www.zdnet.com
Open in
urlscan Pro
2a04:4e42:4c::666
Public Scan
URL:
https://www.zdnet.com/article/chinese-hacker-group-caught-bypassing-2fa/
Submission: On November 03 via manual from US — Scanned from DE
Submission: On November 03 via manual from US — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="c-smartSearch_form"><input aria-label="Search" placeholder="What are you looking for?" type="search" autocomplete="off" aria-autocomplete="list" aria-activedescendant="" aria-controls="c-searchSmartSearchResults" name="query" value="">
<button type="submit"><span class="search-go">Go</span> <svg>
<use xlink:href="#arrow-thin" aria-hidden="false"></use>
</svg></button></form>Text Content
/> X Trending * iPhone 14 Pro wins with substance over sizzle this year * How to convert your home's old TV cabling into powerful Ethernet lines * I put the Apple Watch Ultra through a Tough Mudder: Here's how it held up * What quiet quitting is really about * Welcome to ZDNET's next chapter * * Best VPN services * Best web hosting * Best electric cars * Best Samsung phone 2022 * The 7 best computers of 2022 * * Innovation * Working from Home * Cloud * Windows 11 * ZDNET Recommends Innovation * See all Innovation * AI & Robotics * Autonomous Vehicles * Computing * Electric Vehicles * Makers * * Metaverse * Open Source * Productivity * Quantum Computing * Smartphones * Social Media * * Services & Software * Space * Wearables * * 5G arrives: Understanding what it means for you * Tech skills: Upgrade your job * Accelerate your tech game Paid Content Home & Office * See all Home & Office * Energy * Home Entertainment * Kitchen & Household * Networking * Smart Home * * Smart Office * Sustainability * Yard & Outdoors * * The New Rules of Work Business * See all Business * Amazon * Apple * Cloud * CXO * Data Centers * * Developer * Digital Transformation * E Commerce * Edge Computing * Enterprise Software * Google * * Internet of Things * Microsoft * SMB * * Software development: Emerging trends and changing roles * Small Business Tech Essentials Finance * See all Finance * Banking * Blockchain * Credit Cards * Taxes * * The Future of Money * Financial Literacy 101 Education * See all Education * Bootcamps * Business & Management * Computers & Tech * MBA * Professional Development * * How to switch careers to tech * How to stand out in a job interview * Mental health in the workplace * Productivity and time management Security * See all Security * VPN * Cyber Threats * Password Manager * Ransomware * * Securing the Cloud tomorrow belongs to those who embrace it today * Asia * Australia * Europe * India * United Kingdom * United States * ZDNET France * ZDNET Germany * ZDNET Korea * ZDNET Japan Go Most Popular * See all topics * Deals * News * Newsletters * Videos * ZDNET Recommends * Trending iPhone 14 Pro wins with substance over sizzle this year How to convert your home's old TV cabling into powerful Ethernet lines I put the Apple Watch Ultra through a Tough Mudder: Here's how it held up What quiet quitting is really about Welcome to ZDNET's next chapter Best VPN services Best web hosting Best electric cars Best Samsung phone 2022 The 7 best computers of 2022 Innovation Working from Home Cloud Windows 11 ZDNET Recommends * Innovation See all Innovation AI & Robotics Autonomous Vehicles Computing Electric Vehicles Makers Metaverse Open Source Productivity Quantum Computing Smartphones Social Media Services & Software Space Wearables 5G arrives: Understanding what it means for you Tech skills: Upgrade your job Accelerate your tech game Paid Content * Home & Office See all Home & Office Energy Home Entertainment Kitchen & Household Networking Smart Home Smart Office Sustainability Yard & Outdoors The New Rules of Work * Business See all Business Amazon Apple Cloud CXO Data Centers Developer Digital Transformation E Commerce Edge Computing Enterprise Software Google Internet of Things Microsoft SMB Software development: Emerging trends and changing roles Small Business Tech Essentials * Finance See all Finance Banking Blockchain Credit Cards Taxes The Future of Money Financial Literacy 101 * Education See all Education Bootcamps Business & Management Computers & Tech MBA Professional Development How to switch careers to tech How to stand out in a job interview Mental health in the workplace Productivity and time management * Security See all Security VPN Cyber Threats Password Manager Ransomware Securing the Cloud * More See all topics Deals News Newsletters Videos ZDNET Recommends Innovation Home Innovation Security CHINESE HACKER GROUP CAUGHT BYPASSING 2FA Chinese state-sponsored group APT20 has been busy hacking government entities and managed service providers. Written by Catalin Cimpanu, Contributor on Dec. 22, 2019 * * * * * MUST READ I took my Pixel 7 Pro and DSLR to the zoo. The results surprised me Read now Security researchers say they found evidence that a Chinese government-linked hacking group has been bypassing two-factor authentication (2FA) in a recent wave of attacks. The attacks have been attributed to a group the cyber-security industry is tracking as APT20, believed to operate on the behest of the Beijing government, Dutch cyber-security firm Fox-IT said in a report published last week. The group's primary targets were government entities and managed service providers (MSPs). The government entities and MSPs were active in fields like aviation, healthcare, finance, insurance, energy, and even something as niche as gambling and physical locks. RECENT APT20 ACTIVITY The Fox-IT report comes to fill in a gap in the group's history. APT20's hacking goes back to 2011, but researchers lost track of the group's operations in 2016-2017, when they changed their mode of operation. Fox-IT's report documents what the group has been doing over the past two years and how they've been doing it. According to researchers, the hackers used web servers as the initial point of entry into a target's systems, with a particular focus on JBoss, an enterprise application platform often found in large corporate and government networks. APT20 used vulnerabilities to gain access to these servers, install web shells, and then spread laterally through a victim's internal systems. While on the inside, Fox-IT said the group dumped passwords and looked for administrator accounts, in order to maximize their access. A primary concern was obtaining VPN credentials, so hackers could escalate access to more secure areas of a victim's infrastructure, or use the VPN accounts as more stable backdoors. Fox-IT said that despite what appears to be a very prodigious hacking activity over the past two years, "overall the actor has been able to stay under the radar." They did so, researchers explain, by using legitimate tools that were already installed on hacked devices, rather than downloading their own custom-built malware, which could have been detected by local security software. APT20 SEEN BYPASSING 2FA But this wasn't the thing that stood out the most in all the attacks the Dutch security firm investigated. Fox-IT analysts said they found evidence the hackers connected to VPN accounts protected by 2FA. How they did it remains unclear; although, the Fox-IT team has their theory. They said APT20 stole an RSA SecurID software token from a hacked system, which the Chinese actor then used on its computers to generate valid one-time codes and bypass 2FA at will. Normally, this wouldn't be possible. To use one of these software tokens, the user would need to connect a physical (hardware) device to their computer. The device and the software token would then generate a valid 2FA code. If the device was missing, the RSA SecureID software would generate an error. Image: Fox-IT The Fox-IT team explains how hackers might have gone around this issue: The software token is generated for a specific system, but of course this system specific value could easily be retrieved by the actor when having access to the system of the victim. As it turns out, the actor does not actually need to go through the trouble of obtaining the victim's system specific value, because this specific value is only checked when importing the SecurID Token Seed, and has no relation to the seed used to generate actual 2-factor tokens. This means the actor can actually simply patch the check which verifies if the imported soft token was generated for this system, and does not need to bother with stealing the system specific value at all. In short, all the actor has to do to make use of the 2 factor authentication codes is to steal an RSA SecurID Software Token and to patch 1 instruction, which results in the generation of valid tokens. Image: Fox-IT WOCAO Fox-IT said it was able to investigate APT20's attacks because they were called in by one of the hacked companies to help investigate and respond to the hacks. More on these attacks can be found in a report named "Operation Wocao." The Dutch company said it named the report "Wocao" after a response the Chinese hackers had after they've been detected and booted out of a victim's network. In the screenshot below, you can view APT20 trying to connect to a (now-removed) web shell they installed on a victim's network. The hackers try running several Windows commands. When the commands fail to execute, APT20 hackers understand they've been detected and thrown out of the network, and they type one last command in frustration -- wocao, which is the Chinese slang for "shit" or "damn." Image: Fox-IT THE WORLD'S MOST FAMOUS AND DANGEROUS APT (STATE-DEVELOPED) MALWARE ◀ SECURITY * How to find and remove spyware from your phone * The best VPN services: How do the top 5 compare? * How to find out if you are involved in a data breach -- and what to do next * The 5 best browsers for privacy: Secure web browsing * How to delete yourself from search results and hide your identity online Editorial standards Show Comments Log In to Comment Community Guidelines RELATED FBI warning: This ransomware group is targeting poorly protected VPN servers FBI WARNING: THIS RANSOMWARE GROUP IS TARGETING POORLY PROTECTED VPN SERVERS Waterproof your device when taking a dunk with these top phone pouches WATERPROOF YOUR DEVICE WHEN TAKING A DUNK WITH THESE TOP PHONE POUCHES The best Mac deals right now: Save $400 on the M1 MacBook Pro THE BEST MAC DEALS RIGHT NOW: SAVE $400 ON THE M1 MACBOOK PRO ZDNET we equip you to harness the power of disruptive innovation, at work and at home. * Topics * Galleries * Videos * Do Not Sell or Share My Personal Information * about ZDNET * Meet The Team * Site Map * Reprint Policy * Join | Log In * Newsletters * Site Assistance * * * * © 2022 ZDNET, A Red Ventures company. All rights reserved. Privacy Policy | Cookie Settings | Advertise | Terms of Use Cookie Settings We use cookies and similar technologies to understand how you use our services, improve your experience and serve you personalized content and advertising. By clicking "Accept All", you accept all cookies. By clicking "Reject All", you reject all cookies except Strictly Necessary cookies. To manage your cookies and learn more about our use of cookies click “Cookie Settings”.Learn more. Cookie Settings Reject All Accept All