An exploration into the potential power of collaborative, mission-focused APT research groups

This post will be one of several that will reveal the origins of the investigation, research, and analysis group effort behind what has been .


The formation, vision, and strategy behind Starlight was a direct result of the and Intellectual Property data theft of vital technical information from RSA that forms the underpinnings of Authentication Frameworks used in thousands of companies and Government organizations worldwide.

(something you have , something you know PIN/PASSWORD) attempts to increase the attackers work effort when they want to in order to compromise protected data.  This data can be in the form of content portals, or even access to entire Internal sensitive networks.

When the was in the press, it shell-shocked the industry.  There was very little information in the public about the event.  Many industry experts simply fed off the news cycle, made predictions, or speculated.  The incredible thing however is the silence from the experts who should have had the most intelligence and data to share, research and discuss.  The lack of knowledge behind what malware was used, what IP/DNS infrastructure was leveraged, who else was attacked, who was doing the attacking, what where they targeting, and what tactics, techniques, and procedures were used to facilitate the attack were all lacking.  Many companies and individuals wanted the information to better protect their own networks, however where found to be lacking useful information to detect the same threat.

It was later revealed that the attack was a success, and the key intellectual property was obtained to engineer a technical circumvention / spoofing of a users authentication session when using a 2-factor method with the RSA Token.  A wave of attacks against in the Defense Industrial Base followed shortly after the RSA compromise confirming the mission of the Threat Groups.

Meet the other guy, across the pond, using his Shell, all up in your BASE, nomming on your data.

Antivirus and other security companies have incredible resources and sensor networks at their disposal providing a wealth of threat intelligence for those that seek to do the research, connect the dots and tell a story.   Sadly however many times that data goes undiscovered or unused, buried under a ton of other data, devoid of operational context which is so important these days when researching threats.

It is critical that you know what you are dealing with when handling a threat in your organization.  Is Nation-State espionage?  Is it CyberCrime?  Is it Hackivism, or simply a curious teenager.  If companies have not yet realized, the most potent threat to their long term survival is an estimated 15-30 voracious Chinese based Threat Groups that have been systematically and successfully pillaging America and its Allies systems and Intellectual Property since at least 2003.

Some of these groups are direct components of . Others are Chinese contractors or affiliates.  For those not familiar with the Chinese Government, it is tightly and intimately interwoven within the entire society.  In many cases it is hard to discern were Government influence ends and “Private” control begins.  However there is no doubt when it comes to the operational unit of a military branch where the orders come from.  The is to use its technical capabilities in Computer Network Exploitation, to , infiltrate, and steal any and all data that meets its intelligence tasking requirements for obtaining information related to is Military Modernization and Economic Growth objectives.

Over the past year, Government officials active and retired, congressmen, and security researchers have come out explicitly this to be the case.  They should know.  There is YEARS of  linking this activity to exact groups and individuals behind these activities.  The old tired adages of how ATTRIBUTION is too hard of a problem, and how its impossible to track the source of an attack are a RED HERRING in this industry.  Do not believe it for a second.  If your told that you are being lied to.  The abilities of Nation States to conduct Multi-INT intelligence analysis on threats is unparalleled.  This intelligence supports the missions of Counter-Intelligence, Law Enforcement, and provides data for Strategy and National Leadership Decision Making.

Future postings here will reveal many of the lessons learned through this experience.

It is my hope that it inspires the community of security experts, investigators, forensic professionals, incident responders, and malware analysts to recognize clearly that there is a dire need to come together as one to share their threat data, become educated on the specific technical threats and the groups behind them, and operate as a single unified entity in confronting the single most damaging threat to our future,  as “the greatest transfer of wealth through theft and piracy in the history of the world and we are on the losing end of it.”

I will conclude this post with the original email that I posted to a private research list, in which I issued a community call for action, a Paul Revere’s ride if you will.

Many highly intelligent and dedicated people across many industries and sectors heeded the call, and signed up for the effort.  They all did not seek glory or recognition for their efforts.  They recognized the vital need for a deeply collaborative effort that was mission focused with the goal of centralizing the collective APT knowledge each group member could muster for the aggregate benefit of all.  The process by which members where invited into the organization was based on a that many other groups use as a basis for membership.

The group formed a pact of anonymity with regards to their identities and affiliations.   They produced excellent work, in-depth technical research, and collaborated continuously and richly to the effort and mission.  This privacy will be honored in this and future postings.  Their contributions and dedication to the group made Operation Starlight a successful model for future collaborative efforts challenged with APT research.

Future postings will cover:

  • The dynamics of group formation
  • The challenges of cyber intelligence sharing
  • Targeting the right expertise for inclusion
  • Contribution of resources to the effort
  • Communication and content sharing mechanisms
  • The data that kicked the RSA investigation into high gear
  • The 3 Groups that attacked RSA and their malware / methods
  • Dealing with Press Inquiries
  • The challenges of dealing with Attribution Research
  • APT Malware Analysis and forensic artifacts
  • Timelining Zero Day Exploit Research in Embedded Attacks tied to China
  • Spearfish attack research and Shellcode Analysis
  • Network intelligence, DNS monitoring
  • Scaling and analysis issues with regard to information overload
  • Information organization
  • Threat Group enumeration and categorization
  • CyberWeapon attribution and naming challenges
  • Historical Threat Group campaigns
  • Victim Identification and Intelligence
  • Decoder development
  • Operational Monitoring
  • Disruption Operations
  • Novel and GroundBreaking Game Changing Strategies
  • Lessons in Crisis Management
  • Victim Notification and LE interactions
  • CyberThreat Overclassification
  • The Profit/Patriotism Conundrum and Ambulance Chasing
  • Big Data Mining
  • Smear Campaigns and Information Operations
  • and many other interesting topics

I hope you will enjoy my sharing of experiences and wish that it may inspire you to think differently about things with regard to APT research and how you can make a difference.  There is now a ton of open intelligence that any enterprising researcher can leverage to peel back the onion, connect the dots, and the come the definitive conclusion that our networks our undefendable, there is a desperate need for gamechanging strategies, and our Government is to constrained by policy and political will to do anything about the issue with regards to China until it is too late.

The communication and application of punitive severe consequences in the form of Economic, Trade, Financial pain combined with a massive tactical offensive cyber counter-attack on all CN APT CNE infrastructure, actors, and resources is partially what is needed to show that we mean business. Developing cadres of patrotic operation under letters of combined with the of a also .  This should be preferably done in close collaboration with our Allied friends that recognize that they too are under the same threats and have the will to do something about it.  If not, we might as well concede, and step back from our positions as the leaders of the free world.  I hope the Communist Party of China treats you kindly.

in the sand and denying it will not make the data leaving your networks slow down anytime soon.  We are a , however the and of  speaks volumes about our efforts to roll back the threat or even demonstrate an effective deterrence.

The email that started it all. (Click image to view entire email)

We had better collectively get in gear on this.  Someday lives will be  and we will be looking down the barrel of our own innovation and weapons…


March 27, 2011

No more echo chambers.

March 25, 2011

Well it seems like I have acquired something of a following, however it still seems like not many are interested in adding significant discussion or views to lend to the debate.  I invite any and all to post their thoughts and ideas, or make recommendations for research.

Twitter: diocyde

Gmail: [email protected]

Malware has reached the point of overwhelming the collective average intelligence of the normal operator.  With a plethora of threats, and an infinate amount of possibilities and variations the complexity of such threats will eventually overwhelm the singular human cognition capacity.  This is why we have seen over the past few years the “dumbing down” of ability for AV protections which struggle to deal with tens of millions of samples a year and hundreds of thousands of signatures.  Lost in all the automated analysis is the digital nuggets of intelligence that are missed, or only noted in some obscure report with no operational context. 

One case in point is the clear chaos and confusion of the antiquated CARO naming convention for categorization and naming of malware.  EVERY single AV company does it differently.  No one can agree on a naming convention.  Names of bots/trojans are OBFUSCATED for pointless worthless reasons, adding to the confusion and noise level.  For example, our latest Adobe Flash O-day threat combined with targeted attacks.  F-Secure, after  launched in a highly targeted fashion by actors that are causing a tremendous amount of digital carnage, does its analysis of the exploit, and then decides to name the actual (digital weapon) payload some ridiculous name (Trojan.Agent.ARKJ).   Granted this name (dumbing down) has been going on for years, however when the context of important attacks increasing public awareness to such a high degree, the Tools and arsenal of threat actors should be made known to the general public.  One of the reason security response teams just sort of reimage and move about their business is that they have no ability to triage a really damaging threat unless they do a full static and dynamic analysis of it.

The APT threat group based in Shanghai Military Region Tactical reconnaissance Bureau that has been discussed in earlier posts has malware and malware analysis (for example threat expert) and Virus Total reports that link that specific malware and its evolution back to 2005!  Coincidently this is one of the threats that gets automatically analyzed and classified as blah blah Trojan/backdoor-DSG or whatever the stupid CARO implementation spits out.  additionally some malware is named but the name is a scrambled variant of the Author, the callback domain, the Victim, or some attribution string or mutex in the malware but for some reason AV companies feel its “important” to protect the privacy of malicious cyber actors.  This helps absolutely no one and serves to dissipate the tactical/operational/and strategic importance of a particular attack, as well as misdirect attention of the public away from the victim and the damage being done.  

The espionage attacks of Aurora/Ghostnet/Shadownet and others have not only popularized the naming of malcode but given it a tremendous amount of publicity and attention from researchers WITH the time to rip apart the code and possibly .  additionally its this kind of publicity that engenders the non-geek world to stand up and take notice that their lunch is getting eaten on a daily basis.  AV companies in the past decade and in the early days sought to take away the EGO tripping of virus writers by refusing to grant them infamy by naming a virus after then.  I say the times have changed.  I say that true attribution intelligence should be disgorged from the holder of it and attached like a stinking rotting corpse to the samples. 

Props to  for actually doing this by naming this latest Payload Trojan.Linxder after the Chinese CNE operators hacker handle.   Of course Fireeye is not a AV company per say but the days of just having AV companies is long gone as now everyone is in the cyber space vendor community and managed service sector.

Here is a challenge to Any Reverse Engineer / Malware Analyst / Cyber Intelligence Threat Analyst / or Security Researcher.

  • Go to Mila’s excellent  site
  • Download the excellent archives of 99.99% APT attack payloads
  • Discover the hidden nuggets of Attribution Intelligence
  •    that are used and write a small analysis of these findings. 
  • I will post them as a comment to this blog and I will approve them for review by the entire community.

There are tons of techniques that are being used, abused, and engineered that are enabling the horrible detection rates we are seeing today.

If the new rules of the road are that governments, militaries, and critical infrastructure, and commercial and non-profit organizations are going to be targets for the long term, we might as well serve ourselves by quit calling it APT and start calling it by its real name.  The actual units and operators that are responsible . 

If threat actors use highly customized code this is a Weakness.  This means that if a victim gets attacked with a specialized piece of espionage malware, its analyzed, dissected, and publicized, then other organizations can digitally investigate their own infrastructures looking for the same threat.  If they find it, they know they just got screwed as well.  This is called HERD Defense.  An attack on one member of the herd might take out an individual, but the rest of the herd is now alerted and on the defense whenever they see the same thing or similar.

RSA can start by giving us samples to analyze, and full disclosure briefing.

One of the things AV companies can do is start writing in depth public analysis reports/blogs about the bunch of malware threats that they see used in attacks on say 10 victims or less.  Thats where you find the gooodness. 

Take any random from Contagio.  See what kind of nuggets of intelligence you can glean from it, do your due diligence open source research and social network analysis, put your detective/investigator hat on.  And then ask your self why people continue saying they got pwned by the APT, instead of when instead they should just point to the bastards Baidu profile and Send him a little present as a token of thanks.

Thanks for getting added to the Pwned list.  Join the club.


Its about time we turned the table on attackers by doing what we should have done long ago.  Making the data UNAVAILABLE to them.  I came up with this approach a while back doing response.

If hostile threat actors who fill up warehouses (WOW Gold Farming Style) banging on their keyboards, interacting with their encrypted reverse shells that the seeded your organization with, and filling up their encrypted RAR files with your crown jewels, then your just toast.  What is needed is to segregate and limit access to critical data to only the time periods during which the data is used by the user.

So all the CNE operators basically do their job across the pond directly opposite our time zone.  Their 9-5 is our nighty night time.   Well your organizations hosts (turned on at night because they cant SUFFER a REBOOT after patching in the morning –> users scream wAH.) DO NOT NEED access to data when you are not logged on or away from work.

If user data was either cryptographically locked and segregated from the host machine during a certain chain of events or predetermined time periods. Then it wouldnt matter if half of China was on your box.  They could not get access to it even if they wanted to.  Additionally I have recommended to my clients that they actually force their users to segregate all sensitive data on Removable USB encrypted harddrives that are disconnected at night.  This however only fixes the client data issue and not the compromised credentials ripping data off of portals or share drives.

This concept combines two mitigations into one.  Remove the data from the host, and make it unavailable when its not needed.  The beauty of this is that it would FORCE CNE operators to lose their beauty sleep because they would have to work during OUR business hours not theirs.  and o btw make them really cranky.  They would have to attack our data on our boxes while we are on them and while that data is in use.  Making it much easier to detect anonmolies, as well as allow for the highly skilled DAY SHIFTs in the SOCs to better detect and respond.

The other approach swings well with Green Policies and saves money.  Forcing systems to shutdown during logoff events would additionally remove the data from being targeted as the machine is OFF and save electricity to boot.  Your money saved can go toward that 3 million you will spend on your next APT compromise.  Traditionally patch managers freak out and say this will prevent patching from being done.  NO this will prevent patching from being done when They want to do it.  Change the game.  Fuck your adversary.

It makes sense to me and it should make sense to you to.  Vendors / Entrepreneurs get on it.  CISOs get educated, your getting robbed blind, think unconventional and protect yourselves.

One of the most vexing and frustrating (for many) aspects of cyber espionage intrusion response is the ongoing debate over whether or not samples discovered should be submitted to AV companies.  Obviously what would happen is that at some point most likely an automatic process would engage and some type of generic signature would be generated marking it and its variants as malicious.  The hosts monitored would then detect and delete the sample, the smart CNE operator would detect this, and then modify his sample for new and undetected attacks.

One of the primary worries by many is “We don’t want them evolving! It will be to hard to find and detect!” Therefore lets not up the ante by forcing them to evolve.  Well, has that helped the situation at all? NO.  Has that stemmed the massive data loss.  NO.  Sure its easier to analyze samples when they are not packed, and the code is easy to read.

Groups like Mandiant and others working investigative forensic response have seen samples become detected and the adversaries entrench deeper, and modify their malware which foils an effective response and they have to start their intelligence collection cycle again before they can do a proper remediation.  Of course this would help their billings, but it really doesn’t help the poor victims and it does not stem the data loss and it certainly does not get them out.

In light of this issue I propose a concept I have been espousing for a while.

GAMECHANGER:  Out of Band CyberEspionage Malware notification/alert system for AV security endpoint agents.

Currently victims don’t want to reveal their malware and all its nefarious tricks to AV companies for fear of it pooching a remediation effort.  AV systems typically detect threat and delete, simple as that.  Usually admins don’t even look at the AV logs and even then the information is usually not much use.  Ironically the consumer AV product offerings are more descriptive than the commercial ones.

What is needed is for AV companies to have an option so that anytime a specific espionage malware related event occurs,  the customer has registered a hotline number and POC that can be registered for example the CISO, or one of their lead investigators who will be notified in an out of band fashion.   Detection of this malware would do simply that, Detect and report via out of band.  It will never block it, alert it, report it, share it, or raise any results whatsoever on a scan event.  The ONLY communication will be from the AV vendor directly via encrypted out of band communication to the registered POC who would be very cognizant of the importance of this particular threat. Well one would ask, what exactly gets detected signature wise for this type of event?  It could consist of in the cloud “highly sensitive signatures” that are developed as a result of espionage related incident investigations with a focus on custom malware and malware that is openly available, however used predominately by cyber espionage actors.  The malware sample set could include hashes, IP and domain lists, detection of very specific techniques, signatures, ectera that  would constitute a compilation of intelligence that is several orders of magnitude smaller than all the copious amounts of cybercrime information that is prevalent today.  This small data set of intelligence if generated by authoritative sources in a collaborative fashion, combined with a secure and intelligent way would allow for rapid notification to a organization UHhhh You got some Serious Problems going on, PLA is all up in yoZ SHIT.  This could dramatically change the balance of power.

Investigators would be free to segregate and label samples as espionage-ware if properly vetted, highly advanced analytical resources can then collaboratively rip apart samples to a much more in depth technical level, and resources would have a higher qualitative return on investment due to the fact that they are not wasting time with crap, and focusing on a much smaller set of highly damaging threats.  (Have you noticed that AV Threat Scores are worthless???)  Ironically the smaller the prevalence of the malware threat (APT —-> ) leads to AV vendors saying it is a low, very low threat.  Well not when its shunting Joint Strike Fighter data to Beijing its not.  Get with the program.  Granted AV companies dont give a crap about the US Government.  They are global in nature and have millions of customers.  A targeted attack, being thats its well, targeted, only might impact .005 percent of their customers.  However Threat ratings are still stuck in the worm days and have not evolved appreciably in years…

At the end of the day this will allow organizations to save a ton of money and resources where currently they are trying to cobble together, buy/build their own internal VirusTotal systems on the back end (a Ridiculous effort and waste) and proceed with half ass implementations of their own sandbox systems for fear that AV companies will report this out to the world and by nature of their products tip off the attackers that they have been discovered.

This would also prevent allow for intelligent threat driven TRIAGE of their malcode events allowing them the freedom of action to handle each and every event the way THEY want to.  Allowing them to capture memory first, collect a forensic image, or say monitor network traffic for a time to profile the attack, or conduct active defense actions by infiltrating the C2 channels/distrupting the hostile infrastructures. and allow for capture and analysis of the compromised hop point that will reveal the origins of the TRUE attackers.

I know this blog gets lots of readers however it gets VERY little active discussion and feedback.  This is a dam shame.  If you know of any open blogs that actually these issues seriously and discuss them in depth and are willing to address the bugaboo in the room then let me know and I will link them.  I would be AV companies are sitting on a ton of APT malware that they have no clue as to the operational context….

It’s high time you stop getting events labeled trojan.generic and Backdoor.ckb  Come on man that’s just crap.  Customers should demand better.

At the end of the day I guess, I am really just planting seeds..

One of the things that drives my research in relation to other technical research on malware that only tends to focus on the bits and the bytes is the fact that you can tell entire stories and interrelate seemingly disparate hostile acts of cyber aggression if you know enough and look long enough at the data right in front of you.

The concept of malware intelligence and connecting the dots after view many many samples seems to be under appreciated in the industry to a large extent.  Especially with AV vendors whose mission is to mainly focus on large prevalent threats and most of the Excellent stuff is never reported or just rubbed out of existence with ridiculous CARO naming convention names that mean nothing to the end user and speak nothing to the level of Weaponization of the malware nor its myriad of intelligence nuggets that can be found in its inner core.  Additionally where this information may be discovered, it is not correlated, shared, or discussed in the open.  The actors and organizations are given free reign to act in the shadows due to the fact that no one is actually pointing a finger in their direction and putting heat on them.  This is additionally true in the cybercrime area of malware development where many may know the actors responsible or behind networks however keep it private.    This only enables the sorry state of our situation where the game has completely changed and a tipping point (actually we are way past that) has occurred.  The ground has shifted under our feet and we are still not gauging how serious things are occurring.

GAMECHANGER: I am proposing that industry luminaries come together to create a highly technical Malware Intelligence Fusion Center with the express goal of bringing the special weaponization techniques to light and out in the open.  Identify and correlate the myriad of slipups that hostile actors use that can enable attribution whether it be embedded payload metadata, unique encryption, shellcode specifics, payload pedigrees, TTPs of hostile actors, and then tie these back to multi-INT sources of open source intelligence thus creating threat dossiers that can be leveraged for real world actions.

These cyber actions are done precisely because there is NO risk of consequence, They can operate in the dark because the industry allows them to.  They fail to focus on the fine technical details that might actually connect the dots and draw a bigger picture, then use that knowledge to force a change of behavior.   The numerous denials from various Foreign Ministers about how they would Never ever do these things is on its face wholly ridiculous, however when challenged after each attack, the victims simply let it go, they do not aggressively push for results, demand a change in behavior, or impose consequences collectively or individually.  Most will simply write up a small malware analysis report, not the C2 IP address for (blocking purposes) which is completely worthless and holds NO worth whatsoever in cyberdefense now as we speak.  Then they will post it somewhere and occasionally it will get referenced when next attack occurs.

The collective talent in the security and AV space is staggering, however with all that brain power not a single group or entity (save for possibly Mandiant) has truly tackled and provided a real Cyber Espionage Malware Intelligence capability that is worth much of anything.  If countries want to do the malware espionage game, then they will have to up their game and not get caught, or else all their information is identified and captured and made available to the community for the purposes of collective defense.  (think water buffaloes rallying around and protecting themselves when a pride of lions enters the area)

One of the problems is that much of this is done sort-of effectively in the military/intelligence space, however its pretty much akin to a group of lords and ladies all protected behind big stone walls while the barbarians ravage the countryside and pillage the peasants and merchant class.  This is Exactly what is occurring today, however the fallacy is thinking that the lords and ladies behind the walls are actually safe.  They are not.  They are under concerted siege, and only discovering the rotting diseased corpses that have been placed in the wells, and catapulted over the walls at night, and the assassin insiders that manipulate and kill from within.   Cyber espionage is at a risk of being over popularized to the point where now people hear of a major breach, roll their eyes and say O man not again.  O well.  It happens a lot and then proceed to blah blah about how they should have been secure.

Why has the public discussion not turned openly hostile, demanded action, demanded answers and started act in a more active defense posture towards this?  Currently there is very little open academic or public debate on the benefits of aggressive self defense.  I will say that the latest video where this poor fat kid is just getting the crap punched out of him by a sadistic yet smaller little bastard of a kid.  The fat kid finally say @#[email protected]# and grabs the little pissant, heaves him up in the air and .    The bully then proceeds to do a ridiculous “I just got knocked the F&(k out!” wobble and the bullied kid walks away.

This should serve as a nice inspiration for an example in active defense but I doubt many think its time to work on these things.

My main purpose for this blog was to infect the blogosphere with memes’ and concepts to modify the way things are being done today in the realms of cyberwar/conflict and the sorry situation we are in.  I have proposed game changing concepts that seem to be so actively sought after by organizations like DARPA and NIST as well as others.   Based on the types of organizations that have actively followed this blog, I would say that some of the content has influenced actions or ideas and maybe just maybe planted seeds, where we can pivot from the old and emerge stronger and more active into the new paradigm we find ourselves in.

Many have inquired about the various sources of some of my previous posts.  You can piece together much of the cyber espionage program by researching a variety of sources such as ThreatExpert / Security research on zero-day exploits where they cover not only the embedded attacks, but analysis of the payloads, deep technical analysis on contagio’s web site samples.  Combine that with reports to congress on China, James M’s excellent reporting on behalf of NGC, Topical reports from InfoWar Monitor on GHOSTNET/Aurora/Nightdragon and others, as well as the Excellent malware analysis reports that where exposed due to HBGary’s colossal fuckup revealing new victims as well as in depth malware analysis reports from the targeted and thoroughly compromised Qinetiq organization that works in cyber defense,  Tieing that to the revelations of Wikileaks which exposed methods and code names and past attacks and timelines, along with the excellent reports that Mandiant puts out, and you can easily combine it with the full bevy of open source social networking research to make and tell a wonderful fact based story and connect the dots.  The fact that attackers suck so much at their job (or don’t care about operational security) or that we are just so good and putting the pieces together makes for interesting days.

We shall see how the RSA thing pans out, however there are more “invasions” BTW that’s what China calls computer intrusions…. than you can shake a stick at and we and our allies will be doing post mortem until the cows come home.  In the mean time those little bastards will continue to steal our data on the hosts You Are not looking at.

Typically from a cyberdefense standpoint 2 – factor authentication is the way to go.  Well  in its that our adversaries have effectively developed, operationalized and used successful attacks against our Governments Smart Cards, commonly known as the for DOD and PIV for Federal agencies.    I would have to imagine this is highly damaging, embarrassing considering millions and millions of dollars and years of development has been put into the effort for over the last decade.

The irony is that the Federal Government hasnt even rolled completely out these capabilities for agencies, leaving these safeguards as optional for implementation until recently.  Really??

Either way, their are pwned now.  Users are attacked at home while they use their cards, and attackers are alerted and ride the session in to steal the data from Smartcard protected portals.   A Significant effort must have been initiated to circumvent these controls.    This is known as a Smart-Card Proxy attack.  In order to work with the card reader the attacker would have required reversing knowledge or and then wrote code to hook and issue call functions to the vendor software.  They would have also had to to undermine the chain of trust.

BTW soft certificate stealing is par for the course in APT malware so if you think about using them or extracting them to disk with the private key installed then your doubly screwed.  Either that or they will hook all the certificate processes in Windows and dump the private keys/passphrases from there, or get the PINs from normal keystroke logging.

The only vendor that truly makes this software is   So much for their Tagline “Establishing Trust in Online Identities”,,,,

I will reprint the article here since its just so dam scandalous.

The US government has been stepping up its use of smart cards to help lock down its computer networks, but hackers have found ways around them.

Over the past 18 months, security consultancy has come across several cases where determined attackers were able to get onto computers or networks that required both smart cards and passwords. In a report set to be released Thursday, Mandiant calls this technique a “smart card proxy.”

The attack works in several steps. First, the criminals hack their way onto a PC. Often they’ll do this by sending a specially crafted email message to someone at the network they’re trying to break into. The message will include an malicious attachment that, when opened, gives the hacker a foothold in the network.

After identifying the computers that have card readers, the bad guys install keystroke logging software on those computers to steal the password that is typically used in concert with the smart card.

Then they wait.

When the victim inserts the smart card into the hacked PC, the criminals then try to log into the server or network that requires the smart card for authentication. When the server asks for a digital token from the smart card, the bad guys simply redirect that request to the hacked system, and return it with the token and the previously stolen password.

This is similar to the techniques criminals have been using for several years now to get around the extra authentication technologies used in online banking.

Mandiant is the kind of company that businesses and government agencies call to clean up the mess after they’ve been hacked. It has done investigations at about 120 organisations overt the past year and a half. Most of them get hacked via a targeted email. But in many cases, they were actually hacked years earlier, but never managed to remove the malicious software from their network, according to the report.

Companies or government agencies that assume that they are secure just because they use smart cards to authenticate, could be in for a nasty surprise some day, said Rob Lee, a director with Mandiant. “Everything is circumventable in the end,” he said.

As if that were not enough, they are also using Social Networking for C2 including MSN and Google Chat and MSN. 

Funny how AV companies are really quiet about all this novel capabilities.  My dime is that they are sitting untouched in those massive Malware repositories they have.  Maybe if the drop all their Allapple/Virut/Sality samples they could see the forest for the trees.

Imagine that all our organizations information was being read by a foreign nation state, who uses it to modernize their arsenals which you might have to fight one day, steal your innovative ideas and hand them off to their national universities to finally replicate and deliver to Goverment backed/owned enterprises, use timely intelligence to have full knowledge of your plans/intentions and negotiating positions and then undermine them to force you to abort your preplaned negotiation limits, or scoop the deal your organization has been working on for months/years by under bidding you and winning multibillion dollar resource extraction contracts.  How about targeting your cyberdefence infrastructure by extracting its details and custom coding software that undermines and circumvents it.  Image your organization that has lost its entire Active Directory password database extracted from your domain controllers, image enemies coming and going at will through your networks,  imagine that at ANY time, your adversaries can extract your email like a vacumn cleaner right out of your Exchange inbox and PST files without you even knowing about it.  Imagine your enemy attacking you through your subcontractors VPNs, your users getting emails daily with undetectable trojan horse payloads while your Email gateway doesnt bat an eyelash, image your adversaries accessing all your juicy portals and N-tier web based content systems and browsing at will on the back of legitimate yet compromised user credentials. An lastly imagine for a second your adversary having the ability to download or modify its code and use its access to install and run destructive capabilities at will.  Really. Really? Ponder it and then demand answers. 

CyberDefense is bullshit.  Tippingpoint is now. Do something or it will be to late later.

This is the daily reality we are facing.  For people and so called experts who are not in the know and call this FUD, they are clueless.  Here is a rollup of the Sh1tSt0rm thats just transpired in the last couple months.

Think about this as a citizen and then ask yourself, the US has the most powerful cybercapability in the world, what the f#@# are we doing with it.  Why are these attacks continuing?  Are we impotent to stop them.  Have we lost the ability to project national power to compel an adversary to modify its actions?


  • (The MHTML implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly handle a MIME format in a request for content blocks in a document, which allows to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer.)

  • (new victims revealed)


Get every new post delivered to your Inbox.