Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

2/27/2020
12:35 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

'Cloud Snooper' Attack Circumvents AWS Firewall Controls

Possible nation-state supply chain attack that cheated both cloud and on-premise firewalls acts like a "wolf in sheep's clothing," Sophos says.

[UPDATED 2/27 with new information from Sophos that the attack actually hit on-premise firewalls and servers in the victim organization. This article originally reported on the initial research by Sophos, which had concluded that the malware had the ability to breach on-site firewalls.]

RSA CONFERENCE 2020 - San Francisco - A recently spotted targeted attack employed a rootkit to sneak malicious traffic through the victim organization's AWS and on-premise firewalls and drop a remote access Trojan (RAT) onto its cloud-based servers.

Researchers at Sophos discovered the attack while inspecting infected Linux and Windows EC2-based cloud infrastructure servers running in Amazon Web Services (AWS). The attack, which Sophos says is likely the handiwork of a nation-state, uses a rootkit that not only gave the attackers remote control of the servers but also provided a conduit for the malware to communicate with their command-and-control servers. According to Sophos, the rootkit also allowed the C2 servers to remotely control servers physically located in the organization as well.

"The firewall policy was not negligent, but it could have been better," said Chet Wisniewski, principal research scientist at Sophos. The attackers masked their activity by hiding it in HTTP and HTTPS traffic. "The malware was sophisticated enough that it would be hard to detect even with a tight security policy" in the AWS firewall, he said. "It was a wolf in sheep's clothing ... blending in with existing traffic."

Sophos declined to reveal the victim organization, but said the attack appears to be a campaign to reach ultimate targets via the supply chain - with this as just one of the victims. Just who is behind the attack is unclear, but the RAT is based on source code of the Gh0st RAT, a tool associated with Chinese nation-state attackers. Sophos also found some debug messages in Chinese.

The attackers appear to reuse the same RAT for both the Linux and Windows servers. "We only observed the Linux RAT talking to one server and the Windows talking to a different control server, so we're not sure if it's even the same infrastructure," Wisniewski said. The C2 has been taken down, he noted.

Just how the attackers initially hacked into the victim's network is unclear, but Sophos suggests one possibility is the attackers infiltrated a server via SSH. They also don't have a lot of intel on the rootkit, such as which port it abused, nor do they know for sure what they were after. "It's likely a supply chain attack, targeting this organization to get all of their downstream" clients or customers, Wisniewski said. 

One of the rare aspects of the attack: It targeted Linux with a rootkit, which was called Snoopy. "They dropped the driver part of the rootkit, and called it Snoopy. Had it been called a legitimate file name on the Linux box, we probably wouldn't have noticed it," Wisniewski said. And malware for Linux to date has been relatively rare, too, with mainly cryptojackers, he added.

Cloud Snooper's techniques for now appear to be rare, but like many unique attacks like this, it's only a matter of time before they are imitated. "Every time we see something done in a targeted attack usually by a nation-state, a couple of years later cybercriminals [adopt similar tactics]," Wisniewski said.

"This case is extremely interesting as it demonstrates the true multi-platform nature of a modern attack," wrote Sophos researcher Sergei Shevchenko in the company's technical report on Cloud Snooper.

Sophos recommends deploying AWS's boundary firewall function, keeping Internet-facing servers fully patched, and hardening SSH servers to protect against Cloud Snooper.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Prevent an AWS Cloud Bucket Data Leak."

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24847
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
CVE-2020-24848
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVE-2020-5990
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
CVE-2020-25483
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-5977
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.