third Cyber Security Assessment Netherlands - NCSC

Detailed section » 3 Botnets
»
Dorifel case
Detection and incident response
On 8 August 2012 the NCSC received report of failing systems.
These systems were, through infection, part of the Citadel
botnet. These systems had been ordered through the Citadel
botnet to execute new malware that later became known as
Dorifel. The Dorifel malware is a banking trojan, malware
directed at stealing internet banking log-in details. The makers
of anti-virus software had the first anti-virus updates available
the next day meaning that users with up-to-date anti-virus
software were no longer at risk from new infections from that
moment on. However this was of only limited effect because
this malware was able to switch of anti-virus software without
this being noticed. As a result, systems infected with Citadel
were still vulnerable. The Dorifel malware encrypted files on
the system and on the network storage. The Dutch anti-virus
maker SurfRight published a programme able to reverse this
encryption.
The NCSC advised various target groups of the risks and
perspective into potential action. There was close collaboration
with private investigative companies to analyse the malware.
Much of the expertise in this area appears to be held primarily
by private organisations and be limited in the government.
Impact
The version that appeared in the Netherlands was potentially
a test version. The consequences were major because this
version caused systems to fail. If the malware had worked as
planned, this attack would probably have remained unnoticed.
In the meantime it has become apparent that the number
of infections in the Netherlands is greater than abroad. The
IP addresses found on the Dorifel C&C servers show that at
least 150,000 Dutch systems are (were) infected. One of the
consequences was that organisations were unable to operate.
Because Dorifel was probably not spread through a 0-day, it is
likely that organisations were not careful enough in preventing
and detecting infection by known malware. The organisations
affected include local authorities, hospitals, parts of central
government and government-related bodies. There is no data
regarding the number of infections form organisations in the
vital sectors.
3.4 Prevent and combat
3.4.1. Combat
It is becoming increasingly difficult to detect and combat botnets.
There is more frequent use of P2P architectures, encryption and
large-scale randomly created domain names to prevent detection,
infiltration and dismantling. Under current legislation there are few
opportunities for investigators, companies and the government to
tackle sophisticated botnets.
Botnets are generally investigated, infiltrated and sabotaged by
private parties. Investigative agencies and security companies are
able to operate more freely than the government in an area where
there are still many legal uncertainties. Investigators themselves are
also calling for social discussion on whether it is desirable to have
governments infiltrate botnets because of the high impact on the
privacy of (innocent) users. [128]
Government services are predominantly reactive in their actions
during incidents and have no timely, complete and detailed picture
of malware and botnet activity. Because of a lack of information
provision and coordination of activities in this area, private sector
efforts are often temporary and limited in reach or effect, because
the efforts being made by various actors work against each other.
One example of this is switching off of the Waledac botnet by
Microsoft, something that according to investigators from Fox-IT
among others was an unwise and undesirable act because the
botnet was filtered, leaving people unable to collate information
concerning infections.
3.4.2 Responsibilities
Preventing infection by malware largely remains the responsibility
of the owner (or delegated administrator) of a system. Software
manufacturers, site administrators, Internet Service Providers
(ISPs), etc. also share some of the responsibility.
Users should continue with the time-honoured recommendations
such as maintaining updates, being aware of clicking on links and
using a virus scanner. It remains difficult for less technically savvy
end-users to adopt technical measures, it takes time and effort and
malware is spreading through constantly changing methods of
social engineering.
Recognising infection by malware is virtually impossible without
sufficient understanding of how a computer works. [129]
The high extent of spreading among victims leads to the
assumption that data was stolen from various organisations.
However it is not known what data was stolen by Dorifel.
128 http://www.f-secure.com/weblog/archives/00002056.html
129 Three of the five characteristics in the recommendation below require technical knowledge to
recognise, the other two are not applicable to botnets: https://www.security.nl/
artikel/45721/1/Vijf_kenmerken_van_een_besmette_computer.html
65