Security researchers recently identified an elite team of possibly state-sponsored hackers that infiltrate hotel Wi-Fi networks to gain access to the computers of high-level executives and leaders, probably to steal nuclear secrets. They're calling this band of cyber-spies DarkHotel.
Wired's Kim Zetter recently published a report about Kaspersky Labs and its efforts to track down the hacker group and one of the most unnerving things about DarkHotel is how insanely talented the hackers are. While the security researchers have managed to identify the group's tactics and trace some of its members back to South Korea, they're still not entirely sure who these hackers are and why they're doing what they're doing.
"[The primary targets are] all nuclear nations in Asia," Kaspersky's Costin Raiu told Wired. "Their targeting is nuclear themed, but they also target the defence industry base in the U.S. and important executives from around the world in all sectors having to do with economic development and investments."
What's maybe most alarming out of all of this, is actually how DarkHotel operates. The attacks have been going on for at least seven years and are highly targeted. It appears that the hackers know exactly when specific executives and leaders will be staying in specific hotels and then install the malware — anything from simple Trojans to sophisticated kernal-mode key loggers — right before they arrive. Sometimes they install backdoors on the targets' computer, so that they can break back in at a later date. After the attack is complete and the guest checks out, DarkHotel covers its tracks — very well.
And that's not all. The trap is set so well, almost anyone would get caught. Zetter explains:
When victims attempt to connect to the WiFi network, they get a pop-up alert telling them their Adobe Flash player needs an update and offering them a file, digitally signed to make it look authentic, to download. If the victims accept they download, they get a Trojan delivered instead. Crucially, the alerts pop up before guests actually get onto the WiFi network, so even if they abandon their plan to get online, they are infected the moment they hit "accept."
This is not some obscure exploit that requires users to jump through seven weird hoops before exposing themselves. It's also not your typical, easy-to-spot phishing campaign that only idiots would fall for. These hackers have figured out a way to attack computers before they even join the Wi-Fi network! And remember: the targets are hotel guests who surely believe they can trust the official hotel Wi-Fi.
It's a terrific reminder that you should always be suspicious of third-party Wi-Fi vendors and never download an update you're not expecting — especially if you're on a third-party Wi-Fi network when it prompts you. It's also reminder of just how sophisticated cyber warfare is becoming. DarkHotel is a start reminder that the future of cyber warfare will be invisible and unexpected, with tech that will surely leak out to workaday criminals and thieves. So watch your clicks, citizens. You never know who might be after you. [Wired]