Koobface on Facebook

The popularity of social networking sites such as MySpace and Facebook has sky rocketed in recent years. Today nearly everyone has a profile and established friends lists that are used to keep tabs on your two hundred closest friends. For most, the motive behind these sites lies somewhere between a genuine interest in keeping in touch with friends and family to keeping up with the latest gossip. This popularity hasn't gone unnoticed to the malcode authors. To these authors, social engineering is a key tactic used to get their wares installed on unsuspecting victims. Social networking sites makes socially engineering victims almost too easy.

The authors of the Koobface (an anagram of Facebook) worm implemented an ingenious system that plays on a victim's interest in getting the dirt on one of their friends. At a high level, an infected user has a new wall post added or messages (Figure 1) are sent to all their friends with words such as "Check out these embarrassing videos of me...". Included with the post is a link where a user can click to get all the juicy photos or video.

Figure 1: Facebook Messages with Links to Koobface

The embedded link takes you to a dropper site hosting a fresh copy of Koobface ready to be installed on its next victim.

One variant of the infection process highlighted above involves getting a friend request or private message from an unknown individual wanting to become friends or chat. In most cases the profile picture is a scantily clad female looking to share compromising photos of herself and includes a link to her private website. If you haven't guessed already, the link takes you to a dropper site where you can get your personal copy of Koobface.

In most cases the malicious link mentioned above takes you to a YouTube like site that pops a message that you need to install Adobe Flash, a new video codec, or some other plug-in to view the video. Figure 2 is screenshot of a Koobface infection site using this technique.

Figure 2: Koobface Worm Delivered Under the Guise of Adobe Flash

Installing the "update" downloads and infects a new system/user and the cycle continues.

Malware Payload

The Koobface family of malware was first documented by researchers in mid 2008 and has trended as one of the top infectors throughout 2009 up to the current date in early 2010. Koobface's primary propagation method is through social networking sites such as Facebook, Twitter, MySpace, and Friendster. Even though the infection process remains largely the same, the payload and malicious behaviors documented as part of the Koobface infection has varied slightly over this period. Below is a list of some of these behaviors:

• Stealing login credentials and sessions stored in website cookies
• Stealing web browser saved passwords

• Trick users into solving CAPTCHAs in automated attacks against other systems (Figure 3)
• Installation of malicious proxy settings used for Ad Hijacking and Click Fraud
• SPAM and malware distribution
• Installation of a rogue webserver for command and control (Figure 4)
• Rogues security software delivery (Figure 5)

Figure 3: CAPTCHAs Served via Koobface

Figure 4: Malicious Webserver Process

Figure 5: FakeAV Pop-up Displayed on Compromised Host

Koobface Defense

A good first line of defense against this family of malware is security awareness. If users are trained to avoid clicking links from unsolicited or suspicious posts and approach installing plug-ins with caution, the social engineering infection vector is severely limited. Trained users combined with reputation based network filtering and locally installed Anti-Malware solutions rounds out a good defense against Koobface. For corporate entities, a ban on non-work related social networking sites may limit the corporate exposure to this family.

Appendix A: Infection Artifacts

The details listed in the previous sections are based in part on research data gathered during the analysis of a recent sample of Koobface:

loader.exe: 441d525538ec30002b0581373c3b7623

The infection process also yielded the follow system and network infection artifacts.

Additional Material

A wealth of additional material is available on Koobface. Below is an abbreviated list that can add an additional perspective of this popular malware family.

Win32/Koobface
McAfee, Inc.
Koobface Information on McAffe's Site

W32.Koobface
Symantec, Inc.
Information about Koobface on Symantec's Site

Koobface variant worms across social networking sites
The Register
Koobface Worm Article on The Register Site