Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
GET RECOGNIZED.
Let an ISACA® certification
elevate your career.

Register today and save
Network Security
DDoS Protection Powered By Verisign
Average Rating:
Rate this article:  
MiniDuke Hackers Hit Governments with PDF Exploit

MiniDuke Hackers Hit Governments  with PDF Exploit
By Jennifer LeClaire

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

The MiniDuke attackers are still active and have created malware as recently as Feb. 20, according to Kaspersky. To compromise victims, the attackers used social engineering techniques, which involved sending malicious PDF documents to their targets. The PDFs were highly relevant to their victims, and attack Adobe Reader versions 9, 10, and 11.
 

Related Topics

Hackers
Kaspersky
Adobe
Acrobat
PDF



An online espionage campaign has been exposed. Kaspersky Lab just published a research report that analyzes a series of security incidents that leverage the PDF exploit in Acrobat Reader.

The finding: a new, highly customized malicious program known as MiniDuke is at the heart of the attacks. Kaspersky reports that the MiniDuke backdoor was used to attack multiple government entities and institutions worldwide during the past week.

A number of high-profile targets have already been compromised by the MiniDuke attacks, including government entities in Ukraine, Belgium, Portugal, Romania, the Czech Republic and Ireland. A research institute, two think tanks, and a healthcare provider in the United States were also compromised, along with a prominent research foundation in Hungary.

MiniDuke Attacks 'Old School'

Eugene Kaspersky, founder and CEO of Kaspersky Lab, called it a "very unusual" cyberattack. He remembers this style of malicious programming from the end of the 1990s and the beginning of the 2000s.

"I wonder if these types of malware writers, who have been in hibernation for more than a decade, have suddenly awoken and joined the sophisticated group of threat actors active in the cyberworld," he pondered. "These elite, 'old school' malware writers were extremely effective in the past at creating highly complex viruses, and are now combining these skills with the newly advanced sandbox-evading exploits to target government entities or research institutions in several countries."

According to Kaspersky, the MiniDuke attackers are still active and have created malware as recently as Feb. 20. To compromise victims, the attackers used social engineering techniques, which involved sending malicious PDF documents to their targets. The PDFs were highly relevant -- with well-crafted content that fabricated human rights seminar information and Ukraine's foreign policy and NATO membership plans.

These malicious PDF files were rigged with exploits attacking Adobe Reader versions 9, 10, and 11, bypassing its sandbox, Kaspersky reported, and a toolkit was used to create these exploits and it appears to be the same toolkit that was used in the recent attack reported by FireEye. However, the firm noted, the exploits used in the MiniDuke attacks were for different purposes and had their own customized malware.

Adobe Responds to Incident

"MiniDuke's highly customized backdoor was written in Assembler and is very small in size, being only 20kb," added Kaspersky."The combination of experienced old school malware writers using newly discovered exploits and clever social engineering to compromise high profile targets is extremely dangerous."

When loaded at system boot, Kaspersky reported, the downloader uses a set of mathematical calculations to determine the computer's unique fingerprint, and in turn uses this data to uniquely encrypt its communications later. It is also programmed to avoid analysis by a hard-coded set of tools in certain environments like VMware. If it finds any of these indicators it will run idle in the environment instead of moving to another stage and exposing more of its functionality by decrypting itself further; this indicates the malware writers know exactly what antivirus and IT security professionals are doing in order to analyze and identify malware.

"The incident response process Adobe has put together and refined over the year has served us well, and we continue to evolve as the threats change," said Brad Arkin, senior director of product security at Adobe.

"The Reader and Acrobat patches we put out last week will ensure users are safe from the 'MiniDuke' campaign, so it's important that users update to the latest version if they have not done so already," Arkin told us.
 

Tell Us What You Think
Comment:

Name:



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Network Security
1.   Gmail Hackable by Android Apps
2.   UPS Stores Hit by Data Breach
3.   Target Data Breach Cost: $148 Million
4.   Aruba Handles Black Hat with Aplomb
5.   Chinese Hackers Steal Patient Data


advertisement
UPS Stores Hit by Data Breach
Biz must adopt better security measures.
Average Rating:
Target Data Breach Cost: $148 Million
Better customer data protection needed.
Average Rating:
FBI Cybersquad To Add Agents
Rewarded for recent security successes.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Researchers Find Malicious Android Apps Can Hack Gmail
A new study shows that a weakness in the Android mobile operating system can be used to steal sensitive, personal info from unwitting users. Gmail proved to be the easiest app to attack; Amazon, the hardest.
 
UPS Stores in 24 States Hit by Data Breach
Big Brown has been breached. UPS said that about 105,000 customer transactions at 51 of its UPS Store locations in 24 states could have been compromised between January and August.
 
Cost of Target Data Breach: $148 Million Plus Loss of Trust
The now infamous Target data breach is still costing the company -- and its shareholders -- plenty. In fact, the retailing giant forecast the December 2013 incident cost shareholders $148 million.
 

Enterprise Hardware Spotlight
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 
Feds OK $2.3 Billion IBM-Lenovo x86 Server Deal
IBM and Lenovo are celebrating U.S. approval of their x86-based server deal, having cleared some major security hurdles. The deal makes Lenovo a major player for enterprise data centers.
 
Three New Lenovo PCs Aimed at Business Users
With businesses wanting computing solutions that do more for less money, Lenovo has unveiled three new desktop PCs that it says offer solid computing at a budget-minded price.
 

Mobile Technology Spotlight
Screen Shortage Briefly Puts Brakes on iPhone 6
RAM? Check. Antenna switch? Check. Screen? Oops. Parts suppliers for Apple have found themselves facing a shortage of screens for the new iPhone 6 as next month's release date for the new smartphone looms.
 
Bounty Offered to Coders for Oculus Rift Bugs
Coders who find bugs in software for the Oculus Rift VR immersive headset could receive a reward of at least $500 under Facebook's White Hat bounty program. Facebook acquired Oculus in March.
 
Google Glass Adds Voice Access to Phone Contacts
The latest update to Google Glass will let users access their top 20 phone contacts with voice commands alone. A user can then choose a phone call, Google hangouts, e-mail or text messaging.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.