| 词条 | Careto (malware) |
| 释义 |
Because of the focus on Spanish-speaking victims, the heavy targeting of Morocco, and the targeting of Gibraltar, Bruce Schneier speculates that Careto is operated by Spain.[2] PayloadCareto normally installs a second and more complex backdoor program called SGH. SGH is easily modifiable and also has a wider arsenal including the ability to intercept system events, file operations, and performing a wider range of surveillance features.[3] The information gathered by SGH and Careto can include encryption keys, virtual private network configurations, and SSH keys and other communication channels.[4] Detection and removalCareto is hard to discover and remove because of its use of stealth capabilities. In addition, most of the samples have been digitally signed. The signatures are issued from a Bulgarian company, TecSystem Ltd., but the authenticity of the company is unknown. One of the issued certificates was valid between June 28, 2011 and June 28, 2013. Another was valid from April 18, 2013 to July 18, 2016, but was revoked by Verisign.[5] Careto was discovered when it made attempts to circumvent Kaspersky security products.[6] Upon discovery of Careto trying to exploit their software, Kaspersky started to investigate further. As part of collecting statistics, multiple sinkholes were placed on the command and control servers.[5] Currently most up-to-date antivirus softwares can discover and successfully remove the malware. DistributionOn investigation of the command and control servers, discoveries showed that more than 380 victims were infected. From the information that has been uncovered, the victims were infected with the malware by clicking on a spear phishing link which redirected to websites that had software that Careto could exploit, such as Adobe Flash Player. The player has since been patched and is no longer exploitable by Careto. The websites that contained the exploitable software had names similar to popular newspapers, such as The Washington Post and The Independent. [7] The malware is said to have multiple backdoors to Linux, Mac OS X, and Windows. Evidence of a possible fourth type of backdoor to Android and IOS was discovered on the C&C servers, but no samples were found. [3] It is estimated that Careto has been compiled as far back as 2007. It is now known that the attacks ceased in January 2014.[5] References1. ^1 Kaspersky Lab Uncovers “The Mask”: One of the Most Advanced Global Cyber-espionage Operations to Date Due to the Complexity of the Toolset Used by the Attackers, 11 February 2014 {{Hacking in the 2010s}}2. ^{{cite web|url=https://www.schneier.com/blog/archives/2014/02/the_mask_espion.html|title="The Mask" Espionage Malware - Schneier on Security|work=schneier.com}} 3. ^1 {{cite web|url=http://www.pcworld.com/article/2096460/cyberespionage-operation-the-mask-compromised-organizations-in-30plus-countries.html|title=Unveiling 'The Mask': Sophisticated malware ran rampant for 7 years|author=Lucian Constantin|date=11 February 2014|work=PCWorld}} 4. ^http://www.kaspersky.com/about/news/virus/2014/Kaspersky-Lab-Uncovers-The-Mask-One-of-the-Most-Advanced-Global-Cyber-espionage-Operations-to-Date-Due-to-the-Complexity-of-the-Toolset-Used-by-the-Attackers 5. ^1 2 http://securelist.com/blog/research/58254/the-caretomask-apt-frequently-asked-questions/ 6. ^{{cite web|title=Securelist|url=http://securelist.com/blog/research/58254/the-caretomask-apt-frequently-asked-questions/|accessdate=3 April 2015}} 7. ^{{cite web|title=Unveiling 'The Mask': Sophisticated malware ran rampant for 7 years|url=http://www.pcworld.com/article/2096460/cyberespionage-operation-the-mask-compromised-organizations-in-30plus-countries.html|publisher=Pcworld|accessdate=2 April 2015}} 4 : Malware|Spyware|Rootkits|Cyberwarfare |
| 随便看 |
|
开放百科全书收录14589846条英语、德语、日语等多语种百科知识，基本涵盖了大多数领域的百科知识，是一部内容自由、开放的电子版国际百科全书。