Few days back SophosLabs found out a sophisticated attack that uses a unique combination of techniques to allow malware on servers to communicate freely with its command and control servers through firewalls.
The report deconstructs the tactics, techniques and procedures (TTPs) used in the attack.n the course of investigating a malware infection of cloud infrastructure servers hosted in the Amazon Web Services (AWS) cloud. The technique was discovered in use on AWS, the problem is not an AWS problem per se. It represents a method of piggybacking C2 traffic on a legitimate traffic, such as normal web traffic, in a way that can bypass many, if not most, firewalls.
The complexity of the attack and the use of a bespoke APT (Advanced Persistent Threat) toolset gives us reason to believe that the malware and its operators were an advanced threat actor, possibly nation state sponsored.
The compromised systems were running both Linux and Windows EC2 instances. SophosLabs believes the attack was the work of a nation state motivated by espionage.
As detailed in the report, the TTPs used together include: a rootkit circumventing firewalls, a rare technique to gain access to servers disguised as normal traffic, and a backdoor payload that shares malicious code between both Windows and Linux operating systems, a known, but uncommon approach.
While each individual element has been observed previously in attacks by highly-skilled adversaries, they have not been seen before in combination. Sophos expects that this package of TTPs will trickle down to the lower rungs of the cybercriminal hierarchy and be used as blueprints for new firewall attacks.
“This is the first time we have seen an attack formula that combines a bypassing technique with a multi-platform payload targeting both Windows and Linux systems. IT security teams and network administrators need to be diligent about patching all external-facing services to prevent attackers from evading cloud and firewall security policies,” said Sergei Shevchenko, threat research manager, SophosLabs.
“IT security teams also need to protect against multi-platform attacks. Until now, Windows-based assets have been the typical target, but attackers are more frequently considering Linux systems because cloud services have become popular hunting grounds. It’s a matter of time before more cybercriminals adopt these techniques.”
Technical analysis of Cloud Snooper network operations
To trigger the payload (snoopy) activation, an attacker would send the following packet:
On the way back, the NF_INET_LOCAL_OUT hook handler rebuilds the packet again to make sure its source port is restored back to the original port the incoming packet was destined for. This way, the C2 traffic transparently flows through the port(s) allowed by the firewall:
No other Netfilter hooks within the chain, such as iptables INPUT/OUTPUT rules, will process the packet if the hook returns NF_STOP. This appears to be the purpose of the TCP command 2020: to bypass other Netfilter hooks.
In instances where the Netfilter receives inbound traffic with a source port of 1010/TCP, it directs the contents to the Secure Shell (SSH) port, 22/TCP. For outbound traffic, we have seen two variants using either port 80 or port 443. This will allow for an SSH connection to step around a firewall with IP restrictions on traffic to port 22.
Hence, the ultimate purpose of the snd_floppy rootkit is to provide a covert control channel for the snoopy usermode process, running on a compromised host.
Such covert control channels can be established via any port allowed by firewalls or AWS Security Groups, be it 80, 443, 22, or any other port.
From the outside, the compromised system will show an unusually large volume of traffic that comes from the remote ports 6060, 7070, 8080, and 9999.
But what is the snoopy module? What does it do?
Snoopy is a backdoor trojan that can be executed both as a command line tool and as a daemon (though it needs to be launched with the -d flag for that). The backdoor’s internal version is 3.0.1-2.20170303.
It opens HTTP and/or DNS services on a compromised system, and allows tunneling of the traffic, operating both as a reverse SOCKS5 proxy server, and client.
Advice for Defenders
Create a full inventory of all devices connected to the network, and update all security software used on these devices
Ensure all external-facing services are fully patched. Cloud hosting services often provide firewall security, but this should not be a substitute for an organization’s own cloud security measures
Check and double check all cloud configurations. The Sophos 2020 Threat Report reveals that user misconfiguration and lack of visibility are the top causes of attacks in the cloud
Enable multi-factor authentication on any security dashboards or control panels used internally to prevent attackers from disabling security products during an attack
Remember, there is no single silver bullet for security, and a layered, defense-in-depth, next generation security model – including components designed specifically to protect data and networks in the cloud, like Sophos Cloud Optix with Sophos Intercept X for Server – is an essential best practice.
(Image Courtesy: www.dnewpydm90vfx.cloudfront.net)