The Tale of the Targeted Trojan

Introduction

The Greeks delivered a gift of a wooden horse to the people of Troy. The citizens of Troy accepted the gift, the city fell shortly thereafter, and the term “Trojan Horse” entered the popular lexicon.

The maturation of the information age has brought to us a plethora of network-based systems, a multitude of connectivity and information sharing methodologies, and a level of interconnectivity at the enterprise and individual level never experienced before. It is also likely to continue increasing in both scope and complexity (see Figure 1.1).

Without security programs installed and security features turned on, these systems and methodologies are clearly vulnerable. But the sad reality is that even when protected by such security programs, with their various security features activated, these systems continue to be vulnerable to carefully crafted low-profile attack software that will be undetectable by a multitude of defensive products, in part because the majority of these products are designed as signature-based rather than event-based.

For such products to be effective in maintaining the security of your system, three events must occur:

■ The signature of the attack profile must match a known signature profile.

■ The attack profile must have been seen before by the software manufacturer.

■ The user must update the software to bring the signature of the attack profile to their system.

The Haephrati Case

This tale of the targeted Trojan—a.k.a., the Haephrati case—was active from 2003 to 2005 and came to the public light in January 2006.

At that time, we saw the extradition of Michael Haephrati along with his wife Ruth Brier-Haephrati from the UK to Israel, an event that under normal circumstances would not have garnered much attention had they not created, distributed, and utilized some of the most interesting and successful pieces of software specifically designed to steal the intellectual property of the target. Upon arrival in Israel, the couple pled guilty to the charges brought against them and were convicted. This case has turned out to be one of the most expansive and interesting cases of industrial espionage in many years.

In late-May 2005, the two Haephratis were arrested by British authorities in London, at the request of Israeli authorities, for having conducted he “unauthorized modification of the contents of a computer.” Put more simply, they were charged with having created and placed a “Trojan” file on a computer, not their own, and having siphoned the contents from the computer. But this puts it too simply. What they really did was create their own cottage industry. They provided an “outsourced” technical capability that provided to the “business subscriber,” a monthly compendium of illicitly obtained correspondence, documents, economic data, and intellectual property from the computer systems of firms targeted by the Haephratis’ subscribers.

In essence, provisions of a sophisticated and highly effective outsourced industrial/economic espionage capability were made available to both individuals and enterprises. The Chief Superintendent of the Israel Police National Fraud Unit, Arie Edleman, describing the tool created by Michael Haephrati said, “It not only penetrated the computer and sent material to wherever you wanted, but it also enabled you to completely control it, to change or erase files, for example. It also enabled you to see what was being typed in real time.” He continued, “This is not common software that anti-virus software makers have had to fix.”

The When

■ Initiated circa May 2003

■ Discovered circa November 2004

■ Neutralized circa May 2005

■ Arrested in the UK and then extradited to Israel January 2006

■ Convicted and sentenced March 2006

The How

The Hook

■ Delivered via targeted personal e-mail.

■ Received an e-mail from an address that looked like one of a known entity, such as the e-mail address gur_r@zahav.net.il, which was read as e-mail address gur-r@zahav.net.il.

■ The bogus account was identified as being opened by a person who lived in London and charged the fees to their American Express card.

■ Delivered via targeted commercial e-mail.

■ Targets received an e-mail message offering a business opportunity.

■ Those that responded to info@targetdata.biz would receive the Trojan.

■ The domain targetdata.biz was registered to Haephrati.

■ Delivered via targeted compact disc.

■ Target received a compact disc offering a business opportunity.

■ Those who responded to info@targetdata.biz would receive the Trojan.

The Mechanism

■ While the exact code that Haephrati created and customized for each victim has not been released to the public, a review of relevant security bulletins provides a good indication of how the code functioned.

■ The Trojan included a key-logger, a store-and-forward capability, and would send documents and pictures to FTP servers (file storage servers) located in Israel, the U.S. and other locales. The investigation turned up dozens of servers located around the globe. The program allowed for Haephrati to remotely control the computer of the unsuspecting victim. In essence, Haephrati was running a well-managed store-and-forward service. They were not relying on botnets or other illicitly acquired infrastructures. They had a business to support and leased their infrastructure. According to the Israeli police, items stolen included marketing plans, employee pay slips, business plans, and details on new products, all of which were passed to rivals. The data included over 11,000 pages of data, which consisted of thousands of pages of “confidential” data (more than 11 gigabytes of material).

The Who

Michael Haephrati is the computer programmer who created the original Trojan program, allegedly planted on his in-laws computer so as to provide him the means to harass his former in-laws. According to the press, Ruth Brier-Haephrati saw the business opportunity in selling the capability. In Israel, a number of private investigative firms were identified as being positioned between the Haephratis, the clients, and the victims. Haephrati began creating one-off programs for targeted delivery, based on information acquired about the victim—in other words, they were provided the specific information necessary to craft the tool that would undermine the security apparatus and/or techniques employed by the victim. According to the Israeli police, the capability was also sold to firms outside Israel, none of which have, as of mid-2007, been publicly identified. Thus, it is expected that firms outside Israel have also fallen victim to this type of methodology and specific technology.

The Why

As noted earlier, the initial motive was revenge. Haephrati resented his former in-laws and set about to defame them by manipulating information obtained from their computer. The recipient of the Haephratis’ efforts had a simple motive: economic advantage over their competition.

The Cost

Haephrati charged each business customer the equivalent of US3500 to create the customized program and make the initial install on the victim’s computer, and another US900/month to maintain the infrastructure used to collect, forward, store, collate, and deliver the illicitly acquired information on a monthly basis. The cost to the recipients was the fee they paid to the intermediary who contracted Haephrati’s services. And what was the cost to the victims? Extreme. They lost their intellectual property, lost business opportunity, and lost the privacy of their employees’ personal data. They also lost go-to-market plans, as well as customer requirements, and they potentially lost the trust of their customers. Table 1.1 lists various items traded on underground servers.