How Chinese Attackers Breached an ISP to Poison Insecure Software Updates with Malware (bleepingcomputer.com) 11
An anonymous reader shared this report from BleepingComputer:
A Chinese hacking group tracked as StormBamboo has compromised an undisclosed internet service provider (ISP) to poison automatic software updates with malware. Also tracked as Evasive Panda, Daggerfly, and StormCloud, this cyber-espionage group has been active since at least 2012, targeting organizations across mainland China, Hong Kong, Macao, Nigeria, and various Southeast and East Asian countries.
On Friday, Volexity threat researchers revealed that the Chinese cyber-espionage gang had exploited insecure HTTP software update mechanisms that didn't validate digital signatures to deploy malware payloads on victims' Windows and macOS devices... To do that, the attackers intercepted and modified victims' DNS requests and poisoned them with malicious IP addresses. This delivered the malware to the targets' systems from StormBamboo's command-and-control servers without requiring user interaction.
Volexity's blog post says they observed StormBamboo "targeting multiple software vendors, who use insecure update workflows..." and then "notified and worked with the ISP, who investigated various key devices providing traffic-routing services on their network. As the ISP rebooted and took various components of the network offline, the DNS poisoning immediately stopped."
BleepingComputer notes that "âAfter compromising the target's systems, the threat actors installed a malicious Google Chrome extension (ReloadText), which allowed them to harvest and steal browser cookies and mail data."
On Friday, Volexity threat researchers revealed that the Chinese cyber-espionage gang had exploited insecure HTTP software update mechanisms that didn't validate digital signatures to deploy malware payloads on victims' Windows and macOS devices... To do that, the attackers intercepted and modified victims' DNS requests and poisoned them with malicious IP addresses. This delivered the malware to the targets' systems from StormBamboo's command-and-control servers without requiring user interaction.
Volexity's blog post says they observed StormBamboo "targeting multiple software vendors, who use insecure update workflows..." and then "notified and worked with the ISP, who investigated various key devices providing traffic-routing services on their network. As the ISP rebooted and took various components of the network offline, the DNS poisoning immediately stopped."
BleepingComputer notes that "âAfter compromising the target's systems, the threat actors installed a malicious Google Chrome extension (ReloadText), which allowed them to harvest and steal browser cookies and mail data."
All that effort to distribute malware (Score:5, Informative)
when all they had to do was run ads on Google [tomsguide.com]?
Shock, shock horror, horror, shock, shock horror (Score:1)
Maybe we should investigate "man in middle" attack (Score:2)
Shock, shock horror, horror, shock, shock horror
Maybe we should have security experts begin to study these "man in the middle" attacks and develop countermeasures, maybe digitally sign patches or something? :-)
Which means the updates have crappy security (Score:5, Insightful)
Updates done right come with cryptographic signatures. That means, among other things, that compromising an ISP does not help to compromise the supply chain. Apparently there are still too many crappy software makers that do not get it.
Re: (Score:3)
Debian's only been doing signed Release files since 2007, so maybe the tech is too new and experimental.
/s
Re: (Score:2)
With Microsoft and suppliers in their area being 20-30 years behind on engineering? Probably.
Chief reasons why I don't like auti updates. (Score:2)
What is the sloppy software? (Score:3)
Yeah, right. Vault7 is all fake, I suppose. (Score:2)
The cia make their haching look like anyone else did it.
DNSSEC people deploy it for your DNS (Score:2)
we know that its trival to hack BGP sessions thats why we have PKI for BGP and most understand that... filter your hosts but come on DNS for gov websites such as tax should have DNSSEC and so should google and Microsoft !
get on it sign the zone
Chinese Hacking group (Score:2)
Targeting China?
That seems very unusual.