Tuesday, September 02, 2014
Search
  
Submit your own News for
inclusion in our Site.
Click here...
Breaking News
webOS Is Still Alive With LuneOS ROM Release for Android, webOS Devices
AMD Launches AMD Radeon R9 285 Graphics, "Never Settle: Space Edition" Game Bundle
AMD Introduces New 8-core FX-series Processors
New Philips Hue Beyond Combines Functionality And Ambient Lighting for Home
LG and Samsung Add Swarovski Crystals on Their Products
Pioneer DDJ-WeGO3 Allows You To Mix Tracks from Spotify or iTunes
Apple's iCloud Could Have Allowed Celebrity Nude-Photo Leak
Google To Launch New Budget Phone In India
Active Discussions
help questions structure DVDR
Made video, won't play back easily
Questions durability monitor LCD
Questions fungus CD/DVD Media, Some expert engineer in optical media can help me?
CD, DVD and Blu-ray burning for Android in development
IBM supercharges Power servers with graphics chips
Werner Vogels: four cloud computing trends for 2014
Video editing software.
 Home > News > General Computing > Kaspers...
Last 7 Days News : SU MO TU WE TH FR SA All News

Monday, February 10, 2014
Kaspersky Lab Uncovers "The Mask" Cyber Spying Campaign


A group of high-level attackers has been targeting government embassies, diplomatic offices and energy companies with a cyber-espionage campaign for more than five years that researchers say is the most sophisticated APT operation they've seen to date.

The attack, dubbed the 'Mask,' includes a number of unique components and functionality and the group behind it has been stealing sensitive data such as encryption and SSH keys and wiping and deleting other data on targeted machines,according to researchers at Kaspersky Lab.

The Mask APT campaign has been going on since at least 2007 it doesn't appear to have any connection to China. Researchers say that the attackers behind the Mask are Spanish-speaking and have gone after targets in more than 30 countries around the world. Many, but not all, of the victims are in Spanish-speaking countries, and researchers at Kaspersky Lab, who uncovered the campaign, said that the attackers had at least one zero-day in their arsenal, along with versions of the Mask malware for Mac OS X, Linux, and perhaps even iOS and Android.

"These guys are better than the Flame APT group because of the way that they managed their infrastructure," said Costin Raiu, head of the Global Research Analysis Team at Kaspersky. "The speed and professionalism is beyond that of Flame or anything else that we've seen so far."

Raiu revealed the details of the Mask attack campaign during the Kaspersky Security Analyst Summit on Monday.

Kaspersky researchers first became aware of the Mask APT group because they saw the attackers exploiting a vulnerability in one of the company's products. The attackers found a bug in an older version of a Kaspersky product, which has been patched for several years, and were using the vulnerability as part of their method for hiding on compromised machines. Raiu said that the attackers had a number of different tools at their disposal, including implants that enabled them to maintain persistence on victims' machines, intercept all TCP and UDP communications in real time and remain invisible on the compromised machine. Raiu said all of the communications between victims and the C&C servers were encrypted.

The attackers targeted victims with spear-phishing emails that would lead them to a malicious Web site where the exploits were hosted. There were a number of exploits on the site and they were only accessible through the direct links the attackers sent the victims. One of the exploits the attackers used was for CVE-2012-0773, an Adobe Flash vulnerability that was discovered by researchers at VUPEN, the French firm that sells exploits and vulnerability information to private customers. The Flash bug was an especially valuable one, as it could be used to bypass the sandbox in the Chrome browser. Raiu said the exploit for this Flash bug never leaked publicly.

While most APT campaigns tend to target Windows machines, the Mask attackers also were interested in compromising OS X and Linux machines, as well as some mobile platforms. Kaspersky researchers found Windows and OS X samples and some indications of a Linux versions, but don't have a Linux sample. There also is some evidence that there may be versions for both iOS and Android. Raiu said there was one victim in Morocco who was communicating with the C&C infrastructure over 3G.

Kaspersky researchers have sinkholed about 90 of the C&C domains the attackers were using, and the operation was shut down last week within a few hours of a short blog post the researchers published with a few details of the Mask campaign. Raiu said that after the post was published, the Mask operators rolled up their campaign within about four hours.

However, Raiu said that the attackers could resurrect the operation without much trouble.

"They could come back very quickly if they wanted," he said.




Previous
Next
Apple iTunes Radio Coming To Australia        All News        Intel Develops Very Low Power Graphics Core For Mobiles, Tablets
Apple iTunes Radio Coming To Australia     General Computing News      Home 3D Printers Could Drive Significant Market Revenues

Get RSS feed Easy Print E-Mail this Message

Related News
Health Data Stolen in Cyber Attack from China
Hackers Stole Over 1 Billion Records
Hackers Can Use USB Devices in Attacks
U.S. Arrests Russian Accused Of Hacking Retail Systems
Montana State Says 1.3 Million Records Exposed in Data Breach
Hackers Used YouTube To Sell Stolen Credit Card Data
UK's GCHQ To Share Data With Firms
Hackers Attack Dominos Pizza, Steal Customers' Data
Iranian Hackers Use Fake Social Media Accounts To Spy
Spotify's Servers Hacked
AVAST Forum Hacked
eBay Asks Users To Change Passwords

Most Popular News
 
Home | News | All News | Reviews | Articles | Guides | Download | Expert Area | Forum | Site Info
Site best viewed at 1024x768+ - CDRINFO.COM 1998-2014 - All rights reserved -
Privacy policy - Contact Us .