for Beijing has been found targeting telecommunications companies
with a new piece of malware designed to spy on text messages sent
or received by highly targeted individuals.
Dubbed “MessageTap,” the backdoor malware is a 64-bit ELF
data miner that has recently been discovered installed on a
Linux-based Short Message Service Center (SMSC) server of an
unnamed telecommunications company.
According to a recent report published by FireEye’s Mandiant
firm, MessageTap has been created and used by APT41, a
prolific Chinese hacking group that carries out state-sponsored
espionage operations and has also been found involved in
financially motivated attacks.
In mobile telephone networks, SMSC servers act as a middle-man
service responsible for handling the SMS operations by routing
messages between senders and recipients.
Since SMSes are not designed to be encrypted, neither on
transmitting nor on the telecom servers, compromising an SMSC
system allows attackers to monitor all network connections to and
from the server as well as data within them.
How Does MessageTap Malware Work?
MessageTap uses the libpcap library to monitor all SMS traffic and
then parses the content of each message to determine IMSI and phone
numbers of the sender and the recipient.
malware to filter and only save messages:
- sent or received by specific phone numbers,
- containing certain keywords, or
- with specific IMSI numbers.
For this, MessageTap relies on two configuration files provided by
attackers — keyword_parm.txt and parm.txt — that contain a list of
targeted phone numbers, IMSI numbers, and keywords linked to
“high-ranking individuals of interest to the Chinese intelligence
services.”
“Both files are deleted from disk once the configuration files are
read and loaded into memory. After loading the keyword and phone
data files, MESSAGETAP begins monitoring all network connections to
and from the server,” the researchers said in its report[1] released today.
“The data in keyword_parm.txt contained terms of geopolitical
interest to Chinese intelligence collection.”
content and saves it to CSV files for later theft by the threat
actor.
intercepted several layers upstream in their cellular communication
chain” is especially “critical for highly targeted individuals such
as dissidents, journalists, and officials that handle highly
sensitive information.”
Besides this, the APT41 hacking group has also been found
stealing call detail records (CDR) corresponded to high-ranking
foreign individuals during this same intrusion, exposing metadata
of calls, including the time of the calls, their duration, and the
source and destination phone numbers.
Chinese hackers targeting telecommunications companies isn’t
new. In this year itself, the APT41 hacking group targeted at least
four telecommunications entities, and separate Chinese-suspected
state-sponsored groups also observed hitting four additional
telecommunications organizations.
According to the FireEye researchers, this trend will continue
and more such campaigns will be discovered soon, and therefore to
mitigate a degree of risks, targeted organisations should consider
deploying an appropriate communication program that enforces
end-to-end encryption.
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/RcicDW-4EEg/sms-spying-malware.html