Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Sefnit Botnet Swaps Tor for SSH
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/1/2014 | 10:47:56 AM
Re: Business and Safeguard standpoint
Facebook's Security Team identified some key files, domains and artifacts and other indictators of compromise for enterprises to be on the lookout for, but these are just a sampling:

https://www.facebook.com/notes/protect-the-graph/sefnit-is-back/1448087102098103
Anthony Schimizzi
50%
50%
Anthony Schimizzi,
User Rank: Apprentice
5/1/2014 | 8:49:42 AM
Re: Business and Safeguard standpoint
User action is required in some way to become infected, whether clicking a link in an email to run the malicious code or more sophisticate like downloading a legitimate video which states you need an updated codec (which is actually the bot code) to view it.  User access control will be one of the first places to look.

Another thing to help the posture of your enterprise network in this scenario would be to granularly inspect traffic outbound at your SDP.  A lot of people really focus on how to prevent and outside attack from emanating and don't put as much attention to what traffic is leaving your network.  A good baseline of operational traffic that will traverse outside the SDP will make your life a lot easier when trying to spot a bump in the wire.  In this case, SSH connections back to a Russian entity.  If a baseline is not in place due to a large amount of public Internet traffic, then alerts and suspicious traffic need to be investigated.  With SSH it can be hard to find that right signal-to-noise ratio for your company.  For example, if you know your company does not have any affiliation with Russia, alerts and notifications from your SIEM should be on your IR/ID team's monitors for SSH traffic or any type of traffic, sourced from inside your network and destined to a Russian ip.

 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/30/2014 | 7:14:38 PM
Business and Safeguard standpoint
Now that Sefnit is using the SSH protocol what are some things to look out for? What I can see from the article is that it hits home for Remote Adminstation that uses SSH. Meaning what are some methods to protect from this and is user action required to become vulnerable or just an SSH protocol? I just want to see if from an Enterprise perspective how this affects, so that plans can be made. 


News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27225
PUBLISHED: 2021-03-01
In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to read and overwrite notebooks in projects that they are not authorized to access.
CVE-2021-27132
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVE-2021-3144
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2021-3148
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.