Reductor malware hijacks HTTPS traffic

October 2019 Editor's Choice, Cyber Security, News

Kaspersky researchers have discovered new malware that hijacks victims’ interaction with HTTPS web pages via patching the pseudo random number generator used in the process of establishing encrypted communication between the user and the website. Along with the installation of rogue digital certificates it gives the actors the ability to spy on users’ browser activity.

While the “S” in HTTPS stands for “Secure” and infers that information exchanged between a browser and a website is not accessible to third parties, there still are many ways for a skilled high-profile hacking group to interfere in this process. Reductor is a tool developed for such intrusion and was used for cyber-espionage on diplomatic entities in CIS countries, primarily by monitoring their employees' internet traffic. What’s more, the found modules had RAT (remote administration tool) functions and the capabilities of this malware were almost unlimited.

Reductor distributors had two main attack vectors, one of which consisted of having modules downloaded through COMPfun malware, previously attributed to the Turla Russian-speaking threat actor. Another vector seemed to be trickier: apparently the attacker had the opportunity to patch clean software on the fly while it is being downloaded from legitimate websites to users’ computers. The software installers were downloaded from the warez websites which offer free downloads of pirated software. While the original installers available on those websites were not infected, they would end up on the victims’ PCs carrying malware. Kaspersky researchers concluded that replacement happens on the fly and that Reductor’s operators have some control over the target’s network channel.

Once Reductor found its way to the victim’s device, it would manipulate installed digital certificates, patching browsers’ pseudo random number generators used to encrypt the traffic coming from the user to HTTPS websites. To identify victims, whose traffic is hijacked, the criminals would add unique hardware- and software-based identifiers for each of them and mark them with certain numbers in a not-so-random-anymore numbers generator. Once the browser on the infected device is patched, the threat actor receives all information and actions performed with this browser, while the victim remains unsuspecting of anything untoward.

“We haven’t seen malware developers interacting with browser encryption in this way before” comments Kurt Baumgartner, security researcher at Kaspersky’s Global Research and Analysis Team. “It is elegant in a way and allowed attackers to stay well under the radar for a long time. The level of sophistication of the attack method suggests that the creators of Reductor malware are highly professional – which is quite common among nation-state backed actors. However we weren’t able to find solid technical clues which would attach this malware to any known threat actor. We urge all organisations dealing with sensitive data to stay alert and have regular, thorough security checks.”

To avoid being affected by malware, such as Reductor, Kaspersky recommends:

• Performing regular security audit of an organisation’s IT infrastructure.

• Adopting proven security solutions equipped with web threat protection that identifies and blocks threats that attempt to use encrypted channels to penetrate the system undetected like Kaspersky Endpoint Security for Business.

• In addition to adopting essential endpoint protection, implement a corporate-grade security solution that detects advanced threats on the network level at an early stage, such as Kaspersky Anti Targeted Attack Platform.

• Providing your SOC team with access to the latest threat intelligence, to keep up to date with the new and emerging tools, techniques and tactics used by threat actors and cybercriminals.

• Implementing security awareness training sessions for staff so that they will know the risk associated with pirated software and how to distinguish it.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

30% of local consumers still use unsupported operating systems
October 2019, Kaspersky Lab , Home Security
Many consumers and businesses still rely on unsupported or near end-of-life operating systems (OS) which is a security risk, according to Kaspersky research.

Read more...
Kaspersky uncovers zero-day in Chrome
October 2019, Kaspersky Lab , News, Cyber Security
Kaspersky’s automated technologies have detected a new exploited vulnerability in the Google Chrome web browser.

Read more...
A platform approach to innovation and value
CCTV Handbook 2019, Technews Publishing , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Integrated Solutions, IT infrastructure
Moving to the platform model of doing business holds tremendous advantages for end users and smaller developers, but also for the whole technology supply chain.

Read more...
Open does not always mean easy integration
CCTV Handbook 2019, VERACITECH, Technews Publishing , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Integrated Solutions
Customers who opt for best-of-breed solutions will have to rely on their integrators to develop customised integrated solutions for them.

Read more...
The impact of AI on the surveillance industry
CCTV Handbook 2019, G4S South Africa, Hikvision South Africa, Myertal Tactical Security, Technews Publishing , Editor's Choice, CCTV, Surveillance & Remote Monitoring
What the impact of AI will be on companies, the services and solutions they supply, as well as on the jobs people do.

Read more...
Video analytics and AI
CCTV Handbook 2019, Axis Communications SA, Dallmeier Electronic Southern Africa , Hikvision South Africa, Technews Publishing, Dahua Technology South Africa , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Integrated Solutions
Artificial intelligence has the potential to deliver real benefits in the world of video analytics and many companies are already delivering customer benefits.

Read more...
Cloudy with a chance of AI
CCTV Handbook 2019 , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Integrated Solutions
One local company has developed an AI solution that can be added to existing surveillance installations, offering 24-hour intelligence.

Read more...
Security surveillance architecture
CCTV Handbook 2019, Technews Publishing , Editor's Choice, CCTV, Surveillance & Remote Monitoring
IP video surveillance solutions typically have two distinctive surveillance architectures: centralised and distributed. Dean Coleman explains the difference.

Read more...
Selecting the right surveillance storage
CCTV Handbook 2019, Capsule Technologies, Technews Publishing , Editor's Choice, CCTV, Surveillance & Remote Monitoring, IT infrastructure
Storage is an integral part of a surveillance installation and the solution chosen can make or break the success of your project.

Read more...
Cyber-securing your surveillance infrastructure
CCTV Handbook 2019, Genetec, Hikvision South Africa , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Cyber Security
When it comes to cybersecurity, understanding the risks and the solutions as well as engaging in open communication helps everyone.

Read more...