{"id":48165,"date":"2020-12-21T16:01:59","date_gmt":"2020-12-21T08:01:59","guid":{"rendered":"https:\/\/version-2.com.sg\/?p=22484"},"modified":"2020-12-21T16:01:59","modified_gmt":"2020-12-21T08:01:59","slug":"eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2","status":"publish","type":"post","link":"https:\/\/v2catalog.com\/zh\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/","title":{"rendered":"ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"48165\" class=\"elementor elementor-48165\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-71ae5294 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"71ae5294\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;_id&quot;:&quot;c4a899f&quot;,&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:&quot;1&quot;,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:0,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-1e9119cd\" data-id=\"1e9119cd\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4f04f8cb post-content elementor-widget elementor-widget-text-editor\" data-id=\"4f04f8cb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><strong>BRATISLAVA, MONTREAL<\/strong>\u00a0\u2013 ESET Research discovered another supply-chain attack in Asia, this time on the website of the Vietnam Government Certification Authority (VGCA). The attackers modified two of the software installers available for download on this website by adding a backdoor in order to compromise users of the legitimate application. Supply-chain attacks appear to be a quite common compromise vector for cyberespionage groups. Cybercrime operation SignSight leverages malware known as PhantomNet or Smanager.\n<\/p>\n<p>\n\u201cIn Vietnam, digital signatures are very common, as digitally signed documents have the same level of enforceability as wet signatures. In addition to issuing certificates, the VGCA develops and distributes a digital signature toolkit. It is used by the Vietnamese government, and probably by private companies, to sign digital documents. The compromise of a certification authority website is a good opportunity for APT groups, since visitors are likely to have a high level of trust in a state organization responsible for digital signatures,\u201d explains Matthieu Faou, one of ESET\u2019s researchers investigating the SignSight operation.\n<\/p>\n<p>\nThe PhantomNet backdoor is quite simple and is able to collect victim information (computer name, hostname, username, OS version, user privileges [admin or not], and the public IP address) as well as install, remove and update malicious plugins. These additional and more complex plugins are probably only deployed on a few selected machines. By also installing the legitimate program, the attackers make sure that this compromise won\u2019t be easily noticed by end users.\n<\/p>\n<p>\nESET researchers uncovered this new supply-chain attack in early December 2020 and notified the compromised organization and the VNCERT. We believe that the website ceased delivering compromised software installers at the end of August 2020. The Vietnam Government Certification Authority confirmed that they were aware of the attack before our notification and that they notified the users who downloaded the trojanized software.\n<\/p>\n<p>\nESET has seen victims in the Philippines in addition to Vietnam.\n<\/p>\n<p>\nFor more technical details about operation SignSight, read the blog post \u201cOperation SignSight: Supply- chain attack against a certification authority in Southeast Asia\u201d on WeLiveSecurity. Make sure to follow\u00a0<a href=\"https:\/\/twitter.com\/ESETresearch\" target=\"_blank\" rel=\"noopener\">ESET Research on Twitter<\/a>\u00a0for the latest news from ESET Research.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1a1b0f4 elementor-widget elementor-widget-shortcode\" data-id=\"1a1b0f4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\">\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>BRATISLAVA, MONTREAL\u00a0\u2013 ESET Research discovered another supply-chain attack in Asia, this time on the website of the Vietnam Government Certification Authority (VGCA). The attackers modified two of the software installers available for download on this website by adding a backdoor in order to compromise users of the legitimate application. Supply-chain attacks appear to be a [&hellip;]<\/p>\n","protected":false},"author":148019288,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_wpcom_ai_launchpad_first_post":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1400,1526,1376],"tags":[1389,1529],"class_list":["post-48165","post","type-post","status-publish","format-standard","hentry","category-year2020","category-eset","category-press-release","tag-1389","tag-eset"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia - V2Catalog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/v2catalog.com\/zh\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/\" \/>\n<meta property=\"og:locale\" content=\"zh_HK\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia - V2Catalog\" \/>\n<meta property=\"og:description\" content=\"BRATISLAVA, MONTREAL\u00a0\u2013 ESET Research discovered another supply-chain attack in Asia, this time on the website of the Vietnam Government Certification Authority (VGCA). The attackers modified two of the software installers available for download on this website by adding a backdoor in order to compromise users of the legitimate application. Supply-chain attacks appear to be a [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/v2catalog.com\/zh\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/\" \/>\n<meta property=\"og:site_name\" content=\"V2Catalog\" \/>\n<meta property=\"article:published_time\" content=\"2020-12-21T08:01:59+00:00\" \/>\n<meta name=\"author\" content=\"tracylamv2\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"tracylamv2\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9810\u8a08\u95b1\u8b80\u6642\u9593\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 \u5206\u9418\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/v2catalog.com\\\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/v2catalog.com\\\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\\\/\"},\"author\":{\"name\":\"tracylamv2\",\"@id\":\"https:\\\/\\\/v2catalog.com\\\/#\\\/schema\\\/person\\\/949d980888460b8203c48a6e6c719cca\"},\"headline\":\"ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia\",\"datePublished\":\"2020-12-21T08:01:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/v2catalog.com\\\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\\\/\"},\"wordCount\":369,\"keywords\":[\"2020\",\"ESET\"],\"articleSection\":[\"2020\",\"ESET\",\"Press Release\"],\"inLanguage\":\"zh-HK\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/v2catalog.com\\\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\\\/\",\"url\":\"https:\\\/\\\/v2catalog.com\\\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\\\/\",\"name\":\"ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia - V2Catalog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/v2catalog.com\\\/#website\"},\"datePublished\":\"2020-12-21T08:01:59+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/v2catalog.com\\\/#\\\/schema\\\/person\\\/949d980888460b8203c48a6e6c719cca\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/v2catalog.com\\\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\\\/#breadcrumb\"},\"inLanguage\":\"zh-HK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/v2catalog.com\\\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/v2catalog.com\\\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/v2catalog.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/v2catalog.com\\\/#website\",\"url\":\"https:\\\/\\\/v2catalog.com\\\/\",\"name\":\"V2Catalog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/v2catalog.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-HK\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/v2catalog.com\\\/#\\\/schema\\\/person\\\/949d980888460b8203c48a6e6c719cca\",\"name\":\"tracylamv2\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-HK\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"caption\":\"tracylamv2\"},\"url\":\"https:\\\/\\\/v2catalog.com\\\/zh\\\/author\\\/tracylamv2\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia - V2Catalog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/v2catalog.com\/zh\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/","og_locale":"zh_HK","og_type":"article","og_title":"ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia - V2Catalog","og_description":"BRATISLAVA, MONTREAL\u00a0\u2013 ESET Research discovered another supply-chain attack in Asia, this time on the website of the Vietnam Government Certification Authority (VGCA). The attackers modified two of the software installers available for download on this website by adding a backdoor in order to compromise users of the legitimate application. Supply-chain attacks appear to be a [&hellip;]","og_url":"https:\/\/v2catalog.com\/zh\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/","og_site_name":"V2Catalog","article_published_time":"2020-12-21T08:01:59+00:00","author":"tracylamv2","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"tracylamv2","\u9810\u8a08\u95b1\u8b80\u6642\u9593":"2 \u5206\u9418"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/v2catalog.com\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/#article","isPartOf":{"@id":"https:\/\/v2catalog.com\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/"},"author":{"name":"tracylamv2","@id":"https:\/\/v2catalog.com\/#\/schema\/person\/949d980888460b8203c48a6e6c719cca"},"headline":"ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia","datePublished":"2020-12-21T08:01:59+00:00","mainEntityOfPage":{"@id":"https:\/\/v2catalog.com\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/"},"wordCount":369,"keywords":["2020","ESET"],"articleSection":["2020","ESET","Press Release"],"inLanguage":"zh-HK"},{"@type":"WebPage","@id":"https:\/\/v2catalog.com\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/","url":"https:\/\/v2catalog.com\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/","name":"ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia - V2Catalog","isPartOf":{"@id":"https:\/\/v2catalog.com\/#website"},"datePublished":"2020-12-21T08:01:59+00:00","author":{"@id":"https:\/\/v2catalog.com\/#\/schema\/person\/949d980888460b8203c48a6e6c719cca"},"breadcrumb":{"@id":"https:\/\/v2catalog.com\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/#breadcrumb"},"inLanguage":"zh-HK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/v2catalog.com\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/v2catalog.com\/eset-discovers-operation-signsight-supply-chain-attack-against-a-certification-authority-in-southeast-asia-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/v2catalog.com\/"},{"@type":"ListItem","position":2,"name":"ESET discovers operation SignSight: Supply-chain attack against a certification authority in Southeast Asia"}]},{"@type":"WebSite","@id":"https:\/\/v2catalog.com\/#website","url":"https:\/\/v2catalog.com\/","name":"V2Catalog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/v2catalog.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-HK"},{"@type":"Person","@id":"https:\/\/v2catalog.com\/#\/schema\/person\/949d980888460b8203c48a6e6c719cca","name":"tracylamv2","image":{"@type":"ImageObject","inLanguage":"zh-HK","@id":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","caption":"tracylamv2"},"url":"https:\/\/v2catalog.com\/zh\/author\/tracylamv2\/"}]}},"jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/posts\/48165","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/users\/148019288"}],"replies":[{"embeddable":true,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/comments?post=48165"}],"version-history":[{"count":0,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/posts\/48165\/revisions"}],"wp:attachment":[{"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/media?parent=48165"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/categories?post=48165"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/tags?post=48165"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}