3 ms·

Disclosing the BLOODALCHEMY backdoor

53 points by skilled 3y ago

bognition 3y ago
Interesting, from the title I thought Elastic was disclosing a backdoor in Elasticsearch. However, this is the security team disclosing that they found a new piece of malware.
Pulcinella 3y ago
Much of what is written on the page is over my head. Do they explain why they gave it an edgy name?
- 1970-01-01 3y ago
  They do not. It appears to be yet another subtool or part of a tool chain for exploration.
quesera 3y ago
Summary BLOODALCHEMY is a backdoor shellcode containing only original code(no statically linked libraries). This code appears to be crafted by experienced malware developers. The backdoor contains modular capabilities based on its configuration. These capabilities include multiple persistence, C2, and execution mechanisms. While unconfirmed, the presence of so few effective commands indicates that the malware may be a subfeature of a larger intrusion set or malware package, still in development, or an extremely focused piece of malware for a specific tactical usage. Omitted from summary: In Microsoft Windows Omitted from entirety of article: Which versions of Windows. Maybe some readers care. I do not! :) Omitted from entirety of article: Why it has such a silly name. I would cut them some slack if it exploited a lib named BLDLCM.DLL or something like that, but it seems the name is just more silliness for the sake of silliness?
- DiabloD3 3y ago
  Names crafted like ALLCAPSNOUNVERB are usually government issued internal names that are used once and are unambiguous while also giving no hint to what they refer to, in the case of information leaks. The author did not name it, but the state-sponsored actor did (either the one that wrote it, in cases of tool leaks, or the one that first identified it, in the cases of foreign tool identification).
  - pizzalife 3y ago
    >The author did not name it, but the state-sponsored actor did (either the one that wrote it, in cases of tool leaks, or the one that first identified it, in the cases of foreign tool identification). From the article, there is no indication that the name comes from whoever authored the software. Sounds made up, and the way they obfuscate strings in the code makes me think it is not from a state-actor (definitely not one in the west).
    - DiabloD3 3y ago
      https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set https://www.elastic.co/security-labs/introducing-the-ref5961... This contains language that leads me to believe they take contract work from state entities. So, either their sponsor names these, or they have internally taken to this style to better integrate into the state security apparatus.
      - quesera 3y ago
        That's reasonable enough. But ALCHEMY is not a verb.
        DiabloD3 3y ago
        This is true. The verb would be Alchemise. There is no real hard rules on how to make these names, other than they have to be memorable, unique, and not actually describe the thing they're naming. Having a noun that can be verbed works well enough.
- albert_e 3y ago
  yeah; not explaining the main platform / device this impacts anywhere clearly is a bad miss. the author / reveiwer should fix.
muststopmyths 3y ago
Malware that exploits a brother industries exe, which is vulnerable to loading a malware DLL named the same as a legit one. Possibly to do with printers ? Not very clear if the exe has been patched since, as the article talks about a exe with an expired signature
- barryrandall 3y ago
  Attackers use vulnerabilities in MS-signed 3rd party drivers as malware loaders. Most attackers use drivers with known vulnerabilities, but every now and then they come up with something new. More details and mitigation instructions can be found here: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules https://learn.microsoft.com/en-us/windows/security/applicati...

53 points by skilled 3y ago

Interesting, from the title I thought Elastic was disclosing a backdoor in Elasticsearch. However, this is the security team disclosing that they found a new piece of malware.

Pulcinella 3y ago

Much of what is written on the page is over my head. Do they explain why they gave it an edgy name?

1970-01-01 3y ago
They do not. It appears to be yet another subtool or part of a tool chain for exploration.

quesera 3y ago

Summary BLOODALCHEMY is a backdoor shellcode containing only original code(no statically linked libraries). This code appears to be crafted by experienced malware developers. The backdoor contains modular capabilities based on its configuration. These capabilities include multiple persistence, C2, and execution mechanisms. While unconfirmed, the presence of so few effective commands indicates that the malware may be a subfeature of a larger intrusion set or malware package, still in development, or an extremely focused piece of malware for a specific tactical usage. Omitted from summary: In Microsoft Windows Omitted from entirety of article: Which versions of Windows. Maybe some readers care. I do not! :) Omitted from entirety of article: Why it has such a silly name. I would cut them some slack if it exploited a lib named BLDLCM.DLL or something like that, but it seems the name is just more silliness for the sake of silliness?

DiabloD3 3y ago
Names crafted like ALLCAPSNOUNVERB are usually government issued internal names that are used once and are unambiguous while also giving no hint to what they refer to, in the case of information leaks. The author did not name it, but the state-sponsored actor did (either the one that wrote it, in cases of tool leaks, or the one that first identified it, in the cases of foreign tool identification).
- pizzalife 3y ago
  >The author did not name it, but the state-sponsored actor did (either the one that wrote it, in cases of tool leaks, or the one that first identified it, in the cases of foreign tool identification). From the article, there is no indication that the name comes from whoever authored the software. Sounds made up, and the way they obfuscate strings in the code makes me think it is not from a state-actor (definitely not one in the west).
  - DiabloD3 3y ago
    https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set https://www.elastic.co/security-labs/introducing-the-ref5961... This contains language that leads me to believe they take contract work from state entities. So, either their sponsor names these, or they have internally taken to this style to better integrate into the state security apparatus.
    - quesera 3y ago
      That's reasonable enough. But ALCHEMY is not a verb.
      - DiabloD3 3y ago
        This is true. The verb would be Alchemise. There is no real hard rules on how to make these names, other than they have to be memorable, unique, and not actually describe the thing they're naming. Having a noun that can be verbed works well enough.
albert_e 3y ago
yeah; not explaining the main platform / device this impacts anywhere clearly is a bad miss. the author / reveiwer should fix.

muststopmyths 3y ago

Malware that exploits a brother industries exe, which is vulnerable to loading a malware DLL named the same as a legit one. Possibly to do with printers ? Not very clear if the exe has been patched since, as the article talks about a exe with an expired signature

barryrandall 3y ago
Attackers use vulnerabilities in MS-signed 3rd party drivers as malware loaders. Most attackers use drivers with known vulnerabilities, but every now and then they come up with something new. More details and mitigation instructions can be found here: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules https://learn.microsoft.com/en-us/windows/security/applicati...