Shadowpad Backdoor Discovered in NetSarang Software

Which can allow an attacker to upload files, create processes and store files on the compromised device. NetSarang specialises in secure connectivity and server management software and their products are used in networks around the world, both in servers and workstations and tend to be used by network administrators.

The backdoor was found in the security update released on July 18th 2017; it’s still unknown how the backdoor was installed. Shadowpad resides in the nssock2.dll library in the server management software. It pings out every eight hours to a command-and-control (C2) server with the identity of the compromised computer, its network details, and user names. Once the backdoor is activated, an attacker is able to remotely execute code and steal data from the device.

Anti-virus vendors have been notified of the backdoor and Anti-virus tools have been updated to watch for the compromised .dll. NetSarang have released an update to address this - administrators are advised to read NetSarang’s security advisory and update to the latest version.