Attacks/Breaches
6/7/2017
05:33 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

RIG Exploit Kit Takedown Sheds Light on Domain Shadowing

Threat actors hid tens of thousands of shadow domains behind legitimate domains to carry out malicious activity.

A coordinated effort to disrupt activities related to the RIG Exploit Kit has once again revealed how extensively threat actors abuse legitimate domains and websites to build the operational infrastructure for their criminal campaigns.

Researchers from RSA Security, domain registrar GoDaddy, and several other organizations worked together to recently take down over 40,000 active shadow domain resources that were being used as infrastructure for the RIG EK.

The campaign has resulted in a complete cessation of activity related to EITEST and PseudoDarkleech, two major RIG EK campaigns for distributing banking Trojans, ransomware, and other malware, says Alex Cox, director of RSA Research. "But it remains to be seen how that will affect the RIG ecosystem as a whole," he says.

Domain shadowing refers to the tactic by threat actors to create malicious subdomains behind a legitimate domain using credentials stolen from the domain registrant. Organizations often do not notice the activity because domain registrant accounts are rarely used or checked once the initial domain registration is completed. Criminals employ the technique to hide malware-laden pages and exploit kits behind legitimate domains, making it hard for defenders to spot and eradicate them.

"Domain shadowing is extremely effective because it allows malicious subdomains to leverage the good reputation of the parent domain, and thus bypass reputation based filters," says Shimon Modi, director of product at security intelligence sharing company TruStar Technology.

In the case of the RIG Exploit Kit, the threat actors used the shadow domains they created to host RIG landing pages. Most victims were directed to the landing pages from previously compromised websites injected with iframes. The landing pages were designed to inspect and exploit incoming client systems and to install a diverse set of malicious payloads on them.

The more than 40,000 RIG EK-related subdomains that RSA and the others succeeded in shutting down affected over 800 legitimate domains, many of them registered with GoDaddy. Most of the subdomains were being served out of near bulletproof hosting providers based in Eastern Europe. The hosting providers often had enough legitimate traffic not to be obvious candidates for blacklisting.

"A common way for defenders to attack these systems is to provide proof of malicious activities to the hosting providers, so they will suspend the systems," Cox says. Criminals understand that and deliberately seek out hosting providers that are willing to go along with or are negligent about the activity. "They’ll re-use these hosts until the defenders pinpoint them and then they’ll move onto others," Cox says.

An inspection of the DNS records associated with each of the shadow domains in the RIG Exploit Kit infrastructure showed that most of them were up for barely five to 10 days before being deleted. The duration for which they were actually used was likely closer to 24 and 48 hours according to RSA. Threat actors often rapidly rotate shadow domain to make it even harder for defender to get them.

There is little that was common among the compromised domains and most of them were likely just victims of opportunistic phishing and malware campaigns to steal login credentials to domain registrant accounts, Cox says.

The domain shadowing issue is a challenging problem to solve with 100% effectiveness, Modi says. "But a mix of block [and] tackle techniques and anomaly detection can help in detecting and preventing domain abuse," he says.

In order to ensure their domains are not being abused, organizations should make sure to monitor for unusual numbers of changes to DNS records, block bad IP address from their ISPs DNS systems and check for subdomains that have unusual alphanumeric character patterns, Modi says.

"Monitor organizational DNS records looking for unauthorized changes or additions on a regular, and preferably automated basis," adds Cox.  

Related content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.