The Neutrino exploit kit has a new way to detect security researchers

Neutrino is using passive OS fingerprinting to detect visiting Linux machines, according to Trustwave

The developers of the Neutrino exploit kit have added a new feature intended to thwart security researchers from studying their attacks.

The feature was discovered after Trustwave's SpiderLabs division found computers they were using for research couldn't make a connection with servers that delivered Neutrino.

"The environment seems completely fine except for when accessing Neutrino," wrote Daniel Chechik, senior security researcher.

Exploit kits are one of the most effective ways that cybercriminals can infect computers with malware. They find vulnerable websites and plant code that transparently connects with another server that tries to exploit software vulnerabilities.

If the server finds a hole, the malware is delivered, and the victim is none the wiser. Exploit kits are also sometimes delivered by malicious online ads in attacks known as malvertising.

Malware writers and cyberattackers have long used methods to try to stop security engineers from studying their methods. For example, some malware programs are designed to quit if they're running in a virtual machine.

Chechik wrote that Trustwave tried changing IP addresses and Web browsers to avoid whatever was causing the Neutrino server to not respond, but it didn't work.

But by fiddling with some data traffic that Trustwave's computers were sending to the Neutrino server, they figured out what was going on.

Neutrino has been engineered to use passive OS fingerprinting, which is a method to collect and analyze data packets without the entity that is sending the packets knowing their computers are being profiled. In this case, the computer sending the packets is a security researcher's system that's probing the hackers' server.

Passive OS fingerprinting captures "traffic coming from a connecting host going to the local network," according to a post on the SANS blog. "The fingerprinting can then be conducted without the remote host being aware that its packets are being captured."

Michal Zalewski, a security researcher who works for Google, wrote a tool specifically for passive OS fingerprinting.

It offers attackers the advantage of stealth, since active OS fingerprinting -- which involves sending direct traffic to another network -- can trigger alerts from firewalls and intrusion detection equipment.

Chechik wrote that Neutrino appears to be using passive OS fingerprinting in order to shut down connections coming from Linux machines, which are likely to be used by security researchers.

"This approach generally reduces their exposure to anything from automated scans to unwanted security researchers," he wrote.

It's a smart move by Neutrino's developers, because if a server doesn't respond, it's generally considered down.

"It is very likely that this behavior would simply be written off as a dead server and Neutrino would achieve its goal of being left alone by anyone who isn't a potential victim," Chechik wrote.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?