JWP-Binde-McRee-OConnor

Assessing Outbound Traffic to Uncover Advanced Persistent Threat
Advanced
In order to gain initial access to the victim’s networks, the attackers started with a targeted spear
phishing attack against the company. Several employees of the victim companies received an
email that appeared to be from someone they trusted. However, the email contained a link to a
Taiwanese website that hosted malicious JavaScript. The malware, in turn, exploited an
Internet Explorer vulnerability. The exploit triggers when Internet Explorer attempts to access
memory that has been partially freed. Below is a program fragment from the Aurora attack.
The reason for showing this fragment is to depict the difficulty in discovering this exploit with the
lack of a signature or knowledge of the vulnerability.
function intiliaize()
{
obj = new Array();
event_obj = null;
for (var i = 0; i < 200; i++ )
obj[i] = document.createElement(“COMMENT”);
}
function ev1(evt)
{
event_obj = document.createEventObject(evt);
document.getElementById(“sp1”).innerHTML=””;
window.setInternal(ev2,1);
}
function ev2()
{
var data,tmp;
data = “”;
tmp = unescape(“%u0a0a%u0a0a”);
for (var i = 0; i < 4; i++)
data += tmp;
for (i = 0; i < obj.length; i++) {
obj[i].data = data;
}
event_obj.srcElement;
}
Program 1: Program Fragment from Aurora Attack
Although previously known at Microsoft, the vulnerability was unseen ―in the wild‖---in other
words, there was no indication that anyone else knew of the vulnerability--- and no mechanism
was in place to detect the attack. Once exploited, the victim system(s) connected to series of
Page 5