Heavy disclosure! Hundreds of important information systems have been invaded, and the host has become a key attack target

28 Japan , The National Computer Virus Emergency Response Center disclosed that the national security agency （NSA） It belongs to another network attack weapon “ Sour Fox ” Vulnerability attack weapon platform （ hereinafter referred to as “ Sour Fox platform ”）,

The key targets are China and Russia , The standard configuration program used by the platform by default “ Validator ” The back door of the Trojan , It has been found in hundreds of important information systems in China , Including many scientific research institutions .

Its implantation time is far earlier than “ Sour Fox platform ” Time of public exposure ,

It shows that at least hundreds of important domestic information systems have been attacked .

“ Sour Fox platform ” Set up a dedicated server  , China has become a key target

According to the introduction ,“ Sour Fox platform ” yes NSA Specific intrusion Operations Office （TAO） An important position infrastructure for conducting cyber espionage operations against other countries , Now it has become a computer network intrusion action team （CNE） Our main equipment . Pictured 1 Shown ,

TAO Set a dedicated “ Sour Fox platform ” The server , The number is FOX00-6401.

chart 1：FA Server distribution and task usage classification

“ Sour Fox platform ” yes  NSA  Designed a powerful  0Day  Vulnerability attack platform ,

The platform is mainly used to break through the host system located in the target office intranet , And implant various Trojans into it 、 Back door, etc. to achieve persistent control .

The main steps of the attack are as follows ：

1、 Detect the software and hardware environment of the target host and find exploitable vulnerabilities .

2、 implant “ Validator ” Trojan back door for initial attack , Execute uploading and downloading files 、 Execution procedure 、 Get system information 、 change  ID  And simple functions like self destruction .

3、 Implant more complex Trojan horse programs , such as “ Combined rake ” Rear door system , Launch more complex network attacks to infiltrate and steal important information .

according to “ Sour Fox platform ” Filter rule fragments on the server ,

It can be judged that the server mainly attacks Chinese host targets .

Pictured 2 Shown , The filter focuses on matching the process of anti-virus software popular in China , And the implantable condition is judged .

chart 2：“ Sour Fox platform ” Filter rule fragments on the server

The host has become the target of public criticism , Safety construction is urgent

The spokesman of the Ministry of foreign affairs once pointed out that China is about 531 Ten thousand hosts are controlled by overseas servers .

meanwhile , There are reports , The United States has carried out a large-scale 、 Long-term 、 Systematic cyber attacks , Seriously endangering the safety of China's key infrastructure ,

The government 、 Finance 、 Scientific research institutes 、 Operator, 、 education 、 military 、 Aerospace 、 Medical and other industries , Important sensitive units and organizations have become the main targets .

Militarization of cyberspace 、 The popularization of cyber weapons 、 The normalization of network attacks is becoming increasingly obvious , Critical infrastructure has become a major area of cyber attacks . And the host as IT Core components of infrastructure , It runs a variety of business data , The service value is huge . However, due to various vulnerabilities and security problems on the host , Therefore, it has become the favorite attack target of hackers . therefore ,

With host security as the core IT Safe construction of key infrastructure , At present, there is no time to delay .