Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
Eliminate costly downtime!
Find out how with Free White Paper
& enter to win a Samsung Galaxy Note

www.apc.com
Mobile Tech
Real-time info services with Neustar
Average Rating:
Rate this article:  
Kaspersky Lab Outs
Kaspersky Lab Outs 'The Mask' Cyber-Spy Attacks

By Jennifer LeClaire
February 11, 2014 1:09PM

    Bookmark and Share
The Mask cyber-espionage campaign relies on spear-phishing e-mails with links to a malicious Web site, according to Kaspersky Lab. An infection can be disastrous for victims because The Mask intercepts all communication channels and collects the most vital information from the victim’s machine, Kaspersky said.
 



“The Mask,” aka Careto, has been outed. Kaspersky Lab has discovered an advanced Spanish-language speaking threat actor that has been involved in global cyber-espionage operations since at least 2007. The Mask comes with a complex toolset, including highly sophisticated malware, a rootkit, bootkit, Mac OS X and Linux versions and possibly versions for Android and Apple iOS.

Kaspersky cited government institutions, diplomatic offices and embassies, energy, oil and gas companies, research organizations and activists as the primary targets. The firm found victims of the attacks in 31 countries, from the Middle East and Europe to Africa and the Americas.

The attackers' goal is to gather sensitive data from the infected systems, such as office documents, encryption keys, VPN configurations, SSH keys (serving as a means of identifying a user to an SSH server) and RDP files (used by the remote desktop client to automatically open a connection to the reserved computer), the firm said.

A Nation-State Sponsored Campaign?

If Kaspersky’s analysis is correct, an infection can be disastrous for victims. Careto intercepts all communication channels and collects the most vital information from the victim’s machine. One thing is certain, the firm said, detection can be difficult because of stealth rootkit capabilities, built-in functionalities and additional cyber-espionage modules.

“Several reasons make us believe this could be a nation-state-sponsored campaign. First of all, we observed a very high degree of professionalism in the operational procedures of the group behind this attack,” said Costin Raiu, director of the Global Research and Analysis Team (GReAT) at Kaspersky Lab.

“From infrastructure management, shutdown of the operation, avoiding curious eyes through access rules and using wiping instead of deletion of log files. These combine to put this APT ahead of Duqu in terms of sophistication, making it one of the most advanced threats at the moment. This level of operational security is not normal for cyber-criminal groups,” he said.

Security Analysts Disagree

According to Kaspersky Lab’s analysis report, here’s how it works: The Mask campaign relies on spear-phishing e-mails with links to a malicious Web site. The malicious Web site contains an exploit designed to infect the visitor, depending on system configuration. Upon successful infection, the malicious Web site redirects the user to the benign Web site referenced in the e-mail, which can be a YouTube movie or a news portal.

The exploit Web sites do not automatically infect visitors. Rather, the attackers host the exploits at specific folders on the Web site, which are not directly referenced anywhere, except in malicious e-mails, the firm said. Sometimes, the attackers use subdomains on the exploit Web sites, to make them seem more real. These subdomains simulate subsections of the main newspapers in Spain plus some international ones for instance, The Guardian and The Washington Post.

The malware intercepts all the communication channels and collects the most vital information from the infected system. Detection is extremely difficult because of stealth rootkit capabilities, Kaspersky said.

We asked Chester Wisniewski, a senior security advisor at Sophos, for his take on Mask. He told us while the malware certainly appears to have a sophistication to it that could indicate a nation-state was involved, he would hardly consider this targeted malware.

“Many of the samples were discovered and detected by antivirus for some time,” he said. “It is hard to believe that anyone serious about spying would run an operation this large and expect it to remain a secret.”
 

Tell Us What You Think
Comment:

Name:



Barium Ferrite Is The Future Of Tape: Barium Ferrite (BaFe) offers greater capacity, superior performance, and longer archival life compared to legacy metal particle (MP) tape. Click here to learn more.


 Mobile Tech
1.   Cortana Fills Windows Phone Gap
2.   Galaxy S5 Phone: Less Can Be More
3.   Beware: Facebook Shares Your Locale
4.   Android Gets Chrome Remote Desktop
5.   Amazon 3D Smartphone Pics Leaked


advertisement
BlackBerry Drops T-Mobile After Spat
Moving on to other carriers after snub.
Average Rating:
Cortana Fills Windows Phone Gap
Siri-like virtual assistant has promise.
Average Rating:
Galaxy S5 Phone: Less Can Be More
Most formidable iPhone competitor yet.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Heartbleed Could Cost Millions, Could Have Been Prevented
Early estimates of Heartbleed’s cost to enterprises are running in the millions. The reason: revoking all the SSL certificates the bug exposed will come at a very hefty price. Some say it all could have been avoided.
 
Michaels Says Nearly 3M Credit, Debit Cards Breached
Arts and crafts retail giant Michaels Stores has confirmed that a data breach at its POS terminals from May 2013 to Jan. 2014 may have exposed nearly 3 million customer credit and debit cards.
 
Google's Street View Software Unravels CAPTCHAs
The latest software Google uses for its Street View cars to read street numbers in images for Google Maps works so well that it also solves CAPTCHAs, those puzzles designed to defeat bots.
 

Enterprise Hardware Spotlight
Vaio Fit 11A Battery Danger Forces Recall by Sony
Using a Sony Vaio Fit 11A laptop? It's time to send it back to Sony. In fact, Sony is encouraging people to stop using the laptop after several reports of its Panasonic battery overheating.
 
Continued Drop in Global PC Shipments Slows
Worldwide shipments of PCs fell during the first three months of the year, but the global slump in PC demand may be easing, with a considerable slowdown from last year's drops.
 
Google Glass Finds a Home in Medical Education, Practice
The innovative headpiece may find its niche in markets where hands-free access to data can be a big advantage. Glass experiments for doctors are already under way, with some promising results.
 

Mobile Technology Spotlight
Review: Siri-Like Cortana Fills Windows Phone Gap
With the new Cortana virtual assistant, Windows catches up with Apple's iOS and Google's Android in a major way, taking some of the best parts of Apple's and Google's virtual assistants, with new tools too.
 
With Galaxy S5, Samsung Proves Less Can Be More
Samsung has produced the most formidable rival yet to the iPhone 5s: the Galaxy S5. The device is the fifth edition of the company's successful line of Galaxy S smartphones, and shows less can be more.
 
Facebook Rolls Out Potentially Intrusive Location-Sharing
Looking for friends? Facebook users in the U.S. will soon be able to see which of their friends are nearby, using a smartphone's GPS. Could be a cool feature in some cases, or way too much information.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | Small Business | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.