Why Dyre Is Different and What It Means for Enterprises

By Bob West, Chief Trust Officer, CipherCloud

The Dyre Trojan, which salesforce.com warned its customers about earlier this month, shows that cyber criminals have found a brand new way to target cloud applications.

It is the first known malware tool to deliberately target an enterprise cloud provider and use trusted cloud file sharing services like Dropbox to install itself on client systems. The malware hammers home exactly why companies need to pay close attention to both server-side and client-side security when using cloud services.

Dyre, or Dyreza, was first spotted in the wild in June attempting to steal the banking credentials of customers of major banks such as Citibank, RBS and NatWest. More recently, it appears to have been tweaked to specifically target customers of salesforce.com.

In design and function at least, Dyre is somewhat similar to other Remote Access Trojans (RAT) like Zeus. It typically arrives disguised as a harmless download or attachment that unsuspecting users are tricked into installing on their computers. It then lurks quietly on the system waiting for the user to type in a target URL, like Natwest.com or salesforce.com. Dyre then quickly intercepts the user’s browser session and routes it through a server controlled by the attacker.

Dyre employs a tactic called “browser hooking” to strip SSL protections from supposedly secure sessions. So someone entering their login credentials to access a saleforce.com account or their bank account is actually handing over their username, password and other session data in clear text to the attacker without realizing it.

The version of Dyre that targeted customers of salesforce.com appears designed only to harvest user logins, probably so the credentials can later be sold for use by other cyber criminals. An attacker can potentially use the illegally obtained credentials to take over the associated accounts and carry out all the actions of the authorized users of those accounts without anyone realizing anything until it is too late.

Cyber thieves have used this kind of account hijacking to drain hundreds of millions of dollars from the bank accounts of numerous small businesses, municipal governments and school districts over the past several years.

With Dyre, the threat has moved for the first time to cloud applications.

In this particular instance, the attackers used Dyre to go after customers of salesforce.com. But make no mistake – the malware can be used just as easily to harvest data from customers of other cloud applications as well.

Cyber criminals have clearly figured out that there is a lot of potentially profitable data that can be harvested by going after cloud customers. But instead of trying to infiltrate cloud server-side protections they appear to be going after vulnerable client systems belonging to the end users of enterprise cloud applications.

Many of those infected by Dyre were lured by spear-phishing emails containing a link to a malicious document hosted on Dropbox. Those who downloaded the document thinking it was safe because it was on a reliable site like Dropbox, infected their systems with Dyre. Because Dyre uses some sophisticated packaging and obfuscation techniques, it has been able to avoid detection by most AV tools until recently.

Salesforce.com, is one of the most successful and most trusted cloud services used by businesses. There’s really not a whole lot that salesforce.com or any other cloud provider can do in a situation like this beyond urging customers to follow security best practices. The vulnerability lies more on the client side and not in the cloud.

In an alert, salesforce.com urged customers to ensure that the antivirus tools on their client systems were fully updated and capable of detecting Dyre. The company also asked companies to consider implementing IP range restrictions to ensure that only users from a corporate network or VPN were allowed access to the Salesforce Platform. In addition, salesforce.com recommended that enterprises consider employing two-factor authentication as an additional security measure for users attempting to login from an unfamiliar device or location.

Customers of cloud applications can also mitigate their exposure to Dyre by using cloud encryption gateways for customer-side encryption that protects data. Businesses with particularly sensitive data in the cloud should also consider encrypting the client email addresses and other identifiers, such as Social Security Numbers, that are used for login and authentication to cloud applications.