Rewterz Threat Alert – Winnti Group’s skip 2.0: A Microsoft SQL Server backdoor

Severity

High

Analysis Summary

For a while, ESET researchers have been tracking the activities of the Winnti Group, active since at least 2012 and responsible for high-profile supply-chain attacks against the video game and software industry. Recently, a previously undocumented backdoor targeting Microsoft SQL (MSSQL) that allows attackers to maintain a very discreet foothold inside compromised organizations. This backdoor bears multiple similarities to the PortReuse backdoor, another tool used by the Winnti Group that was first documented by ESET in October 2019, such as the use of the same custom packer and VMProtected launcher, which is why we attribute this backdoor to the Winnti Group.

Named “skip-2.0,” ESET said the backdoor modified MSSQL functions that handle authentication. The idea is to create a “magic password.” If the “magic password” is entered inside any user authentication session, the user is automatically granted access, while normal logging and audit functions are prevented from executing, effectively creating a ghost session inside the server.

ESET said the skip-2.0 code contained clues that linked it to other Winnti hacking tools, such as the PortReuse and ShadowPad backdoors.

PortReuse is an IIS server backdoor that ESET found on the compromised networks of hardware and software vendors across South Asia earlier this year.

ShadowPad is a Windows backdoor trojan that was first seen injected inside apps manufactured by South Korean software maker NetSarang after Chinese hackers breached its infrastructure back in mid-2017.

“Considering that administrative privileges are required for installing the hooks, skip-2.0 must be used on already compromised MSSQL Servers to achieve persistence and stealthiness,” ESET researchers said.

However, the ESET team notes that once this hurdle is passed, skip-2.0 can be one of the most powerful tools in Winnti’s arsenal.

Impact

• Exposure of sensitive information
• Stored Data Manipulation
• Runtime Data Manipulation
• Data Destruction

Indicators of Compromise

SHA1

• a2571946ab181657eb825cde07188e8bcd689575
• 60b9428d00be5ce562ff3d888441220290a6dac7
• 18e4feb988cb95d71d81e1964aa6280e22361b9f
• 4af89296a15c1ea9068a279e05cc4a41b967c956

Affected Vendors

Microsoft

Affected Products

• Microsoft SQL Server 11
• Microsoft SQL Server 12

Remediation

• Strictly keep administrative privileges limited to specific administrator accounts only.
• Use Multi-factor authentication for administrator accounts.