The Darkhotel APT
securelist.com
The Darkhotel APT
1–10 of 13 posts
Re: The Darkhotel APT
#2Good writeup. Kaspersky performs good malware campaign analysis without sensationalism.
Also what a novel idea, just wait on the porous hotel network for your execs to come in. I wonder what country's work this is.
Re: The Darkhotel APT
#3As much as hyperbole security marketing is becoming over-used these days, I actually enjoyed the animation in the video. Very cyberpunk.
Re: The Darkhotel APT
#4Use software like Qubes, Bromium to sign on the malware-infested hotel network, then activate VPN.
Re: The Darkhotel APT
#5Why should we believe this? They admit that they have been unable to find any "dark hotel" infrastructure. What is the basis for their claim that the attacks take place in hotels?
Re: The Darkhotel APT
#6As much as hyperbole security marketing is becoming over-used these days, I actually enjoyed the animation in the video. Very cyberpunk.
Convenient wallpaper: http://i.imgur.com/7ad0Bs1.jpg
Re: The Darkhotel APT
#7Good writeup. Kaspersky performs good malware campaign analysis without sensationalism. Also what a novel idea, just wait on the porous hotel network for your execs to come in. I wonder what country's work this is.
> Kaspersky performs good malware campaign analysis without sensationalism.
Did you play the video?
Re: The Darkhotel APT
#8For those that are interested in a more technical analysis of the malware, infection vectors, and C&C infrastructure check out the whitepaper linked at the top. It goes into significantly more detail than the main article.
Below is a link to the PDF directly (I know the URL looks shady):
http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/f...
If you manage security infrastructure for your organization and want details on C&C URLs, compromised certs used for signing, and relevant file hashes check out the technical apendix they published, also linked at the top of the article (and below):
http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/f...
Re: The Darkhotel APT
#9Good writeup. Kaspersky performs good malware campaign analysis without sensationalism. Also what a novel idea, just wait on the porous hotel network for your execs to come in. I wonder what country's work this is.
> Kaspersky performs good malware campaign analysis without sensationalism. Did you play the video?
No, was it sensationalized? Dammit.
I never watch the videos on news sites. Too disruptive for my work environment.
Re: The Darkhotel APT
#10Why should we believe this? They admit that they have been unable to find any "dark hotel" infrastructure. What is the basis for their claim that the attacks take place in hotels?
Check out the whitepaper they published along with the article. It goes into more detail about the attacks. It appears they have a record of the traffic from the hotels' networks, probably from an IDS or something similar. Some relevant quotes from the whitepaper:
"The Darkhotel APT’s precise malware spread was observed in several hotels’ networks, where visitors connecting to the hotel’s Wi-Fi were prompted to install software updates to popular software packages." - page 5
"As a part of an ongoing investigation, our research led us to embedded iframes within hotel networks that redirected individuals’ web browsers to phony installers. The attackers were very careful with the placement of these iframes and executables on trusted resources - the hotels’ network login portals themselves." - page 6
"We observed traces of a couple of these incidents in late 2013 and early 2014 on a victim hotel’s network. The attackers set up the environment and hit their individual targets with precision. As soon as their target’s stay was over and the attack-frame was closed, the attackers deleted their iframe placement and backdoored executables from the hotel network." - page 6