Regin is the latest malicious software to be uncovered by security researchers, though its purpose is unknown, as are its operators. But experts have told the Guardian it was likely spawned in the labs of a western intelligence agency.
None of the targets of the Regin hackers reside on British soil, nor do any live in the US. Most victims are based in Russia and Saudi Arabia - 28% and 24% respectively.
Ireland had the third highest number of targets - 9% of overall detected infections. The infections lists doesn’t include any “five eyes” countries - Australia, Canada, New Zealand, the UK and the US.
“We believe Regin is not coming from the usual suspects. We don’t think Regin was made by Russia or China,” Mikko Hypponen, chief research officer at F-Secure, told the Guardian. His company first spied Regin hiding on a Windows server inside a customer’s IT infrastructure in Northern Europe.
Only a handful of countries are thought capable of creating something as complex as Regin. If China and Russia are ruled out, that would leave the US, UK or Israel as the most likely candidates.
“here are no other countries I can think of,” said F-Secure researcher Sean Sullivan, when the Guardian put this suggestion to him.
Candid Wueest, threat researcher at Symantec, which published a report on Regin over the weekend, said that the suggestion that a western state was behind the attacks was “probable”, adding “your assumptions are plausible”.
However, the inclusion of some English language in the Regin malware’s command and control communications, including repeated use of the word “shit” in data validation commands, was not a “smoking gun” pointing to an English-speaking country, according to Wueest.
Russian security firm Kaspersky Lab has named one victim of the malware: Belgian cryptographer Jean Jacques Quisquater. This year, he discovered he’d been hit by malware during an investigation into an alleged GCHQ attack on Belgium ISP Belgacom, a source told Belgian paper De Standaard.
The security firm also discovered a “mind-blowing” attack on an unnamed country in the Middle East. “In this specific country, all the victims we identified communicate with each other, forming a peer-to-peer network. The P2P network includes the president’s office, a research center, educational institution network and a bank,” claimed a blog post from Kaspersky Lab.
Regin isn’t after intellectual property, nor is it designed to cause destruction like the infamous Stuxnet worm. It is solely designed to watch over just a handful of targets, with only around 100 infections uncovered globally since it emerged in 2008, according to Wueest.
The target list not only includes government bodies, but small businesses, academics and individuals. The malware’s creators are particularly interested in the telecoms industry too: no surprise given that’s where everyone’s traffic passes through.
It appears the attackers are using typical techniques that users should be aware of. Targets may be tricked into visiting spoofed versions of well known websites and the threat may be installed through a web browser or by exploiting an application, according to Symantec’s white paper on Regin.
“On one computer, log files show that Regin originated from Yahoo! Instant Messenger through an unconfirmed exploit. On one computer, log files show that Regin originated from Yahoo! Instant Messenger through an unconfirmed exploit.”
Whoever is behind the malware has access to considerable coding and cryptographic talent. Regin is being compared to Stuxnet – which was believed to be the work of the US and Israel after it hit Iran – and Flame, another highly sophisticated cyber espionage campaign thought to have been crafted in the US.
“As we’ve been following and analyzing Regin, the complexity and the level of sophistication in the attacks has become very evident. We would place Regin in the category of highly sophisticated governmental espionage campaigns,” said Hypponen.
The malware should have been difficult to detect over the years, though Microsoft picked up on it in 2011. That’s because its only visible component is a driver - the code that provides a software interface to hardware. All its other pieces are encrypted and hidden away in different segments of a computer’s file system.
After it has completed its multi-phase attack, Regin starts its surreptitious work, capturing screenshots, taking control of the mouse’s point-and-click functions, stealing passwords, monitoring the victim’s web activity and retrieving deleted files.
It’s a highly customisable piece of work too: one Regin sample was designed to collect administration traffic for mobile base stations, while another was created for grabbing email from Exchange databases.
Experts told the Guardian that most users shouldn’t have to worry about Regin, as it appears to be part of a targeted operation, not blanket surveillance. However, most security firms will now be adding Regin to their list of detected malware in an effort to block it.
No comments:
Post a Comment