STE WILLIAMS

DDoS attacks taking advantage of ill-advised use of memcached have begun to decline, either because sysadmins are securing the process, or because people are using a potentially-troublesome “kill switch”.

Memcached is a handy caching tool that can improve database performance but has no security controls because it was never intended to be used on internet-exposed systems. In late February attackers started to take advantage of the fact that memcached is a very effective amplifier of UDP messages, since a 15-byte query returns answers that could be hundreds of kilobytes. Attacks on the cache briefly gave GitHub the honour of the biggest ever DDoS attack at 1.7 Tbps, but within days a US service provider took an even bigger hosing.

Last Wednesday, the risks posed by Internet-facing memcached processes took on a new colour, when security vendor Corero explained that a debug command could let a remote attacker retrieve, modify, or insert data into a system.

Corero said that there’s a kill-switch it was deploying for clients. The flush_all command does exactly what it says: the process drops all the objects in memory, and the attack ends.

Cloudflare and Arbor Networks, warned eWeek they’re worried about the ethics and legality of someone firing flush_all at someone else’s machine, because changing the contents of a computer you don’t own is illegal in many or most jurisdictions.

The attack volumes kept increasing for most of last week. Qihoo 360 last Wednesday said it had logged 10,000 attack events in the previous week, and identified 7,131 victim IP addresses.

Those included Qihoo, Google, and Amazon, various smut sites, games, security vendors, various National Rifle Association sites, and Brian Krebs’ page.

It seems the slow business of getting memcached hidden behind firewalls is happening at last, however, with no new attacks reported over the weekend. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/03/12/memcached_cavalry_spotted_on_the_horizon/

There’s a flourishing trade in illicit code-signing certificates, and even extended validation certificates can be purchased for a few thousand dollars.

That’s the conclusion of a study by American and Czech researchers, with input from Symantec Labs (the company’s technical director Christopher Gates is a co-author).

The research found that the success of Microsoft’s Windows Defender SmartScreen has forced attackers to change tactics. Once, malware authors would seek out code-signing certificates that had been compromised. During 2017, however, paper says “these methods have become secondary to purchasing certificates from underground vendors”.

The paper cited platform protections like SmartScreen as driving this change.

During 2017, the researchers followed the fortunes of “four leading vendors of code-signing certificates”. One seller turned over a new certificate every couple of days, and for around 50 code-signing certificates they generated US$16,150, suggesting individual certificates are only worth a few hundred each.

That might not be enough to defeat Windows Defender SmartScreen, however. As the paper explained, when SmartScreen encounters a certificate for the first time, it doesn’t have a reputation associated with the cert so will raise a warning the user has to click-through during installation.

If attackers “want to go unnoticed, a positive reputation needs to be built for the certificate first by signing benign programs and installing them on many client machines.”

Extended Validation certificates come with a positive SmartScreen reputation. As a result, they cost more.

“Extended Validation code-signing certificates can also be purchased, for a few thousand dollars each, with the 2FA hardware tokens they are bound to them being subsequently shipped by post”, the paper said.

The researchers reported EV certificates at prices ranging from from $1,600 up to $7,000 for certificates with the best SmartScreen reputation.

The four vendors the researchers followed operated in Russian and English forums, with one called Codesigning Guru launching a store on the public Internet.

There’s at least a whiff of the cert-selling operations depending on front companies, although the paper stops just short of making an outright accusation. Having checked the registrations for British operations the researchers said that the “publishers” generating the certificates are “rather young companies, some of them being incorporated around a month before their code-signing certificate was issued, and most of those did not have software development as their primary focus”.

Whether or not the companies were set up specifically for certificate abuse, the paper said it indicates a problem in the certificate ecosystem:

Either a malicious party managed to set up a shell company and have a certificate issued on it (without proving identity of the founder), or impersonate a real company (possibly using the data available in the public register).

That was only the British operations: most of the activity the researchers found originated in Russia.

The paper calls on Certificate Authorities to vet applicants more carefully, and says once a malicious publisher is discovered, all certificates from that publisher should be revoked. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/03/12/susicious_digital_cetificate_sales/

Researchers explore why an attacker would target robots with ransomware, and the implications of what might happen if they did.

Robots are in our homes, businesses, schools, and industrial facilities. They’re builders and service workers, healthcare attendants and customer assistants. As robots continue to proliferate in our lives and human-robot interactions grow, so does the potential for cyberattacks.

The rise of robots is driving new attack vectors and threat scenarios — for example, a robot-targeted ransomware attack. IOActive experts this week conducted the first-ever ransomware attack on robots at the 2018 Kaspersky Security Analyst Summit, following extensive research on the key elements needed for an attack like this and the implications that would result if hackers were successful.

Lucas Apa, an IOActive senior security consultant, and IOActive Labs CTO Cesar Cerrudo have long explored robot security. Last year, the two disclosed about 50 flaws in popular robots and robot-control software used in businesses, homes, and industrial sites. Attackers could abuse these to remotely control a robot, infiltrate networks, steal data, and cause physical harm.

Their latest research explores post-exploitation techniques that ransomware attacks could use to disrupt businesses and force payment. “We decided to expand over our previous research, mainly because we realized ransomware could be used to get an actual profit,” Apa explains.

Traditional endpoints commonly store information, which is why data has always been the primary target in ransomware campaigns. Robots are different; they handle different types of data but aren’t typically used to store it. Payment data, video feeds, and audio are all examples of sensitive information that robots process but don’t store internally.

Apa and Cerrudo were curious whether this data could be targeted with ransomware. The team built a proof-of-concept (PoC) ransomware to stage an attack on Softbank’s NAO, a research and education robot with 10,000 in use worldwide. Their PoC attack also works on Pepper, which has nearly the same operating system and vulnerabilities as the NAO robot. The researchers note this attack is possible “on almost any robot” in a blog post detailing their findings.

Someone could deploy ransomware by exploiting an undocumented function that allows remote command execution. The flaw was reported to Softbank and is being disclosed today. As of this writing, there is no fix available. From there, an attacker could infect module files to change the robot’s default operations, disable admin features, monitor video and audio, and send data to a command-and-control server.

This infection could spread among robots connected to the same internal network, even if they’re not on the Internet, says Cerrudo. If a robot is running the same operating system as a desktop machine, there is potential for an infection to spread from one to the other.

“An attacker can execute commands and modify certain behaviors of the robot,” he explains. “If this is done on a high scale on company robots, which could be in the hundreds … this could affect an entire group of robots.”

The Potential for Damage
The implications of robot ransomware are broad and dangerous. An attacker could completely interrupt service by shutting robots down, display offensive content on the robot’s screen, or perform violent movements and even cause harm to workers. Instead of targeting data, attackers could target software to make the robot non-operational until the victim pays up.

There are several reasons businesses might pay the ransom in these cases. For starters, robots are expensive. Even the most basic enterprise robots cost about $10,000, Apa notes. Most businesses would rather pay attackers than deal with the hassle of fixing a dead robot.

“It creates a huge problem,” says Cerrudo. “Once a robot has been compromised with ransomware, you have to send it away to fix it or employ a special technician to fix the problem. It could take a few days or many weeks.”

And for robots used in the enterprise, time is money. Every second the robot is not working causes financial loss, whether it’s from lost revenue, production costs, or repair costs.

Both Apa and Cerrudo anticipate the risk of robot ransomware will grow as businesses become increasingly dependent on them to build products and offer services. Attackers can exploit them to do more than steal data, driving the consequences of ransomware.

While the ultimate fix is for vendors to build more-secure robots, the researchers urge businesses to take precautions when deploying these machines in the enterprise. “Make sure the robot has security protections, authentication, and encryption, and it’s not an easy target,” says Apa. “Research has shown most commercially available robots are insecure.”

Related Content:

• DevSecOps: The Importance of Building Security from the Beginning
• 7 University-Connected Cyber Ranges to Know Now
• CIGslip Lets Attackers Bypass Microsoft Code Integrity Guard
• Cybersecurity Gets Added to the MA Lexicon

 

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop ITX 2018 agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/what-happens-when-you-hold-robots-for-ransom/d/d-id/1331230?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cars are getting smarter every year but their increasing computational power isn’t being backed up by good IT security practices – hacking them is child’s play.

That’s the conclusion of a series of speakers at the Kaspersky Security Analyst Summit. These security researchers have demonstrated how easy it is to introduce software into vehicles to steal data, take control of vital functions, get around alarm and electronic key systems and even crash the car.

“Most cars these days are essentially computers running on four wheels,” said Stefan Tanase, principal security researcher at Romanian network testing shop Ixia.

“The only difference is when you have a problem with computer it won’t affect your physical security, but a car can put your life in danger and automotive security is something that the industry needs to take seriously.”

His fellow researcher Gabriel Cirlig recently bought a car and they decided to see how difficult it would be to hack. It proved to be astonishingly easy. They even managed to turn it into a war-driving machine that could spot and log open Wi-Fi connections.

Cirlig found some code on an open car hacking website that claimed to be able to give root access to a car’s control systems. After using the autorun-enabled USB port, he added the code and found it worked like a charm and tunneled into the car’s infotainment system.

What he found was rather disturbing. When he had connected his phone to the car earlier, it had crawled his entire address book and email list, taken a copy of SMS messages and logged his most visited locations in the last month – all stored in plaintext and perfect for those interested in surveillance.

After installing UNIX Cron software to ensure persistence, the two were able to set up the car’s Wi-Fi to scan for open connections. Thankfully it didn’t seem possible to hack the car from afar via the Wi-Fi but the two suggested it could probably be done given enough research.

Cirlig also found something useful in the car’s software relating to the automatic braking software. The car pings out a 40khz pulse of sound and uses echolocation to detect if there’s an obstacle in the road and will brake if a collision is imminent.

He theorised that if you mounted a similar speaker on another car you could fool another vehicle into slamming on the brakes by tricking it into thinking another car was just ahead, possibly injuring the driver or causing a skid.

While the two were careful not to reveal the make of car involved in the testing, it looked very like a late-model Mazda. After contacting the supplier they said the manufacturer considered its systems features, not bugs.

It gets worse

In a separate presentation Marc Rogers, head of information security at Cloudflare, detailed a number of ways in which basic manufacturing mistakes left car drivers vulnerable to hacking.

The average time from conception to a finished vehicle coming out of the factory is between four to six years, he said. But most Linux distros used in vehicles become outdated sooner than that and he said that vulnerabilities had been found in car code that were more than ten years old.

The current generation of controller area networks in cars is hopelessly out of date and isn’t designed to be secure, he said. Data traffic is unencrypted and access to the CAN is easy using mandated data ports in vehicles.

Keys are another area of weakness. Some electronic keys have a pitifully small number of combinations, but more worrying is the use of signal amplification technology. There is kit available online for around $60 that can pick up the signal from keys and copy them to the car, unlocking them and disabling the alarm system.

All cars sold in the US these days also have to have tire pressure measurement systems installed as standard, and the signal is unencrypted. A suitably programmed Raspberry Pi can use the signal to track cars, but more worryingly can be used to crash the engine control unit that controls keyless entry.

“Car theft rates have been falling for years,” he said. “But in the UK in the last two years they have risen 20 per cent. A direct causal link is difficult but it looks suspicious.”

It’s not just the UK. In the US, car theft rates have risen in the past two years. In 2015 they were up 3.8 per cent and in 2016 there was a further 7.8 per cent rise.

Most manufacturers are still not taking security seriously, he noted, and while they might pen test some subsystems they never do the whole car. This needs to change if future drivers are to be secure on the road. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/03/10/auto_manufacturers_are_asleep_at_the_wheel_when_it_comes_to_security/

If you’re trying to hack an organization then pwning the sysadmin’s machine gives you the keys to the kingdom, and an advanced malware writer has found a clever way to do just that.

The malware, dubbed Slingshot by researchers at Kaspersky Lab and showcased at the firm’s Security Analyst Summit, resides in Mikrotik routers – presumably on the principle that the only people who access the devices are an organization’s IT team. It’s not known how the malware gets onto the router, but it contains a malicious dynamic link library that’s capable of pulling in all kinds of nasty attack tools.

“Never seen this attack vector before, first hack the router and then go for sysadmin,” said Costin Raiu, Kaspersky’s director of global research and analysis. “We’ve seen a lot of attacks against sysadmins but sometimes it’s tricky to find them. This is a very good way to hack the sysadmin and get the keys to the kingdom – it’s a completely new strategy.”

The malware was discovered by accident. The team was analyzing a piece of keylogging code and decided to scan to see if it could be found elsewhere. The malware’s signature turned up in a seemingly innocent file on another computer labelled scesrv.dll.

In testing, once a computer links into the router’s configuration system, the malware activates and dumps a copy of itself onto the connecting PC and gains root access. It then downloads new modules, including two powerful pieces of code dubbed Cahnadr and GollumApp which can harvest screenshots, keyboard data, network data, passwords, USB connections, other desktop activity, and clipboard data.

The malware tries very hard to stay under the radar using a selection of advanced techniques, including identifying the security software used and attempting different tactics to evade detection depending on the code protecting the PC, encrypting all strings in the malware and employing specific anti-debugging countermeasures.

The malware also appears to have had a long lifespan – the code was tagged as Version 6.x and text notes in the software suggest it was developed by an English speaker. Kaspersky thinks that the amount of time and money it would have taken to write Slingshot strongly suggests it was developed by a nation state.

Slingshot is also relatively rare, which also helps keep it under the radar. The researchers found only around 100 infections and the vast majority were in Africa and the Middle East, with Kenya and Yemen showing the most compromised systems. Slingshot has been in circulation since 2012.

Signature files for the malware have now been issued and Mikrotik has updated its code to block Slingshot. System administrators are advised to update the firmware as soon as possible – use a burner PC to do it, just to be safe. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/03/09/slingshot_malware_uses_cunning_plan_to_find_a_route_to_sysadmins/

Paying off a ransomware demand is a great way to end up losing both your money and your files.

This according a study from security company CyberEdge, which found that for those hit by a ransomware infection the best bet is probably to just restore from a backup. The survey, based on a poll of information security professionals, found that less than half of those who pay a ransom demand end up getting their data back.

The report says that 55 per cent of the people it surveyed reported a malware infection hitting their systems in 2017. Spain had the highest rate, with 80 per cent of respondents reporting malware, followed by companies in China (74 per cent) and Mexico (71.9 per cent.) In the US, 53.8 per cent of respondents were hit by ransomware, while slightly under half of those in the UK, 49.5 per cent, were hit.

Overall, 72.4 per cent of those who were infected with ransomware were able to get their data back. Most of those, however, were companies that simply ignored the ransom demands, then restored their systems with uninfected backup copies. The study found that 86.9 per cent of those who refused to pay the demand ended up recovering their data.

Of those who caved to the demand and paid the ransom, 49.4 per cent said they could recover their data, while 50.6 ended up losing it anyway. The not-so-shocking conclusion is that criminals don’t always stay true to their word.

“It’s like flipping a coin twice consecutively – once to determine if your organization will be victimized by ransomware, and then, if you decide to pay the ransom, flip it again to determine if you’ll get your data back,” CyberEdge says.

“The clear lesson here is the critical importance of maintaining up-to-date offline backups.”

There is some good news to be had in the report, at least. CyberEdge notes that, for the first time in the five years it has been doing the annual report, the number of respondents reporting at least one attack was down (from 79.2 per cent to 77.2) and the number of companies that were frequently attacked, more than six times in a year, was also down.

“Perhaps this is more evidence that IT security has finally stopped the bleeding of rising cyberattacks,” CyberEdge says.

We can only hope so. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/03/09/less_than_half_of_ransomware_marks_get_their_files_back/

Improved anti-malware detection prevented spread of cryptomining software this week, says Microsoft.

The spread of a Dofoil cryptomining campaign was contained this week in part because of Windows endpoint security platform for Windows 10, according to Microsoft researchers. 

Researchers write that using “behavior-based signals coupled with cloud-powered machine learning models” Windows Defender Antivirus initially blocked 80,000 instances of the Dofoil Trojan, which carried a cryptomining payload, “within milliseconds.”

Over a 12-hour period, 400,000 instances total were stopped. The spread was contained in part due to Defender’s cloud protection service, which shares threat intelligence to other machines running Defender on Windows 7, 8.1, or 10. (Microsoft extended support for Defender to Windows 7 and 8.1 in February.) 

See more here.

 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/microsoft-windows-defender-prevents-400000-dofoil-infections-/d/d-id/1331237?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Internet users in Turkey, Egypt and Syria who attempted to download legitimate Windows applications have been redirected to nation-state spyware through deep-packet inspection boxes placed on telecom networks in Turkey and Egypt, according to a report issued Friday by security research group Citizen Lab.

Citizen Lab, a Canada-based security and human rights research group run out of the University of Toronto’s Munk School of Global Affairs, said it has found Sandvine PacketLogic devices being used on the networks of Türk Telecom and Telecom Egypt for distributing malware designed for varying purposes, ranging from political censorship to cryptocurrency mining.

“The apparent use of Sandvine devices to surreptitiously inject malicious and dubious redirects for users in Turkey, Syria, and Egypt raises significant human rights concerns,” the report says.

Targeted internet users in Turkey and Syria who attempted to download Windows applications from official vendor websites, including Avast Antivirus, CCleaner, Opera, and 7-Zip were silently diverted to malware-infested versions of the software through HTTP redirects, the report says.

“This redirection was possible because official websites for these programs, even though they might have supported HTTPS, directed users to non-HTTPS downloads by default,” the report says.

In Turkey and Syria, the malware in question is said to be similar to spyware known as StrongPity.

Citizen Lab claims those targeted in Turkey and Syria who downloaded applications from CBS Interactive’s Download.com were also redirected to downloads containing spyware. The group says that Download.com, despite claiming to offer secure downloads, does not appear to support HTTPS.

A spokesperson for CBS Interactive’s CNET did not immediately respond to a request for comment.

In Egypt, the Sandvine boxes appear to have been employed for a money-making scheme referred to as AdHose, which, according to Citizen Lab, involves distributing either affiliate ads or browser cryptocurrency mining scripts. The network hardware is also supposedly being used to censor sites like Human Rights Watch, Reporters Without Borders, Al Jazeera, Mada Masr, and HuffPost Arabic.

Sandvine and its owner, Francisco Partners, has been engaged in a back-and-forth with Citizen Lab in recent weeks over concerns that the pending report is technically flawed and misrepresents the company’s products.

In a March 7 letter, Sandvine asked the University of Toronto to delay publication of the report, claiming that Citizen Lab’s allegations are not technically feasible and are intentionally misleading.

What’s more, the firm charges that Professor Ronald Deibert, who heads Citizen Lab, relied on unethical research methods and misappropriated company technology by acquiring a second-hand Sandvine box for testing.

In a letter sent on Thursday in response to Sandvine’s objections, attorneys representing the University and Citizen Lab disputed the network hardware company’s claim about the inability of its technology to function as described in the report, defended Citizen Lab’s methods, and questioned the networking firm’s unwillingness to respond to questions about its commitment to human rights and ethical business practices.

“You state, broadly, that Sandvine takes seriously its commitment to corporate social responsibility and ethical use of its products,” the letter states. “However, you have not responded to any of the specific questions asked of Sandvine by Citizen Lab in letters dated February 16 and March 1, 2018.”

In response to an inquiry from The Register, a spokesperson for the company in an email said:

Sandvine is deeply committed to ethical technology development and we hold our business processes and behavior to the highest standards. We institute strong safeguards to ensure adherence to our principles of social responsibility, human rights, and privacy rights. We have a Business-Ethics Committee that conducts a comprehensive review of all potential regulatory compliance engagements to identify risk of product misuse prior to any sales. We investigate all allegations of misuse and have a place on our website to report such allegations.

Based on a preliminary review of the report, certain Citizen Lab allegations are technically inaccurate and intentionally misleading. Despite repeated requests, Citizen Lab refused to provide us with a copy of their report or any underlying data prior to its release, which made it impossible for us to investigate their allegations of misuse of our product and denied us any opportunity to fully respond to the claims in the report.

Our investigation of these allegations remains ongoing. We have never had, directly or indirectly, any commercial or technology relationship with any known malware vendors, and our products do not and cannot inject malicious software. While our products include a redirection feature, HTTP redirection is a commodity-like technology that is commonly included in many types of technology products. This standards based protocol is present across a wide variety of networking elements that an end user’s traffic would traverse and is widely deployed and used every day by corporations, security products and telecom providers (just to name a few) for legitimate and lawful purposes.

The Citizen Lab report concludes that companies like Sandvine that do business with regimes that flout democratic norms need to take responsibility for potential uses of their products that violate human rights. It also says that its findings underscore the need for website operators to support HTTPS connections. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/03/09/citizen_lab_claims_sandvine_hardware_used_to_enable_government_spyware/

Phil Bredesen’s campaign for US senate sees a hacker’s hand in email messages

The mid-term US election season is underway and it seems that hackers are already busy. Phil Bredesen (D), the former governor of Tennessee, is running for senate in that state. And his campaign has notified the FBI that they think a hacker has already been in their network.

Signals of a hack came from a phishing email asking for money: a message sent from an email account almost identical to that of the campaign’s media buyer. In itself, that’s not evidence of a hack, but there were details about the message, including dates of upcoming media purchases that indicate the sort of inside knowledge available through hacked servers or accounts.

There is significant concern among US law enforcement and intelligence officials that Russian hackers, who were active during the 2016 election, will seek to disrupt and influence the 2018 election, as well. While the Bredesen campaign evidence points to criminal, rather than political, motivation, it does indicate that political campaigns should still be paying more attention to computer security than many seem prepared to pay.

The FBI declined the opportunity to comment, as is normal for on-going investigations.

Read more here and here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/tennessee-senate-campaign-sees-possible-hack/d/d-id/1331226?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Advanced hacking group appears to be native English speakers targeting Africa, Middle East.

KASPERSKY SECURITY ANALYST SUMMIT 2018 – Cancun, Mexico – A newly discovered nation-state cyber espionage campaign targeting Africa and the Middle East infects network routers in order to snare administrative credentials from its targets and then move freely throughout the network.

Kaspersky Lab researchers unearthed the stealthy and highly sophisticated operation – named “Slingshot” after a word found in the attack code – that has infected at least 100 victims since at least 2012, with nearly half in Kenya, and the rest in Yemen, Libya, Afghanistan, Iraq, Tanzania, Greece, Jordan, Somalia, Tunisia, Turkey, Mauritius, and the United Arab Emirates. The attackers ultimately gain kernel-mode access to victim machines where they then gather screenshots, network information, keyboard data, passwords, USB connections, and other activity and data.

Just how Slingshot initially compromises the target’s network routers is unclear, but Kaspersky researchers say the goal is to gain access to valuable systems admin credentials that then give the attackers a foothold in the network. Slingshot targets MikroTik routers, dropping a malicious dynamic link library (DLL) on the devices that serves as a downloader for other malware. Then when a router admin accesses the router, his or her machine gets silently compromised via the infected router.

Router hacking is a relatively rare attack vector, but it’s an effective one for hackers. Malicious code can sit on these perimeter devices unnoticed because few security tools can detect it. “We think the developers of the malware decided to infect the victims from routers because they wanted to stay undetected,” said Alexey Shulmin, lead malware analyst, Kaspersky Lab, in an interview. “A compromised router can be very hard to detect … During the past years, we have seen several high-profile cases where router malware was involved.”

Shulmin said router security is typically a “blind spot” for organizations. “We are probably only seeing the tip of the iceberg” in router compromises, he said.

In the case of Slingshot, the attackers appear to have been fishing for systems admins to infect and then use their credentials to move laterally. “Once you infect the systems admin, then it becomes quite easy to move through the network. They have access to everything,” said Costin Raiu, head of Kaspersky Lab’s global research and analysis team.

Just how the Slingshot attackers actually infected the routers remains a mystery, but the researchers believe an exploit was used to abuse a vulnerability in the MikroTik router software. Once it infects the system admin and spreads to victim machines, it embeds malware in the kernel of the operating system.

That method indicates that it’s an especially well-resourced and advanced attack group behind the attack. “Nowadays, it’s getting harder and harder to get into kernel mode because most [OSes] support technologies where you can’t load a driver into kernel mode,” Shulmin noted.

The attackers also install code that allows them to store their stolen data such as keylogger files, system information, and other data encrypted on the victim’s hard drive for convenient access.

Slingshot also encrypts and hides its network traffic among legitimate network traffic using a so-called passive network-driven backdoor, typically a server directly connected to the Internet that sits there silently awaiting remote instructions from the attackers. “We’ve seen this [method] before with the Lamberts family,” namely the White Lambert and Grey Lambert hacking teams, Raiu said.

The researchers aren’t sure who is behind the attacks, but there are some intriguing clues they found: Slingshot appears to be a native English-speaking group that employs techniques reminiscent of the Russian-speaking Turla, Equation Group’s (aka the NSA)’s Grayfish platform, and tools from White Lambert, thought to be a CIA hacking team. “Both the White Lambert and Grey Lambert threats use the same mechanism as Slingshot; they try to exploit vulnerable drivers to deliver their code into kernel mode,” Shulmin said.

Even so, the researcher said there’s no solid link between Slingshot and the Lamberts. “We have no solid links with Equation Group and the Lamberts,” Raiu said.

Another fun fact: the attackers appear to be fans of “Lord of the Rings,” given the names Gollum and Smeagol found in malware modules.

Related Content:

• A Closer Look at CIA-Linked Malware as Search for Rogue Insider Begins
• 8 Nation-State Hacking Groups to Watch in 2018
• Encrypted Attacks Continue to Dog Perimeter Defenses

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/endpoint/slingshot-cyber-espionage-campaign-hacks-network-routers/d/d-id/1331229?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple