Some of their tactics worked, others did not. I didn't know what made an attacker until I found an attacker." "When I first looked at this data, I didn't know what I should be looking for. "Finding them turned out to be a very difficult problem to solve," he says.
VIRUSTOTAL UPLOADER CODE
This week he's releasing code he developed for analyzing the metadata so others can do their own research.ĭixon says it wasn't initially easy to spot groups of attackers in the data.
VIRUSTOTAL UPLOADER ARCHIVE
But he says there is now enough historical data in the VirusTotal archive that other researchers can mine it to identify groups and activity he may have missed. Until now he's been reluctant to publicly discuss his work on the metadata, knowing it would prompt attackers to change their tactics and make it harder to profile them. However, at one point the Comment Crew did begin using unique IP addresses for each submission, suggesting they suddenly got wise to the possibility that they were being watched.ĭixon got the idea to mine VirusTotal's metadata after hearing security researchers repeatedly express suspicions that hackers were using the site as a testing tool. The groups Dixon observed, apparently ignorant of the fact that others could watch them, did little to conceal their activity.
Believed to be in China, NetTraveler has been hacking government, diplomatic and military victims for a decade, in addition to targeting the office of the Dalai Lama and supporters of Uyghur and Tibetan causes. He also spotted and tracked a group known by security researchers as NetTraveler. The group Dixon tracked isn't the main Comment Crew outfit but a subgroup of it. electrical power grid, oil and gas pipelines and in water systems.
VIRUSTOTAL UPLOADER SOFTWARE
More recently, the group has focused on critical infrastructure in the U.S., targeting companies like Telvent, which makes control system software used in parts of the U.S. Believed to be a state-sponsored group tied to China's military, Comment Crew reportedly is responsible for stealing terabytes of data from Coca-Cola, RSA and more than 100 other companies and government agencies since 2006. One of the most prolific groups he tracked belongs to the infamous Comment Crew team, also known by security researchers as APT1. He could even in some cases predict when they might launch their attack and identify when some of the victims were hit-code that he saw submitted by some of the attackers for testing later showed up at VirusTotal again when a victim spotted it on a machine and submitted it for detection. Over weeks and months, Dixon watched as the attackers tweaked and developed their code and the number of scanners detecting it dropped. Using an algorithm he created to parse the metadata, Dixon spotted patterns and clusters of files submitted by two well-known cyberespionage teams believed to be based in China, and a group that appears to be in Iran. And, strangely, some of the groups Dixon monitored used the same addresses repeatedly to submit their malicious code.
Though Google masks the IP address to make it difficult to derive from the hash, the hash still is helpful in identifying multiple submissions from the same address. The data includes the file's name and a timestamp of when it was uploaded, as well as a hash derived from the uploader's IP address and the country from which the file was submitted based on the IP address. He can do this because every uploaded file leaves a trail of metadata available to subscribers of VirusTotal's professional-grade service.
0 kommentar(er)
