Menu
Malware hidden in Chinese inventory scanners targeted logistics, shipping firms

Malware hidden in Chinese inventory scanners targeted logistics, shipping firms

Researchers from TrapX discovered a sophisticated multistage cyberespionage attack that started in the supply chain

Financial and business information was stolen from several shipping and logistics firms by sophisticated malware hiding in inventory scanners manufactured by a Chinese company.

The supply chain attack, dubbed "Zombie Zero," was identified by security researchers from TrapX, a cybersecurity firm in San Mateo, California, who wrote about it in a report released Thursday.

TrapX hasn't named the Chinese manufacturer, but said that the malware was implanted in physical scanners shipped to customers, as well as in the Windows XP Embedded firmware available for download on the manufacturer's website.

The malware was designed to launch attacks using the SMB (Server Message Block) protocol and the Radmin remote control protocol when the infected inventory scanner was connected to a company's wireless network. It then looked for ERP (enterprise resource planning) servers with the word "finance" in their names and used known exploits to compromise them, said Carl Wright, executive vice president and general manager of TrapX.

Wright declined to name the targeted ERP software, but said that it's a very popular one that runs on Linux.

According to the TrapX researchers, once an ERP server is found and compromised, the malware installs a second-stage component that connects to command-and-control server at the Lanxiang Vocational School in China's Shandong province. The researchers noted in their report that the Lanxiang Vocational School has been linked in the past to cyberespionage attacks against Google and other companies as part of a campaign called Operation Aurora.

The second-stage component downloads a third and more sophisticated payload that establishes a separate connection to a facility in Beijing.

The malware's goal is to steal corporate financial and customer data from ERP servers, as well shipping manifest information, the TrapX researchers said.

Wright declined to speculate on whether the unnamed Chinese vendor intentionally inserted malware into its scanners or if it might have been a victim of an attack that led to its products and software being compromised. However, he pointed out that when contacted, the vendor initially denied the allegations, but then replaced the infected firmware on its website. He also noted that the company is based only a few blocks from the Lanxiang Vocational School.

Since the attack was originally detected, TrapX has identified seven victims in the shipping and logistics industry, as well as a robotics firm that was attacked with the same initial malware, but with different payloads, Wright said. In the case of the robotics firms, the attack didn't target ERP systems, he said.

Security researchers have warned about the possibility of malware attacks through the supply chain for years, but the number of confirmed incidents has been low. However, according to Wright, the world is changing and this type of attack could happen more often.

Recent media reports based on documents leaked by former U.S. National Security Agency contractor Edward Snowden said that the NSA routinely intercepted routers, servers and other network equipment shipped by U.S. manufacturers to international customers and installed surveillance tools in them.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securityTrapXExploits / vulnerabilitiesmalware

Featured

Slideshows

Sizing up the NZ security spectrum - Where's the channel sweet spot?

Sizing up the NZ security spectrum - Where's the channel sweet spot?

From new extortion schemes, outside threats and rising cyber attacks, the art of securing the enterprise has seldom been so complex or challenging. With distance no longer a viable defence, Kiwi businesses are fighting to stay ahead of the security curve. In total, 28 per cent of local businesses faced a cyber attack last year, with the number in New Zealand set to rise in 2017. Yet amidst the sensationalism, media headlines and ongoing high profile breaches, confusion floods the channel, as partners seek strategic methods to combat rising sophistication from attackers. In sizing up the security spectrum, this Reseller News roundtable - in association with F5 Networks, Kaspersky Lab, Tech Data, Sophos and SonicWall - assessed where the channel sweet spot is within the New Zealand channel. Photos by Maria Stefina.

Sizing up the NZ security spectrum - Where's the channel sweet spot?
Kiwi channel comes together for another round of After Hours

Kiwi channel comes together for another round of After Hours

The channel came together for another round of After Hours, with a bumper crowd of distributors, vendors and partners descending on The Jefferson in Auckland. Photos by Maria Stefina.​

Kiwi channel comes together for another round of After Hours
Consegna comes to town with AWS cloud offerings launch in Auckland

Consegna comes to town with AWS cloud offerings launch in Auckland

Emerging start-up Consegna has officially launched its cloud offerings in the New Zealand market, through a kick-off event held at Seafarers Building in Auckland.​ Founded in June 2016, the Auckland-based business is backed by AWS and supported by a global team of cloud specialists, leveraging global managed services partnerships with Rackspace locally.

Consegna comes to town with AWS cloud offerings launch in Auckland
Show Comments