Slashdot Mirror
Researchers Crack Open Unusually Advanced Malware that Hid For 5 Years (arstechnica.com)
A malware dubbed ProjectSauron went undetected for five years at a string of organizations, according to security researchers at Kaspersky Lab and Symantec. The malware may have been designed by a state-sponsored group. Researchers say that Project Sauron can disguise itself as benign files and does not operate in predictable ways, making it very tough to detect. Ars Technica reports: Its ability to operate undetected for five years is a testament to its creators, who clearly studied other state-sponsored hacking groups in an attempt to replicate their advances and avoid their mistakes. State-sponsored groups have been responsible for malware like the Stuxnet- or National Security Agency-linked Flame, Duqu, and Regin. Much of ProjectSauron resides solely in computer memory and was written in the form of Binary Large Objects, making it hard to detect using antivirus. Because of the way the software was written, clues left behind by ProjectSauron in so-called software artifacts are unique to each of its targets. That means that clues collected from one infection don't help researchers uncover new infections. Unlike many malware operations that reuse servers, domain names, or IP addresses for command and control channels, the people behind ProjectSauron chose a different one for almost every target.
Or ware?
How does this thing boot strap it's self without leaving traces?
So if you have this "advanced malware" you have no less than 2 spywares because Microsoft products are all US Government spyware.
So when you call it advanced, what is so advanced about it actually?
This is supposed to be some reason to install the latest Windows spyware updates? Stupid if you do.
As an IT guy trying desperately to keep his network clean I have both admiration and trepidation towards the time, money, and thought process to create such a beast. Doesn't matter if state sponsored or not, the team was able to create something that hid for 5 years. Whomever you guys/girls are you have my admiration for your ability.
"The world is changing... I can feel it in the water."
Something has been awoken. It's senses it's time has come.
Microsoft and called Windows 10.
Couple years back I've revived a dead flash drive. I was following instructions I found on YouTube. The whole experience was disconcertingly painless - it was way too easy to reflash the drive with new, manufacturer supplied firmware.
So, may be the reason Symantec/Kaspersky didn't find the method used to jump the airgap is that the penetration code was in a flashdrive's firmware.
Scenario: Internet facing machine got breached by one of gazillion methods. Perpetrators sit there, collect login credentials. Then, one day, someone inserts a flashdrive. Firmware is replaced by attack code that makes the drive represent itself as a keyboard. Flash drive then inserted into an airgapped system...
Other scenarios: Given how much resources attacker has (attacks are waaay too, ahem, tailored), they might have done a postal intercept (NSA style) or even breached the flashdrive manufacturer.
There might be traces of reflashing left. Or it might be that the initial overwrite was destructive and that the poisoned flash drive was declared dead (after being plugged into a couple of other airgapped machines, just to be sure).
So it might be a good idea for Kaspersky to rummage through dead thumbdrives drawer.
Comment removed based on user account deletion
Sometimes I wonder if people understand what they are writing.
I was the one who developed it, but it was only supposed to infect Slashdot network as to snif out who were the Anonymous Coward posters, and if there really was human editors working at slashdot.
STFU and go away!
"Researchers Crack Open Unusually Advanced Malware that Hid For 5 Years", and it was found that internally the authors named it "Windows 10 Extra Telemetry Edition"
Just cruising through this digital world at 33 1/3 rpm...
Has it become slashdot policy to never mention Microsoft Windows in relation to malware.
He's right.
Now consider how lax voting machine security is and the counting software used to collate the vote. We need to go back/stick to 100% paper voting systems.
Given the targets of this hack are Russia, Sweden, Rwanda, Belgium (i.e. EU HQ, previously targets of GCHQ), that's UK or USA. They might be nice about 'state sponsored', but that's the obvious conclusion.
Just because its your side, doesn't mean you are safe.
Imagine an out of control military man, who turned the spooks against his own country... do you think he'd think twice about rigging an American or British election?
I don't. I think its the nature of power hungry people that they seek power by the easiest means possible, and a bit of malware on an electronic vote counting machine is all it would take.
"The world is changing... I can feel it in the water."
Something has been awoken. It's senses it's time has come.
Yes, but hopefully we can fight Trump off for at least 4 more years.