Kaspersky Lab experts have discovered a backdoor planted in a server management software product used by hundreds of large companies around the world. When activated, the backdoor allows attackers to download further malicious modules or steal data.
Kaspersky Lab has alerted NetSarang, the vendor of the affected software, and it has promptly removed the malicious code and released an update for customers .
ShadowPad is one of the largest known supply-chain attacks. Had het niet zo gedetecteerd en patched zo snel, zou het mogelijk kunnen hebben gericht honderden organisaties wereldwijd.
In July, 2017 Kaspersky Lab’s Global Research and Analysis (GReAT) team was approached by one of its partners – a financial institution. De organisaties beveiligingsspecialisten waren bezorgd over verdachte DNS (domeinnaam server) verzoeken die op een systeem betrokken waren bij de verwerking van financiële transacties.
Videreundersøgelse viste at kilden til disse forespørsler var serveradministrationsprogrammer produceret af et legitimt firma og anvendt af hundredvis af kunder i brancher som finansielle tjenesteydelser, uddannelse, telekommunikation, produktion, energi og transport. Den mest bekymrende konstateringen var at faktoren ikke gjorde at programvaren skulle gøre disse anmodninger.
Further Kaspersky Lab analysis showed that the suspicious requests were actually the result of the activity of a malicious module hidden inside a recent version of the legitimate software.
Efter den installation av en infected softwareopdatering, ville den skadelige modul starte DNS-forespørgsler til bestemte domæner (dens kommando- og kontrolserver) ved en frekvens på en gang hver otte timer. Den forespørgsel ville indeholde grundlæggende oplysninger om det offersystem (brugernavn, domænenavn, hostnavn).
Hvis de angripere vurderte at systemet skulle være « interessant », ville kommandoserveren svare og aktivere et fuldt fledged backdoor-platform som ville stille implementere sig selv i den angrebne computer. After that, on command from the attackers, the backdoor platform would be able to download and execute further malicious code.
Following the discovery, Kaspersky Lab researchers immediately contacted NetSarang. The company reacted fast and released an updated version of the software without the malicious code.
So far, according to Kaspersky Lab research, the malicious module has been activated in Hong Kong, but it could be lying dormant on many other systems worldwide, especially if the users have not installed the updated version of the affected software.
Kaspersky Lab’s forskere kom til at konkludere at de samme teknikker og procedurer er anvendt ved at angriperne, og at noen likheter eksisterer, som peker på PlugX malwarevarianter, som blev brukt av Winnti APT, en kendt kinesisk-språket cyberespionage-gruppe. Disse oplysninger er imidlertid ikke nok til at etablere en præcis forbindelse til disse aktører.
« ShadowPad is an example of how dangerous and wide-scale a successful supply-chain attack can be. Giving the opportunities for reach and data collection it gives to the attackers, most likely it will be reproduced again and again with some other widely used software component. Luckily NetSarang was fast to react to our notification and released a clean software update, most likely to prevent hundreds of data stealing attacks against its clients. Men, dette tilfellet viser at store firmaer bør stole på avancerede løsninger som er i stand til å overvåke nettverksaktivitet og oppdage anomalier. This is where you can spot malicious activity, even if the attackers were sophisticated enough to hide their malware inside legitimate software, « said Igor Soumenkov, security expert, Global Research and Analysis Team, Kaspersky Lab.
« For å bekæmpe det stadig skiftende landskapet av cyberattacks, NetSarang har infört forskellige metoder og foranstaltninger for at forhindre at vores linje eller produkter bliver kompromitteret, inficeret eller brugt af cyberespionagegrupper. Regretfully, the Build release of our full line of products on July 18th, 2017 was unknowingly shipped with a backdoor which had the potential to be exploited by its creator.
Sikkerheten hos vores kunder og brugerbase er vores højeste prioritet og i sidste ende, vores ansvar. Det faktum at skadelige grupper og enheder er utiliterende kommersiell og legitim programvare for ulovlig gevinst er en stadig voksende bekymring, og en som NetSarang, så vel som andre i dataprogramvareindustrien, tar svært alvorlig.
NetSarang is committed to its users’ privacy and has incorporated a more robust system to ensure that never again will a compromised product be delivered to its users. NetSarang will continue to evaluate and improve our security, not only to combat the efforts of cyber spying groups around the world but also to regain the trust of its loyal user base. «
All Kaspersky Lab products detect and protect against the ShadowPad malware as « Backdoor [dot] Win32 [dot] ShadowPad [dot] a ».
Kaspersky Lab advises users to update immediately to the latest version of the NetSarang software, from which the malicious module has been removed, and to check their systems for signs of DNS queries to unusual domains.
A list of the command server domains used by the malicious module can be found in the Securelist blog post, which also includes further technical information on the backdoor.
With Kaspersky
