Pierluigi Paganini
November 25, 2014
The day after the disclosure of the Regin Backdoor by Symantec, which provided the details the new sophisticated cyber espionage tool,the principal security firms published the results of their investigation. As usual, one of the most interesting analysis was conducted by experts at Kaspersky Lab that issued a paper on the results of their investigation.
The primary victims of the Regin campaign include government entities, financial institutions, telecom operators, research organizations, multinational political bodies and individuals involved in advanced mathematical/cryptographical research.
According to the experts, the development of the Regin platform requested a significant effort, its level of complexity led the research to believe that it was a product of a nation-state project. Regin was designed mainly for two objectives, the intelligence gathering and the facilitating other further attacks on the targeted systems.
The Kaspersky Lab team explained that the most interesting aspect regarding their investigation about Regin is an infection of a large GSM operator. The GSM standard is still widely used, the experts at Kaspersky analyzed the activity log of a GSM base station controller and discovered that attackers gained access to the GSM network stealing the credentials that would allow them to control GSM cells of a large operator.
The attackers had access to the overall information about the activity of the targets within cells of the network, the threat actors would also use the access to the network to perform offensive actions against the victims.
“The ability of this group to penetrate and monitor GSM networks is perhaps the most unusual and interesting aspect of these operations. In today’s world, we have become too dependent on mobile phone networks which rely on ancient communication protocols with little or no security available for the end user. Although all GSM networks have mechanisms embedded which allow entities such as law enforcement to track suspects, there are other parties which can gain this ability and further abuse them to launch other types of attacks against mobile users.” states the post on SecureList.
The experts reported that in April 2008, the threat actors gained access to administrative credentials that would allow them to manipulate a GSM network in a Middle Eastern country. The case reported in the paper represents a case study for the experts which noted a very insidious implementation of the control infrastructure.
“In this specific country, all the victims we identified communicate with each other, forming a peer-to-peer network. The P2P network includes the president’s office, a research center,educational institution network and a bank. These victims spread across the country are all interconnected to each other. One of the victims contains a translation drone which has the ability to forward the packets outside of the country, to the C&C in India. This represents a rather interesting command-and-control mechanism, which is guaranteed to raise very little suspicions. For instance, if all commands to the president’s office are sent through the bank’s network, then all the malicious traffic visible for the president’s office sysadmins will be only with the bank, in the same country.”
Regin backdoor allowed attackers to issue several commands to the base station controller , including the listing of the current call forwarding settings of the Mobile Station and stopping cells in the GSM network. The list of countries targeted by the Backdoor Regin provided by Kaspersky includes Iran, Germany, Syria, Saudi Arabia and Russia that counted for 28 percent of infections:
The researchers at Symantec hypothesized that the campaign is active at least since 2008 and has been operated continuously until the 2011 when seems to be suspended to resurge form 2013. The investigations are still ongoing, security firms have no clues about the attack vector the hackers used initially to launch the attacks.
“The exact method of the initial compromise remains a mystery, although several theories exist, which include man-in-the-middle attacks with browser zero-day exploits. For some of the victims, we observed tools and modules designed for lateral movement. So far, we have not encountered any exploits. The replication modules are copied to remote computers by using Windows administrative shares and then executed. Obviously, this technique requires administrative privileges inside the victim’s network. In several cases, the infected machines were also Windows domain controllers. Targeting of system administrators via web-based exploits is one simple way of achieving immediate administrative access to the entire network.” states Kaspersky.
(Security Affairs – Regin Backdoor, cyber espionage)
