Slashdot Mirror
Cyberespionage Group Adds Disk Wiper and SSH Backdoor To Its Arsenal (csoonline.com)
itwbennett writes: A cyberespionage group known in the security community as Sandworm or BlackEnergy, after its primary malware tool, has recently updated its arsenal with a destructive data-wiping component and a backdoored SSH server. On the eve of Dec. 23, a large area in the Ivano-Frankivsk district in Ukraine suffered a power outage. Ukrainian news service TSN reported that the outage was caused by a virus that disconnected electrical substations. Researchers from antivirus vendor ESET believe that this attack was performed with the BlackEnergy malware and that it wasn't the only one. 'As well as being able to delete system files to make the system unbootable — functionality typical for such destructive trojans — the KillDisk variant detected in the electricity distribution companies also appears to contain some additional functionality specifically intended to sabotage industrial systems,' the ESET researchers said in a blog post.
stuxnet was typical short sighted policy from usa/isreali establishment. they should have known that such weapons do more damage to the more technologically advanced nations than those less advanced.
now suffer the consequences of there being no longer a moral high ground for anyone in west(which being democratic means sins of government cannot be transfered to few dictators/elite) with regard to these. all things allowed.
On the eve of Dec. 23,
Or, as those of us who aren't from the 17th century would say, December 22.
AntiFA: An abbreviation for Anti First Amendment.
is that, in some cases, once you attack a target you leave behind the weapon you used; so that the target can repurpose it to launch a strike against who they perceive as the perpetrator of the attack. While that would require some sophistication on the target's part, it would not surprise me to see someone launch an counter strike using the original weapon; the challenge being determining who launched the initial attack. Of course, some targets may not worry too much about verifying the source but simply retaliating against a non or perceived enemy.
I'm a consultant - I convert gibberish into cash-flow.
"...district in Ukraine suffered a power outage."
This wouldn't be Russia's 'deniable' response to Ukraine cutting electricity to Crimea...?
blindly antisocialist = antisocial
did it enter the grid.
That we don't bomb ourselves back into the stone age, but just turn off our technology remotely.
This thing is actually pretty neat. It installs itself when SndVol.exe runs because there's a backwards-compatibility thing in Windows that elevates that "safe" executable (around UAC), and SndVol.exe is then used to execute the "arbitrary code" that gets the ball rolling.
(https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf - Page 8)
I'm still struggling to understand why critical infrastructure control systems like generation and grid control would not be air-gapped from the rest of the planet.
I wonder if this event will cause them to re-architect their network, or if they'll simply add MalwareBytes to their AVG Free "protected" computers.
Could I gently point out that Dropbear is not, per se, a "trojaned ssh server". It is just a small opensource sshd implementation that is used for embedded applications, including things such as OpenWrt routers.
Could I gently point out that Dropbear is not, per se, a "trojaned ssh server". It is just a small opensource sshd implementation that is used for embedded applications, including things such as OpenWrt routers.
The sentence from the article was "Another recent addition to the group's arsenal is a backdoored version of a SSH server called Dropbear."
This is ambigous. It could be read either as "(a backdoored version of a SSH server) (called Dropbear)" or "(a backdoored version of) (a SSH server called Dropbear)".
That is, it's not clear whether the SSH server is called Dropbear, and it has been backdoored, or whether it is the backdoored version that is called Dropbear.
Nice one, linking to a PDF in a story about malware.
Very droll.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
I wonder which country's grid will be subject to the next attack.
How did it enter the grid.
I agree with this statement.
For those looking for some more info on the attack you can find it here. It is basically what some investigators have uncovered thus far and as a bonus it isn't in Ukrainian.
Time to offend someone
I've worked with a coupe of U.S. utility companies. One small cooperative and another much larger utility.
In both cases, generation and switching(grid) equipment were on their own private network. That network spanned the entirety of their infrastructure thanks to their own fiber plant running everywhere on their own poles. The entire infrastructure could be managed form any of their facilities, as you would expect with a network, but there was no Layer2 or 3 connection between that management network and the ultimately internet connected corporate network that handled back office, accounting/billing, email, web...
It was impossible to switch the grid or impact generation from the internet or corporate network.
When you're already blanketing an area with poles and cables, it's virtually no additional cost to include fiber and copper communication cables. Cost is not even remotely viable as an excuse for connecting the grid o the internet.
P.S. The fiber plant is a profit center thanks to the leasing of fiber pairs and lambdas.