Malicious update/malware by a semi-advanced adversary • Hacker News Board

Re: Malicious update/malware by a semi-advanced adversary

#31

Post by ElectricalUnion » Mon, Oct 10, 2022, 1:36 PM UTC

cm_silva wrote: post #21

blincoln wrote: post #18

Earlier quoted context omitted.

I haven't looked at ad malware for many years, but when I did, it infected the MBR, so reinstalling Windows alone wouldn't remove it. I had to rebuild the MBR. I definitely recommend doing any live testing in a VM on a dedicated testing device. Who knows what sneakier persistence techniques are out there now?

>I haven't looked at ad malware for many years, but when I did, it infected the MBR, so reinstalling Windows alone wouldn't remove it. In this case, wouldn't the infection go away by formatting the disk?

Strictly speaking (disks), yes, but people often say "disk" and format partitions instead.

As the partition table and the MBR/"EFI system partition" exist outside of the realm of normal partitions, formatting normal partitions doesn't help in this case.

Re: Malicious update/malware by a semi-advanced adversary

#32

Post by nonameiguess » Mon, Oct 10, 2022, 2:24 PM UTC

neilv wrote: post #19

I can easily believe that this is a grassroots group (we see many examples of that, in many areas, even in childhood), but this did prompt a few questions: 1. Is there any advantage to nation having cyber attack deniability via being able to at least semi-plausibly claim that , although an attack appeared in the interests of the nation, it was by an independent grassroots group, out of the nation's control? If so, wo…

I'm sure there are plenty of reasons it can be advantageous to be able to attribute covert action to some independent group, but at least one comes from fairly recent US history: the Iran-Contra Affair. Different parts of a government don't always agree with each other, and one might want to be able to act without approval from another. Not all countries are one-party dictatorships where warfighting departments can just do whatever they want.

Re: Malicious update/malware by a semi-advanced adversary

#33

Post by PeterisP » Mon, Oct 10, 2022, 2:50 PM UTC

dannyw wrote: post #15

They probably have logs for manual investigative activity, and took the site down when you kept re-running the payload. Also, please don't execute payloads on your laptop. That seems really stupid.

Executing (parts of) payloads is often an effective part of malware analysis, revealing things quicker than static analysis.

You just need to do it in an isolated environment - it can be a virtual machine (while VM escapes exist, they are quite rare) or a separate laptop that doesn't have any personal data and will be wiped afterward.

Re: Malicious update/malware by a semi-advanced adversary

#34

Post by chomp » Mon, Oct 10, 2022, 3:32 PM UTC

sandos wrote: post #22

chomp wrote: post #4

Good article, I also would advise running in HyperV or its 3rd party equivalent, having to re-OS is lame, and using your main OS leaves you open to UEFI attacks.

There has been several exploits breaking out of VMs though, no? Can you trust even that...

Yeah, but defense in depth. No protection is fool proof, even an air-gapped machine.

Re: Malicious update/malware by a semi-advanced adversary

#35

Post by egberts1 » Mon, Oct 10, 2022, 4:47 PM UTC

Hey Axel, next time create and obtain the client key to give to Firefox TLS and run a MitM proxy to do WireShark capture of raw HTTP traffic.

Bonus if you do this all the time, you’ll snag the whole thing when saving all captures.

Re: Malicious update/malware by a semi-advanced adversary

#36

Post by neilv » Mon, Oct 10, 2022, 7:54 PM UTC

neilv wrote: post #19

I can easily believe that this is a grassroots group (we see many examples of that, in many areas, even in childhood), but this did prompt a few questions: 1. Is there any advantage to nation having cyber attack deniability via being able to at least semi-plausibly claim that , although an attack appeared in the interests of the nation, it was by an independent grassroots group, out of the nation's control? If so, wo…

I meant no offense by those thoughts, I thought they were in the spirit of HN curiosity, and I apologize if I caused any offense.

Since I posted my parent comment, it seems that at least one party has been trying to hack my accounts (including phishing attempts, and trying to social-engineer my phone carrier).

As an individual, I'm not hardened against attacks, and can't afford them, so I hope they will stop.

(If the parties want, they can go look at my publicly-shared open source software projects and community support, and see that I'm not an adversary.)

Hacking an individual is threatening and harmful, and not what I think any of us wants this Hacker News facilitated global community to be about.

Re: Malicious update/malware by a semi-advanced adversary

#37

Post by aviditas » Mon, Oct 10, 2022, 10:50 PM UTC

batch12 wrote: post #27

I've seen this. This is the same basic payload/TTP from the regional news sites that were compromised (via shared scripts hosted by McClatchy and MediaNews) a few years ago (2019). Op needs to hit the site with a new IP and with a 'referer' to get the second stage. There is also some JS fingerprinting, like checking GPU model, to ensure a plausible client visit. This was a fun piece of malware to dissect. I believe S…

The last batch of SocGholish I encountered had virtualization checks on each stage and required user interaction to run/open the payload. Used iframes or modified google analytics on the compromised site and used webpress plugins vulns to get access. The sandboxing checks were crazy good. I ended up getting an old laptop to do the analysis as it detected every other security sandbox tool. The only positive is that the payload (6 months back) itself is easily detected by most edr. Defender caught it on download.

+1 to the enjoyable dissection. Rooting out the underlying infra was also very fun.