Eastern European Banks Were Attacked Via Backdoors Directly Connected To Local Networks, Report Finds (securelist.com) 43
An anonymous reader writes: Karspesky security researcher Sergey Golovanov writes about recent cybertheft incidents involving hardware backdoors planted by criminals. Each attack had a common springboard: an unknown device directly connected to the company's local network. In some cases, it was the central office, in others a regional office, sometimes located in another country. At least eight banks in Eastern Europe were the targets of the attacks, which caused damage estimated in the tens of millions of dollars. Hardware backdoors are cheap and immune to antivirus. A firmware modified OpenWrt based router can provide covert remote access, painless packet captures, and secure VPN connections with the flip of a switch. Will a flashlight and a ladder be common tools of computer security someday? After the cybercriminals entered a organization's building, connected a device to the local network and scanned the local network seeking to gain access to the resources, they proceeded to stage three. "Here they logged into the target system and used remote access software to retain access," writes Golovanov. "Next, malicious services created using msfvenom were started on the compromised computer. Because the hackers used fileless attacks (PDF) and PowerShell, they were able to avoid whitelisting technologies and domain policies. If they encountered a whitelisting that could not be bypassed, or PowerShell was blocked on the target computer, the cybercriminals used impacket, and winexesvc.exe or psexec.exe to run executable files remotely."
Re: (Score:1)
Even OpenWRT was written by "authorities" so you're being kind of vague with your sandwich-board doomsdaying.
Authorities by virtue, not by decree. (Score:1)
The authors of OpenWRT are authoritative by virtue of their works.
These Big Banks are authoritative by decree of the Men-with-Guns, and their rotten produce proves again and again that this decree is nonsensical.
Authority is earned, not imposed.
It does seem like VPN's are a widespread now... (Score:4, Interesting)
I totally understand why a company would want to put all remote offices into a private company VPN, but it sure seems like it opens them up to physical attacks like this in a way they would not be otherwise... maybe companies should work harder to make everything a worker needs accessible via the internet at large and have a more protected domain that is harder to attack - physical as well as network-wise.
That would help improve the life of remote workers also, as a happy byproduct.
If you think about it, yes (Score:3)
I realize I probably didn't make that quite clear enough for the syrupy mind of an AC - so I will explain...
I'm talking about cases where whole remote offices are set up on a VPN. Offer easier to get into satellite offices than main HQ, and not nearly as carefully monitored. Then you have access to the internal network if you leave something attached to any one of a number of hardwired ports probably laying about, near a plug...
Re: (Score:3)
It was already on the "Cloud"... (Score:3)
So to recap, your excuse for not having proper local basic security hardware audits is.
When did that go away? You still need to do that anyway.
to put that in the cloud?
Um - I realize being an AC you may not quite understand this, but "the cloud" is just servers. Anything I was talking about is servers, so it's already on "the cloud" regardless of what I am suggesting - I'm merely talking about enabling access to servers (which again were always there being servers) outside the firewall, rather than presum
Re: (Score:2)
The point is, you can't trust something just because it is on the LAN. If you understand that, then a VPN increases security. If you don't, then it decreases it.
Same with most tools, really.
LAN inhibits strong security (Score:3)
The point is, you can't trust something just because it is on the LAN.
I agree but how long does that ever really hold in any large company?
Over time a LOT of stuff will grow in any company to lazily trust the LAN, or at least they sure will not think about attacks from that vector nearly as hard as the firewall guys.
If you have to make those things open to outside use the whole chain gets a lot more thought applied as to access security. Otherwise server after server gets thrown up with minimal access prot
Re: (Score:3)
"I totally understand why a company would want to put all remote offices into a private company VPN"
But the key of this attack was not VPN, the general concept. It was physical access coupled to "... malicious services created using msfvenom [...] If they encountered a whitelisting that could not be bypassed, or PowerShell was blocked on the target computer, the cybercriminals used impacket, and winexesvc.exe or psexec.exe to run executable files remotely."
Or, in other words, another Windows-vector attack
visual security audits at each office? building ma (Score:2)
visual security audits at each office?
and with some building lease agreements it's the building maintenance job to work on stuff that needs an ladder.
You run windows and complain about a security? (Score:2)
Re: (Score:2)
Will a flashlight and a ladder be common tools of computer security someday?
Oh boy. I have a book you really need to read. [amazon.com]
They are...
And I would even suggest an older book: Neuromancer. It's Cyberpunk staple that hacking runs require a well timed physical access either to plant a bridge head, to bypass a physical security switch or to create a diversion.
It's the other way round in heist movies: A raid party has their computer nerd to hack the alarm system (which is not only for dramatic reasons possible only after bypassing a first layer of physical security)
You mean anyone can connect to the network? (Score:5, Informative)
Security 101, deny unauthorized hardware from connecting to the local network, either hardwired or via WIFI. Especially when having anything to do with banks. Going cheap never works well with networking that should be "secure".
Switches and access points are pretty trivial to setup to deny access.
Re: (Score:1)
Denying unauthorised hardware connection to the corporate network is fine - until the CEO can't connect his new iPad.
Where is the technical talent responsible? (Score:2)
When you design a network, some basic concepts can really help when it comes to security. If you use a locked down DHCP system where the hardware MAC address of all approved machines is used, you assign an IP address from the DHCP server ONLY to those machines that are supposed to be there. New equipment must have that MAC address logged. Locking access to select IP addresses, and testing any connected equipment for MAC addresses that are not known would find the unauthorized devices.
So, who designed
Active ports (Score:2)
This is easier then you think. (Score:2)
Check out this video:
https://youtu.be/r-7lUgpemqc [youtu.be]
Along with showing how this is done, heâ(TM)s a great speaker.
Min