Slashdot Mirror
"Red October" Espionage Malware Campaign Uncovered
L3sPau1 writes "For five years, it hid in the weeds of networks used by Eastern European diplomats, government employees and scientific research organizations, stealing data and infecting more machines in an espionage campaign rivaling Flame and others of its ilk. The campaign, called Rocra or Red October by researchers at Kaspersky Lab, focused not only on workstations, but mobile devices and networking gear to gain a foothold inside strategic organizations. Once inside, attackers pivoted internally and stole everything from files on desktops, smartphones and FTP servers, to email databases using exploits developed in Chinese and Russian malware, Kaspersky researchers said."
It also stole first post! How devious!
You know, I have an idea. We could make a movie based on this, and how they found it. We'll call it, "The Hunt for Red October".
I think the head security researcher should have a Scottish accent.
Most of those IP addresses were in Switzerland, Kazakstan, Greece and Belarus
In other words, it's mostly collecting information from the least-interesting countries in Europe (geopolitically speaking.) One has to assume that the real target(s) are just being drowned out by collateral traffic.
If, and that's a big if, there actually is a defined target.
And have a reliable phone in your toolkit - http://en.wikipedia.org/wiki/Nokia_5110. ...
It has Snake, you know
Its time we started to grill our malware detecors and virus scan makers because somethnig is going very very wrong. This makes the third or fourth MAJOR espionage virus/malware/trojan of a very large size that has been apparently rampaging for years. How can I now trust symantic to find a zero day and protect my systems when they have been unable to find things like red october and flame for years, and they are huge programs!
I am not a big conspiracy theorist, but something is going on here. Why aren't these things being spotted and reported?
Papa Legba come and open the gate
It will get out of hand, and we'll be lucky to live through it.
"The antivirus industry has a dirty little secret: its products are often not very good at stopping viruses."
(The linked New York Times story is a great read.)
I thought everyone knew the U.S. government had cozy relationships with a/v companies. It's one of the reasons I don't bother using any of the commercial packages. There's no point in buying a lock when the people you want to keep out, already have the master key. I think Kaspersky enjoys shaming the American companies...as he should.
You think Microsoft can't create clean code? Maybe you pesky hackers keep finding bugs put there for a reason... Don't think Linux or Mac is excluded, our government participates in many open source projects to make sure their locks get put on the door. The Chinese, Russians, and others all do the same. Unless you've got a lot of time and experience reviewing code, nearly all of our systems are "bugged"....except mine OF COURSE. ;-)
... or just one? Or three? At no point does the article reveal what the target is. IMO, even if this was some universal malware affecting all operating systems known to mankind, it should be indicated. Therefore it is a very crappy article. It would be like saying, "the French are bombing a country". And then going on at length about how the attacks proceed, but never mentioning which damn country. You'd want that information, wouldn't you?
That China is not on the map of infected countries? I mean, this is right up their alley, and It is pretty damn suspicious that there are no (known) infections there.
And it starts with: "Like most of these APT-style targeted attacks, this one begins with a spear phishing message; one example provided was an announcement of a diplomatic car for sale.The email messages contain one of three attachments, each a different exploit of an existing vulnerability. "
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
When I was twelve, I helped my daddy set up an email server in our basement because some fool in China compromised a few diplomats' Gmail accounts. Well, this thing could compromise a coupla hundred accounts in Washington and New York and no one would know anything about it till it was all over.
I assume almost everyone is infected with some type of state sponsored malware.
For those interested:
http://wikileaks.org/the-spyfiles.html
"For five years, it hid in the weeds of networks used by Eastern European diplomats, government employees and scientific research organizations, stealing data and infecting more machines in an espionage campaign rivaling Flame and others of its ilk. The campaign, called Rocra or Red October by researchers at Kaspersky Lab"
...
I call BS on this report
> Want a better method? How about we catalog and fingerprint all programs and processes on our machines
Regrettably fungerprinting (as in hashing) is broken. The US/IL authors of the "Tilded" military espionage cyber platform are so advanced, they falsified an MD5 checksum in an old, but valid (*) Microsoft certificate to elevate its privileges for malicious use in Win7 and Vista. They didn't simply create a random-junk hash collision, but created a cherry-picked one, which was supposed to be borderline impossible.
(*) Yeah, more or less "Return of the Jedi" analogy. Wonder how many bothans were hurt in the making of said franken-cert?
Most experts agree an MD5-crack was utilized so that the powers that be did not need to disclose the funny things they can do with the more up to date tech, like SHA-1 or SHA-256. If you had the same math wizardry and supercomputing prowess at your fingertips, why not cash out the whole Bitcoin configuration space and go party-sailing around the Caribbean, with ladyfolk onboard, for the rest of your life?
Imaging what would happen to whitelisting organizations and vendors, if the powers that be used their tricks to insert false checksums or carefully crafted "evil twin" files for legitimate hashes? Users would quickly lose confidence in the method and revert to good ol' pattern scan antivirus.