News / Science & Technology

'Mask' Malware Called 'Most Advanced' Cyber-espionage Operation

FILE - A man types on a computer keyboard.
FILE - A man types on a computer keyboard.

Related Articles

Sochi Games Present Hacking Minefield

If you do not need the device, do not take it, US State Department warns

More Questions than Answers About China Internet Outage

Chinese officials point to hackers, while others say it was a glitch in the Great Firewall that caused massive outages
Researchers at the Internet security firm Kaspersky Lab say they have uncovered what they’re calling “one of the most advanced global cyber-espionage operations to date.”

The malware is called “Careto,” which roughly means face or mask in Spanish. Since at least 2007, it has netted 380 unique victims in 31 countries, Kaspersky said.

Kaspersky called the Mask  “an extremely sophisticated piece of malware,” which is very hard to detect.

The malware predominantly targets government institutions, diplomatic offices and embassies, energy, oil and gas companies, research organizations and activists, Kaspersky said.

Countries where Mask infections have been observed include several in Latin America, including Argentina, Bolivia, Brazil, Colombia, Costa Rica, Cuba, Guatemala, Mexico and Venezuela.

Additional countries included China the United States, Turkey, Egypt, France, Germany, Belgium, Poland, South Africa, Spain, Switzerland, Tunisia and the United Kingdom.

Spanish language tie

Apart from the Mask’s duration and scope, it is of interest because the “authors appear to be native in the Spanish language which has been observed very rarely in APT (advanced persistent threat) attacks,” according to Kaspersky.

According to Christopher Burgess, CEO of Prevendra, Inc., an Internet security firm, “the Spanish-language market has not been a primary focus of the information security community at the enterprise/government or individual consumer level.”

“It is well known the Spanish banking software offerings are among the best, thus the targeting of the ingredients of the various countries’ economic backbones and foreign diplomacy of the region is most interesting,” he said.

Burgess said that the big question is who could pull this off?

Kaspersky offers one idea.

“Several reasons make us believe this could be a nation-state sponsored campaign, said Costin Raiu, Director of the Global Research and Analysis Team at Kaspersky Lab in a statement.

“First of all, we observed a very high degree of professionalism in the operational procedures of the group behind this attack," he said.

"From infrastructure management, shutdown of the operation, avoiding curious eyes through access rules and using wiping instead of deletion of log files," he said.

"These combine to put this APT ahead of Duqu (another malware) in terms of sophistication, making it one of the most advanced threats at the moment," he said. "This level of operational security is not normal for cyber-criminal groups.”

Dmitry Bestuzhev, head of Kaspersky’s research center for Latin America, has his own strong suspicions.

“We can certainly say it’s some Spanish speaking government,” he said in an email. “We say it’s a government because of the Careto complexity. The attackers invested a lot of science time and also money. This can be only a government.”

But Matthew Aid, a an independent intelligence analyst, said he didn’t think it was a nation-state like China, Russia or the U.S.

“It sounds like something a group of hackers would do,” he said.

He said that the programming used in a lot of malware systems that could be done by “some kids sitting at a terminal thinking how they can put malware out into the ether.”

“It’s not all that hard to do,” he said.

Taking off the 'Mask'

Kaspersky said they first became aware of the Mask last year when it tried “to exploit a vulnerability in the company’s products which was fixed five years ago.”

Infections occur through spear-phishing e-mails with links to a “malicious website.”

Spear-phishing emails appear to come from a trusted source. After infecting the computer, the malicious website sends the user to the real website referenced in the email.

Kaspersky said the Mask “can intercept network traffic, keystrokes, Skype conversations, PGP keys, analyse WiFi traffic, fetch information from all Nokia devices, screen captures and monitor all file operations.”

Bestuzhev said the malware stole “secrets of the latest research done in the laboratories, diplomatic documents, government plans and documents in general.”

“It was also stealing private encryption keys and private encryption certificates used to cipher connections and locally stored data,” he said. “Additionally the attackers stole certificated used to signed PDF documents."

"It’s a very important point since now they can build malicious PDF files including exploits and when to sign them with a valid signature, so nobody would suspect it is something malicious which would allow to trespass many security filters,” he said.

Concerns about information

Aid said that he sometimes thinks Kaspersky can be “alarmist,” but that he liked that the company “goes places and looks under rocks” that other security firms don’t.

“They don’t give you the means by which you can make an independent assessment,” he said. “This is the sixth or seventh major storm they’ve raised, and then it disappears, and you sort of wonder has this malware disappeared or is it still out there in the ether?”

Kaspersky said that during the investigation into the Mask, the command and control servers, which were in Latin America, were shut down, meaning, at least temporarily, the malware can’t call home.

But Aid is quick to warn about the longevity of malware.

“When you insert something into the Internet, it never dies,” he said. “Once it’s on the Internet, it will never go away.”

You May Like

China May Be Biggest Winner From Ukraine Crisis

Missile sales, oil and gas shipments are among many areas that may drive Beijing and Moscow closer together in coming years More

Obama Faces Chaotic World, Limits of Power

Current foreign policy issues bring into focus challenges for US policymakers who are mindful of Americans' waning appetite for overseas military engagements More

SADC Meeting Lesotho Officials to Resolve Stalemate

Official says regional bloc has been engaged with leaders in Lesotho to resolve political disagreement that led to coup attempt More

This forum has been closed.
Comments
     
There are no comments in this forum. Be first and add one

Featured Videos

Your JavaScript is turned off or you have an old version of Adobe's Flash Player. Get the latest Flash player.
West Africa Ebola Vaccine Trials Possible by Early 2015i
X
Carol Pearson
August 30, 2014 7:14 PM
A U.S. health agency is speeding up clinical trials of a possible vaccine against the deadly Ebola virus that so far has killed more than 1,500 people in West Africa. If successful, the next step would be a larger trial in countries where the outbreak is occurring. VOA's Carol Pearson has more.
Video

Video West Africa Ebola Vaccine Trials Possible by Early 2015

A U.S. health agency is speeding up clinical trials of a possible vaccine against the deadly Ebola virus that so far has killed more than 1,500 people in West Africa. If successful, the next step would be a larger trial in countries where the outbreak is occurring. VOA's Carol Pearson has more.
Video

Video Survivors Commemorate 70th Anniversary of Nazi Liquidation of Jewish Ghetto

When the German Nazi army occupied the Polish city of Lodz in 1939, it marked the beginning of a long nightmare for the Jewish community that once made up one third of the population. Roughly 200,000 people were forced into the Lodz Ghetto. Less than 7,000 survived. As VOA’s Kane Farabaugh reports, some survivors gathered at the Union League Club in Chicago on the 70th anniversary of the liquidation of the Lodz Ghetto to remember those who suffered at the hands of the Nazi regime.
Video

Video Cost to Raise Child in US Continues to Rise

The cost of raising a child in the United States continues to rise. In its latest annual report, the U.S. Department of Agriculture says middle income families with a child born in 2013 can expect to spend more than $240,000 before that child turns 18. And sending that child to college more than doubles that amount. VOA’s Deborah Block visited with a couple with one child in Alexandria, Virginia, to learn if the report reflects their lifestyle.
Video

Video Chaotic Afghan Vote Recount Threatens Nation’s Future

Afghanistan’s troubled presidential election continues to be rocked by turmoil as an audit of the ballots drags on. The U.N. says the recount will not be completed before September 10. Observers say repeated disputes and delays are threatening the orderly transfer of power and could have dangerous consequences. VOA correspondent Meredith Buel reports.
Video

Video Ukraine Battles Pro-Russia Rebel Assault

After NATO concluded an emergency meeting to discuss the crisis in eastern Ukraine, the country is struggling to contain heavy fighting near the strategic port of Mariupol, on the Azov Sea. Separatist rebels are trying to capture the city, allegedly with Russian military help, and Ukraine's defense forces are digging in. VOA's Daniel Schearf spoke with analysts about what lies ahead for Ukraine.
Video

Video Growing Business Offers Paint with a Twist of Wine

Two New Orleans area women started a small business seven years ago with one thing in mind: to help their neighbors relieve the stress of coping with a hurricane's aftermath. Today their business, which pairs painting and a little bit of wine, has become one of the fastest growing franchises across the U.S. VOA’s June Soh met the entrepreneurs at their newest franchise location in the Washington suburbs.
Video

Video Ebola Vaccine Trials To Begin Next Week

The National Institutes of Health says it is launching early stage trials of a vaccine to prevent the Ebola virus, which has infected or killed thousands of people across West Africa. The World Health Organization says Ebola could infect more than 20,000 people across the region by the time the outbreak is over. The epidemic has health experts and governments scrambling to prevent more people from becoming infected. Zlatica Hoke has more.
Video

Video Asian Bacteria Threatens Florida Orange Trees

Florida's citrus fruit industry is facing a serious threat from a bacteria carried by the Asian insect called psyllid. The widespread infestation again highlights the danger of transferring non-native species to American soil. VOA’s George Putic reports.
Video

Video Aging Will Reduce Economic Growth Worldwide in Coming Decades

The world is getting older, fast. And as more people retire each year, fewer working-age people will be there to replace them. Bond rating agency Moody’s says that will lead to a decline in household savings; reducing global investments - which in turn, will lead to slower economic growth around the world. But experts say it’s not too late to mitigate the economic impact of the world’s aging populations. Mil Arcega has more.
Video

Video Is West Doing Enough to Tackle Islamic State?

U.S. President Barack Obama has ruled out sending ground troops to Iraq to fight militants of the so-called Islamic State, or ISIS, despite officials in Washington describing the extremist group as the biggest threat the United States has faced in years. Henry Ridgwell reports from London on the growing uncertainty over whether the West’s response to ISIS will be enough to defeat the terrorist threat.
Video

Video Coalition to Fight Islamic State Could Reward Assad

The United States along with European and Mideast allies are considering a broader assault against Islamic State fighters who have spread from Syria into Iraq and risk further destabilizing an already troubled region. But as VOA State Department Correspondent Scott Stearns reports, confronting those militants could end up helping the embattled Syrian President Bashar al-Assad.
Video

Video Made in America Socks Get Toehold in Online Fashion Market

Three young entrepreneurs are hoping to revolutionize the high-end sock industry by introducing all-American creations of their own. And they’re doing most of it the old-fashioned way. VOA’s Julie Taboh recently caught up with them to learn what goes into making their one-of-a-kind socks.
Video

Video Americans, Ex-Pats Send Relief Supplies to West Africa

Health organizations from around the world are sending supplies and specialists to the West African countries that are dealing with the worst Ebola outbreak in history. On a smaller scale, ordinary Americans and African expatriates living in the United States are doing the same. VOA's Carol Pearson reports.

AppleAndroid