Spies Steal Confidential Data For Years Via Satellites

A group of cyber spies by several anti-virus companies responsible will be held for attack on the Belgian Ministry of Foreign Affairs and numerous other organizations is already using satellites for years to steal confidential data from infected computers. Reported anti-virus firm Kaspersky Lab today.

The espionage group called "Turla" and is responsible for the Snake rootkit, also known as Uroburos. Through social engineering and zero-day vulnerabilities knows the group of infecting computers for eight years. It involves government agencies and embassies, as well as defense, education, and research organizations and pharmaceutical companies. After valuable targets have been determined using the attackers in the final phase of the attack a wide, satellite-based communication mechanism in order to steal the data and to cover their tracks.

Satellite

Satellite provides mainly people in remote areas access. One of the most widespread and affordable types of satellite-based Internet connections is called a downstream-only connection. In addition, outgoing requests from a user's computer to communicate through conventional lines, such as a dial-up modem or GPRS connection, while all inbound traffic from the satellite. This technology allows the user to achieve a relatively high download speed.

The downstream traffic has the disadvantage that it comes back to the unencrypted computer. A malicious user in the same region as the satellite user can intercept this traffic with the right equipment and software and gain access to the download traffic from users. The Turla group used this weakness to steal confidential data from infected computers without them hereby leave a trail.

The group listens first to the downstream of the satellite to identify active IP addresses of the satellite-based Internet users who are online at that moment. Then they choose an online IP address that they want to use to send the stolen data to, without the legitimate user of this is informed. The infected computer then is instructed to send the data to the IP address of the user satellite.

TCP / IP connection

In order to steal data from the satellite traffic the attacker must have a complete TCP / IP connection between himself and have the infected machine, let Stefan Tanase Kaspersky Lab. When setting up a TCP connection between two machines, the first client sends a SYN packet to the server. Then, the server sends a SYN-ACK packet back.The client replies with an ACK packet, and the connection is established and data can be exchanged.

In the case of the espionage group allows the infected computer to send a SYN packet to the IP address of the user satellite.The satellite provider radiates this SYN packet to earth. The innocent satellite user accepts the package, because he has not asked for here. Therefore there is no TCP / IP connection. The attackers who are in the region and accommodate the satellite traffic received the same package, but accept it. For this, they send back an ACK request, in which they spoof the IP address of the user's satellite. "This way they know parallel a full TCP / IP connection to set up and steal the data," said Tanase.

Hijacking satellite links was discussed at the Black Hat conference in 2009 and 2010 (PDF 1, PDF 2). According Tanase uses Turla group this tactic since at least 2007. Two years before the public was discussed. Other espionage groups would use this tactic. For this own satellite links are used, but in the case of the group-Turla lifts them on the satellite traffic of others.

The use of satellites has the advantage that attackers in this way be able to hide the location of their own server. Also, it is not necessary to have a valid subscription satellite. Hijacking the satellite link can be completely anonymous. As a result, it is also difficult to identify the attackers. This method has some drawbacks, since satellite based Internet can be slow and unstable.

Providers

Another interesting aspect to the tactics of Turla is that satellite Internet service are used in the Middle East and African countries. Thus, the researchers discovered IP addresses of providers in Afghanistan, Congo, Lebanon, Libya, Niger, Nigeria, Somalia and Zambia. Satellites used by operators in these countries usually have no coverage in European and North American regions. This enables most security researchers very difficult to investigate such attacks.

"Turla is able to achieve the ultimate anonymity by using a widely used technology -. One-way Internet via the satellite, the attackers anywhere itself can within the range of the satellite selected by them are, an area that can cover thousands of square kilometers "Tanase know so late. Kaspersky Lab detected worldwide hundreds of infections, although the actual number may be higher is because the virus fighter does not all infections. The attackers are thereby still active and still make use of satellite communications to steal confidential data, according to the Russian anti-virus company.

Google: Update Stage Fright Leak Available On Time

Owners of an Android device will receive a security update for a very serious leak in time, so has Google at the Black Hat conference in Las Vegas announced. It is the Stage Fright vulnerability can perform, allowing a remote attacker code on smartphones.

All that this requires is sending an MMS message, although the vulnerability via websites and apps is to attack. The problem was discovered by security Zimperium and Trend Micro. Both parties warned Google that then came up with an update.Rolling out the patch among telecom operators and manufacturers was difficult. Because of all the attention, and for the extent of the problem were various manufacturers in motion and made ​​known to come up with patches. As announced Samsung itself entirely new policy for the rollout of Android security updates. Each month users will soon receive updates.

In the case of Google, the Internet giant will today send updates to owners of a Nexus Nexus 5 and 6, according to Android Police, and Business Insider . According to Adrian Ludwig from the Android Security Team most Android users will receive the update later this month. Yet he is optimisch that users will be protected by existing security measures such as ASLR.This technology makes it harder to vulnerabilities like Stage Fright use and is present on 90% of Android devices. In addition, Ludwig expects the patches are rolled out on time, even before attackers through Stage Fright users can attack, reports The Verge .

32 Zero-Day Vulnerabilities Announced At Black Hat Conference

For another two weeks and then starts the American edition of the Black Hat conference, one of the most important conferences in the field of IT security. This year especially defense against malware and mobile technologies popular topics, but there will also be all sorts of unknown vulnerabilities are demonstrated.

"We have 32 different zero-day vulnerabilities disclosed during the event," said Stevie Wylie, general director of the conference, compared to eWeek . "The zero days come from a variety of areas, including mobile and SCADA (supervisory control and data acquisition) systems." In addition, the conference for the first time a study ( pdf ) published among 460 security experts. The experts suggest that refined attacks directly against the organization are focused and phishing and social engineering are the main concerns. Furthermore, the experts most daily time spent on vulnerabilities that are introduced by their own application developers.

When it comes to expenditure are incidental data leaks that cause end users because they do not follow the policy as well as targeted attacks, the greatest costs. When asked what the weakest link in the enterprise security indicates 33% of the surveyed experts to end users who violate security policy and easily be misled by social engineering attacks. According to Black Hat, the survey shows that the current IT security model of enterprises should be reconsidered and that security professionals do not spend their time and money to make the issues they are most concerned about.

Researchers "Freeze" Software To Stop Malware

Researchers have devised a way to stop malware on computers, namely the "freezing" of software. Most software for Windows is dependent dynamic-link libraries (DLLs). A DLL is an executable file that is used by programs to share code and other resources required for certain tasks to carry. Windows contains several DLLs with functions and resources needed programs to the Windows environment function.

Since a DLL contains various related code, a program that will make use of it more code into memory than it actually needs.Malware can make use of this extra code if it knows how to use a vulnerability in the application. Researchers Collin Mulliner and Matthias Neugschwandtner invented a tool called Code Freeze a program that analyzes the code exactly you need from a DLL and which part is missing. Then, the tool overwrites the unused DLL code that the program loaded into the computer's memory, so malware can not make use of it.

Overhead

Code Freeze itself is offered as a DLL and would provide little overhead. During a demonstration appeared that Adobe Reader Code Freeze opened a few seconds slower than without the tool was. However, more than half of the DLL code reader loaded in the memory has been switched off, without the impact that this had on the program. An instance of malware which Mulliner had made earlier Adobe Reader still managed to attack, here succeeded after switching Code Freeze no longer.

Because the adjustment of the DLL code occurs in memory and not on the hard disk, both plans would be used as DLL files are not permanently changed. The software has been tested on Windows 8.1 32-bit. Mulliner late Tom's Guide that he wants to offer along with Neugschwandtner Code Freeze to Microsoft. Eventually, the researcher hopes that Microsoft will implement the tool and software developers here will go along. Next month Code Freeze will be discussed at the Black Hat conference demonstrated in Las Vegas.

Blogs And Twitter Users Who Follow The British Secret Service

British intelligence service GCHQ has set up a program to follow discussions of hackers and security experts on Twitter and blogs, according to documents Edward Snowden where The Intercept on message. The list of Twitterers are all kinds of hackers and security experts as well as from anonymous hacktivists and several companies such as Microsoft and the French VUPEN.

The Computer Emergency Response Teams (CERTs) of Finland and the Netherlands are on the list of followed Twitter accounts. In the case of the Netherlands was about GOVCERT that on January 10, 2012 passed in the National Cyber ​​Security Center (NCSC). Since 2012 until today there was once through theGovcert_NL account twittered. All communications which runs through the Twitter account of the NCSC.

However, the document Snowden dates from 2012. It is unclear whether GCHQ eventually @ NCSC account followed.Because of the focus on the list of Twitter accounts where The Intercept on message was there again today fromGovcert_NL a tweet sent in English which warned that the account is no longer in use.

In total, it would GHCQ about 60 blogs and Twitter users use as an information source. The followed blogs are primarily of security, anti-virus companies and security researchers. According GCHQ can be used Twitter to be alerted in real time about new security issues and possible plans of hacktivists. It also appears that the Secret Service was planning to extend monitoring to IRC channels and Pastebin, where more and more information would come from.