Powerful malware infected governments in Russia, Iran, and Rwanada, stayed hidden for five years

projectsauron malware stayed hidden five years project sauron header
An incredibly sophisticated piece of malware infected government computers in Russia, Iran, and Rwanda, and evaded detection for five years. The malware, called “ProjectSauron” by Kaspersky and “Remsec” by Symantec, has been active since 2011, or longer, infecting computers on the computers of government entities, military operations, research institutions, banks, and telecommunication companies.

The malware used all kinds of tricks to stay hidden, including living mostly in system memory. But a huge part of ProjectSauron’s success, Ars Technica is reporting, is the virus’ ability to avoid leaving patterns.

“The attackers clearly understand that we as researchers are always looking for patterns,” a Kaspersky report said. “Remove the patterns and the operation will be harder to discover. We are aware of more than 30 organizations attacked, but we are sure that this is just a tiny tip of the iceberg.”

This pattern avoidance is crucial to the malware’s success, and also downright impressive. For example: executables had different names on different machines, all of them designed to look innocuous. Here are a few example filenames from Kaspersky’s report:

Vendor that uses similar filenames Disguised malware filename
Kaspersky Lab kavupdate.exe, kavupd.exe
Symantec SsaWrapper.exe, symnet32.dll
Microsoft KB2931368.exe
Hewlett-Packard hptcpprnt.dll
VmWare VMwareToolsUpgr32.exe

As you can see, the malware took on seemingly mundane filenames that users would not find out-of-place.

But things get even crazier. This malware had a plugin system, meaning custom Lua code could be configured to grab data from specific machines. There are 50 different kinds of plugin possible.

The malware can infect computers in a number of different ways. Even if a target is air-gapped, the malware can hop over on USB drives.

Information can be gleaned from targets in all sorts of different ways too, some of them quite novel. For example: the malware has been shown to send metadata over DNS.

What’s the point of all this? According to Kaspersky, the malware is “designed to perform specific functions like stealing documents, recording keystrokes, and hijacking encryption keys from both infected computers and attached USB sticks.”

What isn’t known is who made this malware. The sophistication suggests a state sponsor, but nothing can be said for sure at this point. We’ll be watching closely as security researchers try to learn more.

Business

‘Ralph Breaks the Internet’ wins one of the worst box-office weekends of 2018

Wreck-It Ralph sequel Ralph Breaks the Internet stayed on top of the weekend box office for the third week, winning what was one of the worst weekends for ticket sales in the US so far this year.
Computing

With 20,000 sites swallowed up, a botnet is eating WordPress alive

A botnet of infected WordPress sites has been attacking other WordPress sites, generating up to five million malicious logins on certain WordPress backends within the last thirty days.
Mobile

The best weather apps for the iPhone

Don't rely solely on your local meteorologist to stay up to date on the weather. Take matters into your own hands with one of these weather apps, each of which brings something unique to the table.
Mobile

Atomic-colored BlackBerry Key2 LE arrives just in time to bring holiday cheer

TCL teased that it would release two new BlackBerry phones with keyboards this year, and it has stayed true to its promise. The company announced its latest handset, the BlackBerry Key2 LE, at IFA 2018 in Berlin.
Computing

Microsoft’s Chromium Edge browser may be adding your Chrome extensions

Fans sticking to Google Chrome because due to its vast extension library might be able to switch over to Microsoft's latest iteration of Edge, as a project manager confirms that the company has its eyes on Chrome extensions.
Gaming

Apple Mac users should take a bite out of these awesome games

Contrary to popular belief, there exists a bevy of popular A-list games compatible for Mac computers. Take a look at our picks for the best Mac games available for Apple fans.
Emerging Tech

An A.I. cracks the internet’s squiggly letter bot test in 0.5 seconds

How do you prove that you’re a human when communicating on the internet? The answer used to be by solving a CAPTCHA puzzle. But maybe not for too much longer. Here is the reason why.
Computing

Qualcomm’s dual-screen PC concept looks like two connected Surface Go tablets

In Qualcomm's video teaser, we got a glimpse of the company's vision for how a dual-screen ARM PC should work. The internet reacted to Qualcomm's video, calling the device in question merely a mashup of two Surface Go tablets.
Deals

Check out the best Green Monday deals for those last-minute gifts

Black Friday and Cyber Monday have come and gone, but that doesn't mean you've missed your chance of finding a great deal. We're talking about Green Monday, of course, and it falls on December 10.
Computing

Hololens 2 could give the Always Connected PC a new, ‘aggressive’ form

Microsoft is said to be leaning on Qualcomm to power its Hololens 2 headset. Instead of Intel CPUs, the next Hololens could use a Snapdragon 850 processor, allowing it to benefit from the always-connected features.
Computing

Chrome’s dark mode may cast its shadow over Macs by early 2019

By early 2019 Google may release a version of Chrome for Mac users that offers a Dark Mode feature to match MacOS Mojave's recent darkening.
Computing

These laptop bags will keep your notebook secure wherever you go

Choosing the right laptop bag is no easy feat -- after all, no one likes to second-guess themselves. Here are some of the best laptop bags on the market, from backpacks to sleeves, so you can get it right the first time around.
Home Theater

Step aside set-top boxes, the best streaming sticks are tiny and just as powerful

Which streaming stick reigns supreme? We pit the Chromecast and Chromecast Ultra against the Roku Premiere, Roku Streaming Stick+, and the Amazon Fire TV Stick 4K to help you decide which one will be the best fit in your living room.
Computing

If you've lost a software key, these handy tools can find it for you

Missing product keys getting you down? We've chosen some of the best software license and product key finders in existence, so you can locate and document your precious keys on your Windows or MacOS machine.