Kaspersky Lab experts have discovered a backdoor planted in a server management software product used by hundreds of large businesses around the world. When activated, the backdoor allows attackers to download further malicious modules or steal data. Kaspersky Lab has alerted NetSarang, the vendor of the affected software, and it has promptly removed the malicious code and released an update for customers.

 

ShadowPad is one of the largest known supply-chain attacks. Had it not been detected and patched so quickly, it could potentially have targeted hundreds of organizations worldwide.

 

In July, 2017 Kaspersky Lab’s Global Research and Analysis (GReAT) team was approached by one of its partners – a financial institution. The organization’s security specialists were worried about suspicious DNS (domain name server) requests originating on a system involved in the processing of financial transactions.

 

Further investigation showed that the source of these requests was server management software produced by a legitimate company and used by hundreds of customers in industries like financial services, education, telecoms, manufacturing, energy, and transportation. The most worrying finding was the fact that the vendor did not mean for the software to make these requests.

 

Further Kaspersky Lab analysis showed that the suspicious requests were actually the result of the activity of a malicious module hidden inside a recent version of the legitimate software.

 

Following the installation of an infected software update, the malicious module would start sending DNS-queries to specific domains (its command and control server) at a frequency of once every eight hours. The request would contain basic information about the victim system (user name, domain name, host name).

 

If the attackers considered the system to be “interesting”, the command server would reply and activate a fully-fledged backdoor platform that would silently deploy itself inside the attacked computer. After that, on command from the attackers, the backdoor platform would be able to download and execute further malicious code.

 

Following the discovery, Kaspersky Lab researchers immediately contacted NetSarang. The company reacted fast and released an updated version of the software without the malicious code.

 

So far, according to Kaspersky Lab research, the malicious module has been activated in Hong Kong, but it could be lying dormant on many other systems worldwide, especially if the users have not installed the updated version of the affected software.

 

While analyzing the tools techniques and procedures used by the attackers, Kaspersky Lab researchers came to the conclusion that some similarities exist that point to PlugX malware variants used by the Winnti APT, a known Chinese-speaking cyberespionage group. This information, however, is not enough to establish a precise connection to these actors.

 

“ShadowPad is an example of how dangerous and wide-scale a successful supply-chain attack can be. Given the opportunities for reach and data collection it gives to the attackers, most likely it will be reproduced again and again with some other widely used software component. Luckily NetSarang was fast to react to our notification and released a clean software update, most likely preventing hundreds of data stealing attacks against its clients. However, this case shows that large companies should rely on advanced solutions capable of monitoring network activity and detecting anomalies. This is where you can spot malicious activity even if the attackers were sophisticated enough to hide their malware inside legitimate software,” said Igor Soumenkov, security expert, Global Research and Analysis Team, Kaspersky Lab.

 

NetSarang Statement

 

“To combat the ever-changing landscape of cyberattacks NetSarang has incorporated various methods and measures to prevent our line of products from being compromised, infected, or utilized by cyberespionage groups. Regretfully, the Build release of our full line of products on July 18th, 2017 was unknowingly shipped with a backdoor which had the potential to be exploited by its creator.

 

The security of our customers and user base is our highest priority and ultimately, our responsibility. The fact that malicious groups and entities are utilizing commercial and legitimate software for illicit gain is an ever-growing concern and one that NetSarang, as well as others in the computer software industry, is taking very seriously.

 

NetSarang is committed to its users’ privacy and has incorporated a more robust system to ensure that never again will a compromised product be delivered to its users. NetSarang will continue to evaluate and improve our security not only to combat the efforts of cyber espionage groups around the world but also in order to regain the trust of its loyal user base.”

 

All Kaspersky Lab products detect and protect against the ShadowPad malware as “Backdoor.Win32.ShadowPad.a”.

 

Kaspersky Lab advises users to update immediately to the latest version of the NetSarang software, from which the malicious module has been removed, and to check their systems for signs of DNS queries to unusual domains. A list of the command server domains used by the malicious module can be found in the Securelist blogpost, which also includes further technical information on the backdoor.


RECOMMENDED ARTICLE FOR TECHWORLD


 
COLORFUL Debuts Most Powerful Gaming Graphics Card at CGU 2018: COLORFUL iGame GeForce RTX 2080 Ti KUDAN
Techworld Date Posted: 7 January 2019 2:43 PM | 214 Views
Colorful Technology Company Limited, professional manufacturer of graphics cards, motherboards and high-performance storage solutions is proud to announce its most powerful graphics card to date with the latest entry bearing the title of KUDAN.. See More
 
COLORFUL Debuts Most Powerful Gaming Graphics Card at CGU 2018: COLORFUL iGame GeForce RTX 2080 Ti KUDAN
Techworld Date Posted: 2:43 PM | 214 Views
Colorful Technology Company Limited, professional manufacturer of graphics cards, motherboards and high-performance storage solutions is proud to announce its most powerful graphics card to date with the latest entry bearing the title of KUDAN.See More

Frank Emmanuel Trazo
Summer Loving in VR: Summer Lesson
Techworld • By: Frank Emmanuel Trazo | Date Posted: 27 June 2017 10:55 AM | 631 Views
Summer is one of the most magical and memorable seasons for the youth as it lets them experience love. As VR technology is becoming more reachable for public consumption and you can live in.... See More
Frank Emmanuel Trazo
Summer Loving in VR: Summer Lesson
Techworld • By: Frank Emmanuel Trazo | Date Posted: 10:55 AM | 631 Views
Summer is one of the most magical and memorable seasons for the youth as it lets them experience love. As VR technology is becoming more reachable for public consumption and you can live in...See More

 
ASUS Republic of Gamers Announces Rapture GT-AC5300
Techworld Date Posted: 29 August 2017 4:41 PM | 328 Views
Modern online games require close teamwork and precise control from players; even a second of unwanted network latency can lose a game. To date, most routers labeled as ‘gaming routers' are largely defined by.... See More
 
ASUS Republic of Gamers Announces Rapture GT-AC5300
Techworld Date Posted: 4:41 PM | 328 Views
Modern online games require close teamwork and precise control from players; even a second of unwanted network latency can lose a game. To date, most routers labeled as ‘gaming routers' are largely defined by...See More

 
Say Goodbye to Dead Spots at Home and Say Hello to Google WiFi! PLDT Teams Up with Google to Give You the Strongest and Seamless Connections at Home
Techworld Date Posted: 25 October 2018 2:32 PM | 258 Views
Nothing ruins an online experience like an interrupted connection. Whether you’re streaming the final episode of your favorite series, uploading an important file to make a deadline or video calling with your bestfriend abroad,.... See More
 
Say Goodbye to Dead Spots at Home and Say Hello to Google WiFi! PLDT Teams Up with Google to Give You the Strongest and Seamless Connections at Home
Techworld Date Posted: 2:32 PM | 258 Views
Nothing ruins an online experience like an interrupted connection. Whether you’re streaming the final episode of your favorite series, uploading an important file to make a deadline or video calling with your bestfriend abroad,...See More

 
Realme 3 First Offline Sale a Hit, Saw 900% Growth over Brand’s First Ever In-Store Sale
Techworld Date Posted: 24 April 2019 4:26 PM | 50 Views
After two weeks of back-to-back sold-out sales on Shopee and being hailed the fastest-selling smartphone under Php10,000, the realme 3 successfully lands on the hands of pre-order customers at its first nationwide in-store sale,.... See More
 
Realme 3 First Offline Sale a Hit, Saw 900% Growth over Brand’s First Ever In-Store Sale
Techworld Date Posted: 4:26 PM | 50 Views
After two weeks of back-to-back sold-out sales on Shopee and being hailed the fastest-selling smartphone under Php10,000, the realme 3 successfully lands on the hands of pre-order customers at its first nationwide in-store sale,...See More

Symantec Attack Investigation Team
FASTCash: How the Lazarus Group Is Emptying Millions from ATMs
Techworld • By: Symantec Attack Investigation Team | Date Posted: 16 November 2018 3:17 PM | 211 Views
On October 2, 2018, an alert was issued by US-CERT, the Department of Homeland Security, the Department of the Treasury, and the FBI.. See More
Symantec Attack Investigation Team
FASTCash: How the Lazarus Group Is Emptying Millions from ATMs
Techworld • By: Symantec Attack Investigation Team | Date Posted: 3:17 PM | 211 Views
On October 2, 2018, an alert was issued by US-CERT, the Department of Homeland Security, the Department of the Treasury, and the FBI.See More

 
Enjoy Exclusive Perks When You Upgrade to a SUN LTE SIM
Techworld Date Posted: 2 May 2019 11:07 AM | 92 Views
Have you shifted to a Sun LTE SIM? If not, now is the perfect time to upgrade to a Sun LTE SIM for faster mobile internet connectivity and get an exclusive Shopee discount from.... See More
 
Enjoy Exclusive Perks When You Upgrade to a SUN LTE SIM
Techworld Date Posted: 11:07 AM | 92 Views
Have you shifted to a Sun LTE SIM? If not, now is the perfect time to upgrade to a Sun LTE SIM for faster mobile internet connectivity and get an exclusive Shopee discount from...See More

 
SILVERSTONE TECHNOLOGY LAUNCHES 2018 PRODUCT LINE
Techworld Date Posted: 4 May 2018 3:22 PM | 547 Views
SilverStone Technology Co., Ltd. (SST), one of the biggest designers and manufacturers of computer parts and accessories in the world introduces their 2018 product line in the Philippines with a Launch Party for its.... See More
 
SILVERSTONE TECHNOLOGY LAUNCHES 2018 PRODUCT LINE
Techworld Date Posted: 3:22 PM | 547 Views
SilverStone Technology Co., Ltd. (SST), one of the biggest designers and manufacturers of computer parts and accessories in the world introduces their 2018 product line in the Philippines with a Launch Party for its...See More

 
Get the New iPad 6th Gen from Smart Bro at Php999 per Month
Techworld Date Posted: 24 July 2018 11:16 AM | 482 Views
Looking for the perfect learning tool for your child or a fun and entertaining device to share with your kid?   Look no further as Smart Bro makes it a lot easier for you.... See More
 
Get the New iPad 6th Gen from Smart Bro at Php999 per Month
Techworld Date Posted: 11:16 AM | 482 Views
Looking for the perfect learning tool for your child or a fun and entertaining device to share with your kid?   Look no further as Smart Bro makes it a lot easier for you...See More

 
Kaspersky Lab Warns of Dangers of ‘Balkanisation’ at Its 4th APAC Cyber Security Summit
Techworld Date Posted: 26 September 2018 4:00 PM | 230 Views
Kaspersky Lab presented the cybersecurity risks that can result from Balkanisation in cyberspace — the fragmentation of the world wide web, during its 4th Asia Pacific (APAC) Cyber Security Weekend in Siem Reap, Cambodia.. See More
 
Kaspersky Lab Warns of Dangers of ‘Balkanisation’ at Its 4th APAC Cyber Security Summit
Techworld Date Posted: 4:00 PM | 230 Views
Kaspersky Lab presented the cybersecurity risks that can result from Balkanisation in cyberspace — the fragmentation of the world wide web, during its 4th Asia Pacific (APAC) Cyber Security Weekend in Siem Reap, Cambodia.See More


Power by

Download Free AZ | Free Wordpress Themes