A new attack uses compromised LoJack endpoint software to take root on enterprise networks.

Researchers have identified a new attack that uses computer-recovery tool LoJack as a vehicle for breaching a company's defenses and remaining persistent on the network. The good news is that it hasn't started specific malicious activity — yet.

Arbor Networks' ASERT, acting on a third-party tip, found a subtle hack involving legitimate LoJack endpoint agents. The threat actors didn't change any of the legitimate actions of the software. All they did was strip out the legitimate C2 (command and control) server address from the system and replace it with a C2 server of their own.

Richard Hummel, manager of threat research at NETSCOUT Arbor's ASERT, says that the subtlety of the action means that most existing security software and systems will not provide any indication that something is going wrong. "If they're running as an admin, they might not see it," Hummel says. "This doesn't identify as malicious or malware, so they might just see a subtle warning."

The addresses of the new C2 servers are pieces of the analysis that led researchers to believe that the campaign is attributable to Fancy Bear, a Russian hacking group responsible for a number of well-known exploits. On initial execution, the infected software contacts on of the C2 servers, which logs its success. Then, the new LoJack application proceeds to … wait. It simply does what LoJack does, with no additional communication or activity.

Hummel says that the lack of activity and lack of steps to prevent legitimate activity means that most security software won't recognize that the app is anything but legitimate.

Once in place, the nature of the LoJack system's activities means that it's very persistent, remaining in place and active through reboots, on/off cycles, and other disruptive events.

"This is basically giving the attacker a foothold in an agency," Hummel says. "There's no LoJack execution of files, but they could launch additional software at a later date." And the foothold that the software gains is a strong one.

"If they're on a critical system or the user is someone with high privileges, then they have a direct line into the enterprise," Hummel explains, adding, "with the permissions that LoJack requires, [the attackers] have permission to install whatever they want on the victims' machines."

There is, so far, nothing about the attack that contains a huge element of novelty. As for the code, Hummel says that this particular mechanism for attack has been around since 2014, when the software that is now LoJack was called Computrace. Even then, Hummel says, "researchers talked about how LoJack maintains its persistence."

And while Hummel's team has suspicions about infection mechanisms, they aren't yet sure what's happening. "We did some initial analysis on how the payload is being distributed and other Fancy Bear attacks, and we can't verify the infection chain," Hummel says, though he's quick to add, "We don't think that LoJack is distributing bad software."

With stealth and persistence on its side, how does an enterprise prevent this new attack from placing bad software on corporate computers? Hummel says everything begins with proper computer hygiene. "Users will be prompted for permission warnings — don't just blow by them," he says.

Next, the IT security team can scan for five domains currently used by the software:

  • elaxo[.]org

  • ikmtrust[.]com

  • lxwo[.]org

  • sysanalyticweb[.]com (2 forms)

Each of these domains should be blocked by network security mechanisms.

It's rare to have warning of an active infection method prior to damaging attacks using the infection target. Organizations now have time to learn about the tactic and disinfect compromised endpoints before the worst occurs.

Related Content:

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights