Slash Boxes

SoylentNews is people

posted by azrael on Saturday July 12 2014, @08:49PM   Printer-friendly
from the tricorder-malfunction dept.

Handheld scanners are installed with sophisticated malware by China-based threat actors in order to target shipping and logistics organizations all over the world says the security firm TrapX (report 15 MB PDF).

The attack begins at a Chinese company that provides hardware and software for handheld scanners used by shipping and logistics firms worldwide to inventory items they handle. The manufacturer installs the malware on the embedded Microsoft Windows XP devices.

Experts determined that the threat group target servers that stores corporate financial data, customer data and other sensitive information. A second payload downloaded by the malware then establishes a sophisticated C&C on the company's finance servers, enabling the attackers to exfiltrate the information they're after.

The malware used by the Zombie Zero attackers is highly sophisticated and polymorphic, the researchers said. One observed attack revealed that 16 of the 48 scanners used by the victim were infected, and the malware managed to penetrate the targeted organization's defenses and gain access to servers on the corporate network.

Interestingly, the C&C is located at the Lanxiang Vocational School, an educational institution said to be involved in the Operation Aurora attacks against Google, and is physically located one block away from the scanner manufacturer, TrapX said. Another possible attack vector is of course the labels with printed binary data. Compartmentalized networks and a strict API enforcement gateway may be ways to combat threats like these.

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 1) by Horse With Stripes on Sunday July 13 2014, @01:39AM

    by Horse With Stripes (577) on Sunday July 13 2014, @01:39AM (#68312)


  • (Score: 3, Informative) by Hairyfeet on Sunday July 13 2014, @11:23PM

    by Hairyfeet (75) <reversethis-{moc ... {8691tsaebssab}> on Sunday July 13 2014, @11:23PM (#68685) Journal

    Thanks. And for those that need proof that Linux can and does get malware? Here is how to write a Linux virus in 5 easy steps [] and please not that it uses social engineering THE SAME ATTACK VECTOR that the majority of Windows bugs use. See security tool, av 20xx, etc, all use social engineering to get past the defenses since ALL of the major OSes are now hardened so well that the weakest link is...drumroll...PEBKAC.

    For those that want specific examples, look up the KDELook screensaver bug, the Quake 3 infected MP (which was in at least one major repo for over a year, showing repos don't magically protect you) and do I even need to mention Heartbleed or any of the other nasties one can find with just 3 minutes on Secunia?

    ACs are never seen so don't bother. Always ready to show SJWs for the racists they are.