Hello, World!
Today in hacking news, “snake” it’s one of the most mysterious pieces of malware
ever seen, buried deep in its code are strange illuminati looking symbols - and up until
recently if you tried to google it, you’d find only a small handful of instances where
it’s shown its face.
But, snake isn’t just malware, it’s a network.
Developed all the way back in 2003 by the elite Russian state hacking group ‘Turla’,
it’s played a pivotal role in Russian cyber espionage for the past 20 years.
‘Turla’ is group known by many names, ‘Waterbug’, ‘Venomous Bear’, ‘Iron
Hunter’, and countless others, they spawned in 1996 - launching their debut campaign “Moonlight
Maze”, which saw them stealing secret documents from NASA, the Pentagon, and numerous other
US government agencies.
After that hack, which quite literally put the very concept of cyber espionage on the
map, Turla hackers began developing “Snake”, though at it was first called “Uroboros”,
named after the ancient symbol of a serpent eating it’s own tail, which represents infinity.
And, the uroboros symbol was actually buried in the code, in order to, I dunno, spook whoever
went digging.
Snake has the features you’d expect from a typical RAT - like being able to exfiltrate
files, run arbitrary commands and drop further malware.
But what makes Snake different, and in the words of the five eyes - “the most sophisticated
cyber espionage tool designed … by“ “Russia’s Federal Security Service”, is that Snake,
was built from the ground up to achieve a “rare level of stealth”.
Snakes one job is to remain hidden on a victim computer indefinitely.
And, in order to achieve this, all computers infected with snake form a peer to peer network,
acting as a means of stealthily laundering stolen files back to Moscow.
You can think of it kind of like Tor, when data was stolen from a certain snake node
it’d go through a series of hops before ending up in the hands of Turla.
To say snake malware has been wildly successful would be an understatement, “[its] infrastructure
[has been found] in over 50 countries”, and in one example after Turla hacked systems
in an unnamed NATO country, snake was used to “exfiltrate a large volume”, of “United
Nations and NATO documents” back to Russia.
Snake was named after an ancient symbol of infinity for a reason, because it was continuously
improved and upgraded, with US intelligence agencies on the back foot for 20 years, leaving
them actually kinda impressed and admitting that “Snake demonstrates careful software
engineering design and implementation, with the implant containing surprisingly few bugs
given its complexity”.
The Russian hackers even left taunts within the code, directed at the intelligence agencies
trying to reverse engineer it.
But despite all of this, Snake contained some surprising weaknesses which ultimately resulted
in its downfall - the most egregious of which was the way it handled its communications.
Snake used a 128 bit asymmetric encryption key, which is hilariously inadequate by today’s
standards, making it possible for the FBI to quite simply crack it.
The cause of this ridiculous level of self own is thought to be a simple mistake of confusing
bits for bytes, had 128 bytes been used then this video may never have been possible.
But that wasn’t the only slip up.
In order to make reverse engineering more difficult, malware operators typically employ
obfuscation techniques, which might include modifying their code, replacing function names
and variable names with random looking jargon, so it’s difficult for anyone to make sense
of what does what.
Whilst snake developers did do this, on one occasion when pushing out a new version, they
forgot - leaving vital clues as to how snake works buried in its code.
Making it easier for 3 letter agencies to piece together just how snake operates.
Also, in an effort to hamper detection attempts Snake used a custom implementation of HTTP
to communicate with other bots in the Snake network.
Part of this custom protocol included an “8-byte metadata structure” - used to keep track
of which packet was which.
However, this structure acted as a kind of signature which inadvertently revealed the
presence of Snake communications…
so by “observing as few as two or three packets of HTTP, the FBI … learned to identify
computers that [were] communicating using Turla’s Snake”.
Oh and speaking of identification, if you’re wondering just how Snake was attributed to
Russia, this was as easy as observing the times of day of snake operations, which just
so happened to be 7am to 8pm Moscow standard time, with US Intelligence pinpointing Snake
developers as being based in a city South-East of Moscow.
By leveraging the mistakes within Snake, the FBI created a tool called PERSEUS, which was
capable of connecting to snake infected machines by pretending to be one itself.
From there, PERSEUS would exploit a self destruct function programmed into it by it’s Russian
authors in order to systematically disable each snake infection one by one.
You could argue that this snake really did end up eating itself.
After being granted the search warrant required, the FBI launched their cyber nuke in the form
of operation MEDUSA which involved deploying PERSEUS on all infected computers in the US.
Notably though, this was done without the permission of the computer’s owners - a
strategy that has proved controversial in the past when in 2021 the FBI proactively
accessed Exchange servers sin order to remove malware, at the time this was described as
an “unprecedented move by U.S. law enforcement”, but since then, this tactic, love it or hate
it, has become the new norm.
Let me know in the comments by the way what you think about intelligence agencies playing
IT technician on your computer without your knowledge.
Snake might be gone, but those behind it aren’t going anywhere.
Some of the hackers alleged to be part of Turla are already wanted by the FBI, but Russia
is… shall we say, unlikely, to hand them over.
And so the saga continues, with snake’s replacement perhaps already in development.
This video is sponsored by PCBWay, the complete solution for all your PCB Fabrication and
on demand 3D printing needs.
From standard PCBs to the more advanced varieties, PCBWay provides granular control over every
element of your PCB.
With superfast turnaround times you’ll be spending more time creating and less time
waiting on packages.
PCBWay also offers on demand machining, from CNCing and sheet metal cutting to 3d printing
and injection molding, there’s an array of materials to choose from, and of course,
superfast turnaround times.
Sign up now using the link in the description to get a $5 coupon, which can be used site
wide.
As always thanks for watching and I’ll see you in the next video, have a good one.