10 ms·

Kaspersky: Poorly detected backdoor targeting governments and NGOs around globe

122 points by modinfo 4y ago

notlukesky 4y ago
Is this backdoor patched? And deliberate by Microsoft?
- CSMastermind 4y ago
  No and no? Unless I'm _really_ misreading the article or your comment I think you're misinterpreting what's happening here. IIS a webserver that gets packaged with most versions of Windows. Once attackers gain access to a system through some exploit or another they're leveraging IIS to create a persistent and alternative entry point into the system (a "backdoor"). SessionManager is the name of one piece of malware that does this but it's emblematic of a recent trend of using IIS once you gain access to a system. There's nothing to be patched because there's nothing built into IIS and it's not deliberate by Microsoft in the way that "Increase in Android Malware" wouldn't be deliberate by Google.
  - notlukesky 4y ago
    Thanks for clarifying.
- nix23 4y ago
  You can be sure that Microsoft has no deliberate backdoors in it's products. However the 3-letter agencies have enough zero-day's in their pipeline...probably even more for linux then windows nowadays's.
  - NGRhodes 4y ago
    And also Microsoft have historically (currently ?) just given access to user data of various products of theirs.
wyldfire 4y ago
What does it mean for the backdoor to be "poorly detected"? I would think "poorly implemented [thus easily detected]" makes sense but not "poorly detected." Unless maybe this means that the backdoor is so well hidden that it's not detected by backdoor-detectors? EDIT: yes this does seem to be the case: > A distinctive feature of SessionManager is its poor detection rate. First discovered by Kaspersky researchers in early 2022, some of the backdoor samples were still not flagged as malicious in most popular online file scanning services. I still can't help thinking that the detection capability lies in the detector(s) and it's not a credit to SessionManager as much as it is a fault of the detectors. Is it just too new to be fingerprinted/identified?
- Natsu 4y ago
  I mean, a poorly-detected virus has always been one that doesn't get caught by many detectors. It's normally a call for other vendors to pay more attention to it and implement detection.
  - weq 4y ago
    Or maybe its calling people out for intentionally not detecting this backdoor because of whom it benefits?
    - ConstantVigil 4y ago
      Possibly, but it depends on who we are talking about here. Care to elaborate?
- deleted 4y ago
  [deleted]
- nomilk 4y ago
  It seems "poorly detected" means "(many of) those who have it don't know about it" > it is still possible to discover related malicious activities months or years later, and this will probably be the case for a long time
- 4y ago
technion 4y ago
During the Proxlogon event it talks about, I wrote the following for this scenario: https://github.com/technion/IISBackdoorDetect/blob/main/IISBackdoorDetect.ps1 https://github.com/technion/IISBackdoorDetect/blob/main/IISB... I still run it routinely on all our managed Exchange servers.
bragr 4y ago
>Kaspersky: Poorly detected backdoor targeting governments and NGOs around globe Funny, according to the US government, that is what Kaspersky is.
- DocTomoe 4y ago
  In my book, that only increases the trustworthiness of Kaspersky, in the same way that I tend to trust prosecutors whom the Mafia dislikes.
  - mgfist 4y ago
    In your example it's more like trusting the mobsters that prosecutors are investigating.
  - jonathanstrange 4y ago
    This might have been a reasonable rationale before the Ukraine war and before the West and Russia went into a pretty much open cyber war against each other. Right now, it's really not a good idea to use a security product from a Russian company (unless you're living in Russia, North Korea, Syria, or Iran, of course).
    - twelve40 4y ago
      open cyber war, huh? sounds scary! any examples of major recent damage from this cyber war front? aside from stupid script kiddie dossing which dies in a couple days.
      - jonathanstrange 4y ago
- ConstantVigil 4y ago
  Also according to the US government; weapons of mass destruction are to be found near oil laden countries. Oh wait. But seriously, I always had an inkling of unsureness about using Kaspersky. Could never really place my finger on why. Dodged a bullet I guess?
fuj 4y ago
Interestingly, the map they use shows Crimea as part of Ukraine. The article must be tailored to the foreigner audience since there doesn't seem to be an equivalent one in the Russian version of their website.
kvakvs 4y ago
Kaspersky labs have this curse of trying to be good guys, while operating from a dictatorship state with all state security services having hands up theirs, firmly holding them and operating them like puppets. It is impossible to be a good neutral guy in a dictatorship.
- capableweb 4y ago
  All incorporated companies exists in similar space where they are implicitly and explicitly beholden to the government governing the nation they are incorporated in, that's just how running a legal business is. Best we can do is get information from multiple sources and build an independent understanding from the information. Worst we can do is trusting single entities without any verification from others, no matter where the incorporation is made.
- somenameforme 4y ago
  How quick are we to forget PRISM [1] and the countless other related programs that have been revealed. Any tech company operating in any country is going to be subject to the state interests within that country. Anything beyond that matter of fact is going to be a matter of public relations come propaganda. You can see this leaking into the public in the US most commonly with China. China is still a geopolitical adversary of the US, but they're also the economic future of the world. So big companies want to appeal to China, but are in a constant balancing act between that and keeping domestic powers happy. [1] - https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM
  - iostream24 4y ago
    I think it’s rather a concern that too much bending over backwards to please Xi will jeopardize their customers trust. There is a concerted effort now afoot both in the EU and the USA to bring certain tech fabrication processes to domestic shores for various reasons. The race to the bottom of costing in pursuit of profit margins brought other issues to the forefront and once the market probed the lower end of costing possibilities consumers noticed things like scissors that bend when cutting paper, and there’s been a large backlash, arguably one of the principle fuels feeding the fires of this fake so-called-populism. Im not so sure about China being the economic future of the world these days, despite decades hearing this and despite actual economic sizes and pollution footprints, as I’m not sure China and the US or EU markets can decouple effectively so easily. It’s a bit of a double edged sword for all concerned
vasergen 4y ago
- iostream24 4y ago
  - throwrqX 4y ago
    It's gray because it's a shallow dismissive comment with no substance. Likewise yours will likely also end up the same because complaining about foreign shills is against the guidelines for reasons stated there. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - heartbreak 4y ago
      > HN is broken Gee maybe they’re onto something.
    - iostream24 4y ago
  - GnarfGnarf 4y ago
    its
isodev 4y ago
Is this a case of one backdoor calling another “poorly detected”? I can’t imagine Kaspersky having any credibility as long as they represent the values of a tzar/dictatorship with no regards for human life.
- lizardactivist 4y ago
  No, it's a case of the world's foremost experts on AV software and malware analysis doing all of us a favor and reporting on yet another malware threat. Kaspersky's credibility lies in the fact that they are second to none in their industry and has produced an immense amount of research on malware neutralization for over 20 years now.
- azangru 4y ago
  > as long as they represent the values of a tzar/dictatorship They have their own values. Specifically, they value your money when it is transferred to their account. As do most companies.

122 points by modinfo 4y ago

notlukesky 4y ago

Is this backdoor patched? And deliberate by Microsoft?

CSMastermind 4y ago
No and no? Unless I'm _really_ misreading the article or your comment I think you're misinterpreting what's happening here. IIS a webserver that gets packaged with most versions of Windows. Once attackers gain access to a system through some exploit or another they're leveraging IIS to create a persistent and alternative entry point into the system (a "backdoor"). SessionManager is the name of one piece of malware that does this but it's emblematic of a recent trend of using IIS once you gain access to a system. There's nothing to be patched because there's nothing built into IIS and it's not deliberate by Microsoft in the way that "Increase in Android Malware" wouldn't be deliberate by Google.
- notlukesky 4y ago
  Thanks for clarifying.
nix23 4y ago
You can be sure that Microsoft has no deliberate backdoors in it's products. However the 3-letter agencies have enough zero-day's in their pipeline...probably even more for linux then windows nowadays's.
- NGRhodes 4y ago
  And also Microsoft have historically (currently ?) just given access to user data of various products of theirs.

wyldfire 4y ago

What does it mean for the backdoor to be "poorly detected"? I would think "poorly implemented [thus easily detected]" makes sense but not "poorly detected." Unless maybe this means that the backdoor is so well hidden that it's not detected by backdoor-detectors? EDIT: yes this does seem to be the case: > A distinctive feature of SessionManager is its poor detection rate. First discovered by Kaspersky researchers in early 2022, some of the backdoor samples were still not flagged as malicious in most popular online file scanning services. I still can't help thinking that the detection capability lies in the detector(s) and it's not a credit to SessionManager as much as it is a fault of the detectors. Is it just too new to be fingerprinted/identified?

Natsu 4y ago
I mean, a poorly-detected virus has always been one that doesn't get caught by many detectors. It's normally a call for other vendors to pay more attention to it and implement detection.
- weq 4y ago
  Or maybe its calling people out for intentionally not detecting this backdoor because of whom it benefits?
  - ConstantVigil 4y ago
    Possibly, but it depends on who we are talking about here. Care to elaborate?
deleted 4y ago
[deleted]
nomilk 4y ago
It seems "poorly detected" means "(many of) those who have it don't know about it" > it is still possible to discover related malicious activities months or years later, and this will probably be the case for a long time
4y ago

technion 4y ago

During the Proxlogon event it talks about, I wrote the following for this scenario: https://github.com/technion/IISBackdoorDetect/blob/main/IISBackdoorDetect.ps1 https://github.com/technion/IISBackdoorDetect/blob/main/IISB... I still run it routinely on all our managed Exchange servers.

bragr 4y ago

>Kaspersky: Poorly detected backdoor targeting governments and NGOs around globe Funny, according to the US government, that is what Kaspersky is.

DocTomoe 4y ago
In my book, that only increases the trustworthiness of Kaspersky, in the same way that I tend to trust prosecutors whom the Mafia dislikes.
- mgfist 4y ago
  In your example it's more like trusting the mobsters that prosecutors are investigating.
- jonathanstrange 4y ago
  This might have been a reasonable rationale before the Ukraine war and before the West and Russia went into a pretty much open cyber war against each other. Right now, it's really not a good idea to use a security product from a Russian company (unless you're living in Russia, North Korea, Syria, or Iran, of course).
  - twelve40 4y ago
    open cyber war, huh? sounds scary! any examples of major recent damage from this cyber war front? aside from stupid script kiddie dossing which dies in a couple days.
    - jonathanstrange 4y ago
ConstantVigil 4y ago
Also according to the US government; weapons of mass destruction are to be found near oil laden countries. Oh wait. But seriously, I always had an inkling of unsureness about using Kaspersky. Could never really place my finger on why. Dodged a bullet I guess?

fuj 4y ago

Interestingly, the map they use shows Crimea as part of Ukraine. The article must be tailored to the foreigner audience since there doesn't seem to be an equivalent one in the Russian version of their website.

kvakvs 4y ago

Kaspersky labs have this curse of trying to be good guys, while operating from a dictatorship state with all state security services having hands up theirs, firmly holding them and operating them like puppets. It is impossible to be a good neutral guy in a dictatorship.

capableweb 4y ago
All incorporated companies exists in similar space where they are implicitly and explicitly beholden to the government governing the nation they are incorporated in, that's just how running a legal business is. Best we can do is get information from multiple sources and build an independent understanding from the information. Worst we can do is trusting single entities without any verification from others, no matter where the incorporation is made.
somenameforme 4y ago
How quick are we to forget PRISM [1] and the countless other related programs that have been revealed. Any tech company operating in any country is going to be subject to the state interests within that country. Anything beyond that matter of fact is going to be a matter of public relations come propaganda. You can see this leaking into the public in the US most commonly with China. China is still a geopolitical adversary of the US, but they're also the economic future of the world. So big companies want to appeal to China, but are in a constant balancing act between that and keeping domestic powers happy. [1] - https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM
- iostream24 4y ago
  I think it’s rather a concern that too much bending over backwards to please Xi will jeopardize their customers trust. There is a concerted effort now afoot both in the EU and the USA to bring certain tech fabrication processes to domestic shores for various reasons. The race to the bottom of costing in pursuit of profit margins brought other issues to the forefront and once the market probed the lower end of costing possibilities consumers noticed things like scissors that bend when cutting paper, and there’s been a large backlash, arguably one of the principle fuels feeding the fires of this fake so-called-populism. Im not so sure about China being the economic future of the world these days, despite decades hearing this and despite actual economic sizes and pollution footprints, as I’m not sure China and the US or EU markets can decouple effectively so easily. It’s a bit of a double edged sword for all concerned

vasergen 4y ago

iostream24 4y ago
- throwrqX 4y ago
  It's gray because it's a shallow dismissive comment with no substance. Likewise yours will likely also end up the same because complaining about foreign shills is against the guidelines for reasons stated there. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - heartbreak 4y ago
    > HN is broken Gee maybe they’re onto something.
  - iostream24 4y ago
- GnarfGnarf 4y ago
  its

isodev 4y ago

Is this a case of one backdoor calling another “poorly detected”? I can’t imagine Kaspersky having any credibility as long as they represent the values of a tzar/dictatorship with no regards for human life.

lizardactivist 4y ago
No, it's a case of the world's foremost experts on AV software and malware analysis doing all of us a favor and reporting on yet another malware threat. Kaspersky's credibility lies in the fact that they are second to none in their industry and has produced an immense amount of research on malware neutralization for over 20 years now.
azangru 4y ago
> as long as they represent the values of a tzar/dictatorship They have their own values. Specifically, they value your money when it is transferred to their account. As do most companies.