FBI: Wiper Malware Has Korean Language Packs, Hard Coded Targets

chicksdaddy sends news that the FBI has issued a warning to U.S. businesses over a "destructive" malware campaign using advanced tools. They don't name specific targets, but the information fits with the details from last week's attack on Sony Pictures, which led to the leak of several unreleased movies. A copy of the FBI's recent five-page FLASH alert reveals that the malware alleged to have wiped out systems at Sony Pictures Entertainment deployed a number of malicious modules, including a version of a commercial disk wiping tool on target systems. Samples of the malware obtained by the FBI were also found to contain configuration files created on systems configured with Korean language packs. The use of Korean could strengthen theories that the destructive cyber attacks have links to North Korea, though it is hardly conclusive. It does appear that the attack was targeted at a specific organization. The malware analyzed by the FBI contained a hard coded list of IP addresses and computer host names.

Comments

How

[fnj]

WTF, overwrites the MBR? What half assed OS does this attack? Windows?

Re:How

[GameboyRMH]

I think any OS will do it once the attacking program can gain root access, unless MBR protection is enabled in the BIOS.

Re:How

[fisted]

I think any OS will do it once the attacking program can gain root access

Nope, I don't think so. (see securelevel 2)
(and nope, you can't defeat it *that* way. (see RB_HALT)).
It's kind of notable that neither Free- nor OpenBSD seem to support an equivalent to the latter (all three do have the securelevel mechanism, though).

unless MBR protection is enabled in the BIOS

Are you living in a distant past where disk i/o still goes via BIOS?

Re:How

[knorthern knight]

> WTF, overwrites the MBR? What half assed OS does this attack? Windows?

I'm a linux user, not a Microsoft fanboi, but... have you ever heard of fdisk? Or for that matter...

dd if=/dev/zero of=/dev/hda bs=446 count=1

to wipe the MBR. If you want to take out the entire hard drive, it's

dd if=/dev/zero of=/dev/sda bs=1M

Any OS that can be installed from USB key or a CD can do the equivalant of this.

Korea?

[TechyImmigrant]

"Yes Sergey, I have this brilliant plan to compile the production malware on a Korean build of Windows. They'll never suspect it was us."
 

Re:As a malware analyst...

[amicusNYCL]

"Just as likely"? I would imagine that, among all of the versions of Windows that have the Korean language installed, the vast majority of them are being used by Koreans rather than English-speaking Americans.

Re:As a malware analyst...

[kruach aum]

I would also imagine that the kind of person involved in this sort of attack is aware of the capabilities of the people investigating the attack, and that such a person would be interested in confounding that investigation by, say, pretending to be someone he's not, like a Korean language user.

Malware? Sony?

[TechyImmigrant]

Is the irony of Sony being hit by malware lost on people?

http://en.wikipedia.org/wiki/S...

Re:Malware? Sony?

[xxxJonBoyxxx]

>> Is the irony of Sony being hit by malware lost on people?

At Sony, we just call it "software."

Re:And it was signed Kim Jong Un

[DougOtto]

The analysis doesn't blame Korea or anyone else, it's the media taking that route. The analysis just lists the file targets and the information you'd want to see if you have a match; e.g.

File: igfxtrayex.exe
Size: 249856 bytes (244.0 KB)
MD5: 760c35a80d758f032d02cf4db12d3e55
PE Compile Time: 2014-11-24 04:11:08
Language pack of resource section: Korean

It seems sans-bullshit to me.

Ha, NORTH Korea?

[Anonymous Coward]

They have threatened repercussions if Sony releases "The Interview." https://en.wikipedia.org/wiki/The_Interview_(2014_film)

Re:As a malware analyst...

[Spy Handler]

If you're saying it was a false flag operation (trying to make it look like it came from Koreans), it's possible. But who would do that? Normally hackers like to brag and build up their rep. It could be state-sponsored hackers from another country, but then why would China or Iran specifically target Sony Pictures? AFAIK only N. Korea has a beef with Sony.

It's possible but not likely.

Re:Corporate

[TechyImmigrant]

Who said Russian? I know an Israeli called Sergey.

Re:As a malware analyst...

[dunkindave]

I like to apply Occam's Razor. Having dealt with a variety of hackers ranging from newbies up to APT, I have found almost all of them make stupid mistakes and do things like this that leak info. I have yet to see a convincing false-flag since attackers would rather hide their origin than fake it, meaning they try to remove all such info instead of putting in fake info. Given my experience I have no trouble whatsoever believing the indicators of the Korean language pack presence on the origination computers is a strong lead for where it came from. The current beef that NK has against Sony due to the upcoming film, along with they specific threats, just adds to it as corresponding motive, like the cherry on top of the sundae.

None of these are exclusive

[Imazalil]

Could be half Russian half Israeli NSA contractor working in Korea.

Re:Sony chose to wage war against North Korea

[TrollingForHostFiles]

Japan has been a servant state to Israel and the USA since their defeat in WW2.

Yeah, that was pretty clever of the Israelis, taking control of Japan some years before Israel even existed as a state.