Meet Mask, Posssibly The Most Sophisticated Malware Campaign Ever Seen

[Turk]

By Dan Goodin - Feb 11 2014, 8:33am AEST

Attackers used phishing and zero-days to infect Windows, Mac, and Linux users.

Mask victims by IP address.

Calling it the most sophisticated malware-driven espionage campaign ever discovered, researchers said they have uncovered an attack dating back to at least 2007 that infected computers running the Windows, OS X, and Linux operating systems of 380 victims in 31 countries.

The "Mask" campaign, which gets its name from a string of text found in one of the malware samples, includes a variety of components used to siphon encryption keys, key strokes, Skype conversations, and other types of sensitive data off infected computers. There is also evidence that the Spanish-speaking attackers had malware that ran on devices running both Apple's iOS and Google's Android mobile operating systems. Victims include government agencies, embassies, research institutions, private equity firms, activists, energy companies, and companies in other industries. The sophistication of Mask makes it likely that the campaign is the work of attackers sponsored by a well-resourced nation-state, said researchers from Kaspersky Lab, the Moscow-based security company that discovered it.

Mask—or "Careto" as its Spanish slang translation appears in source code analyzed by Kaspersky—joins a pantheon of other state-sponsored malware campaigns with names including Stuxnet, Flame, Duqu, Red October, Icefog, and Gauss. Unlike more opportunistic crimeware campaigns that generate revenue by targeting anyone with an Internet-connected computer, these "advanced persistent threats" (APTs) are much more determined. They're tailored threats that are aimed as specific people or organizations who possess unique data or capabilities with strategic national or business value.

"With Careto, we describe yet another sophisticated cyberespionage operation that has been going on undiscovered for more than five years," Kaspersky Lab researchers wrote in a detailed analysis published Monday. "In terms of sophisticated, we put Careto above Duqu, Gauss, RedOctober, or Icefog, making it one of the most complex APTs we observed."

The attackers relied on highly targeted spear phishing e-mails to lure targeted individuals to malicious websites. In some cases, attackers impersonated well-known websites, such as those operated by The Guardian and The Washington Post. One of the exploits recently used by the attackers targeted CVE-2012-0773, a highly critical vulnerability in Adobe's Flash Player that made it possible to bypass the sandbox security protection Google Chrome and other browsers rely on to prevent websites from executing malicious code on end-user computers.

"What makes 'The Mask' special is the complexity of the toolset used by the attackers," the Kaspersky analysis stated. "This includes an extremely sophisticated malware, a rootkit, a bootkit, 32- and 64-bit Windows versions, Mac OS X and Linux versions, and possibly versions of Android and iPad/iPhone (Apple iOS)."

Kaspersky researchers first stumbled onto Mask after noticing that it exploited a vulnerability in older versions of Kaspersky antivirus products to hide itself. The vulnerability has been patched for an unspecified amount of time, but attackers were exploiting the vulnerability on machines that continued to run older versions of the Kaspersky software.

Like Stuxnet and many other pieces of malware used in the last five years, Mask code was digitally signed, in this case with a valid certificate issued to a fake company called TecSystem Ltd. Such digital credentials are designed to bypass warnings delivered by Windows and other operating systems before executing programs that haven't been vouched for by credentials issued by a recognized certificate authority. The malware uses encrypted HTTP or HTTPS channels when communicating with command and control servers.

Researchers were able to take control of some of the domain names or IP addresses hosting the control servers that Mask-infected computers reported to. In all, the researchers observed 1,000 separate IP addresses in 31 countries connect. They also found traces of 380 different victim identifiers designated by the Mask naming convention. The Mask campaign was abruptly shut down last week within hours of being revealed in a short blog post.

"For Careto, we observed a very high degree of professionalism in the operational procedures of the group behind this attack, including monitoring of their infrastructure, shutdown of the operation, avoiding curious eyes through access rules, using wiping instead of deletion for log files and so on," the Kaspersky analysis noted. "This is not very common in APT operations, putting the Mask into the 'elite' APT groups section."

Post updated to add "slang" to the third paragraph.
http://arstechnica.com/security/2014/02/meet-mask-posssibly-the-most-sophisticated-malware-campaign-ever-seen

[anuseems]

Actually my bet is it's from Spain, for two reasons. First, 'careto' is common slang in Spain, which refers to 'face'. It is only used in Spain as far as I know, I've never heard it used in other Spanish-speaking countries. Second reason is that most of the infected computers were in Morocco, and Spain would have (or actually has) lots reasons to want to spy on Moroccan issues. The two countries have been historically related, including some conflicts in recent years.

[mazigh]

the impressive is that this spyware was introduced since 2007 and now we are in 2014!

[mazigh]

Actually my bet is it's from Spain, for two reasons. First, 'careto' is common slang in Spain, which refers to 'face'. It is only used in Spain as far as I know, I've never heard it used in other Spanish-speaking countries. Second reason is that most of the infected computers were in Morocco, and Spain would have (or actually has) lots reasons to want to spy on Moroccan issues. The two countries have been historically related, including some conflicts in recent years.

Maybe you are right if we are dealing with the victims location, but as I know the Mask in Spanish is "Careta" not "Careto", "Careto" Seems to be a Portuguese word so the malware may be made by Brazil or Portugal, but even this we can't confirm who really did it, but we can by decrypting the virus and finding the servers where spyware were connected to =)

[mazigh]

Interesting PDF about the malware from Kaspersky

[Turk]

"The Mask" Espionage Malware By Bruce Schneier February 11, 2014
Based on the prevalence of Spanish-speaking victims, the number of infected victims in Morocco, and the fact that Gibraltar is on the list, that implies Spain is behind this one. My guess is that soon countries will start infecting uninteresting targets in order to deflect blame, but that they still think they’re immune from discovery.
https://www.schneier.com/blog/archives/2014/02/the_mask_espion.html