Getty Images
Researchers have discovered never-before-seen malware that North Korean hackers have been using to surreptitiously read and download emails and attachments from infected users’ Gmail and AOL accounts.
The malware, named SHARPEXT by researchers at security firm Volexity, uses clever means to install a browser extension for Chrome and Edge browsers, Volexity reported in a blog post. Email services cannot detect the extension, and since the browser is already authenticated using any existing multi-factor authentication protection, this increasingly popular security measure has no role in slowing account compromise.
The malware has been in use for “more than a year,” Volexity said, and is the work of a hacking group the company tracks as SharpTongue. The group is sponsored by the North Korean government and overlaps with a group followed like Kimsuky by other researchers. SHARPEXT targets organizations in the US, Europe and South Korea that work on nuclear weapons and other issues that North Korea considers important to its national security.
Volexity president Steven Adair said in an email that the extension is installed “through spear phishing and social engineering where the victim is tricked into opening a malicious document. We’ve previously seen that DPRK threat actors were launching spear phishing attacks where the goal was to get the victim to install a browser extension rather than a post-exploitation mechanism for persistence and theft of data”. In its current incarnation, the malware only works on Windows, but Adair said there’s no reason it can’t be extended to also infect browsers running on macOS or Linux.
announcement
The blog post added: “Volexity’s own visibility shows that the extension has been very successful, as logs obtained by Volexity show that the attacker was able to successfully steal thousands of emails from multiple victims by deploying of the malware.”
Installing a browser extension during a phishing operation without the end user noticing is not easy. The SHARPEXT developers have clearly paid attention to research like the one published here, here and here, which shows how a security mechanism in the Chromium browser engine prevents malware from making changes to sensitive user settings. Every time a legitimate change is made, the browser takes a cryptographic hash of a part of the code. On startup, the browser checks the hashes, and if any of them don’t match, the browser requests that the old configuration be restored.
In order for attackers to bypass this protection, they must first extract the following from the compromised computer:
- A copy of the browser’s resources.pak file (which contains the HMAC seed used by Chrome)
- The user’s S-ID value
- The original Preferences and Secure Preferences files on the user’s system
After modifying the preferences files, SHARPEXT automatically loads the extension and runs a PowerShell script that enables DevTools, a setting that allows the browser to run custom code and settings.
“The script runs in an infinite loop checking the processes associated with the target browsers,” explained Volexity. “If any targeted browsers are found running, the script checks the tab title for a specific keyword (eg ‘05101190’ or ‘Tab+’ depending on the version of SHARPEXT). The specific keyword is inserted in the title by the malicious. extension when an active tab changes or when a page loads.”
announcement
Volexity
The post continued:
The keystrokes sent are equivalent to Control+Shift+J, the shortcut to enable the DevTools panel. Finally, the PowerShell script hides the newly opened DevTools window using the ShowWindow() API and the SW_HIDE flag. At the end of this process, DevTools is enabled in the active tab, but the window is hidden.
Also, this script is used to hide any windows that might alert the victim. Microsoft Edge, for example, periodically displays a warning message to the user (Figure 5) if extensions are running in developer mode. The script constantly checks if this window appears and hides it using ShowWindow() and the SW_HIDE flag.
Volexity
Once installed, the extension can perform the following requests:
Data HTTP POST Description mode=list List previously collected emails from the victim to ensure no duplicates are uploaded. This list is continuously updated as SHARPEXT runs. mode=domain Lists email domains the victim has previously communicated with. This list is continuously updated as SHARPEXT runs. mode=black Collects a blacklist of email senders that should be ignored when collecting victim emails. mode=newD&d=[data]
Add a domain to the list of all domains seen by the victim. mode=attach&name=[data]&idx=[data]&body=[data]
Upload a new attachment to the remote server. mode=new&mid=[data]&mbody=[data]
Upload Gmail data to the remote server. mode=attlist Commented by attacker; receive a list of attachments to be exfiltrated. mode=new_aol&mid=[data]&mbody=[data]
Upload the AOL data to the remote server.
SHARPEXT allows hackers to create lists of email addresses to ignore and track email or attachments that have already been stolen.
Volexity created the following summary of the orchestration of the various SHARPEXT components it analyzed:
Volexity
The blog post provides images, file names and other indicators that trained individuals can use to determine if they have been attacked or infected by this malware. The company warned that the threat it poses has grown over time and is not likely to go away anytime soon.
“When Volexity found SHARPEXT, it appeared to be an early development tool that contained numerous bugs, an indication that the tool was immature,” the company said. “The latest updates and ongoing maintenance demonstrate that the attacker is achieving its goals, finding value in continuing to refine it.”