Hammertoss -Hackers combine coded photos and Twitter to hit their target – A cybersecurity firm has discovered a piece of malware that uses Twitter, the coding site Github and online photos to attack computers.
FireEye said the suspicious tool, called Hammertoss, was likely created by a Russian group.
It creates Twitter accounts that tweet a web address and post a hashtag indicating the location and size of the image.
The hidden instructions in the photo, which is stored on Github, have the ability to steal data from a machine. In some cases, the commands, which are encrypted using a technique called steganography, instruct Hammertoss to upload information from the victim's affected network to cloud storage service accounts.
What is steganography?
It is a technique that involves small changes to the values used to define the color of a pixel.
In a 24-bit image, each pixel has a color defined by three numbers – one for red, one for green, and one for blue.
A tiny change in each pixel will modify its color but not so much that it becomes detectable by the human eye. However, with the right software, or a reference image, the changes will be visible.
These changes can be built up into number (Ascii) codes that define specific letters, and thus ultimately create a message.
Because the attack involves several different pieces, it is much more difficult to avoid detection, or to be blocked by anti-virus software.
FireEye calls the group APT29, and suspects it is of Russian origin due to its targets and the data it steals, as well as the hours it strikes, and the fact that it stopped during a Russian holiday.
Strategic analysis manager Jen Weedon said it is difficult to combat and protect against this malware.
“Hammertoss really challenges the ability of defenders to detect and differentiate the malware’s command and control communications ,” he said, among other things. “Furthermore, there is no attacker infrastructure to block it, so detecting this malware requires a powerful combination of people, technology, and the right intelligence to hunt down, expose, and neutralize such a sophisticated tool.”
