Has your company been infiltrated by the Shady Rat hack?
- 06 August, 2011 00:28
- Comments
When McAfee released its Operation Shady Rat hacking report earlier this week, it didn't name all of the organizations it thought could have been hacked as part of a large, five-year ongoing campaign. Yours might be one of them.
McAfee said 72 organizations worldwide were hacked, according log reports in a server that McAfee gained access to. It listed a few, such as the U.N., the U.S. International Trade Organization and the World Anti-Doping Agency, but most were unnamed.
The company's report generated wide media coverage and a breathless recount of the continued threat that sophisticated hackers pose. China even responded, saying in its official People's Daily newspaper on Friday that linking every cyberattack to the country is "irresponsible."
So how would a company find out if they were affected? It might be hard. But a security vendor has built a Web-based tool called the Shady Rat checker that went live on Friday. It checks to see if the IP address of the computer you are using is listed in the Shady Rat server logs.
A positive result means that a particular computer has communicated with the Shady Rat command-and-control server, said Aviv Raff, CTO and co-founder of Seculert, a company that has a cloud-based service used to detect malware and other cyberthreats.
"It means that your network is or was compromised by Shady Rat," Raff said. "It will also tell you how many times it communicated with the C&C server, and when was the first time."
After McAfee's Shady Rat report was released, Raff said "it took us few hours to put the clues together and realize which attack McAfee was referring to. This is only one of the attacks we monitor on a daily basis."
In fact, Raff said the Shady Rat attack is not particularly special, except for one technical aspect in how the command-and-control server transmitted instructions to compromised machines.
Even several days after McAfee released its report, the server is remarkably still online and communicating with infected machines. The log files are still openly available without any hacking, which is how Raff and Seculert were able to get a list of the 700 IP addresses. Raff said his organization learned the Shady Rat attack "several months ago," and McAfee said in its report that the attack was not new.
The Shady Rat server is hosted in the U.S. but Raff declined to reveal its hosting provider. "I'm sure they were already contacted, as this is under law enforcement investigation," he said.
Send news tips and comments to jeremy_kirk@idg.com
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Bookmark this page
- Share this article
- Got more on this story? Email CIO
- Follow CIO on twitter
-
Apple aims iPads at High Schools
-
Face Time - Interview with John Brennan and Robert DiStefano
-
Google Jumps Into Social Bookmarks Game
-
NBN build gaining momentum daily: Quigley
-
Face Time - Interview with John Brennan and Robert DiStefano
-
Risk management: ensuring the security of your hosted information
Organisations of all sizes are becoming victims to cybercriminals, data breaches, information theft and security risks. But before you go out and spend a fortune on security software, solutions and consultants, the starting point is to identify and measure your business’s exposure to those risks. In this whitepaper, “Exploring, Identifying and Measuring” risk, we examine how to identify risk and share an approach for identifying and measuring risk in your organisation. -
Consolidation Without Compromise
Virtualisation of computer, storage and infrastructure is enabling the transformation of enterprise datacentres into private clouds. The impact is an unprecedented ability to consolidate infrastructure without compromise: no change to service level agreements (SLAs), no loss of performance or scale, and no regression in the organisation’s overall security posture. Read on. -
CISO Guide to Next Generation Threats - Combating Advanced Malware, Zero-Day and Targeted APT Attacks
Over 95% of businesses unknowingly host compromised endpoints, despite their use of firewalls, intrusion prevention systems (IPS), antivirus and Web gateways.1 Today’s attacks look new and unknown to signature-based tools because the attacks employ advanced malware and zero-day vulnerabilities. To regain the upper hand against next-generation attacks, enterprises must turn to true next-generation protection: signature-less, proactive and real time. Read on.
Get exclusive access to Invitation only events CIO, reports & analysis. 
Comments
Post new comment