Sykipot Trojan hijacks DoD smart cards
Sykipot variant acts as smart card proxy in order to access protected resources
IDG News Service - A variant of the Sykipot Trojan Horse hijacks U.S. Department of Defense (DoD) smart cards in order to access restricted resources.
"We recently discovered a variant of Sykipot with some new, interesting features that allow it to effectively hijack DoD and Windows smart cards," said Jaime Blasco, a security researcher at AlienVault, in a blog post. "This variant, which appears to have been compiled in March 2011, has been seen in dozens of attack samples from the past year."
Smart cards interface with computers through a special reader. They use digital certificates and PIN codes for authentication purposes.
Sykipot is commonly used in advanced persistent threat (APT) attacks. According to Blasco, the Sykipot variant recently analyzed by AlienVault contains several commands to capture smart card information and use it to access secure resources.
One of the variant's routines is designed to work with ActivIdentity ActivClient, an authentication software product compliant with DoD's Common Access Card (CAC) specification.
The CAC enables access to DoD computers, networks, and certain facilities. It allows users to encrypt and digitally sign emails and it facilitates the use of public key infrastructure (PKI) for authentication purposes.
This Sykipot variant reads the smart card certificates registered on the victim's computer, steals the card's PIN number using a keylogger module and uses the information to log into protected resources, as long as the card remains inside the reader, Blasco said. In essence, it becomes a smart card proxy.
"While trojans that have targeted smartcards are not new, there is obvious siginficance to the targeting of a particular smartcard system in wide deployment by the U.S. DoD and other government agencies, particularly given the nature of the information the attackers seem to be targeting for exfiltration," Blasco said.
Sykipot was distributed last month as part of an APT attack against companies from the telecommunications, manufacturing, computer hardware, chemical and defense industries. targeted U.S. federal agencies in particular. According to AlienVault, the Trojan's main command and control servers are located in China, although its creators will sometime use U.S.-based servers to route the stolen information in order to avoid detection.
- Where You Mitigate Heartbleed Matters Read this article to learn more about why customers must choose the most strategic point in the network at which to deploy their...
- Mitigating Multiple DDoS Attack Vectors It's time to rethink and refine the enterprise security architecture, so organizations can remain agile and resilient against future threats. Download this infographic...
- SIP Migration: Addressing CIOs' Concerns Recent data from IDG Research shows that many IT executives are counting on SIP to help them meet employee efficiency and customer experience...
- City Solved Network Mystery - Saves $30K The City of Jacksonville put their hunch to work and not only solved a mystery, but found a new and innovative use for...
- What Does it Take to Deliver a Superior Customer Experience? The Two Top-Rated Online Retailers, B&H Photo and Crutchfield Electronics, Share Their Secrets Discuss practical CX tools and service methods such as contact center agents and the use of realtime speech analytics to help contact center...
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily... All Network Security White Papers | Webcasts