0

The media are currently (and have been) creating a huge ruckus surrounding the supposedly "undetectable" Gameover Zeus malware.

My question is... is there actually any increased risk to this particular malware, or are the media just running with it to run a scaremongering story?

Are a combination of Malware Bytes and Microsoft Security Essentials sufficient for most users to be safe?

  • What makes you think this is "undetectable". It is talking about a botnet. Bot nets are trivially detectable locally since they involve your computer making unusual network activity in order to do work for the botnet and receive commands. The problem with botnets is that many people don't bother taking these steps, which allows botnets to form in the first place. – AJ Henderson Jun 5 '14 at 13:38
  • @AJHenderson - Undetectable was in quotes, because that's how the media are/were describing it. – Anonymous Jun 5 '14 at 14:25
  • Ah, I didn't even see any mention of it being undetectable in the PC World article, but I did only scan it briefly. – AJ Henderson Jun 5 '14 at 14:28
  • 1
    Must have been one of the other ones. :-) Obviously it must be detectable to some degree, otherwise banks wouldn't be advising everyone to scan using various software. – Anonymous Jun 5 '14 at 14:42
  • I like that you linked the five "publications" I'd avoid for any balanced and sane view on the matter. Especially the Daily Mail... seriously? I direct you to the Daily Mail Song. – Polynomial Jun 6 '14 at 7:17
4

The media are in a feeding frenzy over this. However, the malware in question is several years old. This started I think with the FBI blowing their own trumpet over taking over a botnet (that had been working for several years).

Then the UK's National Crime Agency decided to use it as a public awareness campaign to try and get people to improve the safety and security of their PC's.

Then the press got it and did their usual thing of totally twisting it out of recognition.

Indeed, the later variants of this malware are, at least to a degree, not even dependent on their command and control servers. They are capable of talking peer-to-peer.

So the risk is inflated by the press. However, that isn't to say that this type of malware doesn't present a real and present danger to anyone using the Internet - it does.

So the usual mitigations should be applied:

  • Good anti-malware software with rapid updates (the Microsoft AV seems to have fallen off the edge of acceptable recently) - Avast, etc.
  • Limits on running executables - this may well be the best protection all round. Unfortunately, it isn't easy to achieve outside the enterprise & even in the enterprise, it does annoy people! Only recognised and authorised executables should be able to run.
  • Outside the enterprise, sensible precautions are running Microsoft EMET and running as a standard user not a user with admin rights.

An occasional sweep with alternative anti-malware tools and rootkit detection tools may also be sensible though many of the vendors of what were just AV tools now include additional checks as well.

Oh, and inside an enterprise, there should also be additional checks at network boundaries by using threat management tools which can detect suspicious activity both coming into and going out of the network and blocking & reporting it.

Finally, the malware in question is most certainly detectable by the right tools. A quick search will reveal that.

  • While the risk is being inflated on a personal scale, the difficulty of defeat of these distributed botnets make now (just after a partial takedown) a good time to try and make folks (them out there) do something - which I think is the general plan. That said the is a little too much FUD and not enough actionable instruction (but given it's 'the great unwashed' that needs to do something, .. the viscous/virtuous circle continues its spiral). So yes, it's update the AV signature files, and do a full scan! – Philip Oakley Jun 6 '14 at 16:48
  • I agree, and this is a difficult message to get across so full marks to the NCA for getting the message out (zero for the FBI blowing their own trumpet). AV alone is not enough any more & the 3 bullets I've given are a minimum not the best protection available. – Julian Knight Jun 6 '14 at 19:26
0

Oh the media... why is there no uproar about other bots? GameoverZeus is simply an improved Zeus. It is run as a P2P (peer to peer) network, and operated by an HTTP control panel. The source code of Zeus can be found with a Google search so that's how that happened. It's one of, if not the most sophisticated bots on the market next to TDSS. It's even able to bypass two factor authentication, along with all of the plugins you would see in bots like SpyEye, ICE9, Carberp, and Citadel.

There is also an optional rootkit function to make it very hard to detect and remove. Antivirus will not detect it. These people are not dumb, it's actually easier than you think to hide something from AV. It's foolish to say that one could not bypass and disable any antivirus. It's better than nothing though.

The answer is that it's totally inflated. This bot can do what the original Zeus did in 2008. It was improved to keep up with the times. Julian offered some very good information on protecting yourself, I would start with that.

  • I'm not sure you are correct that AV cannot detect it. I'm seeing AV vendors listing the sigs they use to detect it. Be careful of sweeping claims about AV effectiveness. It is important to recognize that AV might be poor at detecting 0-days, but once seen, can detect the known threat. Perhaps you need to qualify your statements above. – schroeder Jun 5 '14 at 22:55
  • This has nothing to do with zero day vulnerabilities. Perhaps a zero day exploit was used in downloading the malware, but this is far too broad considering far more than one person uses this malware. Most AV's use heuristics and runtime scanning. Detects common patterns used in malicious software. The code obfuscation method that is used commonly is encryption or "Crypting" I myself with limited low-level programming language experience using common tools can take malware written from the Zeus source and make it undetected by 40 of the largest AV programs. This is without a rootkit. – Æther Jun 6 '14 at 5:19
  • In time it will be detected, however as I said these people are not new to this. They will constantly change and update the bot's server file to keep it hidden. No doubt, I should have said something like "The answer is yes it can be detected, but the people who control these operations are smart enough to keep it undetected." – Æther Jun 6 '14 at 5:22
  • Be careful. You are making sweeping claims, which you can only support with more sweeping claims. Until you have written malware that passes VirusTotal, do not claim that you can. Answers here need to stick to the facts and what can be proven, and not the hubris of the answerer. You state that "AV will not detect it" and that statement is false on its face. Can someone create a variant that might not get detected? Sure, but then we've changed what we're talking about. – schroeder Jun 6 '14 at 14:24
0

Wrong I've been under attack since April 27. Zues changed the location of malwarebytes premimium edition changed it so it won't be detected (this after uninstalling mbam.exe and reinstalling it with a new registry , rewrote mcafee scanned and deleted 239 registry keys, changed behavior of norton, windows firewall, and windows defender to make sure I can't access certain sites and especially won't let me download any potential program or scanner with the ability to detect it!! Apparently I need to contact my system administrator for that privilege... I am supposed to be him!) locating the host is not as simple as these uninformed people describe! I have ports open all the way to 997000. What makes it difficult is really what all has the sharing capability (that I can't turn off, when I do the computer reboots and Zeus is located in just about all my .exe files) 2 computers, 2 iPhones (5c &5s) yes Genius Bar "couldn't believe it either", 2 direct tv receivers, smart tv, and the first memory leak came from my wireless printer. Oh yeah Zeus also brought the conficker worm with him. But what you don't understand is Zues is a HIGHLY powerful and innovative WEB SERVER, not just some random Trojan or worm. I hate to be real but the FBI isn't just blowing smoke up your tail! Http my but Zues can alter and create ALL your certificates, it becomes a CA! Here is my router info:

TLS Information

Minimum Supported Protocol: SSLv3 Maximum Supported Protocol: TLSv1.2

Ciphers

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: Enabled TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: Enabled TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: Enabled TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: Enabled TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: Enabled TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA: Enabled TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384: Enabled TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: Enabled TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: Enabled TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: Enabled TLS_ECDHE_RSA_WITH_RC4_128_SHA: Enabled TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: Enabled TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384: Enabled TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256: Enabled TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384: Enabled TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256: Enabled TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA: Enabled TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA: Enabled TLS_ECDH_ECDSA_WITH_RC4_128_SHA: Enabled TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA: Enabled TLS_ECDH_RSA_WITH_AES_256_CBC_SHA: Enabled TLS_ECDH_RSA_WITH_AES_128_CBC_SHA: Enabled TLS_ECDH_RSA_WITH_RC4_128_SHA: Enabled TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA: Enabled TLS_RSA_WITH_AES_256_CBC_SHA256: Enabled TLS_RSA_WITH_AES_128_CBC_SHA256: Enabled TLS_RSA_WITH_AES_128_CBC_SHA: Enabled SSL_RSA_WITH_RC4_128_SHA: Enabled SSL_RSA_WITH_RC4_128_MD5: Enabled TLS_RSA_WITH_AES_256_CBC_SHA: Enabled SSL_RSA_WITH_3DES_EDE_CBC_SHA: Enabled TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: Enabled TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: Enabled TLS_DHE_RSA_WITH_AES_128_CBC_SHA: Enabled TLS_DHE_RSA_WITH_AES_256_CBC_SHA: Enabled SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA: Enabled TLS_DH_anon_WITH_AES_128_CBC_SHA256: Enabled TLS_DH_anon_WITH_AES_256_CBC_SHA256: Enabled TLS_DH_anon_WITH_AES_128_CBC_SHA: Enabled TLS_DH_anon_WITH_AES_256_CBC_SHA: Enabled SSL_DH_anon_WITH_RC4_128_MD5: Enabled SSL_DH_anon_WITH_3DES_EDE_CBC_SHA: Enabled TLS_ECDHE_ECDSA_WITH_NULL_SHA: Enabled TLS_ECDHE_RSA_WITH_NULL_SHA: Enabled TLS_ECDH_ECDSA_WITH_NULL_SHA: Enabled TLS_ECDH_RSA_WITH_NULL_SHA: Enabled TLS_PSK_WITH_AES_256_CBC_SHA384: Enabled TLS_PSK_WITH_AES_128_CBC_SHA256: Enabled TLS_PSK_WITH_AES_256_CBC_SHA: Enabled TLS_PSK_WITH_AES_128_CBC_SHA: Enabled TLS_PSK_WITH_RC4_128_SHA: Enabled TLS_PSK_WITH_3DES_EDE_CBC_SHA: Enabled TLS_PSK_WITH_NULL_SHA384: Enabled TLS_PSK_WITH_NULL_SHA256: Enabled TLS_PSK_WITH_NULL_SHA: Enabled TLS_RSA_WITH_NULL_SHA256: Enabled SSL_RSA_WITH_NULL_SHA: Enabled SSL_RSA_WITH_NULL_MD5: Enabled

  • 2
    I'd highly recommend you edit your post so it's actually readable. – Joel L Jun 21 '14 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.