Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Privacy

Stealth Mango Proves Malware Success Doesn't Require Advanced Tech

At Black Hat USA, a pair of researchers will show how unsophisticated software can still be part of a successful surveillance campaign.

Reports on new strains of malware and dissection of its operation are common at security conferences. Less common: Full end-to-end reports of the malware, the infrastructure underneath it, and the organization behind it. But on Aug. 9, that's what Lookout's Andrew Blaich and Michael Flossman will present at Black Hat USA.

"Our presentation is covering a targeted surveillance campaign where we identified an Android tool called Stealth Mango being deployed in targeted attacks, as well as a related iOS tool that was identified as being created by the same developers," says Flossman, head of Lookout's threat intelligence services. "While we do focus primarily on the Android tool and the information that the actors behind that tool were able to steal, we also dive into the background information around the group that was responsible for its development and creation."

Stealth Mango and the related iOS software, Tangelo, are surveillanceware that is based on technology developers use for their more common offerings in spouseware. "The capabilities are really similar between [Stealth Mango and], for example, a spouseware tool — an application that is something that you would deploy on your significant other's phone or desktop to keep tabs on them," Flossman says. "Basically what we've found in a lot of our investigations is that the kind of people that would deploy spouseware are interested in the same kinds of information that a nation-state would be interested in."

(See Blaich and Flossman's Black Hat USA talk on August 9, "Stealth Mango and the Prevalence of Mobile Surveillanceware")

The two researchers weren't necessarily looking for Stealth Mango when it showed up in the research. "We were just looking for interesting cases of surveillanceware, and as we were working in-depth and started to examine the malware and look at more about the servers it was talking to, we really discovered what we had on our hands there," says Blaich, security researcher and head of device intelligence at Lookout.

And what they had was a campaign that was successful despite its lack of cutting-edge technology or technique.

"We're quite certain that it was created specifically for this customer," Flossman says. "So in that regard, it's like a bespoke solution" — though one built almost entirely from "off-the-rack" parts.

"It's quite standard, and nothing really stands out," Flossman says. "What I would say is interesting is the overall context around its use: the actors deploying it, but also just how much success they've had with this tool despite what might be taken as a lack of sophistication."

That success offers an economics lesson to other threat actors. "It really shows that sometimes you don't need a very complex or expensive solution to achieve your goals," Blaich says.

"A good way of thinking about this is that if you purchased Pegasus and it came with a bunch of zero-day exploits, you'd be quite cautious in how you deploy them. You'd make sure that they never would fall into the hands of researchers because basically, if that happened, you'd be burning a zero-day investment which these days is well over $100,000," Flossman says. "Comparatively, an attack like [Stealth Mango] is something that would cost several thousand dollars, max."

Those several thousands dollars in this case would be spent with a group that Blaich and Flossman say has been behind earlier attacks against the Indian military, including Operation C Major and Operation Transparent Tribe. In the current Stealth Mango campaign, they're covering their bases by using both their surveillanceware and commodity Trojans like Crimson RAT.

Flossman says that the group's Trojan use isn't new, but, like the surveillanceware, it is evolving. "If we look at the mobile malware they used in [C Major and Transparent Tribe], it was even less sophisticated than what we saw now, so they've evolved that tool and have worked on building it out," he says. "And we can see they're getting a fair bit of value from the mobile side of things now."

"[As a whole], this ties back into providing really good insight into exactly what adversaries in the mobile space need to do in order to be effective," Flossman adds. "It's a lot lower than what we often expect."

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
sofialais
50%
50%
sofialais,
User Rank: Apprentice
8/2/2018 | 2:48:20 PM
vigilance

I wonder how many of us are exposed to these goods as we continue to listen to extensive vigilance.

 

curso de manutenção de notebook
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/30/2018 | 9:25:10 AM
Cost
It's a lot lower than what we often expect." Not only sophistication of attack is less bit also cost is less and the lilleyhood of attack is high as a result.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/30/2018 | 9:23:32 AM
Mobile
"And we can see they're getting a fair bit of value from the mobile side of things now." Obviously mobile is difficult but more likely as more people use mobile more than desktop.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/30/2018 | 9:21:07 AM
Sophisticated
Trojan use isn't new, but, like the surveillanceware, it is evolving. "If we look at the mobile malware they used in [C Major and Transparent Tribe], it was even less sophisticated Do less sophisticated but the same impact, a good day for hackers.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/30/2018 | 9:19:16 AM
Stealth Mango
Stealth Mango and the related iOS software, Tangelo, are surveillanceware " I wonder how many of us are exposed to these wares as we keep hearing extensive surveillance.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/30/2018 | 9:15:59 AM
Any tool
Obviously any tool may be good enough to exploits vulnerabilities, I think we need to take a look at vulnerabilities to address some of the security chalanges.
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27621
PUBLISHED: 2020-10-22
The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inab...
CVE-2020-27620
PUBLISHED: 2020-10-22
The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups.
CVE-2020-27619
PUBLISHED: 2020-10-22
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
CVE-2020-17454
PUBLISHED: 2020-10-21
WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS payload into the owner POST parameter, which does not filter user inputs. By putting an XSS payload in place of a valid Owner Name, a modal b...
CVE-2020-24421
PUBLISHED: 2020-10-21
Adobe InDesign version 15.1.2 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .indd file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.