Chinese Hackers' Ten-Year Espionage Operation: A Deep Dive into Operation Highland
The recent discovery of a decade-long espionage campaign, dubbed 'Operation Highland', has shed light on the sophisticated tactics employed by Chinese hackers. This article delves into the intricate details of the attack, the vulnerabilities exploited, and the implications for global cybersecurity.
The Intrusion and Its Duration
Operation Highland, attributed to the Velvet Ant cyberespionage group, showcases the hackers' ability to maintain persistence and full visibility into a target organization's administrative activities for over a decade. This extended duration highlights the complexity and resourcefulness of the attack.
Targeting Vulnerable Systems
The campaign began in 2016 by targeting vulnerable internet-facing systems, a common initial step for many cyberattacks. However, what sets Operation Highland apart is the subsequent pivot to an 'air-gapped' environment, a network isolated from the internet, demonstrating the hackers' adaptability.
Establishing Persistence and Remote Access
Velvet Ant's tactics are intricate. They deployed a modified GS-Netcat reverse shell, disguised as a legitimate system component, to establish encrypted remote shell access. This shell achieved persistence through a malicious systemd service or startup script modification, ensuring their presence even after potential password changes.
The hackers then installed a custom SOCKS5 proxy, masquerading as 'smbd -D', to tunnel network traffic and reach internal systems. This proxy was a key enabler for their internal pivoting.
Building a Remote Execution Path
One of the most intriguing aspects of the attack was the establishment of a remote execution path into the isolated network. Velvet Ant modified an Nginx server to proxy requests to a compromised backend server, which then forwarded them to a FastCGI process. This process launched a custom binary, 'uptime', and established SSH connections to internal systems using HTTP POST requests.
This chain of modifications created a remote execution path without requiring direct access to the critical infrastructure network, showcasing the hackers' ingenuity.
Modifying Authentication Components
To ensure long-term persistence, Velvet Ant targeted Linux Pluggable Authentication Modules (PAM). They replaced legitimate PAM modules with backdoored versions that accepted hardcoded passwords and harvested user credentials. This modification granted them access to credentials as they were used in the target environment, bypassing the authentication flow.
Impact and Cleanup Challenges
The impact of this operation was profound. Administrative activity became fully observable, with every login and command executed across compromised hosts. The hackers' ability to embed access within the authentication process reduced the effectiveness of conventional containment measures.
The cleanup process was complex. Sygnia researchers had to carefully replace critical components, ensuring the authentication process remained intact. They built a testing lab, profiled hosts, and prepared rollback procedures to minimize the risk of breaking authentication and causing operational outages.
Recommendations for Defenders
Sygnia emphasizes the importance of treating authentication components like PAM, OpenSSH, and Windows LSASS as critical security assets. They recommend implementing measures such as EDR, file integrity monitoring, hardened privileged access, multi-factor authentication (MFA), and continuous monitoring for unauthorized modifications.
Offline recovery planning is crucial, including strict backup schedules and immutable snapshot creation. Testing backups and recovery scripts is essential to ensure a smooth restoration process.
Conclusion: A Call to Action
Operation Highland serves as a stark reminder of the evolving nature of cyber threats. The attack's duration, complexity, and impact emphasize the need for proactive cybersecurity measures. Organizations must stay vigilant, adapt to new attack vectors, and prioritize authentication security to prevent such sophisticated espionage campaigns.
