Courcy's Future Threats - 12 February 2013

Researchers from Russian security firm have revealed that a major data-stealing cyber attack may have been underway, undetected, since 2007.

The malware appears to have targeted government institutions such as embassies, nuclear research centres and oil and gas institutes.

The malicious program is highly sophisticated, and is designed to steal encrypted files. It can even recover files that have been deleted.

Describing the discovery as “very significant”, Professor Alan Woodward, from the University of Surrey, suggested that this attack may be target at specific information, rather than just trawling for available data.

Professor Woodward said “It appears to be trying to suck up all the usual things - word documents, PDFs, all the things you’d expect. “But a couple of the file extensions it’s going after are very specific encrypted files.”

A statement from Kaspersky Labs confirmed this assessment, and also suggested that although some countries have been hit harder than others, many nations have had data stolen.

“The primary focus of this campaign targets countries in Eastern Europe, former USSR Republics, and countries in Central Asia, although victims can be found everywhere, including Western Europe and North America.

“The main objective of the attackers was to gather sensitive documents from the compromised organisations, which included geopolitical intelligence, credentials to access classified computer systems, and data from personal mobile devices and network equipment.”

In an interview with the UK’s BBC, Kaspersky’s chief researcher Vitaly Kamluk suggested that the attacks were not random, but that victims were carefully selected.

“It was discovered in October last year,” Mr Kamluk said. “We initiated our checks and quite quickly understood that is this a massive cyber attack campaign.

“There were a quite limited set of targets that were affected - they were carefully selected. They seem to be related to some high-profile organisations.”

Red October is similar in construction to Flame, a piece of malware also discovered by Kaspersky, on 28 May 2012.

Both Flame and Red October are made up of several distinct modules, each with a set objective or function.

• Flame

In 2012 Kaspersky revealed the existence of an all-in-one “worm, trojan and backdoor”, which it dubbed Flame. It is a remotely reprogrammable data stealer that can seize, transmit and then delete files. Its six megabyte core can download extra modules until it swells to 20 MB. The cyberweapon, which it can quite justifiably be called, is remarkably versatile. It can steal huge amounts of data and transmit them back to its creator, and it can delete information from infected computers. It is not yet known what Flame’s full range of tricks is, but it can do a lot more than just steal data; it can manipulate hardware. Security firm Symantec demonstrated that Flame can be used to turn on microphones and webcams attached to infected systems, record audio and video files, and monitor screen activity. The usefulness of this kind of tool to intelligence organisations hardly needs discussing.

Flame’s greatest strength so far has been its stealth. The country hit hardest (as far as we know) is Iran, whose national Computer Emergency Response Team revealed the code’s malicious components were undetectable by 43 antivirus programs. An official statement indicated that Flame was the cause of incidents of mass data loss in Iran, particularly linked to the oil industry.

Cryptofiler

Discussing the make-up of Red October, Kamluk said “There is a special module for recovering deleted files from USB sticks. It monitors when a USB stick is plugged in, and it will try to undelete files. We haven’t seen anything like that in a malware before.”

A further unique property of Red October, according to Professor Woodward, is its extreme stealth. Specifically, it is able to hide on a machine as if deleted.

“If it’s discovered, it hides,” he said. “When everyone thinks the coast is clear, you just send an email and ‘boof’ it’s back and active again.”

Some of the most notable modules in Red October are ones that specifically target files encrypted using a system known as Cryptofiler.

Cryptofiler, while less common now, is an encryption standard that used to be in widespread use by intelligence agencies. Although it has been surpassed by more sophisticated encryption and is no longer used for extremely sensitive documents, it is still used by the organisations such as Nato and the EU for protecting privacy and other information that could be valuable to hackers.

Professor Woodward pointed out that the fact that Red October is particularly searching for Cryptofiler files it means that whoever the attackers are they may have discovered a way to break this encryption.

Origins

There are clues as to the origin of this malware hidden in the code, but these must be taken with a pinch of salt. As Professor Woodward has pointed out, these crumbs can be false clues planted by the programmers to confuse analysts, or send them in the wrong direction.

Nevertheless, early analysis suggests the malware originated in Russia.

Mr Kamluk said the code was littered with broken, Russian-influenced English.

“We’ve seen use of the word ‘proga’ - a slang word common among Russians which means program or application. It’s not used in any other language as far as we know.”

Kaspersky’s research indicated there were 55,000 connection targets within 250 different IP addresses. In simpler terms, this means that large numbers of computers were infected in single locations - possibly government buildings or facilities.

Methodology

Kaspersky have noted that the earliest evidence indicates that what they are terming this ‘cyber-espionage campaign’ has been active since 2007 and is still active now, despite its discovery. The network is well disguised and, as such, difficult to analyse. The command and control (C&C) infrastructure is actually a long chain of servers working as proxies and hiding the location of the ‘mothership’ control server.

Despite the sophistication of Red October, the initial phases of the attacks are surprisingly traditional (in cyber threat terms). They begin with what Kaspersky call a “classical scenario” of specific targeted attacks, consisting of two stages. First is the initial infection. Once this has happened additional modules are then deployed for intelligence gathering

The malicious code is delivered to the target system via e-mail as attachments (Microsoft Excel and Word documents, and in all probability PDFs) which are contain hidden exploit code for known security vulnerabilities in Word applications and PDF readers. In addition to Office documents, it appears that the attackers can also infiltrate some victims’ networks using a particular Java vulnerability known as the ‘Rhino’ exploit.

When the victim opens the malicious document or visits a malicious URL on a vulnerable system the embedded code initiates the setup of the main component which in turn handles further communication with the C&C server.

The infected system then receives a number of additional spy modules from the C&C server, including modules that can infect smartphones.

The primary purpose of the spying modules is to steal information. While stealing data is not a new phenomenon for cyber criminals, the discovery of both Flame and Red October suggest a new paradigm in cyber crime. As long as the target system has a periodic connection to the internet, highly sophisticated malware can be used to obtain reams of sensitive information. Previously, cyber criminals were constrained by the fact that malicious software had to be self-contained. This made it difficult to infect some systems with sophisticated malicious software; someone downloading a file with malicious code embedded would be suspicious of the large file size.

Now, size is not a problem. The only code that needs to be in the initial infected file is the setup module, which will download other modules to the system as required at a later date.

The fact that modules have been found that allow the malicious software to hide as if deleted suggests that from now on, no organisation can be completely sure it is not infected. Just because the system looks clean, it does not mean it is.

• Red October: Key facts

Red October is said to be one of the most significant attacks ever to be discovered:

• It has been operating unchecked since 2007.
• Attackers created more than 60 domain names to run the attack, based mostly in Germany and Russia.
• Although the virus can collect a wide range of document types, it specifically targets ‘Cryptofiler’ files - an encryption technique used by organisations like Nato and the EU.
• Most infection connections were found coming from Switzerland, followed by Kazakhstan and Greece.
• Intended targets received personalised correspondence based on gathered intelligence on individual people.
• Unlike the high-profile malware Stuxnet, Red October is not believed to have caused any physical damage to infrastructure, concentrating solely on stealing information.

Source: Kaspersky Labs