0
1
Researchers at security firm McAfee have confirmed that social networks are being used to target North Korean dissidents with spyware
An investigation into a spyware campaign against North Korean defectors, journalists and groups or individuals that help them, has revealed that the attacks are highly targeted.
The investigation follows reports by South Korean media that unknown actors were using KakaoTalk, a popular chat app in South Korea, and other social network services such as Facebook to send links to install malware on victims’ devices.
The links appear to be for a heathcare app called Blood Assistant or an app called Pray for North Korea, but clicking the links results in spyware being installed on the victim’s device.
An identical dropper is used by both apps. McAfee has identified the spyware as Android/HiddenApp.BP.
The researchers found that in the case of the malicious links to Blood Assistant, Facebook was used in 12% of cases to send the link to its targets.
According to the researchers, the dropped Trojan uses popular cloud services Dropbox and Yandex as a control server to upload data and receive commands.
When the dropped Trojan is installed, it saves device information in a temporary folder and uploads it to the cloud, they said. It then downloads a file containing commands and other data to control the infected device.
Most of the malicious behaviours – such as saving contact information – are implemented inside a separate dex [Android executable] file named “core”, which is downloaded from the control server.
The researchers found that command file has its own format, and the handler for command code received from the cloud is implemented as a separate dex file and is downloaded either before or after the malware parses the command file.
This mechanism allows the attacker to easily extend its malicious functionality without needing to update the whole malware, the researchers said.
To read the original article
http://www.computerweekly.com/news/450433004/Spyware-targets-North-Korean-dissidents-via-social-links-says-McAfee
