<html>
<head>
<title>Hydraq</title>
</head>
<body align="justify">
<h1><center>Foreword</center></h1>
<p><i>This report was written by Mathilde CARON, Silviu COCA, Franck ROLAND and Daniel VEGA SIMOES and it intends to analyze and clarify questions about the Hydraq incident that happened in early 2010. This attack was widely broadcasted for its high-profile targets, such as Google, and suspected political motivations.</i>
<br><br><hr>
<h1><center>Introduction</center></h1>
<p>Hackers continuously try to improve their skills and by this we shouldn’t think only about technical things, but also conceptual ones, like ideology and mentality. In the past, an attacker would’ve hacked as many computers as possible just for fame and fun. Attacks would’ve been on random targets, based on the exploitable applications running. The knowledge required by the attacker was based on bugs which could be exploited, either found by the hacker himself or published online within the hacker community.
<p>Nowadays, things have drastically changed as the money factor plays a key role. We are witnessing more evolved attacks, which have become targeted and discrete. The attacker prefers to infect single hosts and gather as much information as possible rather than spreading the malicious code over many machines, because by controlling the spread of the infection, the attacker can remain undercover. This stealth gives him potentially more power. With sophisticated mechanisms of command interpretation and updating, the attacker’s tools become more robust. The terms cyber crime, cyber terrorism and cyber war describe the new security challenges computer engineers have to face.
<br><br><hr>
<h1><center>Hydraq</center></h1>
<p>Even though targeted attacks have been going on for couple of years, the Hydraq incident was quite well mediated and caught the community’s attention. Classified by Symantec as Trojan.Hydraq, the security literature describes [4]Hydraq as a family of threats used in highly sophisticated, coordinated attacks against large and high-profile corporate networks, one of them being Google. Google had their own investigation and declared that [3] at least twenty other large companies from a wide range of businesses, including Internet, finance, technology, media and chemical sectors, have been similarly targeted and that they notified those companies, working along with relevant U.S. authorities. One of the main goals was to access the Gmail accounts of human rights activists located in China, which makes the attack seemingly political in nature.
<p>The Hydraq incident was a targeted attack by the book. Overall, Hydraq was a Trojan horse that opened a backdoor on the compromised computer. It had a simple JavaScript architecture with some basic code obfuscation techniques and no anti-debugging or anti-emulation protection. The attackers were focused on the purpose rather than on the possibility of reverse engineering the source code. Symantec declared [1] that the Trojan is easy to remove, threat contamination is low and the number of infected hosts is presumed to have been lower than 50. A zero-day vulnerability in Internet Explorer allowed the attacker to install the backdoor. The vulnerable versions of Internet Explorer were 6, 7 and 8, which meant the totality of Microsoft’s browser versions in use today. Using a modified code of the VNC remote desktop application, the Trojan could monitor and log the victim’s actions.
<p>However, Hydraq was not new to the hack scene, as previous variants of it were already available. The first appearance was logged as of July 2009. These variants exploited in Adobe Flash Player and Adobe Acrobat Reader the Remote Code Execution Vulnerability (CVE-2009-1862). This vulnerability, which showed up in the Adobe ActionScript Virtual Machine and affected the 'flash9f.dll' and 'authplay.dll' modules, could be triggered by the attacker by supplying a malicious Flash ('.swf') file or by embedding a malicious Flash application in a PDF file. Most common used propagation method was email PDF attachments containing the malicious Flash application which executed and installed Trojan.Hydraq.
<p>This newer version of Hydraq, released on January 2010, used XSS Filter Script Handling Vulnerability (CVE-2009-4074), URL Validation Vulnerability (CVE-2010-0027), Uninitialized Memory Corruption Vulnerability (CVE-2010-0244-0247) and HTML Object Memory Corruption Vulnerability (CVE-2010-0248-0249) [2]. The attacker was able to disclose information and run remote code by taking advantage of HTML object handling flaw, which was triggered when IE tried to access a deleted or incorrectly initialized HTML object. Attackers could exploit this issue by luring a user into opening a specially crafted webpage or email attachment. When the website or email attachment was opened, the vulnerability was leveraged to execute and install Trojan.Hydraq. Once the exploit attack was successful, Hydraq’s binary shellcode would then execute on the target system. The malicious JavaScript code containing well known nop-like padding used for heap spray can be found in Appendix A.
<br><br><hr>
<h1><center>Deployment</center></h1>
<p>After the successful exploitation, the attacker would attempt to install a backdoor in order to maintain access. In this case, the downloaded executable from the Internet was a dropper component of Hydraq.
<h3>Dropper file installation (EXE)</h3>
<ol>
<li>The dropper component generates a random service name using the format Ups and 3 random characters.</li>
<li>The service name is used to load the DLL component from %System%\Rasmon.dll.</li>
<li>The generated service name is added to the registry entry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\SysIns.</li>
<li>The service is started and the DLL is loaded using Windows Generic Host Process (svchost.exe). This is an effective technique which can be used to help malware persist on a compromised computer. However, while effective this technique is neither new, nor complex. W32/Downadup is an example of malware that successfully employed this exact same technique.
<ul>
<li>ServiceName = "Ups<3 random characters>"</li>
<li>DesiredAccess = SERVICE_ALL_ACCESS</li>
<li>ServiceType = SERVICE_WIN32_SHARE_PROCESS</li>
<li>StartType = SERVICE_AUTO_START</li>
<li>ErrorControl = SERVICE_ERROR_NORMAL</li>
<li>BinaryPathName = "%SystemRoot%\System32\svchost.exe -k SysIns"</li>
</ul>
</li>
<li>Cleanup phase in which the malware runs the batch located in %Windows%\DFS.bat and deletes the registry key found in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\SysIns and the dropper file.</li>
</ol>
<h3>Backdoor installation (DLL)</h3>
<ol>
<li>It checks the service name it is running on and performs a case sensitive comparison on the first three characters of the service name “Ras”. If it is not the same, it stops the service operation, deletes the current service and then registers a new service name in the following format: ”RaS” + 4 random characters. Each time the infected host reboots, the malware changes the service name, due to the case sensitive comparison between “Ras” and “RaS”.</li>
<li>The DLL component creates a new service:
<ul>
<li>ErrorControl: SERVICE_ERROR_IGNORE</li>
<li>Start: SERVICE_AUTO_START</li>
<li>Type: SERVICE_WIN32_SHARE_PROCESS</li>
<li>ImagePath: %SystemRoot%\System32\svchost.exe -k netsvcs</li>
</ul>
</li>
<li>In a similar manner to the dropper file, the DLL creates a new registry entry for the newly created service: HKLM\SYSTEM\CurrentControlSet\Services\RaS<4randomcharacters>\Parameters\ServiceDll = %system%\Rasmon.dll</li>
<li>Finally it adds a registry entry to its name in HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersions\Svchost\netsvcs</li>
</ol>
<p>For the remote connection information, the registry key HKLM\Software\Sun\1.1.2\AppleTlk is used. As Hydraq backdoor DLL component is installed through svchost.exe, it cannot interact with the user or access GUI objects, as svchost.exe is a non-interactive service. To enable the interactive service, the malware will:
<ol>
<li>Assign the default desktop object to the Win32/Hydraq DLL thread.</li>
<li>Assign the winstat0 window station to the Win32/Hydraq DLL process.</li>
</ol>
<p>After this installation process, the compromised system will try to access the Command & Control site and begin gathering information.
<br><br><hr>
<h1><center>References</center></h1>
<ul>
<li>[1] Symantec – Trojan.Hydraq http://www.symantec.com/business/security_response/writeup.jsp?docid=2010-011114-1830-99</li>
<li>[2] Microsoft - Cumulative Security Update for Internet Explorer http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx</li>
<li>[3] Google - A new approach to China http://googleblog.blogspot.com/2010/01/new-approach-to-china.html</li>
<li>[4] In-depth Analysis of Hydraq - The face of cyberwar enemies unfolds, Zarestel Ferrer and Methusela Cebrian Ferrer, CA ISBU Senior Researchers, Melbourne Australia</li>
</ul>
<br><br><hr>
<h1><center>Appendix A</center></h1>
var e1=null;<br>
function ev1(evt)<br>
{<br>
e1=document.createEventObject(evt);<br>
document.getElementById("sp1").innerHTML="";<br>
window.setInterval(ev2, 50);<br>
}<br>
function ev2()<br>
{<br>
p="\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\<br>
u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0<br>
d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0<br>
c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d"<br>
;<br>
for(i=0;i<x1.length;i++){x1[i].data=p;};<br>
var t=e1.srcElement; <br>
}<br>
</body>
</html>