Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:25 PM
Connect Directly

Russian Threat Group May Have Devised a 'Man-on-the-Side' Attack

Data from an intrusion last year suggests Iron Liberty group may have a new trick up its sleeve, Secureworks says.

Iron Liberty, a Russia-based cyber espionage group known for targeting energy, nuclear, and defense organizations worldwide, may have developed a dangerous new technique called a "man-on-the side" attack.

Secureworks warned about the new threat in a report this week describing a "man-on-the-side" (MOTS) attack to install malware. The security firm says MOTS differs from a typical man-in the-middle (MITM) attack.

"The difference between MITM and MOTS is straightforward," says Don Smith, senior director of the Counter Threat Unit at Secureworks. "With MITM, the attacker is present on infrastructure the traffic is traversing and can tamper with it," he says. "With MOTS, the attacker has sufficient access to observe and inject traffic which through timing/bandwidth is consumed by the victim before the legitimate reply arrives."

The security vendor's theory is based on its analysis of a campaign last year where Iron Liberty actors managed to install a malware tool called Karagany on a target system without leaving any trace of how they did it. According to Secureworks, its research showed no evidence of a phishing email, drive-by-download, or a malicious link being used to drop the malware on the system.

Secureworks' forensic analysis showed that Karagany was installed on the system shortly after its user initiated a legitimate request to download Adobe Flash over HTTP from Adobe's official website. Logs showed that Karagany was installed on the system in the short period of time during when the user request was initiated and the Adobe file was downloaded.

Secureworks found that Kargany files were dropped on the system just 20 seconds after the initial Flash Player binary was downloaded, and by 27 seconds, additional malicious files were downloaded on the system.

Multiple Explanations

"There are several credible explanations for how the Karagany payload was delivered alongside the Adobe installer file," Secureworks said in its report. But none of them appeared very likely in this case, the company said.

For example, the malware could have been downloaded if Adobe's website had been compromised. But Secureworks' investigation showed no indication that such a thing had happened during the compromise timeframe.

Another possibility was that someone with access to the victim organization's internal or gateway systems had intercepted and manipulated traffic between Adobe and the infected system in a typical MITM attack. Here again, Secureworks was unable to find any signs that such activity had taken place. A third possibility, which Secureworks similarly deemed unlikely, was a Border Gateway Protocol (BGP) attack where the user's traffic was routed through attacker-controlled systems.

Instead, they believe the Iron Liberty actors likely managed to compromise a router outside the victim organization, and then used it to intercept the Adobe installer request and return a Trojanized response, Secureworks said.

"Being 100% clear, the traffic injection we saw in these cases could have come from Man on the Side or from Man in the Middle," Smith says. "We do not know how the fraudulent traffic was injected. [It] could have been router compromise or could have been traffic injection."

For enterprises, attacks like these are another reason not to implicitly trust anything on the Internet. Protecting against a man-on-the side attack is no different from dealing with a man-in-the-middle attack, Smith says.

Some common mitigating tactics include using SSL encryption and checking the hashes of files that are downloaded from the Internet to make sure they match with the original file.

With a man-on-the-side attack, there are two parties trying to respond to the same request and the bad actor's goal is to get in first, Smith says.

The only way to detect such activity would be to monitor the sequence of packets arriving in response to a request and looking for out of sequence packets arriving and likely being discarded. "You need to be extremely well instrumented to detect it," Smith says.

Related Content:


Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
7/27/2019 | 2:26:33 PM
Ways to address the MOTS issue

"The difference between MITM and MOTS is straightforward," says Don Smith, senior director of the Counter Threat Unit at Secureworks. "With MITM, the attacker is present on infrastructure the traffic is traversing and can tamper with it," he says. "With MOTS, the attacker has sufficient access to observe and inject traffic which through timing/bandwidth is consumed by the victim before the legitimate reply arrives."

 Wouldn't it be better to implement IPv6 and utilize its capabilities, it has a number of advantages that IPv4 does not:
  • IPv6 can run end-to-end encryption
  • Widespread adoption of IPv6 will, therefore, make man-in-the-middle attacks significantly more difficult
  • IPv6 also supports more-secure name resolution

Also, why not implement ways to block countries, this can be done using Powershell and IPtables/UFW, the user would have to do it from an ingress and egress standpoint. I would think this would be a way to mitigate this issue because the payload could not be downloaded from "Command and Control".

Something to think about.

For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-14
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
PUBLISHED: 2019-10-14
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
PUBLISHED: 2019-10-14
In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
PUBLISHED: 2019-10-14
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen).
PUBLISHED: 2019-10-14
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.