Breaking The Weakest Link Of The Strongest Chain
Around July last year, more than a 100 Israeli servicemen were hit by a cunning threat actor. The attack compromised their devices and exfiltrated data to the attackers’ command and control server. In addition, the compromised devices were pushed Trojan updates, which allowed the attackers to extend their capabilities. The operation remains active at the time of writing this post, with attacks reported as recently as February 2017.
The campaign, which experts believe is still in its early stages, targets Android OS devices. Once the device is compromised, a process of sophisticated intelligence gathering starts, exploiting the ability to access the phone’s video and audio capabilities, SMS functions and location.
The campaign relies heavily on social engineering techniques, leveraging social networks to lure targeted soldiers into both sharing confidential information and downloading the malicious applications.
Characterized by relatively unsophisticated technical merit, and extensive use of social engineering, the threat actor targets only IDF soldiers.
IDF C4I & the IDF Information Security Department unit, with Kaspersky Lab researchers, have obtained a list of the victims; among them IDF servicemen of different ranks, most of them serving around the Gaza strip.
The operation follows the same infection flow across the different victims:
Figure 1: Campaign’s attack flow
The threat actor uses social engineering to lure targets into installing a malicious application, while continuously attempting to acquire confidential information using social networks. We’ve seen a lot of the group’s activity on Facebook Messenger. Most of the avatars (virtual participants in the social engineering stage) lure the victims using sexual innuendo, e.g. asking the victim to send explicit photos, and in return sending fake photos of teenage girls. The avatars pretend to be from different countries such as Canada, Germany, Switzerland and more.
After the victim downloads the APK file from the malicious URL, the attacker expects the victim to install the package manually. The dropper requires common user permissions as shown in the following screenshot.
Figure 2: Dropper permissions once installed on a victim mobile device
The dropper relies on the configuration server which uses queries in order to download the best fitting payload for the specified device.
- Downloader & Watchdog of the main payload
- Payload update mechanism
- Customized payload – the dropper sends a list of installed apps, and receives a payload package based on it
- Obfuscation – The dropper package is obfuscated using ProGuard, which is an open source code obfuscator and Java optimizer, observed in the LoveSongs dropper.
The network protocol between the dropper and the configuration server is based on HTTP POST requests. The following servers implement a RESTful API:
LoveSongs – http://endpointup[.]com/update/upfolder/updatefun.php
YeeCall, WowoMessanger – http://droidback[.]com/pockemon/squirtle/functions.php
Figure 3: Communication with C&C server over HTTP
Most of the communication with the server is in clear-text, except for specific commands which are encrypted using an AES-128 hard coded-key.
Figure 4: WowoMessanger REST-API POST packet capture
Figure 5: Fake WowoMessanger app – logic flow
Along with an ID existence check, the dropper sends a list of the device’s installed apps – if it hasn’t done so already.
The flow between different variants of the dropper is similar, with minor changes. One variant pretends to be a YouTube player, while others are chat apps:
LoveSongs has YouTube player functionality, whereas WowoMessanger does not have any legitimate functionality whatsoever; it erases its icon after the first run.
The payload is installed after one of the droppers mentioned above has been downloaded and executed on the victim device. The only payload we have seen so far is “WhatsApp_Update”.
The payload is capable of two collection mechanisms:
- Execute “On demand” commands – manual commands that are triggered by the operator
- Scheduled process – scheduled tasks that collect information periodically from various sources.
Most of the collected data will be sent only when a WI-FI network is available.
The payload uses the WebSocket protocol, which gives the attacker a real-time interface to send commands to the payload in a way that resembles ‘reverse shell’. Some of the commands are not yet implemented (as shown in the table below). The commands gives the operator basic yet dangerous RAT capabilities:
- Collect general information about the device e.g. Network operator, GPS location, IMEI etc.
- Open a browser and browse to a chosen URL
- Read & send SMS messages, and access contacts
- Eavesdrop at a specific time and period
- Take pictures (using the camera) or screenshots
- Record video and audio.
*Commands which were implemented are in bold.
Besides the C&C commands, the payload periodically collects data using various Android APIs. The default time interval is 30 seconds. The process collects the following data:
- General data about the device (as mentioned in the C&C command)
- SMS messages, WhatsApp database along with the encryption key (requires root permissions which is not yet fully implemented)
- Browsing & search history along with bookmarks
- Documents and archives ( < 2MB ) found in storage (doc, docx, ppt, rar, etc)
- Pictures taken, auto captures while on an active call
- List of contacts and call logs
- Records calls and eavesdrops
- Updates itself
The attackers implemented all of the malicious logic without any native or third-party sources. The logic behind the automatic call-recording feature is implemented entirely using Android’s API.
Figure 6: Call-Recording implementation in WhatsApp_update
The IDF, which led the research along with Kaspersky Lab researchers, has concluded that this is only the opening shot of this operation. Further, that it is by definition a targeted attack against the Israeli Defense Force, aiming to exfiltrate data on how ground forces are spread, which tactics and equipment the IDF is using and real-time intelligence gathering.
Kaspersky Lab GReAT researchers will disclose more behind-the-scenes details of the operation at the upcoming Security Analyst Summit.
Domain names & APK hashes
Certificates – SHA1 fingerprints