Chronicle’s VirusTotal (VT) is a boon to security researchers and a gift to potential criminals. Apart from virus samples it contains likely millions of user credentials readily available to anyone who knows where and how to look.
This is the finding of SafeBreach researchers who wanted to see if VT’s advanced search capabilities could provide a supercharged version of Google Hacking (dorking). They found it could.
The research started with an analysis of samples of well-known infostealers found on VT, such as RedLine Stealer, Azulrt, Raccoon Stealer and Hawkeye. The malware samples contain their exfiltration filenames. SafeBreach researchers then used VT’s own search capabilities to see if any infostealer exfiltration files could also be found on VT. Perhaps surprisingly, they found many such files.
Why malware exfiltration files should be found alongside the malware on VT is strange. SafeBreach director of security research Tomer Bar offered several possible reasons. Some are based on simple user error: users detect a file they do not recognize and simply upload it to VT to be checked ‒ not necessarily realizing it might contain their own sensitive data stolen by the infostealer. Once on VT, it stays there.
A more disturbing reason, he suggested, is that criminals do this themselves, using VT as a marketing tool to display their catalog while hiding in plain sight. “It’s simply been overlooked,” Bar suggested to SecurityWeek, “because it is not easy to see what you’re not looking for.”
In a research blog post on January 18, 2022, SafeBreach gives examples of what it found. Using VT to search for Azulrt related files “YandexBrowser_Default.txt“, it found more than 20 instances. Among those is a folder called ‘Новая папка’ from September 2021. It contains zip files with 1,000 victims comprising 405 MB of exfiltrated data. The content included 44,000 Gmail passwords, 7,000 Hotmail, 4,700 Facebook, 950 PayPal and 30 Visa.com.
“These credentials,” says the report, “are for 1,300 government sites from 48 countries.” They include tax-related sites such as the IRS in the U.S., HMRC in the UK (including the universal credit website), and India’s passport office.
Overall, the report continues, “We were able to collect more than 1,000,000 credentials in a few days, exfiltrated by different types of malware, and unencrypted cryptocurrency wallets. We were also able to discover a market that publishes 1000 victims’ data for free as a teaser and publishes a site and a Telegram channel selling one hundred thousand victims’ exfiltrated data.”
Similar results were found with each of the infostealers SafeBreach examined, demonstrating that VT Hacking is a serious issue. SafeBreach calls it ‘the perfect cybercrime’ since there is no risk to the criminal, little effort required, no need for any additional malware to be developed or acquired and installed, and no defense from it. All the criminal requires is a “VT license for the small fee of €600”.
VT Hacking works at scale. “A lazy criminal who uses this method can gather an almost unlimited number of credentials and other user-sensitive data in a short period using an infection-free approach,” says the report.
It can even be automated. “You could use a Yara rule to alert you in real time about any new file,” Bar said. “The basic VT license allows you to set something like 15 rules. So, you could take the top ten infostealers and use ten of these rules to get a notification in real time that a new file has been uploaded and is available.”
More than a month ago, the company contacted Google with its findings and recommendations, including for example, the addition of an algorithm that disallows uploads of files with sensitive data that contain cleartext or encrypted files with the decryption password attached textually or by image. Google acknowledged receipt.
“But Google did not tell us what they plan to do,” Bar told SecurityWeek. “A week ago, we repeated our searches, and the results are almost all still available. I sent Google a second mail saying the data is still available, but I haven’t had a response.”
He continued, “We waited more than a month before publishing our findings, but without a response from Google we are now publishing the details of our research to bring the issue to the attention of companies so they will be more sensitive to how they upload their own files. We prefer to wait until vendors fix any problems we find, but this is a bit different since it is available to any criminal with no hacking skills, has no IOCs, and is undetectable by the ‘victims’. I do have confidence, however, that Google will fix the problem in time.”
Related: Breach and Attack Simulation Firm SafeBreach Doubles Funding With $53.5M
Related: VirusTotal Introduces ‘Collections’ to Simplify IoC Sharing
Related: How Attackers Use Search Engines and How You Can Fight Back!
