6 ms·

The executive summary is worth the 1-minute read. Interesting that all the malicious frameworks known (by ESET) that target air-gapped networks were for some f

by sounds 5y ago

The executive summary is worth the 1-minute read. Interesting that all the malicious frameworks known (by ESET) that target air-gapped networks were for some form of espionage.

SQueeeeeL 5y ago
"Air-gapping is used to protect the most sensitive of networks. In the first half of 2020 alone, four previously unknown malicious frameworks designed to breach air-gapped networks were publicly documented. ESET Research decided to revisit each framework known to date and to put them in perspective, side by side. Here are the key findings stemming from this exhaustive study: • All the frameworks are designed to perform some form of espionage. • All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks. • We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals. • Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network. • More than 10—critical severity—LNK-related remote code execution vulnerabilities in Windows have been discovered, then patched by Microsoft, in the last 10 years. • All the frameworks were built to attack Windows systems. We have not found any evidence of actual or suspected malware components built to target other operating systems. In this white paper, we will describe how malware frameworks targeting air-gapped networks operate, and provide a side-by-side comparison of their most important TTPs. We also propose a series of detection and mitigation techniques to protect air-gapped networks from the main techniques used by all the mali- cious frameworks publicly known to date."
- lucb1e 5y ago
  Bullet points require a blank line to be separated on HN (this happens to a lot of people): --- Air-gapping is used to protect the most sensitive of networks. In the first half of 2020 alone, four previously unknown malicious frameworks designed to breach air-gapped networks were publicly documented. ESET Research decided to revisit each framework known to date and to put them in perspective, side by side. Here are the key findings stemming from this exhaustive study: • All the frameworks are designed to perform some form of espionage. • All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks. • We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals. • Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network. • More than 10—critical severity—LNK-related remote code execution vulnerabilities in Windows have been discovered, then patched by Microsoft, in the last 10 years. • All the frameworks were built to attack Windows systems. We have not found any evidence of actual or suspected malware components built to target other operating systems. In this white paper, we will describe how malware frameworks targeting air-gapped networks operate, and provide a side-by-side comparison of their most important TTPs. We also propose a series of detection and mitigation techniques to protect air-gapped networks from the main techniques used by all the malicious frameworks publicly known to date.
  - lucb1e 5y ago
    > All the frameworks used USB drives as the physical transmission medium [...] We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals What about the red channel transmission in VGA cables from the Snowden leaks, if memory serves? I'm happy to see this claim because I usually skip these articles about leaking this or that in a lab environment via EM (they seem too esoteric to me but the media seems to love it because it really plays to the imagination), but at the same time it worries me that I can think of a counter example off the top of my head. Maybe it doesn't qualify as a "framework" or wasn't bidirectional, even if it was used to leak confidential data.
    - jcrawfordor 5y ago
      The paper is specific to delivery of malware to airgapped networks. The NSA's RAGEMASTER which you are thinking of, and the whole VAGRANT family, is only a surveillance system - it does not allow for the insertion of any type of software. There is also a useful differentiation in that NSA TAO-type techniques generally require that physical access be established (either to the environment or to equipment being taken into the environment), so in some sense they do not "jump" the air-gap... it's assumed that the method of insertion has already solved that problem. This paper discusses tools that are intended to make their way from a public network into an air-gapped one. In other words, there is a difference between tools for merely exfiltrating from an airgapped environment (having gained access some other way) and tools to actually gain access to the environment by software means. Physically infiltrating, tampering, etc to get an implant into an airgapped environment is old hat in the intelligence world, and so there are many defenses against it, but a "malware" approach to getting a software implant in is a pretty new thing with fewer defenses. Although as this paper shows, epoxy in the USB ports has proven surprisingly effective.
walty 5y ago
Also interesting that "All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks. We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals."
- jonathankoren 5y ago
  Probably because to get this stuff to work is really hard in practice. Several years ago, we were playing with https://github.com/fulldecent/system-bus-radio https://github.com/fulldecent/system-bus-radio to work, but we couldn't, even though we had the right MacBooks.
  - QuarterReptile 5y ago
    Alternatively, such a tool would be so valuable that it would be carefully and sparingly employed. Go too far down that rabbit hole, though, and you start getting into badBIOS territory (a great "conspiracy" theory in the sense of a wild and unprovable idea, though not in the sense of any actual conspiracy.)

by sounds 5y ago

The executive summary is worth the 1-minute read. Interesting that all the malicious frameworks known (by ESET) that target air-gapped networks were for some form of espionage.

SQueeeeeL 5y ago

"Air-gapping is used to protect the most sensitive of networks. In the first half of 2020 alone, four previously unknown malicious frameworks designed to breach air-gapped networks were publicly documented. ESET Research decided to revisit each framework known to date and to put them in perspective, side by side. Here are the key findings stemming from this exhaustive study: • All the frameworks are designed to perform some form of espionage. • All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks. • We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals. • Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network. • More than 10—critical severity—LNK-related remote code execution vulnerabilities in Windows have been discovered, then patched by Microsoft, in the last 10 years. • All the frameworks were built to attack Windows systems. We have not found any evidence of actual or suspected malware components built to target other operating systems. In this white paper, we will describe how malware frameworks targeting air-gapped networks operate, and provide a side-by-side comparison of their most important TTPs. We also propose a series of detection and mitigation techniques to protect air-gapped networks from the main techniques used by all the mali- cious frameworks publicly known to date."

lucb1e 5y ago
Bullet points require a blank line to be separated on HN (this happens to a lot of people): --- Air-gapping is used to protect the most sensitive of networks. In the first half of 2020 alone, four previously unknown malicious frameworks designed to breach air-gapped networks were publicly documented. ESET Research decided to revisit each framework known to date and to put them in perspective, side by side. Here are the key findings stemming from this exhaustive study: • All the frameworks are designed to perform some form of espionage. • All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks. • We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals. • Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network. • More than 10—critical severity—LNK-related remote code execution vulnerabilities in Windows have been discovered, then patched by Microsoft, in the last 10 years. • All the frameworks were built to attack Windows systems. We have not found any evidence of actual or suspected malware components built to target other operating systems. In this white paper, we will describe how malware frameworks targeting air-gapped networks operate, and provide a side-by-side comparison of their most important TTPs. We also propose a series of detection and mitigation techniques to protect air-gapped networks from the main techniques used by all the malicious frameworks publicly known to date.
- lucb1e 5y ago
  > All the frameworks used USB drives as the physical transmission medium [...] We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals What about the red channel transmission in VGA cables from the Snowden leaks, if memory serves? I'm happy to see this claim because I usually skip these articles about leaking this or that in a lab environment via EM (they seem too esoteric to me but the media seems to love it because it really plays to the imagination), but at the same time it worries me that I can think of a counter example off the top of my head. Maybe it doesn't qualify as a "framework" or wasn't bidirectional, even if it was used to leak confidential data.
  - jcrawfordor 5y ago
    The paper is specific to delivery of malware to airgapped networks. The NSA's RAGEMASTER which you are thinking of, and the whole VAGRANT family, is only a surveillance system - it does not allow for the insertion of any type of software. There is also a useful differentiation in that NSA TAO-type techniques generally require that physical access be established (either to the environment or to equipment being taken into the environment), so in some sense they do not "jump" the air-gap... it's assumed that the method of insertion has already solved that problem. This paper discusses tools that are intended to make their way from a public network into an air-gapped one. In other words, there is a difference between tools for merely exfiltrating from an airgapped environment (having gained access some other way) and tools to actually gain access to the environment by software means. Physically infiltrating, tampering, etc to get an implant into an airgapped environment is old hat in the intelligence world, and so there are many defenses against it, but a "malware" approach to getting a software implant in is a pretty new thing with fewer defenses. Although as this paper shows, epoxy in the USB ports has proven surprisingly effective.

walty 5y ago

Also interesting that "All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks. We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals."

jonathankoren 5y ago
Probably because to get this stuff to work is really hard in practice. Several years ago, we were playing with https://github.com/fulldecent/system-bus-radio https://github.com/fulldecent/system-bus-radio to work, but we couldn't, even though we had the right MacBooks.
- QuarterReptile 5y ago
  Alternatively, such a tool would be so valuable that it would be carefully and sparingly employed. Go too far down that rabbit hole, though, and you start getting into badBIOS territory (a great "conspiracy" theory in the sense of a wild and unprovable idea, though not in the sense of any actual conspiracy.)