Multi-Stage, evolving, silent…

It seems to always come from drive-by attacks and silently waits for the C&C to provide instructions…

I drops onto the system and creates a number of registry keys with difficult to anticipate keys, and files with semi random names. That can make it hard to find, but the one key you can count on appearing is,

– HKCUSoftwareMicrosoftInternet ExplorerSettingsGateslist

The most important thing you can do to prevent the spread of Clampi/Ilomo once it is on your network is to do no work with Domain Administrator privileges. One of the most dangerous aspects of Clampi/Ilomo is its ability to log user credentials and use them to spread across your network using legitimate tools like PSEXEC.

@echo off && reg query HKCUSoftwareMicrosoftInternet ExplorerSettingsGateslist /s || echo Does not Exist!!!!

Ilomo Botnet analyzation by TrendMicro

Threats and vulnerabilities do not seem to be categorized the same way. LOW, MEDIUM, HIGH… RED, YELLOW, GREEN… It doesn’t mean anything. Threats should be categorized and ranked based on the ease of exploit, the level of automation available, and the ease of remediation.

And thats where HELL comes in…

Nine Levels with the center being the dreaded 0-day… with limbo or level 1 populated by 100% automated attacks… things “script kiddies” use and should always be plugged because its super easy. Each level gets harder. Each level of attack requires a increasing level of skill to accomplish, but can also have a higher degree of remediation. I propose such a scale due to the complaints Ive seen, and heard about some testers ignoring “script kiddie” stuff, or claiming “you don’t test for that, because anyone can do it”… But thats the point… If any one can do it you need to fix it first, you need to fix it faster, and then you get to move onto the “l33t” hacks. 30 minutes to hack with a super “l33t” 0-day or 5 minutes with a script…

Its Up to us the InfoSec community to make these issues meaningful to the suits and systems admins we work with. Its our JOB to do the basic’s, because there are plenty of people who will try the basic’s on us.