Russians Suspected In ‘Uroburos’ Digital Espionage Attacks

http://www.techweekeurope.co.uk/news/russian-intelligence-uroburos-malware-140494

Russian intelligence linked to super-sophisticated rootkit targeting high-profile organisations and nation states

On March 3, 2014 by Thomas Brewster 0

Russian government hackers are suspected of creating a highly-sophisticated piece of malware designed tosteal files from nation states’ digital infrastructure.

The Uroburos malware, named after an ancient symbol depicting a serpent or dragon eating its own tail that recently appeared in the Broken Sword 5 video game, worked in in peer-to-peer mode, meaning it can move across machines even if they’re not connected to the public Internet.

G-Data said Uroburos was “one of the most advanced rootkits we have ever analysed in this environment”.

Russian intelligence involved?

It works on both 32-bit and 64-bit Microsoft Windows machines, again pointing to a well-funded effort. It’s likely the Uroburos attacks went undetected for at least three years, as a sample of a rootkit driver was dated back to 2011.

“The development of a framework like Uroburos is a huge investment. The development team behind this malware obviously comprises highly skilled computer experts, as you can infer from the structure and the advanced design of the rootkit,” G-Data said.

“The design is highly professional; the fact the attackers use a driver and a virtual file system in two separate files which can only work in combination, makes the analysis really complicated. One needs to have the two components to correctly analyze the framework. The driver contains all of the necessary functionality and the file system alone simply cannot be decrypted.

“The network design is extraordinarily efficient, too; for an incident response team, it is always complicated to deal with peer-to-peer infrastructure. It is also hard to handle passive nodes, because one cannot quickly identify the link between the different infected machines.”

The Russian connection was made after researchers from G-Data discovered plenty of Russian-language strings in the code. They also found the malware searching for the presence of Agent.BTZ, malware used in attacks on the US in 2008, which were said to have been carried out by Russian spies.

The Agent.BTZ attack was initiated when a USB stick was deliberately left in a parking area belonging to the United States Department of Defense.

“We believe that the team behind Uroburos has continued working on even more advanced variants, which are still to be discovered,” G-Data added.

“We are sure of the fact that attacks carried out with Uroburos are not targeting John Doe but high profile enterprises, nation states, intelligence agencies and similar targets.”


俄罗斯在克里米亚的军事活动正成为全世界的焦点，而它在幕后的网络间谍战也正有条不紊的继续着。俄罗斯政府黑客被怀疑是间谍软件Uroburos的幕后作者。

Uroburos是一种p2p传播的恶意程序，被安全公司G-Data称之为至今发现的最先进rootkit恶意程序之一。Uroburos的间谍活动至少秘密进行了三年，G-Data称它的开发需要巨大的资金投入和经验丰富的专家。程序的源代码中包含了俄语字符串，并被发现在搜索另一个间谍软件Agent.BTZ，Agent.BTZ是涉及渗透进五角大楼的恶意程序。

俄罗斯悄然打响网络间谍战，Uroburos程序幕后作者

俄罗斯政府黑客被怀疑开发了一款高度复杂的恶意软件，用来从一些国家政府的基础数字设施窃取文件。

这款名为Uroburos的恶意软件是根据一种古老的符号——乌洛波洛斯来命名的，其形象符号是最近出现在冒险游戏断剑5中的衔尾蛇。这款恶意软件通过P2P模式运行，这也就意味着即使没有连接公网，这款软件仍然可以在机器间传播。

全球顶级杀软G-Data表示这是迄今为止发现的最先进的rootkit恶意程序之一。

俄罗斯情报部门参与?

俄罗斯悄然打响网络间谍战，Uroburos程序幕后作者

它可以适用于32位和64位系统。而Uroburos的间谍活动至少可以追溯到2011年，已经运行了至少三年而未被发现。

G-Data表示：

“像Uroburos这样框架的开发需要巨大的投资，我们从rootkit的结构和先进的设计推断，这款恶意软件的开发团队中显然有着大量经验丰富的计算机专家。”

“这种设计太专业了，事实上攻击者将驱动和虚拟文件系统完全独立开了，只有在这两部分组合起来才能正常工作，这就导致了对其分析起来便非常复杂。要想分析这个框架只有将两个组件正确组合起来。而驱动所包含的必要功能与单独的文件系统是无法实行解密的。”

“这种网络设计太高效了，对于一个事件响应来说，要完成p2p基础设施的处理往往是非常复杂的。因为不能快速识别不同受感染机器之间的联系，这就导致被动节点很难被处理。”

G-Data的研究者在这款软件的源代码中发现了大量的俄语字符，并被发现在搜索另一个间谍软件Agent.BTZ(一款在2008年用于渗透五角大楼的恶意软件)，这也就直指俄罗斯的间谍活动行为。

我们仍记得，当Agent.BTZ攻击发起时，有一个USB存储承载着Agent.BTZ在美国国防部的电脑间“流窜”。早在2008年，由于这种软件通过“U盘”来疯狂传播，因此美军暂时禁止官兵在任何军方电脑上使用U盘或者其他外置存储装置。

“我们相信，Uroburos的背后开发团队会继续致力于开发更先进的恶意软件变种，当然这还有待于我们进一步发现”，G-Data补充说明。

“我们可以确定的事实是Uroburos的目标绝不是张三李四王二麻子某个个人，而是高端企业、政府机关、情报机构和其他相关部门。”