Cyber Training Group International (CTGI)

Tag: malware

  • AT&T Customers Are Being Infected By A Massive Malware Botnet But User Data Is Allegedly Secure

    AT&T Customers Are Being Infected By A Massive Malware Botnet But User Data Is Allegedly Secure

    If you are an AT&T enterprise customer with some older technology on the edge of your network, your infrastructure may be under attack by a Russian botnet dubbed EwDoor.

    In late October this year, researchers at 360 Netlab discovered a threat actor attacking Edgewater Networks’ devices using the four-year-old CVE-2017-6079. This vulnerability, when exploited, could allow the attacker to execute commands via a hidden page embedded in the firmware dating back to 2006, according to the National Institute of Standards and Technology’s database.

    ewdoor layout att customers under attack by botnet
    The basic logic of EwDoor’s operations.

    Subsequently, the researchers named this botnet EwDoor after “it’s targeting of Edgewater producers and its Backdoor feature.” The initial version of this network used a multi-command-and-control (C2) redundancy mechanism, allowing the researchers to register one of the C2 domains and gain some insights into EwDoor. They found that the 5,700 attacked devices are “EdgeMarc Enterprise Session Border Controllers” belonging to AT&T and geographically located within the United States.

    Also Read: HACKERS DEPLOY LINUX MALWARE, WEB SKIMMER ON E-COMMERCE SERVERS

    Since that initial insight was gained, the researchers briefly lost sight of EwDoor, but found that there have been three known updates for the network that “can be summarized into 2 main categories of DDoS attacks and Backdoor.” The thought is that with these capabilities, which also include “self-updating, port scanning, file management, reverse SHELL, and the execution of arbitrary commands,” the threat actor wishes to deny service and gather sensitive information like call logs.

    c2 info2 att customers under attack by botnet

    Interestingly, the team at 360 Netlab was able to deconstruct the code from EwDoor and found some of the C2 domains and the locations for the downloaded files. Though these have likely changed since the research was published, it shows that the threat actor’s efforts to obfuscate their work had flaws.

    In any event, AT&T spoke with BleepingComputer and stated that there was “no evidence of customers’ data being accessed as a result of these attacks.” Specifically, AT&T previously identified this issue, and the company has “taken steps to mitigate it and continue[s] to investigate.” Despite this reassurance, it is still concerning that something like this could happen, especially considering the crux of this attack is a highly dangerous four-year-old vulnerability.

    Credits: HOT HARDWARE

  • Hackers deploy Linux malware, web skimmer on e-commerce servers

    Hackers deploy Linux malware, web skimmer on e-commerce servers

    Security researchers discovered that attackers are also deploying a Linux backdoor on compromised e-commerce servers after injecting a credit card skimmer into online shops’ websites.

    The PHP-coded web skimmer (a script designed to steal and exfiltrate customers’ payment and personal info) is added and camouflaged as a .JPG image file in the /app/design/frontend/ folder.

    The attackers use this script to download and inject fake payment forms on checkout pages displayed to customers by the hacked online shop.

    “We found that the attacker started with automated eCommerce attack probes, testing for dozens of weaknesses in common online store platforms,” the Sansec Threat Research Team revealed.

    “After a day and a half, the attacker found a file upload vulnerability in one of the store’s plugins. S/he then uploaded a webshell and modified the server code to intercept customer data.”

    Linux malware undetected by security software

    The Golang-based malware, spotted by Dutch cyber-security company Sansec on the same server, was downloaded and executed on breached servers as a linux_avp executable.

    Once launched, it immediately removes itself from the disk and camouflages itself as a “ps -ef” process that would be used to get a list of currently-running processes.

    Also Read: These 23 fake Android apps are dangerous spyware, so delete them now

    While analyzing the linux_avp backdoor, Sansec found that it waits for commands from a Beijing server hosted on Alibaba’s network.

    They also discovered that the malware would gain persistence by adding a new crontab entry that would redownload the malicious payload from its command-and-control server and reinstall the backdoor if detected and removed or the server restarts.

    Until now, this backdoor remains undetected by anti-malware engines on VirusTotal even though a sample was first uploaded more than one month ago, on October 8th.

    The uploader might be the linux_avp creator since it was submitted one day after researchers at Dutch cyber-security company Sansec spotted it while investigating the e-commerce site breach.