A computer worm is a piece of malware that is designed to replicate itself in order to spread to other machines. While worms have existed since at least the 1980s, they’ve made a surprise comeback in 2017. Notable pieces of malware, including ransomware and banking trojans, have sought to incorporate “wormable” functionalities. Following the WCry attacks, Rick Holland wrote a blog titled “The Early 2000s Called, They Want Their Worms Back”. Could 2017 be seen as the return of the worm? By using the Red Hat structured analytic technique, it’s possible to take the perspective of an attacker and understand the potential evolution of this technique in the near future.
Worms in 2017
In early 2017, the SamSam ransomware added self-propagation techniques. The developers of SamSam likely determined that the added technique would increase potential profits for the operators of the ransomware. More recently, Emotet and TrickBot, two banking trojans added self-propagation to their functionality. Banking trojans target customers of online banking services in order to harvest their credentials and access accounts for subsequent fraudulent transfers. Both Emotet and TrickBot demonstrated a new capability that attempted to allow self-propagation through a network using two distinct techniques.
- Emotet relied on the brute-force cracking of credentials to spread internally among networked systems, using a list of passwords hard-coded into the malware. This was incorporated in the months after WCry and Petya, demonstrating how criminals track cyber trends and adjust their TTPs accordingly.
- The new TrickBot variant attempted to autonomously propagate among networked machines over the Server Message Block (SMB) service. There have been further indications that the exploit used in the TrickBot variant was ETERNALBLUE, an exploit for an SMB vulnerability (CVE-2017-0144). ETERNALBLUE was released by the Shadow Brokers in April 2017 and subsequently used in the WCry (WannaCry) attacks of May 2017.
Over the past six months, there have been multiple instances of malware using network self-propagation techniques. As seen in Figure 1 below, the Backdoor.Nitol and Gh0st RAT trojans, WCry, and now, possibly, TrickBot have used ETERNALBLUE.
Figure 1 – Timeline of malware adding self-propagation
Red Hat Analysis
The incorporation of a “worming” capability enables malware to propagate among machines within a local area network, and potentially between networks. This could enable a single successful delivery via a spam email, for example, to infect multiple machines.
A lack of technical knowledge is one reason why we have seen a lack of adoption in the past. TrickBot is a well-developed and successful banking trojan, indicating that its operators were likely relatively well resourced; however, the newly added self-propagation modules were reportedly relatively poorly written in comparison to its older modules, suggesting a realistic possibility that they may still be under development.
In order to assess the question of why banking trojan developers would adopt self-propagation techniques, we have conducted a Red Hat analysis exercise. Red Hat analysis is a structured analytic technique that prompts an analyst to change his or her point of reference from that of an analyst observing or predicting an adversary or competitor’s behavior, to someone who must make decisions within an existing operational culture. The technique works best when you are trying to predict the behavior of a specific person or adversary. The Red Hat analysis quadrant in Figure 2 shows the potential advantages, benefits, costs, and risks associated with future development of self-propagating techniques for banking trojans.
Figure 2 – Red Hat analysis of developing self-propagation techniques for banking trojans
The self propagation outlook
Actors or groups that can implement these techniques without compromising operational security would likely gain more profit. Given this, it’s likely that the development of self-propagation capabilities will continue in the near future.
While there’s still limited information on how self-propagation techniques have increased the profitability of Emotet and TrickBot, the incorporation of these capabilities in multiple malware variants showed their developers and operators perceived the techniques as profitable. If development of self-propagation techniques continues, it will likely increase the extent to which a specific variant can impact an enterprise network. However, this would largely depend on how hardened a network is against such activity.
Shortly after the WCry ransomware worm, we wrote a blog on 5 lessons we can learn from security engineering. The advice in this blog extends beyond the WCry incident, and provides good advice for protecting against the rise of wormable malware, covering these five areas:
-
- Default deny
- Least privilege
- (Attack) surface reduction
- Need to know/compartmentalization
- Defense in depth