Security researchers have identified an ongoing cyber-espionage campaign that compromised 59 computers belonging to government organizations, research institutes, think tanks and private companies from 23 countries in the past 10 days.
The attack campaign was discovered and analyzed by researchers from security firm Kaspersky Lab and the Laboratory of Cryptography and System Security (CrySyS) of the Budapest University of Technology and Economics.
Dubbed MiniDuke, the attack campaign used targeted email messages — a technique known as spear phishing — that carried malicious PDF files rigged with a recently patched exploit for Adobe Reader 9, 10 and 11.
The exploit was originally discovered in active attacks earlier this month by security researchers from FireEye and is capable of bypassing the sandbox protection in Adobe Reader 10 and 11. Adobe released security patches for the vulnerabilities targeted by the exploit on Feb. 20.
The new MiniDuke attacks use the same exploit identified by FireEye, but with some advanced modifications, said Costin Raiu, director of Kaspersky Lab’s global research and analysis team, on Wednesday. This could suggest that the attackers had access to the toolkit that was used to create the original exploit.
The malicious PDF files are rogue copies of reports with content relevant to the targeted organizations and include a report on the informal Asia-Europe Meeting (ASEM) seminar on human rights, a report on Ukraine’s NATO membership action plan, a report on Ukraine’s regional foreign policy and a report on the 2013 Armenian Economic Association, and more.
If the exploit is successful, the rogue PDF files install a piece of malware that’s encrypted with information gathered from the affected system. This encryption technique was also used in the Gauss cyber-espionage malware and prevents the malware from being analyzed on a different system, Raiu said. If run on a different computer, the malware will execute, but will not initiate its malicious functionality, he said.
Another interesting aspect of this threat is that it’s only 20KB in size and was written in Assembler, a method that’s rarely used today by malware creators. Its small size is also unusual when compared to the size of modern malware, Raiu said. This suggests that the programmers were “old-school,” he said.
The piece of malware installed during this first stage of the attack connects to specific Twitter accounts that contain encrypted commands pointing to four websites that act as command-and-control servers. These websites, which are hosted in the U.S., Germany, France and Switzerland, host encrypted GIF files that contain a second backdoor program.
The second backdoor is an update to the first and connects back to the command-and-control servers to download yet another backdoor program that’s uniquely designed for each victim. As of Wednesday, the command-and-control servers were hosting five different backdoor programs for five unique victims in Portugal, Ukraine, Germany and Belgium, Raiu said.These unique backdoor programs connect to different command-and-control servers in Panama or Turkey, and they allow the attackers to execute commands on the infected systems.
The people behind the MiniDuke cyber-espionage campaign have operated since at least April 2012, when one of the special Twitter accounts was first created, Raiu said. However, it’s possible that their activity was more subtle until recently, when they decided to take advantage of the new Adobe Reader exploit to compromise as many organizations as possible before the vulnerabilities get patched, he said.
The malware used in the new attacks is unique and hasn’t been seen before, so the group might have used different malware in the past, Raiu said. Judging by the wide range of targets and the global nature of the attacks, the attackers probably have a large agenda, he said.
MiniDuke victims include organizations from Belgium, Brazil, Bulgaria, Czech Republic, Georgia, Germany, Hungary, Ireland, Israel, Japan, Latvia, Lebanon, Lithuania, Montenegro, Portugal, Romania, Russia, Slovenia, Spain, Turkey, Ukraine, United Kingdom and the United States.
In the United States, a research institute, two pro-U.S. think tanks and a health care company have been affected by this attack, Raiu said without naming any of the victims.
The attack is not as sophisticated as Flame or Stuxnet, but is high-level nevertheless, Raiu said. There are no indications regarding where the attackers might operate from or what interests they might be serving.
That said, the backdoor coding style is reminiscent of a group of malware writers known as 29A, believed to be defunct since 2008. There’s a “666” signature in the code and 29A is the hexadecimal representation of 666, Raiu said.
A “666” value was also found in the malware used in the earlier attacks analyzed by FireEye, but that threat was different from MiniDuke, Raiu said. The question of whether the two attacks are related remains open.
News of this cyber-espionage campaign comes on the heels of renewed discussions about the Chinese cyber-espionage threat, particularly in the U.S., that were prompted by a recent report from security firm Mandiant. The report contains details about the years-long activity of a group of cyberattackers dubbed the Comment Crew that Mandiant believes to be a secret cyberunit of the Chinese Army. The Chinese government has dismissed the allegations, but the report was widely covered in the media.
Raiu said that none of the MiniDuke victims identified so far was from China, but declined to speculate on the significance of this fact. Last week security researchers from other companies identified targeted attacks that distributed the same PDF exploit masquerading as copies of the Mandiant report.
Those attacks installed malware that was clearly of Chinese origin, Raiu said. However, the way in which the exploit was used in those attacks was very crude and the malware was unsophisticated when compared to MiniDuke, he said.
HALIFAX, Nova Scotia –  A former Canadian Navy intelligence officer who pleaded guilty to espionage on Wednesday was selling secrets to the Russians for about $3,000 a month.
Sub-Lt. Jeffrey Paul Delisle showed no emotion as he acknowledged to a Nova Scotia provincial court judge that he understood the consequences of entering guilty pleas to three charges and was voluntarily giving up his right to a trial
Federal prosecutor Lyne Decarie outlined the case against Delisle during a bail hearing in March, saying he voluntarily entered the Russian embassy in Ottawa in 2007 and offered to sell information to them. A publication ban was imposed on those hearings at the time.
At the bail hearing, Decarie read portions of a police statement where Delisle reportedly described the day he walked into the embassy as “professional suicide.”
“The day I flipped sides … from that day on, that was the end of my days as Jeff Delisle,” Decarie read from his statement.
She said he claimed to police that his betrayal “was for ideological reasons” and that he wasn’t doing it for the money.”
Delisle, 41, worked at a naval communications and intelligence center in Halifax that was a multinational base with access to secret data from NATO countries.
Decarie alleged in court that Delisle had access to the facility’s secure and unsecured systems that contained information from Canada and allies, and that he shared mostly military data.
Decarie said Delisle was asked to search for Russian references in the past month on his work computer, then copy it onto a USB key and take it home with him where he uploaded it to an email program that he shared with his foreign handler.
Decarie said Delisle, a father who is divorced from his first wife, received $5,000 for the first couple transfers and then $3,000 every month. Decarie said he began doing it “following some personal problem.”
He came to the authorities’ attention when he was returning from a trip to Brazil to meet a Russian handler in the fall of 2011, Decarie said. He was carrying several thousand dollars after staying the country only four days, raising the suspicions of Canada Border Services agents who shared their concerns with the police and military.
The prosecution said some time after, the Royal Canadian Mounted Police took over the account he shared with the Russians, allowing him to think he was transmitting material to a Russian agent when “it was actually the RCMP opening the email.”
Delisle was arrested in Halifax last Jan. 13 and charged with espionage and breach of trust, making him the first person in Canada to be convicted under the country’s Security of Information Act which was passed by Parliament after the terrorist attacks on the United States on Sept. 11, 2001.
Defense lawyer Mike Taylor said the evidence against his client is overwhelming.
“You reach a point in which you say, ‘OK we’re toast,'” Taylor said in a telephone interview with The Associated Press. “Barring some catastrophic happening there was going to be a conviction.”
Taylor said at no time did his client put any Canadian troops in danger.
“There was no information that indicated where troops were or ships were,” he said.
Taylor also suggested the Russians put pressure on when at one point he tried to stop spying. Decarie said Delisle told officers that the Russians had pictures of his children.
“They had all my information. They had photos of me,” Decarie read from the statement. “They had photos of my children and I knew exactly what it was for.”
Delisle, wearing a blue hooded sweat shirt, jeans and glasses, clasped his hands and appeared unmoved as the judge asked him if he understood the consequences of the plea on Wednesday.
Taylor said no deal on sentencing was reached with the prosecution. Delisle is looking at life in prison, but Taylor said it will be up to the judge. Two days of sentencing hearings will start Jan. 10.
The Canadian military, the government and police have not revealed any details about what information is alleged to have been disclosed. A spokesman for Canada’s defense minister said they’ll reserve comment as the judicial process continues.
Delisle, who joined the navy as a reservist in 1996, became a member of the regular forces in 2001 and was promoted to an officer rank in 2008. He had access to systems with information shared by the Five Eyes community that includes Canada, the United States, Britain, Australia and New Zealand.
In damage assessments read in court, officials in the Canadian intelligence community said the breaches from 2007 to 2012 could unmask intelligence sources and place a chill on the sharing of vital security information among allies.
“Delisle’s unauthorized disclosure to the Russians since 2007 has caused severe and irreparable damage to Canadian interests,” one official wrote in a statement read by Decarie.
___
Associated Press Writer Rob Gillies in Toronto contributed to this report.
(09-25) 13:49 PDT OAKLAND — A divorce attorney pleaded not guilty Tuesday to charges that she hired a private investigator, who was a central character in Contra Costa County’s “dirty DUI” scandal, to illegally install listening devices inside the car of a client’s ex-husband.
Mary Nolan, 60, appeared in Oakland federal court, where she also pleaded innocent to four counts of tax evasion. She faces up to 15 years in prison and $750,000 in fines if convicted on all counts.
Nolan was first linked to disgraced private investigator Christopher Butler,50, in 2010, after two men told The Chronicle that she used their drunken driving arrests against them in divorce and custody battles. Both men have since filed civil lawsuits against Nolan alleging she orchestrated their arrests through Butler.
Butler pleaded guilty earlier this year to using attractive women to meet estranged husbands in bars and set them up for drunken driving arrests by police officers tied for him.
Butler, who is scheduled to be sentenced Tuesday afternoon, admitted in court papers that Nolan referred clients to him. He also estimated that he bugged between 75 and 100 cars during his tenure as a private investigators.
Nolan was never charged in connection with the drunken driving scandal that snared Butler and others.
But prosecutors alleged in their separate case against Nolan that in at least one instance she hired Butler to bug the car of a client’s spouse so she could use the recorded information against him in divorce proceedings.
Nolan’s court appearance drew the attention of Phil Dominic, 55, of Oakland, who said Nolan represented his ex-girlfriend in a 2010 custody dispute over their son. His case is not the one forming the basis of the criminal case against Nolan.
Dominic said Nolan lied about him to family court judges and destroyed his relationship with the mother of his son, as well as his child.
“This is Christmas for me,” said Dominic, who heckled Nolan as she left the courthouse.
Dominic said he was organizing a group of men whose wives were represented by Nolan to discuss taking legal action against the attorney.
“I told her one day she’d get caught,” Dominic said. “I told her, ‘One day I’m going to see you on the other side.”
Outside court, Nolan’s attorney Jay Weill declined to comment.
Nolan is scheduled to appear in court next month for further proceedings.
Justin Berton is a San Francisco Chronicle staff writer.
Cyber terrorism and espionage have been highlighted as growing threats to Australian organisations and government departments, according to a new annual report by the Australian Security Intelligence Organisation (ASIO).
The Annual Report 2011-12, which was tabled in the federal parliament this week, found that ASIO completed more than 150,000 counter terrorism security assessments during the reporting period.
“Emerging technology and an Internet-connected world offer new avenues of espionage,” read the report.
“The espionage threat is evidence by foreign intelligence services seeking agents in relevant positions, including in the Australian public service and working for Australian businesses, but also seeking access to any computer system or network holding data that could be targeted for espionage activity.”
According to the report, cyber espionage state and non-state actors continued to target Australian organisations.
ASIO pointed out that critical infrastructure, such as SCADA networks, is one area organisations need to focus on protecting in Australia.
“Critical infrastructure by its very nature poses a potential target for those who wish to do harm to Australia and so careful consideration must be given to matters having an impact on the security of critical infrastructure,” read the report.
“No single element of critical infrastructure stands alone and the potential for threats against auxiliary assets must also be considered.”
Over the 2011-12 period, ASIO provided 25 briefing sessions on potential or specific threats to critical infrastructure and produced 22 reports. These were sent to more than 153 government and private sector organisations.
Cyber terrorism
Turning to terrorism, ASIO reported that international influences through the Internet will continue to inspire some Australians to potentially join terrorism groups such as al-Qa’ida.
“Over the 12 months, al-Qa’ida and its affiliates have suffered a number of setbacks including the loss of senior figures such as Anwar al-Aulaqi, in Yemen,” read the report.
“The continuing counter-terrorism efforts of Australia’s partners in South-East Asia are also having an effect on regional extremist networks, although terrorist threats persist.”
However, ASIO conceded that these setbacks have not lessened the extent of what the report referred to as “violent jihadist” groups to promote, foster and engage in terrorism.
“The global tempo of terrorist activities, including attacks, attempted attacks, plotting, fundraising and recruitment, remains undiminished.”
CREST
The report went on to highlight ASIO’s connection with the Australian arm of the Council of Registered Ethical Security Testers (CREST) which was established in March 2012.
“CREST Australia is the product of co-ordinated engagement with industry involving ASIO, CERT Australia and the Defence Signals Directorate [DSD] and will have an important role in establishing clear and agreed standards for cyber-security testing.”
According to the report, the CREST standards will help the business sector be confident that the work conducted by CREST-accredited IT security professionals is completed with integrity, accountability and to agreed international standards. In addition, CREST Australia is affiliated with CREST Great Britain.
Security firm Kaspersky Lab recently announced the discovery of miniFlame, a small and highly flexible malicious program designed to steal data and control infected systems during targeted cyber espionage operations.
Comparison of miniFlame with other malicious programs
miniFlame, also known as SPE, was found by Kaspersky Lab’s experts in July 2012, and was originally identified as a Flame module.
However, in September 2012, Kaspersky Lab’s research team conducted an in-depth analysis of Flame’s command control servers (CC) and from the analysis found that the miniFlame module was actually an interoperable tool that could be used as an independent malicious program, or concurrently as plug-in for both the Flame and Gauss malware.
Analysis of miniFlame showed there were several versions created between 2010 and 2011, with some variants still being active in the wild.
The analysis also revealed new evidence of the cooperation between the creators of Flame and Gauss, as both malicious programs can use miniFlame as a “plug-in” for their operations.
Main findings:
• miniFlame, also known as SPE, is based on the same architectural platform as Flame. It can function as its own independent cyber espionage program or as a component inside both Flame and Gauss.
• The cyber espionage tool operates as a backdoor designed for data theft and direct access to infected systems.
• Development of miniFlame might have started as early as 2007 and continued until the end of 2011. Many variations are presumed to be created. To date, Kaspersky Lab has identified six of these variants, covering two major generations: 4.x and 5.x.
• Unlike Flame or Gauss, which had high number of infections, the amount of infections for miniFlame is much smaller. According to Kaspersky Lab’s data, the number of infections is between 10-20 machines. The total number of infections worldwide is estimated at 50-60.
• The number of infections combined with miniFlame’s info-stealing features and flexible design indicate it was used for extremely targeted cyber-espionage operations, and was most likely deployed inside machines that were already infected by Flame or Gauss.
Discovery
The discovery of miniFlame occurred during the in-depth analysis of the Flame and Gauss malware.
In July 2012 Kaspersky Lab’s experts identified an additional module of Gauss, codenamed “John” and found references to the same module in Flame’s configuration files.
The subsequent analysis of Flame’s command and control servers, conducted in September 2012, helped to reveal that the newly discovered module was in fact a separate malicious program, although it can be used as a “plug-in” by both Gauss and Flame. miniFlame was codenamed SPE in the code of Flame’s original CC servers.
Kaspersky Lab discovered six different variations of miniFlame, all dating back to 2010-2011.
At the same time, the analysis of miniFlame points to even earlier date when development of the malware was commenced – not later than 2007. miniFlame’s ability to be used as a plug-in by either Flame or Gauss clearly connects the collaboration between the development teams of both Flame and Gauss.
Since the connection between Flame and Stuxnet/Duqu has already been revealed, it can be concluded that all these advanced threats come from the same “cyber warfare” factory.
Functionality
The original infection vector of miniFlame is yet to be determined. Given the confirmed relationship between miniFlame, Flame, and Gauss, miniFlame may be installed on machines already infected by Flame or Gauss.
Once installed, miniFlame operates as a backdoor and enables the malware operators to obtain any file from an infected machine.
Additional info-stealing capabilities include making screenshots of an infected computer while it’s running a specific program or application in such as a web browser, Microsoft Office program, Adobe Reader, instant messenger service, or an FTP client.
miniFlame uploads the stolen data by connecting to its CC server (which may be unique, or “shared” with Flame’s CCs). Separately, at the request from miniFlame’s CC operator, an additional data-stealing module can be sent to an infected system, which infects USB drives and uses them to store data that’s collected from infected machines without an internet connection.
Alexander Gostev, chief security expert at Kaspersky Lab, said “miniFlame is a high precision attack tool. Most likely it is a targeted cyberweapon used in what can be defined as the second wave of a cyberattack.
“First, Flame or Gauss are used to infect as many victims as possible to collect large quantities of information. After data is collected and reviewed, a potentially interesting victim is defined and identified, and miniFlame is installed in order to conduct more in-depth surveillance and cyber-espionage.
“The discovery of miniFlame also gives us additional evidence of the cooperation between the creators of the most notable malicious programs used for cyber warfare operations: Stuxnet, Duqu, Flame and Gauss.”
