Eastern European Banks Were Attacked Via Backdoors Directly Connected To Local Networks, Report Finds (securelist.com)

An anonymous reader writes: Karspesky security researcher Sergey Golovanov writes about recent cybertheft incidents involving hardware backdoors planted by criminals. Each attack had a common springboard: an unknown device directly connected to the company's local network. In some cases, it was the central office, in others a regional office, sometimes located in another country. At least eight banks in Eastern Europe were the targets of the attacks, which caused damage estimated in the tens of millions of dollars. Hardware backdoors are cheap and immune to antivirus. A firmware modified OpenWrt based router can provide covert remote access, painless packet captures, and secure VPN connections with the flip of a switch. Will a flashlight and a ladder be common tools of computer security someday? After the cybercriminals entered a organization's building, connected a device to the local network and scanned the local network seeking to gain access to the resources, they proceeded to stage three. "Here they logged into the target system and used remote access software to retain access," writes Golovanov. "Next, malicious services created using msfvenom were started on the compromised computer. Because the hackers used fileless attacks (PDF) and PowerShell, they were able to avoid whitelisting technologies and domain policies. If they encountered a whitelisting that could not be bypassed, or PowerShell was blocked on the target computer, the cybercriminals used impacket, and winexesvc.exe or psexec.exe to run executable files remotely."

Comments

It does seem like VPN's are a widespread now...

[SuperKendall]

I totally understand why a company would want to put all remote offices into a private company VPN, but it sure seems like it opens them up to physical attacks like this in a way they would not be otherwise... maybe companies should work harder to make everything a worker needs accessible via the internet at large and have a more protected domain that is harder to attack - physical as well as network-wise.

That would help improve the life of remote workers also, as a happy byproduct.

Re:It does seem like VPN's are a widespread now...

[kiviQr]

Better question is why they are on the same network. Office and bank networks should have been separated.

Re:It does seem like VPN's are a widespread now...

[turbidostato]

"I totally understand why a company would want to put all remote offices into a private company VPN"

But the key of this attack was not VPN, the general concept. It was physical access coupled to "... malicious services created using msfvenom [...] If they encountered a whitelisting that could not be bypassed, or PowerShell was blocked on the target computer, the cybercriminals used impacket, and winexesvc.exe or psexec.exe to run executable files remotely."

Or, in other words, another Windows-vector attack.

I also totally understand why a company would want to put all remote offices into a private company VPN (which doesn't preclude to be properly segmented). What it's totally incomprehensible is why they insist in using Windows.

You mean anyone can connect to the network?

[bobstreo]

Security 101, deny unauthorized hardware from connecting to the local network, either hardwired or via WIFI. Especially when having anything to do with banks. Going cheap never works well with networking that should be "secure".

Switches and access points are pretty trivial to setup to deny access.

LAN inhibits strong security

[SuperKendall]

The point is, you can't trust something just because it is on the LAN.

I agree but how long does that ever really hold in any large company?

Over time a LOT of stuff will grow in any company to lazily trust the LAN, or at least they sure will not think about attacks from that vector nearly as hard as the firewall guys.

If you have to make those things open to outside use the whole chain gets a lot more thought applied as to access security. Otherwise server after server gets thrown up with minimal access protection because it is already "protected" by the company firewall.

You can't just wave your hands and say you need to understand you shouldn't trust something just because it's within the LAN, because that ignores how people behave in reality over time. No security team at any company has enough power or funds or people to actually enforce that idea.

If you think about it, yes

[SuperKendall]

I realize I probably didn't make that quite clear enough for the syrupy mind of an AC - so I will explain...

I'm talking about cases where whole remote offices are set up on a VPN. Offer easier to get into satellite offices than main HQ, and not nearly as carefully monitored. Then you have access to the internal network if you leave something attached to any one of a number of hardwired ports probably laying about, near a plug...

It was already on the "Cloud"...

[SuperKendall]

So to recap, your excuse for not having proper local basic security hardware audits is.

When did that go away? You still need to do that anyway.

to put that in the cloud?

Um - I realize being an AC you may not quite understand this, but "the cloud" is just servers. Anything I was talking about is servers, so it's already on "the cloud" regardless of what I am suggesting - I'm merely talking about enabling access to servers (which again were always there being servers) outside the firewall, rather than presuming people on the VPN should get in more easily.

There was one company I was at that took it a bit too far the other way though - they actually had some servers I could *only* access when not on the company VPN! Now that was interesting, but I think too far.