Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/10/2015
04:45 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Chinese Hacking Group Codoso Team Uses Forbes.com As Watering Hole

ASLR vulnerability patched today used in tandem with previously patched Flash vuln to carry out drive-by-downloads against political and economic targets

Another day, another cyberespionage campaign attributed to a Chinese hacking group. Today's newly identified hacking push is a watering hole attack against Forbes and other targets last November that's been attributed by iSIGHT Partners and Invincea to likely be the handiwork of a long-running group they call Codoso Team, but which has also been named as Sunshop Group. The campaign was made possible by a zero-day attack that strung together a now-patched Adobe vulnerability with a bypass vulnerability in Microsoft's ASLR technology for Internet Explorer that the company patched today.

Research evidence only showed the attack to occur over a couple of days, but in addition to some highly targeted web properties it infected the Thought of the Day widget on Forbes.com with the intent to perform drive-by-download attacks via the Flash vulnerability. In spite of the mainstream appeal via Forbes, which is ranked by Alexa as the 61st most popular website on the Internet, the targets of this attack were fairly narrow. Attackers seemed to be going after defense sector firms, Chinese dissident groups and other political target, as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy.

"So what’s really interesting about this is it separates a lot of cyber espionage activity from say criminal activity.  These guys don’t typically just put drive-bys anywhere," says John Hultquist, senior manager of cyber espionage threat intelligence for iSIGHT.  "They don’t want anybody’s information.  What they want is information associated with the requirements that they have.  Usually those requirements are gathering intelligence on intellectual property, gathering strategic intelligence, gathering information on say dissidents or security issues that they’re working."

First publicly identified as the Sunshop Group by FireEye in 2013, Codoso Team has been on security research radars since 2010 as it perpetrated numerous targeted attacks using zero-day vulnerabilities.

"You may remember in 2010 the prize was actually awarded to a noted Chinese dissident," says Hultquist.  "Shortly after that these operators went in, popped the website, and used that website to serve up exploits to visitors, again a very targeted concept.  Since then they don’t only operate this way or through this manner, they’re also carrying out targeted spearphishing attacks." 

It also shares attack techniques with Deep Panda, which like Codoso, leans heavily on the use of the Derusbi malware to carry out attacks. While they may be sharing resources, iSIGHT believes them to be two distinct gangs.

According to Anup Ghosh, CEO at Invincea, his team first noticed activity around the Forbes.com site through a defense firm customer. Typically used to tracking broad malvertising campaigns using similar media sites, his team was surprised to see the attack only going after specific customer types, primarily in the defense sector. He also says the attack was unique through the use of chained zero-day exploits. Not only was it attacking a Flash zero-day, but it was also leveraging a zero-day in ASLR to bypass that mitigation technique.

"Effectively in modern operating systems and browsers there is a layer of technology that Microsoft has added to the mix that really makes it much more difficult for a particular exploit to figure out what address base it’s operating in.  So it makes it more difficult or nearly impossible to execute a buffer overflow," explains Patrick McBride, vice president at iSIGHT. "In this case the team was able to exploit that ASLR, get outside of that box, if you will, and then directly exploit the flash vulnerability. "

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
aws0513
50%
50%
aws0513,
User Rank: Ninja
2/11/2015 | 9:46:46 AM
Some questions regarding the Forbes.com incident.
When were the Forbes.com operators/owners notified of the compromise?
If not, why?
If so, did they take any actions?
If no actions were taken, why?
If actions were taken, what were they?

The reason I am asking these questions is that I could not find any indication in either of the referenced technical write-ups that the operators of the Forbes.com website were notified of the problem their widget was causing.  Nor were there any indication of any actions taken on the Forbes.com website when/if they were notified.

To me, this indicates that they knew about the problem in November, but let it hang out there to continue to be a risk factor until the Adobe and Microsoft patches were released. 
If this is indeed the case, IMHO someone has the cart before the horse on remediation actions here.

Maybe there is more to this story from the Forbes.com side of the issue.  I would hope they had an opportunity to mitigate the risk before waiting on vendor patches.
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21070
PUBLISHED: 2021-04-19
Adobe Robohelp version 2020.0.3 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with permissions to write to the file system could leverage this vulnerability to escalate privileges.
CVE-2020-7851
PUBLISHED: 2021-04-19
Innorix Web-Based File Transfer Solution versuibs prior to and including 9.2.18.385 contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the internal method. A remote attacker could induce a user to access a crafted web page, causing damage...
CVE-2021-29399
PUBLISHED: 2021-04-19
XMB is vulnerable to cross-site scripting (XSS) due to inadequate filtering of BBCode input. This bug affects all versions of XMB. All XMB installations must be updated to versions 1.9.12.03 or 1.9.11.16.
CVE-2021-23381
PUBLISHED: 2021-04-18
This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23374
PUBLISHED: 2021-04-18
This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.