Kaspersky Lab has uncovered a new advanced persistent threat (APT) campaign that has affected a large number of users through what is known as a supply chain attack. Its research found that threat actors behind Operation ShadowHammer have targeted users of the ASUS Live Update Utility, by injecting a backdoor into it at least between June and November 2018. Kaspersky Lab experts estimate that the attack may have affected more than a million users worldwide.
A supply chain attack is one of the most dangerous and effective infection vectors, increasinglyexploited in advanced operations over the last few years – as we have seen with ShadowPad or CCleaner. It targets specific weaknesses in the interconnected systems of human, organisational, material, and intellectual resources involved in the product life cycle: from initial development stage through to the end user. While a vendor’s infrastructure can be secure, there could be vulnerabilities in its providers’ facilities that would sabotage the supply chain, leading to a devastating and unexpected data breach.
The actors behind ShadowHammer targeted the ASUS Live Update Utility as the initial source of infection. This is a pre-installed utility in most new ASUS computers, for automatic BIOS, UEFI, drivers and applications updates. Using stolen digital certificates used by ASUS to sign legitimate binaries, the attackers have tampered older versions of ASUS software, injecting their own malicious code. Trojanized versions of the utility were signed with legitimate certificates and were hosted on and distributed from official ASUS update servers – which made them mostly invisible to the vast majority of protection solutions.
While this means that potentially every user of the affected software could have become a victim, actors behind ShadowHammer were focused on gaining access to several hundreds of users, which they had prior knowledge about. As Kaspersky Lab’s researchers discovered, each backdoor code contained a table of hardcoded MAC addresses – the unique identifier of network adapters used to connect a computer to a network.
Once running on a victim’s device, the backdoor verified its MAC address against this table. If the MAC address matched one of the entries, the malware downloaded the next stage of malicious code. Otherwise, the infiltrated updater did not show any network activity, which is why it remained undiscovered for such a long time. In total, security experts were able to identify more than 600 MAC addresses. These were targeted by over 230 unique backdoored samples with different shellcodes.
The modular approach and extra precautions taken when executing code, to prevent accidental code or data leakage indicates that it was very important for the actors behind this sophisticated attack to remain undetected, while hitting some very specific targets with surgical precision. Deep technical analysis shows that the arsenal of the attackers is very advanced and reflects a very high level of development within the group.
The search for similar malware has revealed software from three other vendors in Asia, all backdoored with very similar methods and techniques. Kaspersky Lab has reported the issue to Asus and other vendors.
“The selected vendors are extremely attractive targets for APT groups that might want to take advantage of their vast customer base,” said Vitaly Kamluk, Director of Global Research and Analysis Team, APAC, at Kaspersky Lab. “It is not yet very clear what the ultimate goal of the attackers was and we are still researching who was behind the attack. However, techniques used to achieve unauthorised code execution, as well as other discovered artefacts suggest that ShadowHammer is probably related to the BARIUM APT, which was previously linked to the ShadowPad and CCleaner incidents, among others. This new campaign is yet another example of how sophisticated and dangerous a smart supply chain attack can be nowadays.”
In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky Lab researchers recommend implementing the following measures:
- In addition to adopting must-have endpoint protection, implement a corporate grade security solution which detects advanced threats on the network level at an early stage, such as Kaspersky Anti Targeted Attack Platform;
- For endpoint level detection, investigation and timely remediation of incidents, we recommend implementing EDR solutions such as Kaspersky Endpoint Detection and Response or contacting a professional incident response team;
- Integrate Threat Intelligence feeds into your SIEM and other security controls in order to get access to the most relevant and up-to-date threat data and prepare for future attacks.
Kaspersky Lab will present full findings on Operation ShadowHammer at the Security Analyst Summit 2019 in Singapore, running from 9 to 11 April.
Click here to read Asus’ response.
Projection tech transforms retail
By TIMOTHY WILSON, visual imaging business account manager at Epson South Africa
Display designs, such as those found in retail stores, are no longer confined to static visuals on pull-up banners, 2D print and posters. The increasingly popular use of projection technology has ushered in new and exciting ways to create immersive displays using rich media and high-quality visual content to go beyond the four walls of traditional marketing.
In the past, projectors were lamp-based and prone to failure when used in a harsh environment, such as a retail store. Today, newly introduced laser projection technology has unlocked a range of capabilities.
Transforming the way brands engage with audiences
Creative techniques such as projection mapping, which can be described as the projection of video, animation and other colourful displays onto 3D surfaces, have completely transformed the way brands engage with audiences and can live in retail spaces, concert halls and even sports stadiums.
Projection mapping offers venues wide-spread creativity in using lighting in small or large environments, as was the case with Epson’s showstopping kinetic portal, which implemented projection mapping on a 360 degree vortex at the largest AV and systems integration show in the world – Integrated Systems Europe 2019. Driven by a new, affordable generation of projectors, mapping not only covers flat walls and traditional projections screens but also irregular shapes, objects, and even entire building façades.
When projecting on a larger scale, such as at events and music concerts, the process of visually combining several projectors to display one single seamless image might sound simple enough in principle but can prove to be a challenging task in reality. To overcome this challenge, experiential marketers are adopting the use of image edge blending, which refers to the process of stacking multiple projectors to create a single overlapped projection that appears continuous and clear.
It’s due to these advancements that displays in retail and events no longer pivot just on aesthetic appeal but can now deliver immersive consumer experiences that drive engagement and increase foot traffic. This is starting to drastically change the way that retailers, events and even restaurants host, engage, entertain and communicate with their audiences.
Projection is driving growth in experiential marketing
Consumer interest in the transition towards projection has seen this technology take centre stage at leading retailers such as Mall of Africa, events by brands such as ABSA and restaurants like Saint, transforming their environments into immersive spaces through projection that displays captivating imagery and video.
Saint restaurant in Sandton has pushed the boundaries of branding and displays, transforming all surfaces into a visual delight. Patrons entering the restaurant are greeted by a visual experience within a dome, featuring a series of moving, constantly changing artworks – such as a starry night sky or a replica of the Sistine Chapel – projected onto walls and the ceiling.
In fact, EventTrack research, which showcases the current state of marketing around the globe, highlights the continuous growth of event and experiential marketing. It notes that high-quality projection technology, more specifically its ability to emit stunning visual experiences, has grown in popularity to become the go-to tool for event organisers and retailers looking to captivate and engage with consumers.
The future of projection technology
Projection technology has proven to be an outstanding, much more cost-effective and reliable form of marketing collateral – setting an entirely new standard for high-resolution projection.
Sandton City recently embraced this market-leading technology with the installation of a virtual aquarium in its Centre Court. This installation centred on creating a 3D mapping concept that enabled shoppers to select an undersea creature from a touchpad to swim across digitised hoarding.
With capabilities to meet the demands of large-scale projection and the ability to effectively transform the way brands remain visible at shopping malls, restaurants and retail spaces – the unprecedented imaging power of projection technology has set a considerably high bar when it comes to retail and event displays.
Epson, which is not only pioneering imaging technology and innovative projection solutions, is also the market leader when it comes to high lumen laser projection, having recently announced its 30,000 lumens laser projector (EB-L30000U) which will officially launch in 2020. This high-end installation laser projector, complete with 4K enhancement, is aimed at rental and staging companies, hospitality markets and visitor attractions, which is yet another progressive step towards transforming the way marketers engage with their consumers in the 21st century.
GoFundMe hits R9bn in donations for people and causes
The world’s largest social fundraising platform has announced that Its community has made more than 120-million donations
GoFundMe this week released its annual Year in Giving report, revealing that its community has donated more than 120-million times, raising over $9-billion for people, causes, and organisations since the company’s founding in 2010.
In a letter to the GoFundMe community, CEO Rob Solomon emphasised how GoFundMe witnesses not only the good in people worldwide, but their generosity and their action every day.
“As we enter a new decade, GoFundMe is committed to spreading compassion and empathy through our platform,” said Solomon in the letter. “Together, we can bring more good into the world and unlock the power of global giving.”
The GoFundMe giving community continues to grow with both repeat donors and new donors. In fact, nearly 60% of donors were new this year. After someone makes a donation, they continue to engage with the community and give to multiple causes. In fact, one passionate individual donated 293 times to 234 different fundraisers in this past year alone. Donations are made every second, ranging from $5 to $50,000. This year, more than 40% of donations were under $50.
GoFundMe continues to be a mirror of current events across the globe. This year, young changemakers started the Fridays for Futuremovement to fight climate change, which led to a 60% increase in fundraiser descriptions mentioning ‘climate change’. Additionally, the community rallied together to support one another during natural disasters like Hurricane Dorian and the California wildfires, where thousands of fundraisers were started to help those in need.
The report includes a snapshot of giving trends from the year based on global GoFundMe data. It also includes company milestones from 2019, such as launching the company’s non-profit and advocacy arm, GoFundMe.org, and introducing GoFundMe Charity, which provides enterprise software with no subscription fees or contracts to charities of every size.
Highlights from GoFundMe’s 2019 Year in Giving report include:
- Global giving trends and data
- Top 10 most generous countries
- Top 10 most generous U.S. states and cities
- Biggest moments in 2019
To view the entire report, visit: www.gofundme.com/2019