Breaking the chain
September 2017, This Week's Editor's Pick, Cyber Security
Kaspersky Lab experts have discovered a backdoor planted in a server management software product used by hundreds of large businesses around the world. When activated, the backdoor allows attackers to download further malicious modules or steal data. Kaspersky Lab has alerted NetSarang, the vendor of the affected software, and it promptly removed the malicious code and released an update for customers.
ShadowPad is one of the largest known supply-chain attacks. Had it not been detected and patched so quickly, it could potentially have targeted hundreds of organisations worldwide.
In July, 2017 Kaspersky Lab’s Global Research and Analysis (GReAT) team was approached by one of its partners – a financial institution. The organisation’s security specialists were worried about suspicious DNS (domain name server) requests originating on a system involved in the processing of financial transactions. Further investigation showed that the source of these requests was server management software produced by a legitimate company and used by hundreds of customers in industries like financial services, education, telecoms, manufacturing, energy, and transportation. The most worrying finding was the fact that the vendor did not mean for the software to make these requests.
Further Kaspersky Lab analysis showed that the suspicious requests were actually the result of the activity of a malicious module hidden inside a recent version of the legitimate software.
Following the installation of an infected software update, the malicious module would start sending DNS-queries to specific domains (its command and control server) at a frequency of once every eight hours. The request would contain basic information about the victim system (user name, domain name, host name). If the attackers considered the system to be ‘interesting’, the command server would reply and activate a fully-fledged backdoor platform that would silently deploy itself inside the attacked computer. After that, on command from the attackers, the backdoor platform would be able to download and execute further malicious code.
Following the discovery, Kaspersky Lab researchers immediately contacted NetSarang. The company reacted fast and released an updated version of the software without the malicious code.
So far, according to Kaspersky Lab research, the malicious module has been activated in Hong Kong, but it could be lying dormant on many other systems worldwide, especially if the users have not installed the updated version of the affected software.
While analysing the tools techniques and procedures used by the attackers, Kaspersky Lab researchers came to the conclusion that some similarities exist that point to PlugX malware variants used by the Winnti APT, a known Chinese-speaking cyber espionage group. This information, however, is not enough to establish a precise connection to these actors.
“ShadowPad is an example of how dangerous and wide-scale a successful supply-chain attack can be. Given the opportunities for reach and data collection it gives to the attackers, most likely it will be reproduced again and again with some other widely used software component. Luckily NetSarang was fast to react to our notification and released a clean software update, most likely preventing hundreds of data stealing attacks against its clients. However, this case shows that large companies should rely on advanced solutions capable of monitoring network activity and detecting anomalies. This is where you can spot malicious activity even if the attackers were sophisticated enough to hide their malware inside legitimate software,” said Igor Soumenkov, security expert, Global Research and Analysis Team, Kaspersky Lab.
All Kaspersky Lab products detect and protect against the ShadowPad malware as “Backdoor.Win32.ShadowPad.a”. Kaspersky Lab advises users to update immediately to the latest version of the NetSarang software, from which the malicious module has been removed, and to check their systems for signs of DNS queries to unusual domains. A list of the command server domains used by the malicious module can be found in the Securelist blogpost, which also includes further technical information on the backdoor.
For more information visit https://securelist.com/shadowpad/81432/
- Back to the future
September 2017, Adamastor Consulting, This Week's Editor's Pick, Cyber Security, Integrated Solutions, Residential Estate (Industry)
The future is not what it used to be. Rob Anderson looks at estate security in 2027.
- Assessing risks in security technology systems
September 2017, Adamastor Consulting, This Week's Editor's Pick, Security Services & Risk Management, Residential Estate (Industry)
Technology used to mitigate physical risks comes with its own risks that need to be addressed.
- Manage your data appropriately
September 2017, This Week's Editor's Pick, Security Services & Risk Management, Residential Estate (Industry)
Home is where one relaxes and forgets about the stresses and demands of day-to-day life, except if your job is managing an estate and the security of its residents.
- Managing technology risks for effective estate security
September 2017, Technews Publishing, Residential Estate (Industry), Cyber Security, Integrated Solutions, Conferences & Events
Hi-Tech Security Solutions and Rob Anderson hosted the Residential Estate Security Conference 2017 in Johannesburg earlier this year.
- Essential backup power equipment
September 2017, Eurobyte Technology, Legrand Southern Africa, This Week's Editor's Pick, Security Services & Risk Management, Residential Estate (Industry)
Planning for unexpected power outages has become an essential part of any security strategy for residential estates wanting to keep their security running.
- Five safety rules
September 2017, DEHN Africa, This Week's Editor's Pick, Security Services & Risk Management, Residential Estate (Industry)
Working on electrical installations can be dangerous as those that are not properly connected or maintained pose a serious risk to both people and property.
- Deepening the value of surveillance
September 2017, Hikvision South Africa, Residential Estate (Industry), CCTV, Surveillance & Remote Monitoring, Cyber Security
Deep Learning has swept through the IT industry, bringing benefits and better classifications to a number of applications. Now it’s changing security as well.
- Partnering with estates for security success
September 2017, Elf Rentals - Electronic Security Solutions, This Week's Editor's Pick, Perimeter Security, Alarms & Intruder Detection, Integrated Solutions, Residential Estate (Industry)
The team at Elf Rentals considers themselves to be specialist partners in the electronic security sector in terms of the financing, installation and maintenance of security contracts.
- Advances in video analytics
September 2017, Avigilon, Bosch Security Systems, Reditron, Cathexis Technologies, This Week's Editor's Pick, CCTV, Surveillance & Remote Monitoring, Perimeter Security, Alarms & Intruder Detection, Residential Estate (Industry)
Analytics technologies are continually advancing to not only alert to potential threats, but also to reduce the occurrence of false alarms.
- Expect the unexpected
September 2017, This Week's Editor's Pick, Integrated Solutions, Security Services & Risk Management, Residential Estate (Industry)
The scouts’ motto of Be Prepared is probably more suited to those responsible for managing the security of residential estates.
- Remote maintenance is a reality
September 2017, This Week's Editor's Pick, Integrated Solutions, Residential Estate (Industry)
With the Internet of Things (IoT) and artificial intelligence (AI) becoming more accepted in general, remote maintenance has in fact become possible.
- The perimeter and beyond
September 2017, FLIR Systems, Modular Communications, Secu-Systems, This Week's Editor's Pick, Perimeter Security, Alarms & Intruder Detection
No matter how secure you think a particular layer is, there is always someone who will figure out a way past it, which is why we need other layers to deter them from further incursion.