8 ms·

Kaspersky Lab cybersecurity firm is hacked

196 points by goodcanadian 11y ago

nerdy 11y ago
"Duqu 2.0 Hits Kaspersky Lab (securelist.com)" thread @ https://news.ycombinator.com/item?id=9691654 https://news.ycombinator.com/item?id=9691654
deleted 11y ago
[deleted]
- ChrisGranger 11y ago
  That's the BBC article's title. Isn't it S.O.P. to leave article titles as they are?
ingenter 11y ago
Here's one of the reason not to install antivirus software: if a malicious adversary finds a vuln in the AV or hacks C&C servers, you have a nice backdoor you installed to "protect" yourself.
- flashman 11y ago
  Depends on your threat model. I'm more worried about something nasty in one of the many pieces of random software I download from the internet than my AV being compromised.
  - hellbanner 11y ago
    Unfortunately our standard web browsers are insecure because of the way Javascripts work.
    - chc 11y ago
      In practice, JavaScript on the Web doesn't seem to be very high on the list of malware vectors.
      - hellbanner 11y ago
        Isn't this what XSS is.. ?
    - pestaa 11y ago
      Any scripting language can be properly sandboxed, JavaScript being no exception.
  - dietrichepp 11y ago
    I hear a lot of people talk about security but very few people talk about threat models. We need more of this.
    - shabble 11y ago
      Are there any good introductory taxonomies or categorisations of threats and potentially appropriate responses? The obvious distinctions that spring to my (uninformed) mind are: active (mitm, injection) vs passive (snooping, traffic analysis), targeted/opportunistic (maybe insider/outsider too?), and perhaps level of available resources (on the s'kiddie - lone hacker - collective - governmental spectrum, or something) I guess the biggest problem with not having a coherent threat model is that you can end up putting too much effort into the wrong things and have a false confidence in your security. Weakest links, and all that.
      - Spearchucker 11y ago
        STRIDE is the acronym used at Microsoft to categorize different threat types. STRIDE stands for: Spoofing Spoofing is attempting to gain access to a system by using a false identity. This can be accomplished using stolen user credentials or a false IP address. After the attacker successfully gains access as a legitimate user or host, elevation of privileges or abuse using authorization can begin. Tampering Tampering is the unauthorized modification of data, for example as it flows over a network between two computers. Repudiation Repudiation is the ability of users (legitimate or otherwise) to deny that they performed specific actions or transactions. Without adequate auditing, repudiation attacks are difficult to prove. Information disclosure Information disclosure is the unwanted exposure of private data. For example, a user views the contents of a table or file he or she is not authorized to open, or monitors data passed in plaintext over a network. Some examples of information disclosure vulnerabilities include the use of hidden form fields, comments embedded in Web pages that contain database connection strings and connection details, and weak exception handling that can lead to internal system level details being revealed to the client. Any of this information can be very useful to the attacker. Denial of service Denial of service is the process of making a system or application unavailable. For example, a denial of service attack might be accomplished by bombarding a server with requests to consume all available system resources or by passing it malformed input data that can crash an application process. Elevation of privilege Elevation of privilege occurs when a user with limited privileges assumes the identity of a privileged user to gain privileged access to an application. For example, an attacker with limited privileges might elevate his or her privilege level to compromise and take control of a highly privileged and trusted process or account. They use the DREAD model to calculate threat impact (risk). You can get the risk rating for a given threat by asking the following questions: Damage potential How great is the damage if the vulnerability is exploited? Reproducibility How easy is it to reproduce the attack? Exploitability How easy is it to launch an attack? Affected users As a rough percentage, how many users are affected? Discoverability How easy is it to find the vulnerability? Therese's more detail in chapter 3 [1] (threat modelling) of the book Improving Web Application Security: Threats and Countermeasures [2] Note the book was published 12 years ago. [1] https://msdn.microsoft.com/en-us/library/ff648644.aspx#c03618429_011 https://msdn.microsoft.com/en-us/library/ff648644.aspx#c0361... [2] https://msdn.microsoft.com/en-us/library/ff649874.aspx https://msdn.microsoft.com/en-us/library/ff649874.aspx
- hellbanner 11y ago
  What was the software.. Adaware, I believe, would block a fair bit of spyware.. except for the companies that it made deals with.
- deleted 11y ago
  [deleted]
- eeeeeeeeeeeee 11y ago
  Yes, but it's a bit paranoid. Windows and Office are likely going to give you more entry points than the net gain you get from having antivirus/malware protection.
- meowface 11y ago
  That's bordering on complete paranoia. You can make this argument for any software you install with auto-update capabilities... which is likely significantly more than half the software the average person has. Your AV company's infrastructure is probably a lot more secure than the infrastructure of browser plugins you use and games you play.
  - kbenson 11y ago
    If, like our phones, workstation software actually had to request specific access at install or use, then it would be much more dangerous if software that needed quite extensive access was exploited like this. But we don't. Our workstations are actually fairly dumb in this regard. Why is that? Note: Newer Windows an Mac systems might have this with their stores, I don't know. But a store isn't a requirement for this, so why have we had to wait so long?
  - qq66 11y ago
    It's not paranoia to be deeply concerned by the security implications of a ton of auto updating software from dozens of vendors sitting on hundreds of millions of machines.
  - leni536 11y ago
    >Your AV company's infrastructure is probably a lot more secure than the infrastructure of browser plugins you use and games you play. Well I'm not a security expert and I'm using Linux, so I don't use a Windows antivirus obviously. A quick test trying to download free or trial Windows antivirus software (I'm not willing to pay for this simple experiment): Kaspersky: - google Kaspersky - google result leads to http site, all the way to the download of the trial version it's http (I'm sure at least 80% of users don't notice this) - try to type in manually https://www.kaspersky.com - it redirects to http://www.kaspersky.com !!!! Ok let's try Avast, it's popular, isn't it? - ok it's all https, http redirects to https, it could even have HSTS, didn't check. - download links to http CNET site ... - I have to allow half the World's third party js to get to the download. - It's of course http, - Manually rewrite it to https (not straightforward, it's behind a redirection), invalid certificate (issued to a248.e.akamai.net instead of software-files-a.cnet.com - Its installer is probably loaded with CNET crapware anyway Downloading Avira worked fine though, I only tried these three. These companies are supposed to be security vendors, this is freaking ridiculous.
- x0n 11y ago
  I also knew a guy who wore a seat belt and it broke his neck when he crashed his car into a tree. I still wear a seat belt.
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
grhmc 11y ago
Does anyone get the impression this was some sort of early detection mechanism, done intentionally by the hackers, to know when it has been publicly discovered? Is this stupid? Probably stupid.
- nerdy 11y ago
  I personally believe this is a honeypot or trial of sorts. The reason could've been to determine whether or not the intrusion was detected at all as a sort of validation of just how "almost invisible" the malware is, or it could've been to determine the time required to detect. Alternatively, it could be a way of getting at the company's data or even to instigate a thorough review of their platform from the client's perspective. There's a lot of subtle information in the Kaspersky report that might be interesting to intelligence services: - Simultaneous Duqu & Equation Group infection of one victim - Feature coverage (and those omitted, like other payloads) - Red herrings detected/ignored; strings, faked compile timestamps - Noticed misspelling of "Excceeded" & lack of other linguistic errors Kaspersky mulled this issue: "So the targeting of security companies indicates that either they are very confident they won't get caught, or perhaps they don't care much if they are discovered and exposed. By targeting Kaspersky Lab, the Duqu attackers have probably taken a huge bet hoping they’d remain undiscovered; and lost." However they also conceded that they aren't sure: "The exact reason why Kaspersky Lab was targeted is still not clear – although the attackers did seem to focus on obtaining information about Kaspersky's future technologies, Secure OS, anti-APT solutions, KSN and APT research." https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns.pdf https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0...
  - mike_hearn 11y ago
    The simplest, most obvious explanation is: Israeli intelligence wanted to spy on Kaspersky because they are the best at finding and analysing state sponsored malware, they were over-cocky and they eventually got caught.
    - nerdy 11y ago
mirimir 11y ago
Intel Security just reported that "[p]ersistent and virtually undetectable attacks by the Equation Group that reprogram hard disk drives and solid state drive firmware."[0,1] It's interesting that this threat was first reported by Kaspersky in February.[2] The firmware exploits are part of the attack system with Duqu 2.0, right? [0] http://www.mcafee.com/us/security-awareness/articles/mcafee-labs-threats-report-may-2015.aspx http://www.mcafee.com/us/security-awareness/articles/mcafee-... [1] https://news.ycombinator.com/item?id=9685829 https://news.ycombinator.com/item?id=9685829 [2] http://www.kaspersky.com/about/news/virus/2015/equation-group-the-crown-creator-of-cyber-espionage http://www.kaspersky.com/about/news/virus/2015/equation-grou...
- HolyLampshade 11y ago
  Different groups in this case. According to Kapersky's report, Duqu used a zero-day to promote into kernel space, then loaded the full payload into memory. Less terrifying than the firmware revision from EG as a single attack, but Duqu was unique in that it replicated itself around in the local network, making it impossible to remove short of powering down everything.
DickingAround 11y ago
A lot of beating around the bush; just say the US and/or Isreal did it. We already know Duqu was made by the same people who made Stuxnet. We already know Stuxnet was made by the US and/or Isreal to hurt the Iranian nuclear program. So if they have strong evidence it was the same people... we know who those people are and we should just say their names.
- x5n1 11y ago
  Kaspersky has been a pain in the ass of the status quo because they are Russian and so it's difficult to control them and rein them in. Lots of exploits depends on the cooperation and complacency of security companies that are in the pocket of the various governments. Kaspersky wasn't one of these, or at least in the pockets of Russia, and so had to be compromised to try to control their oversight on security and to further the chances of exploits succeeding. Good on them for detecting the exploit, now they know that they are valid targets for this sort of thing.
  - tptacek 11y ago
    Who is trying to control and rein in antivirus companies?
    - obstinate 11y ago
      The Illuminati. Come on. As a security researcher, you should know this. /s
    - x5n1 11y ago
      https://www.schneier.com/blog/archives/2013/12/how_antivirus_c.html https://www.schneier.com/blog/archives/2013/12/how_antivirus...
      - wglb 11y ago
        That is, nobody: they claim they have never received a request to not detect malware.
deleted 11y ago
[deleted]
mirimir 11y ago
Kaspersky's technical paper on Duqu 2.0,[0] begins with: "The initial attack against Kaspersky Lab began with the targeting of an employee in one of our smaller APAC offices." It notes that the next step was compromising other machines on LAN. But they only discuss Windows, and don't even mention OSX, BSD, Linux, etc. I'm wondering how lateral movement to non-Windows machines would have been accomplished. [0] https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns.pdf https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0...
github-cat 11y ago
There is never an end to defend against security attacks. Even the most well-known security company cannot get away with them, how about the general people?
ParadisoShlee 11y ago
List of related links https://redletter.link/question/233-newsrollup-the-duqu-20 https://redletter.link/question/233-newsrollup-the-duqu-20
deleted 11y ago
[deleted]

196 points by goodcanadian 11y ago

nerdy 11y ago

"Duqu 2.0 Hits Kaspersky Lab (securelist.com)" thread @ https://news.ycombinator.com/item?id=9691654 https://news.ycombinator.com/item?id=9691654

deleted 11y ago

[deleted]

ChrisGranger 11y ago
That's the BBC article's title. Isn't it S.O.P. to leave article titles as they are?

ingenter 11y ago

Here's one of the reason not to install antivirus software: if a malicious adversary finds a vuln in the AV or hacks C&C servers, you have a nice backdoor you installed to "protect" yourself.

flashman 11y ago
Depends on your threat model. I'm more worried about something nasty in one of the many pieces of random software I download from the internet than my AV being compromised.
- hellbanner 11y ago
  Unfortunately our standard web browsers are insecure because of the way Javascripts work.
  - chc 11y ago
    In practice, JavaScript on the Web doesn't seem to be very high on the list of malware vectors.
    - hellbanner 11y ago
      Isn't this what XSS is.. ?
  - pestaa 11y ago
    Any scripting language can be properly sandboxed, JavaScript being no exception.
- dietrichepp 11y ago
  I hear a lot of people talk about security but very few people talk about threat models. We need more of this.
  - shabble 11y ago
    Are there any good introductory taxonomies or categorisations of threats and potentially appropriate responses? The obvious distinctions that spring to my (uninformed) mind are: active (mitm, injection) vs passive (snooping, traffic analysis), targeted/opportunistic (maybe insider/outsider too?), and perhaps level of available resources (on the s'kiddie - lone hacker - collective - governmental spectrum, or something) I guess the biggest problem with not having a coherent threat model is that you can end up putting too much effort into the wrong things and have a false confidence in your security. Weakest links, and all that.
    - Spearchucker 11y ago
      STRIDE is the acronym used at Microsoft to categorize different threat types. STRIDE stands for: Spoofing Spoofing is attempting to gain access to a system by using a false identity. This can be accomplished using stolen user credentials or a false IP address. After the attacker successfully gains access as a legitimate user or host, elevation of privileges or abuse using authorization can begin. Tampering Tampering is the unauthorized modification of data, for example as it flows over a network between two computers. Repudiation Repudiation is the ability of users (legitimate or otherwise) to deny that they performed specific actions or transactions. Without adequate auditing, repudiation attacks are difficult to prove. Information disclosure Information disclosure is the unwanted exposure of private data. For example, a user views the contents of a table or file he or she is not authorized to open, or monitors data passed in plaintext over a network. Some examples of information disclosure vulnerabilities include the use of hidden form fields, comments embedded in Web pages that contain database connection strings and connection details, and weak exception handling that can lead to internal system level details being revealed to the client. Any of this information can be very useful to the attacker. Denial of service Denial of service is the process of making a system or application unavailable. For example, a denial of service attack might be accomplished by bombarding a server with requests to consume all available system resources or by passing it malformed input data that can crash an application process. Elevation of privilege Elevation of privilege occurs when a user with limited privileges assumes the identity of a privileged user to gain privileged access to an application. For example, an attacker with limited privileges might elevate his or her privilege level to compromise and take control of a highly privileged and trusted process or account. They use the DREAD model to calculate threat impact (risk). You can get the risk rating for a given threat by asking the following questions: Damage potential How great is the damage if the vulnerability is exploited? Reproducibility How easy is it to reproduce the attack? Exploitability How easy is it to launch an attack? Affected users As a rough percentage, how many users are affected? Discoverability How easy is it to find the vulnerability? Therese's more detail in chapter 3 [1] (threat modelling) of the book Improving Web Application Security: Threats and Countermeasures [2] Note the book was published 12 years ago. [1] https://msdn.microsoft.com/en-us/library/ff648644.aspx#c03618429_011 https://msdn.microsoft.com/en-us/library/ff648644.aspx#c0361... [2] https://msdn.microsoft.com/en-us/library/ff649874.aspx https://msdn.microsoft.com/en-us/library/ff649874.aspx
hellbanner 11y ago
What was the software.. Adaware, I believe, would block a fair bit of spyware.. except for the companies that it made deals with.
deleted 11y ago
[deleted]
eeeeeeeeeeeee 11y ago
Yes, but it's a bit paranoid. Windows and Office are likely going to give you more entry points than the net gain you get from having antivirus/malware protection.
meowface 11y ago
That's bordering on complete paranoia. You can make this argument for any software you install with auto-update capabilities... which is likely significantly more than half the software the average person has. Your AV company's infrastructure is probably a lot more secure than the infrastructure of browser plugins you use and games you play.
- kbenson 11y ago
  If, like our phones, workstation software actually had to request specific access at install or use, then it would be much more dangerous if software that needed quite extensive access was exploited like this. But we don't. Our workstations are actually fairly dumb in this regard. Why is that? Note: Newer Windows an Mac systems might have this with their stores, I don't know. But a store isn't a requirement for this, so why have we had to wait so long?
- qq66 11y ago
  It's not paranoia to be deeply concerned by the security implications of a ton of auto updating software from dozens of vendors sitting on hundreds of millions of machines.
- leni536 11y ago
  >Your AV company's infrastructure is probably a lot more secure than the infrastructure of browser plugins you use and games you play. Well I'm not a security expert and I'm using Linux, so I don't use a Windows antivirus obviously. A quick test trying to download free or trial Windows antivirus software (I'm not willing to pay for this simple experiment): Kaspersky: - google Kaspersky - google result leads to http site, all the way to the download of the trial version it's http (I'm sure at least 80% of users don't notice this) - try to type in manually https://www.kaspersky.com - it redirects to http://www.kaspersky.com !!!! Ok let's try Avast, it's popular, isn't it? - ok it's all https, http redirects to https, it could even have HSTS, didn't check. - download links to http CNET site ... - I have to allow half the World's third party js to get to the download. - It's of course http, - Manually rewrite it to https (not straightforward, it's behind a redirection), invalid certificate (issued to a248.e.akamai.net instead of software-files-a.cnet.com - Its installer is probably loaded with CNET crapware anyway Downloading Avira worked fine though, I only tried these three. These companies are supposed to be security vendors, this is freaking ridiculous.
x0n 11y ago
I also knew a guy who wore a seat belt and it broke his neck when he crashed his car into a tree. I still wear a seat belt.

deleted 11y ago

[deleted]

deleted 11y ago

[deleted]

grhmc 11y ago

Does anyone get the impression this was some sort of early detection mechanism, done intentionally by the hackers, to know when it has been publicly discovered? Is this stupid? Probably stupid.

nerdy 11y ago
I personally believe this is a honeypot or trial of sorts. The reason could've been to determine whether or not the intrusion was detected at all as a sort of validation of just how "almost invisible" the malware is, or it could've been to determine the time required to detect. Alternatively, it could be a way of getting at the company's data or even to instigate a thorough review of their platform from the client's perspective. There's a lot of subtle information in the Kaspersky report that might be interesting to intelligence services: - Simultaneous Duqu & Equation Group infection of one victim - Feature coverage (and those omitted, like other payloads) - Red herrings detected/ignored; strings, faked compile timestamps - Noticed misspelling of "Excceeded" & lack of other linguistic errors Kaspersky mulled this issue: "So the targeting of security companies indicates that either they are very confident they won't get caught, or perhaps they don't care much if they are discovered and exposed. By targeting Kaspersky Lab, the Duqu attackers have probably taken a huge bet hoping they’d remain undiscovered; and lost." However they also conceded that they aren't sure: "The exact reason why Kaspersky Lab was targeted is still not clear – although the attackers did seem to focus on obtaining information about Kaspersky's future technologies, Secure OS, anti-APT solutions, KSN and APT research." https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns.pdf https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0...
- mike_hearn 11y ago
  The simplest, most obvious explanation is: Israeli intelligence wanted to spy on Kaspersky because they are the best at finding and analysing state sponsored malware, they were over-cocky and they eventually got caught.
  - nerdy 11y ago

mirimir 11y ago

Intel Security just reported that "[p]ersistent and virtually undetectable attacks by the Equation Group that reprogram hard disk drives and solid state drive firmware."[0,1] It's interesting that this threat was first reported by Kaspersky in February.[2] The firmware exploits are part of the attack system with Duqu 2.0, right? [0] http://www.mcafee.com/us/security-awareness/articles/mcafee-labs-threats-report-may-2015.aspx http://www.mcafee.com/us/security-awareness/articles/mcafee-... [1] https://news.ycombinator.com/item?id=9685829 https://news.ycombinator.com/item?id=9685829 [2] http://www.kaspersky.com/about/news/virus/2015/equation-group-the-crown-creator-of-cyber-espionage http://www.kaspersky.com/about/news/virus/2015/equation-grou...

HolyLampshade 11y ago
Different groups in this case. According to Kapersky's report, Duqu used a zero-day to promote into kernel space, then loaded the full payload into memory. Less terrifying than the firmware revision from EG as a single attack, but Duqu was unique in that it replicated itself around in the local network, making it impossible to remove short of powering down everything.

DickingAround 11y ago

A lot of beating around the bush; just say the US and/or Isreal did it. We already know Duqu was made by the same people who made Stuxnet. We already know Stuxnet was made by the US and/or Isreal to hurt the Iranian nuclear program. So if they have strong evidence it was the same people... we know who those people are and we should just say their names.

x5n1 11y ago
Kaspersky has been a pain in the ass of the status quo because they are Russian and so it's difficult to control them and rein them in. Lots of exploits depends on the cooperation and complacency of security companies that are in the pocket of the various governments. Kaspersky wasn't one of these, or at least in the pockets of Russia, and so had to be compromised to try to control their oversight on security and to further the chances of exploits succeeding. Good on them for detecting the exploit, now they know that they are valid targets for this sort of thing.
- tptacek 11y ago
  Who is trying to control and rein in antivirus companies?
  - obstinate 11y ago
    The Illuminati. Come on. As a security researcher, you should know this. /s
  - x5n1 11y ago
    https://www.schneier.com/blog/archives/2013/12/how_antivirus_c.html https://www.schneier.com/blog/archives/2013/12/how_antivirus...
    - wglb 11y ago
      That is, nobody: they claim they have never received a request to not detect malware.

deleted 11y ago

[deleted]

mirimir 11y ago

Kaspersky's technical paper on Duqu 2.0,[0] begins with: "The initial attack against Kaspersky Lab began with the targeting of an employee in one of our smaller APAC offices." It notes that the next step was compromising other machines on LAN. But they only discuss Windows, and don't even mention OSX, BSD, Linux, etc. I'm wondering how lateral movement to non-Windows machines would have been accomplished. [0] https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns.pdf https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0...

github-cat 11y ago

There is never an end to defend against security attacks. Even the most well-known security company cannot get away with them, how about the general people?

ParadisoShlee 11y ago

List of related links https://redletter.link/question/233-newsrollup-the-duqu-20 https://redletter.link/question/233-newsrollup-the-duqu-20

deleted 11y ago

[deleted]