Of the many attacks corporate networks face daily, advanced persistent threats are the most serious. Consider these tips to tell which kind of attack you're facing and what to do about it.
Oil companies, Internet technology firms, defense contractors, and even computer-security firms have all been targeted by persistent adversaries bent on stealing intellectual property and sensitive business information.
Advanced persistent threats (APTs)--a term that's become much maligned since the media locked onto it--describes attackers that are targeting specific companies and data, rather than searching for vulnerable targets of opportunity. Persistent attackers stole oil field exploration data from ExxonMobil, information on the Joint Strike Fighter from Lockheed Martin and Northrup Grumman, and sensitive data on SecurID tokens from RSA. For many in the industry, the question is no longer if they have been breached, but how deeply, said Richard Bejtlich, chief security officer of Mandiant.
"No one has been able to stop these guys, no one," he said. "They remain a problem for every company with valuable intellectual property."
Separating persistent threats from more opportunistic cybercrime-focused attacks is not easy, but can help inform defense, according to security experts. Block an opportunistic attack and the crisis is averted; block a persistent attacker and they will come back tomorrow, said Toralv Dirro, security strategist for McAfee's Labs in the Europe, Middle East, and Africa region.
"If someone is a victim of a targeted attack, there are patterns," Dirro said. "They should really follow up on identifying those patterns."
In many cases, the patterns are not clear. Even "advanced" attackers will only use, for example, the minimum force necessary to compromise a network. In some cases, attackers have rented botnets; in others, they've used standard cybercrime tools.
"It is never a case of, oh, they are using Poison Ivy, so it's APT--everyone is using Poison Ivy," Mandiant's Bejtlich said. "It really comes down to a lot of analysis to figure out what is going on."
Published: 2014-09-02 S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.
Published: 2014-09-02 Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element.
Published: 2014-09-02 CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.
Published: 2014-09-02 The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.
Published: 2014-09-02 Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.