{"id":1573,"date":"2025-01-28T05:04:46","date_gmt":"2025-01-28T05:04:46","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/01\/28\/new-vpn-backdoor-html\/"},"modified":"2025-01-28T05:04:46","modified_gmt":"2025-01-28T05:04:46","slug":"new-vpn-backdoor-html","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/01\/28\/new-vpn-backdoor-html\/","title":{"rendered":"New VPN Backdoor"},"content":{"rendered":"\n<div>New VPN Backdoor<\/div>\n<p> \t<BR><br \/>\n<BR><\/BR><br \/>\n    <!-- no image --><br \/>\n \t<BR><br \/>\n<BR><\/BR><\/p>\n<div>\n<p>A newly discovered <a href=\"https:\/\/arstechnica.com\/security\/2025\/01\/backdoor-infecting-vpns-used-magic-packets-for-stealth-and-security\/\">VPN backdoor<\/a> uses some interesting tactics to avoid detection:<\/p>\n<blockquote>\n<p>When threat actors use backdoor malware to gain access to a network, they want to make sure all their hard work can\u2019t be leveraged by competing groups or detected by defenders. One countermeasure is to equip the backdoor with a passive agent that remains dormant until it receives what\u2019s known in the business as a \u201cmagic packet.\u201d On Thursday, researchers revealed that a never-before-seen backdoor that quietly took hold of dozens of enterprise VPNs running Juniper Network\u2019s Junos OS has been doing just that.<\/p>\n<p>J-Magic, the tracking name for the backdoor, goes one step further to prevent unauthorized access. After receiving a magic packet hidden in the normal flow of TCP traffic, it relays a challenge to the device that sent it. The challenge comes in the form of a string of text that\u2019s encrypted using the public portion of an RSA key. The initiating party must then respond with the corresponding plaintext, proving it has access to the secret key.<\/p>\n<p>The lightweight backdoor is also notable because it resided only in memory, a trait that makes detection harder for defenders. The combination prompted researchers at Lumin Technology\u2019s Black Lotus Lab to sit up and take notice.<\/p>\n<p>[\u2026]<\/p>\n<p>The researchers found J-Magic on <a href=\"https:\/\/www.virustotal.com\/gui\/home\/upload\">VirusTotal<\/a> and determined that it had run inside the networks of 36 organizations. They still don\u2019t know how the backdoor got installed.<\/p>\n<\/blockquote>\n<p>Slashdot <a href=\"https:\/\/tech.slashdot.org\/story\/25\/01\/24\/0039249\/backdoor-infecting-vpns-used-magic-packets-for-stealth-and-security\">thread<\/a>.<\/p>\n<\/div>\n<p> \t<BR><br \/>\n <BR><\/BR><br \/>\n    Bruce Schneier<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n<a href=\"https:\/\/www.schneier.com\/blog\/archives\/2025\/01\/new-vpn-backdoor.html\">Go to bruce schneier<\/a><br \/>\n \t<BR><br \/>\n <BR><\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"<p>New VPN Backdoor A newly discovered VPN backdoor uses some interesting tactics to avoid detection: When threat actors use backdoor malware to gain access to a network, they want to make sure all their hard work can\u2019t be leveraged by competing groups or detected by defenders. One countermeasure is to equip the backdoor with a [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[646,57,258,1,516],"tags":[87],"class_list":["post-1573","post","type-post","status-publish","format-standard","hentry","category-backdoors","category-bruce-schneier","category-malware","category-uncategorized","category-vpn","tag-bruce-schneier"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/1573"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=1573"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/1573\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=1573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=1573"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=1573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}