3 ms·
Not sure why the post above has been downvoted to 0. Too bad. It's some of the best research we've ever done. We didn't look at the hashes or using hashing to
by mmaunder 10y ago
Not sure why the post above has been downvoted to 0. Too bad. It's some of the best research we've ever done.
We didn't look at the hashes or using hashing to identify anything. It's quite a story actually:
The report provided a Yara sig for PHP malware. We used that to search our own attack data that we log and we found the full malware sample that matched the sig.
But it was encrypted. It's a small piece of PHP that gets a key from a POST param or COOKIE and decrypts the executable code and runs it. Quite smart actually if you want to obfuscate code. So we needed the key.
We looked at our attack data and thankfully we logged one of the attempts by an attacker to access the malware including their key. It was just 4 lowercase chars so we could have bruteforced it.
We decrypted the malware. That gave us the name and version. We googled that and found the distro site. Claim they're a Ukrainian group and the version DHS has a Yara sig for is several versions behind.
We downloaded it. It's a standard PHP 'shell' malware which means it's just a utility to manage a compromised site. File management, upload, OS info, OS command running etc. Nothing super scary and the most common malware we see. Nothing that would infect a workstation in a watering-hole attack.
Regarding the IPs: No we just did a PTR lookup and assumed they're Tor exit nodes as they say they are.
Mark.
- downandout 10y ago> Not sure why the post above has been downvoted to 0. Too bad. It's some of the best research we've ever done. Any post on HN that implies that anyone other than Vladimir Putin himself is responsible for Clinton's defeat will get downvotes...I've lost about 15 points on various posts downplaying this narrative. The Silicon Valley crowd simply cannot tolerate any hint of an alternate narrative.
- solarengineer 10y agoHN participants are now from all over the world. I'm an Indian in Singapore, for e.g.
- topynate 10y agoTrue enough (I'm in Israel. Hi!) but despite a good measure of international interest, it's the Americans who are most likely to have a strong emotional reaction to this topic. It's their election, after all. I really dislike +/- voting on political comments for just this reason; too easy to convince oneself that a downvote is merited.
- polotics 10y agoHi! I disagree. On such a sensitive subject it's paid shills, overwhelmingly.
- deleted 10y ago[deleted]
- wwweston 10y agoLots of things get downvotes that don't represent a gestalt of HN opinions: the idea that JS is an acceptable programming language, that .NET is a reasonable platform for development, that sending JSON to the client isn't necessarily an improvement over sending markup. Just because your opinion is opposed doesn't mean dissent isn't allowed. It is pretty ridiculous to assert that the election's outcome lies primarily on Putin. On the other hand, Trump's victory was pretty thin, and that invites speculation that if certain influences hadn't been present, the election might well have gone the other way. Russian influence is one among many, but it's among the most disturbing, which is one reason people have strong feelings about dismissing it.
- DominoTree 10y agoIsn't it possible, that without matching file hashes, that the malware you found a sample of had a different encrypted payload versus the ones referred to by the report? I'm just thinking that an entity could've downloaded some commodity malware (instead of writing their own from scratch) and modified it to suit their purposes, but the YARA sig would've hit on a lot of different variants of the same webshell versus a higher-fidelity match based on file hash.