Sophisticated Targeted Attack Via Hotel Networks
Kaspersky Labs is reporting (detailed report here, technical details here) on a sophisticated hacker group that is targeting specific individuals around the world. “Darkhotel” is the name the group and its techniques has been given.
This APT precisely drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crew’s most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world. These travelers are often top executives from a variety of industries doing business and outsourcing in the APAC region. Targets have included CEOs, senior vice presidents, sales and marketing directors and top R&D staff. This hotel network intrusion set provides the attackers with precise global scale access to high value targets. From our observations, the highest volume of offensive activity on hotel networks started in August 2010 and continued through 2013, and we are investigating some 2014 hotel network events.
Good article. This seems pretty obviously a nation-state attack. It’s anyone’s guess which country is behind it, though.
Targets in the spear—phishing attacks include high-profile executives—among them a media executive from Asiaas well as government agencies and NGOs and U.S. executives. The primary targets, however, appear to be in North Korea, Japan, and India. “All nuclear nations in Asia,” Raiu notes. “Their targeting is nuclear themed, but they also target the defense industry base in the U.S. and important executives from around the world in all sectors having to do with economic development and investments.” Recently there has been a spike in the attacks against the U.S. defense industry.
We usually infer the attackers from the target list. This one isn’t that helpful. Pakistan? China? South Korea? I’m just guessing.
Subscribe to comments on this entry
Arclight • November 10, 2014 2:55 PM
I’ve often thought that hotels are a ripe target for this sort of highly-targeted monitoring and attack. First, the hospitality industry is very competitive, and their networks are virtually guaranteed to be maintained on a shoestring budget that has to compete with maintaining the HVAC and keeping the pools sparkling.
On a good day, half of them are broken and using self-signed portal certificates and the like. IFS and active incident response aren’t even on the wish-list.
Next, we have a self-selected population of of folks who are already more likely to be important because they are travelling. We can further infer what they are up to and who they are based on the time and place (example: mid-week traveller to Crystal City, VA ia probably on .gov business). And we can infer more by the floor/accomodations they are placed in.
We also have physical access to nearly all of the facility for the price of a room-night. We can even book a suite we think is important and have 24 hours to install equipment with power and data access.
And even if the intended targets have a high security-awareness and quality training, travel means they are away from their home org’s resources and under time pressure to accomplish some important task.
With these factors in mind, ignoring an SSL warning or connecting to an unknown network are perfectly rational things to do knowingly.
Oh, and let’s not forget that once we record someone’s MAC address, we now have unique and almost never-changing identifier for our targets.
All in all, this seems like pretty low-hanging fruit for an intel organization.
Arclight