The researchers said that CronRat “enables server-side Magecart data theft which bypasses browser-based security solutions”. The malware was discovered on several eCommerce websites injecting Magecart payment skimmers in server-side code.
Sansec director of threat research Willem de Groot said that digital skimming is moving from the browser to the server, and this is yet another example.
“Most online stores have only implemented browser-based defenses, and criminals capitalize on the unprotected back-end. Security professionals should really consider the full attack surface,” he added.
The malware uses Linux’s cron job scheduling utility to hide from discovery. It adds several tasks to crontab with a curious date specification: 52 23 31 2 3. These lines are syntactically valid but would generate a run time error when executed.
“However, this will never happen as they are scheduled to run on February 31st. Instead, the actual malware code is hidden in the task names and is constructed using several layers of compression and base64 decoding,” said researchers.
What to consider when choosing a next-generation firewall
How to choose a NGFW solution
According to researchers, the malware is a sophisticated Bash program that features self-destruction, timing modulation, and a custom binary protocol to communicate with a foreign control server. Upon launch, it contacts the control server using an exotic feature of the Linux kernel that enables TCP communication via a file using a fake banner for the Dropbear SSH service. This also helps to keep the malware hidden.
It also contacts a server hosted on Alibaba in China, and uses a custom binary protocol with random checksums, to avoid detection by firewalls and packet inspectors.
Once contact with a C2 server is established, it drops its disguise and sends and receives numerous commands, and downloads a malicious dynamic library. Afterwards, the malware is ready to run any command on a compromised system.
While investigating this RAT, the researchers wrote another specially crafted RAT client to intercept commands. This led to the discovery of yet another RAT that researchers hope to study in-depth later.
Shining light on new ‘cool’ cloud technologies and their drawbacks
IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley
Build mobile and web apps faster
Three proven tips to accelerate modern app development
Reduce the carbon footprint of IT operations up to 88%
A carbon reduction opportunity
Comparing serverless and server-based technologies
Determining the total cost of ownership
See the original article here: ITPro