New BlackEnergy Crimeware Enhanced to Target Linux Systems and Cisco Routers

Security researchers at Kaspersky Lab have unearthed new capabilities in the BlackEnergy Crimeware weapon that has now ability to hacking routers, Linux systems and Windows, targeting industry through Cisco network devices.

The antivirus vendor’s Global Research & Analysis Team released a report Monday detailing some of the new “relatively unknown” custom plug-in capabilities that the cyber espionage group has developed for BlackEnergy to attack Cisco networking devices and target ARM and MIPS platforms.

The malware was upgraded with custom plugins including Ciscoapi.tcl which targets The Borg's kit, and According to researchers, the upgraded version contained various wrappers over Cisco EXEC-commands and "a punchy message for Kaspersky," which reads, "F*uck U, Kaspersky!!! U never get a fresh B1ack En3rgy. So, thanks C1sco 1td for built-in backd00rs & 0-days."

BlackEnergy malware program was originally created and used by cybercriminals to launch Distributed Denial-of-Service (DDoS) attacks. The malware developer then added some custom plugins used to funnel banking information.

Most recently BlackEnergy malware was observed in alleged state-sponsored attacks targeting the North Atlantic Treaty Organization (NATO), Ukrainian and Polish government agencies, and a variety of sensitive European industries over the last year.

Now, the cyber espionage group has enhanced the malware program which also has the capabilities like port scanning, password stealing, system information gathering, digital certificate theft, remote desktop connectivity and even hard disk wiping and destroying.

In case if a victim knew of the BlackEnergy infection on their system, the attacker activates "dstr," the name of a plugin that destroys hard disks by overwriting them with random data. A second victim was compromised by using VPN credentials taken from the first victim.

Security researchers, Kurt Baumgartner and Maria Garnaeva, also came across BlackEnergy version that works on ARM and MIPS based systems and found that it has compromised networking devices manufactured by Cisco Systems.

However, the experts are not sure for the purpose of some plugins, including one that gathers device instance IDs and other information on connected USB drives and another that collects details on the BIOS (Basic Input/Output System), motherboard, and processor of infected systems.

"We are pretty sure that our list of [BlackEnergy] tools is not complete," the researchers wrote. "For example, we have yet to obtain the router access plugin, but we are confident that it exists. Evidence also supports the hypothesis that there is a decryption plugin for victim files."

Multiple unnamed victim companies in different countries were targeted with the latest BlackEnergy malware, including victims in Russia, Germany, Belgium, Turkey, Libya, Vietnam and several other countries.

Another Crimeware group, the Sandworm Team, believed to have used the BlackEnergy exclusively throughout 2014 at victim sites and included custom plugin and scripts of their own. Also last month, the Sandworm Team had targeted organizations across the world in an espionage campaign, and iSIGHT Partners revealed that the team used spear phishing as the major attack vector to victimize their targets.

By "Kunal Vohra", Director@H2K

Having Problem..!!! Connect with Admin
BBM: 7F72A48D


 Kunal Vohra Download Our Official Android App & Get Free Internet

"The Hackers Street"

For Daily Updates 

Malware Turning USB into undetectable Cyber Weapons

Once again USB has come up as a major threat to a vast number of users who use USB drives – including USB sticks and keyboards. Security researchers have released a bunch of hacking tools that can be used to convert USB drive into silent malware installer.

This vulnerability has come about to be known as "BadUSB", whose source code has been published by the researchers on the open source code hosting website Github, demanding manufacturers either to beef up protections for USB flash drive firmware and fix the problem or leave hundreds of millions of users vulnerable to the attack.

The code released by researchers Adam Caudill and Brandon Wilson has capability to spread itself by hiding in the firmware meant to control the ways in which USB devices connect to computers. The hack utilizes the security flaw in the USB that allows an attacker to insert malicious code into their firmware.

But Wait! What this means is that this critical vulnerability is now available online for hackers, cyber criminals and everybody to use so as to infect as many computers as they want.

SOURCE CODE AVAILABLE ONLINE TO EVERYBODY

In a talk at the Derbycon Hacker Conference in Louisville last week, the duo were able to reverse engineer the USB firmware, infect it with their own code, and essentially hijack the associated device. The researchers also underlined the danger of the Bad USB hack by going in-depth of the code.

The security hole was first revealed by researchers from Berlin-based Security Research Labs (SRLabs in Germany) at the Black Hat security conference in Las Vegas two months ago, and here you can watch the video of their presentation. The German researchers didn’t publish their source code because they thought it to be dangerous and too hard to patch.

“We really hope that releasing this will push device manufactures to insist on signed firmware updates, and that Phison will add support for signed updates to all of the controllers it sells,” Caudill said in a blog post. “Phison isn’t the only player here, though they are the most common—I’d love to see them take the lead in improving security for these devices.”

THE GOOD NEWS AND THE BAD

The good news is that this vulnerability presents in only one USB manufacturer Phison electronics, a Taiwanese electronics company. But the bad side of it is that Phison USB sticks can infect any given device they are plugged into, and the company has not yet revealed who it manufactures USB sticks for. This is the fact it is still unclear as to how widespread the problem may be at the moment.

A Phison USB stick can infect any type of computer, but it isn’t clear if its able to infect any other USB device that is plugged into them afterwards or not. However, Phison controllers are found in a very large number of USB thumb drives available on the market.

Bad USB VULNERABILITY IS UNPATCHABLE

The flaw in USB basically modifies the firmware of USB devices, which can easily be done from inside the operating system, and hides the malware in USB devices in a way that it become almost impossible to detect it. The flaw goes worst when complete formatting or deleting the contents of a USB device wouldn't vanish the malicious code, since its embedded in the firmware.

According to Wired, the vulnerability is "practically unpatchable" because it exploits "the very way that USB is designed." Once infected, each USB device will infect anything it's connected to, or any new USB stick coming into it.

IMPACT OF BadUSB ATTACK

Once compromised, the USB devices can reportedly:

• enter keystrokes
• alter files
• affect Internet activity
• infect other systems, as well, and then spread to additional USB devices
• spoofs a network card and change the computer’s DNS setting to redirect traffic
• emulates a keyboard and issue commands on behalf of the logged-in user, for example to exfiltrate files or install malware

During their Derbycon demonstration, the two researchers replicated the emulated keyboard attack, but also showed how to create a hidden partition on thumb drives to defeat forensic tools and how to bypass the password for protected partitions on some USB drives that provide such a feature.

MANUFACTURER DENIES THE PROBLEM

Security researchers tried to contact Phison electronics, the manufacturer of the vulnerable USB devices, but the company "repeatedly denied that the attack was possible."

By "Kunal Vohra", Director@H2K

Still Having Problem..!!! Connect with Admin

BBM: 7F72A48D

 Kunal Vohra Download Our Official Android App & Get Free Internet

"The Hackers Street"

For Daily Updates