Our aim is to convince the reader of the importance of having all the proper defense mechanisms to mitigate the techniques used by virtually all of these frameworks that have been observed in the wild, before starting to look into the many theoretical air gap bypass techniques that have received a lot of attention in recent years despite none of them ever being used in a real, publicly disclosed attack. Armed with this information, we will highlight some detection opportunities specific to the actual techniques observed in the wild. This also resulted in a systematic analysis structure that may be reused to document air-gapped malware that is discovered in the future.ĭespite some differences and nuances found across all frameworks studied, our analysis shows how most differ on many of those aspects only from an implementation perspective, mostly due to the severe constraints imposed by air-gapped environments. Specifically, we focused our attention on the malware execution mechanisms used on both the connected and the air-gapped side of targeted networks and the malware functionalities within the air-gapped network (persistence, reconnaissance, propagation, espionage, and – at least in one case – sabotage activities), with a focus on the communication and exfiltration channels used to cross the air-gap barrier and control the components running on the isolated networks. This exhaustive study allowed us to isolate several major similarities in all of these frameworks, even those produced 15 years apart. Using the knowledge made public by more than 10 different organizations over the years, and some ad hoc analysis to clarify or confirm some technical details, we put the frameworks in perspective to see what history could teach us in order to improve air-gapped network security and our abilities to detect and mitigate future attacks.
Jumping the air gap: 15 years of nation-state effort
#Air gapped network series
We also propose a series of detection and mitigation techniques to protect air-gapped networks from the main techniques used by all the malicious frameworks publicly known to date. In our white paper, linked below, we describe how malware frameworks targeting air-gapped networks operate, and we provide a side-by-side comparison of their most important TTPs. We have not found any evidence of actual or suspected malware components built to target other operating systems.
#Air gapped network windows
#Air gapped network code
All the frameworks are designed to perform some form of espionage.ESET Research decided to revisit each framework known to date and to put them in perspective, side by side. In the first half of 2020 alone, four previously unknown malicious frameworks designed to breach air-gapped networks emerged, bringing the total, by our count, to 17. ESET researchers studied all the malicious frameworks ever reported publicly that have been used to attack air-gapped networks and are releasing a side-by-side comparison of their most important TTPsĪir-gapping is used to protect the most sensitive of networks.
0 kommentar(er)
