ShadowPad: Attackers hid powerful backdoor in a popular server management software

USA: Kaspersky Lab researchers have discovered a backdoor planted in a server management software, NetSarang. When activated, the backdoor allows attackers to download further malicious modules or steal data.

The backdoor called ShadowPad is one of the largest known supply-chain attacks. Kaspersky Lab has alerted NetSarang, the affected software vendor, and it promptly removed the malicious code and released an update for customers.

The affected NetSarang titles are Xmanager Enterprise 5.0, Xmanager 5.0, Xshell 5.0, Xftp 5.0, or Xlpd 5.0. According to Kaspersky Lab research, the malicious module has been activated in Hong Kong, but it could be lying dormant on many other systems worldwide, especially if the users have not installed the updated version of the affected software.

“ShadowPad is an example of how dangerous and wide-scale a successful supply-chain attack can be. Given the opportunities for reach and data collection it gives to the attackers, most likely it will be reproduced again and again with some other widely used software component,” said Igor Soumenkov, security expert, Global Research and Analysis Team, Kaspersky Lab.

Last month, Kaspersky Lab’s Global Research and Analysis Team (GReAT) was approached by one of its partners, a financial institution. The organization’s security specialists were worried about suspicious DNS (domain name server) requests originating on a system involved in the processing of financial transactions.

Further investigation showed that the source of these requests was server management software used by hundreds of customers in industries like financial services, education, telecoms, manufacturing, energy and transportation. The most worrying finding was the fact that the vendor did not mean for the software to make these requests.

Further Kaspersky Lab analysis showed that the suspicious requests were actually the result of the activity of a malicious module hidden inside a recent version of the legitimate software.

Following the installation of an infected software update, the malicious module would start sending DNS-queries to specific domains (its command and control server) at a frequency of once every eight hours. The request would contain basic information about the victim’s system (user name, domain name, host name). If the attackers considered the system to be “interesting,” the command server would reply and activate a fully-fledged backdoor platform that would silently deploy itself inside the attacked computer. After that, on command from the attackers, the backdoor platform would be able to download and execute further malicious code.

Some of them are very similar to ones used previously by the PlugX and Winnti groups, which are known to be Chinese-speaking cyberespionage groups, found the researchers.

“This case shows that large companies should rely on advanced solutions capable of monitoring network activity and detecting anomalies. This is where you can spot malicious activity even if the attackers were sophisticated enough to hide their malware inside legitimate software,” added he.

Ankush Johar, Director at Bugsbounty.com - a crowdsourced security platform for ethical hackers and businesses said, “This incident clearly highlights that threats may be lurking in the background, and may not be your fault at all. This is a clear third party threat. The only thing a security-conscious enterprise can undertake is to deploy ‘intrusion-aware’ and ‘intrusion-prevention’ tools, open-source or paid, to avert any such debacles.”