I'm looking for state-sponsored spyware that has the following features.
The spyware should be split into three or more parts. There are two parts on the host/phone, and a third part on the home router. The two parts on the host are:
- a piece at ring0 joined in the kernel to hide traces
- another piece is in userland and injected in the browser to communicate with the attacker.
The full implant is fileless and the PC is infected while it connects to the internet by the router. The part in the router is file-less too and is infected from the isp infrastructure.
The information is exfiltrated in a covert channel through a benign and existent encrypted stream. I mean, for example, I'm connected to Facebook, the exfiltered data are injected into the Facebook stream data and then extracted from the router part of the implant. In this way, if I run a sniffer on the cable between router and PC, I see only encrypted packets to Facebook, and then from my point of view, everything looks benign.
When the data goes to the router they are extracted (the router has the private key and can decrypt the encrypted data), re-assembled and sent to the C2C so that the data sent to Facebook are totally clean.
This kind of implant should not trigger any alert on snort or other IDS.
I cannot run a sniffer after the router because there is an ISP.
This implant can be cross-platform and cross-device: window/linux/mac/bsd/ios/android and PC/router/phone.
- Is this kind of implant theoretically possible?
- Have you ever heard of anything like this?