Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

2/27/2020
12:35 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

'Cloud Snooper' Attack Circumvents AWS Firewall Controls

Possible nation-state supply chain attack that cheated both cloud and on-premise firewalls acts like a "wolf in sheep's clothing," Sophos says.

[UPDATED 2/27 with new information from Sophos that the attack actually hit on-premise firewalls and servers in the victim organization. This article originally reported on the initial research by Sophos, which had concluded that the malware had the ability to breach on-site firewalls.]

RSA CONFERENCE 2020 - San Francisco - A recently spotted targeted attack employed a rootkit to sneak malicious traffic through the victim organization's AWS and on-premise firewalls and drop a remote access Trojan (RAT) onto its cloud-based servers.

Researchers at Sophos discovered the attack while inspecting infected Linux and Windows EC2-based cloud infrastructure servers running in Amazon Web Services (AWS). The attack, which Sophos says is likely the handiwork of a nation-state, uses a rootkit that not only gave the attackers remote control of the servers but also provided a conduit for the malware to communicate with their command-and-control servers. According to Sophos, the rootkit also allowed the C2 servers to remotely control servers physically located in the organization as well.

"The firewall policy was not negligent, but it could have been better," said Chet Wisniewski, principal research scientist at Sophos. The attackers masked their activity by hiding it in HTTP and HTTPS traffic. "The malware was sophisticated enough that it would be hard to detect even with a tight security policy" in the AWS firewall, he said. "It was a wolf in sheep's clothing ... blending in with existing traffic."

Sophos declined to reveal the victim organization, but said the attack appears to be a campaign to reach ultimate targets via the supply chain - with this as just one of the victims. Just who is behind the attack is unclear, but the RAT is based on source code of the Gh0st RAT, a tool associated with Chinese nation-state attackers. Sophos also found some debug messages in Chinese.

The attackers appear to reuse the same RAT for both the Linux and Windows servers. "We only observed the Linux RAT talking to one server and the Windows talking to a different control server, so we're not sure if it's even the same infrastructure," Wisniewski said. The C2 has been taken down, he noted.

Just how the attackers initially hacked into the victim's network is unclear, but Sophos suggests one possibility is the attackers infiltrated a server via SSH. They also don't have a lot of intel on the rootkit, such as which port it abused, nor do they know for sure what they were after. "It's likely a supply chain attack, targeting this organization to get all of their downstream" clients or customers, Wisniewski said. 

One of the rare aspects of the attack: It targeted Linux with a rootkit, which was called Snoopy. "They dropped the driver part of the rootkit, and called it Snoopy. Had it been called a legitimate file name on the Linux box, we probably wouldn't have noticed it," Wisniewski said. And malware for Linux to date has been relatively rare, too, with mainly cryptojackers, he added.

Cloud Snooper's techniques for now appear to be rare, but like many unique attacks like this, it's only a matter of time before they are imitated. "Every time we see something done in a targeted attack usually by a nation-state, a couple of years later cybercriminals [adopt similar tactics]," Wisniewski said.

"This case is extremely interesting as it demonstrates the true multi-platform nature of a modern attack," wrote Sophos researcher Sergei Shevchenko in the company's technical report on Cloud Snooper.

Sophos recommends deploying AWS's boundary firewall function, keeping Internet-facing servers fully patched, and hardening SSH servers to protect against Cloud Snooper.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Prevent an AWS Cloud Bucket Data Leak."

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-20001
PUBLISHED: 2021-03-07
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
CVE-2020-28466
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
CVE-2021-27364
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2021-27365
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...
CVE-2021-27363
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system...