Kaspersky Lab experts have discovered a backdoor planted in a server management software product used by hundreds of large businesses around the world. When activated, the backdoor allows attackers to download further malicious modules or steal data. Kaspersky Lab has alerted NetSarang, the vendor of the affected software, and it has promptly removed the malicious code and released an update for customers.

 

ShadowPad is one of the largest known supply-chain attacks. Had it not been detected and patched so quickly, it could potentially have targeted hundreds of organizations worldwide.

 

In July, 2017 Kaspersky Lab’s Global Research and Analysis (GReAT) team was approached by one of its partners – a financial institution. The organization’s security specialists were worried about suspicious DNS (domain name server) requests originating on a system involved in the processing of financial transactions.

 

Further investigation showed that the source of these requests was server management software produced by a legitimate company and used by hundreds of customers in industries like financial services, education, telecoms, manufacturing, energy, and transportation. The most worrying finding was the fact that the vendor did not mean for the software to make these requests.

 

Further Kaspersky Lab analysis showed that the suspicious requests were actually the result of the activity of a malicious module hidden inside a recent version of the legitimate software.

 

Following the installation of an infected software update, the malicious module would start sending DNS-queries to specific domains (its command and control server) at a frequency of once every eight hours. The request would contain basic information about the victim system (user name, domain name, host name).

 

If the attackers considered the system to be “interesting”, the command server would reply and activate a fully-fledged backdoor platform that would silently deploy itself inside the attacked computer. After that, on command from the attackers, the backdoor platform would be able to download and execute further malicious code.

 

Following the discovery, Kaspersky Lab researchers immediately contacted NetSarang. The company reacted fast and released an updated version of the software without the malicious code.

 

So far, according to Kaspersky Lab research, the malicious module has been activated in Hong Kong, but it could be lying dormant on many other systems worldwide, especially if the users have not installed the updated version of the affected software.

 

While analyzing the tools techniques and procedures used by the attackers, Kaspersky Lab researchers came to the conclusion that some similarities exist that point to PlugX malware variants used by the Winnti APT, a known Chinese-speaking cyberespionage group. This information, however, is not enough to establish a precise connection to these actors.

 

“ShadowPad is an example of how dangerous and wide-scale a successful supply-chain attack can be. Given the opportunities for reach and data collection it gives to the attackers, most likely it will be reproduced again and again with some other widely used software component. Luckily NetSarang was fast to react to our notification and released a clean software update, most likely preventing hundreds of data stealing attacks against its clients. However, this case shows that large companies should rely on advanced solutions capable of monitoring network activity and detecting anomalies. This is where you can spot malicious activity even if the attackers were sophisticated enough to hide their malware inside legitimate software,” said Igor Soumenkov, security expert, Global Research and Analysis Team, Kaspersky Lab.

 

NetSarang Statement

 

“To combat the ever-changing landscape of cyberattacks NetSarang has incorporated various methods and measures to prevent our line of products from being compromised, infected, or utilized by cyberespionage groups. Regretfully, the Build release of our full line of products on July 18th, 2017 was unknowingly shipped with a backdoor which had the potential to be exploited by its creator.

 

The security of our customers and user base is our highest priority and ultimately, our responsibility. The fact that malicious groups and entities are utilizing commercial and legitimate software for illicit gain is an ever-growing concern and one that NetSarang, as well as others in the computer software industry, is taking very seriously.

 

NetSarang is committed to its users’ privacy and has incorporated a more robust system to ensure that never again will a compromised product be delivered to its users. NetSarang will continue to evaluate and improve our security not only to combat the efforts of cyber espionage groups around the world but also in order to regain the trust of its loyal user base.”

 

All Kaspersky Lab products detect and protect against the ShadowPad malware as “Backdoor.Win32.ShadowPad.a”.

 

Kaspersky Lab advises users to update immediately to the latest version of the NetSarang software, from which the malicious module has been removed, and to check their systems for signs of DNS queries to unusual domains. A list of the command server domains used by the malicious module can be found in the Securelist blogpost, which also includes further technical information on the backdoor.


RECOMMENDED ARTICLE FOR TECHWORLD


 
Realme to Officially Enter the Philippines on November 29th
Techworld Date Posted: 21 November 2018 1:31 PM | 126 Views
Realme, a fast-emerging smartphone brand in South East Asia announces its official arrival in the Philippines on November 29th, 2018. Established in May 2018, Realme aims to provide young people around the world with.... See More
 
Realme to Officially Enter the Philippines on November 29th
Techworld Date Posted: 1:31 PM | 126 Views
Realme, a fast-emerging smartphone brand in South East Asia announces its official arrival in the Philippines on November 29th, 2018. Established in May 2018, Realme aims to provide young people around the world with...See More

 
Remote Access Nightmare: New Backdoors Increase More Than 40% in 2018
Techworld Date Posted: 11 December 2018 4:24 PM | 89 Views
Out of all the new malicious files detected in 2018, the amount that turned out to be backdoors rose by 44%, while the volume of ransomware increased by 43%.. See More
 
Remote Access Nightmare: New Backdoors Increase More Than 40% in 2018
Techworld Date Posted: 4:24 PM | 89 Views
Out of all the new malicious files detected in 2018, the amount that turned out to be backdoors rose by 44%, while the volume of ransomware increased by 43%.See More

 
Belkin Accessories for New Gen iPhones Are Now Available at Power Mac Center
Techworld Date Posted: 29 June 2018 4:35 PM | 343 Views
  Modern life is unthinkable without the iPhone, especially as it has replaced almost every other device needed at work and in everyday life. Keep yours in peak performance with the help of the.... See More
 
Belkin Accessories for New Gen iPhones Are Now Available at Power Mac Center
Techworld Date Posted: 4:35 PM | 343 Views
  Modern life is unthinkable without the iPhone, especially as it has replaced almost every other device needed at work and in everyday life. Keep yours in peak performance with the help of the...See More

 
Apacer Unveils New Industrial Product Identification to Support Smart Devices
Techworld Date Posted: 28 December 2018 4:08 PM | 63 Views
As the Internet of Things (IoT), artificial intelligence (AI) and 5G technology gradually integrate, a new data economy ecosystem is taking shape.. See More
 
Apacer Unveils New Industrial Product Identification to Support Smart Devices
Techworld Date Posted: 4:08 PM | 63 Views
As the Internet of Things (IoT), artificial intelligence (AI) and 5G technology gradually integrate, a new data economy ecosystem is taking shape.See More

 
World-Renowned Photo-Editing App Publisher Launches ArtBot
Techworld Date Posted: 19 December 2017 8:59 AM | 288 Views
Meitu Inc., publisher of the world renowned photo-editing app Meitu, is dedicated to the pursuit of beauty around the world.. See More
 
World-Renowned Photo-Editing App Publisher Launches ArtBot
Techworld Date Posted: 8:59 AM | 288 Views
Meitu Inc., publisher of the world renowned photo-editing app Meitu, is dedicated to the pursuit of beauty around the world.See More

 
Kaspersky Lab Appeals U.S. Department of Homeland Security Debarment
Techworld Date Posted: 11:46 AM | 220 Views
Kaspersky Lab announced today that it is seeking an appeal in federal court of U.S. Department of Homeland Security’s (DHS) decision on Binding Operational Directive 17-01 banning the use of the company’s products in.... See More
 
Kaspersky Lab Appeals U.S. Department of Homeland Security Debarment
Techworld Date Posted: 11:46 AM | 220 Views
Kaspersky Lab announced today that it is seeking an appeal in federal court of U.S. Department of Homeland Security’s (DHS) decision on Binding Operational Directive 17-01 banning the use of the company’s products in...See More

 
ADATA to Showcase Its Latest Innovations at IFA 2018
Techworld Date Posted: 23 August 2018 2:03 PM | 332 Views
ADATA Technology, a leading manufacturer of high-performance DRAM modules and NAND flash products, has announced that it will be showcasing its latest products and solutions at IFA 2018 in Berlin. Among the products to.... See More
 
ADATA to Showcase Its Latest Innovations at IFA 2018
Techworld Date Posted: 2:03 PM | 332 Views
ADATA Technology, a leading manufacturer of high-performance DRAM modules and NAND flash products, has announced that it will be showcasing its latest products and solutions at IFA 2018 in Berlin. Among the products to...See More

 
KKR-Backed Emerald Media Leads US$65 Million Series B in aCommerce to Drive Southeast Asia’s Retail and Ecommerce Ecosystem Forward
Techworld Date Posted: 20 November 2017 1:46 PM | 214 Views
Manila, 20 November 2017 - aCommerce Co. Ltd. announced today that it has closed a US$65 million Series B funding round. The company is Southeast Asia’s leading ecommerce enabler and e-distributor in four markets.... See More
 
KKR-Backed Emerald Media Leads US$65 Million Series B in aCommerce to Drive Southeast Asia’s Retail and Ecommerce Ecosystem Forward
Techworld Date Posted: 1:46 PM | 214 Views
Manila, 20 November 2017 - aCommerce Co. Ltd. announced today that it has closed a US$65 million Series B funding round. The company is Southeast Asia’s leading ecommerce enabler and e-distributor in four markets...See More

 
New Game Ready Driver Is Optimised for Star Wars Battlefront II, And Improves Destiny 2 Performance by up to 53%
Techworld Date Posted: 16 November 2017 5:26 PM | 249 Views
Hot on the heels of the Star Wars inspired GPUs comes the Star Wars TM BattlefrontTM II Game Ready driver from NVIDIA. Star Wars Battlefront II is launching worldwide on November 17, 2017, but.... See More
 
New Game Ready Driver Is Optimised for Star Wars Battlefront II, And Improves Destiny 2 Performance by up to 53%
Techworld Date Posted: 5:26 PM | 249 Views
Hot on the heels of the Star Wars inspired GPUs comes the Star Wars TM BattlefrontTM II Game Ready driver from NVIDIA. Star Wars Battlefront II is launching worldwide on November 17, 2017, but...See More

 
Introducing the new special editions to the moto g family moto G5s and moto G5s plus
Techworld Date Posted: 14 October 2017 2:30 PM | 368 Views
Motorola continues to bring unique and intuitive user experiences that Filipinos love and the two new additions to its moto g family: moto g5s and moto g5s plus, come with the latest innovations in.... See More
 
Introducing the new special editions to the moto g family moto G5s and moto G5s plus
Techworld Date Posted: 2:30 PM | 368 Views
Motorola continues to bring unique and intuitive user experiences that Filipinos love and the two new additions to its moto g family: moto g5s and moto g5s plus, come with the latest innovations in...See More


Power by

Download Free AZ | Free Wordpress Themes