Researchers crack open unusually advanced malware that hid for 5 years

[NWCorona]

Source: Arstechnica

Security experts have discovered a malware platform that's so advanced in its design and execution that it could probably have been developed only with the active support of a nation state.

The malware—known alternatively as "ProjectSauron" by researchers from Kaspersky Lab and "Remsec" by their counterparts from Symantec—has been active since at least 2011 and has been discovered on 30 or so targets. Its ability to operate undetected for five years is a testament to its creators, who clearly studied other state-sponsored hacking groups in an attempt to replicate their advances and avoid their mistakes. State-sponsored groups have been responsible for malware like the Stuxnet- or National Security Agency-linked Flame, Duqu, and Regin. Much of ProjectSauron resides solely in computer memory and was written in the form of Binary Large Objects, making it hard to detect using antivirus.

Part of what makes ProjectSauron's so impressive is its ability to collect data from air-gapped computers. To do this, it uses specially prepared USB storage drives that have a virtual file system that isn't viewable by the Windows operating system. To infected computers, the removable drives appear to be approved devices, but behind the scenes are several hundred megabytes reserved for storing data that is kept on the air-gapped machines. The arrangement works even against computers in which data-loss prevention software blocks the use of unknown USB drives.

Kaspersky researchers still aren't sure precisely how the USB-enabled exfiltration works. The presence of the invisible storage area doesn't in itself allow attackers to seize control of air-gapped computers. The researchers suspect the capability is used only in rare cases and requires use of a zero-day exploit that has yet to be discovered. In all, Project Sauron is made up of at least 50 modules that can be mixed and matched to suit the objectives of each individual infection.

Read more: http://arstechnica.com/security/2016/08/researchers-crack-open-unusually-advanced-malware-that-hid-for-5-years/

---

The ability to jump the gap is crazy stuff.

[Recursion]

1. There was a BIOS hack that allowed air-gap control via infrasonic signals

At least that was the assumption since physically disconnecting the mic stopped it.

A computer's IR receiver would also work, and for that matter a monitor can function as an AM tuner...

[NWCorona]

9. Agreed! The technology that's coming on line is both scary and amazing

I'm just thinking about the fact that it was latent for over five years and how it was able to avoid patten mapping.

Also the bridging method is the most troubling part of the whole article.

"The arrangement works even against computers in which data-loss prevention software blocks the use of unknown USB drives."

[truthisfreedom]

2. Aliens, obviously.

[Moliere]

3. 5 years is an eternity in Tech

Unreal hack to have been active for so long

[spinbaby]

4. It didn't "jump the gap"

It depended on someone plugging in an infected USB drive, probably counting on someone using the same USB drive on both an unsecured and a secure computer. There are very secure air-gap manual switches that enable someone to have both computers on their desk and switch between them as needed. All it would take is for that person to get lazy and use the same USB drive on both machines. A REALLY secure computer has its USB ports filled with epoxy.

[NWCorona]

10. Yeah you are right. that term can be viewed a few ways. That's why I left off the word "air"

In my view the way it fools secure systems is the most interesting and troubling part.

And definitely agree with you on the epoxy.

[cannabis_flower]

11. Lazy or careless

Not necessarily the same thing.

[reACTIONary]

12. Epoxy, and...

.... located within a Faraday cage.

[cstanleytech]

5. So was it depending on a physical USB drive or was it creating a

hidden virtual USB drive to survive on infected systems?

[Igel]

6. Sounds like it was coopting part of a separate USB drive's memory.

You plug it in, the anti-malware software doesn't see this sequestered memory. The malware runs, infects the machine, and saves data to that reserved memory, undetected.

As soon as you plug the USB thumbdrive into a networked computer, the information can be transmitted. An uninfected drive plugged into an infected machine can be infected.

The air-gapped computer is now "networked" like the computers where I worked a long time ago was "networked": Engineers ran experiments, the data was recorded on magnetic tape, and somebody would have to schlep the tapes from the experiment site to the processing section. (Okay, this was '81.)

[FigTree]

7. Windows operating system

The gift that keeps on giving.

[Plucketeer]

8. You can find examples

of some of the most vaunted automobiles in junkyards - ones that show no evidence of a collision being the cause of their demise. Nothing man-made is perfectly impervious.