Chinese espionage tool exploits vulnerabilities is 58 widely used websites

guest · Aug 17, 2021

Chinese espionage tool exploits vulnerabilities is 58 widely used websites
August 17, 2021
https://therecord.media/chinese-espionage-tool-exploits-vulnerabilities-is-58-widely-used-websites/

A security researcher has discovered a web attack framework developed by a suspected Chinese government hacking group and used to exploit vulnerabilities in 58 popular websites to collect data on possible Chinese dissidents.

Fifty-seven of the sites are popular Chinese portals, while the last is the site for US newspaper, the New York Times.

In addition, the tool also abused legitimate browser features in attempts to collect user keystrokes, a large swath of operating system details, geolocation data, and even webcam snapshots of a target’s face—although many of these capabilities weren’t as silent as the exploits targeting third-party websites, since they also tended to trigger a browser notification prompt.
Click to expand...

Tetris is a complex web-based spying tool
Named Tetris, the tool was found secretly uploaded on two websites with a Chinese readership.

“The sites both appear to be independent newsblogs,” said a security researcher going online under the pseudonym of Imp0rtp3, who analyzed the Tetris attack framework for the first time in a blog post earlier this month.

According to Imp0rtp3, users who landed on these two websites were first greeted by Jetriz, the first of Tetris’ two components, which would gather and read basic information about a visitor’s browser.
Named Swid, this component would load 15 different plugins (JavaScript files) inside the victim’s browser in order to perform various actions.
Click to expand...

While web-based attack tools like Tetris aren’t a common sight in cybersecurity reports these days, as most threat actors like to rely on spear-phishing and malware, they are still useful for attackers as they can be used to identify possible targets of interest that can be arrested in the real world or targeted at a later day with malware.
Click to expand...

Uncovering Tetris – a Full Surveillance Kit Running in your Browser

Executive Summary

A Chinese state sponsored threat actor is targeting Chinese-speaking opposition through waterholed websites.

The Campaign uses a modular and custom JS surveillance framework, dubbed “Tetris”, implementing a wide range of browser feature.

Almost all of Tetris’ components have zero AV detections.

Tetris exploits vulnerabilities is 58 widely used websites, including Aliexpress, Baidu, QQ and Tmall.

Two different waterholed websites have been found, there are indications to at least 5 more..

Click to expand...

Log in or Sign up

Chinese espionage tool exploits vulnerabilities is 58 widely used websites

guest Guest

Log in or Sign up

Chinese espionage tool exploits vulnerabilities is 58 widely used websites

guest Guest

Useful Searches