third Cyber Security Assessment Netherlands - NCSC

Sophisticated malware
CSAN-1 and 2 focused on the Stuxnet and Duqu malware.
During the past year, investigators have uncovered more such
sophisticated malware. Flame, Miniflame, Wiper and Gauss
seem to have a lot in common with Stuxnet and Duqu. These
similarities are not restricted to the techniques used - the
victims are primarily in the Middle East. According to the Wall
Street Journal, the New York Times and The Washington Post,
this malware is part of a campaign called ‘Olympic Games’. The
United States is alleged to have been working with Israel since
on a series of attacks aimed specifically at targets in the Middle
East. One of the things the various malware is said to have
been used for is to gather intelligence about sabotaging the
Iranian nuclear programme, and for spying on Lebanese banks.
Investigators are constantly uncovering more indications that a
state actor with a high level of knowledge is behind the attacks.
For example cryptanalyst Marc Stevens of the Dutch National
Research Institute for Mathematics and Computer Science
(CWI) in Amsterdam has discovered that Flame uses a completely
new, as yet unknown cryptographic variant of attack.
Flame uses an entirely new variant of a ‘chosen prefix collision’
attack so that it appears as a legal security update from
Microsoft. Developing such an attack requires a high level of
cryptanalytical knowledge. As of yet unknown vulnerabilities
and fake certificates have also been used. Analyses carried out
by Symantec among others reveals the attackers’ access and
their division of roles on C&C servers and purging of this is
exceptionally professional. Also of interest is the time that
apparently elapsed between spreading of the malware and its
discovery by investigators. It shows that detection mechanisms
are not able to detect sophisticated threats.
For more information see:
http://online.wsj.com/article/SB10001424052702303506404577448563517340188.html?mod=WSJ_hpp_LEFTTopStories
http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.
html?pagewanted=1&_r=2&
http://www.cwi.nl/nieuws/2012/cwi-cryptanalist-ontdekt-nieuwe-cryptografische-aanvalsvariant-in-flame-virus
http://www.fireeye.com/blog/technical/malware-research/2012/08/guys-behind-gauss-and-flame-are-the-same.html
http://online.wsj.com/article/SB10001424052702303506404577448563517340188.html?mod=WSJ_hpp_LEFTTopStories
http://www.securelist.com/en/blog/750/Full_Analysis_of_Flames_Command_Control_servers
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_flamer_newsforyou.pdf
http://www.symantec.com/connect/blogs/have-i-got-newsforyou-analysis-flamer-cc-servers
http://www.securelist.com/en/blog/208193808/What_was_that_Wiper_thing
and professional attack, Shamoon was seemingly a copy-cat by an
actor allied to Iran. A further example of espionage malware
probably originating from Iran is Mahdi [202] , malware that again is
not very sophisticated and is probably used for espionage from Iran.
Western organisations offer sophisticated forms of espionage
technology, including malware, on a commercial basis. It appears
that variations of FinSpy [203] brought to market by the German/
English company Gamma International have been used by investigative
and intelligence services. It now also appears to have been
used to spy on or censure opponents of the regime in Bahrain.
202 http://www.informationweek.com/security/attacks/
mahdi-malware-makers-push-anti-american/240004380
203 https://citizenlab.org/2012/07/from-bahrain-with-love-finfishers-spy-kit-exposed/
204 http://www.bloomberg.com/news/2012-07-27/gamma-says-no-spyware-sold-to-bahrainmay-be-stolen-copy.html
205 http://www.nytimes.com/2013/01/16/business/rights-group-reports-on-abuses-ofsurveillance-and-censorship-technology.html?_r=1&
206 http://www.pcworld.com/article/2030602/reporters-without-borders-slams-five-nations-forspying-on-media-activists.html
207 http://www.bloomberg.com/news/2012-04-24/unplug-companies-that-help-iran-and-syriaspy-on-citizens.html
Gamma International says that it has not sold the software to
Bahrain and assumes that it was obtained illegally. [204]
According to the media, more situations have recently come to light
where actors from countries such as China [205] , Libya [206] , Morocco,
Vietnam and Syria [207] have used espionage software developed in
the west for surveillance on activists and journalists.
Digital espionage continues to pose a serious threat to private
organisations too. Public/private collaboration has provided better
insight into actual incidents as has sharing information such as
indicators on an incidental basis.
7.4 In conclusion
While the number of vulnerabilities is increasing, it can (again)
be established that these are known vulnerabilities, which with
effective patching and updates can be overcome. However given
that this does not happen enough, the impact of the vulnerabilities
is increasing. In the majority of cases, these vulnerabilities may
result in use in a DoS attack. Following this comes the generation
of random code with restricted rights and access to sensitive data.
The number of vulnerabilities in web browsers and CMSs has this
year witnessed an increase in vulnerabilities.
88