5 ms·
the company-system had a qemu "client" that opened up a connection to the attacker's IP (1 MB ram, no disk space, just tcp socket); the attackers then used qemu
by out-of-ideas 3y ago
the company-system had a qemu "client" that opened up a connection to the attacker's IP (1 MB ram, no disk space, just tcp socket); the attackers then used qemu on their own systems, listening to the tcp-connect from the compromised system, in order to establish a tunnel.
securelist.com also states the tunnel made by qemu is not encrypted
- nonrandomstring 3y agoAFAICS, other than easy point to point tunnel via twin VM instances the win here was the TCP encapsulation. The investigators had to strip that back using pcap edit, so presumably it wasn't an easy spot for the firewall either.
- cckk 3y agosorry noob q, but do you mean that the company probably didn't think to search for the unencrypted traffic? I'm not sure if I understand why the encapsulated traffic being unencrypted is "advantageous" for the adversary
- chatmasta 3y agoI think it's just that most scanning tools aren't trying to unwrap a TCP packet inside a TCP packet, so it bypassed their naive filters. Once a researcher spotted it, it was trivial to unwrap, but automated tooling would just see it as the outer TCP packet with some opaque data inside of it. I would assume that the attacker's destination IP would show up on some dashboards somewhere though...