Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Home Network Security Viruses & Malware Hackers Security Solutions More Topics...
Eliminate costly downtime!
Find out how with Free White Paper
& enter to win a Samsung Galaxy Note

www.apc.com
Viruses & Malware
24/7/365 Network Uptime
Average Rating:
Rate this article:  
MiniDuke Hackers Hit Governments  with PDF Exploit
MiniDuke Hackers Hit Governments with PDF Exploit

By Jennifer LeClaire
February 28, 2013 2:23PM

Bookmark and Share
The MiniDuke attackers are still active and have created malware as recently as Feb. 20, according to Kaspersky. To compromise victims, the attackers used social engineering techniques, which involved sending malicious PDF documents to their targets. The PDFs were highly relevant to their victims, and attack Adobe Reader versions 9, 10, and 11.
 

Related Topics

Hackers
Kaspersky
Adobe
Acrobat
PDF


An online espionage campaign has been exposed. Kaspersky Lab just published a research report that analyzes a series of security incidents that leverage the PDF exploit in Acrobat Reader.

The finding: a new, highly customized malicious program known as MiniDuke is at the heart of the attacks. Kaspersky reports that the MiniDuke backdoor was used to attack multiple government entities and institutions worldwide during the past week.

A number of high-profile targets have already been compromised by the MiniDuke attacks, including government entities in Ukraine, Belgium, Portugal, Romania, the Czech Republic and Ireland. A research institute, two think tanks, and a healthcare provider in the United States were also compromised, along with a prominent research foundation in Hungary.

MiniDuke Attacks 'Old School'

Eugene Kaspersky, founder and CEO of Kaspersky Lab, called it a "very unusual" cyberattack. He remembers this style of malicious programming from the end of the 1990s and the beginning of the 2000s.

"I wonder if these types of malware writers, who have been in hibernation for more than a decade, have suddenly awoken and joined the sophisticated group of threat actors active in the cyberworld," he pondered. "These elite, 'old school' malware writers were extremely effective in the past at creating highly complex viruses, and are now combining these skills with the newly advanced sandbox-evading exploits to target government entities or research institutions in several countries."

According to Kaspersky, the MiniDuke attackers are still active and have created malware as recently as Feb. 20. To compromise victims, the attackers used social engineering techniques, which involved sending malicious PDF documents to their targets. The PDFs were highly relevant -- with well-crafted content that fabricated human rights seminar information and Ukraine's foreign policy and NATO membership plans.

These malicious PDF files were rigged with exploits attacking Adobe Reader versions 9, 10, and 11, bypassing its sandbox, Kaspersky reported, and a toolkit was used to create these exploits and it appears to be the same toolkit that was used in the recent attack reported by FireEye. However, the firm noted, the exploits used in the MiniDuke attacks were for different purposes and had their own customized malware.

Adobe Responds to Incident

"MiniDuke's highly customized backdoor was written in Assembler and is very small in size, being only 20kb," added Kaspersky."The combination of experienced old school malware writers using newly discovered exploits and clever social engineering to compromise high profile targets is extremely dangerous."

When loaded at system boot, Kaspersky reported, the downloader uses a set of mathematical calculations to determine the computer's unique fingerprint, and in turn uses this data to uniquely encrypt its communications later. It is also programmed to avoid analysis by a hard-coded set of tools in certain environments like VMware. If it finds any of these indicators it will run idle in the environment instead of moving to another stage and exposing more of its functionality by decrypting itself further; this indicates the malware writers know exactly what antivirus and IT security professionals are doing in order to analyze and identify malware.

"The incident response process Adobe has put together and refined over the year has served us well, and we continue to evolve as the threats change," said Brad Arkin, senior director of product security at Adobe.

"The Reader and Acrobat patches we put out last week will ensure users are safe from the 'MiniDuke' campaign, so it's important that users update to the latest version if they have not done so already," Arkin told us.
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Viruses & Malware
1.   OpenSSL Calls for More Support
2.   How, Why Heartbleed Got Its Name
3.   Android Apps Mine Virtual Currency
4.   Spyware Targets U.S. and Europe
5.   Report: Target Ignored Security Alerts


advertisement
Spyware Targets U.S. and Europe
May be linked to Russian exploits.
Average Rating:
Android Apps Mine Virtual Currency
Malware drains mobile phone battery.
Average Rating:
OpenSSL Calls for More Support
To find, fix problems like Heartbleed.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
IBM Offers Security, Disaster Recovery as SoftLayer Service
New disaster recovery and security services for SoftLayer clients are being added by IBM. Big Blue said the new capabilities will speed cloud adoption by alleviating concern over business continuity.
 
How To Beat the Heartbleed Bug
Heartbleed headlines continue as IT admins scramble for answers no one has. Early reports of stolen personal data, including 900 social insurance numbers in Canada, are starting to trickle in.
 
After Heartbleed, OpenSSL Calls for More Support
The president of the OpenSSL Foundation says more support is needed from companies and governments that use its software so that it can better spot and fix flawed pieces of code such as Heartbleed.
 

Enterprise Hardware Spotlight
Vaio Fit 11A Battery Danger Forces Recall by Sony
Using a Sony Vaio Fit 11A laptop? It's time to send it back to Sony. In fact, Sony is encouraging people to stop using the laptop after several reports of its Panasonic battery overheating.
 
Continued Drop in Global PC Shipments Slows
Worldwide shipments of PCs fell during the first three months of the year, but the global slump in PC demand may be easing, with a considerable slowdown from last year's drops.
 
Google Glass Finds a Home in Medical Education, Practice
Google Glass may find its first markets in verticals in which hands-free access to data is a boon. Medicine is among the most prominent of those, as seen in a number of Glass experiments under way.
 

Mobile Technology Spotlight
Amazon 3D Smartphone Pics Leaked
E-commerce giant Amazon is reportedly set to launch a smartphone after years of development. Photos of the phone, which may feature a unique 3D interface, were leaked by tech pub BGR.
 
Zebra Tech Buys Motorola Enterprise for $3.45B
Weeks after Lenovo bought Motorola Mobility’s assets from Google for $2.91 billion, Zebra Technologies is throwing down $3.45 billion for Motorola’s Enterprise business in an all-cash deal.
 
CTIA Caves, Volunteers Kill Switch Plan
After bucking against the concept of a smartphone kill switch, the CTIA just announced the “Smartphone Anti-Theft Voluntary Commitment” to thwart smartphone thefts in the U.S.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Hackers | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.