Researchers crack open unusually advanced malware that hid for 5 years
Source: Arstechnica
Security experts have discovered a malware platform that's so advanced in its design and execution that it could probably have been developed only with the active support of a nation state.
The malwareknown alternatively as "ProjectSauron" by researchers from Kaspersky Lab and "Remsec" by their counterparts from Symantechas been active since at least 2011 and has been discovered on 30 or so targets. Its ability to operate undetected for five years is a testament to its creators, who clearly studied other state-sponsored hacking groups in an attempt to replicate their advances and avoid their mistakes. State-sponsored groups have been responsible for malware like the Stuxnet- or National Security Agency-linked Flame, Duqu, and Regin. Much of ProjectSauron resides solely in computer memory and was written in the form of Binary Large Objects, making it hard to detect using antivirus.
Part of what makes ProjectSauron's so impressive is its ability to collect data from air-gapped computers. To do this, it uses specially prepared USB storage drives that have a virtual file system that isn't viewable by the Windows operating system. To infected computers, the removable drives appear to be approved devices, but behind the scenes are several hundred megabytes reserved for storing data that is kept on the air-gapped machines. The arrangement works even against computers in which data-loss prevention software blocks the use of unknown USB drives.
Kaspersky researchers still aren't sure precisely how the USB-enabled exfiltration works. The presence of the invisible storage area doesn't in itself allow attackers to seize control of air-gapped computers. The researchers suspect the capability is used only in rare cases and requires use of a zero-day exploit that has yet to be discovered. In all, Project Sauron is made up of at least 50 modules that can be mixed and matched to suit the objectives of each individual infection.
Read more: http://arstechnica.com/security/2016/08/researchers-crack-open-unusually-advanced-malware-that-hid-for-5-years/
The ability to jump the gap is crazy stuff.
Recursion
(56,582 posts)At least that was the assumption since physically disconnecting the mic stopped it.
A computer's IR receiver would also work, and for that matter a monitor can function as an AM tuner...
NWCorona
(8,541 posts)I'm just thinking about the fact that it was latent for over five years and how it was able to avoid patten mapping.
Also the bridging method is the most troubling part of the whole article.
"The arrangement works even against computers in which data-loss prevention software blocks the use of unknown USB drives."
truthisfreedom
(23,159 posts)Moliere
(285 posts)Unreal hack to have been active for so long
spinbaby
(15,090 posts)It depended on someone plugging in an infected USB drive, probably counting on someone using the same USB drive on both an unsecured and a secure computer. There are very secure air-gap manual switches that enable someone to have both computers on their desk and switch between them as needed. All it would take is for that person to get lazy and use the same USB drive on both machines. A REALLY secure computer has its USB ports filled with epoxy.
NWCorona
(8,541 posts)In my view the way it fools secure systems is the most interesting and troubling part.
And definitely agree with you on the epoxy.
cannabis_flower
(3,768 posts)Not necessarily the same thing.
reACTIONary
(5,789 posts).... located within a Faraday cage.
cstanleytech
(26,334 posts)hidden virtual USB drive to survive on infected systems?
Igel
(35,374 posts)You plug it in, the anti-malware software doesn't see this sequestered memory. The malware runs, infects the machine, and saves data to that reserved memory, undetected.
As soon as you plug the USB thumbdrive into a networked computer, the information can be transmitted. An uninfected drive plugged into an infected machine can be infected.
The air-gapped computer is now "networked" like the computers where I worked a long time ago was "networked": Engineers ran experiments, the data was recorded on magnetic tape, and somebody would have to schlep the tapes from the experiment site to the processing section. (Okay, this was '81.)
FigTree
(347 posts)The gift that keeps on giving.
Plucketeer
(12,882 posts)of some of the most vaunted automobiles in junkyards - ones that show no evidence of a collision being the cause of their demise. Nothing man-made is perfectly impervious.