Schneier on Security

Clive Robinson • March 10, 2025 11:34 AM

@ Bruce, ALL,

With regards the “c/side” article intro and,

“Creating four backdoors facilitates the attackers having multiple points of re-entry should one be detected and removed. A unique case we haven’t seen before.“

It raises an interesting set of thoughts…

Firstly, whilst this is not the first case of multiple attack code entry points being put into target systems, in the past even “State Sponsored APT” did not put in four.

This implies that who ever was behind it thought they would need them for some reason.

Which Secondly raises the question as to “Why so many?”

The three obvious answers are,

1, They wanted to maintain entrance over a considerable period of time.
2, They thought getting another exploit to get in would be difficult.
3, Creating a covert backdoor is usually a lot simpler than finding a vulnerability.

The last point there also applies to a group with “multiple skill sets”, which is why “State Sponsored” APT would be many peoples attribution assumption.

However it gives another potential answer,

4, They wanted to appear as different attackers.

That point might also be because they wanted to “rent the backdoors out” to multiple untrusted clients.

Or they wanted to act as multiple unrelated attackers.

Unfortunately there is no further information given to work from

However the second article from “thehackernews” likewise gives no further information, but… Then starts talking about a second attack in a way that might make people think the two separate attacks were the same or strongly related.

The second attack is used to,

‘”fully hijacks the user’s browser window” to redirect site visitors to Chinese-language gambling platforms.’

If the two are in fact related this would suggest the level of attacker is “higher up the experience scale” and have a “campaign” they want to keep around a while.

If that is the case and they are of a higher level, it means that they very probably have a lot more than four APT backdoors they have developed and are in effect “keeping their powder dry” on the others.

That is as one backdoor gets nixed they can still get in and install a new to defenders backdoor to replace it.

But the question that came to my mind first was,

“Why has it taken so long for State Sponsored APT style activities to be taken up in the more general criminal class?”

One implication would be that criminal attackers did not feel they needed to have multiple entry routes to individual targets. Either because it was a “target rich environment” with an expected large numbers of easy to exploit vulnerabilities. The number of “easy targets” was so high going after the same person multiple times had no real advantage.

I guess that now this multiple entry point notion is out there, and compared to exploiting code vulnerabilities, adding covert back doors is easier we will see a lot more of it in future as the gap between Criminal and State blurs further.

Clive Robinson • March 10, 2025 6:35 PM

@ m7drc, ALL,

Your comment of,

“It seems like these types of attacks would fail if people used proper access control methods (e.g. SELinux, AppArmor), especially for the ssh backdoor. Other intrusion detection measures (e.g. tripwire, snort, fail2ban) should also be used to detect unauthorized changes, especially when they occur outside expected update windows.”

Sorry but that is the wrong way to look at it.

What you are saying is,

1, Enlarge the attack surface.
2, Increase the complexity
3, Add increasing ambiguity

Etc, etc, etc.

At what point do you stop shoveling stuff on?

The correct response is,

1, How do you reduce the attack surface?
2, How do you decrease the complexity?
3, How do you remove the ambiguity?

Etc, etc, etc.

When the suggested solution makes the problem worse and in this case it does, you really need to look at solutions that make things simpler to manage and run whilst importantly reducing needless resource issues.

What this tells us is two things,

1, The application is not fit for purpose.
2, Likewise the environment the application executes in is not fit to be put on the market.

Thus the priority is not to make problems worse by adding attack surface, complexity and ambiguity, but clean up the application and the environment so they are “fit for” both “purpose” and “market”.

The fact that the industry wants to go the other way, should tell you something…

Which is as currently set up the industry it’s self is “Not Fit” and should be legislated and regulated untill it is as is done in nearly every other consumer and common commercial market.