Kaspersky Labs has revealed that hackers are now hacking other attack groups, using their tools and stealing victim data, making more difficult to gather accurate threat intelligence.
Sophisticated threat actors are actively hacking other attack groups in order to steal victim data, borrow tools and techniques and re-use each other’s infrastructure – making accurate threat intelligence ever harder for security researchers, according to Kaspersky Lab’s Global Research and Analysis Team (GReAT).
Accurate threat intelligence relies on identifying the patterns and tools that signpost a particular threat actor. Such knowledge allows researchers to better map different attackers’ goals, targets and behaviours, and to help organisations determine their level of risk. When threat actors start hacking each other and taking over tools, infrastructure and even victims, this model quickly starts to break down.
Kaspersky Lab believes that such attacks are likely to be implemented mainly by nation-state backed groups, targeting foreign or less competent actors. It is important that IT security researchers learn how to spot and interpret the signs of these attacks, so that they can present their intelligence in context.
In a detailed review of the opportunities for such attacks, GReAT researchers identified two main approaches: passive and active. Passive attacks involve intercepting other groups’ data in transit, for example as it moves between victims and command and control servers – and are almost impossible to detect. The active approach involves infiltrating another threat actor’s malicious infrastructure.
There is a greater risk of detection in the active approach, but it also offers more benefits as it allows the attacker to extract information on a regular basis, monitor its target and their victims, and potentially even insert its own implants or mount attacks in the name of its victim. The success of active attacks relies heavily on the target making mistakes in operational security.
GReAT has encountered a number of strange and unexpected artefacts while investigating specific threat actors that suggest such active attacks are already happening in-the-wild.
- Backdoors installed in another entity’s command-and-control (C&C) infrastructure
Installing a backdoor in a hacked network allows attackers to establish persistence inside the operations of another group. Kaspersky Lab researchers have found what appear to be two in-the-wild examples of such backdoors.
One of these was found in 2013, while analysing a server used by NetTraveler, a Chinese-language campaign targeting activists and organisations in Asia. The second one was found in 2014, while investigating a hacked website used by Crouching Yeti (also known as Energetic Bear), a Russian-language threat actor targeting the industrial sector since 2010. The researchers noticed that, for a brief period of time, the panel managing the C&C network was modified with a tag that pointed to a remote IP in China (likely a false flag). The researchers believe this was also a backdoor belonging to another group, although there are no indicators as to who this might be.
- Sharing hacked websites
In 2016, Kaspersky Lab researchers found that a website compromised by the Korean-language DarkHotel also hosted exploit scripts for another targeted attacker, which the team called ScarCruft, a group targeting mainly Russian-, Chinese- and South Korean- organisations. The DarkHotel operation dates from April 2016, while the ScarCruft attacks were implemented a month later, suggesting that ScarCruft may have observed the DarkHotel attacks before launching its own.
Infiltrating a group with an established stake in a certain region or industry sector enables an attacker to reduce costs and improve targeting, benefiting from the specialist expertise of its victim.
Some threat actors share rather than steal victims. This is a risky approach if one of the groups is less advanced and gets caught, as the inevitable forensic analysis that follows will also reveal the other intruders. In November 2014, Kaspersky Lab reported that a server belonging to a research institution in the Middle East, known as the Magnet of Threats, simultaneously hosted implants for the highly sophisticated threat actors Regin and Equation Group (English-language), Turla and ItaDuke (Russian-language), as well as Animal Farm (French-language) and Careto (Spanish). In fact, this server was the starting point for the discovery of the Equation Group.
“Attribution is hard at the best of times as clues are rare and easily manipulated, and now we also have to factor in the impact of threat actors hacking each other. As more groups leverage each other’s toolkits, victims and infrastructure, insert their own implants or adopt the identity of their victim to mount further attacks, where will that leave threat hunters trying to build a clear, accurate picture? Our examples hint that some of this is already happening in-the-wild and threat intelligence researchers will need to pause and adapt their thinking when it comes to analysing the work of advanced threat actors,” said Juan Andres Guerrero-Saade, Principal Security Researcher, Global Research and Analysis Team, Kaspersky Lab.
In order to keep pace with the rapidly evolving threat landscape, Kaspersky Lab advises enterprises to implement a full-scale security platform combined with cutting-edge threat intelligence. Kaspersky Lab’s enterprise security portfolio provides businesses with threat prevention through its next-generation endpoint security suite, detection based on the Kaspersky Anti Targeted Attack platform, and prediction and incident response through its threat intelligence services.
Further details on ways in which threat actors acquire and reuse elements of other groups, including tool repurposing and malware clustering, and their ramifications for threat intelligence can be found in the paper, Walking in your enemy’s shadow: when fourth-party collection becomes attribution hell.
Samsung unleashes the beast
Most new smartphone releases of the past few years have been like cat-and-mouse games with consumers and each other. It has been as if morsels of cheese are thrown into the box to make it more interesting: a little extra camera here, a little more battery there, and incremental changes to size, speed (more) and weight (less). Each change moves the needle of innovation ever-so-slightly. Until we find ourselves, a few years later, with a handset that is revolutionary compared to six years ago, but an anti-climax relative to six months before.
And then came Samsung. Probably stung by the “incremental improvement” phrase that has become almost a cliché about new Galaxy devices, the Korean giant chose to unleash a beast last week.
The new Galaxy Note 9 is not only the biggest smartphone Samsung has ever released, but one of the biggest flagship handsets that can still be called a phone. With a 6.4” display, it suddenly competes with mini-tablets and gaming consoles, among other devices that had previously faced little contest from handsets.
It offers almost ever cutting edge introduced to the Galaxy S9 and S9+ smartphones earlier this year, including the market-leading f1.5 aperture lens, and an f2.4. telephoto lens, each weighing in at 12 Megapixels. The front lens is equally impressive, with an f1.7 aperture – first introduced on the Note 8 as the widest yet on a selfie camera.
So far, so S9. However, the Note range has always been set apart by its S Pen stylus, and each edition has added new features. Born as a mere pen that writes on screens, it evolved through the likes of pressure sensitivity, allowing for artistic expression, and cut-and-paste text with translation-on-the-fly.
(Click here or below to read more about the Samsung Galaxy S Pen stylus) Samsung Galaxy S9 Features)
SA ride permit system ‘broken’
Despite the amendments to the National Land Transport Act, ALON LITS, General Manager, Uber in Sub Saharan Africa, believes that many premature given that the necessary, well-functioning systems and processes are not yet in place to make these regulatory changes viable.
The spirit and intention of the amendments to the National Land Transport Act No 5 (NLTA), 2009 put forward by the Ministry of Transport are to be commended. It is especially pleasing that these amendments include ridesharing and e-hailing operators and drivers as legitimate participants in the country’s public transport system, which point to government’s willingness to embrace the changes and innovation taking place in the country’s transport industry.
However, there are aspects of the proposed amendments that are, at best, premature given that the necessary, well-functioning systems and processes are not yet in place to make these regulatory changes viable.
Of particular concern are the significant financial penalties that will need to be paid by ridesharing and e-hailing companies whose independent operators are found to be transporting passengers without a legal permit issued by the relevant local authority. These fines can be as high as R100 000 per driver operating without a permit. Apart from being an excessive penalty it is grossly unfair given that a large number of local authorities don’t yet have functioning permit issuing systems and processes in place.
The truth is that the operating permit issuance system in South Africa is effectively broken. The application and issuance processes for operating licenses are fundamentally flawed and subject to extensive delays, sometimes over a year in length. This situation is exacerbated by the fact that it is very difficult for applicants whose permit applications haven’t yet been approved to get reasons for the extensive delays on the issuing of those permits.
Uber has had extensive first-hand experience with the frustratingly slow process of applying for these permits, with drivers often having to wait months and, in some cases more than a year, for their permits.
Sadly, there appears to be no sense of urgency amongst local authorities to prioritise fixing the flawed permit issuing systems and processes or address the large, and growing, backlogs of permit applications. As such, in order for the proposed stringent permit enforcement rules to be effective and fair to all role players, the long-standing issues around permit issuance first need to be addressed. At the very least, before the proposed legislation amendments are implemented, the National Transport Ministry needs to address the following issues:
- Efficient processes and systems must be put in place in all local authorities to allow drivers to easily apply for the operating permits they require
- Service level agreements need to be put in place with local authorities whereby they are required to assess applications and issue permits within the prescribed 60-day period.
- Local authorities need to be given deadlines by which their current permit application backlogs must be addressed to allow for faster processing of new applications once the amendments are promulgated.
If the Transport Ministry implements the proposed legislation amendments before ensuring that these permit issuance challenges are addressed, many drivers will be faced with the difficult choice of either having to operate illegally whilst awaiting their approved permits and risking significant fines and/or arrest, or stopping operations until they receive their permits, thereby losing what is, for many of them, their only source of income.
As such, if the Ministry of Transport is not able to address these particular challenges, it is only reasonable to ask it to reconsider this amendment and delay its implementation until the necessary infrastructure is in place to ensure it does not impact negatively on the country’s transport industry. The legislators must have been aware of the challenges of passing such a significant law, as the Amendment Bill allows for the Minister to use his discretion to delay implementation of provisions for up to 5 years.
Fair trade and healthy competition are the cornerstones of any effective and growing economy. However, these clauses (Section 66 (7) and Section 66A) of the NLTA amendment, as well as the proposal that regulators be given authority to define the geographic locations or zones in which vehicles may operate, are contrary to the spirit of both. As a good corporate citizen, Uber is committed to supplementing and enhancing South Africa’s national transport system and contributing positively to the industry. If passed into law without the revisions suggested above, these new amendments will limit our business and many others from playing the supportive roles we all can, and should, in growing the SA transport and tourism industries as well as many other key economic sectors.
What’s more, if passed as they currently stand, the amendments will effectively limit South African consumers from having full access to the range of convenient transport options they deserve; which has the potential to harm the reputation and credibility of the entire transport industry.