'The Mask' new cyberespionage operation - 30+ countries

[Usr6]

The attack campaign is highly sophisticated and bears the marks of being a state-sponsored operation, the researchers said

A cyberespionage operation that used highly sophisticated multi-platform malware went undetected for more than five years and compromised computers belonging to hundreds of government and private organizations in more than 30 countries.

Details about the operation were revealed Monday in a paper by security researchers from antivirus firm Kaspersky Lab who believe the attack campaign could be state sponsored.

The Kaspersky researchers dubbed the whole operation "The Mask," the English translation for the Spanish word Careto, which is what the attackers called their main backdoor program. Based on other text strings found in the malware, the researchers believe its authors are probably proficient in Spanish, which is unusual for an APT (advanced persistent threat) campaign.

"When active in a victim system, The Mask can intercept network traffic, keystrokes, Skype conversations, PGP keys, analyze WiFi traffic, fetch all information from Nokia devices, screen captures and monitor all file operations," the Kaspersky researchers said in the research paper. "The malware collects a large list of documents from the infected system, including encryption keys, VPN configurations, SSH keys and RDP [remote desktop protocol] files. There are also several extensions being monitored that we have not been able to identify and could be related to custom military/government-level encryption tools."

Data found by investigating and monitoring a set of command-and-control (C&C) servers used by the attackers revealed more than 380 unique victims from 31 countries. The main targets of the operation are government institutions; embassies and other diplomatic missions; energy, oil and gas companies; research institutions; private equity firms and activists.

Victims were targeted using spear-phishing emails with links leading to websites that hosted exploits for Java and Adobe Flash Player, as well as malicious extensions for Mozilla Firefox and Google Chrome. The URLs used were meant to impersonate the websites of popular newspapers, many in Spanish, but also The Guardian, The Washington Post and The Independent.

Historical data collected from debug logs accessible on C&C servers showed that more than 1,000 victim IP (Internet Protocol) addresses had connected to them. The top five countries by victim IP address count were Morocco, Brazil, the U.K., Spain and France.

Kaspersky was also able to redirect the domain names for some of the C&C servers to a server under its control -- an operation known as sinkholing -- in order to gather statistics and collect more accurate information about the locations of current victims. The active monitoring of connections to the sinkhole server showed a different distribution by country, but Spain, France and Morocco remained in the top 5 by both IP address count and unique victim IDs.

The attackers began shutting down their command-and-control servers in January, and at this time all servers that the Kaspersky researchers knew of are offline. Even so, it's not certain that all victims have been identified, so the paper includes technical details that organizations can use to check their networks and systems for intrusions with this threat.

Also, the possibility of attackers resurrecting the attack campaign cannot be ruled out, the researchers said in a blog post.

In terms of sophistication, the Kaspersky researchers place The Mask campaign above other cyberespionage operations such as Duqu, Gauss, Red October and Icefog that the company has identified over the past few years.

"For Careto, we observed a very high degree of professionalism in the operational procedures of the group behind this attack, including monitoring of their infrastructure, shutdown of the operation, avoiding curious eyes through access rules, using wiping instead of deletion for log files and so on," the researchers said in their paper. "This is not very common in APT operations, putting the Mask into the 'elite' APT groups section."

The malware toolset used by the attackers includes three different backdoor programs, one of which had versions for Mac OS X and Linux in addition to Windows. Some evidence possibly indicating infections on iOS and Android devices was also found on the C&C servers, but no malware samples for those platforms was recovered.

The Careto backdoor program collects system information and can execute additional malicious code, the Kaspersky researchers said. It also injects some of its modules into browser processes -- it can do so in Internet Explorer, Mozilla Firefox and Google Chrome -- to communicate with command-and-control servers.

Careto was often used to install a second, more complex backdoor program called SGH that has a modular architecture and can be easily extended. This second threat contains a rootkit component and has modules for intercepting system events and file operations as well as performing a large number of surveillance functions.

SGH also attempts to exploit a vulnerability in older versions of Kaspersky antivirus products in order to evade detection, which is what attracted the researchers' attention in the first place and prompted the investigation. However, that vulnerability was patched back in 2008 and only affects versions of Kaspersky Workstation older than 6.0.4. and Kaspersky Anti-Virus and Kaspersky Internet Security 8.0 installations that haven't been properly updated, the researchers said.

The third backdoor program is based on an open-source project called SBD, short for Shadowinteger's Backdoor, which is itself based on the netcat networking utility. The Kaspersky researchers found customized SBD variants for Windows, Mac OS X and Linux associated with The Mask operation, but the Linux variant was damaged and couldn't be analyzed.

Different variants of the backdoor programs used in The Mask over the years have been identified, the oldest of which appears to have been compiled in 2007.

Most samples were digitally signed with valid certificates issued to a company called TecSystem Ltd. from Bulgaria, but it's not clear if this company is real. One certificate was valid between June 28, 2011 and June 28, 2013. The other was supposed to be valid from April 18, 2013 to July 18, 2016, but has since been revoked by VeriSign.

"Nation-state-level cyber-offensive operations can lurk in the dark for many years before being discovered and fully analyzed," said Igor Soumenkov, principal security researcher at Kaspersky Lab, via email. "Sometimes, samples are detected, but the researchers lack the data to make a 'big picture' out of it. With Careto, we tried not just to analyze the attack against Kaspersky products, but to understand what is the big picture."

Soumenkov believes the use of the Spanish language and the compilation date of the oldest sample suggest that state-sponsored attackers from countries other than China, Russia or the U.S. have been running cyberespionage attacks longer than previously thought.

Sursa: Cyberespionage operation 'The Mask' compromised organizations in 30-plus countries | ITworld

pe acelasi subiect:

http://arstechnica.com/security/2014/02/meet-mask-posssibly-the-most-sophisticated-malware-campaign-ever-seen/

http://www.darkreading.com/attacks-breaches/researchers-uncover-the-mask-global-cybe/240166043

http://www.securelist.com/en/blog/208216078/The_Careto_Mask_APT_Frequently_Asked_Questions

Ceva interesant:

The CVE-2012-0773 was originally discovered by VUPEN and has an interesting story. This was the first exploit to break the Chrome sandbox and was used to win the CanSecWest Pwn2Own contest in 2012. The exploit caused a bit of a controversy because the VUPEN team refused to reveal how they escaped the sandbox, claiming they were planning to sell the exploit to their customers. It is possible that the Careto threat actor purchased this exploit from VUPEN.(See story by Ryan Naraine)

Analiza completa: http://www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf

Edited February 11, 2014 by Usr6

[yo20063]

Sunt curios cate si mai cate "pieces of malware" sunt "out in the wild" si cine stie de cati ani au ramas si vor ramane nedetectate. Ne dam seama ca deja sunt programe malware care comunica prin poze folosind stenografia, si oricat ti-ai monitoriza reteaua e foarte greu sa-ti dai seama daca sunt request-uri malitioase, mai ales daca pozele sunt pe retele ca facebook s.a.m.d. BIG BROTHER IS UPON US!

[Gilbert]

This is the problem from the internet, any country can monitor, modify or delete any data that hangs on the internet from any other country, institute or individual. Not a recent problem, but yet we keep believing in the holy ghost of the computer. Even it is from no value at all anymore. How long more are we going to refuse to protect our citizens, economies and countries?

I can only explain that by the ultimate stupidity of mankind.

It is not just big brother, it is way bigger then that. I know there are many more malware active, you can discover easely with a good port monitor. The point is that the internet is a unreliable medium that got the illusion that it is handy and functional. But infact it make's our companies and governments funerable and unreliable.

As i see it, the main function of the internet is to create chaos, division and distrust. Well maybe that is still a hypotheses but the results we can see every day again and again.

Edited February 11, 2014 by hate.me
merge