Interestingly, visiting the the JCDC website did not trigger the file download.<\/p>\n
The executable is called \u201cfirefox.exe\u201d and it was embedded in the Mangaung website using a simple HTML <iframe> tag pointing to http:\/\/www.jcdc.gov.jm\/uploads\/firefox.exe.<\/p>\n
The source of the Mangaung website also contained an iframe pointing to a firefox.exe file hosted on shell32.tk, but it appeared to be inaccessible.<\/p>\n
![\"Mangaung](\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2013\/05\/Mangaung-firefox.exe-malware-download-prompt.jpg\")
Mangaung firefox.exe malware download prompt<\/p><\/div>\n
Masquerading as Firefox? Smells like FinSpy<\/h3>\n
A report recently released by Citizen Lab<\/a> revealed that a spyware suite used by governments known as FinFisher sometimes had its trojan (FinSpy) masquerade as Firefox.<\/p>\n Add to this that Citizen Lab reported that it had discovered command & control servers for the spyware suite on the Telkom network in South Africa, and a logical first reaction is to suspect that a version of the FinSpy trojan was being hosted on the Mangaung website.<\/p>\n However, Citizen Lab\u2019s report suggests that FinSpy would use far less overt methods of infecting a machine.<\/p>\n An investigation by Citizen Lab, which was later confirmed by Sensepost<\/a>, indicated that the malware was not FinFisher.<\/p>\n A quick check on VirusTotal did not provide conclusive results as to what this malware might be, but further prodding from Sensepost revealed that the trojan was written in .NET.<\/p>\n Jeremy du Bruyn<\/a>, a security expert at Sensepost, explained the trojan\u2019s code had been obfuscated, making it more difficult to see what its purpose is.<\/p>\n \u201cIt employs a number of measures to make static analysis of the malware more difficult, for instance by calling \u2018IsDebuggerPresent\u2019 to check if it is being analysed and if so exit; as well as not using any hardcoded strings,\u201d Du Bruyn said.<\/p>\n The trojan developer appears to be Chinese-speaking, Du Bruyn said, which he said correlates with the Taiwanese IP address of the command & control server.<\/p>\n \u201cThe Trojan communicates with an IP in Taiwan, specifically 114.34.216.71 on port 888,\u201d Du Bruyne said.<\/p>\n Jeremy du Bruyn from Sensepost<\/p><\/div>\n At the time of publication the Mangaung website was still serving the malware, despite SITA and the JDCD being alerted to it on Thursday, 30 May 2013.<\/p>\n While the JDCD did not respond by the time of publication, a SITA spokesperson did tell MyBroadband that they don\u2019t provide the hosting for this particular government website.<\/p>\n Thanks to Siavosh, Jeremy, and Dominic of Sensepost for their work in analysing the malware. Thanks to John and the team from Citizen Lab who also provided valuable information for this article.<\/em><\/p>\n ADSL router security concern in SA<\/strong><\/a><\/p>\n SAPS website still vulnerable: hacker<\/strong><\/a><\/p>\n Slow ADSL? It could be a cyber-attack<\/strong><\/a><\/p>\n Spyware servers in South Africa: the plot thickens<\/strong><\/a><\/p>\n SA first in Africa\u2026 for malware<\/strong><\/a><\/p>\nTaiwanese spyware?<\/h3>\n
![\"Jeremy](\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2013\/05\/Jeremy-du-Bruyn-The-Panda.jpg\")
Malware still being served<\/h3>\n
More on information security in South Africa<\/h3>\n