'StrongPity' Malware Infects Users Through Legitimate WinRAR and TrueCrypt Installers (neowin.net) 105
Kaspersky Labs has revealed a new strain of malware -- named 'StrongPity' which targets users looking for two popular applications - WinRaR and TrueCrypt. The malware contains components that not only has the ability to give attackers complete control on the victim's computer, but also steal disk contents and download other software that the cybercriminals need. From a Neowin report: To be able to gather victims, the attackers have built special fake websites that supposedly host the two programs. One instance that was discovered by the researchers is that the criminals transposed two letters in a domain name, in order to fool the potential victim into thinking that the program was a legitimate WinRAR installer website.
Title smells like bullshit (Score:5, Insightful)
Re: (Score:1)
Re: (Score:3)
Bad writing, but I'm sure the meaning is that it also legitimately installs the actual intended software. Might even be the exact same installer but with a modified payload.
Re: (Score:3)
Isn't that precisely how malware has been spreading since day one?
Re: (Score:2)
Yellow journalism, or the yellow press, is a type of journalism that presents little or no legitimate well-researched news and instead uses eye-catching headlines to sell more newspapers. Techniques may include exaggerations of news events, scandal-mongering, or sensationalism.
That pretty much describes every media outlet around these days.
Re: (Score:2)
Yea, I was expecting to see something in the article where they somehow injected their malware without changing the MD5 or SHA sums and put them back in the official mirrors. That would have been way more impressive.
Re: (Score:3)
not legitimate... It is horrible writing and freaking fearmongering FUD crap that is the norm for slashdot now days.
These are MODIFIED installers, the article needs to be corrected
Re: (Score:2)
Looking at some site, the user then finds some site GUI with a swapped out download that offers poor crypto but has the look and feel of the real crypto software.
"On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users" (October 3, 2016)
https://securelist.com/blog/re... [securelist.com]
"Adding in their creative waterholing and poisoned installer tactics, we describe the StrongPity APT as not only determined and well-resourced, but fairly
Legitimate (Score:4, Insightful)
Re: (Score:2)
In this case, you're right. But conversely, just because it's legitimate, does not mean it's malware free.
Of course this makes for clickbait, because legitimate installers installing malware are rare, whereas fake installers installing malware is an every day occurrence.
Legitimate Installers (Score:1)
... no. How could the malware being served qualify as a legitimate installer?
sounds like (Score:1)
someone just downloaded an .exe off a website and ran it.
If I can get someone to do that, you don't need winrar as part of the equation anymore.
Actual source (Score:5, Informative)
Nothing like an ad-infested news page with referral program links to the original source. Here is the actual article, with a sanitized URL:
http://usa.kaspersky.com/about-us/press-center/press-releases/2016/Kaspersky_Lab_Reveals_Advanced_Persistent_Threat_StrongPity [kaspersky.com]
Re: (Score:2)
Re: (Score:3)
7zip is open source and I'm pretty sure it handles rar/zip/gzip too.
Re: (Score:2)
7-Zip has no recovery options. If you're doing backups, but note testing them (which is a classic home scenario), RAR and it's extra recovery data can save you.
Re:Wait.. (Score:4, Interesting)
7-zip decompresses RAR files, and makes 7z (LMZA and LMZA2) files which are smaller, "better"* (support multi threaded compression/decompression and AES encryption) and is multi-platform and open source. Absolutely no reason why it shouldn't be your compression format of choice.
Re: (Score:2)
Cheers, I haven't seen disk fragmentation myself, but I'll look out for it from now on.
And yes, I think you're correct, I don't think 7zip has any recovery or repair mode, but it does make a "best effort" and in my experience will partially recover damaged archives. Of course, since it will depend enormously on the exact file structure, archive structure, and level of damage, this should be regarded more as an anecdote than advice.
Re: (Score:2)
Except for the one construction supplies company who sent infected .rars to several of my users. (To be fair that was about 8 years ago. Things may have got better but I wouldn't hold my breathe).
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
Why are people still using something that the authors of same apparently think is compromised?
Because if they really found a serious bug they'd either patch it or tell people where it is and why it needs fixing. The whole "there's a problem here, but I won't tell you what it is", "trust Microsoft, switch to Bitlocker" and so on was just screaming "there's something we can't tell you". It's designed to ruin their credibility so that nobody would trust another Truecrypt release. Why would they do that? The only logical explanation I can think of is that somebody was trying to force them to add a backd
Re: (Score:2)
Re: (Score:2)
Why is this here? (Score:4, Insightful)
Hasn't this been done 1000 times before? What's new here? Why is this newsworthy?
Re: (Score:2)
They're going as far as creating lookalike web sites to host it. I haven't seen this exact thing before personally.
Re:Why is this here? (Score:5, Informative)
The headline stated something rare (legitimate installers of popular programs being infested by malware)
Of course the headline was nothing to do with reality, the article, or even the summary, which is all about the every day occurrence of fake installers being used to try to trick people in to installing malware, which is not new at all.
Re: Why is this here? (Score:1)
I wondered that. The link below mentions unusual and fake certificates.
The malware first appeared on tamindir.com at the end of 2015 redirecting mainly Turkish users to a clone of the truecrypt site then last month links were put on winrar.it and winrar.be to point to copies of the winrar site which affected mainly Italian and Belgian users respectively. The malware was after details of encryption and passwords.
There's no word on how the attackers put links to the malware on legitimate sites.
I'd guess it'
Re: (Score:1)
Why do people feel the need to post "why is this news?" comments? This actually may interest some people. Maybe _you_ already knew it, but there are new people on the site every day. It's pretty egotistical to think that only things that interest you is news. The better question is "why are you posting this?"
Re: (Score:2)
I'm more surprised that Slashdot passed on the error without thinking how stupid it sounded.
You must be new here.
Re: (Score:2)
Malware controls victim's Windows computer (Score:2)
Msmash forgot to mention that this malware is only effective on Microsoft Windows. Go here [distrowatch.com] for an alternative to the Microsoft industry standard.
Re: (Score:2)
Re: (Score:2)
I'm pretty sure you can in WINE. And Truecrypt has Linux versions for sure.
Re: (Score:2)
Other code might be security service friendly by design as a small front company, gov fronted start up or via developers who had to make deals or had cash offers made by govs or got trapped under a US NSL at work.
Its hard to find good crypto that works. Look at the help the security services got over everyday crypto by big US brands under PRISM or VPV sec
Re: (Score:2)
So NOT legitimate, then (Score:2)
'StrongPity' Malware Infects Users Through Legitimate WinRAR and TrueCrypt Installers
in order to fool the potential victim into thinking that the program was a legitimate WinRAR installer website.
It certainly fooled whoever submitted the story.
Now, will someone at Slashdot bother to fix it?
Re: (Score:3)
Why use WinRAR? (Score:2)
Considering removing slashdot from favourites (Score:2)
This is supposedly a tech news site.
There is no way that editing can accidentally be that shit. Malware in "Legitimate installer" - wow that is news. Click through to standard bullshit.
Things like this are a good way to drive away the readership. Only reason I still visit is that the community is still large enough to have interesting discussions around the articles (although the trolling etc is getting worse as time goes on)
(Just wish a few other alternatives would get more active communities)
Ok, folks, where is the story? (Score:2)
First of all, the headline is misleading. For it to be true, you'd have to get infected somehow by installing genuine WinRAR and TrueCrypt software you downloaded from trusted (and trustworthy), genuine sources. Now THAT definitely WOULD be a story!
But what do we have instead? Malware writers using typosquatting techniques to get people to install genuine looking software. Now, it's been a while that I've left the malware analysis business, but even back then, well over a decade ago, this would not have mad