TY - GEN
T1 - USBCulprit
T2 - 2021 European Interdisciplinary Cybersecurity Conference, EICC 2021
AU - Guri, Mordechai
N1 - Publisher Copyright:
© 2021 ACM.
PY - 2021/11/10
Y1 - 2021/11/10
N2 - Air-gapped networks are disconnected from the Internet due to the sensitive data they store and process. These networks are usually maintained by military organizations, defense industries, critical infrastructures, and more. Malware that is capable of jumping air-gaps is rare findings. In June 2020, researchers in Kaspersky security firm reported USBCulprit, an Advanced Persistent Threat (APT) which seems to be designed to reach air-gapped networks. The malware includes lateral movement, spreading, and data exfiltrations mechanisms via USB thumb drives. We tested and reverse-engineered the sample of USBCulprit, and investigated its internal design, modules, and techniques. Especially, we revised the data collection and air-gap exfiltration mechanisms. We also present a video clip showing the actual attack on our in-lab air-gapped network and discuss a set of defensive countermeasures. This analysis in important for the understanding and mitigation of USB-borne APTs.
AB - Air-gapped networks are disconnected from the Internet due to the sensitive data they store and process. These networks are usually maintained by military organizations, defense industries, critical infrastructures, and more. Malware that is capable of jumping air-gaps is rare findings. In June 2020, researchers in Kaspersky security firm reported USBCulprit, an Advanced Persistent Threat (APT) which seems to be designed to reach air-gapped networks. The malware includes lateral movement, spreading, and data exfiltrations mechanisms via USB thumb drives. We tested and reverse-engineered the sample of USBCulprit, and investigated its internal design, modules, and techniques. Especially, we revised the data collection and air-gap exfiltration mechanisms. We also present a video clip showing the actual attack on our in-lab air-gapped network and discuss a set of defensive countermeasures. This analysis in important for the understanding and mitigation of USB-borne APTs.
KW - APT
KW - Air-gap
KW - Covert channels
KW - Malware
KW - USB
KW - exfiltration
UR - https://www.scopus.com/pages/publications/85120520741
U2 - 10.1145/3487405.3487412
DO - 10.1145/3487405.3487412
M3 - Conference contribution
AN - SCOPUS:85120520741
T3 - ACM International Conference Proceeding Series
SP - 7
EP - 13
BT - Proceedings of the 2021 European Interdisciplinary Cybersecurity Conference, EICC 2021
PB - Association for Computing Machinery
Y2 - 10 November 2021 through 11 November 2021
ER -