11 ms·

New campaign targeting security researchers

235 points by el_duderino 6y ago

userbinator 6y ago
and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server. At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions. I am almost willing to bet $$$ that they would be fine if they had JS disabled. That also reminds me of something I remember reading about many years ago on an RE site: "You hear about all the bugs they fix in each update. You don't hear about all the new ones they introduced."
- gruez 6y ago
  >I am almost willing to bet $$$ that they would be fine if they had JS disabled. The problem is that you eventually have to enable scripts when you encounter a site that refuses to work with scripts disabled. There are enough of such sites around that most people would instinctively enable scripts whenever they see a broken site, which nullifies any security benefit.
  - userbinator 6y ago
    If anything, security researchers should not be "most people". They should know better than to let sites execute untrusted code. Of course, I believe Google is complicit in this somewhat, since its own intrusive tracking needs JS, and so it encourages everyone to make sites that require it and users to leave it on by default.
- mappu 6y ago
  >I am almost willing to bet $$$ that they would be fine if they had JS disabled. The attack vector was spearphishing followed by convincing the target to compile a project, where the makefile contained malware. No JS involved.
  - dotty- 6y ago
    From the blog post: >In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog. Aka, they were compromised after simply visiting a malicious blog. This is why the blog post emphasizes the Chrome Vulnerability Program, and specifically mentions that the victim was running a fully patched Windows 10 machine and fully patched Chrome. >At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions. RCE exploits on web browsers are typically written in JS. I would also bet $$$ that if they had JS disabled, they would not have been compromised.
  - deathanatos 6y ago
    The article notes that there appear to have been exploits from browsing to the attackers' blogs in addition to the malware-laden software project.
- smnrchrds 6y ago
  > I am almost willing to bet $$$ that they would be fine if they had JS disabled. I am fully willing to bet $$$$ that they would be fine if they had air gapped their computer. Unfortunately, disabling JS is only marginally more practical than completely foregoing access to the web; and it is only going to get worse as more sites and services rely on JS.
  - superkuh 6y ago
    It really depends on what you do. Amazon.com, for example, works perfectly fine with javascript disabled. They do it because they care about selling to everyone and know that even people with old computers and old software buy things. Web devs keep repeating to themselves that no one browses with JS off but you can't see the ones that have it off if all you use to survey is JS itself.
    - g_p 6y ago
      Gov.UK is built around an assumption users have no or broken JavaScript, based on some of their research into how people use the site. When running at scale, they found about 1 in 93 visitors didn't have working JavaScript. [1] Mid startup hustle it makes sense for people to start ignoring this. But if you adopt a mindset of serving users, you'll quickly see why they went with this approach - progressive enhancement of the site based on the capabilities that work, with a fully functional experience extending from lynx and upwards. [2] [1] https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missing-out-on-javascript-enhancement/ https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missi... [2] https://technology.blog.gov.uk/2016/09/19/why-we-use-progressive-enhancement-to-build-gov-uk/ https://technology.blog.gov.uk/2016/09/19/why-we-use-progres...
      - saagarjha 6y ago
        “It’s just 1% of our users!”
      - andi999 6y ago
        Probably the 1 was an unidentified robot...
- tclancy 6y ago
  (Disclosure: I am not in any way a security researcher) > I am almost willing to bet $$$ that they would be fine if they had JS disabled I would guess that's because you do and that's what you use as a proxy to feel safe about the unsafe web. All of us even slightly aware of the security problems of browsing the web have something (for myself I immediately thought, I should add those domain names to my PiHole, just to be safe), but that's the problem with asymmetry: it costs you a lot to defend against everything; it costs a determined attacker very little in a marginal cost sense to spread their efforts across threat vectors. You're pretty sure disabling JS makes things safe. Do you allow CSS? That's another vector. What about all those cool new HTML5 apis we have now? Heck, it's tough to get developers to think at all about accessibility, what are the odds the developers who have to support that under-appreciated field put in a ton of extra time to make sure the features are fuzz tested? Anyone tested what you can do with the subtitle track to an HTML5 video player? I bought a copy of The Tangled Web a decade ago and never finished it because the whole thing was just too depressing to really come to grips with and instead I too have uBlock, a PiHole, some other Chrome extensions and a Mac as a sort of double-condom to make me feel safe without making me much safer. We are all the US military, happily stockpiling the wrong assets to fight the last war.
  - everybodyknows 6y ago
    >I too have uBlock, ... Did you mean “uBlock Origin”, from the original author of uBlock? https://news.ycombinator.com/item?id=24534778 https://news.ycombinator.com/item?id=24534778
    - tclancy 6y ago
      Yes. Good point about the clarification!
- albntomat0 6y ago
  Take a look at the most recent stable release notes for Chrome. I don't have a full list of which ones are in the renderer processes vs which ones are in the browser process. That said, it seems like a good number would affect Chrome without Javascript https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html https://chromereleases.googleblog.com/2021/01/stable-channel...
saagarjha 6y ago
You’d think that sending the world’s foremost security researchers malware would be a stupid idea, but they’re people too. They run Windows and Chrome just like everyone else, and (for the most part) nobody can really live with “I’m going to be targeted by a nation state” as their threat model, not even those who are aware of what the capabilities of an advanced zero day are. It’s kind of depressing if you think about it: nobody has really solved “what do I do if I have a government against me” yet…
- troyjfarrell 6y ago
  I agree that everyone, even security researchers, will make mistakes. But there are people who survive with state-level actors in their threat model. These people probably 1) do not post their threat model and mitigations in easy-to-Google places and 2) have the help of one or more other state-level actors.
  - saagarjha 6y ago
    Well it’s twofold: one is that security researchers will use bad passwords and click in shady links just like anyone else, and the second part is that even people with state-level adversaries that are actively trying to avoid getting hacked (journalists, whistleblowers, the like) get hacked anyways because they…carry an up-to-date flagship. There really doesn’t seem to be actual protections against a determined state actor short of not using computers…
    - i_am_proteus 6y ago
      "Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good pass-word and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https:// https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFI-NITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them."[0] [0]https://scholar.harvard.edu/files/mickens/files/thisworldofours.pdf https://scholar.harvard.edu/files/mickens/files/thisworldofo...
SheinhardtWigCo 6y ago
Why hunt for bugs like a chump when you can target the infosec and product security folks with lazy opsec and download working PoCs right off their systems?
deleted 6y ago
[deleted]
cik 6y ago
In my (direct) experience most security researchers, have very poor practices in general. I come to this space from the side of anonymity and general paranoia - because I find that interesting. That paranoia leads to horrible security experiences for me, but I feel much safer in my practices. If you always assume your data is at risk, and that your data can become your person, you'll take care of it. In the modern era, we're almost post-goods. I couldn't care less if someone broke into my house and stole my TV/monitors/stuff - and it's happened. But the last thing I'd want stolen is data I hold near and dear.
- tarruda 6y ago
  If you don't mind adding an additional layer to your paranoia, I suggest seeing this video on the 2012 solar storm: https://youtu.be/hESunUuFrzk https://youtu.be/hESunUuFrzk The video will show how your data can be suddenly destroyed if all you have are digital backups. Seeing this video led me to buy a laser printer so I can have paper backups: http://ollydbg.de/Paperbak/ http://ollydbg.de/Paperbak/
  - avdlinde 6y ago
    Never seen this before, very interesting! But how much can one realistically print? 500KB per page isn't much for today's data hoarding standards. I guess you don't keep images?
    - numpad0 6y ago
      500KB/page at $0.02/page = $20.97/GB. HDD is $0.01-0.03/GB, SSD is $0.10-0.25/GB, BD/DVD are $0.02-0.10/GB, respectively, at retail prices and before counting redundancy. $20/GB was as far back for HDD as Oct 1999, which by the way fell further to around $7.50 next year in Oct 2000[1]. Yeah interesting but 10-100 fold density improvement would be nice... 1: https://mkomo.com/cost-per-gigabyte https://mkomo.com/cost-per-gigabyte
      - namibj 6y ago
        25G BD-R can be had for 8 ct. However, the patent license royalties are at about 10 ct (I forgot if USD or EUR). Also, you can't retroactively pay the royalties when importing. Patents are bad. They would have developed BluRay without patent protection.
numlock86 6y ago
> In each of these cases, the researchers have followed a link on Twitter to a write-up hosted on blog.br0vvnn[.]io, and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server. At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions. At this time we’re unable to confirm the mechanism of compromise, but we welcome any information others might have Interesting. Call me naive, but couldn't someone just investigate on this right now? Like get the link, act as Chrome and debug the whole process from forwarding the link to the executable up to getting compromised?
- albntomat0 6y ago
  It's possible the attacker only serves up the Chrome exploit to some selected group of visitors, rather than anyone who visits the site.
zinekeller 6y ago
Alejandro Caceres (a bughunter that has been attacked) has discussed some additional details on the VS attack vector on https://www.theregister.com/2021/01/26/north_korea_targeted_me_0_day/ https://www.theregister.com/2021/01/26/north_korea_targeted_....

235 points by el_duderino 6y ago

and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server. At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions. I am almost willing to bet $$$ that they would be fine if they had JS disabled. That also reminds me of something I remember reading about many years ago on an RE site: "You hear about all the bugs they fix in each update. You don't hear about all the new ones they introduced."

gruez 6y ago
>I am almost willing to bet $$$ that they would be fine if they had JS disabled. The problem is that you eventually have to enable scripts when you encounter a site that refuses to work with scripts disabled. There are enough of such sites around that most people would instinctively enable scripts whenever they see a broken site, which nullifies any security benefit.
- userbinator 6y ago
  If anything, security researchers should not be "most people". They should know better than to let sites execute untrusted code. Of course, I believe Google is complicit in this somewhat, since its own intrusive tracking needs JS, and so it encourages everyone to make sites that require it and users to leave it on by default.
mappu 6y ago
>I am almost willing to bet $$$ that they would be fine if they had JS disabled. The attack vector was spearphishing followed by convincing the target to compile a project, where the makefile contained malware. No JS involved.
- dotty- 6y ago
  From the blog post: >In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog. Aka, they were compromised after simply visiting a malicious blog. This is why the blog post emphasizes the Chrome Vulnerability Program, and specifically mentions that the victim was running a fully patched Windows 10 machine and fully patched Chrome. >At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions. RCE exploits on web browsers are typically written in JS. I would also bet $$$ that if they had JS disabled, they would not have been compromised.
- deathanatos 6y ago
  The article notes that there appear to have been exploits from browsing to the attackers' blogs in addition to the malware-laden software project.
smnrchrds 6y ago
> I am almost willing to bet $$$ that they would be fine if they had JS disabled. I am fully willing to bet $$$$ that they would be fine if they had air gapped their computer. Unfortunately, disabling JS is only marginally more practical than completely foregoing access to the web; and it is only going to get worse as more sites and services rely on JS.
- superkuh 6y ago
  It really depends on what you do. Amazon.com, for example, works perfectly fine with javascript disabled. They do it because they care about selling to everyone and know that even people with old computers and old software buy things. Web devs keep repeating to themselves that no one browses with JS off but you can't see the ones that have it off if all you use to survey is JS itself.
  - g_p 6y ago
    Gov.UK is built around an assumption users have no or broken JavaScript, based on some of their research into how people use the site. When running at scale, they found about 1 in 93 visitors didn't have working JavaScript. [1] Mid startup hustle it makes sense for people to start ignoring this. But if you adopt a mindset of serving users, you'll quickly see why they went with this approach - progressive enhancement of the site based on the capabilities that work, with a fully functional experience extending from lynx and upwards. [2] [1] https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missing-out-on-javascript-enhancement/ https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missi... [2] https://technology.blog.gov.uk/2016/09/19/why-we-use-progressive-enhancement-to-build-gov-uk/ https://technology.blog.gov.uk/2016/09/19/why-we-use-progres...
    - saagarjha 6y ago
      “It’s just 1% of our users!”
    - andi999 6y ago
      Probably the 1 was an unidentified robot...
tclancy 6y ago
(Disclosure: I am not in any way a security researcher) > I am almost willing to bet $$$ that they would be fine if they had JS disabled I would guess that's because you do and that's what you use as a proxy to feel safe about the unsafe web. All of us even slightly aware of the security problems of browsing the web have something (for myself I immediately thought, I should add those domain names to my PiHole, just to be safe), but that's the problem with asymmetry: it costs you a lot to defend against everything; it costs a determined attacker very little in a marginal cost sense to spread their efforts across threat vectors. You're pretty sure disabling JS makes things safe. Do you allow CSS? That's another vector. What about all those cool new HTML5 apis we have now? Heck, it's tough to get developers to think at all about accessibility, what are the odds the developers who have to support that under-appreciated field put in a ton of extra time to make sure the features are fuzz tested? Anyone tested what you can do with the subtitle track to an HTML5 video player? I bought a copy of The Tangled Web a decade ago and never finished it because the whole thing was just too depressing to really come to grips with and instead I too have uBlock, a PiHole, some other Chrome extensions and a Mac as a sort of double-condom to make me feel safe without making me much safer. We are all the US military, happily stockpiling the wrong assets to fight the last war.
- everybodyknows 6y ago
  >I too have uBlock, ... Did you mean “uBlock Origin”, from the original author of uBlock? https://news.ycombinator.com/item?id=24534778 https://news.ycombinator.com/item?id=24534778
  - tclancy 6y ago
    Yes. Good point about the clarification!
albntomat0 6y ago
Take a look at the most recent stable release notes for Chrome. I don't have a full list of which ones are in the renderer processes vs which ones are in the browser process. That said, it seems like a good number would affect Chrome without Javascript https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html https://chromereleases.googleblog.com/2021/01/stable-channel...

saagarjha 6y ago

You’d think that sending the world’s foremost security researchers malware would be a stupid idea, but they’re people too. They run Windows and Chrome just like everyone else, and (for the most part) nobody can really live with “I’m going to be targeted by a nation state” as their threat model, not even those who are aware of what the capabilities of an advanced zero day are. It’s kind of depressing if you think about it: nobody has really solved “what do I do if I have a government against me” yet…

troyjfarrell 6y ago
I agree that everyone, even security researchers, will make mistakes. But there are people who survive with state-level actors in their threat model. These people probably 1) do not post their threat model and mitigations in easy-to-Google places and 2) have the help of one or more other state-level actors.
- saagarjha 6y ago
  Well it’s twofold: one is that security researchers will use bad passwords and click in shady links just like anyone else, and the second part is that even people with state-level adversaries that are actively trying to avoid getting hacked (journalists, whistleblowers, the like) get hacked anyways because they…carry an up-to-date flagship. There really doesn’t seem to be actual protections against a determined state actor short of not using computers…
  - i_am_proteus 6y ago
    "Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good pass-word and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https:// https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFI-NITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them."[0] [0]https://scholar.harvard.edu/files/mickens/files/thisworldofours.pdf https://scholar.harvard.edu/files/mickens/files/thisworldofo...

SheinhardtWigCo 6y ago

Why hunt for bugs like a chump when you can target the infosec and product security folks with lazy opsec and download working PoCs right off their systems?

deleted 6y ago

[deleted]

cik 6y ago

In my (direct) experience most security researchers, have very poor practices in general. I come to this space from the side of anonymity and general paranoia - because I find that interesting. That paranoia leads to horrible security experiences for me, but I feel much safer in my practices. If you always assume your data is at risk, and that your data can become your person, you'll take care of it. In the modern era, we're almost post-goods. I couldn't care less if someone broke into my house and stole my TV/monitors/stuff - and it's happened. But the last thing I'd want stolen is data I hold near and dear.

tarruda 6y ago
If you don't mind adding an additional layer to your paranoia, I suggest seeing this video on the 2012 solar storm: https://youtu.be/hESunUuFrzk https://youtu.be/hESunUuFrzk The video will show how your data can be suddenly destroyed if all you have are digital backups. Seeing this video led me to buy a laser printer so I can have paper backups: http://ollydbg.de/Paperbak/ http://ollydbg.de/Paperbak/
- avdlinde 6y ago
  Never seen this before, very interesting! But how much can one realistically print? 500KB per page isn't much for today's data hoarding standards. I guess you don't keep images?
  - numpad0 6y ago
    500KB/page at $0.02/page = $20.97/GB. HDD is $0.01-0.03/GB, SSD is $0.10-0.25/GB, BD/DVD are $0.02-0.10/GB, respectively, at retail prices and before counting redundancy. $20/GB was as far back for HDD as Oct 1999, which by the way fell further to around $7.50 next year in Oct 2000[1]. Yeah interesting but 10-100 fold density improvement would be nice... 1: https://mkomo.com/cost-per-gigabyte https://mkomo.com/cost-per-gigabyte
    - namibj 6y ago
      25G BD-R can be had for 8 ct. However, the patent license royalties are at about 10 ct (I forgot if USD or EUR). Also, you can't retroactively pay the royalties when importing. Patents are bad. They would have developed BluRay without patent protection.

numlock86 6y ago

> In each of these cases, the researchers have followed a link on Twitter to a write-up hosted on blog.br0vvnn[.]io, and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server. At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions. At this time we’re unable to confirm the mechanism of compromise, but we welcome any information others might have Interesting. Call me naive, but couldn't someone just investigate on this right now? Like get the link, act as Chrome and debug the whole process from forwarding the link to the executable up to getting compromised?

albntomat0 6y ago
It's possible the attacker only serves up the Chrome exploit to some selected group of visitors, rather than anyone who visits the site.

zinekeller 6y ago

Alejandro Caceres (a bughunter that has been attacked) has discussed some additional details on the VS attack vector on https://www.theregister.com/2021/01/26/north_korea_targeted_me_0_day/ https://www.theregister.com/2021/01/26/north_korea_targeted_....