While investigating the infamous Russian-speaking cyberespionage actor Turla, Kaspersky Lab researchers have discovered how it’s evading detection of its activity and physical location.
Turla is a sophisticated cyberespionage group that has been active for more than 8 years. The attackers behind Turla have infected hundreds of computers in more than 45 countries including Kazakhstan, Russia, China, Vietnam and the United States. Types of organisations that have been affected include government institutions and embassies, as well as military, education, research and pharmaceutical companies. At the initial stage, the Epic backdoor performs victim profiling. For only the most high profile targets, the attackers then use an extensive satellite-based communication mechanism in the later stages of the attack, which helps them to hide their traces.
Satellite communications are known mostly as a tool for TV broadcasting and secure communications; however, they are also used to provide access to the Internet. Such services are mostly used in remote locations where all other types of Internet access are either unstable and slow, or not available at all. One of the most widespread and inexpensive types of satellite-based Internet connection is a so-called downstream-only connection.
In this case, outgoing requests from a user’s PC are communicated through conventional lines (a wired or GPRS connection), with all the incoming traffic coming from the satellite. This technology allows the user to get a relatively fast download speed. However, it has one big disadvantage: all the downstream traffic comes back to the PC unencrypted. Any rogue user with the right set of inexpensive equipment and software could simply intercept the traffic and get access to all the data that users of these links are downloading.
The Turla group takes advantage of this weakness in a different way: by using it to hide the location of its Command and Control servers (C&C), one of the most important parts of the malicious infrastructure. The C&C server is essentially a “homebase” for the malware deployed on targeted machines. Discovering the location of such a server can lead investigators to uncover details about the actor behind an operation, so here’s how the Turla group is avoiding such risks:
1. The group first “listens” to the downstream from the satellite to identify active IP addresses of satellite-based Internet users who are online at that moment.
2. They then choose an online IP address to be used to mask a C&C server, without the legitimate user’s knowledge.
3. The machines infected by Turla are then instructed to exfiltrate data towards the chosen IPs of regular satellite-based Internet users. The data travels through conventional lines to the satellite Internet provider’s teleports, then up to the satellite, and finally down from the satellite to the users with the chosen IPs.
Interestingly, the legitimate user whose IP address has been used by the attackers to receive data from an infected machine, will also receive these packets of data but will barely notice them. This is because the Turla attackers instruct infected machines to send data to ports that, in the majority of cases, are closed by default. So the PC of a legitimate user will simply drop these packets, while the Turla C&C server, which keeps those ports open, will receive and process the exfiltrated data.
Another interesting thing with the Turla actor tactics is that they tend to use satellite Internet connection providers located in Middle Eastern and African countries. In their research, Kaspersky Lab experts have spotted the Turla group using IPs of providers located in countries such as Congo, Lebanon, Libya, Niger, Nigeria, Somalia or the UAE.
Satellite beams that are used by operators in these countries usually do not cover European and North American territories, making it very hard for most of security researchers to investigate such attacks.
“In the past, we’ve seen at least three different actors using satellite-based Internet links to mask their operations. Of these, the solution developed by the Turla group is the most interesting and unusual. They are able to reach the ultimate level of anonymity by exploiting a widely used technology – one-way satellite Internet. The attackers can be anywhere within range of their chosen satellite, an area that can exceed thousands of square kilometers,” said Stefan Tanase, Senior Security Researcher at Kaspersky Lab. “This makes it almost impossible to track down the attacker. As the use of such methods becomes more popular, it’s important for system administrators to deploy the correct defense strategies to mitigate such attacks.”
Kaspersky Lab products successfully detect and block the malware used by the Turla threat actor with the following detection names: Backdoor.Win32.Turla.*, Rootkit.Win32.Turla.*, HEUR:Trojan.Win32.Epiccosplay.gen, HEUR:Trojan.Win32.Generic.
Rain, Telkom Mobile, lead in affordable data
A new report by the telecoms regulator in South Africa reveal the true consumer champions in mobile data costs
The latest bi-annual tariff analysis report produced by the Independent Communications Authority of South Africa (ICASA) reveals that Telkom Mobile data costs for bundles are two-thirds lower than those of Vodacom and MTN. On the other hand, Rain is half the price again of Telkom.
The report focuses on the 163 tariff notifications lodged with ICASA during the period 1 July 2018 to 31 December 2018.
“It seeks to ensure that there is retail price transparency within the electronic communications sector, the purpose of which is to enable consumers to make an informed choice, in terms of tariff plan preferences and/or preferred service providers based on their different offerings,” said Icasa.
ICASA says it observed the competitiveness between licensees in terms of the number of promotions that were on offer in the market, with 31 promotions launched during the period.
The report shows that MTN and Vodacom charge the same prices for a 1GB and a 3GB data bundle at R149 and R299 respectively. On the other hand, Telkom Mobile charges (for similar-sized data bundles) R100 (1GB) and R201 (3GB). Cell C discontinued its 1GB bundle, which was replaced with a 1.5GB bundle offered at the same price as the replaced 1GB data bundle at R149.
Rain’s “One Plan Package” prepaid mobile data offering of R50 for a 1GB bundle remains the most affordable when compared to the offers from other MNOs (Mobile Network Operators) and MVNOs (Mobile Virtual Network Operators).
“This development should have a positive impact on customers’ pockets as they are paying less compared to similar data bundles and increases choice,” said Icasa.
The report also revealed that the cost of out-of-bundle data had halved at both MTN and Vodacom, from 99c per Megabyte a year ago to 49c per Megabyte in the first quarter of this year. This was still two thirds more expensive than Telkom Mobile, which has charged 29c per Megabyte throughout this period (see graph below).
Meanwhile, from having positioned itself as consumer champion in recent years, Cell C has fallen on hard times, image-wise: it is by far the most expensive mobile network for out-of-bundle data, at R1.10 per Megabyte. Its prices have not budged in the past year.
The report highlights the disparities between the haves and have-nots in the dramatically plummeting cost of data per Megabyte as one buys bigger and bigger bundles on a 30-day basis (see graph below).
For 20 Gigabyte bundles, all mobile operators are in effect charging 4c per Megabyte. Only at that level do costs come in at under Rain’s standard tariffs regardless of use.
Qualcomm wins 5G as Apple and Intel cave in
A flurry of announcements from three major tech players ushered in a new mobile chip landscape, wrItes ARTHUR GOLDSTUCK
Last week’s shock announcement by Intel that it was canning its 5G modem business leaves the American market wide open to Qualcomm, in the wake of the latter winning a bruising patent war with Apple.
Intel Corporation announced its intention to “exit the 5G smartphone modem business and complete an assessment of the opportunities for 4G and 5G modems in PCs, internet of things devices and other data-centric devices”.
Intel said it would also continue to invest in its 5G network infrastructure business, sharpening its focus on a market expected to be dominated by Huawei, Nokia and Ericsson.
Intel said it would continue to meet current customer commitments for its existing 4G smartphone modem product line, but did not expect to launch 5G modem products in the smartphone space, including those originally planned for launches in 2020. In other words, it would no longer be supplying chips for iPhones and iPads in competition with Qualcomm.
“We are very excited about the opportunity in 5G and the ‘cloudification’ of the network, but in the smartphone modem business it has become apparent that there is no clear path to profitability and positive returns,” said Intel CEO Bob Swan. “5G continues to be a strategic priority across Intel, and our team has developed a valuable portfolio of wireless products and intellectual property. We are assessing our options to realise the value we have created, including the opportunities in a wide variety of data-centric platforms and devices in a 5G world.”
The news came immediately after Qualcomm and Apple issued a joint announced of an agreement to dismiss all litigation between the two companies worldwide. The settlement includes a payment from Apple to Qualcomm, along with a six-year license agreement, and a multiyear chipset supply agreement.
Apple had previously accused Qualcomm of abusing its dominant position in modem chips for smartphones and charging excessive license fees. It ordered its contract manufacturers, first, to stop paying Qualcomm for the chips, and then to stop using the chips altogether, turning instead to Intel.
With Apple paying up and Intel pulling out, Qualcomm is suddenly in the pound seats. It shares hit their highest levels in five years after the announcements.
Qualcomm said in a statement: “As we lead the world to 5G, we envision this next big change in cellular technology spurring a new era of intelligent, connected devices and enabling new opportunities in connected cars, remote delivery of health care services, and the IoT — including smart cities, smart homes, and wearables. Qualcomm Incorporated includes our licensing business, QTL, and the vast majority of our patent portfolio.”
Meanwhile, Strategy Analytics released a report on the same day that showed Ericsson, Huawei and Nokia will lead the market in core 5G infrastructure, namely Radio Access Network (RAN) equipment, by 2023 as the 5G market takes off. Huawei is expected to have the edge as a result of the vast scale of the early 5G market in China and its long term steady investment in R&D. According to a report entitled “Comparison and 2023 5G Global Market Potential for leading 5G RAN Vendors – Ericsson, Huawei and Nokia”, two outliers, Samsung and ZTE, are expected to expand their global presence alongside emerging vendors as competition heats up.