The precedence of Cyberwar from China APT-2
Welcome to the Cyber precedence of China Part-2, Today we are just curious to learn about how APT-2 attack was successfully conducted by targeting Military and Defense network. APT-2 doesn't damage any property instead it was stealing all the information from the unencrypted web and network interface. If you are curious to know about APT-1 and what APT does, check our first previous blog.
APT-2 Consists of two main Malwares
- MOOSE
- WARP
Chinese Attackers combined these two malwares and created a new attack vector. Before understanding what is APT-2 we need to know how these malwares work individually.
MOOSE Malware
MOOSE Malware was created to target Linux based system which runs on ARM and MIPS Architecture. The main motto of creating this malware is to steal the cookies present in the network and send it to c2c servers. This malware targeted Routers, modems and devices provided by the ISP's. Initially this was introduced into the web through phishing attacks and by visiting unencrypted websites "HTTP".
Once the device gets affected it used to pick up all the cookies automatically. The creators primarily targeted Social media platforms like Instagram, Facebook, YouTube and so long as they were using HTTP at that time. While the people were so curious about to likes, follows and comments the hackers decided to use their cookie for creating multiple accounts using those details.
Social media platforms used to block creating multiple accounts by tracking down the IP. Modern techniques are being introduced today but, in 2012 there were no modern methods deployed to avoid frauds.
MOOSE Working
Once it reached a Linux desktop/ laptop is used to look for the DNS and the servers connected with the machine. Then using its multi threading capacity it uses to find all the IP within and outside the network. Once those basic recon is done it then brute forces the Telnet and the FTP passwords. It had a list of passwords that the vendor was using to actually protect the devices while shipping. These passwords are pronounceable and easily crackable. It periodically checks for the TCP port where the above-mentioned services were running. From there it is used to steal the cookie and send it to C2C server. It also affected various Windows servers and desktops.
WARP Malware
WARP Malware is a Trojan created from old school name Zxarps. The main work of this Trojan is to behave as a router. Once the system gets infected with WARP Trojan the systems tends to behave as a router and asks all the device to send its ARP Request to the infected device. A sample ARP request is shown below
You can even capture your ARP request and response through a Wireshark interface. Once you actually expand the message there will be multiple data going in and out of your device. The WARP malware is used to inject the <iframes> into the website that the user is visiting, and even the user is not aware about it. So once the iframe is injected users visiting that particular website all over the website will slowly become vulnerable. This Trojan is actually an category of Adware in China.
Once iframe is injected the hacker can literally brute force the logins, find passwords if is really not configured properly and moreover he can actually modify the website from his licking by using a proxy. Click here to know more about <iframe and HTML Injection>.
APT-2
Once these malwares infected in a network then they tend to steal the IP address, website details, Username, passwords and cookie value. By using all these values the hackers can create multiple accounts using your cookie value, and then they can actually do many things all they like.
Prevention
- Change Default Passwords
- Use strong password policy
- Configure the website properly
- Perform periodic security checks
- Update your system firmware once released by vendors
For more details and references visit our sitemaps.
Comments