Research: Cyber Spies Sloppy Programmers

Groups that advanced persistent threats (APTS) for cyber espionage prove to be sloppy programmers use, says a researcher ( pdf ) of the British anti-virus firm Sophos . The virus fighter compared the malware cybercriminals applied by cyber spies.

Apts are often considered sophisticated attacks, in which attackers long time to access the network from a target managed to obtain. However, the quality of the malware used appears to be disappointing, says researcher Gabor Szappanos. For example, there appeared to be no quality control in the APT-groups. "A big part of their creations is not well tested, and they do not see why some functionality is not working," he tells.

It also appears that ordinary malware writers have more knowledge than the known exploits APT groups. Something which is bad news, because APT groups focusing on specific targets, while the malware from the malware writers has a much greater range. The APT groups do not have extensive skills when it comes to exploits. New exploits are quickly utilized, but it comes to units which have been developed by others or come from Metasploit.

Usually they develop exploits yourself and in the case of other people's exploits are barely changed. Metasploit is a framework that is offered by security firm Rapid7 and allows security professionals to test the security of systems. According Szappanos let his research shows that when security researchers and administrators respond rapidly to undetected leaks, they probably handle this type of APT groups.

"Despite this, the malware writers mentioned in the report should not be underestimated. They develop sophisticated Trojans and know that spread to major organizations. The fact that they are not good with exploits does not mean that they are less dangerous," concludes the researcher.

Researchers Steal Data From Jailbroken iPhone Via Siri

Researchers have developed a way which makes it possible to steal data from infected jailbroken iPhone via the Siri voice control. When users communicate with Siri is processed their voice to data and sent it to Apple, where the voice input is translated into text.

Researchers Luca Caviglione and Wojciech Mazurczy an attack developed Siri which is used to set up a secret channel between an infected machine and a botmaster so they can steal sensitive data like passwords, credit card numbers and Apple IDs. The malware on the device processes the data to an audio clip that is offered to Siri. Siri will then send the data to a remote server. An attacker who has access to network traffic can thus extract the encoded information.

In addition to the requirement that access to the network traffic, the iPhone must be jailbroken, so the researchers in their report to know. By using the "iStegSiri-attack" can be 0.5 bytes sent per second. Sending a credit card number with 16 digits in this way takes about 2 minutes. The researchers say opposite IEEE they especially want to see how their research steganography, hiding information in innocent looking objects such as images, text or sound clips can be used by attackers.