Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

2/27/2020
12:35 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

'Cloud Snooper' Attack Circumvents AWS Firewall Controls

Possible nation-state supply chain attack that cheated both cloud and on-premise firewalls acts like a "wolf in sheep's clothing," Sophos says.

[UPDATED 2/27 with new information from Sophos that the attack actually hit on-premise firewalls and servers in the victim organization. This article originally reported on the initial research by Sophos, which had concluded that the malware had the ability to breach on-site firewalls.]

RSA CONFERENCE 2020 - San Francisco - A recently spotted targeted attack employed a rootkit to sneak malicious traffic through the victim organization's AWS and on-premise firewalls and drop a remote access Trojan (RAT) onto its cloud-based servers.

Researchers at Sophos discovered the attack while inspecting infected Linux and Windows EC2-based cloud infrastructure servers running in Amazon Web Services (AWS). The attack, which Sophos says is likely the handiwork of a nation-state, uses a rootkit that not only gave the attackers remote control of the servers but also provided a conduit for the malware to communicate with their command-and-control servers. According to Sophos, the rootkit also allowed the C2 servers to remotely control servers physically located in the organization as well.

"The firewall policy was not negligent, but it could have been better," said Chet Wisniewski, principal research scientist at Sophos. The attackers masked their activity by hiding it in HTTP and HTTPS traffic. "The malware was sophisticated enough that it would be hard to detect even with a tight security policy" in the AWS firewall, he said. "It was a wolf in sheep's clothing ... blending in with existing traffic."

Sophos declined to reveal the victim organization, but said the attack appears to be a campaign to reach ultimate targets via the supply chain - with this as just one of the victims. Just who is behind the attack is unclear, but the RAT is based on source code of the Gh0st RAT, a tool associated with Chinese nation-state attackers. Sophos also found some debug messages in Chinese.

The attackers appear to reuse the same RAT for both the Linux and Windows servers. "We only observed the Linux RAT talking to one server and the Windows talking to a different control server, so we're not sure if it's even the same infrastructure," Wisniewski said. The C2 has been taken down, he noted.

Just how the attackers initially hacked into the victim's network is unclear, but Sophos suggests one possibility is the attackers infiltrated a server via SSH. They also don't have a lot of intel on the rootkit, such as which port it abused, nor do they know for sure what they were after. "It's likely a supply chain attack, targeting this organization to get all of their downstream" clients or customers, Wisniewski said. 

One of the rare aspects of the attack: It targeted Linux with a rootkit, which was called Snoopy. "They dropped the driver part of the rootkit, and called it Snoopy. Had it been called a legitimate file name on the Linux box, we probably wouldn't have noticed it," Wisniewski said. And malware for Linux to date has been relatively rare, too, with mainly cryptojackers, he added.

Cloud Snooper's techniques for now appear to be rare, but like many unique attacks like this, it's only a matter of time before they are imitated. "Every time we see something done in a targeted attack usually by a nation-state, a couple of years later cybercriminals [adopt similar tactics]," Wisniewski said.

"This case is extremely interesting as it demonstrates the true multi-platform nature of a modern attack," wrote Sophos researcher Sergei Shevchenko in the company's technical report on Cloud Snooper.

Sophos recommends deploying AWS's boundary firewall function, keeping Internet-facing servers fully patched, and hardening SSH servers to protect against Cloud Snooper.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Prevent an AWS Cloud Bucket Data Leak."

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20934
PUBLISHED: 2020-11-28
An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c.
CVE-2020-29368
PUBLISHED: 2020-11-28
An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
CVE-2020-29369
PUBLISHED: 2020-11-28
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.
CVE-2020-29370
PUBLISHED: 2020-11-28
An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.
CVE-2020-29371
PUBLISHED: 2020-11-28
An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.