Slashdot Mirror
Sykipot Trojan Variant Stealing DoD Smartcard Credentials
Trailrunner7 writes "A new research report says variants of the Sykipot Trojan have been found that can steal Dept. of Defense smartcard credentials. The research, published in a blog post Thursday, is the latest by Alien Vault to look at Sykipot, a Trojan horse program known to be used in targeted attacks against the defense industry. The new variants, which Alien Vault believes have been circulating since March, 2011, have been used in 'dozens of attacks' and contain features that would allow remote attackers to steal smart card credentials and access sensitive information."
Those cards are heavily used. It's not like this would only impact e-mail, the cards are pretty much used for everything.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
There is a trojan within the trojan to guide the black helicopters to your home. In fact I risk the BSOD just posting this.
This is an attack vector that I have worried about with smartcards. The trojan captures the PIN for the card and then uses the card to perform various protected operations.
Technically the secret keys and such are not compromised but as long as the card is inserted then the trojan can use it to do stuff.
I have long argued that smartcards need a built-in pin-pad right on the card itself. Although it wouldn't stop every attack it would prevent man-in-the-middle attacks used to capture the PIN.
Per the Article:
>> The Trojan is delivered to target systems in a corrupted PDF attached to spear-phishing e-mail messages. The PDFs exploited a previously unknown software vulnerability in the Adobe Reader program, the company said.
There may be a new variant, but this approach and using ActivClient have been around. Some may suggest this is the reason some government agencies have ensured Windows won't need 3rd party applications and can perform this function natively.
Except in China where there is no 13th of any month. Bet you didn't know that !!
Authentication 101: Something you have and something you know. I've only read the summary, but if these copied credentials ("something you had") can be used to access sensitive resources remotely, then it would seem that "something you know" is something DoD didn't know.
Thank you, Edward Snowden.
"Arguments from authority are worthless." —Carl Sagan
Does it really matter the smart card was attacked? If the machine is compromised to begin with anything you or your computer does with your credentials is compromised anyway.
According to TFA attacker still can only do anything while card is in compromised computers reader. What has failed?
The trojan steals "use" of the inserted card, and probably the PIN. The private key remains safely in the card, and the trojan can't use it once the card is removed. The defenses are (1) don't use smart card on untrusted computer, or (2) if no other choice, use smart card only long enough to accomplish a specific task. The smart card PIN can be changed by the user, so it may not even be necessary to revoke the credential after an exposure. However, the trojan also gains temporary use of the card holder's digital signature -- meaning that authentic digitally-signed spear phishing emails could be sent under the card-holder's email account. If the card is inserted but the PIN is never entered, then a trojan might maliciously enter several random PINs and block the card as a DoS attack...
It's not just you. I've noticed it as well. Fillable PDFs are of the good, but why do I need 'adobe echosign' when my work already issues digital certificates, a 'convert to PDF' when it's already a PDF, etc..?
I don't read AC A human right
And was reported during the prototyping phase.
The CAC is no better than a simple password (the PIN). Once that has been taken, the CAC can be used for anything as long as it is plugged in.
http://www.spi.dod.mil/lipose.htm
Your taxes paid for it and it's a free download. Grab a copy and check it out. Saves buckets of money in license fees compared to a PE-ish live CD, and won't run Windows malware.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Here is more detail on the attack:
Smartcard access
The rst one is that it creates a new thread with a keylogger routine. The code is very basic, it stores the window name and the keys pressed under a le named MSF5F0.dat on an unencrypted format, example:
Title:Internet Explorer
www.google.es
Title:My Computer
It uses the WIN32 APIs functions [GetKeyState, GetAsyncKeyState, GetForegroundWindow, GetWindowTextA].