12 ms·
> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safe
by daenz 5y ago
> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safeguards included:
* Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site.
* In some email campaigns the targets received links with unique IDs. This was potentially used to enforcea one-time-click policy for each link and allow the exploit kit to only be served once.
* The exploit kit would AES encrypt each stage, including the clients’ responses with a session-specific key.
* Additional stages were not served if the previous stage failed.
Is this a normal level of sophistication for a CVE?
- mhoad 5y agoI think it’s currently unusual but makes sense as a pretty obvious SOP for an attacker with a specific target set who is sitting on top of a pretty valuable vulnerability (RCE on a fully up to date Chrome in this instance). They are hard to come buy and building tooling is a long and expensive process on top of everything else.
- RL_Quine 5y agoWe see some of this with just normal spear phishing against companies. The "single click" thing is reasonably common, it makes things a bit harder to catch as often the clickthrough will change to whatever is being spoofed in the first place. A homophone ycornbinator.com would serve the malware first time, then next time it would send a permanent redirect. Unique IDs you'll see in things like spam SMS, both to work around automated blacklisting, but also to work out who clicked through and who might be a potential mark the next time even if they didn't completely fall for the scam. Most of what we got was recycled RAT malware with various packers though, it didn't trend towards being particularly interesting because you usually don't need to be to catch people, at least that's my impression. Maybe it's bad toupee fallacy.
- mot0rola 5y agoI am receiving increased SMS spam past week. Is connected to this exploit? Msgs are all different domains with unique ID appended.
- samsonradu 5y agoMe too, receiving spam job offers with bit.ly links.
- xunn0026 5y agoI too saw one of these. Very odd since I was expecting a note about a job.
- TedDoesntTalk 5y agoDon’t reply to those SMS. Your geolocation can be derived from your reply, even a STOP or UNSUBSCRIBE reply.
- akouri 5y agoCan you explain how this works if you don't click any links?
- TedDoesntTalk 5y agoI read about it on HN some months ago. I don’t recall if it was in comments or an article. But I read the info and sources and was convinced enough at the time. I’m sorry I didn’t save the original info. I’ll try some googling “geolocation from SMS” and see what I can find.
- wolverine876 5y agoThanks for the input. A nit, sorry, but maybe relevant to readers learning a little about anti-phishing: homophones sound the same ('-phone' refers to sound, like telephone) but differ in meaning, such as 'write' and 'right'. I don't know the term for ycombinator.com / ycornbinator.com, which is a real problem, of course.
- chrismarlow9 5y agoIt's a homoglyph https://en.m.wikipedia.org/wiki/Homoglyph https://en.m.wikipedia.org/wiki/Homoglyph Typically used via poorly named idn homograph attacks https://en.m.wikipedia.org/wiki/IDN_homograph_attack https://en.m.wikipedia.org/wiki/IDN_homograph_attack
- thaumasiotes 5y agoTechnically ycornbinator.com is just a lookalike. Homographs look exactly the same. (And of course "homograph" ["same writing" or "same picture"] is a better name than "homoglyph" ["same carving"].)
- chrismarlow9 5y agoThat's fair I'm not really one for jargon and whatnot (I think it can actually become less useful if the goal is just to communicate something to a person), but the first line in wiki says: > a homoglyph is one of two or more graphemes, characters, or glyphs with shapes that appear identical or very similar. "Very similar" and "two or more" being the key words. As for homograph I found homoglyph by reading the wiki and it saying homoglyph is more appropriate. (Insert obligatory "wiki it's not always accurate etc etc"). Overall I'd take either one and personally don't care. Just trying to match what you're saying with what I'm reading and make sense of where the truth is.
- wolverine876 5y ago> (Insert obligatory "wiki it's not always accurate etc etc"). Overall I'd take either one and personally don't care. Just trying to match what you're saying with what I'm reading and make sense of where the truth is. Diving in (even if the parent doesn't care :) ): The last sentence is the real challenge: Meanings depend 100% on writer and reader understandings. If two agree that 'homograph' means 'chicken poop', as long as they're the only ones communicating then 'chicken poop' it is; but if someone else reads it, our language subsystem fails. Some dictionaries influence meaning by being prescriptive (e.g., American Heritage, IIRC); others report what has been understood by being descriptive (e.g., Oxford). The problem is, Wikipedia is neither: It represents the understandings of a few editors of unknown knowledge; it is neither descriptive nor prescriptive and we quickly get into chicken poop scenarios. * Homograph, report Merriam-Webster and Oxford, means words with the same spelling but different meanings (or origin or pronunciation), e.g., the bow of a ship and a bow and arrow. * Homoglyph doesn't appear in Oxford, Merriam-Webster, American Heritage, or any others (per Wordnik and OneLook), except Wiktionary. Wiktionary descriptively traces the word back to 1938 (though maybe with a different meaning in that case) and says it means a glyph with the same or similar appearance but different meaning. That still doesn't define a term for the entire string "ycornbinator.com", only the "rn", but close enough!
- deleted 5y ago[deleted]
- adolph 5y agoMuch of it seems like normal ad-tech practice to identify individuals and discourage click-farming. Unique keys sent in an email campaign? Oh my scaaary stuff.
- politelemon 5y agoFor targeted ones I think it is. The details that emerged around SolarWinds were quite sophisticated in terms of execution, timing, hiding, and cleanup.
- no-dr-onboard 5y agoFor CVEs? No. CVEs are awarded for things as (relatively) little as static keys being packaged with APKs. What is unusual is that NK used a sophisticated attack chain to successfully pwn a hardened industry (notably, fintech). At this point I think it’s safe to say that NK is a significant competitor to FVEY in terms of cyber warfare capabilities.
- thefunnyman 5y agoI would say this isn’t necessarily unusual for NK. As far as I know, they’re the only nation state actor known to hack for profit and they’ve committed several of the largest cyber bank robberies ever. Nation state actors have an _incredible_ amount of time, resources, and motivation.
- no-dr-onboard 5y agoIndeed. The amount of skill they've demonstrated as Lazarus (Lazarus Leaks (Vault 7), the Bangladesh Bank Heist, and Dark Seoul) is certainly notable and this seems to fit well within their MO.