5 ms·

CCleaner Command and Control Causes Concern

43 points by runesoerensen 9y ago

craftyguy 9y ago
https://news.ycombinator.com/item?id=15274339 https://news.ycombinator.com/item?id=15274339
- runesoerensen 9y ago
  This is a follow-up to that story. The HN discussion might still be relevant for context though
0x0 9y ago
Can you imagine the havoc you could create if you compromise microsoft+samsung+vmware+intel and push malware embedded in software+firmware updates that combine the (also a HN top post right now) Intel ME hack and perhaps a couple of the (also HN top post right now) broadcom wifi chip exploits? Will we end up with a setup where every system within range of a wifi chip is instantly and persistently compromised? Could we even recover from that?
- milesokeefe 9y ago
  >Will we end up with a setup where every system within range of a wifi chip is instantly and persistently compromised? ＊every system within range of a wifi chip and connected to a power source
  - 0x0 9y ago
    A power source such as a non-removable battery in many laptops and phones? Doesn't Intel ME run even when the system is powered down?
    - sandworm101 9y ago
      Maybe, but the wifi isnt on. That couldnt be hidden.
      - milesokeefe 9y ago
        If by "isn't on" you mean "turned off by the OS", that wouldn't do anything. Intel ME operates despite whatever the OS is doing. You'd have to physically disconnect the modem, put the device in a faraday cage, completely remove power source, etc.
    - milesokeefe 9y ago
      Yes, so many/most phones and laptops would be compromised. But there are also plenty of computers in every form that aren't plugged into anything at all and completely invulnerable. It would be devastating but nothing we couldn't rebuild from.
      - outoftacos 9y ago
        You mean like desktops? That are unplugged? How many of those do you think are sitting around? How old is the version of Windows on them do you think? If your recovery strategy is "drive as fast as you can to the thrift shop" then I don't know how effective "rebuilding" would be. This is fucking terrifying.
basicplus2 9y ago
I think one of the biggest issues is.. operating systems like windows give no indication to the ordinary user what internet connections they are making either legitimately themselves or from software installed separately and giving users the opportunity to review and grant or deny access. If ALL connections were transparent it would be much easier to see what was not appropriate. Operating systems should say that a connection is being made and for what purpose and the user given the opportunity to grant or deny. This is what i liked about Sophos' original interface sadly gone by the wayside.
- sengork 9y ago
  Yes, tools like Comodo firewall by default are set to be quiet and prevent end user prompts as much as possible. Regardless the amount of components (whether it be OS, software or website elements) which attempt connecting is overwhelming for even a non-average tech savvy user. For example install https://pi-hole.net/ https://pi-hole.net/ and you'll no doubt realise that most of the DNS queries traversing your home network are not directly made by the end-user.
- lathiat 9y ago
  The reality is that the average majority consumer would be so annoyed by such things that they would be ineffective. And at best most likely become trained just to hit YES. Even as a technical user, my reaction to windows privilege escalation is pretty much just to smash yes. Like all good things, there is a balance... and there will always be people keen to be more attuned to whats happening.
- raesene6 9y ago
  You can do it in Windows with something like glasswire, or on OSX with Little snitch or equivalent. I run glasswire, and regularly see legitimate traffic from odd sounding processes. A non-technical user would have zero chance of determining what was legitimate and what wasn't. So whilst it is handy for technical users (who are willing to put in the effort to check all the various processes that make network access) it's not likely to work well for the wider user population
lawnchair_larry 9y ago
"During our investigation we were provided an archive containing files that were stored on the C2 server." I find that more interesting than the article itself. Some unknown entity just happened to hack the command server and drop a dump of it in their lap?
- bob33212 9y ago
  FBI
bob33212 9y ago
These attackers are after the IT blueprints of other organizations. So that they can build a hibernating bot inventory. They can then sell pwned corporate computers to 3rd parties for BTC. Phishing and Spear Phishing doesn't work well on pro users. But this does.
raesene6 9y ago
Supply chain attacks are an obvious avenue for high-end attackers, where their direct targets are hardened, so I guess we'll see more of these going forward. Whilst companies like Microsoft can likely afford to harden their software update systems well enough to deter this, I do wonder what impact it'll have if smaller software providers/open source software providers who can't afford high-end OpSec teams start getting targeted. Realistically a lot of software auto-updates these days so it's a nice avenue for attackers to exploit...

43 points by runesoerensen 9y ago

craftyguy 9y ago

https://news.ycombinator.com/item?id=15274339 https://news.ycombinator.com/item?id=15274339

runesoerensen 9y ago
This is a follow-up to that story. The HN discussion might still be relevant for context though

0x0 9y ago

Can you imagine the havoc you could create if you compromise microsoft+samsung+vmware+intel and push malware embedded in software+firmware updates that combine the (also a HN top post right now) Intel ME hack and perhaps a couple of the (also HN top post right now) broadcom wifi chip exploits? Will we end up with a setup where every system within range of a wifi chip is instantly and persistently compromised? Could we even recover from that?

milesokeefe 9y ago
>Will we end up with a setup where every system within range of a wifi chip is instantly and persistently compromised? ＊every system within range of a wifi chip and connected to a power source
- 0x0 9y ago
  A power source such as a non-removable battery in many laptops and phones? Doesn't Intel ME run even when the system is powered down?
  - sandworm101 9y ago
    Maybe, but the wifi isnt on. That couldnt be hidden.
    - milesokeefe 9y ago
      If by "isn't on" you mean "turned off by the OS", that wouldn't do anything. Intel ME operates despite whatever the OS is doing. You'd have to physically disconnect the modem, put the device in a faraday cage, completely remove power source, etc.
  - milesokeefe 9y ago
    Yes, so many/most phones and laptops would be compromised. But there are also plenty of computers in every form that aren't plugged into anything at all and completely invulnerable. It would be devastating but nothing we couldn't rebuild from.
    - outoftacos 9y ago
      You mean like desktops? That are unplugged? How many of those do you think are sitting around? How old is the version of Windows on them do you think? If your recovery strategy is "drive as fast as you can to the thrift shop" then I don't know how effective "rebuilding" would be. This is fucking terrifying.

basicplus2 9y ago

I think one of the biggest issues is.. operating systems like windows give no indication to the ordinary user what internet connections they are making either legitimately themselves or from software installed separately and giving users the opportunity to review and grant or deny access. If ALL connections were transparent it would be much easier to see what was not appropriate. Operating systems should say that a connection is being made and for what purpose and the user given the opportunity to grant or deny. This is what i liked about Sophos' original interface sadly gone by the wayside.

sengork 9y ago
Yes, tools like Comodo firewall by default are set to be quiet and prevent end user prompts as much as possible. Regardless the amount of components (whether it be OS, software or website elements) which attempt connecting is overwhelming for even a non-average tech savvy user. For example install https://pi-hole.net/ https://pi-hole.net/ and you'll no doubt realise that most of the DNS queries traversing your home network are not directly made by the end-user.
lathiat 9y ago
The reality is that the average majority consumer would be so annoyed by such things that they would be ineffective. And at best most likely become trained just to hit YES. Even as a technical user, my reaction to windows privilege escalation is pretty much just to smash yes. Like all good things, there is a balance... and there will always be people keen to be more attuned to whats happening.
raesene6 9y ago
You can do it in Windows with something like glasswire, or on OSX with Little snitch or equivalent. I run glasswire, and regularly see legitimate traffic from odd sounding processes. A non-technical user would have zero chance of determining what was legitimate and what wasn't. So whilst it is handy for technical users (who are willing to put in the effort to check all the various processes that make network access) it's not likely to work well for the wider user population

lawnchair_larry 9y ago

"During our investigation we were provided an archive containing files that were stored on the C2 server." I find that more interesting than the article itself. Some unknown entity just happened to hack the command server and drop a dump of it in their lap?

bob33212 9y ago
FBI

bob33212 9y ago

These attackers are after the IT blueprints of other organizations. So that they can build a hibernating bot inventory. They can then sell pwned corporate computers to 3rd parties for BTC. Phishing and Spear Phishing doesn't work well on pro users. But this does.

raesene6 9y ago

Supply chain attacks are an obvious avenue for high-end attackers, where their direct targets are hardened, so I guess we'll see more of these going forward. Whilst companies like Microsoft can likely afford to harden their software update systems well enough to deter this, I do wonder what impact it'll have if smaller software providers/open source software providers who can't afford high-end OpSec teams start getting targeted. Realistically a lot of software auto-updates these days so it's a nice avenue for attackers to exploit...