Securelist

>Authors GReAT >Global Research & Analysis Team, Kaspersky Lab https://securelist.com/author/great/ The article is apparently authored by malware analysis team from Kaspersky Lab, so they are probably quite good at reverse engineering binaries.

Yesterday, https://securelist.com/modern-asia-apt-groups-ttp/111009/ > In this report, we share the most valuable intelligence that we gathered on Asian APT groups. Over the course of our work, we noticed that these groups attacked the greatest number of countries and industries. Most importantly, our analysis of hundreds of attacks revealed a similar pattern among various groups. They achieve specific objectives at various stages of the Cyber Kill Chain using a common but limited number of techniques encountered by security professionals all over the world. Unfortunately, security teams often have difficulty detecting these attacks in their own infrastructure.

> These groups' activity has been publicly tracked as Operation Dream Job and Operation AppleJeus. Following those links yield these two documents, which both have "Attribution" sections. Presumably some of these tell-tale signs were identified in the ongoing exploitation. https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campa… https://securelist.com/operation-applejeus/87553/#attribution

Does https://googleprojectzero.blogspot.com or Kaspersky's secure blog count? https://securelist.com/

Private companies like Crowdstrike would probably love to reveal their analysis however they would be restricted by the actual data owners (e.g. the DNC) and I would guess ongoing government investigations. Plus why blow all of your signatures when they still work? Outside of that, there's tons of data online already regarding Russian government hacking activity: http://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-a… https://www.fireeye.com/content/dam/fireeye-www/global/en/current-thre… https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profil… http://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komp… Do you think understanding the tools, infrastructure, coding styles, activities, targets of these groups allows them to perform attribution?

It's kind of cute how the technical report[1] goes to great lengths to finger Israel, without explicitly stating it (see page 43). [1] https://securelist.com/files/2015/06/The_Mystery_of_Duqu_2_0_a_sophist…

some more interesting details about exploit: https://securelist.com/blog/research/68877/equation-group-from-houston…

Reading http://www.securelist.com/en/analysis/204792250/IT_Threat_Evolution_Q3… I find it surprising that the Netherlands manages to be the best malware exporter in the world (third in 'production', close behind Russia and the USA (both with a much larger population), but also in the top 10 for 'least consumption', a list that neither Russia nor the USA made). Does anybody have any idea how that comes about? The only reason I can think of is that Amsterdam is a huge node in the Internet backbone (http://en.wikipedia.org/wiki/Amsterdam_Internet_Exchange). Malware authors might want to host their stuff close to such nodes, so that they can distribute their wares efficiently.

The SecureList summary was much more detailed: http://www.securelist.com/en/blog/208193558/Gadget_in_the_middle_Flame… Flame took advantage of WPAD, a little-known magical hostname (http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol) to do MITM attacks on the Windows Update servers. Flame then installed 'WuSetupV.exe' with the description "Desktop Gadget Platform" "Allows you to display gadgets on your desktop". What's amazing is that Windows Update doesn't require explicit validation of an update-only certificate chain. It seems like any certificate from the Microsoft root can certify updates (!).

>if you released a vulnerable piece of hardware, SOMEONE SOMEWHERE will notice But is that someone somewhere only part of the NSA or its Chinese equivalent? It makes me think of the TriangleDB iPhone exploit. I don't think anyone could have realistically known that those MMIO opcodes were there, without being part of the actual CPU design team. https://securelist.com/operation-triangulation-the-last-hardware-myste… >The exploit targets Apple A12–A16 Bionic SoCs, targeting unknown MMIO blocks of registers that are located at the following addresses: 0x206040000, 0x206140000, and 0x206150000. >The prompted me to try something. I checked different device tree files for different devices and different firmware files: no luck. I checked publicly available source code: no luck. I checked the kernel images, kernel extensions, iboot, and coprocessor firmware in search of a direct reference to these addresses: nothing. >How could it be that that the exploit used MMIOs that were not used by the firmware? How did the attackers find out about them? What peripheral device(s) do these MMIO addresses belong to I believe it's very easy nowadays to release undetectably vulnerable devices.

It's so bad that even some intelligence agency-developed malware gets busted (in part) due to leaky paths and other strings in binaries' metadata. Here's a leaked CIA Wiki/CMS thread from 2015 discussing some of the fuckups found by Kaspersky in NSA ("Equation Group") malware binaries: https://wikileaks.org/ciav7p1/cms/page_14588809.html >This is PDB string, right? The PDB path should ALWAYS be stripped (I speak from experience. Ask me about Blackstone some time.). For Visual Studio user mode stuff, the /DEBUG linker switch should NOT be used. For drivers, it's a bit harder to avoid it, but a post-build step using binplace will strip the path information. >For other strings generally, yeah, search the binary for them. Don't use internal tool names in your code. Examples from Kaspersky's report (https://securelist.com/files/2015/02/Equation_group_questions_and_answ… >"Timeout waiting for the “canInstallNow” event from the implant-specific EXE!" "Implant" is NSA lingo for "persistent malware". Probably best not to include routines for helpful error messages in your production-build nation-state malware code. >"Manual/DRINKPARSLEY/2008-09-30/10:06:46.468-04:00" Conspicuous all-caps NSA codename. >"standalonegrok_2.1.1.1" "The codename GROK appears in several documents published by Der Spiegel, where “a keylogger” is mentioned. Our analysis indicates EQUATIONGROUP’s GROK plugin is indeed a keylogger on steroids that can perform many other…

> These measures are always marketed as being for security from hackers and more recently also in the name of privacy That's because they are. The reality is the existence of side-loading and third-party stores on Android contributes directly to the spread of malware on the platform, which is why Google has made it more difficult to do so with each successive release of Android. According to Nokia's threat intelligence report (https://onestore.nokia.com/asset/205835), Android devices were responsible for 47.15% of malware infections compared to 0.85% from iPhones. (Note that even after scaling for the number of devices there is still an order of magnitude difference.) Windows/PCs at 35.82% and IoT devices at 16.17% make up the rest. That's right, Android has overtaken Windows as the biggest malware vector on the planet. According to Kaspersky's mobile malware report (https://securelist.com/mobile-malware-evolution-2019/96280/), 13.89% of users in the United States were attacked by mobile malware in 2019. In some other countries the numbers are significantly higher: 21.23% in Brazil, 24.14% in Mexico, 27.36% in Malaysia, 37.98% in India, and 60.64% in Iran. The overwhelming majority of mobile malware targets the Android platform. If you want to argue that your right to "freedom" over your device is so important to you that you believe the risk of malware is worth the tradeoff, that's one thing, but don't hand-wave away the very real security benefits of strictly…

There is a lot of independent analysis pointing at North Korea[0][1][2][3] The infosec industry are extremely skeptical of attribution especially coming from government - it took a long time for a higher-certainty attribution to be established in the Sony and Bangladesh reserve bank cases, and there are still open cases of attribution in other incidents Along with technical evidence, Wannacry also fits the North Korea m.o of financial incentive but also incentive to sow chaos[12], as well as how their attackers operate in Singapore and China and outsource some components. On the contrary there is little to no evidence pointing anywhere else - meaning the second best probability of attribution for Wannacry is much further down the list. The key difference there is that during the Iraq invasion there was zero corroborative evidence, the actual weapons inspectors said there was no evidence. Further - the USA doesn't need a made-up pretext for war with North Korea. They're technically still at war and North Korea are in violation of UN Security Council resolutions and treaties (they routed around the UN for Iraq) North Korea has sunk a ship[4], downed an airliner[5], attacked South Korean islands[6], tested nuclear weapons, developed a missile program, fired across the DMZ[7] (as recently again as today[8]), assassinated foreigners on foreign soil[9], been caught attempting to sell weapons of mass destruction[10], sold arms to Syria and others in violation of sanctions[11]…

I was about to make that connection, this is similar to Brazil's boletos. The difference is that in Brazil it is a standardized system that spans all banks: anyone with a bank account that wants to receive money can have their bank issue a "boleto", which is essentially a barcode that routes money to the destination account. A payer can go to any participating place (post office, convenience store, bank tellers, etc) and surrender cash, which then gets routed through the banking system to the right account. Which brings us to a potential problem: there has been a tremendous amount of fraud in this system (Brazil's Boletos), with all sorts of malware changing the barcode when it is downloaded in an infected computer to issue a boleto with a different destination account. Back in 2014 this was well documented by Krebs[1], and at amazing detail by @assolini from Kaspersky[2]. I also documented a specific case that happened to a friend[3]. While it should be possible to mount similar attacks on the Amazon system, having people deposit money into others' accounts, it should be straightforward for Amazon to detect this, since it is a single issuer system... [1] https://krebsonsecurity.com/2014/07/brazilian-boleto-bandits-bilk-bill… [2] https://securelist.com/analysis/publications/66591/attacks-against-bol… [3] http://cs.brown.edu/~rfonseca/notes/net-bb-dns-poison.html

Rather than having a daily list, I use Feeder (Chrome extension: http://feeder.co/) to read my RSS feeds, I had always preferred it to Google Reader, I never did get myself into the mantra of checking Reader often (it ended up being once every few months, when I randomly remembered) ; however Feeder is nice in its minimalistic approach, just showing me how many items for each feed, which encourages me to zero it out, although unlike Reader it just shows the titles of RSS feed items, so I end up judging whether or not to read an article based on the title. A few feeds I follow: News * Hacker News - https://news.ycombinator.com/ (https://news.ycombinator.com/rss and https://news.ycombinator.com/bigrss [a lot of the posts are repeated over both, and note these are not necessarily the front page posts, my guess is that they are upvoted new posts, so I end up reading some posts before they reach the front page]) * Phoronix - http://www.phoronix.com/ (http://www.phoronix.com/rss.php) * ThreatPost - http://threatpost.com/ (http://threatpost.com/feed) * TheNextWeb - http://thenextweb.com/ (http://feeds2.feedburner.com/thenextweb) * Wired - http://www.wired.com/ (http://feeds.wired.com/wired/index) * iClarified - http://www.iclarified.com/ (http://iclarified.com/rss/rss.xml) * TorrentFreak - https://torrentfreak.com/ (http://feeds.feedburner.com/Torrentfreak) * r/WorldNews - http://www.reddit.com/r/worldnews (http://www.reddit.com/r/worldnews/.rss) Blogs * Securelist -…

A source for your claim would be helpful. Here's an alternative take, with source: > In Q2 2025, the number of attacks involving malware, adware, and unwanted software decreased compared to Q1. https://securelist.com/malware-report-q2-2025-mobile-statistics/117349…

This article going into more detail on those targeted was posted later: https://securelist.com/notepad-supply-chain-attack/118708/

> People have a right to propose changes to broken things they use. Here's the root of your misunderstanding. “Broken” is subjective, relative only to you. > it's right there is name of the feature "Pull Request", it's a request, not a demand. That's marketing-speak. It is absolutely a demand. PRs are a growth-hacking feature and are part of how GitHub got to be so dominant. The abuse of social pressure calling someone's project unmaintained was the same mechanism used for the XZ Utils backdoor: https://securelist.com/xz-backdoor-story-part-2-social-engineering/112…

mostly no, from my reading - it was a multi-stage chain of relatively normal looking things that added up to an exploit. helped by the tests involved using compressed data that wasn't human-readable. you can of course come up with ways it could have been caught, but the code doesn't stand out as abnormal in context. that's all that really matters, unless your build system is already rigid enough to prevent it, and has no exploitable flaws you don't know about. finding a technical overview is annoyingly tricky, given all the non-technical blogspam after it, but e.g. https://securelist.com/xz-backdoor-story-part-1/112354/ looks pretty good from a skim.

This was exactly the playbook that led to the xz backdoor. Just the quotes: https://news.ycombinator.com/item?id=39909905 Very long page but a lot more in depth. Search for “Jigar Kumar pressured Lasse Collin” https://securelist.com/xz-backdoor-story-part-2-social-engineering/112… And an overview: https://en.wikipedia.org/wiki/XZ_Utils_backdoor

Time to buckle up for more of this [0] awesomeness, now coming to a Play store near you. Problems created by tech illiterate elders, for tech illiterate elders. [0] https://securelist.com/open-source-package-for-cursor-ai-turned-into-a…

You need to click through to the actual investigation https://securelist.com/gitvenom-campaign/115694/

They link here [0] for more details, which might be less geo-intercepted. [0] https://securelist.com/gitvenom-campaign/115694/

The structure of the archive looked very similar to the sample I was analyzing. The securelist article [1] also describes the same malware techniques and stealer behaviors, just in a way more undetailed manner than the original reddit post. [1] https://securelist.com/gitvenom-campaign/115694/ edit: update my grandparent comment with the reddit links. It was on /r/netsec and /r/hacking and not on /r/cybersecurity where the author posted it first :D

Basically they first need to get a remote shell and are then able to replace the extension source with the modified one. This article does a good job explaining it more in depth.[0] 0: https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/…

Reminded me a bit about the use of satellite internet for anonymity https://securelist.com/satellite-turla-apt-command-and-control-in-the-…

That's why I mentioned the recent story. [0] [1] "Apple doesn't know" when the chain uses an internal backdoor in Apple hardware is a... stretch. And the chain gives the strong vibes of corporate-style development, with all its redundancy and mismatch between two parts. It's not alchemy, really. [0] https://securelist.com/operation-triangulation-the-last-hardware-myste… [1] https://news.ycombinator.com/item?id=38783112 - HN discussion

AFAIK still no luck with Gauss from 2012 https://securelist.com/gauss-abnormal-distribution/36620/

Yeah I’m sure state actors that are capable of creating exploits using undocumented registers on Apple silicon [1] won’t be able to break camera sensor DRM.. [1] https://securelist.com/operation-triangulation-the-last-hardware-myste…

If a company creates a back door for a government in a way that it looks like an oopsie vulnerability, it gives them plausible deniability. If someone reports the vuln and they don't fix it, this somewhat shatters the plausible deniability. Operation triangulation https://securelist.com/operation-triangulation-the-last-hardware-myste… revealed the use of four different vulnerabilities, hidden code and undocumented features to take over Iphones. Its sophistication points to an APT. Apple did not deny helping the attacker TMK.