Saturday Dec 14, 2024
Saturday Dec 14, 2024
Monday, 10 March 2014 00:00 - - {{hitsCtrl.values.hits}}
Those assessments were based on analysis of tactics employed by hackers, along with technical indicators and the victims they targeted.
“It is sophisticated malware that’s linked to other Russian exploits, uses encryption and targets western governments. It has Russian paw prints all over it,” said Jim Lewis, a former US Foreign Service Officer, now senior fellow at the Centre for Strategic and International Studies in Washington.
However, security experts caution that while the case for saying Turla looks Russian may be strong, it is impossible to confirm those suspicions unless Moscow claims responsibility. Developers often use techniques to cloud their identity.
The threat surfaced this week after a little known German anti-virus firm, G Data, published a report on the virus, which it called Uroburos, the name text in the code that may be a reference to the Greek symbol of a serpent eating its own tail.
Experts in state-sponsored cyber attacks say that Russian government-backed hackers are known for being highly disciplined, adept at hiding their tracks, extremely effective at maintaining control of infected networks and more selective in choosing targets than their Chinese counterparts.
“They know that most people don’t have either the technical knowledge or the fortitude to win a battle with them. When they recognize that someone is onto them, they just go dormant,” said one expert who helps victims of state-sponsored hacking.
A former western intelligence official commented: “They can draw on some very high grade programmers and engineers, including the many who work for organised criminal groups, but also function as privateers.”
Russia’s Federal Security Bureau declined comment as did the Pentagon and US Department of Homeland Security officials.
On Friday, Britain’s BAE Systems Applied Intelligence - the cyber arm of Britain’s premier defence contractor - published its own research on the spyware, which it called “snake.”
The sheer sophistication of the software, it said, went well beyond that previously encountered - although it did not attribute blame for the attack.
“The threat... really does raise the bar in terms of what potential targets, and the security community in general, have to do to keep ahead of cyber attacks,” said Martin Sutherland, Managing Director of BAE Systems Applied Intelligence.
Symantec Corp estimates up to 1,000 networks have been infected by Turla and a related virus, Agent.BTZ. It named no victims, saying only that most were government computers.
BAE said it has collected over 100 unique samples of Turla since 2010, including 32 from Ukraine, 11 from Lithuania and 4 from Great Britain. It obtained smaller numbers from other countries.
Hackers use Turla to establish a hidden foothold in infected networks from which they can search other computers, store stolen information, then transmit data back to their servers.
“While it seems to be Russian, there is no way to know for sure,” said Mikko Hypponen, Chief Research Officer with Helsinki-based F-Secure, which encountered Turla last year.
Security firms that are monitoring the threat have said the operation’s sophistication suggests it was likely backed by a nation state and that technical indicators make them believe it is the work of Russian developers.
European governments have long welcomed US help against Kremlin spying, but were infuriated last year to discover the scale of surveillance by America’s National Security Agency that stretched also to their own territory.
