Microsoft Windows Crash Reports Reveal New APT, POS Attacks

You never know what you'll glean from a Windows crash report: security researchers recently unearthed a previously unknown advanced persistent threat campaign as well as a new point-of-sale system attack by perusing and analyzing those crash reports also known as Dr. Watson.

Researchers at Websense -- who recently exposed weaknesses in Microsoft's Windows crash reports that could be abused by attackers or spies -- today released free source code online for enterprises to employ the crash reports for catching potential security breaches in their organizations. The researchers next week at the RSA Conference in San Francisco will release indicators of compromise for the two attack campaigns that can be incorporated into intrusion prevention systems.

Alex Watson, director of security research for Websense, says his team spotted a targeted attack waged against a mobile network provider and a government agency, both outside the U.S., as well as a Zeus-based attack aimed at the point-of-sale system of wholesale retailers. In both cases, the attacks have been suspended and the command-and-control infrastructures disrupted.

"We wanted to prove that we can detect zero-day or unknown [attacks] by a little information in crash reports," Watson says. So he and his team created crash "fingerprints" to filter and search for real-world attack intelligence in Dr. Watson reports.

Watson says the team scoured some 16 million Microsoft Windows Error Report logs over a four-month period, searching for a crash fingerprint that mimics the behavior of the Internet Explorer zero-day exploit used in attacks last year against Taiwanese high-tech equipment makers and Japanese financial institutions, the CVE-2013-3893 memory corruption vulnerability patched by Microsoft in October of last year.

Websense found five crash reports from four different organizations that appeared to indicate exploit attempts – one of which was the mobile network provider, which it would not name. Websense also spotted traffic going to a remote access Trojan typically associated with targeted attacks called Houdini H-Worm. The government agency target was spotted with a machine communicating to the RAT command-and-control during the same period, according to Websense.

The researchers then found crash reports akin to the POS malware used against Target and other retailers, mostly from a large clothing retailer in the Eastern U.S. "This was massively different from a normal Zeus infection. It appears to be a very targeted Zeus just going after the wholesale industry," Watson says. The Windows crashes appear to indicate code injection attempts, he says, and there's no evidence thus far that the attacks are related to Target or Neiman Marcus.

"As far as we can tell, no information was stolen. The command and control was blocked on outbound," he says. "This Zeus-based malware was able to steal credit cards using RAM-scraping."

Good News, Bad News

The bad news is that Microsoft's automated Windows error report feature mostly transmits crash log data unencrypted and in the clear, leaving organizations that use the function vulnerable to targeted attacks, according to Websense Security Labs. The team studied risks posed by some popular applications and services that use Microsoft Windows Error Reporting, which automatically sends to the software giant details of a system crash. The sensitive information in these reports, which includes the make and model of the machine, BIOS version, ID, and applications, can help bad guys and even the National Security Agency profile potential targeted machines and networks.

Wolfgang Kandek, CTO at Qualys, says it's not so simple for bad guys to glean intel from Windows crash reports, however. "I'm not quite sure bad guys can easily get to that information. That would mean intercepting the communication of your machine to Microsoft. Maybe they would be monitoring your router or your firewall," he says. "I'm not sure it was be that easy unless they are already in your network ... and you would have bigger problems" then, he says.

But the good news is that the reports can also be used for good, as Websense found with its fingerprinting method that exposed the previously unknown targeted attack and POS campaign.

[The NSA is reportedly using crash dumps to collect feedback on its attempts to exploit flaws in targeted companies and networks, but crash dumps still remain a successful defensive technology. See How Windows 'Crash Dumps' Aid Defenders.]

The reports absolutely can provide good information to enterprises, as well as to Microsoft, Kandek says. "A certain number of crashes may be normal across your organization ... but if it spikes up, it's worth investigating," Kandek says.

The full Websense report is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.