Menu
'ScanBox' keylogger targets Uyghurs, US think tank, hospitality industry

'ScanBox' keylogger targets Uyghurs, US think tank, hospitality industry

The JavaScript-based attack doesn't put malware on a computer's disk

A diversification of targets for a clever keylogging attack suggests that several hacking groups may be using the "ScanBox" framework, which spies on users without installing malicious software.

ScanBox was found in August by the security company Alien Vault on the website of a large industrial company that develops simulation and engineering software for aerospace and manufacturing companies.

PricewaterhouseCoopers wanted to see if ScanBox was more widespread and found it on a more diverse set of websites, including one for the Uyghur community in China, an industrial-related website in Japan, a U.S. think tank and a Korean hospitality site.

"This variation was our first clue that more than one actor may be using the framework, although on its own this would not be enough - some actors do target a wide range of organisations, some also focus on specific geographies or sectors," wrote Chris Doman and Tom Lancaster, who work in cyber threat detection and response for PwC.

It's a common technique for attackers to plant malware or other malicious code on legitimate websites, in what is referred to as a "watering hole" attack.

ScanBox is unique in that it doesn't install malware but instead uses JavaScript. If executed in the browser, the JavaScript logs keystrokes and collects system information that could be used later to exploit computers in other ways, Doman and Lancaster wrote.

The four infected websites had generally the same code base for ScanBox, although there were minor differences in implementation. Depending on which browser a person is using, ScanBox loads different plugins that check the versions of Microsoft's SharePoint application or Adobe Systems' Reader app, among others. If attackers detect outdated versions of those applications, they may try to exploit them in further attacks.

Though the four attacks all used SandBox, there was "little overlap both in terms of associated infrastructure and in terms of the malware families associated with that infrastructure," such as shared IP addresses or other domains, Doman and Lancaster wrote.

The four websites are so different that they would be of interest to separate groups of attackers. Sometimes, attackers do take exploit kits planted on other websites and appropriate them for their own use, they wrote. They also occasionally share attack kits even if they have different targets in mind.

"Sharing frameworks like ScanBox or other exploit kits allows less sophisticated actors who were themselves unable to develop a tool like ScanBox to conduct better attacks," they wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags securityAlien VaultmalwarePricewaterhouseCoopers

Featured

Slideshows

Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Show Comments