Uroburos - Rootkit - More Details

Snippet:

“This kind of data stealing software is too expensive to be used as common spyware. We assume that the attackers reserve the Uroburos framework for dedicated and critical targets. This is the mainreason why the rootkit was only detected many years after the suspected first infection. Furthermore, we assume that the framework is designed to perform cyber espionage within governments and high profile enterprises but, due to its modularity, it can be easily extended to gain new features and perform further attacks as long as it remains undetected within its target.”

The links below has more details:

https://www.alertlogic.com/uroburos-profile/



Previous story - Uroburos rootkit - Apparently this Malware is 3 years old 

http://martin-news-bytes.blogspot.com/2014/03/uroburos-rootkit-apparently-this.html



Previous story - It is claimed to be from Russian government.

http://martin-news-bytes.blogspot.com/2014/03/20th-century-was-nuclear-threat-from.html

Zero Day exploit Business - Aptly called “the modern-day merchants of death” selling “the bullets of cyberwar.”

This article is 2 years old so, we can imagine what it would be today

Here is a rough price list

ADOBE READER                                     $5,000-$30,000

MAC OSX                                                $20,000-$50.000

ANDROID                                                $30,000-$60.000

FLASH OR JAVA BROWSER PLUG-INS $40,000-$100,000

MICROSOFT WORD                                 $50,000-$100,000

WINDOWS $60,000-$120,000

FIREFOX OR SAFARI $60,000-$150.000

CHROME OR INTERNET EXPLORER        $80.000-$200,000

iOS         $100,000-$250,000

The links below has more details:

http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/

Uroburos rootkit - Apparently this Malware is 3 years old

It is  designed to capture network traffic and steal files. It's a rootkit made up of two files, a driver and an encrypted virtual file system. The rootkit is able to take control of an infected machine, execute arbitrary commands and hide system activities.

The malware communicates over a peer-to-peer network. Providing it can find one computer with internet access within a compromised network, it's capable of stealing data from other infected computers on the same network – even if they don't have access to the interwebs

Similarities in techniques and technology point to links between Uroburos and a malware-based attack against the US around six years ago.

The link below has more details:

http://www.theregister.co.uk/2014/03/04/uroburos_spyware/

Here is the previous story where it was claimed to be from Russian government.

http://martin-news-bytes.blogspot.com/2014/03/20th-century-was-nuclear-threat-from.html

Smart devices spying on us (And why is that a surprise)

As  (smart) devices get better and as we use them more and more in our day-to-dya life  , they will obviously retain more and more information about us. The combination of "Internet Of Things", collusion between vendors and governments and insecure design of products is going to make it easy for "Big Brother" or anyone with not-so-good intention to extract these information.

Moral of the story: We can't have it both ways. This is the downside and only in my opinion, privacy laws can offer us some protection

The link below has more details:

http://www.polygon.com/2014/2/28/5456940/our-game-consoles-are-likely-spying-on-us-and-this-is-business-as

20th Century was Nuclear Threat from nations; 21st Century is Malware from Nation States

We better  get used to these types of headlines.   

Well, you can figure out the reason

G Data bases its case for Russian government involvement on the complexity of the malware and the presence of Cyrillic words in the malware sample

Uroburos is a rootkit made of two files, "a driver and an encrypted virtual file system," that can "take control of an infected computer, execute arbitrary commands, and hide system activities." The malware is highly dangerous, MN alleges, because its structure is "modular" and "flexible," meaning that new malicious functions can be added to it easily.

The link below has more details:

http://news.cnet.com/8301-1009_3-57619748-83/security-firm-claims-russian-government-makes-malware