BRATISLAVA – ESET researchers have discovered and analyzed malware that targets Voice over IP (VoIP) softswitches. This new malware, named CDRThief by ESET, is designed to target a very specific VoIP platform used by two China-made softswitches (software switches): Linknat VOS2009 and VOS3000. A softswitch is a core element of a VoIP network that provides call control, billing, and management. These softswitches are software-based solutions that run on standard Linux servers. Entirely new Linux malware is rarely seen, thus making CDRThief worthy of interest. The primary goal of the malware is to exfiltrate various private data, including call detail records (CDR), from a compromised softswitch.

“It’s hard to know the ultimate goal of attackers who use this malware. However, since it exfiltrates sensitive information, including call metadata, it seems reasonable to assume that the malware is used for cyberespionage. Another possible goal for attackers using this malware is VoIP fraud. Since the attackers obtain information about the activity of VoIP softswitches and their gateways, this information could be used to perform International Revenue Share Fraud,” says ESET researcher Anton Cherepanov, who discovered CDRThief. “CDRs contain metadata about VoIP calls such as caller and IP addresses of call recipients, starting time of the call, call duration, call fees, and other information,” he adds.

To steal this metadata, the malware queries internal MySQL databases used by the softswitch. Thus, attackers demonstrate a solid understanding of the internal architecture of the targeted platform.

“We noticed this malware in one of our sample sharing feeds, and as an entirely new Linux malware, it’s a rarity and caught our attention. What was even more interesting was that it quickly became apparent that this malware targeted a specific Linux VoIP platform,” explains Cherepanov.

To hide malicious functionality from basic static analysis, the authors encrypted any suspicious-looking strings. Interestingly, the password from the configuration file is stored encrypted. Despite this, Linux/CDRThief malware is still able to read and decrypt it. Thus, the attackers demonstrate deep knowledge of the targeted platform, since the algorithm and encryption keys used are not documented. Furthermore, only the malware authors or operators can decrypt any exfiltrated data.

“The malware can be deployed to any location on the disk under any file name. It’s unknown what type of persistence is used for starting the malware. However, it should be noted that once the malware is started, it attempts to launch a legitimate file present on the Linknat platform. This suggests that the malicious binary might somehow be inserted into a regular boot chain of the platform in order to achieve persistence and possibly masquerade as a component of the Linknat softswitch software,” concludes Cherepanov.

For more technical details about CDRThief, read the blog post “Who is calling? CDRThief targets Linux VoIP softswitches” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

Bratislava –  The 2020 back to school season will be unlike any other — whether you’re heading back to school physically or virtually, it is essential that students, teachers and administrators alike are protected against online threats.

COVID-19 has dramatically altered the education experience for the foreseeable future, both for school-age children and university students. For many, virtual classrooms replaced physical ones overnight, turning living rooms into classrooms and disrupting technological systems already in place.

With students relying on home devices and networks often shared by multiple users, it has never been more important to secure your networks and personal and professional data. As virtual schooling becomes more commonplace, a longer-term concern for educators and students alike is how to maintain online privacy and data protection as personal information, such as grades and behavioral reports, need to be shared. For those returning to the physical classroom, abiding by hygienic and social distancing guidelines will be critical, and teachers can focus on the physical safety of their students once they know their online experience is secured.

ESET Internet Security offers advanced protection from hackers, scams and malware, and is a multi-layered security system that protects you against all types of online and offline threats. Key features include:

Multiplatform protection – Secure all your devices with a single license. No matter whether you run on a Mac, Windows, Android or Linux, we’ve got you covered!

Keep your privacy protected – Prevent unauthorized access to your computer and misuse of your data. Stay safe while making online payments – Our product automatically protects your internet banking and offers a special secured browser through which you can safely pay online and access web-based crypto wallets.

Anti-theft features – Stay safer by tracking and locating your missing computer in case it gets lost or stolen, and identify thieves via your laptop’s built-in camera.

Enjoy safer connections – Protect your webcam and home router from intruders. Test your passwords, and scan your smart devices for vulnerabilities.

ESET Consumer & IoT Segment Director, Mária Trnková, commented, “So many aspects of life have changed dramatically over the course of the year, and education is no exception. The pandemic has transformed the teaching and learning experience for many across the globe, and the last thing anyone needs is to deal with a cybersecurity breach. We are proud to support educators and students with cutting-edge technology to ensure that all users are safe and secure this back to school season.”

Click here to find out more information about ESET Internet Security.

BRATISLAVA – August 19, 2020 – ESET, a global leader in cybersecurity, has been highly commended in the KuppingerCole Market Compass 2020 report. The report analyzed ESET’s Endpoint Protection, Detection and Response solutions, including ESET Endpoint Security and ESET Enterprise Inspector, praising ESET for its universal coverage.

KuppingerCole Analysts is an international and independent analyst organization that supports companies, corporate users, integrators and software manufacturers in meeting both tactical and strategic challenges. The Market Compass provides an overview of a market segment and the vendors in the Endpoint Protection, Detection & Response (EPDR) market. It covers the trends that are influencing this market segment and the essential capabilities required of solutions in this space and provides ratings on how well the solutions meet expectations. 

ESET achieved high scores across all categories, achieving the third highest number of strong positives out of a total 17 vendors, with top scores in six out of nine criteria and the rest being evaluated as positive. KuppingerCole assesses vendor solutions on nine key criteria – Security, Interoperability, Usability, Deployment, Malware Protection, Threat Hunting, Automated Responses, Secondary EPP and Common Functions – with strong positive as the highest possible rating.  

In addition to broad support for a variety of operating systems, KuppingerCole cites ESET’s rare technical capability of being able to scan the Unified Extensible Firmware Interface (UEFI) as a core strength. ESET is further commended for its complete suite of detection and protection techniques, and excellent implementation of multiple, advanced ML algorithms for discovering malicious activity patterns. As one of the very few vendors on the market, ESET leverages Windows AMSI, and provides a Script Scanner, Advanced Memory Scanner and Ransomware Shield. The report also highlights ESET’s contribution to mapping the MITRE ATT&CK framework in order to facilitate analysis of malicious actors. KuppingerCole also commend ESET Enterprise Inspector’s support of interactive live querying and memory analysis with automated response options like network isolation of suspect nodes, process termination, moving/deleting files and running scripts.  

ESET Enterprise Inspector, ESET’s own proprietary solution for targeted attacks and advanced persistent threats, was previously evaluated in the KuppingerCole Executive View Report 2020. The report highlights ESET’s practice of publishing threat intelligence discoveries for the benefit of the community, and the additional detailed security analysis and threat research gained from ESET’s powerful cloud-based reputation system, the global LiveGrid®. ESET Enterprise Inspector can also generate attribution theories with high confidence levels, with customers having flexibility in creating rules for detection thresholds and alerting, filtering out certain conditions that may occur so as to reduce false positives, or customers themselves can design rules for assignment of attributes and even edit event attributes during investigations.  

Ignacio Sbampato, Chief Business Officer at ESET, commented, “At ESET, we are dedicated to providing cutting-edge security solutions for businesses, and we are proud to be continually recognized by expert analysts for our advanced software solutions. The digital threat landscape is constantly evolving and adapting, and it is vital that organizations and their systems are adequately protected. Reports such as the KuppingerCole Market Compass are vital in holding us accountable to the high standards we set for our solutions, and our dedication to keeping enterprises and their data safe and secure around the world.”

To find out more about ESET’s Endpoint Detection and Response solution, click here.