4 ms·

How does the bogus chip exfiltrate data out of the system, wouldn't the alarms go off at the network level?

• teknologist 8y ago
  Most network level firewalls don't block/inspect outbound packets at this level, and even if they did they could just tunnel (e.g. ssh) through an open port. I think I also read that there was no actual sign of data exfiltration - they were just sending "keep alives" to the C&C hosts.
  • rakkhi 8y ago
    This was my question also. Typically you do not allow servers Internet access and even where you do it is via an authenticated proxy to an approved set of URLs. If there was traffic to a C&C this would be come fairly obvious especially in a spray and prey type attack like this where it is hard to control where the infected servers go it is surprising that there is no evidence presented of this being detected. Your servers or endpoints contacting unusual internet addresses and especially setting up tunnels is something any monitoring system would be looking for
  • samsonradu 8y ago
    But the packets would have a destination that's inspectable isn't it?
    • deleted 8y ago
      [deleted]