This linux malware goes stealth mode, QNAP patches a Zero Day, and Mandiant is acquired
by Google!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for September 13 2022 - this is your summary
of the threats to our security, privacy and Internet freedom.
Let’s jump right into the news this week.
Security researchers at AT&Ts Alien Labs have discovered and analyzed new malware that’s
targeting Linux devices - both traditional servers that run Linux distros, as well as
IoT smart home devices.
This new strain of malware differs from others due to it’s sophistication and ability to
be stealth while being used to install a crypto miner.
This malware uses legit cloud services for hosting of the attack C and C servers, as
well as polymorphic encoding to evade detection.
This is due to its use of a Metasploit module called Shikata Ga Nai which encodes shellcode.
This malware is dubbed Shikitega, and it’s currently unknown how the initial infection
happens.
Shikitega evades detection by downloading the malware bit by bit, in what is called
a multi stage infection chain, so each new piece of a payload receives commands from
a previous part of the payload and creates a chain reaction of downloading and executing
the malware.
The researchers noted that Shikitega starts with just an initial dropper, then downloads
the Metasploit tool Mettle to control IoT devices.
After this it continues on to run shell commands and download additional modules to get persistence
on an infected machine.
The final payload gives the attacker full root privileges and downloads the crypto miner.
Shikitega uses known vulnerabilities in Linux, including CVE-2021-3493, which is a validation
issue in the Linux kernel, and CVE-2021-4034, which is a memory corruption vulnerability
called PwnKit.
Both of these flaws allow for Shikitega to work, so the researchers recommend applying
patches for both and updating as soon as updates are available.
They’ve also listed IOCs or indicators of compromise in their analysis for admins to
use.
It’s a new week with a new QNAP zero day!
QNAP posted a security bulletin for users to immediately update Photo Station to the
latest available version due to a zero day being used by DEADBOLT ransomware.
They noticed an uptick in ransomware attacks last Saturday that were targeting NAS devices
connected directly to the internet, with widespread use.
A patch was made available within 12 hours of detecting the attacks and assessing the
vulnerability.
QNAP also offered an alternative called QuMagie, which is a photo storage management tool that
can replace Photo Station on their NAS products.
QNAP hasn’t disclosed any technical details about the zero day that was discovered.
DeadBolt isn’t new.
The ransomware has been in use since January, encrypting files on vulnerable NAS devices
with a DOT deadbolt extension, and hijacking the regular login page with a ransom note.
But now it’s just using a new vector for attack.
The patch, which varies in version number depending on the QTS version you’re running,
can prevent DeadBolt ransomware from using the Photo Station zero day, but if you have
a NAS device connected to the internet, consider removing it.
These can be placed behind firewalls and users can try using myQNAPcloud instead.
QNAP also recommends using a strong password for user accounts, disable port forwarding
on routers, upgrading the firmware, and creating backups often.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to my newest patrons including Jack L for joining the alliance
on Patreon.com/threatwire.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with my last top story, about Mandiant and Google!
Back in March, Google announced they were planning to buy Mandiant, a huge cybersecurity
company, for $5.4 billion dollars.
The acquisition means they’d buy the company for $23 per share all cash, and Mandiant would
become a part of Google Cloud.
They finally closed the deal yesterday, September 12, for the disclosed full amount.
Google posted a blog about the purchase, saying this will allow them to grow cloud security.
Mandiant is joining Google Cloud to increase security for organizations, and improve threat,
incident, and exposure management.
Google is using this acquisition to expand the current Google Cloud security portfolio
they offer, by adding more to the suite of enterprise security offerings, along with
pioneering new approaches with Google’s use of data processing, AI and machine learning.
Google has also mentioned that Mandiant’s threat research will continue to be shared
to help support organizations including those who don’t run on Google Cloud.
The Mandiant brand will also remain unchanged.
This is definitely a positive for Google Cloud users, since Mandiant is at the forefront
of cybersecurity, but I’m curious what you think of this acquisition.
I'm Shannon Morse, I'll see you on the Internet!