20 ms·

Researchers crack open malware that hid for 5 years

357 points by rando444 10y ago

coldcode 10y ago
Some at the NSA is having a bad day reading this.
- zellyn 10y ago
  The article says it was first deployed in 2011. Five years is a pretty good run. I wonder what they're deploying right now?
  - sitkack 10y ago
    Now they are in the SMC and the secure enclave.
    - Aelinsaar 10y ago
      As to the secure enclave, the very nature of a target that's in SO MANY hands, means that's it's unlikely to ever remain secure from a motivated state. It's such a catch-22... buy into the mass production, or have something that might really be strongly encrypted, but stands out like a sore thumb by virtue of not being the mass production model?
  - Jerry2 10y ago
    >Five years is a pretty good run. For a project this big & complex, and for something that cost hundreds of millions of dollars to develop, 5 years is paltry. Duqu remained hidden for 11+ years.
  - jandrese 10y ago
    Probably to the Intel Management Engine/AMD Platform Security Processor. By the time your machine is booting it is too late to detect the infection. Reinstalls won't work. If I wanted to own a machine and not be detected, that's where I'd live. It's also complex and closed source so you are basically guaranteed to have exploitable bugs that won't be fixed. It has access to network and system busses at a layer below the OS so ex-filtrating can be done at a layer below what the OS can see.
    - breadtk 10y ago
      There's been sufficient evidence that they are involved in hacking/rewriting HDD firmware. See: https://www.wired.com/2015/02/nsa-firmware-hacking/ https://www.wired.com/2015/02/nsa-firmware-hacking/
- pjc50 10y ago
  Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.
  - dragonwriter 10y ago
    There's a visibility bias there: attack capabilities in user are more likely to result in news articles; defense capabilities less so.
    - mtgx 10y ago
      If only the media was quick to blame them for cyberattacks that happen under their watch, too. Then they might finally start to care. But because corporate media has such a tight relationship with all the Washington insiders, that never really happens. One good example from recent times of how well this type of "incentive" works is Google and Stagefright. The media went nuts over Stagefright affecting virtually all Android devices - and for good reason, too. Since then Google seems to be taking Android security way more seriously, and there have been a lot of serious security improvements in Android (7.0) over the past year. But these sort of actions seem to happen in slow motion, if at all, when there isn't a hacking/malware catastrophe for which the companies can get blamed in the press. The NSA pushed hard for new surveillance laws such as CISA with the promise that it's what they need to keep us safe against cyberattacks. So why isn't every single media entity blaming the NSA over every major new data breach that happened since then?
  - drzaiusapelord 10y ago
    Well, what do you expect them to do for you? Nationalize and manage your IT infrastructure? They and the DoD publish security guidelines for servers, desktops, etc that any business or government agency can follow. Also do you use SELinux? That's NSA as well. If you want regulation, that's Congress and POTUS, not the NSA.
  - peterwwillis 10y ago
    You have to research and implement new attacks to design its defense.
- jonathankoren 10y ago
  Or they're saying, "Oh? That old thing?" We honestly don't know. It might not even be the NSA.
frank_jaeger 10y ago
That is a really impressive piece of software. USB exfiltration of data on air gapped machines is next level. I'm in awe of their skill.
- jobu 10y ago
  And they had every login for the network it was found on: "The library was masquerading as a Windows password filter, which is something administrators typically use to ensure passwords match specific requirements for length and complexity. The module started every time a network or local user logged in or changed a password, and it was able to view passcodes in plaintext."
  - amelius 10y ago
    Perhaps time to move to 2FA.
    - peterwwillis 10y ago
      This was a network authentication module on a domain controller. It's intercepting every low level token used to authenticate a network transaction, including encryption keys.
      - mjevans 10y ago
        If security has been penetrated that far you are already owned. What really scares me are things that can live in firmware; not just on mass storage drives but also in host system firmware. We've let too many dragons breed in dark places in the name of Digital Restrictions Management.
- paxcoder 10y ago
  Can you clarify what exactly is so impressive about this software? I read the article, and I don't see it.
  - 10y ago
Zigurd 10y ago
Some security professionals have expressed the view that insecure endpoints represent a good compromise. That is, without the US government being able to snoop on endpoint devices, encryption would have to be tightly controlled, so that the government could retain intelligence and investigatory capability. A more cynical view would be that many security firms sell both security and forensics/surveillance. One of those two product lines has to be fundamentally defective. Is the position that hackable endpoints are a good compromise supportable any longer? Or has it bitten US entities in the ass enough that making truly secure computing a reality for computer users, even if it blinds the surveillance state, becomes the new goal.
- EthanHeilman 10y ago
  I've often heard not that "insecure endpoints represent a good compromise" but instead that since: 1. endpoints are vulnerable because they are exceptionally hard to secure, 2. and attacking endpoints can be targeted and specific, the governments case that weakening encryption is necessary for warranted search is weak. Even with strong encryption the government can exploit the targeted communicant's endpoint to learn either the plaintext or the encryption keys. This isn't a compromise so much as a statement of reality and what is likely to remain reality for some time to come. Weakening encryption, for the most part, provides benefits to the government in the form of mass surveillance, but for a variety of reasons doesn't offer much benefit in the form of limited, specific searches. >making truly secure computing a reality for computer users, We can make endpoints more secure, but I see no path to endpoint security that will keep out a determined well resourced adversary.
  - Zigurd 10y ago
    You get what you pay for. Right now, endpoint systems are undefended, even intentionally compromised. The design of endpoint systems assumes all components can be trusted. But those components don't usually undergo testing for vulnerabilities and hidden capabilities.
deleted 10y ago
[deleted]
mr_overalls 10y ago
What is the role of an InfoSec professional in an environment where advanced threats like this are being deployed? I mean, a beat cop knows when it's time to call the FBI or the military. But the open nature of the Net means that firewall probes by script kiddies are interspersed with intrusions by nation-state actors. It's a weird state of affairs.
- Aelinsaar 10y ago
  I'm sure the nation-state actors couldn't be happier about the confusing nature of that, and cultivate it within reason.
- Spooky23 10y ago
  Work with stakeholders to minimize lateral movement after a breach, get monitoring in place to detect breaches, and have a response plan. If you have company critical secrets or life-safety systems, you need to air gap where possible. That's you're job. You cannot stop or prevent attacks, and if option don't have the metrics and logs, the FBI won't be able to do anything, assuming you can get them to give a shit.
skybrian 10y ago
Is the implication that there must be someone who connects the special USB drives to these air-gapped computers? So the attacker must have local people on the ground.
- drzaiusapelord 10y ago
  Supposedly, the "drop USB drives in the parking lot" works pretty well to get around air-gapped systems. As well as mailing USB drives to the receptionist, mail room, etc. Also, this thing was running as a local admin on a domain controller. So either the DC's weren't patched or some zero-days were used. Or perhaps an inside job.
  - peterwwillis 10y ago
    Not supposedly. Every pen testing company worth their salt uses dropped USB drives and have a very high success rate, because humans suck at security. The malware infects non-gapped systems until it infects a file which is being copied to a gapped system.
  - PeanutNore 10y ago
    Well it worked on Mr Robot at least
  - montecarl 10y ago
    The DoD Cybersecurity Awareness training[1] covers this and a number of other physical attacks. I'm not sure how serious anyone takes it though. [1] http://cdsetrain.dtic.mil/cybersecurity/ http://cdsetrain.dtic.mil/cybersecurity/
  - superuser2 10y ago
    > the DC's weren't patched As I understand it, airgapped systems are not in the habit of bringing software updates across the airgap, so unpatched everything is likely.
    - drzaiusapelord 10y ago
mr_overalls 10y ago
Apple's walled garden has been subjected to criticism from open source advocates. And Windows 10's telemetry triggers a lot of privacy concerns, too. But in our current security environment, what if these walls become necessary for secure computing? By analogy, there's a reason that many ancient cities were circled by a wall.
- taylorwc 10y ago
  I suspect your comment will be met harshly here, but I agree for at least a subset of users. If you regularly read HN, you probably can see the clear downsides of the so-called 'walled garden' approach. I can too. Then I have a 10-minute conversation trying to help my mother-in-law with whatever Best-buy recommended cheap PC she purchased 2 years ago, and I am convinced that she needs the walled garden.
  - Ntrails 10y ago
    There was a pop up which said that there was a virus and I needed to click ok to get it removed I swear to God I'd put adblock on that laptop to reduce this risk. Not to mention there must have been multiple click throughs for the different hurdles to install the malware. This is not a problem I envisage happening on Mums iPad though, and there's a lot to be said for that piece of mind
  - mr_overalls 10y ago
    I'm definitely an advocate of open source myself, and I never thought I'd be considering the other side's arguments. It's just that I see major data/security breaches increasing in the news, along with stories (like this one) about cyber-offensive capabilities growing more and more powerful. In the InfoSec world, it seems like anything is hackable, and the balance of power firmly lies with offensive tools. I'm just scratching my head about what the appropriate defensive strategies are going to be, given that Chinese and Russian state-sponsored hackers are known to attack civilian targets. I'm not sure how we're supposed to secure our government, financial, and tech companies against these players. For all of their known (and probable) capabilities, our three-letter agencies don't seem too concerned about encouraging defensive technologies and securing domestic networks.
jt2190 10y ago
I'm curious: How realistic is building malware like this? Is this something that has been done out in the open by researchers? Is there an example we can see, or is this all still rumors? The reason I ask is because there's actually value in spreading the rumor that a capability like this exists. Imagine if your adversary believed that you could gain access to their computers even when they're not connected to the internet. They'd run themselves in circles trying to secure everything! In general, I believe this article to be true, but would love to learn more of the details.
- r721 10y ago
  From Kaspersky Lab's analysis: >What would ProjectSauron have cost to set up and run? >Kaspersky Lab has no exact data on this, but estimates that the development and operation of ProjectSauron is likely to have required several specialist teams and a budget probably running into millions of dollars. https://securelist.com/analysis/publications/75533/faq-the-projectsauron-apt/ https://securelist.com/analysis/publications/75533/faq-the-p...
- lawnchair_larry 10y ago
  It is real, and many similar samples exist. People in the industry can usually ask around and get copies.
- runjake 10y ago
  It would take an inordinate amount of time for a person to build something like ProjectSauron, but after reading the link, it uses a wide range of publicly-known techniques (windows key loggers, password filters, DNS/ICMP exfil, named pipes, etc etc). This software seems to do a good job at amalgamating a wide range of methods.
- acqq 10y ago
  Read this as an "introduction" and then you'll be able to understand why the researchers can be so sure that specific kind of malware must be state sponsored: http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html http://www.nytimes.com/2012/06/01/world/middleeast/obama-ord... http://www.langner.com/en/wp-content/uploads/2013/11/To-kill-a-centrifuge.pdf http://www.langner.com/en/wp-content/uploads/2013/11/To-kill... Simply, the goals ant he methods of the commercial malware are fundamentally different to those that can be recognized in the state-sponsored malware.
rdtsc 10y ago
Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of those devices come with a 100x markup. $400 device from China vs $40k from US. Those who sell the $40k know how hard it is get on the list they are milking it for all its worth (the sales person was quite frank about it). It was also funny to see "Windows" as an approved security blessed OS and then Debian, Ubuntu, OpenBSD rejected (with only ancient version of RHEL's approved for Linux).
- dghughes 10y ago
  >I remember hearing there were going around filling USB ports with epoxy. And we all laughed at PS/2 keyboards and mouseeses
  - 13of40 10y ago
    You can boot an original IBM PC off the keyboard port. Look for the MFG_BOOT function here: https://www.iee.et.tu-dresden.de/~kc-club/DOWNLOAD/DISK401/ROMBIOS.ALL https://www.iee.et.tu-dresden.de/~kc-club/DOWNLOAD/DISK401/R... Basically, the device connected to the keyboard port has to reply with code 0x65 when it's initialized, then the BIOS will read some bytes into memory and jump to it. Not sure whether this was brought forward to newer models or clones, though so it's just some fun trivia...
    - rangibaby 10y ago
      The original IBM PC switch was like the back switch on current PSUs. If it were on it would be booting anyway, right?
- fl0wenol 10y ago
  I wouldn't call RHEL 6 ancient. Thankfully this may be going away at some point in the future, leaving it up to agencies to certify products or stacks on their own merits, or to instead have them be evaluated for specific purposes if sold as solutions: https://www.niap-ccevs.org/Documents_and_Guidance/ccevs/GPOS%20Position%20Statement.pdf https://www.niap-ccevs.org/Documents_and_Guidance/ccevs/GPOS...
Kadin 10y ago
> The researchers went on to speculate that the project was funded by a nation-state, but they stopped short of saying which one. So ... does anyone, perhaps who doesn't have Kaspersky's business interests to protect, care to actually speculate? In other cases it's been seemingly well-known in the security community which APT attacks trace back to which countries, it's just apparently impolite to say it in public.
- Mtinie 10y ago
  The list of countries with a known infection suggests a Western nation acting alone, or in cooperation with others (for instance, the "Five Eyes"). Alternatively, one of the infected nations could also be responsible. Infecting selected systems inside your border could be a way to deflect attention when the hunt for the malware' authors began. Pure speculation on my part, and nothing particularly new.
- groby_b 10y ago
  Russia, Iran, Rwanda... Let's assume the latter is a vector, not the target. (The attacker is sophisticated enough that we can assume Rwanda itself is of little interest). Rwanda also has fairly close ties to Russia, which strengthens the vector hypothesis. Russia+Iran suggests a western actor. Their biggest shared interest is Syria, I'd think. And look, the Syrian conflict is on since March '11, and the activity according to Kaspersky reaches back to June '11. I'd say that's quite close. Neither the US nor Europe were that deeply invested in Syria. There is, however, one small middle-east country that has quite an interest in the entire region, and also isn't friends with Iran or Russia. And it just so happens that Israel is somewhat of a close affiliation of Rwanda. None of that is in any way conclusive, but it certainly is probable.
  - ars 10y ago
    > and also isn't friends with Iran or Russia Actually Israel is on very friendly terms with Russia. There are a ton of Russian immigrants in Israel to the point that Putin called them "Russian ambassadors". It didn't start that way - part of the history of the creation of the modern state of Israel is Russia vs US proxy conflict (of sorts) via Egypt. But it's not like that anymore, not for a long time. (The US and Russia have moved on to other proxies :)
anonbanker 10y ago
Anyone know of an instance of airgapped USB-based exploits for Linux-based systems?
nyan4 10y ago
> It was also funny to see "Windows" as an approved security blessed OS and then Debian, Ubuntu, OpenBSD rejected Bribes always help.
- LeoPanthera 10y ago
  It's easy to see conspiracy everywhere, but the truth is usually much more mundane. It costs a lot of money to security-certify an OS, so they probably only wanted to certify a small number. Windows is obviously the most-used desktop OS for PCs, so that seems the logical choice.
- jpollock 10y ago
  Paying for certification is what's required. Governments require various certifications to sell to them, and that certification costs money in consultancies. RHEL paid for the testing, they get a certification and access to the customer. It looks like this is probably referring to EAL [1][2]. In a market with a large number of vendors interacting with a large number of relatively unknowledgeable buyers, an oversight team is going to try to find a certification to give guidance (and ass covering). Yes, this is a barrier to entry, but it's also a learned behaviour as buyers get repeatedly burned. I would argue that this is equivalent to requiring your plumbers and electricians to be licensed. [1] https://en.wikipedia.org/wiki/Evaluation_Assurance_Level https://en.wikipedia.org/wiki/Evaluation_Assurance_Level [2] https://www.redhat.com/en/about/press-releases/red-hat-achieves-top-security-certification-for-red-hat-enterprise-linux-6 https://www.redhat.com/en/about/press-releases/red-hat-achie...
  - rdtsc 10y ago
    EAL (Common Criteria) and also FIPS-140-2 for crypto.
- sctb 10y ago
  We detached this subthread from https://news.ycombinator.com/item?id=12255106 https://news.ycombinator.com/item?id=12255106 and marked it off-topic.
devnull42 10y ago
Heh I gave a talk at DefCon Skytalks last week on this exact exfil method and C&C structure with a live demo using code we wrote....interesting.
- j_s 10y ago
  Is there any part of your talk available online?
  - devnull42 10y ago
    This is pretty much the only part. The code from the live demo. I will try and find a place to get the slides up in the next few days if there is any interest: https://github.com/coryschwartz/dns_exfiltration https://github.com/coryschwartz/dns_exfiltration
    - ladzoppelin 10y ago
      I was at the conference but missed this talk. I would love to see the slides. Congrats on speaking at Defcon.
- b_emery 10y ago
  Any further comments on the need for nation-state sized budgets, based on your work?
- eugenekolo2 10y ago
  > Heh I gave a talk at DefCon Skytalks last week on this exact exfil method and C&C structure with a live demo using code we wrote....interesting. > Kaspersky researchers still aren't sure precisely how the USB-enabled exfiltration works. The presence of the invisible storage area doesn't in itself allow attackers to seize control of air-gapped computers. The researchers suspect the capability is used only in rare cases and requires use of a zero-day exploit that has yet to be discovered. In all, Project Sauron is made up of at least 50 modules that can be mixed and matched to suit the objectives of each individual infection. You remarkably have the exact exfil method when that's not disclosed information?
DavidWanjiru 10y ago
What criteria is used to determine that malware could only possibly have been made by a nation state? If all it takes is specialist teams and a budget in the millions of dollars (presumably, had it been 10s or 100s of millions, that's what they'd call it), lot's of private entities can pull that together, can't they?
- bradford 10y ago
  They probably could, but would they? At least in the US, publicly traded tech companies are accountable to shareholders: There's some transparency in the accounting, and it's hard for them to throw millions of dollars at a problem before shareholders start asking tough questions.
  - DavidWanjiru 10y ago
    But a military contractor type of company has lots of obfuscation leeway with "top secret" type of things, doesn't it? And I'd imagine a defence contractor is the type of company that would be interested in the kind of info this kind of malware can gather.
    - SCHiM 10y ago
      There is some evidence that CITIC Group, a Chinese company, is heavily involved in corporate espionage and the manipulation of foreign nations. There's no particular reason that other large companies, no matter their home countries, could not also be engaged in these types of activities.
      - emmelaich 10y ago
        link: http://www.securityweek.com/chinese-attackers-conduct-cyberespionage-economic-gain http://www.securityweek.com/chinese-attackers-conduct-cybere...
- ryanlol 10y ago
  They simply pretend that all skilled attackers are state actors. Due to how the industry works, they're usually correct.
erikpukinskis 10y ago
Bau$$
- sctb 10y ago
  Please don't comment like this here.
  - erikpukinskis 10y ago
    I think it's a great comment. Look at my comment history if if you are curious about context, downvote me if you like, but I stand by it.
milesf 10y ago
What's with all this nonsense about could have "been developed only with the active support of a nation-state"? Do nations suddenly have access to some sort of advanced, alien software development teams? Feels more like political sabre-rattling to get the public to eventually condone a future attack from our homeland shores of Oceania against the evil Eastasia or Eurasia.
- breadtk 10y ago
  I believe it's less about fear mongering and more about understanding the level of sophistication of the software. Talk to anti malware analyst and they'll tell you how commoditized the malware game is nowadays. There's an endless stream of malware and ransomware which can be linked back to just a handful of frameworks. These types of malware families also fall under the spray-n-pray mentality for distribution. Spam, drive-by-downloads, infected torrents, etc. Compare the mass of malware that is out there with the level of technical sophistication, OPSEC to prevent detection, and precise targeting of its victims. Along with other big name malwares (i.e. Stuxnet, Flame, etc.), this class of malware is very precise in its objective. It isn't trying to make money for its owners. It isn't trying to replicate itself across the internet endlessly. Rather it has a key objective of infecting a specific set of networks. So when researchers call out the fact that it is likely to be "state sponsored", they are saying the purpose of the malware is very different than your average piece of malware.
  - celticninja 10y ago
    Essentially depending on what malware does we can easily identify government software because criminal software has a different set of objectives. Is it possible though that corporate software could have similar objectives? I'm thinking corporate espionage type behaviour.
    - breadtk 10y ago
      > Is it possible though that corporate software could have similar objectives? I'm thinking corporate espionage type behaviour. Yes, it is possible.
cynoclast 10y ago
The thing I find interesting is that I bet the authors are reading this.
ayyn0n0n0 10y ago
Anyone know what IPs the C&C servers used? Interested to see what hosting company in the US they used.
hrayr 10y ago
>> so advanced in its design and execution that it could probably have been developed only with the active support of a nation-state Why is advanced technology automatically assumed to have the backing of nation-states? Cant several highly motivated and smart individuals create the technology without a nation-state behind them?
- ballsohardy 10y ago
  Not only that, but if I was creating some malware I'd mimic every single one of the TTPs that are supposedly used by all these "Advanced Persistent Threat" groups that are anointed by "threat research" groups. Sprinkle in some Russian/Chinese strings, and an obvious string for how I'd like everyone to refer to me (Sauron in this case) and call it a day.
- WatchDog 10y ago
  That's why they said "probably". You need to look at things like the complexity of the malware, how many staff it would take to develop and maintain it operationally, the targets selected and what sort of payloads are executed. Criminals tend to have simpler malware that used known exploits or a small number of zero days. They generally cast a wide net for their targets and their payloads typically aim to directly raise funds(ransom, mining, card theft, etc). In contrast, nation-states tend to have complex malware with multiple zero days, greater care is taken to avoid detection, their targets are chosen carefully and their payloads focus on gathering information and specialized operations.

357 points by rando444 10y ago

coldcode 10y ago

Some at the NSA is having a bad day reading this.

zellyn 10y ago
The article says it was first deployed in 2011. Five years is a pretty good run. I wonder what they're deploying right now?
- sitkack 10y ago
  Now they are in the SMC and the secure enclave.
  - Aelinsaar 10y ago
    As to the secure enclave, the very nature of a target that's in SO MANY hands, means that's it's unlikely to ever remain secure from a motivated state. It's such a catch-22... buy into the mass production, or have something that might really be strongly encrypted, but stands out like a sore thumb by virtue of not being the mass production model?
- Jerry2 10y ago
  >Five years is a pretty good run. For a project this big & complex, and for something that cost hundreds of millions of dollars to develop, 5 years is paltry. Duqu remained hidden for 11+ years.
- jandrese 10y ago
  Probably to the Intel Management Engine/AMD Platform Security Processor. By the time your machine is booting it is too late to detect the infection. Reinstalls won't work. If I wanted to own a machine and not be detected, that's where I'd live. It's also complex and closed source so you are basically guaranteed to have exploitable bugs that won't be fixed. It has access to network and system busses at a layer below the OS so ex-filtrating can be done at a layer below what the OS can see.
  - breadtk 10y ago
    There's been sufficient evidence that they are involved in hacking/rewriting HDD firmware. See: https://www.wired.com/2015/02/nsa-firmware-hacking/ https://www.wired.com/2015/02/nsa-firmware-hacking/
pjc50 10y ago
Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.
- dragonwriter 10y ago
  There's a visibility bias there: attack capabilities in user are more likely to result in news articles; defense capabilities less so.
  - mtgx 10y ago
    If only the media was quick to blame them for cyberattacks that happen under their watch, too. Then they might finally start to care. But because corporate media has such a tight relationship with all the Washington insiders, that never really happens. One good example from recent times of how well this type of "incentive" works is Google and Stagefright. The media went nuts over Stagefright affecting virtually all Android devices - and for good reason, too. Since then Google seems to be taking Android security way more seriously, and there have been a lot of serious security improvements in Android (7.0) over the past year. But these sort of actions seem to happen in slow motion, if at all, when there isn't a hacking/malware catastrophe for which the companies can get blamed in the press. The NSA pushed hard for new surveillance laws such as CISA with the promise that it's what they need to keep us safe against cyberattacks. So why isn't every single media entity blaming the NSA over every major new data breach that happened since then?
- drzaiusapelord 10y ago
  Well, what do you expect them to do for you? Nationalize and manage your IT infrastructure? They and the DoD publish security guidelines for servers, desktops, etc that any business or government agency can follow. Also do you use SELinux? That's NSA as well. If you want regulation, that's Congress and POTUS, not the NSA.
- peterwwillis 10y ago
  You have to research and implement new attacks to design its defense.
jonathankoren 10y ago
Or they're saying, "Oh? That old thing?" We honestly don't know. It might not even be the NSA.

frank_jaeger 10y ago

That is a really impressive piece of software. USB exfiltration of data on air gapped machines is next level. I'm in awe of their skill.

jobu 10y ago
And they had every login for the network it was found on: "The library was masquerading as a Windows password filter, which is something administrators typically use to ensure passwords match specific requirements for length and complexity. The module started every time a network or local user logged in or changed a password, and it was able to view passcodes in plaintext."
- amelius 10y ago
  Perhaps time to move to 2FA.
  - peterwwillis 10y ago
    This was a network authentication module on a domain controller. It's intercepting every low level token used to authenticate a network transaction, including encryption keys.
    - mjevans 10y ago
      If security has been penetrated that far you are already owned. What really scares me are things that can live in firmware; not just on mass storage drives but also in host system firmware. We've let too many dragons breed in dark places in the name of Digital Restrictions Management.
paxcoder 10y ago
Can you clarify what exactly is so impressive about this software? I read the article, and I don't see it.
- 10y ago

Zigurd 10y ago

Some security professionals have expressed the view that insecure endpoints represent a good compromise. That is, without the US government being able to snoop on endpoint devices, encryption would have to be tightly controlled, so that the government could retain intelligence and investigatory capability. A more cynical view would be that many security firms sell both security and forensics/surveillance. One of those two product lines has to be fundamentally defective. Is the position that hackable endpoints are a good compromise supportable any longer? Or has it bitten US entities in the ass enough that making truly secure computing a reality for computer users, even if it blinds the surveillance state, becomes the new goal.

EthanHeilman 10y ago
I've often heard not that "insecure endpoints represent a good compromise" but instead that since: 1. endpoints are vulnerable because they are exceptionally hard to secure, 2. and attacking endpoints can be targeted and specific, the governments case that weakening encryption is necessary for warranted search is weak. Even with strong encryption the government can exploit the targeted communicant's endpoint to learn either the plaintext or the encryption keys. This isn't a compromise so much as a statement of reality and what is likely to remain reality for some time to come. Weakening encryption, for the most part, provides benefits to the government in the form of mass surveillance, but for a variety of reasons doesn't offer much benefit in the form of limited, specific searches. >making truly secure computing a reality for computer users, We can make endpoints more secure, but I see no path to endpoint security that will keep out a determined well resourced adversary.
- Zigurd 10y ago
  You get what you pay for. Right now, endpoint systems are undefended, even intentionally compromised. The design of endpoint systems assumes all components can be trusted. But those components don't usually undergo testing for vulnerabilities and hidden capabilities.

deleted 10y ago

[deleted]

mr_overalls 10y ago

What is the role of an InfoSec professional in an environment where advanced threats like this are being deployed? I mean, a beat cop knows when it's time to call the FBI or the military. But the open nature of the Net means that firewall probes by script kiddies are interspersed with intrusions by nation-state actors. It's a weird state of affairs.

Aelinsaar 10y ago
I'm sure the nation-state actors couldn't be happier about the confusing nature of that, and cultivate it within reason.
Spooky23 10y ago
Work with stakeholders to minimize lateral movement after a breach, get monitoring in place to detect breaches, and have a response plan. If you have company critical secrets or life-safety systems, you need to air gap where possible. That's you're job. You cannot stop or prevent attacks, and if option don't have the metrics and logs, the FBI won't be able to do anything, assuming you can get them to give a shit.

skybrian 10y ago

Is the implication that there must be someone who connects the special USB drives to these air-gapped computers? So the attacker must have local people on the ground.

drzaiusapelord 10y ago
Supposedly, the "drop USB drives in the parking lot" works pretty well to get around air-gapped systems. As well as mailing USB drives to the receptionist, mail room, etc. Also, this thing was running as a local admin on a domain controller. So either the DC's weren't patched or some zero-days were used. Or perhaps an inside job.
- peterwwillis 10y ago
  Not supposedly. Every pen testing company worth their salt uses dropped USB drives and have a very high success rate, because humans suck at security. The malware infects non-gapped systems until it infects a file which is being copied to a gapped system.
- PeanutNore 10y ago
  Well it worked on Mr Robot at least
- montecarl 10y ago
  The DoD Cybersecurity Awareness training[1] covers this and a number of other physical attacks. I'm not sure how serious anyone takes it though. [1] http://cdsetrain.dtic.mil/cybersecurity/ http://cdsetrain.dtic.mil/cybersecurity/
- superuser2 10y ago
  > the DC's weren't patched As I understand it, airgapped systems are not in the habit of bringing software updates across the airgap, so unpatched everything is likely.
  - drzaiusapelord 10y ago

mr_overalls 10y ago

Apple's walled garden has been subjected to criticism from open source advocates. And Windows 10's telemetry triggers a lot of privacy concerns, too. But in our current security environment, what if these walls become necessary for secure computing? By analogy, there's a reason that many ancient cities were circled by a wall.

taylorwc 10y ago
I suspect your comment will be met harshly here, but I agree for at least a subset of users. If you regularly read HN, you probably can see the clear downsides of the so-called 'walled garden' approach. I can too. Then I have a 10-minute conversation trying to help my mother-in-law with whatever Best-buy recommended cheap PC she purchased 2 years ago, and I am convinced that she needs the walled garden.
- Ntrails 10y ago
  There was a pop up which said that there was a virus and I needed to click ok to get it removed I swear to God I'd put adblock on that laptop to reduce this risk. Not to mention there must have been multiple click throughs for the different hurdles to install the malware. This is not a problem I envisage happening on Mums iPad though, and there's a lot to be said for that piece of mind
- mr_overalls 10y ago
  I'm definitely an advocate of open source myself, and I never thought I'd be considering the other side's arguments. It's just that I see major data/security breaches increasing in the news, along with stories (like this one) about cyber-offensive capabilities growing more and more powerful. In the InfoSec world, it seems like anything is hackable, and the balance of power firmly lies with offensive tools. I'm just scratching my head about what the appropriate defensive strategies are going to be, given that Chinese and Russian state-sponsored hackers are known to attack civilian targets. I'm not sure how we're supposed to secure our government, financial, and tech companies against these players. For all of their known (and probable) capabilities, our three-letter agencies don't seem too concerned about encouraging defensive technologies and securing domestic networks.

jt2190 10y ago

I'm curious: How realistic is building malware like this? Is this something that has been done out in the open by researchers? Is there an example we can see, or is this all still rumors? The reason I ask is because there's actually value in spreading the rumor that a capability like this exists. Imagine if your adversary believed that you could gain access to their computers even when they're not connected to the internet. They'd run themselves in circles trying to secure everything! In general, I believe this article to be true, but would love to learn more of the details.

r721 10y ago
From Kaspersky Lab's analysis: >What would ProjectSauron have cost to set up and run? >Kaspersky Lab has no exact data on this, but estimates that the development and operation of ProjectSauron is likely to have required several specialist teams and a budget probably running into millions of dollars. https://securelist.com/analysis/publications/75533/faq-the-projectsauron-apt/ https://securelist.com/analysis/publications/75533/faq-the-p...
lawnchair_larry 10y ago
It is real, and many similar samples exist. People in the industry can usually ask around and get copies.
runjake 10y ago
It would take an inordinate amount of time for a person to build something like ProjectSauron, but after reading the link, it uses a wide range of publicly-known techniques (windows key loggers, password filters, DNS/ICMP exfil, named pipes, etc etc). This software seems to do a good job at amalgamating a wide range of methods.
acqq 10y ago
Read this as an "introduction" and then you'll be able to understand why the researchers can be so sure that specific kind of malware must be state sponsored: http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html http://www.nytimes.com/2012/06/01/world/middleeast/obama-ord... http://www.langner.com/en/wp-content/uploads/2013/11/To-kill-a-centrifuge.pdf http://www.langner.com/en/wp-content/uploads/2013/11/To-kill... Simply, the goals ant he methods of the commercial malware are fundamentally different to those that can be recognized in the state-sponsored malware.

rdtsc 10y ago

Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of those devices come with a 100x markup. $400 device from China vs $40k from US. Those who sell the $40k know how hard it is get on the list they are milking it for all its worth (the sales person was quite frank about it). It was also funny to see "Windows" as an approved security blessed OS and then Debian, Ubuntu, OpenBSD rejected (with only ancient version of RHEL's approved for Linux).

dghughes 10y ago
>I remember hearing there were going around filling USB ports with epoxy. And we all laughed at PS/2 keyboards and mouseeses
- 13of40 10y ago
  You can boot an original IBM PC off the keyboard port. Look for the MFG_BOOT function here: https://www.iee.et.tu-dresden.de/~kc-club/DOWNLOAD/DISK401/ROMBIOS.ALL https://www.iee.et.tu-dresden.de/~kc-club/DOWNLOAD/DISK401/R... Basically, the device connected to the keyboard port has to reply with code 0x65 when it's initialized, then the BIOS will read some bytes into memory and jump to it. Not sure whether this was brought forward to newer models or clones, though so it's just some fun trivia...
  - rangibaby 10y ago
    The original IBM PC switch was like the back switch on current PSUs. If it were on it would be booting anyway, right?
fl0wenol 10y ago
I wouldn't call RHEL 6 ancient. Thankfully this may be going away at some point in the future, leaving it up to agencies to certify products or stacks on their own merits, or to instead have them be evaluated for specific purposes if sold as solutions: https://www.niap-ccevs.org/Documents_and_Guidance/ccevs/GPOS%20Position%20Statement.pdf https://www.niap-ccevs.org/Documents_and_Guidance/ccevs/GPOS...

Kadin 10y ago

> The researchers went on to speculate that the project was funded by a nation-state, but they stopped short of saying which one. So ... does anyone, perhaps who doesn't have Kaspersky's business interests to protect, care to actually speculate? In other cases it's been seemingly well-known in the security community which APT attacks trace back to which countries, it's just apparently impolite to say it in public.

Mtinie 10y ago
The list of countries with a known infection suggests a Western nation acting alone, or in cooperation with others (for instance, the "Five Eyes"). Alternatively, one of the infected nations could also be responsible. Infecting selected systems inside your border could be a way to deflect attention when the hunt for the malware' authors began. Pure speculation on my part, and nothing particularly new.
groby_b 10y ago
Russia, Iran, Rwanda... Let's assume the latter is a vector, not the target. (The attacker is sophisticated enough that we can assume Rwanda itself is of little interest). Rwanda also has fairly close ties to Russia, which strengthens the vector hypothesis. Russia+Iran suggests a western actor. Their biggest shared interest is Syria, I'd think. And look, the Syrian conflict is on since March '11, and the activity according to Kaspersky reaches back to June '11. I'd say that's quite close. Neither the US nor Europe were that deeply invested in Syria. There is, however, one small middle-east country that has quite an interest in the entire region, and also isn't friends with Iran or Russia. And it just so happens that Israel is somewhat of a close affiliation of Rwanda. None of that is in any way conclusive, but it certainly is probable.
- ars 10y ago
  > and also isn't friends with Iran or Russia Actually Israel is on very friendly terms with Russia. There are a ton of Russian immigrants in Israel to the point that Putin called them "Russian ambassadors". It didn't start that way - part of the history of the creation of the modern state of Israel is Russia vs US proxy conflict (of sorts) via Egypt. But it's not like that anymore, not for a long time. (The US and Russia have moved on to other proxies :)

anonbanker 10y ago

Anyone know of an instance of airgapped USB-based exploits for Linux-based systems?

nyan4 10y ago

> It was also funny to see "Windows" as an approved security blessed OS and then Debian, Ubuntu, OpenBSD rejected Bribes always help.

LeoPanthera 10y ago
It's easy to see conspiracy everywhere, but the truth is usually much more mundane. It costs a lot of money to security-certify an OS, so they probably only wanted to certify a small number. Windows is obviously the most-used desktop OS for PCs, so that seems the logical choice.
jpollock 10y ago
Paying for certification is what's required. Governments require various certifications to sell to them, and that certification costs money in consultancies. RHEL paid for the testing, they get a certification and access to the customer. It looks like this is probably referring to EAL [1][2]. In a market with a large number of vendors interacting with a large number of relatively unknowledgeable buyers, an oversight team is going to try to find a certification to give guidance (and ass covering). Yes, this is a barrier to entry, but it's also a learned behaviour as buyers get repeatedly burned. I would argue that this is equivalent to requiring your plumbers and electricians to be licensed. [1] https://en.wikipedia.org/wiki/Evaluation_Assurance_Level https://en.wikipedia.org/wiki/Evaluation_Assurance_Level [2] https://www.redhat.com/en/about/press-releases/red-hat-achieves-top-security-certification-for-red-hat-enterprise-linux-6 https://www.redhat.com/en/about/press-releases/red-hat-achie...
- rdtsc 10y ago
  EAL (Common Criteria) and also FIPS-140-2 for crypto.
sctb 10y ago
We detached this subthread from https://news.ycombinator.com/item?id=12255106 https://news.ycombinator.com/item?id=12255106 and marked it off-topic.

devnull42 10y ago

Heh I gave a talk at DefCon Skytalks last week on this exact exfil method and C&C structure with a live demo using code we wrote....interesting.

j_s 10y ago
Is there any part of your talk available online?
- devnull42 10y ago
  This is pretty much the only part. The code from the live demo. I will try and find a place to get the slides up in the next few days if there is any interest: https://github.com/coryschwartz/dns_exfiltration https://github.com/coryschwartz/dns_exfiltration
  - ladzoppelin 10y ago
    I was at the conference but missed this talk. I would love to see the slides. Congrats on speaking at Defcon.
b_emery 10y ago
Any further comments on the need for nation-state sized budgets, based on your work?
eugenekolo2 10y ago
> Heh I gave a talk at DefCon Skytalks last week on this exact exfil method and C&C structure with a live demo using code we wrote....interesting. > Kaspersky researchers still aren't sure precisely how the USB-enabled exfiltration works. The presence of the invisible storage area doesn't in itself allow attackers to seize control of air-gapped computers. The researchers suspect the capability is used only in rare cases and requires use of a zero-day exploit that has yet to be discovered. In all, Project Sauron is made up of at least 50 modules that can be mixed and matched to suit the objectives of each individual infection. You remarkably have the exact exfil method when that's not disclosed information?

DavidWanjiru 10y ago

What criteria is used to determine that malware could only possibly have been made by a nation state? If all it takes is specialist teams and a budget in the millions of dollars (presumably, had it been 10s or 100s of millions, that's what they'd call it), lot's of private entities can pull that together, can't they?

bradford 10y ago
They probably could, but would they? At least in the US, publicly traded tech companies are accountable to shareholders: There's some transparency in the accounting, and it's hard for them to throw millions of dollars at a problem before shareholders start asking tough questions.
- DavidWanjiru 10y ago
  But a military contractor type of company has lots of obfuscation leeway with "top secret" type of things, doesn't it? And I'd imagine a defence contractor is the type of company that would be interested in the kind of info this kind of malware can gather.
  - SCHiM 10y ago
    There is some evidence that CITIC Group, a Chinese company, is heavily involved in corporate espionage and the manipulation of foreign nations. There's no particular reason that other large companies, no matter their home countries, could not also be engaged in these types of activities.
    - emmelaich 10y ago
      link: http://www.securityweek.com/chinese-attackers-conduct-cyberespionage-economic-gain http://www.securityweek.com/chinese-attackers-conduct-cybere...
ryanlol 10y ago
They simply pretend that all skilled attackers are state actors. Due to how the industry works, they're usually correct.

erikpukinskis 10y ago

Bau$$

sctb 10y ago
Please don't comment like this here.
- erikpukinskis 10y ago
  I think it's a great comment. Look at my comment history if if you are curious about context, downvote me if you like, but I stand by it.

milesf 10y ago

What's with all this nonsense about could have "been developed only with the active support of a nation-state"? Do nations suddenly have access to some sort of advanced, alien software development teams? Feels more like political sabre-rattling to get the public to eventually condone a future attack from our homeland shores of Oceania against the evil Eastasia or Eurasia.

breadtk 10y ago
I believe it's less about fear mongering and more about understanding the level of sophistication of the software. Talk to anti malware analyst and they'll tell you how commoditized the malware game is nowadays. There's an endless stream of malware and ransomware which can be linked back to just a handful of frameworks. These types of malware families also fall under the spray-n-pray mentality for distribution. Spam, drive-by-downloads, infected torrents, etc. Compare the mass of malware that is out there with the level of technical sophistication, OPSEC to prevent detection, and precise targeting of its victims. Along with other big name malwares (i.e. Stuxnet, Flame, etc.), this class of malware is very precise in its objective. It isn't trying to make money for its owners. It isn't trying to replicate itself across the internet endlessly. Rather it has a key objective of infecting a specific set of networks. So when researchers call out the fact that it is likely to be "state sponsored", they are saying the purpose of the malware is very different than your average piece of malware.
- celticninja 10y ago
  Essentially depending on what malware does we can easily identify government software because criminal software has a different set of objectives. Is it possible though that corporate software could have similar objectives? I'm thinking corporate espionage type behaviour.
  - breadtk 10y ago
    > Is it possible though that corporate software could have similar objectives? I'm thinking corporate espionage type behaviour. Yes, it is possible.

cynoclast 10y ago

The thing I find interesting is that I bet the authors are reading this.

ayyn0n0n0 10y ago

Anyone know what IPs the C&C servers used? Interested to see what hosting company in the US they used.

hrayr 10y ago

>> so advanced in its design and execution that it could probably have been developed only with the active support of a nation-state Why is advanced technology automatically assumed to have the backing of nation-states? Cant several highly motivated and smart individuals create the technology without a nation-state behind them?

ballsohardy 10y ago
Not only that, but if I was creating some malware I'd mimic every single one of the TTPs that are supposedly used by all these "Advanced Persistent Threat" groups that are anointed by "threat research" groups. Sprinkle in some Russian/Chinese strings, and an obvious string for how I'd like everyone to refer to me (Sauron in this case) and call it a day.
WatchDog 10y ago
That's why they said "probably". You need to look at things like the complexity of the malware, how many staff it would take to develop and maintain it operationally, the targets selected and what sort of payloads are executed. Criminals tend to have simpler malware that used known exploits or a small number of zero days. They generally cast a wide net for their targets and their payloads typically aim to directly raise funds(ransom, mining, card theft, etc). In contrast, nation-states tend to have complex malware with multiple zero days, greater care is taken to avoid detection, their targets are chosen carefully and their payloads focus on gathering information and specialized operations.