Tag Archives | malware

All You Need To Know About The Lebanese General Security Cyber Espionage Campaign

By Rami on January 19, 2018 in Telecom

My Facebook and Twitter feeds are infested now with news articles about the cyber espionage campaign dubbed as “Dark Caracal” involving the Lebanese Directorate of General Security, and so far I have seen all kind of comments from people who are oblivious about this revelation to others who now believe that every single Lebanese mobile phone is subject to the espionage campaign. So there you go, everything you need to know about Dark Caracal.

What?

Mobile security firm Lookout, and digital rights group Electronic Frontier Foundation, released a report yesterday attributing a global cyber espionage campaign that they called “Dark Caracal” to the Lebanese Directorate of General Security.

The attack carried out by the hackers apparently seized control of thousands of Android phones from around 21 countries and resulted in stealing hundreds of Gigabytes. Researchers were able to gain access to one of the servers used by the hackers and found that the stolen data included: SMS Messages, Account credentials, WiFi details, Call records, Bookmarks and browsing history, Messaging apps databases (WhatsApp, Telegram…), Contacts, Installed Apps, Personal documents, Images, Voice recordings, and Listing of the phone storage content.

It is worth noting that all attacks targeted Android phones and there was no evidence of targeting iPhones. On the other hand, files stolen from personal computers included full backup images of iPhone mobiles. Moreover, I found it a bit weird that users from neither Israel nor Iran were victims to this campaign.

How?

In terms of hacking, the attackers did not utilize very sophisticated techniques to control the phones, they actually launched several campaigns that consisting of sending phishing links and fake applications to their victims in order to lure them into installing some malicious applications on their mobiles and computers which in turn uploaded their personal data to some remote server controlled by the hackers.

As to how these hackers were busted, the researchers claimed that they spotted several testing devices that were used by the hackers themselves to test their malware, and those devices had one thing in common which was a WiFi network called “Bld3F6”. Upon investigating a little, they were able to identify that this WiFi network was located very close to the General Security building in Mathaf.

When?

The researchers found that the campaign was first launched in 2012 and was still active at the time of publishing their findings.

Are we all compromised?

Certainly not. Some people made it seem like the General Security have super powers now and are able to infiltrate all our devices. If you use trusted WiFi networks, double check each link you see on the web before clicking it, and make sure to install legitimate apps only on your mobile, then you are most probably safe.

Conclusion

I have mixed thoughts about this. Is it ethical to spy on people? Definitely not, but all governments do it anyway, and assuming that the General Security is really tied to this cyber campaign then our government is no different. I’d like to believe that what they’re doing is probably protecting us from terror attacks, but I also value personal privacy and would feel outraged if I knew someone had access to my personal data…

Anyway, if you feel like reading more about Dark Caracal, you can find more details in the 49 pages report prepared by Lookout and Electronic Frontier Foundation here. One thing that I thought the report lacked was more details on how the researchers gained access to the servers utilized by the hackers, otherwise it is quite informative.

No, our banks are still vulnerable to cyber attacks

By Rami on October 5, 2012 in Lebanon

Remember when it was revealed back in August that many Lebanese bank have been targeted by a malware called “Gauss”? I bet people are starting to forget about the matter and there’s really nothing wrong about that. I mean you can’t expect people to keep talking about the issue for ever, but what’s really worrying is when regulators disregard the threat this malware is still posing to the information systems at our banks.

On September 15th, an article was published in The Daily Star aiming to assure everyone that Lebanese banks are safe and no one will be able to break into their systems because of the “preventive measures” they’re taking. What measures you may ask? Updating their antivirus programs.

Lebanese banks have upgraded their software security systems to block any virus designed to spy on transactions and operations, the Central Bank and IT experts said Thursday.

Jonny Torbey, the head of the IT department at Credit Libanais, said Lebanese banks have developed a security system to prevent any outside party from penetrating their computers regardless of how strong the virus. Read more here

I don’t claim to be a security professional, but I work in the IT sector, and if you also have some basic knowledge in IT and Information Security, you’ll know that updating programs and virus definitions is not sufficient to be protect yourself from cyber attacks. Even the biggest organizations in the world are not immune to attacks, but the difference is in how these organizations react when facing such issue, and that can only be done with proper policies, standards, processes, and systems in place.

A group of independent security professionals wrote this reply to let people know why these actions are insufficient and I decided to publish it here for you guys to read.

Lebanese banks upgrading anti-virus systems: Isn’t it business as usual? Are they truly willing to fight back?

First and foremost, the authors are speaking as Lebanese banking customers who happen to be subject matter experts!

Some of us have had first hands experience reacting to the Gauss Malware in Lebanese banks, and we have taken notice of the Central Bank memorandum released to the IT Departments of all Lebanese banks as well as last week’s related press release.

We can quite understand the need for such communication. It was surely aimed at re-increasing the level of confidence in Lebanese banks in the media and reassuring the general public, who are mostly illiterate in the works of Gauss.

However, knowing how lethal and stealthy the Gauss malware is, we are afraid that such an analysis, if considered sufficient and remained unchallenged, is hurting the Lebanese Banking’s sector reputation rather than increasing confidence in it.

Indeed, the quoted explanations might be misleading and give the impression that the Lebanese Central Bank might have not fully understood the dynamics of the Gauss malware, specially that the latter targets customers’ workstations rather than the banks’ Information Systems.

The reported solution consisting of upgrading the anti-virus systems alone will not prevent future sophisticated malware from targeting the Lebanese banking sector again! More dangerously it might encourage more lethal and frequent hacking and cyber-espionage…

Gauss falls into the category of highly advanced cyber-espionage attacks, more commonly known as Advanced Persistent Threats (APT), and is far from being a playground for script-kiddies.
By only conveying simplistic views about Gauss, the banking sector might not be showing enough readiness to fight back.

Moreover, when it comes to the Lebanese banking sector intrinsic sensitivity, it is quite shocking to read “Other bankers confidently say that they are not concerned about any virus because they insist that they have nothing to hide.”

Is the Lebanese Central Bank enforcing security standards as it should? Is it emphasizing more on implementing policies and procedures? Is there enough security awareness preached and are banks investing enough in this area?

Regulatory authorities should really focus more on pushing Lebanese Banks to become ISO 27001 certified with a clear Information Security Management System (ISMS).

Such a continuous improvement lifecycle will concretely increase Lebanese Banks’ reputation when it comes to operational risk management.

Apparently, much more work needs to be done there, and it’s not that great to hear about these attacks targeting same assets once again. We sincerely hope this will trigger some sort of a more serious action! An information security program must exist, and must be based on a well-established strategy with measured deliverables, and clear accountability for all the involved parties.

As too much time has elapsed between the Gauss info disclosure from Kaspersky and the “public” reaction from the Lebanese Central Bank, one could legitimately look for an officially appointed crisis management spokesperson. Such speaker would rely on a Computer Security Incident Response Team (CISRT) and/or relevant structure in order to protect the sector and the public from unverified media delivery and from misleading information.

It’s not a shame to admit our shortcomings as long as we are determined to work on eliminating them and reassuring the customers in parallel about all sorts of required actions taken to contain and eradicate this malware from the internal workspace.

Remember, big worldwide financial and non-financial companies got compromised too. Even the most sophisticated information security organizations’ operations got hacked as well, but with proper ISMS in place, they were able to stand on their feet and react quickly and expertly.

Remember the Confidentiality, Integrity, Availability (CIA) triad? It’s a great model, but we prefer CIAA instead – Last “A=Accountability” is what matters everywhere used…

To end on a lighter note, we all recall that Lebanese applause when the plane lands safely in Beirut airport but isn’t it business as usual to have a successful landing? The same applies to bankers “continuously updating their antivirus systems”: Isn’t it business as usual?

Sustainable security can only happen with a process enhancement security program!

A new malware targets Lebanese Bank customers!

By Rami on August 10, 2012 in Lebanon

Kaspersky Labs recently discovered a new malware called “Gauss” with a module that aims to capture Lebanese bank accounts login credentials. And the targeted banks included Bank of Beirut, EBLF, Blom Bank, Byblos Bank, Fransabank, and Credit Libanais.

The article suggests the malware has been created by the US and Israeli governments and was not intended to steal money from client accounts, but rather to trace the source of funding to certain individuals (Hezbollah members I suppose).

The spyware, dubbed Gauss after a name found in one of its main files, also has a module that targets bank accounts in order to capture login credentials. The malware targets accounts at several banks in Lebanon, including the Bank of Beirut, EBLF, BlomBank, ByblosBank, FransaBank and Credit Libanais. It also targets customers of Citibank and PayPal.

The researchers don’t know if the attackers used the bank component in Gauss simply to spy on account transactions, or to steal money from targets. But given that the malware was almost certainly created by nation-state actors, its goal is likely not to steal for economic gain, but rather for counterintelligence purposes. Its aim, for instance, might be to monitor and trace the source of funding going to individuals or groups, or to sabotage political or other efforts by draining money from their accounts.

Still, that doesn’t seem like the only purpose for that malware, since the people at Kaspersky are still working to crack the larger part of its code and identify what is it responsible for.

Make sure to read the very interesting and worrying report from Wired.com here.

I know protecting your network from a nation-state-created malware is quite hard, but I hope Lebanese banks are now taking the necessary measures to protect themselves from such attacks and eventually safeguard our information.

Thank you Ibrahim Lahoud