Backdoor targeting Microsoft SQL server

October 2019 Cyber Security

ESET research has just analysed a sample from a new backdoor called ‘skip-2.0’ by its authors. The backdoor is a recently discovered addition to the arsenal of the notorious cyberespionage group Winnti. Specifically, skip-2.0 targets MSSQL Server 12, allowing the attacker to connect to any MSSQL account with a magic password – while automatically hiding these connections from the logs. Such a backdoor could allow an attacker to stealthily copy, modify or delete database content. This could be used, for example, to manipulate in-game currencies for financial gain. The Winnti operators are known to have dabbled maliciously with databases of in-game currencies in the past.

“This backdoor allows the attacker not only to gain persistence in the victim's MSSQL Server through the use of a special password, but also to remain undetected thanks to the multiple log and event publishing mechanisms that are disabled when that password is used,” explains Mathieu Tartare, ESET researcher investigating the Winnti Group. “We tested skip-2.0 against multiple MSSQL Server versions and found that we were able to log in successfully using the special password only with MSSQL Server 12. Even though MSSQL Server 12 is not the most recent version, it is the most common one,” adds Tartare.

ESET has observed multiple similarities between skip-2.0 and other known tools from the Winnti Group’s arsenal, such as a VMProtected launcher, its custom packer, an Inner-Loader injector using the same hooking procedure. “This leads us to think that skip-2.0 is also part of that toolset,” says Tartare.

ESET researchers have been tracking the activities of the Winnti Group for some time. The group has been active since at least 2012 and is held responsible for high-profile supply-chain attacks against the video game and software industry. ESET has recently published a white paper that updates its understanding of the arsenal of the Winnti Group and exposes a previously undocumented backdoor called PortReuse.

The blog post Winnti Group's skip-2.0: a Microsoft SQL Server backdoor (https://www.welivesecurity.com/2019/10/21/winnti-group-skip2.0-microsoft-sql-server-backdoor/) offers technical details describing more functionalities of this backdoor, as well as its similarities to the Winnti Group’s known arsenal – in particular, with the PortReuse and ShadowPad backdoors.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Stolen credentials on the Dark Web
October 2019 , Cyber Security, Security Services & Risk Management
Over 21 million credentials belonging to Fortune 500 companies, 16 million of which were compromised during the last 12 months, are up for sale.

Read more...
Stolen credentials on the Dark Web
October 2019 , Cyber Security, Security Services & Risk Management
Over 21 million credentials belonging to Fortune 500 companies, 16 million of which were compromised during the last 12 months, are up for sale.

Read more...
The importance of XDR for cyber protection
October 2019 , Cyber Security, Products
35% of South African organisations are expecting an imminent cyberattack and a further 31% are bracing for it to happen within a year, according to local research conducted by Trend Micro.

Read more...
Enterprise security must change
October 2019 , Cyber Security, Security Services & Risk Management
The recent wave of cyberattacks against local banks has highlighted the importance of protecting data against malicious users.

Read more...
Kaspersky uncovers zero-day in Chrome
October 2019, Kaspersky Lab , News, Cyber Security
Kaspersky’s automated technologies have detected a new exploited vulnerability in the Google Chrome web browser.

Read more...
Cybersecurity for video surveillance systems
September 2019 , Cyber Security, CCTV, Surveillance & Remote Monitoring
Video surveillance systems are increasingly accessible over any IP network, which has led to the rise of potential cyberattack.

Read more...
Cyber-securing your surveillance infrastructure
CCTV Handbook 2019, Genetec, Hikvision South Africa , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Cyber Security
When it comes to cybersecurity, understanding the risks and the solutions as well as engaging in open communication helps everyone.

Read more...
Cybersecure surveillance partnership
CCTV Handbook 2019, Bosch Building Technologies, Genetec , Cyber Security, CCTV, Surveillance & Remote Monitoring
With Bosch and Genetec, you can feel confident that your data is protected by one of the world?s best security solutions, end to end, day after day.

Read more...
Keeping your things to yourself
October 2019, Technews Publishing , Editor's Choice, Cyber Security, Integrated Solutions, IT infrastructure
Three experts spoke to Hi-Tech Security Solutions to offer advice on keeping your IoT working for you and not for cyber criminals.

Read more...
IoT in security
October 2019, Duxbury Networking, Technews Publishing , Editor's Choice, Cyber Security, Integrated Solutions, IT infrastructure
Using the Internet of Things is not really optional these days, but securing the Internet of Things is compulsory, no matter what industry you operate in.

Read more...