Security researcher creates new backdoor inspired by leaked NSA malware

guest · Apr 24, 2019

Security researcher creates new backdoor inspired by leaked NSA malware
New experimental backdoor highlights an OS section that antivirus products are not looking at
April 24, 2019
https://www.zdnet.com/article/secur...-new-backdoor-inspired-by-leaked-nsa-malware/

A security researcher has created a proof-of-concept backdoor inspired by the NSA malware that leaked online in the spring of 2017.
This new malware is named SMBdoor and is the work of RiskSence security researcher Sean Dillon (@zerosum0x0).

Dillon designed SMBdoor as a Windows kernel driver that once installed on a PC will abuse undocumented APIs in the srvnet.sys process to register itself as a valid handler for SMB (Server Message Block) connections.
The malware is very stealthy, as it doesn't bind to any local sockets, open ports, or hooks into existing functions, and by doing so avoiding triggering alerts for some antivirus systems.
STEALTHY BY DESIGN
"Like DOUBLEPULSAR, this implant hides in an esoteric area of the system," Dillon told ZDNet.
"Listening to network traffic over an already-bound port, without touching any sockets, is not well established in current methodologies and is part of an expanding research area.
Click to expand...

Log in or Sign up

Security researcher creates new backdoor inspired by leaked NSA malware

guest Guest

Log in or Sign up

Security researcher creates new backdoor inspired by leaked NSA malware

guest Guest

Useful Searches