Chinese ‘attack US DoD Smart Cards’ with Sykipot Malware

A new strain of the Sykipot malware is being used by Chinese cyber criminals to compromise US Department of Defense (DoD) smart cards, a new report has revealed.

The malware has been designed to take advantage of smart card readers running ActivClient – the client application of ActivIdentity – according to unified security information and event management (SIEM) company AlienVault.

ActivIdentity’s smart cards are standardised at the DoD and a number of other US government agencies. The cards are used to identify active duty military staff, selected reserve personnel, civilian employees, and eligible contractor staff.

As with previous Sykipot strains, the attackers use an email campaign to get specific targets to click on a link and deposit the Sykipot malware onto their machines. After identifying the computers that have card readers, the attackers install keystroke logging software to steal the PIN number that is used in concert with the smart card.

“When a card is inserted into the reader, the malware acts as the authenticated user and can access sensitive information,” explained AlienVault’s lab manager Jaime Blasco. “The malware is then controlled by the attackers and then told what – and when – to steal the appropriate data.”

So far, AlienVault has seen attacks that compromise smart card readers running Windows Native x509 software, which is reportedly in commonplace use amongst a number of US government and allied agencies.

This new strain is thought to have originated from the same Chinese authors that created a version of Sykipot in 2011, which distributed a variety of spam messages claiming to contain information on the next-generation unmanned “drones”, developed by the United States Air Force.

In an investigation into that earlier strain last year, Blasco suggested that the team behind Sykibot was working with an information “shopping list” that included semiconductor, medical and aerospace technology.

In a report released least year, security consultancy Mandiant identified several cases where determined attackers were able to get onto computers or networks that required both smart cards and passwords. Mandiant called this technique a “smart card proxy”.