Connect with us

News

StoneDrill malware coming to wipe you

Published

on

Kaspersky Lab has discovered StoneDrill – a wiper that destroys everything on an infected computer and also features advanced anti-detection techniques and espionage tools.

Kaspersky Lab’s Global Research and Analysis Team has discovered a new sophisticated wiper malware, called StoneDrill. Just like another infamous wiper, Shamoon, it destroys everything on the infected computer. StoneDrill also features advanced anti-detection techniques and espionage tools in its arsenal. In addition to targets in the Middle East, one StoneDrill target has also been discovered in Europe, where wipers used in the Middle East have not previously been spotted in the wild.

In 2012, the Shamoon (also known as Disttrack) wiper made a lot of noise by taking down around 35,000 computers in an oil and gas company in the Middle East. This devastating attack left 10% of the world’s oil supply potentially at risk. However, the incident was one of a kind, and after it the actor essentially went dark. In late 2016 it returned in the form of Shamoon 2.0 – a far more extensive malicious campaign using a heavily updated version of the 2012 malware.

While exploring these attacks Kaspersky Lab researchers unexpectedly found malware that was built in a similar “style” to Shamoon 2.0. At the same time, it was very different and more sophisticated than Shamoon. They named it StoneDrill.

StoneDrill – a wiper with connections:

It is not yet known how StoneDrill is propagated, but once on the attacked machine it injects itself into the memory process of the user’s preferred browser. During this process it uses two sophisticated anti-emulation techniques aimed at fooling security solutions installed on the victim machine. The malware then starts destroying the computer’s disk files.

So far, at least two targets of the StoneDrill wiper have been identified, one based in the Middle East and the other in Europe.

Besides the wiping module, Kaspersky Lab researchers have also found a StoneDrill backdoor, which has apparently been developed by the same code writers and used for espionage purposes. Experts discovered four command and control panels which were used by attackers to run espionage operations with help of the StoneDrill backdoor against an unknown number of targets.

Perhaps the most interesting thing about StoneDrill is that it appears to have connections to several other wipers and espionage operations observed previously. When Kaspersky Lab researchers discovered StoneDrill with the help of Yara-rules created to identify unknown samples of Shamoon, they realised they were looking at a unique piece of malicious code that seems to have been created separately from Shamoon. Even though the two families – Shamoon and StoneDrill – don’t share the exact same code base, the mind-set of the authors and their programming “style” appear to be similar. That’s why it was possible to identify StoneDrill with the Shamoon-developed Yara-rules.

Code similarities with older known malware were also observed, but this time not between Shamoon and StoneDrill. In fact StoneDrill uses some parts of the code previously spotted in the NewsBeef APT, also known as Charming Kitten – another malicious campaign which has been active in the last few years.

“We were very intrigued by the similarities and comparisons between these three malicious operations. Was StoneDrill another wiper deployed by the Shamoon actor? Or are StoneDrill and Shamoon two different and unconnected groups that just happened to target Saudi organisations at the same time? Or, two groups which are separate but aligned in their objectives? The latter theory is the most likely one: when it comes to artefacts we can say that while Shamoon embeds Arabic-Yemen resource language sections, StoneDrill embeds mostly Persian resource language sections. Geopolitical analysts would probably be quick to point out that both Iran and Yemen are players in the Iran-Saudi Arabia proxy conflict, and Saudi Arabia is the country where most victims of these operations were found. But of course, we do not exclude the possibility of these artefacts being false flags,” said Mohamad Amin Hasbini, Senior Security Researcher, Global Research and Analysis Team, Kaspersky Lab.

Kaspersky Lab products successfully detect and block the malware related to Shamoon, StoneDrill, and NewsBeef.

In order to protect organisations from such attacks, Kaspersky Lab security experts advise the following:

  • Conduct a security assessment of the control network (i.e. a security audit, penetration testing, gap analysis) to identify and remove any security loopholes. Review external vendor and 3rd party security policies in case they have direct access to the control network.
  • Request external intelligence: intelligence from reputable vendors helps organisations to predict future attacks on the company’s industrial infrastructure. Emergency response teams, such as Kaspersky Lab’s ICS CERT, provide some cross-industry intelligence free of charge.
  • Train your employees, paying special attention to operational and engineering staff and their awareness of recent threats and attacks.
  • Provide protection inside and outside the perimeter. A proper security strategy has to devote significant resources to attack detection and response in order to block an attack before it reaches critically important objects.
  • Evaluate advanced methods of protection: including regular integrity checks for controllers, and specialised network monitoring to increase the overall security of a company and reduce the chances of a successful breach, even if some inherently vulnerable nodes cannot be patched or removed.

Continue Reading

Featured

Data journalism takes top prize in revamped awards

Published

on

The entries to the 2018 Vodacom Journalist of the Year Awards were extraordinarily varied and of an excellent standard, with new categories introduced which are based on content as opposed to platforms. This year, the judges decided that two entries were equally worthy of the coveted Vodacom Journalist of the Year Award.

The first co-winning entry, in the new Data Journalism category, is a set of stories by Alastair Otter and Laura Grant of Media Hack which showed how Data Journalism is shaping the future. The second co-winning entrant is Bongani Fuzile of the Daily Dispatch for his articles in the investigative category on how migrant workers were being ripped off by pension deductions (full citations below).

Convenor of the judging panel Ryland Fisher says: “This year we modernised the 12 categories that journalists could enter their work in and the change was embraced by entrants. In a turbulent time for media, the 2018 entries once again proved that there are excellent South African journalists delivering praiseworthy work, and we commend them for finding new and innovative ways to cover the news.”

Takalani Netshitenzhe, Chief Officer for Corporate Affairs at the Vodacom Group, says: “Vodacom is proud of its 17-year association with these prestigious awards, which make an important contribution to our society through the recognition of journalistic excellence. I’d like to congratulate all of tonight’s winners and, as always, I’d like to pay tribute to our hardworking judges. Ryland Fisher, Mathatha Tsedu, Arthur Goldstuck, Collin Nxumalo, Elna Rossouw, Patricia McCracken, Megan Rusi, Mary Papayya, Albe Grobbelaar and Obed Zilwa: thank you for making these awards a continued success.”

Veteran journalist and media stalwart Ms Amina Frense is the winner of the 2018 Vodacom Journalist of the Year Lifetime Achiever AwardShe has spent decades in mainstream media both locally and internationally. She is a former Managing Editor: News and Current Affairs at the SA Broadcasting Corporation. She has worked in many countries abroad as a producer and a foreign correspondent, has written two books and is also a founding member of SANEF where she still serves as a council member (full citation below).

The overall winners share the R100 000 main prize. National winners in the various categories are as follows, with each winner taking home R10 000:

SPORT

The entries in this category were of an exceptionally high standard. One entrant stood out and became the unanimous winner. This journalist showed an exceptional skill for story-telling and for finding unexpected angles and unknown facts. For his stories about Musangwe’s fight for recognitionAge cheating in SA football, and Hansie Cronje revisited, the winner is Ronald Masinda, and the team of Gift Kganyago, Nceba Ntlanganiso and Charles Lombard from eSAT TV.

Click here to see who won the awards for data journalism , CSI/sustainability and photography.

Previous Page1 of 5

Continue Reading

Featured

Cons exploit Telegram ICO

Published

on

Kaspersky Lab researchers have uncovered dozens of highly convincing fake websites claiming to be investment sites for an initial coin offering (ICO) by the Telegram messaging service. Many of these websites appear to belong to the same group. In one case alone, tens of thousands of US dollars’ worth of cryptocurrency were stolen from victims believing they were investing in ‘Grams’, Telegram’s rumoured new currency. Telegram has not officially confirmed an ICO and has warned people about fraudulent investor sites.

In late 2017, stories started to circulate that the Telegram messaging service was launching an initial coin offering (ICO) to finance a blockchain platform based on its TON (Telegram Open Network) technology. Unverified technical documentation was posted online, but there appears to have been no confirmation from Telegram itself. The resulting confusion seems to have allowed fraudsters to capitalise on investor interest by creating fake sites and stealing vast sums of money.

Kaspersky Lab researchers have discovered dozens of such sites, possibly belonging to the same group, claiming to sell tokens for ‘Grams’ and inviting investors to pay with cryptocurrencies including Bitcoin, Ethereum, lice litecoin, dash and Bitcoin dash. A record of transactions on one site revealed that the scammers were able to steal at least $35,000 US dollars’ worth of Ethereum from investors.

The researchers found that some of the websites were so convincing that even after Telegram and others began to issue warnings, they were still able to recruit potential investors. Most use a secure connection, require registration and generate a unique online wallet for each new victim, making it harder to track the money.

Judging by the content of the fake websites, it appears they may have common ownership. For example, several have the exactly the same ‘Our Team’ section.

“ICOs are a fairly risky investment and many people don’t yet fully understand how they work, so it is not surprising that high quality fake websites, with seemingly reassuring features such as a secure connection and registration are successful at luring people in. People wishing to invest in an ICO would do well to check with the company behind it and make sure they know exactly who they are giving their money to, or they may never see it again,” said Nadezhda Demidova, Lead Web-Content Analyst, Kaspersky Lab.

Kaspersky Lab offers the following advice for users considering investing in an ICO:

  • Check for warning signs: for example, some of the fake Telegram ICO websites had the same wrong image next to the name of Telegram’s Chief Product Officer.
  • Do your homework: always check with the brand’s official site to verify the legitimacy of the investment site and, if necessary contact the company’s ICO teams before investing any money or currency.
  • Use reliable security solutions such as Kaspersky Internet Security and Kaspersky Internet Security for Android, which will warn you if you try to visit fake internet pages.

Continue Reading

Trending

Copyright © 2018 World Wide Worx