Damballa finds tools related to the malware that hit Sony

The tools make it easier for attackers to move undetected through a network

Security company Damaballa said it has found two utilities that are closely related to capabilities seen in the destructive malware that hit Sony Pictures Entertainment last year.

The utilities were discovered as Damballa was investigating a new version of the "Destover" malware, which rendered thousands of computers unusable at Sony after attackers stole gigabytes of sensitive company information.

One key question in the Sony breach is how the attackers were able to evade security systems. What Damaballa found are two utilities that help mask new files introduced to a system. 

"Both utilities would be used during an attack to evade detection while moving laterally through a network to broaden the attack surface," wrote senior threat researchers Willis McDonald and Loucif Kharouni, in a blog post on Wednesday.

One of the tools, setMFT, enables a technique called timestopping, which can make a file appear to have a different timestamp. It's often used in combination with renaming a newly introduced file to make it appear to blend in with a group of other files.

"This can conceal a file’s existence from security personnel looking for malicious files or scans of files created after a certain date," they wrote. "Timestomping can get past a cursory check."

The other tool, afset, is used for timestomping and cleaning up log data stored in Windows. It can also change the build time and checksum of an executable.

Afset "allows the attacker to remain stealthy and erase their tracks as they move through the network," they wrote. "A full forensic analysis of a system would reveal the presence of afset and missing log activity, but it’s likely this activity would go undetected initially creating high-risk infection dwell time."

It can be difficult for companies to detect intruders in their networks, particularly if the attackers are using valid login credentials stolen from an authorized user. Once in, using these utilities could make it even harder to detect strange activity.

Just one antivirus product was detecting both of the tools, the researchers wrote. That makes it likely that newer versions of them would not be detected, at least initially. 

"These capabilities, when used together with tools that enable attackers to obtain network credentials and disable defenses, allows them to permeate the network undetected for an extended period of time," they wrote.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?