Fireye. Malware Lateral Movement: A Primer

TL;DR

http://www.fireeye.com/blog/threat-research/2015/08/malware_lateral_move.html
https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf 

•  Internal reconnaissance
• Netstat
• IPConfig/IFConfig 
• ARP cache
• Local Routing table 
• PowerShell 
• Credentials harvesting
• “pass the hash”
• Stealing of plaintext passwords from the memory of the machine using tools like Mimikatz
• create a Kerberos ticket “Golden Ticket” which will then allow the malicious actor to add accounts to your domain, elevate their privileges and make many other unauthorized changes.
• Keylogging
• Utilizing certificate capture tools like Mimikatz to harvest authentication certificates from compromised machines
• Pivoting attacks to compromise other hosts
• Using built-in system tools like Remote Desktop Protocol (RDP), AT, PsExec, VBScript and using open source tools like Metasploit. 
• built-in Windows tool PowerShell and WMI

Fireeye. iOS Masque Attack Weaponized: A Real World Look

https://www.fireeye.com/blog/threat-research/2015/08/ios_masque_attackwe.html

• Not in the wild before. See posts re Masque attacks below.
• Repackaged IOS apps
• 11 IOS apps in Hacking team arsenal
• used against non-jailbroken IOS devices
• Reverse engineered and weaponized social networks apps - : WhatsApp, Twitter, Facebook, Facebook Messenger, WeChat, Google Chrome, Viber, Blackberry Messenger, Skype, Telegram, and VK.
• Pop ups asking for permission of access the Photo, Microphone, and Contacts.
• Gathers information
• Voice call recording in Skype, Wechat, etc.
• Text message intercepting in Skype, Whats App, Facebook messenger, etc.
• Chrome visited website history
• Phone call
• SMS/iMessage content
• Precise GPS coordinate recording in background
• Contacts information
• Photos

[1] VB2014 paper: Apple without a shell – iOS under targeted attack

[2] iOS Masque Attack Revived: Bypassing Prompt for Trust and App URL Scheme Hijacking

[3] Masque Attack: All Your iOS Apps Belong to Us

[4] Three New Masque Attacks against iOS: Demolishing, Breaking and Hijacking

Fireeye. CVE-2015-0097 Exploited in the Wild

July 30, 2015

https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-0097_exploi.html

• "Microsoft Word Local Zone Remote Code Execution Vulnerability."

• In the wild

• Does not require common exploitation techniques like a heapspray or ROP chain

• Exploit. Office can open documents as HTML files via the MSScriptControl.ScriptControl.1 control. If the document contains valid HTML (in this case, appended to the end of the document), the HTML is launched in the Local Security Zone. Scripts embedded within the HTML content then write to disk with the ADODB.Recordset Active X Control. By writing scripts to the users Startup directory as shown in Figure 1, the attacker's scripts achieve full RCE and persistence.
• Payload - config.vbs - downloads and executes a binary from the attacker's server. The script saves and executes the binary as %temp%\svchost.exe.
• One of the variants we observed is a Word Document named mat khau wifi thuong dung.doc (Vietnamese language) that is used to drop PlugX malware on a system.
• The payload is a RAR SFX file named KB3002659.exe. This RAR SFX file contains the following three components:
• 1.     AhnI2.exe - Legitimate AhnLab Internet Security Software digitally signed by AhnLab, Inc.
• 2.     AhnI2.dll - Malicious PlugX DLL
• 3.     AhnI2.asf - Encrypted file used by PlugX DLL
• Producs affected 
• Microsoft Excel 2007 and 2010
• Microsoft Word 2007 and 2010
• Microsoft Powerpoint 2007 and 2010

Labels: App - MS Office, CVE-2015-0097 - MS Office, 

[1] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0097
[2] https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0097
[3] https://technet.microsoft.com/en-us/library/security/ms15-022.aspx