Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/10/2015
04:45 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Chinese Hacking Group Codoso Team Uses Forbes.com As Watering Hole

ASLR vulnerability patched today used in tandem with previously patched Flash vuln to carry out drive-by-downloads against political and economic targets

Another day, another cyberespionage campaign attributed to a Chinese hacking group. Today's newly identified hacking push is a watering hole attack against Forbes and other targets last November that's been attributed by iSIGHT Partners and Invincea to likely be the handiwork of a long-running group they call Codoso Team, but which has also been named as Sunshop Group. The campaign was made possible by a zero-day attack that strung together a now-patched Adobe vulnerability with a bypass vulnerability in Microsoft's ASLR technology for Internet Explorer that the company patched today.

Research evidence only showed the attack to occur over a couple of days, but in addition to some highly targeted web properties it infected the Thought of the Day widget on Forbes.com with the intent to perform drive-by-download attacks via the Flash vulnerability. In spite of the mainstream appeal via Forbes, which is ranked by Alexa as the 61st most popular website on the Internet, the targets of this attack were fairly narrow. Attackers seemed to be going after defense sector firms, Chinese dissident groups and other political target, as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy.

"So what’s really interesting about this is it separates a lot of cyber espionage activity from say criminal activity.  These guys don’t typically just put drive-bys anywhere," says John Hultquist, senior manager of cyber espionage threat intelligence for iSIGHT.  "They don’t want anybody’s information.  What they want is information associated with the requirements that they have.  Usually those requirements are gathering intelligence on intellectual property, gathering strategic intelligence, gathering information on say dissidents or security issues that they’re working."

First publicly identified as the Sunshop Group by FireEye in 2013, Codoso Team has been on security research radars since 2010 as it perpetrated numerous targeted attacks using zero-day vulnerabilities.

"You may remember in 2010 the prize was actually awarded to a noted Chinese dissident," says Hultquist.  "Shortly after that these operators went in, popped the website, and used that website to serve up exploits to visitors, again a very targeted concept.  Since then they don’t only operate this way or through this manner, they’re also carrying out targeted spearphishing attacks." 

It also shares attack techniques with Deep Panda, which like Codoso, leans heavily on the use of the Derusbi malware to carry out attacks. While they may be sharing resources, iSIGHT believes them to be two distinct gangs.

According to Anup Ghosh, CEO at Invincea, his team first noticed activity around the Forbes.com site through a defense firm customer. Typically used to tracking broad malvertising campaigns using similar media sites, his team was surprised to see the attack only going after specific customer types, primarily in the defense sector. He also says the attack was unique through the use of chained zero-day exploits. Not only was it attacking a Flash zero-day, but it was also leveraging a zero-day in ASLR to bypass that mitigation technique.

"Effectively in modern operating systems and browsers there is a layer of technology that Microsoft has added to the mix that really makes it much more difficult for a particular exploit to figure out what address base it’s operating in.  So it makes it more difficult or nearly impossible to execute a buffer overflow," explains Patrick McBride, vice president at iSIGHT. "In this case the team was able to exploit that ASLR, get outside of that box, if you will, and then directly exploit the flash vulnerability. "

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
aws0513
50%
50%
aws0513,
User Rank: Ninja
2/11/2015 | 9:46:46 AM
Some questions regarding the Forbes.com incident.
When were the Forbes.com operators/owners notified of the compromise?
If not, why?
If so, did they take any actions?
If no actions were taken, why?
If actions were taken, what were they?

The reason I am asking these questions is that I could not find any indication in either of the referenced technical write-ups that the operators of the Forbes.com website were notified of the problem their widget was causing.  Nor were there any indication of any actions taken on the Forbes.com website when/if they were notified.

To me, this indicates that they knew about the problem in November, but let it hang out there to continue to be a risk factor until the Adobe and Microsoft patches were released. 
If this is indeed the case, IMHO someone has the cart before the horse on remediation actions here.

Maybe there is more to this story from the Forbes.com side of the issue.  I would hope they had an opportunity to mitigate the risk before waiting on vendor patches.
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19619
PUBLISHED: 2019-12-06
domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.
CVE-2019-19616
PUBLISHED: 2019-12-06
An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment fun...
CVE-2019-19617
PUBLISHED: 2019-12-06
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
CVE-2012-1114
PUBLISHED: 2019-12-05
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php.
CVE-2012-1115
PUBLISHED: 2019-12-05
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.