APT Malware Attacks Smart Cards Used by DIB & Governments

Via NY Times (Bits Blog) -

Chinese hackers have deployed a new cyber weapon that is aimed at the Defense Department, the Department of Homeland Security, the State Department and potentially a number of other United States government agencies and businesses, security researchers say.

Researchers at AlienVault, a Campbell, Calif., security company, said on Thursday that they had uncovered a new variant of some malicious software called Sykipot that targets smart cards used by government employees to access restricted servers and networks. Traces of Sykipot malware have been found in cyberattacks dating back to 2006, but AlienVault’s researchers say this is the first time Sykipot has compromised smart cards.

The government uses smart cards to supplement employee passwords, which have proven easy to crack. By cracking smart cards, hackers eliminate the final hurdle between themselves and some of the government’s most sensitive information. Mandiant, a security firm, first outlined smart card weaknesses in a January 2011 report and said it had investigated several attacks in which hackers used smart cards to crack into companies. The latest Sykipot strain offers a look at how hackers are compromising smart cards and indicates who they are after.

Researchers say this strain specifically targets smart card readers that run ActivClient, a program made by ActivIdentity, an identity authentication company based in Fremont, Calif. ActivIdentity’s smart cards are used by employees at the Defense Department, Department of Homeland Security, Coast Guard, Social Security Administration, Treasury Department and other government agencies, along with businesses including Monsanto, BNP Paribas and Air France.

[...]

Exactly what Sykipot’s architects have stolen is still not known. But given ActivIdentity’s client list of defense agencies, security researchers say, it is now clear who the target is.

----------------------------------------------------------------

Mandiant M-Trends "When Prevention Fails" - Jan 2011
http://www.security.nl/files/M-trends2.pdf (Full Report)

It was this M-Trends paper (commonly called M-Trends 2) that first highlighted Smartcard Proxy Malware – Page 7-9.

At the time Mandiant suggested using hardware RSA tokens as a way of minimizing risk.

There are several ways to reduce the likelihood an attacker would be able to compromise hardware-based tokens. Removing smart cards when not in use is the easiest way to mitigate risks, however moving to other hardware based technologies such as RSA Tokens with time-based sync of passwords is an effective way to thwart this threat.

However, just two months later (March 2011), the RSA SecurID breach became public – rendering the advice moot.