Indian 'attacks' Norwegian telco to get at Pakistan, China

Discussion in 'China' started by huaxia rox, May 22, 2013.

  1. huaxia rox

    huaxia rox Senior Member Senior Member

    Apr 4, 2011
    Likes Received:
    Indian 'attacks' Norwegian telco to get at Pakistan, China • The Register

    Security researchers have uncovered what appears to be a sophisticated targeted attack launched from India and designed to steal information from a range of government and private enterprise victims in Pakistan, China and elsewhere.

    What began as an investigation into an attack on Norwegian operator Telenor soon uncovered evidence to show attackers probably hailing from India had been lifting info from business, government, poltical organisations for as long as three years.

    Norwegian anti-malware firm Norman AS claimed in its Operation Hangover (PDF) report that although the attack infrastructure appeared “predominantly to be a platform for surveillance against targets of national security interest (such as Pakistan)”, as well as industrial espionage, there is no direct evidence to link it to state-sponsored players.

    Attackers used spear phishing techniques, exploiting known Microsoft software vulnerabilities – no zero days – to drop info-stealing malware dubbed "HangOver" onto victims’ machines.

    Finding readable folders on a number of C&C servers, the researchers dug deeper to discover several malicious executable digitally signed with a certificate which had been revoked in 2011.

    Domains registered by the attackers were almost all privacy protected, while “almost all websites belonging to this attacker has their robots.txt set to ‘disallow’ to stop them from being crawled”, the report continued.

    However, the attack is far from advanced, according to security firm Eset, which has also been investigating.

    "String obfuscation using simple rotation (a shift cipher), no cryptography used in network communication, persistence achieved through the startup menu and use of existing, publicly-available tools to gather information on infected systems shows that the attackers did not go to great lengths to cover their tracks," the vendor said in a blog post.

    The researchers at Norman explained how the initial Telenor attack allowed them to widen the investigation, as follows:

    We have direct knowledge of only one attack – the one against Telenor. During this investigation we have obtained malware samples and decoy documents that have provided indications as to whom else would be in the target groups. We have observed the usage of peculiar domain names that are remarkably similar to existing legitimate domains. We have also obtained sinkhole data for a number of domains in question and found open folders with stolen user data in them; enough to identify targets down to IP and machine name/domain level.

    These IP addresses hail from a large range of countries globally including China, Russia, France and the US but the vast majority correspond to Pakistan.

    Aside from Telenor the report listed other attack targets as energy companies the Eurasian Natural Resources Corporation (ENRC) and Bumi; Porsche Informatik; and Chicago Mercantile Exchange.

    “The continued targeting of Pakistani interests and origins suggested that the attacker was of Indian origin,” the report concludes.

    Interestingly, an analysis of the project paths for malware creation revealed a highly organised operation in which “multiple developers are tasked with specific malware deliverances”:

    There are many diverging project paths which points towards different persons working on separate sub-projects, but apparently not using a centralised source control system. The projects seem to be delegated into tasks, of which some seem to follow a monthly cycle.

    The report also points out that the word “Appin” crops up in various contexts and cases, including malware file names, speculating some actor may be deliberately trying to implicate Indian security company Appin Security Group in the attacks.

    The company has now issued a warning notice on its home page urging the public “not to be misled by any communication received through fictitious domains which are purportedly being made by, or on behalf of, our company”.

    It also sent a strongly worded statement to The Hacker News claiming the reference to Appin in the report was a “marketing gimmick on the part of Norman AS” and that it has already initiated legal proceedings against the Norwegian firm. ®
  3. q874878592

    q874878592 Tihar Jail Banned

    May 25, 2013
    Likes Received:
    India is a fool
  4. W.G.Ewald

    W.G.Ewald Defence Professionals/ DFI member of 2 Defence Professionals

    Sep 28, 2011
    Likes Received:
    North Carolina, USA
    What information would India need to steal from China or Pakistan?
    Keshav Murali likes this.
  5. Keshav Murali

    Keshav Murali Back to studies :( Senior Member

    Apr 14, 2013
    Likes Received:
    The city of Humidity
    It could even have been engineered by your country to implicate India. After all, China has been hacking US websites for past 10 years now. Easy for them to hack themselves and obfuscate the IP address to point towards India.
  6. Ray

    Ray The Chairman Defence Professionals Moderator

    Apr 17, 2009
    Likes Received:
    Goodness gracious.

    India requires to attack China and Pakistan!
    Keshav Murali likes this.
  7. cobra commando

    cobra commando Tharki regiment Veteran Member Senior Member

    Oct 3, 2009
    Likes Received:
    "Indian 'attacks' Norwegian
    telco to get at Pakistan, China" wut?? :notsure: :rofl:
  8. rock127

    rock127 Maulana Rockullah Senior Member

    Aug 12, 2009
    Likes Received:
    LOL at the news title.... should be "e-attack" at max.

Share This Page