Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/25/2019
05:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russian Threat Group May Have Devised a 'Man-on-the-Side' Attack

Data from an intrusion last year suggests Iron Liberty group may have a new trick up its sleeve, Secureworks says.

Iron Liberty, a Russia-based cyber espionage group known for targeting energy, nuclear, and defense organizations worldwide, may have developed a dangerous new technique called a "man-on-the side" attack.

Secureworks warned about the new threat in a report this week describing a "man-on-the-side" (MOTS) attack to install malware. The security firm says MOTS differs from a typical man-in the-middle (MITM) attack.

"The difference between MITM and MOTS is straightforward," says Don Smith, senior director of the Counter Threat Unit at Secureworks. "With MITM, the attacker is present on infrastructure the traffic is traversing and can tamper with it," he says. "With MOTS, the attacker has sufficient access to observe and inject traffic which through timing/bandwidth is consumed by the victim before the legitimate reply arrives."

The security vendor's theory is based on its analysis of a campaign last year where Iron Liberty actors managed to install a malware tool called Karagany on a target system without leaving any trace of how they did it. According to Secureworks, its research showed no evidence of a phishing email, drive-by-download, or a malicious link being used to drop the malware on the system.

Secureworks' forensic analysis showed that Karagany was installed on the system shortly after its user initiated a legitimate request to download Adobe Flash over HTTP from Adobe's official website. Logs showed that Karagany was installed on the system in the short period of time during when the user request was initiated and the Adobe file was downloaded.

Secureworks found that Kargany files were dropped on the system just 20 seconds after the initial Flash Player binary was downloaded, and by 27 seconds, additional malicious files were downloaded on the system.

Multiple Explanations

"There are several credible explanations for how the Karagany payload was delivered alongside the Adobe installer file," Secureworks said in its report. But none of them appeared very likely in this case, the company said.

For example, the malware could have been downloaded if Adobe's website had been compromised. But Secureworks' investigation showed no indication that such a thing had happened during the compromise timeframe.

Another possibility was that someone with access to the victim organization's internal or gateway systems had intercepted and manipulated traffic between Adobe and the infected system in a typical MITM attack. Here again, Secureworks was unable to find any signs that such activity had taken place. A third possibility, which Secureworks similarly deemed unlikely, was a Border Gateway Protocol (BGP) attack where the user's traffic was routed through attacker-controlled systems.

Instead, they believe the Iron Liberty actors likely managed to compromise a router outside the victim organization, and then used it to intercept the Adobe installer request and return a Trojanized response, Secureworks said.

"Being 100% clear, the traffic injection we saw in these cases could have come from Man on the Side or from Man in the Middle," Smith says. "We do not know how the fraudulent traffic was injected. [It] could have been router compromise or could have been traffic injection."

For enterprises, attacks like these are another reason not to implicitly trust anything on the Internet. Protecting against a man-on-the side attack is no different from dealing with a man-in-the-middle attack, Smith says.

Some common mitigating tactics include using SSL encryption and checking the hashes of files that are downloaded from the Internet to make sure they match with the original file.

With a man-on-the-side attack, there are two parties trying to respond to the same request and the bad actor's goal is to get in first, Smith says.

The only way to detect such activity would be to monitor the sequence of packets arriving in response to a request and looking for out of sequence packets arriving and likely being discarded. "You need to be extremely well instrumented to detect it," Smith says.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
7/27/2019 | 2:26:33 PM
Ways to address the MOTS issue

"The difference between MITM and MOTS is straightforward," says Don Smith, senior director of the Counter Threat Unit at Secureworks. "With MITM, the attacker is present on infrastructure the traffic is traversing and can tamper with it," he says. "With MOTS, the attacker has sufficient access to observe and inject traffic which through timing/bandwidth is consumed by the victim before the legitimate reply arrives."

 Wouldn't it be better to implement IPv6 and utilize its capabilities, it has a number of advantages that IPv4 does not:
  • IPv6 can run end-to-end encryption
  • Widespread adoption of IPv6 will, therefore, make man-in-the-middle attacks significantly more difficult
  • IPv6 also supports more-secure name resolution

Also, why not implement ways to block countries, this can be done using Powershell and IPtables/UFW, the user would have to do it from an ingress and egress standpoint. I would think this would be a way to mitigate this issue because the payload could not be downloaded from "Command and Control".

Something to think about.

Todd
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-0404
PUBLISHED: 2019-12-11
SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure.
CVE-2019-0405
PUBLISHED: 2019-12-11
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure.
CVE-2019-0395
PUBLISHED: 2019-12-11
SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launchpad, leading to Stored Cross Site Scripting vulnerability.
CVE-2019-0398
PUBLISHED: 2019-12-11
Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to an authenticated user to send unintended request to the web server, leading to Cross Site Request Forgery.
CVE-2019-0399
PUBLISHED: 2019-12-11
SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allows a user to discover accounting information of the Projects in Project dashboard, leading to Information Disclosure.