Hackers use Dropbox, WordPress to spread malware

The Chinese cyberspies behind the widely publicized espionage campaign against The New York Times have added Dropbox and WordPress to their bag of spear-phishing tricks.

The gang, known in security circles as the DNSCalc gang, has been using the Dropbox file-sharing service for roughly the last 12 months as a mechanism for spreading malware, said Rich Barger, chief intelligence officer for Cyber Squared. While the tactic is not unique, it remains under the radar of most companies.

"I wouldn't say it's new," Barger said on Thursday. "It's just something that folks aren't really looking at or paying attention to."

The gang is among 20 Chinese groups identified this year by security firm Mandiant that launch cyberattacks against specific targets to steal information. In this case, the DNSCalc gang was going after intelligence on individuals or governments connected to the Association of Southeast Asian Nations. ASEAN is a non-governmental group that represents the economic interests of ten Southeast Asian countries.

The attackers did not exploit any vulnerabilities in Dropbox or WordPress. Instead, they opened up accounts and used the services as their infrastructure.

The gang uploaded on Dropbox a .ZIP file disguised as belonging to the U.S.-ASEAN Business Council. Messages were then sent to people or agencies that would be interested in the draft of a Council policy paper. The paper, contained in the file, was legitimate, Barger said.

When a recipient unzipped the file, they saw another one that read, "2013 US-ASEAN Business Council Statement of Priorities in the US-ASEAN Commercial Relationship Policy Paper.scr." Clicking on the file would launch a PDF of the document, while the malware opened a backdoor to the host computer in the background.

Once the door was open, the malware would reach out to a WordPress blog created by the attackers. The blog contained the IP address and port number of a command and control server that the malware would contact to download additional software.

Dropbox is a desirable launchpad for attacks because employees of many companies use the service. "People trust Dropbox," Barger said.

For companies that have the service on its whitelist, malware moving from Dropbox won't be detected by a company's intrusion prevention systems. Also, communications to a WordPress blog would likely go undetected, since it would not be unusual behavior for any employee with access to the Internet.

In general, no single technology can prevent such an attack. "There's no silver bullet here," Barger said.

The best prevention is for security pros to share information when their companies are targeted, so others can draw up their own defense, he said.

In The New York Times attack, the hackers penetrated the newspaper's systems in September 2012 and worked undercover for four months before they were detected.

The attack coincided with an investigative piece the newspaper published on business dealings that reaped several billion dollars for the relatives of Wen Jiabao, China's prime minister.

Reddit, Mozilla, WordPress, and others plan July 4 protest against NSA surveillance

A large coalition of civil rights and privacy groups and potentially thousands of websites will stage protests on the Fourth of July to protest surveillance programs at the U.S. National Security Agency.

As part of the Restore the Fourth campaign, many website members of the 30,000-member Internet Defense League plan to display a protest of NSA surveillance and the text of the Fourth Amendment to the U.S. Constitution.

Websites participating include Reddit, where Restore the Fourth originated, WordPress, 4chan, Mozilla, Fark, and Cheezburger.com.

Organizers of Restore the Fourth are also planning live protests in dozens of U.S. cities, including New York, Philadelphia, Los Angeles, Boston, Washington, D.C., San Francisco, Houston and Atlanta.

"How long do we expect rational people to accept using terrorism to justify and excuse endless executive and state power?" actor John Cusack said during a press conference announcing the protests. "Why are so many in our government, our press, our intellectual class afraid of an informed public?"

Representatives of the NSA and the U.S. Office of Director of National Intelligence didn't immediately respond to requests for comments on the planned protests.

The protests come after former NSA contractor Edward Snowden leaked information about widespread NSA surveillance of U.S. residents and other people to media outlets, with the first details published last month. Snowden, said to be holed up in a Russian airport, is seeking political asylum in several countries. He faces charges in the U.S. of theft of government property, unauthorized communication of national defense information and willful communication of classified communications intelligence information to an unauthorized person.

StopWatching.us, a website set up three weeks ago, has collected more than 531,000 signatures of people opposing the NSA surveillance programs.

Cusack, a board member of the Freedom of the Press Foundation, complained that many defenders of the NSA surveillance programs are focusing on supposed character flaws of Snowden and the journalists who broke the story instead of on the surveillance itself and questions about its legality.

The spotlight on Snowden is a "big distraction to avoid focusing on the invasions that have actually been occurring," added Harvey Anderson, senior vice president business and legal affairs at Mozilla. The lack of transparency about the surveillance programs "undermines the openness of the Internet," he added.

Efforts to downplay the surveillance and suggest that the U.S. public doesn't care won't work, added Craig Aaron, president and CEO of digital rights group Free Press. "As we learn every week about the unchecked surveillance and corporate collusion, the outcry is only going to grow louder and louder," he said.