Backdoor Hidden in Software

Tuesday, August 15, 2017 @ 05:08 PM gHale

A backdoor planted in a server management software product used by hundreds of large businesses worldwide, including manufacturers, allows attackers to download malicious modules or steal data, researchers said.

NetSarang, the affected software vendor, learned about the issue and removed the malicious code and released an update for customers, said researchers at Kaspersky Lab who found the problem.

Attackers Using New Backdoor
Malware at Bargain Price of $7
Backdoor Uses Legit Video App
Companies Held for Ransom: Report

The backdoor code, called ShadowPad, is one of the largest known supply-chain attacks.

Just last month a financial institution reached out to Kaspersky Lab’s Global Research and Analysis Team (GReAT). It appears the organization’s security specialists were worried about suspicious DNS (domain name server) requests originating on a system involved in the processing of financial transactions.

Further investigation showed the source of these requests was server management software produced by a legitimate company and used by hundreds of customers in industries like financial services, education, telecoms, manufacturing, energy and transportation.

The most worrying finding was the vendor did not mean for the software to make these requests.

Kaspersky analysis showed the suspicious requests were the result of a malicious module hidden inside a recent version of the legitimate software.

Following the installation of an infected software update, the malicious module would start sending DNS-queries to specific domains (its command and control server) at a frequency of once every eight hours. The request would contain basic information about the victim’s system (user name, domain name, host name). If the attackers considered the system to be “interesting,” the command server would reply and activate a fully-fledged backdoor platform that would silently deploy itself inside the attacked computer. After that, on command from the attackers, the backdoor platform would be able to download and execute further malicious code.

Following the discovery, Kaspersky Lab researchers immediately contacted NetSarang. The company reacted fast and released an updated version of its software without the malicious code.

The malicious module has been activated in Hong Kong, but it could be lying dormant on many other systems worldwide, especially if users have not installed the updated version of the affected software, researchers said.

“ShadowPad is an example of how dangerous and wide-scale a successful supply-chain attack can be. Given the opportunities for reach and data collection it gives to the attackers, most likely it will be reproduced again and again with some other widely used software component,” said Igor Soumenkov, security researcher on the Global Research and Analysis Team at Kaspersky Lab. “Luckily, NetSarang was fast to react to our notification and released a clean software update, most likely preventing hundreds of data-stealing attacks against its clients; however, this case shows that large companies should rely on advanced solutions capable of monitoring network activity and detecting anomalies. This is where you can spot malicious activity even if the attackers were sophisticated enough to hide their malware inside legitimate software.”

NetSarang released a statement regarding the incident:

“To combat the ever-changing landscape of cyberattacks, NetSarang has incorporated various methods and measures to prevent our line of products from being compromised, infected or utilized by cyberespionage groups. Regretfully, the Build release of our full line of products on July 18, 2017 was unknowingly shipped with a backdoor, which had the potential to be exploited by its creator.

“The security of our customers and user base is our highest priority and ultimately, our responsibility. The fact that malicious groups and entities are utilizing commercial and legitimate software for illicit gain is an ever-growing concern and one that NetSarang, as well as others in the computer software industry, is taking very seriously.

“NetSarang is committed to its users’ privacy and has incorporated a more robust system to ensure that never again will a compromised product be delivered to its users. NetSarang will continue to evaluate and improve our security not only to combat the efforts of cyberespionage groups around the world but also in order to regain the trust of its loyal user base.”

Leave a Reply

You must be logged in to post a comment.