds its main use in sharing the virtual memory of operating system processes.

Does it make whether apply to all computer OS system?

Typically the system structure involve fork system call are the Unix and Linux OS system – The fork() System Call .

Remark: In Linux, the key data structure is the struct task_struct. This contains pid (the thread ID), tgid (the process ID), and pointers to the parent process’s task_struct.

What is fork() system Call?

System call fork() is used to create processes. It takes no arguments and returns a process ID. The purpose of fork() is to create a new process, which becomes the child process of the caller. After a new child process is created, both processes will execute the next instruction following the fork() system call.

Major flaw of implicit sharing or shadowing (Copy-on-write)

The key to implementing direct I/O in the 2.6 kernel is a function called get_user_pages. But get_user_pages () do not check pte_dirty() bit properly.

Vulnerability found by Linus Torvalds. For more detail, please refer below url for reference.

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619

How about Cloud computing architecture? Does it impact by similar flaw?

Since the flaw found on Unix or Linux base machine, a Linux based hypervisor have inherent risk before patch. It looks that this flaw may lure of attacker interest especially on cloud computing server farm. From technical point of view, the key to implementing direct I/O in the 2.6 kernel is a function called get_user_pages. A pointer to the task performing the I/O; its main purpose is to tell the kernel who should be charged for any page faults incurred while setting up the buffer. However get_user_pages () do not check pte_dirty() bit properly. What if an unprivileged local user infected by malware. The attacker relies this bug to gain write access to additional read-only memory mappings. And thus execute a privilege escalation. It looks that even though you install the advance defense mechanism is hard to detect this type of suspicious activities.

Suggestion

Since this bug contains unpredictable potential risk, it is better to patch your Unix or Linux system with immediate action.

We can foresee that the impact of this bug struggle the IT world. Since web server, local balancer, security devices, even though malware detector are using linux OS. It looks like it is a tsunami.

Information Supplement on 25th Oct 2016

The XNU kernel is used widely on many Apple devices, ranging from the iMac, to the iPhone. List of system calls from iOS 6.0 GM – see below:

Entry point is 0x80085084....This appears to be XNU 2107.2.33
Syscall names are @2a70f0
Sysent offset in file/memory (for patching purposes): 0x2ef0c0/0x802f00c0

Suppressing enosys (0x800b3429)  T = Thumb
1. exit                  801d4a74 T
2. fork                  801d7980 T
3. read                  801eb584 T
4. write                 801eb958 T
5. open                  800b13a4 T
6. close                 801ccab4 T
7. wait4                 801d56bc T
9. link                  800b18e8 T

The purpose of fork() is to create a new process, which becomes the child process of the caller. After a new child process is created, both processes will execute the next instruction following the fork() system call. Therefore, we have to distinguish the parent from the child. XNU kernel derived on BSD Unix. Believed that iOS might have similar vulnerability but not discovered yet!

Status update 10th Nov 2016 – For dirtyCow yara rule

rule DirtyCow Unix-Linux only {

strings:
   $a1 = { 48 89 D6 41 B9 00 00 00 00 41 89 C0 B9 02 00 00 00 BA 01 00 00 00 BF 00 00 00 00 }

   $b1 = { E8 ?? FC FF FF 48 8B 45 E8 BE 00 00 00 00 48 89 C7 E8 ?? FC FF FF 48 8B 45 F0 BE 00 00 00 00 48 89 }
   $b2 = { E8 ?? FC FF FF B8 00 00 00 00 }

   $source1 = "madvise(map,100,MADV_DONTNEED);"
   $source2 = "=open(\"/proc/self/mem\",O_RDWR);"

   $source3 = ",map,SEEK_SET);"

   $source_printf1 = "mmap %x"
   $source_printf2 = "procselfmem %d"
   $source_printf3 = "madvise %d"
   $source_printf4 = "[-] failed to patch payload"
   $source_printf5 = "[-] failed to win race condition..."
   $source_printf6 = "[*] waiting for reverse connect shell..."

   $s1 = "/proc/self/mem"
   $s2 = "/proc/%d/mem"
   $s3 = "/proc/self/map"
   $s4 = "/proc/%d/map"

   $p1 = "pthread_create" fullword ascii
   $p2 = "pthread_join" fullword ascii
condition:
   ( uint16(0) == 0x457f and $a1 ) or
   all of ($b*) or
   3 of ($source*) or
   ( uint16(0) == 0x457f and 1 of ($s*) and all of ($p*) and filesize < 20KB )

}