Attacks/Breaches
5/29/2014
09:45 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Iranian Cyberspies Pose as Journalists Online To Ensnare Their Targets

Cyberspying campaign out of Iran combines social engineering and social media to steal credentials from a wide array of US and Israeli military, government, and defense contractors.

Yet another cyber espionage campaign by Iranian hackers has been discovered, but this one comes with an elaborate social engineering twist: The attackers target their victims via social media using more than a dozen phony or duped journalist personas as well as a phony news site.

The so-called "Newscaster" cyber espionage operation has been underway since at least 2011, according to security firm iSight Partners, which published a report on the attacks today. The attackers, out of Iran, target US and Israeli military, government, and defense contractors by posing as journalists on Facebook, LinkedIn, YouTube, and Twitter. The attackers even set up a phony news media website called NewsOnAir.org, where they repost real articles by AP, BBC, and Reuters, and others with fake journalist bylines that then share "their" articles via social media.

More than 2,000 individuals have been found affected by the campaign, which seeks to steal user credentials as well as corporate and personal emails of targets, including the US military, Congressional staff, Washington-area journalists, diplomatic corps, US defense contractors, Israeli defense contractors, and members of the US/Israeli lobby. The attackers also have targeted individuals in the UK, Saudi Arabia, and Iraq.

Compared with Chinese cyber espionage campaigns, the attacks are fairly rudimentary, technology-wise, with low-level IRC malware and links from NewsOnAir.org to phishing sites that steal and harvest user credentials but appear as legitimate links such as Outlook Web Access and Google and Yahoo login pages. The sophistication lies in the creativity of building phony journalist personas online in social media and gathering connections over time. iSight Partners says the attackers successfully connected or friended via social media several current and former senior military leaders as well as senior foreign policy officials working on nuclear nonproliferation and sanctions.

"What we infer from the length of the operation is that they've had success there," says Tiffany Jones, senior vice president at iSight, which has been tracking the campaign since last year. "While they may not be highly sophisticated or technical, they make it up in creativity and persistence. The method was not necessarily novel, but they are pretty brash and patient."

[The Iranian Ajax Security Team of hackers went from high-profile hacktivists posturing on Facebook to cyberspies encrypting stolen information from defense contractors. Read On The Trail of an Iranian Hacking Operation].

Jones tells us the attackers even used real journalists' identities to bolster the legitimacy of two of their online personas: the name of Thomson Reuters reporter Sandra Maler and a picture of Fox News's Kimberly Gulifoyle. "They were utilizing fictitious personas to ultimately connect to high-value targets and become friends, [gather] LinkedIn contacts, and to [ultimately] scrape credentials for access into accounts. They use social media for reconnaissance and also to propagate false information."

This allowed the attackers, for instance, to use a phony journalist persona to connect with a high-value government official. "They... gain cred as a journalist, do recon on who their [target's] friends and family are, where they go to school, what contacts they have in their current network. Then they begin to connect and become friends over time within their circle of trust," says Jones.

Once their targets were in their "circle" of online social media contacts, the attackers attempted to harvest the targets' credentials via phishing emails with malicious links, for example. '"We see them sending fictitious links that appear to be YouTube links. That takes you to a [phony] Google+ login, where you provide credentials and it takes you to a YouTube video," says John Hultquist, head of cyber espionage intelligence at iSight.

The hackers behind this operation are not connected to the Iranian Ajax Security Team, Hultquist says. The Ajax Team, which FireEye recently identified as behind a series of attacks dubbed Operation Saffron Rose, uses spear phishing attacks and spoofed Microsoft Outlook Web Access and VPN login pages aimed at stealing user credentials from defense contractors and other members of the defense industry. The Ajax Team had previously been a notorious group of hacktivists, and its evolution to cyber espionage was an indication of a more mature and rapidly evolving Iranian threat. Security experts who track cyber spying operations have noticed a shift in Iranian spying online.

CrowdStrike tracks the Newscaster group of attackers as well and dubs them "Charming Kitten," says Adam Meyers, vice president of intelligence at CrowdStrike. Meyers says, aside from the credential-harvesting tactic, the attackers also employ backdoor malware via spearphishing emails. "One way we've seen is [malware] was actually was delivered as a file that when executed would show a pop up a picture or image, so the user would think they opened a document, but it was actually installing malware."

Meyers says CrowdStrike tracks at least five different cyber espionage groups out of Iran. But the lines are a bit blurred when it comes to these groups in Iran, he says. "They are organized differently than [groups] in China. We track actors more than specific groups" in Iran.

iSight was not able to discern just what the attackers may or may not have stolen. Jones says iSight traced the attack's infrastructure domains to Tehran, and discovered telltale Iranian content in the attacks. Among the markers is an IRC malware password used widely in the campaign: "Parastoo," a Persian word. The attackers also operate mainly during working hours in Tehran, she says.

The catch, of course, is that social engineering is difficult to track or defend. "We don't have traditional defenses that protect against these types of threats. But there some best-practices, such as don't [connect] or friend people you don't know, and don't endorse them for skills on LinkedIn if you don't know them," Jones advises.

iSight also recommends that organizations check for any traffic to and from Newscaster domains, as well as communications to URLs associated with Newscaster social media accounts.

The full iSight report on the campaign is available here for download.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/31/2014 | 11:25:42 AM
Social Engineering and Firewall Subversion
SANS denotes Social engineering as one of the top 4 methods for getting into the internal network and behind the firewall. I would have to agree and rank at least in the top 2 of the 4. Think of it in logical terms. Linkedin tracks your professional background. I look you up on Linkedin and already know your place of business. This is helpful with probing the helpdesk for internal credentials.

If I can foster an email correspondence with anyone at the enterprise, as long as the email isn't aliased, I could possibly have your username. From there facebook could be used to pull personal data and maybe hone down the field of a password possibility if you create your own passwords. With this put into the specialized fields of a dictionary attack, it could take a lot less time to discover your password.

Now account lockouts are the next piece of security that would prevent intrusion. But if I am a hacker I do not want to go on site and try to bypass physical security as well. I would rather try and find an in remotely. Next step for me is to call the helpdesk for remote documentation. Some enterprises have multiple avenues for working remotely. Going back to my previous point about lockouts, the functionality of a remote client is to allow you to work from anywhere. Functionality is the main purpose here. Many don't have a lockout mechanism. So I can try to log in remotely as many times as I want, making my dictionary attack much more efficient. Once I have the credentials. I log in remotely during off hours, and because I don't need to change your password you may not be any the wiser. 

This is all thanks to social engineering.
Bprince
50%
50%
Bprince,
User Rank: Ninja
5/29/2014 | 9:50:16 PM
Re: Traditional defenses
It is very easy to fall for something like that on a social network, especially after the scammer gets one person who you trust to friend them. Then it can cascade, because other people will say, 'well if so and so knows her from our company, I must have met her as well' or 'that person must be trustworthy.' It is a good way to conduct reconnaissance for spear-phishing. 

BP
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
5/29/2014 | 5:11:37 PM
Re: A Fascinating Look
Exactly! I have several people hanging in limbo right now for that very reason! Though I doubt any of them are losing sleep over it. :)
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/29/2014 | 5:07:32 PM
Re: A Fascinating Look
So true. I find myself thinking I have to appear rude rather than risk getting 0wned when I get requests for connections to folks I don't know or remember!
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
5/29/2014 | 5:04:52 PM
Re: A Fascinating Look
That's wild -- but it's easy to see how people could fall for it. I recall almost falling victim to something a few weeks ago when a real friend's Facebook was hijacked. A fraudulent account was created in his name and the fraudster sent friend requests out. Fortunately, my real friend notified all his contacts about the fake account set up in his name (with his photo) so I didn't accept the duplicate friend request. But I would have done, probably, thinking he or FB had done something to his original account by mistake. 

And we all meet so many people that it's hard to recall all their names. If someone seems legit and mentions meeting you at a conference three months ago, odds are many of us might take this at face value rather than run the risk of offending someone who appeared legit!
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
5/29/2014 | 5:01:18 PM
Re: Traditional defenses
No, I don't think those suggestions are good enough. Especially when you're dealing with a group like this, which uses real journalists' names to try and reach its targets. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/29/2014 | 4:58:15 PM
Re: A Fascinating Look
This is reminiscent of the controversial "Robin Sage" experiment conducted a few years back, where a phony persona was set up on LinkedIn, Facebook and Twitter to see who would connect to "Robin," who scored connections with people in the Joint Chiefs of Staff, the CIO of the NSA, an intelligence director for the U.S. Marines, a chief of staff for the U.S. House of Representatives, and several Pentagon and DoD employees. "She" even got job offers and dinner invites. Robin Sage and this Iranian campaign demonstrate how easy it is to fall into the trap of trusting someone online without truly vetting them. Anyone can fall victim to this, which is what makes it so disturbing.

 

 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/29/2014 | 4:50:36 PM
Traditional defenses
It's pretty scary to think how defenseless we are against social engineering. Are best-practices like "don't [connect] or friend people you don't know, and don't endorse them for skills on LinkedIn if you don't know" enough to stop a determinined attacker?
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/29/2014 | 4:50:30 PM
Traditional defenses
It's pretty scary to think how defenseless we are against social engineering. Are best-practices like "don't [connect] or friend people you don't know, and don't endorse them for skills on LinkedIn if you don't know" enough to stop a determinined attacker?
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
5/29/2014 | 4:49:23 PM
Re: A Fascinating Look
Social Media is  a powerful instrument for military operation. I wrote an excellent post on the topic more than one year ago where are explained all the techniques based on exploitation of social networking platform.

 

http://resources.infosecinstitute.com/social-media-use-in-the-military-sector/

 

Let me also another post we it is explained how to "poison" a social network for various purposes.

 

http://securityaffairs.co/wordpress/352/digital-id/social-network-poisoning-they-want-to-spy-on-us-we-evade.html

Regards

 

 
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-5142
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.

CVE-2010-5302
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.

CVE-2010-5303
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15 (r85), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to $errorString.

CVE-2014-0965
Published: 2014-08-21
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted SOAP response.

CVE-2014-3022
Published: 2014-08-21
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted URL that triggers an error condition.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.