ESET research team assists FBI in Windigo case 0 929

First detected in 2011, the malware campaign that later became known as Windigo was able to infiltrate around 25,000 servers over a two-year period (2012-2014), with the malicious gang behind it demonstrating a high level of technical expertise. Operation Windigo is a set of Linux server-side malware tools used to redirect web traffic, send spam and host other malicious content.

At the core of Operation Windigo is Linux/Ebury, an OpenSSH backdoor and credential stealer, using that backdoor, the attackers installed additional malware to perform web traffic redirection (using Linux/Cdorked), send spam (using Perl/Calfbot or SSH tunnels) and, most importantly, steal credentials when the OpenSSH client was used to spread further.

In 2014 ESET published a research report entitled Operation Windigo. This report was awarded the inaugural Péter Szőr Award for best technical research at VB2014 and has also been used by law enforcement to explain exactly what Windigo is to prosecutors, lawyers and judges.

ESET’s collaboration with the FBI

At ESET our job is to protect all internet users and this task often requires collaboration with others such as law enforcement. In the case of Windigo, we have collaborated with the FBI through the sharing of technical details about the malicious operation and the malware components involved. This cooperation resulted in allowing the FBI investigators to better understand the various parts of this very complex scheme.

Maxim Senakh sentenced

The following timeline outlines the occurence of events leading up to the sentencing of Maxim Senakh

  • 2015-01-13: Indictment against Maxim Senakh is produced, charging him with 11 counts.
  • 2015-08-08: Maxim Senakh is arrested by Finnish authorities at its border while returning to Russia after personal travel.
  • 2016-01-05: Finland agrees to the extradition of Senakh.
  • 2016-02-04: Senakh is extradited from Finland to the US, where he pleads not guilty to all charges against him.
  • 2017-03-28: Maxim Senakh enters into a plea agreement with the US Attorney’s Office and pleads guilty to the first count of the indictment, the remaining 10 being dismissed.
  • 2017-08-03: Senakh is sentenced to 46 months in federal prison, without the possibility of parole.

Where are we now?

Not long after Senakh’s arrest in 2015, there was a sharp decrease in the traffic redirected by Cdorked, the component responsible for sending web visitors to exploit kits or unwanted advertisement pages and this activity has not resumed. The FBI had determined that this malicious activity benefited Senakh directly.

Unfortunately, however the sentencing of Senakh has not resulted in the complete shutdown of Windigo as new variants of Win32/Glupteba, a Windows malware that has strong ties with Windigo have been identified.

In addition, the malware component at the core of Windigo, has evolved. Development has continued with changes made to the latest versions, such as evasion of most of the public indicators of compromise, improved precautions against botnet takeover and a new mechanism to hide the malicious files on the filesystem.

Previous ArticleNext Article

Safer Internet Day 2019 0 205

Working together with your children for a better online experience

Beginning in 2004, Safer Internet Day has grown to become one of the landmark events in the online safety calendar. And this year’s theme, ‘Together for a better internet’, encapsulates a lot of the discussion we are seeing around online safety and cybersecurity. The topic is too complex a minefield for any of us to bear sole responsibility and, like all good things in life, we need to work together to bring about the best possible future.

What does it mean to work together where online safety is concerned? It could be an IT security company working closely with a consultation of parents to develop products, or parents and teachers working to ensure the online education of our young people. But what about children themselves? We put a lot of onus on finding the right solutions and products to protect our kids online, but one day those kids will grow up and live without online parental control. We should think about the best way to prepare them; ‘together for a better internet’ should mean working with our children to educate, inform and protect them, so they can stand the best possible change of making the right decisions for themselves.

That’s not to say that software doesn’t play a crucial role, and ESET would encourage all parents to take care over choosing the right parental control software on the family computer. When you are doing this though, we advise you do it together with your kids. Talk them through the programmes you’re installing and select your privacy settings together, discussing why you are doing it and the kinds of threats you’re protecting the family against. As part of this conversation you can talk to your children about what they’re doing online, who they’re talking to and what kinds of things they need to be careful about in day to day online. Many kids see control settings on the internet as a block to them having fun; what they need is someone to explain their function and reasoning. By having this discussion, you’re giving your kids an element of control and responsibility over their online activities which, when paired alongside the rules and software we all need to protect ourselves, should produce better results when it comes to their internet education.

The internet is such an integral part of our lives that the earlier you start talking to kids, involving them and teaching them about their online worlds, the better the results. Creating an open dialogue will always be more effective than just putting your foot down.

Set an example; whatever you expect your kids to do, make sure you are also doing. The online world represents dangers for all of us and we can all benefit from a few more precautions. If you’re asking your kids to cover their webcam when they’re not using it, then make sure you also do it. If you’re restricting their screen time, then think about setting yourself some boundaries as well. With the damaging effects of too many screens on our health and wellbeing, it’s unlikely to have any negative repercussions.

ESET’s software, such as its ESET Parental Control, places a large emphasis on parents and children working together. It helps them to navigate online, manage what apps and websites they use, and decide – together – what’s good for them. One of the key features is age-based filters which helps to manage which apps children can and cannot access, allowing parents to consider the right restrictions for their children and to not just impose a blanket ban. Other features include setting time limits on when children can play on their devices and creating exceptions that kids can request. Parents can even send their children messages which they must acknowledge before they can continue to use their devices.

It’s elements such as these that allow children to be involved in the monitoring of their safety, and truly help parents to work together with their kids for a better internet and the best possible online world.

 

ESET East Africa launches a new line of enterprise security solutions 0 592

ESET Enterprise solutions

ESET, the leader in cybersecurity research and a top European Union-based endpoint security company, announces the launch of its new line of enterprise security solutions designed to provide the global enterprise sector with tools for prevention and management of cyber risks on a global scale.

ESET East Africa is raising its game with the introduction of ESET Dynamic Threat Defense, an off-premise cloud sandboxing solution providing almost instant analysis of zero-day and ransomware threats before they reach the network.

As recently reported by Forrester[1], buyers want an “endpoint security suite that consolidates capabilities and minimizes complexity when possible.” ESET East Africa’s new line of cybersecurity solutions meets this demand and offers something extra.

The new line of enterprise security solutions also welcomes the brand-new ESET Security Management Center, a revamp of the renowned online console ESET Remote Administrator. This online console provides not only complete network visibility and full security management via one single pane of glass, but also fully customizable reporting and single-click threat remediation, adding important complexity-minimizing elements to the whole suite.

“We understand global enterprise increasingly requires cybersecurity solutions that are more tailored to their specific needs, because we cooperate with a large number of them at the country level,” explained Juraj Malcho, Chief Technology Officer at ESET. “Get your hands on our latest offering and you’ll see how easily manageable an enterprise security solution can be.”

The ESET Endpoint Protection solutions offer enterprises increased visibility of the alerts being sent to ESET LiveGrid® – a platform made up of 110 million sensors worldwide and verified by ESET research & development centers. This allows customers to have the highest level of confidence when viewing data and reports within their consoles.

ESET East Africa offices are based in Nairobi to offer local support to our ever-growing partner base in the East African region. As part of our commitment to the growth of our partners, we are fully focused on servicing our channel. As an ESET East Africa partner, you will benefit from our technical, sales and marketing expertise to assist with deal closure, technical support and onsite training.

ESET East Africa’s new enterprise products and services are designed to be seamlessly deployed in parallel with the existing ESET enterprise offer. For more information about this offering, visit our website.

[1] The Forrester WaveTM: Endpoint Security Suites, Q2 2018 report