So Long, and Thanks for All the Domains

While Trojans like Dyre and Dridex are dominating malware-related news, we take the time to have a closer look at Tinba (Tiny Banker, Zusy, Illi), yet another Trojan which targets Windows users. In the first part of this post, we give a short historical review, followed by hints about how to detect (and remove) this threat on an infected system. In the second part, we have a look at a portion of the Trojan’s code which enhances its communication resilience, and how we can leverage these properties for defensive purposes.

Tinba is a fine piece of work, initially purely written in assembly. CSIS discovered it back in May 2012, and it contained WebInject capability and rootkit functionality in a binary of just 20 KB. The source code of Tinba leaked in July 2014, helping bad guys to create their own, extended versions.

Tinba Rootkit ZwQueryDirectoryFile
The source code of Tinba leaked in July 2014. Shown are some preparations to hook ZwQueryDirectoryFile.

Tinba on steroids was discovered in September 2014. Two main features are worth noting: First, each binary comes with a public key to check incoming control messages for authenticity and integrity. Second, there is a domain generation algorithm (DGA), which we will discuss later. In October 2014, Tinba entered Switzerland, mainly to phish for credit card information.

Tinba Inject
Tinba tried to phish credit card information.

Like other commodity Trojans, Tinba checks whether it is running in a virtual machine/sandboxed environment by checking the hard-disk size or looking for user interaction. According to, there was an intense distribution of Tinba in Switzerland early this year. Such spam campaigns can happen again at any time, so it is of use to know how to detect Tinba on an infected system and remove it.

Even though Tinba has the ability to hide directories and files (rootkit functionality), cybercriminals were wondering why they should bother using it. Why not simply hide directories and files with the “hidden” flag, which works for most users? Thus, it is relatively simple for a computer-savvy user to remove this version of Tinba from an infected (see instructions below).

Tinba Directory Hidden
A randomly named directory, which contains the Trojan itself, can be hidden by setting its attributes to “hidden”.

Continue reading “So Long, and Thanks for All the Domains”

Protect your network with DNS Firewall

If you run your own mail server, you will quickly find out that 90% of the e-mails you receive are spam. The solution to this problem is e-mail filtering, which rejects or deletes unwanted spam. This solution is generally well accepted, and most users would not want the old days back when your inbox was filled with scams. Those people who want spam can also work around it by disabling spam filtering for their e-mail address or opting to run their own mail server.

Spam, scammers and other malicious abuse are not unique to e-mail. One possible approach is to invent a filtering technology for every protocol or service and allow the service owners to block misuse according to their policy. On the other hand, most services on the Internet make use of the Domain Name System (DNS). If you control DNS name resolution for your organisation, you can filter out the bad stuff the same way you filter out spam on e-mail. The difference and the advantage of DNS is that DNS filtering is independent of the service you use.

Back in 2010, ISC and Paul Vixie invented a technology called Response Policy Zones (RPZ) (See CircleID Post Taking back the DNS). While it has always been possible to block certain domain names from being resolved on your DNS resolver, adding host names manually as an authoritative zone does not scale.

(Illustration Christoph Frei)
(Illustration Christoph Frei)

Continue reading “Protect your network with DNS Firewall”

Drive-by code and Phishing on Swiss websites in 2014

In 2014, about 1,800 Swiss websites were cleaned from drive-by code, compared with 2,700 in 2013, a decline of 33%. At the same time, the number of phishing cases affecting .ch and .li top-level domains rose from only a handful in 2013 to more than 300.

Drive-by code on Swiss websites in 2014

Last year, 35,796 suspicious drive-by URLs in the .ch and .li top-level domains were reported to SWITCH. Security experts from SWITCH-CERT automatically sent requests to these servers and analysed the responses, looking for malicious code injected into the HTML source code. When an expert identified malicious code, the registrar or domain name holder and the web hoster were notified and asked to remove it within one working day. This was done for 1,839 domain names in 2014. In 1,493 (81%) cases, the code was removed by the web hoster or domain holder within one day. For the other 346 domains, the deadline was not met, and the domain name was temporarily suspended to prevent further damage to website visitors. Some 264 (14%) of the infected websites were cleaned of malicious code, with the remaining 82 domain names having to be reactivated after five days, the maximum suspension time by law. A request for identification was sent to the holders of all 82 domains, resulting in an additional 59 (3.2%) of websites being cleaned. A total of 23 (1.3% of all notified) domain names were deleted after 30 days because the domain holder failed to respond to the identification request.

Compromised .ch and .li websites used for drive-by infections by quarter

Continue reading “Drive-by code and Phishing on Swiss websites in 2014”

The December 2014 issue of our SWITCH Security Report is available!

Dear Reader!

A new issue of our monthly SWITCH Security Report has just been released.

The topics covered in this report are:

  • No «Land of the Free» in sight: NSA allowed to continue gathering data, BND puts forward EUR 300 million wish list
  • Censorship culture in the UK
  • The new PR: how parties, companies and organisations manipulate web chat to propagate opinions
  • Regin and the Detekt-ives: new software finds known government Trojans – Symantec discovers a new one
  • Generali cheaper: lower premiums in exchange for personal information
  • The Clipboard: Interesting Presentations, Articles and Videos

The Security Report is available in both english and german language.

»»  Download the english report.      »»  Download the german report.

Did you miss our previous Security Report? Click here to go to the archive.


Retefe with a new twist

A few months ago, we blogged about the banking trojan Retefe (Blog post in German) that was and still is targeting Switzerland. First off, Retefe is different because it only targets Switzerland, Austria and Sweden (and sometimes Japan). Contrast this to many other banking Trojans, which have a much more global and dynamic target list. Not only that, but the Retefe infrastructure also prevents computers from not affected countries to connect to its systems by using geo-location aware access lists and filters. The second unique property of Retefe is the fact, that it only modifies the operating system by adding a fake root certificate and by changing the DNS server for domain name resolution. After infection, the installer removes itself, which makes life hard for anti-virus software trying to detect a malicious Retefe component or activity.

Since a few days, Retefe is back again with a new twist. It still targets the same countries and the same banks. Not too exciting, the spam campaign has changed. However, in this wave Retefe is picky and only installs itself on selected computers. And some icing to the cake, it also installs another malware called DOFOIL. In this blog post, we give a technical analysis of the new Retefe.
Continue reading “Retefe with a new twist”

IT-Security-Links #65

Swiss economy makes online security its priority

Switzerland is one of the safest countries in the world. To make also the Internet a secure place in Switzerland, the Swiss online economy has started the Swiss Internet Security Alliance (SISA). The goal of the alliance is to make Switzerland the “cleanest” Internet country in the world! The organization launched an online security check today which allows internet users to clean and protect their systems.

Offering more security
The founding of the Swiss Internet Security Alliance is a sign of its members’ commitment to making the Internet a secure place in Switzerland. The association brings together expert knowledge from representatives of various sectors and promotes information-sharing amongst competitors.

Overcoming challenges together
The Swiss Internet Security Alliance focuses on its main assets – the knowledge, experience and technical expertise of its members. Its members asut, Centralway, credit suisse, cyscon Schweiz, Lucerne University of Applied Sciences and Arts, Hostpoint, Migros Bank, PostFinance, Raiffeisen, Sunrise, Swisscard, Swisscom, SWITCH, UBS, upc cablecom and Viseca have longstanding experience in dealing with online security.  The association is open to other interested parties. More information can be found in the press release:

Comprehensive security check
Upon founding the association, the Swiss Internet Security Alliance is launching a security check. The Swiss Security Check provides protection on three levels.

  1. Users with outdated or incorrectly configured software who are therefore subject to a security risk, will find this out within seconds.
  2. If there is suspicion of malware, the malware cleaner helps with the diagnosis and resolution of the problems.
  3. A cyber vaccine completes the protection and keeps electronic pests at bay.


The Swiss Security Check is free and can be accessed here:


Please follow @swiss_isa on Twitter!

IT-Security-Links #62


IT-Security-Links #61

  • McAfee Labs reports that a new ransomware called CryptoWall uses Tor for communication and demands Bitcoin from the user in exchange for the private key to decrypt the files. “The use of Tor and Bitcoin in this operation make tracing the attackers more difficult” writes McAfee.
  • Firefox version 31 is improving malware detection. Firefox has long been using Google’s Safe Browsing service to check for malicious web sites, now it also checks downloaded files.
  • Isreal’s Homeland Security writes that anonymous hackers have launched DDoS attacks against network infrastructure from Israel. The attacks also affected DNS name resolution on domain names ending in
  • The Register writes that Security outlet VUPEN has revealed it held onto a critical Internet Explorer vulnerability for three years before disclosing it at the March Pwn2Own hacker competition. VUPEN makes money by selling exploits to its customers.
  • The Moscow Times writes that Russia’s Interior Ministry has put out a tender on its official government procurement website for anyone who can identify Tor users. On a related note, the Tor team issued a security advisory this week, warning operators of hidden services about attacks to deanonymizing users. And if that’s not enough Tor news for this week, according to the Tor project’s latest annual financial statements (PDF), the US government increased its funding to 1.8 million US dollars in 2013!


Retefe Bankentrojaner

E-Banking ist seit seiner Entstehung ein attraktives Tummelfeld für Betrüger. Oft wird auf spezielle Schadsoftware, auf sogenannte Bankentrojaner, zurückgegriffen, um arglosen Opfern Geld abzuziehen.

Die meisten dieser Bankentrojaner basieren auf technisch betrachtet ziemlich komplexen Softwarekomponenten: Verschlüsselte Konfigurationen, Man-in-the-Browser-Funktionalität, Persistenz- und Updatemechanismen, um einige zu nennen. Im letzten halben Jahr hat sich eine gänzlich neue Variante behauptet, welche erst im Februar 2014 einen Namen erhielt: Retefe. Nur wenig wurde bis an hin publiziert, einer der Hauptgründe ist sicherlich, dass die Schadsoftware nur in wenigen Ländern (CH, AT, SE, JP) agiert und nur einige ausgewählte Banken angreift. TrendMicro (Blogartikel: Operation Emmental (DE), (EN)) und SWITCH-CERT möchten hiermit nun etwas detaillierter über diesen Trojaner berichten.

Das Besondere am Retefe Bankentrojaner ist seine Schlichtheit. Das infizierte System wird wie folgt manipuliert:

  1. Auf dem PC des Opfers wird der Eintrag des DNS-Servers auf einen bösartigen DNS-Server geändert.
  2. Auf dem PC des Opfers wird ein gefälschtes Root-Zertifikat installiert, siehe auch unser kürzlich veröffentlichten Blogartikel zu diesem Thema.


Nach der Infektion löscht sich die Installationsroutine selbst. Ausser dem manipulierten System bleibt nichts zurück, was es schwierig für Antiviren-Programme macht, im Nachhinein eine Infektion festzustellen.

An Eleganz ist diese Schadsoftware schwer zu übertreffen: Sie verzichtet auf die in der Einführung genannten Softwarekomponenten und minimiert damit die Komplexität. Es scheint auch, dass es aus Betrügersicht heutzutage ökonomischer ist, schlicht und einfach neue Opfer-PCs mittels Spam-Kampagnen zu infizieren.

Wie sieht der Modus Operandi konkret aus?

Modus Operandi eines möglichen Schadenfalls
Modus Operandi eines möglichen Schadenfalls

Continue reading “Retefe Bankentrojaner”

IT-Security-Links #53


IT-Security-Links #51

IT-Security-Links #50

Einführung in die Anti-Malware-Analyse – Teil 3: Anti-VM

Im zweiten Teil dieser mehrteiligen Serie definierten wir den Begriff Ausführbare Datei und zeigten, was hinter Anti-Debugging steckt. Die Analyse der Malware war dynamisch, das heisst, der bösartige Code wurde effektiv ausgeführt – und das Analysesystem mit grosser Wahrscheinlichkeit infiziert. Wäre es daher nicht praktisch, die Analyse in einer virtuellen Umgebung durchzuführen? Mit einem Knopfdruck ist der saubere Zustand wieder hergestellt. Eine Idee, die auf der Hand liegt. Entsprechend haben sich die Autoren bösartiger Software dazu Gedanken gemacht und eine Technik entwickelt, diesen Umstand auszunutzen – Anti-VM: Läuft die Malware in einer virtuellen Maschine, so gehe davon aus, dass es sich um einen Malware-Analysten handelt und mache nichts böses.

Bevor wir darauf eingehen – lohnt es sich überhaupt das anzuschauen? Werden nicht bald alle Maschinen virtuell laufen? Schön möglich, aber im Moment nicht und die Anti-VM-Technik wird erstaunlich oft angewandt. Gemäss einer Untersuchung von Qualys [1] (im Jahr 2012) implementieren 90% der untersuchten Malwaresamples (4 Millionen Stück) mindestens eine Anti-Malware-Technik – mit über 80% bei weitem am häufigsten Anti-VM.

Anti-Malware Techniken. Quelle: Qualys 2012
Anti-Malware Techniken. Quelle: Qualys 2012

Notabene: 2.9 der 4 Millionen untersuchten Malwaresamples greifen auf eine Anti-VM-Methode namens IN zurück – weshalb wir uns in diesem Artikel hauptsächlich damit beschäftigen.

Virtuelle Maschinen unterscheiden sich von physikalischen Maschinen. Diese Unterschiede können offensichtlich sein: Installierte Software (VMware-Tools), Laufende Prozesse (vmtoolsd.exe), Herstellerkennung der (virtuellen) Netzwerkkarte (00:0c:29:xx:xx:xx), Harddisk-Bezeichnungen etc. Aber einige Unterschiede sind erst in den Tiefen des Betriebssystems zu finden. Die erste Detektion einer virtuellen Umgebung auf nicht-triviale Art wird Joanna Rutkowska von Invisible Things Lab attributiert. Ihr Code aus dem Jahr 2004 wird häufig wie folgt zitiert[2]:

int swallow_redpill () {
   unsigned char m[2+4], rpill[] = "\x0f\x01\x0d\x00\x00\x00\x00\xc3";
   *((unsigned*)&rpill[3]) = (unsigned)m;
   return (m[5]>0xd0) ? 1 : 0;

…auch bekannt als “Red Pill”. Continue reading “Einführung in die Anti-Malware-Analyse – Teil 3: Anti-VM”

IT-Security-Links #47