RM

“Red October” in the title of Tom Clancy’s bestselling novel referred to a Soviet submarine whose silent propulsion system made it undetectable to sonar. It’s a fitting name for the sophisticated cyber-espionage network that has recently been identified after collecting high-level data from governments, embassies and diplomatic networks, energy companies, and other sensitive systems for at least five years.

 

Red October begins as a series of spear phishing attacks with highly personalized emails for specific targets.  These emails include both malicious and “clean” Microsoft® Office attachments, and the attack proceeds as follows:

 

•    The unsuspecting user receives an email with an attached Microsoft Office file and opens the file.
•    The exploit drops and launches two files: a clean Microsoft Word or Microsoft Excel file and a malicious .EXE.
•    Microsoft Word or Microsoft Excel then crashes and exits while the malicious .EXE launches along with the clean document, so the user sees nothing amiss, as shown in these examples:

 

 

 

Java is another attack vector in the spear phishing campaign.  As with the Office based attack described above, Red October sends a spear phish email containing a link that loads a malicious Java applet when opened.

 

All known related C&C IPs and domains associated with the Red October attack are classified as “Bot Networks”. Websense® ThreatScope™ helps protect our customers by identifying all of the embedded files as Malicious, as shown in the following reports:

ThreatScope Report on Dropped File 1

ThreatScope Report on Dropped File 2

ThreatScope Report on Dropped File 3

 

The following CVE are reported to have been used as part of the Red October spear phishing attacks:

CVE-2009-3129 Excel

CVE-2010-3333 Word

CVE-2012-0158 Word

CVE-2011-3544 Java

 

Targeted attacks like Red October lower a victim’s guard by appealing to his or her interests.  This social engineering aspect is what makes such attacks so successful. Therefore, it’s essential to remain vigilant when opening emails with attachment or links, especially if they are unsolicited.  

 

Websense customers are protected by Websense ACE (Advanced Classification Engine), and we will continue to monitor this and other evolving security threats.

Websense^® researchers monitor sites like Pastebin, Facebook, Twitter, Blogspot and others to keep our finger on the pulse of hacking and other malicious activities. Pastebin, in particular, has become a popular place for hackers to show off their latest exploits. 

 

Our researchers recently observed a significant increase in malicious links posted to Pastebin:

 

On Tuesday, November 20, we detected a spike in compromised URLs posted to the site. A Pastebin user named “PCA-Master” was responsible for posting 572 of these compromised URLs.

Each compromised URL showed a similar pattern:

 

These hosts were invaded with images like this:

 

 
In all cases, Websense customers were protected by the real-time analytics offered by Websense solutions.

According to its FAQ, “Pastebin.com is a website where you can store text for a certain period of time. The website is mainly used by programmers to store pieces of sources code or configuration information, but anyone is more than welcome to paste any type of text.”

Despite its Acceptable Use Policy that specifically prohibits posting email lists, login details, password lists and personal information (among other items), all of these are routinely posted to Pastebin.

 

The “Pakistan Cyber Army” has been around for some time and regularly compromises large numbers of hosts in various countries, including many Indian websites, especially government sites. According to the Pakistan Cyber Army site:
 
“Pakistan Cyber Army is not a hacking or cracking group or anything illegal to be, Pakistan Cyber Army is a symbol of all the Pakistani Security Expert’s who wanted to safegaurd Pakistan Cyber Space from hacking attack’s […] We mastered it and now we are here to announce that we are no longer blackhat’s, there was a time when we used to be but only for our country safegaurd and our nation pride.”
 
Pakistan Cyber Army images have recently plastered sites in many countries. According to HackRead, a website with news about hacking, most of the affected sites belonged to “small and local businesses, such as banks, chemical factories, TV channels, online gaming and automotive industry etc.”

While hackers pose a serious problem for many organizations, on a lighter note, students from HaBetzefer, an Israeli school of advertising and art, and ad agency McCann Digital Israel have produced a campaign called “If you can’t fight them, redesign them” to combat the plague of what students are calling “uninspired designs each time: black background, grotesque low-res images and unbearable amounts of text.” One of the traits associated with hackers is their lack of style, as evidenced by the Pakistan Cyber Army’s hack page.

The students sent cheerful redesigned hack pages back to hacker groups with the friendly message, “We would like to end all cyberwars, but in the meantime — if you must hack our sites, at least leave something beautiful.” So far, none of the hackers has taken them up on the offer, but it’s clearly their loss: