Software Supply-Chain Attack Hits Vietnam Government Certification Authority

guest · Dec 17, 2020

Software Supply-Chain Attack Hits Vietnam Government Certification Authority
December 17, 2020
https://thehackernews.com/2020/12/software-supply-chain-attack-hits.html

Cybersecurity researchers today disclosed a new supply-chain attack targeting the Vietnam Government Certification Authority (VGCA) that compromised the agency's digital signature toolkit to install a backdoor on victim systems.

Uncovered by Slovak internet security company ESET early this month, the "SignSight" attack involved modifying software installers hosted on the CA's website ("ca.gov.vn") to insert a spyware tool called PhantomNet or Smanager.
Click to expand...

According to ESET's telemetry, the breach happened from at least July 23 to August 16, 2020, with the two installers in question — "gca01-client-v2-x32-8.3.msi" and "gca01-client-v2-x64-8.3.msi" for 32-bit and 64-bit Windows systems — tampered to include the backdoor.

"The compromise of a certification authority website is a good opportunity for APT groups, since visitors are likely to have a high level of trust in a state organization responsible for digital signatures," ESET's Matthieu Faou said.
Click to expand...

The digital signature tool, mandated by Vietnam's Government Cipher Committee as part of an electronic authentication scheme, is used by the government sector as well as private companies to digitally sign documents using a USB token (also called a PKI token) that stores the digital signature and requires the aforementioned driver to operate.
Click to expand...

ESET: Operation SignSight: Supply‑chain attack against a certification authority in Southeast Asia

ESET researchers have uncovered a supply-chain attack on the website of a government in Southeast Asia
The attackers modified two of the software installers available for download on this website and added a backdoor in order to compromise users of the legitimate application.

ESET researchers uncovered this new supply-chain attack in early December 2020 and notified the compromised organization and the VNCERT.
Click to expand...

Once downloaded and executed, the installer starts the genuine GCA program and the malicious file. The malicious file is written to C:\Program Files\VGCA\Authentication\SAC\x32\eToken.exe. By also installing the legitimate program, the attackers make sure that this compromise won’t be easily noticed by the end-users.
Click to expand...

Log in or Sign up

Software Supply-Chain Attack Hits Vietnam Government Certification Authority

guest Guest

Log in or Sign up

Software Supply-Chain Attack Hits Vietnam Government Certification Authority

guest Guest

Useful Searches