Attacks/Breaches
11/22/2011
10:51 AM
Connect Directly
RSS
E-Mail
50%
50%

APT Or Everyday Cybercrime? How To Tell

Of the many attacks corporate networks face daily, advanced persistent threats are the most serious. Consider these tips to tell which kind of attack you're facing and what to do about it.

Oil companies, Internet technology firms, defense contractors, and even computer-security firms have all been targeted by persistent adversaries bent on stealing intellectual property and sensitive business information.

Advanced persistent threats (APTs)--a term that's become much maligned since the media locked onto it--describes attackers that are targeting specific companies and data, rather than searching for vulnerable targets of opportunity. Persistent attackers stole oil field exploration data from ExxonMobil, information on the Joint Strike Fighter from Lockheed Martin and Northrup Grumman, and sensitive data on SecurID tokens from RSA. For many in the industry, the question is no longer if they have been breached, but how deeply, said Richard Bejtlich, chief security officer of Mandiant.

"No one has been able to stop these guys, no one," he said. "They remain a problem for every company with valuable intellectual property."

Separating persistent threats from more opportunistic cybercrime-focused attacks is not easy, but can help inform defense, according to security experts. Block an opportunistic attack and the crisis is averted; block a persistent attacker and they will come back tomorrow, said Toralv Dirro, security strategist for McAfee's Labs in the Europe, Middle East, and Africa region.

"If someone is a victim of a targeted attack, there are patterns," Dirro said. "They should really follow up on identifying those patterns."

In many cases, the patterns are not clear. Even "advanced" attackers will only use, for example, the minimum force necessary to compromise a network. In some cases, attackers have rented botnets; in others, they've used standard cybercrime tools.

"It is never a case of, oh, they are using Poison Ivy, so it's APT--everyone is using Poison Ivy," Mandiant's Bejtlich said. "It really comes down to a lot of analysis to figure out what is going on."

Read the rest of this article on Dark Reading.

Read our report on how to guard your systems from a SQL attack. Download the report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

CVE-2014-4511
Published: 2014-07-22
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.

CVE-2014-4911
Published: 2014-07-22
The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.