Kaspersky Labs has identified ShadowPad, a backdoor virus planted in server management software that allows attackers to download further malicious modules or steal data.
Kaspersky Lab experts have discovered a backdoor planted in a server management software product used by hundreds of large businesses around the world. When activated, the backdoor allows attackers to download further malicious modules or steal data. Kaspersky Lab has alerted NetSarang, the vendor of the affected software, and it has promptly removed the malicious code and released an update for customers.
ShadowPad is one of the largest known supply-chain attacks. Had it not been detected and patched so quickly, it could potentially have targeted hundreds of organisations worldwide.
In July, 2017 Kaspersky Lab’s Global Research and Analysis (GReAT) team was approached by one of its partners – a financial institution. The organisation’s security specialists were worried about suspicious DNS (domain name server) requests originating on a system involved in the processing of financial transactions. Further investigation showed that the source of these requests was server management software produced by a legitimate company and used by hundreds of customers in industries like financial services, education, telecoms, manufacturing, energy, and transportation. The most worrying finding was the fact that the vendor did not mean for the software to make these requests.
Further Kaspersky Lab analysis showed that the suspicious requests were actually the result of the activity of a malicious module hidden inside a recent version of the legitimate software. Following the installation of an infected software update, the malicious module would start sending DNS-queries to specific domains (its command and control server) at a frequency of once every eight hours. The request would contain basic information about the victim system (user name, domain name, host name). If the attackers considered the system to be “interesting”, the command server would reply and activate a fully-fledged backdoor platform that would silently deploy itself inside the attacked computer. After that, on command from the attackers, the backdoor platform would be able to download and execute further malicious code.
Following the discovery, Kaspersky Lab researchers immediately contacted NetSarang. The company reacted fast and released an updated version of the software without the malicious code.
So far, according to Kaspersky Lab research, the malicious module has been activated in Hong Kong, but it could be lying dormant on many other systems worldwide, especially if the users have not installed the updated version of the affected software.
While analysing the tools techniques and procedures used by the attackers, Kaspersky Lab researchers came to the conclusion that some similarities exist that point to PlugX malware variants used by the Winnti APT, a known Chinese-speaking cyberespionage group. This information, however, is not enough to establish a precise connection to these actors.
“ShadowPad is an example of how dangerous and wide-scale a successful supply-chain attack can be. Given the opportunities for reach and data collection it gives to the attackers, most likely it will be reproduced again and again with some other widely used software component. Luckily NetSarang was fast to react to our notification and released a clean software update, most likely preventing hundreds of data stealing attacks against its clients. However, this case shows that large companies should rely on advanced solutions capable of monitoring network activity and detecting anomalies. This is where you can spot malicious activity even if the attackers were sophisticated enough to hide their malware inside legitimate software,” said Igor Soumenkov, security expert, Global Research and Analysis Team, Kaspersky Lab.
“To combat the ever-changing landscape of cyberattacks NetSarang has incorporated various methods and measures to prevent our line of products from being compromised, infected, or utilised by cyberespionage groups. Regretfully, the Build release of our full line of products on July 18th, 2017 was unknowingly shipped with a backdoor which had the potential to be exploited by its creator.
The security of our customers and user base is our highest priority and ultimately, our responsibility. The fact that malicious groups and entities are utilising commercial and legitimate software for illicit gain is an ever-growing concern and one that NetSarang, as well as others in the computer software industry, is taking very seriously.
NetSarang is committed to its users’ privacy and has incorporated a more robust system to ensure that never again will a compromised product be delivered to its users. NetSarang will continue to evaluate and improve our security not only to combat the efforts of cyber espionage groups around the world but also in order to regain the trust of its loyal user base.”
All Kaspersky Lab products detect and protect against the ShadowPad malware as “Backdoor.Win32.ShadowPad.a”.
Kaspersky Lab advises users to update immediately to the latest version of the NetSarang software, from which the malicious module has been removed, and to check their systems for signs of DNS queries to unusual domains. A list of the command server domains used by the malicious module can be found in the Securelist blogpost, which also includes further technical information on the backdoor.
ME and Africa Consumer tech spending to hit $149bn
Reaching $130bn this year, consumer spending on technology in the Middle East and Africa is expected to grow just 4% a year.
Consumer spending on technology in the Middle East and Africa (MEA) is forecast to total $130.8 billion this year, a year-on-year increase of 4.1%. According to the latest Worldwide Semiannual Connected Consumer Spending Guide from International Data Corporation (IDC), consumer purchases of traditional and emerging technologies will remain strong over the 2019–2023 forecast period, increasing at a five-year compound annual growth rate (CAGR) of 3.5% to reach $149.4 billion in 2023.
86.3% of all consumer technology spending in 2019 will be on traditional technologies such as mobile phones, personal computing devices, and mobile telecom services. Mobile telecom services (voice and data) will account for 68.7% of this amount, followed by mobile phones which will account for 26.6%. Spending growth for traditional technologies will be relatively slow, with a CAGR of 2.4% for the 2019–2023 forecast period.
“Faster connectivity, combined with declining data service costs from telecom service providers and the need for end users to use telecom services for an increasing number of devices, will ensure that consumer spending on traditional technologies will continue to grow,” says Fouad Charakla, IDC’s senior research manager for client devices in the Middle East, Turkey, and Africa.
Emerging technologies, including AR/VR headsets, drones, on-demand services, robotic systems, smart home devices, and wearables, will deliver strong growth with a five-year CAGR of 10.2%. This growth will see emerging technologies account for 17.1% of overall consumer spending in 2023, up from 13.7% in 2019. Smart home devices and on-demand services will account for around 93% of consumer spending on emerging technologies by the end of the forecast period.
“The low penetration of smart home devices in the region, combined with growing efforts from market players to educate home users on the benefits and usage of these devices, will serve as an engine of growth for consumer spending on emerging technologies,” says Charakla. “A large portion of end users are already looking to invest in devices that will improve their productivity and quality of life, two key demands that smart home devices can be positioned to fulfil.”
On-demand services represent a new addition to IDC’s Worldwide Semiannual Connected Consumer Spending Guide. “On-demand services enable access to networks, marketplaces, content, and other resources in the form of subscription-based services and includes platforms such as Netflix, Hulu, and Spotify, among others,” says Charakla. “As connected consumers juggle multiple services across their devices, it is essential for technology providers to understand how the adoption of these various technologies and services will impact their customers’ experiences in the future.”
Communication and entertainment will be the two largest use case categories for consumer technology, representing more than 79% of all spending throughout the forecast. More than 70% of all communication spending will go toward traditional voice and messaging services in 2019. Entertainment spending will be dominated by watching or downloading TV, videos and movies, as well as listening to music and downloading and playing online games. The use cases that will see the fastest spending growth over the forecast period are augmented reality games (49.5% CAGR).
The Worldwide Semiannual Connected Consumer Spending Guide quantifies consumer spending for 22 technologies in ten categories across nine geographic regions. The guide also provides spending details for 23 consumer use cases. Unlike any other research in the industry, the Connected Consumer Spending Guide was designed to help business and IT decision makers to better understand the scope and direction of consumer investments in technology over the next five years.
Could robots replace human tennis players?
While steeped in tradition, tennis has embraced technology on multiple fronts: coaching, umpiring and fan experiences. Since the early 2000s, the Sony-owned Hawk-Eye system has been assisting tennis umpires in making close calls. At Wimbledon, IBM’s Watson AI analyses fan and player reactions in real-time video footage from matches to create highlight reels just minutes after the end of a match.
Meanwhile, at the ATP Finals in London, similar data analysis is being carried out by digital services and consulting firm Infosys.
GlobalData’s Verdict deputy editor Rob Scammell hears the future of tennis discussed at a recent panel discussion about the use of data analytics and technology in the game.
Scammel writes: “Infosys has been partnered with ATP for five years, providing features such as its cloud-based platform, which leverages artificial intelligence to analyse millions of data points to gain insights into the game.
“Players and coaches can also make use of the Infosys’ Players and Coaches Portal, allowing them to “slice and dice” matches on an iPad with 1,000 data analytics combinations. This is data crunching is vital according to Craig O’Shannessy, strategy analyst for the ATP World Tour and a coach for 20 years – including for the likes of Novak Djokovic.
O’Shannessy says: “Video and data analytics is crucial for giving players an edge. It’s about finding out of 100 points, the 10 or 15 that matter the most, and explaining that these are the patterns of play that you want to repeat in these upcoming games to win those matches.”
However, although Chris Brauer, director of innovation at the Institute of Management Studies at Goldsmiths, University of London, asked whether the “inevitable conclusion” of technological innovations in tennis was removing humans from the game entirely. ATP chair umpire and manager Ali Nili suggested that while there could one day be robot players adjudicated by robot umpires, it would be an entirely different sport.
Nili told GlobalData: “At ATP, we’re most proud of our athletes. It’s our athletes which make the tennis exciting. It’s how fast they are, how strong they are being. As humanbeings, we compare them to us and we’re fascinated by the things that they’re able to do. They’re the number one attraction for anyone who comes in, watches tennis, and everything else is secondary, you know, all the data and everything else, because we try to make our athletes more appealing.”
Could robots replace human tennis players?
Raghavan Subramanian, associate vice president and head of Infosys Tennis Platform, says it’s a “very philosophical question” and that we can look to the precedent set by other ‘man vs machine’ face-offs.
“In chess, we had [Garry] Kasparov play against the computer. So I think the natural first transition will not be two robots playing against each other, but one robot, possibly playing against the best player today. That’s the first possible bridge before two robots play.”