Industrial Software Site Attacked

Wednesday, September 3, 2014 @ 02:09 PM gHale


An industrial software firm ended up hit with a sophisticated reconnaissance tool poised for a either a possible attack on incoming traffic or to learn important data points.

But to no avail as the incident ended up detected last week by researchers from security firm AlienVault who found rogue code injected into the website of a big industrial company they refused to name.

RELATED STORIES
Targeted Attack: Device Maker Hit
Exploit Kit Remains Adaptive
Exploit Kit Delivers Double Payload
Attack on Tor to Deanonymize Users

“The website is related to software used for simulation and system engineering in a wide range of industries, including automotive, aerospace, and manufacturing,” said Jaime Blasco, director of the AlienVault Labs in a blog post.

“The attackers were able to compromise the website and include code that loaded a malicious Javascript file from a remote server,” he said. “This Javascript file is a framework for reconnaissance that the attackers call “Scanbox.”

Unlike most watering hole attacks where hackers inject malware-carrying exploits into websites visited by their intended targets, the purpose of this attack was only to gain detailed information about visiting computers.

In addition to collecting basic information like the browser type, computer IP (Internet Protocol) address, operating system and language, Scanbox uses advanced techniques to detect which security programs are on the visitor’s system, he said.

According to the AlienVault analysis, Scanbox also tests if the computer uses Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) anti-exploitation tool and enumerates the locally installed versions of Adobe Flash, Microsoft Office, Acrobat Reader and Java — programs frequently targeted with Web-based exploits to install malware.

AlienVault researchers have seen some of the techniques used by Scanbox in other watering hole campaigns this year.

In this recent attack, the framework also deployed a JavaScript-based keylogger on the compromised site that recorded all keystrokes typed visitors, including passwords and other sensitive data entered into Web forms, Blasco said.

“This is a very powerful framework that gives attackers a lot of insight into the potential targets that will help them launching future attacks against them,” he said.

Attacks might already be happening, as the AlienVault researchers found evidence the server hosting the Scanbox framework also served Java exploits. The AlienVault blog post contains domain names and IP addresses that companies should search for in their traffic logs to determine if they were a target.



Leave a Reply

You must be logged in to post a comment.