Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/25/2019
05:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russian Threat Group May Have Devised a 'Man-on-the-Side' Attack

Data from an intrusion last year suggests Iron Liberty group may have a new trick up its sleeve, Secureworks says.

Iron Liberty, a Russia-based cyber espionage group known for targeting energy, nuclear, and defense organizations worldwide, may have developed a dangerous new technique called a "man-on-the side" attack.

Secureworks warned about the new threat in a report this week describing a "man-on-the-side" (MOTS) attack to install malware. The security firm says MOTS differs from a typical man-in the-middle (MITM) attack.

"The difference between MITM and MOTS is straightforward," says Don Smith, senior director of the Counter Threat Unit at Secureworks. "With MITM, the attacker is present on infrastructure the traffic is traversing and can tamper with it," he says. "With MOTS, the attacker has sufficient access to observe and inject traffic which through timing/bandwidth is consumed by the victim before the legitimate reply arrives."

The security vendor's theory is based on its analysis of a campaign last year where Iron Liberty actors managed to install a malware tool called Karagany on a target system without leaving any trace of how they did it. According to Secureworks, its research showed no evidence of a phishing email, drive-by-download, or a malicious link being used to drop the malware on the system.

Secureworks' forensic analysis showed that Karagany was installed on the system shortly after its user initiated a legitimate request to download Adobe Flash over HTTP from Adobe's official website. Logs showed that Karagany was installed on the system in the short period of time during when the user request was initiated and the Adobe file was downloaded.

Secureworks found that Kargany files were dropped on the system just 20 seconds after the initial Flash Player binary was downloaded, and by 27 seconds, additional malicious files were downloaded on the system.

Multiple Explanations

"There are several credible explanations for how the Karagany payload was delivered alongside the Adobe installer file," Secureworks said in its report. But none of them appeared very likely in this case, the company said.

For example, the malware could have been downloaded if Adobe's website had been compromised. But Secureworks' investigation showed no indication that such a thing had happened during the compromise timeframe.

Another possibility was that someone with access to the victim organization's internal or gateway systems had intercepted and manipulated traffic between Adobe and the infected system in a typical MITM attack. Here again, Secureworks was unable to find any signs that such activity had taken place. A third possibility, which Secureworks similarly deemed unlikely, was a Border Gateway Protocol (BGP) attack where the user's traffic was routed through attacker-controlled systems.

Instead, they believe the Iron Liberty actors likely managed to compromise a router outside the victim organization, and then used it to intercept the Adobe installer request and return a Trojanized response, Secureworks said.

"Being 100% clear, the traffic injection we saw in these cases could have come from Man on the Side or from Man in the Middle," Smith says. "We do not know how the fraudulent traffic was injected. [It] could have been router compromise or could have been traffic injection."

For enterprises, attacks like these are another reason not to implicitly trust anything on the Internet. Protecting against a man-on-the side attack is no different from dealing with a man-in-the-middle attack, Smith says.

Some common mitigating tactics include using SSL encryption and checking the hashes of files that are downloaded from the Internet to make sure they match with the original file.

With a man-on-the-side attack, there are two parties trying to respond to the same request and the bad actor's goal is to get in first, Smith says.

The only way to detect such activity would be to monitor the sequence of packets arriving in response to a request and looking for out of sequence packets arriving and likely being discarded. "You need to be extremely well instrumented to detect it," Smith says.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
7/27/2019 | 2:26:33 PM
Ways to address the MOTS issue

"The difference between MITM and MOTS is straightforward," says Don Smith, senior director of the Counter Threat Unit at Secureworks. "With MITM, the attacker is present on infrastructure the traffic is traversing and can tamper with it," he says. "With MOTS, the attacker has sufficient access to observe and inject traffic which through timing/bandwidth is consumed by the victim before the legitimate reply arrives."

 Wouldn't it be better to implement IPv6 and utilize its capabilities, it has a number of advantages that IPv4 does not:
  • IPv6 can run end-to-end encryption
  • Widespread adoption of IPv6 will, therefore, make man-in-the-middle attacks significantly more difficult
  • IPv6 also supports more-secure name resolution

Also, why not implement ways to block countries, this can be done using Powershell and IPtables/UFW, the user would have to do it from an ingress and egress standpoint. I would think this would be a way to mitigate this issue because the payload could not be downloaded from "Command and Control".

Something to think about.

Todd
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4108
PUBLISHED: 2019-11-14
Multiple unspecified vulnerabilities in Cryptocat Project Cryptocat 2.0.18 have unknown impact and attack vectors.
CVE-2018-12207
PUBLISHED: 2019-11-14
Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.
CVE-2019-0117
PUBLISHED: 2019-11-14
Insufficient access control in protected memory subsystem for Intel(R) SGX for 6th, 7th, 8th, 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families; Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics may allow a ...
CVE-2019-0123
PUBLISHED: 2019-11-14
Insufficient memory protection in Intel(R) 6th Generation Core Processors and greater, supporting SGX, may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2019-0124
PUBLISHED: 2019-11-14
Insufficient memory protection in Intel(R) 6th Generation Core Processors and greater, supporting TXT, may allow a privileged user to potentially enable escalation of privilege via local access.