Attacks/Breaches

2/9/2017
10:30 AM
Dave Klein
Dave Klein
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Harvest Season: Why Cyberthieves Want Your Compute Power

Attackers are hijacking compute power in order to pull off their other crimes.

What's the hottest commodity cyberthieves are going after these days? Credit card numbers? Medical records? Politicians’ emails?

Those may be big, attractive targets. But more and more, attackers are going after unwitting organizations' compute power. That's what lets them steal all those other things in volume and commit all manner of online crimes.

We're witnessing a resurgence in compute power hijacking — what the thieves call "harvesting" — for a variety of nefarious purposes. A big driver is the trend toward ever-larger-scale data theft. Why break into an individual’s laptop to steal one credit card number when you can break into a retailer’s data center and steal millions? Another driver is the surge in cryptocurrency mining, a rapidly growing source of illicit profits.

To exfiltrate multiple terabytes of data at a time requires enormous computing power. To get it, bad actors are targeting legitimate enterprise data centers across all industries and company sizes. Once sophisticated hackers gain a foothold within a data center, they can dwell undetected for months. Indeed, the average "dwell time" for a successful breach is around 150 days, according to Mandiant’s 2016 M-Trends report. And hijackers need only a fraction of the host’s computing power to carry out their schemes. Consequently, their harvesting goes unnoticed.

Uncovering a Hidden Mine
Here’s an example of the damage hijackers can do. Last year, a midtier insurance firm came to our company with a problem. It suspected its data center had been compromised, but couldn’t confirm it. We sent analysts in to investigate. Sure enough, the company had a problem — beyond its wildest suspicions. Not only had the insurer been breached, but the attackers had set up shop, changed the firewall and DNS rules, and were running a massive botnet operation out of the data center. This security-conscious company had become the unwitting "botlord" of some 10,000 machines worldwide.

Our team shut down the operation and cleaned up the infected systems. In the process, we discovered what the attackers were really doing and why they needed all that compute power: Monero mining.

Monero is a form of cryptocurrency, a derivative of Bitcoin. Monero or Bitcoin mining refers to discovering, capturing, and processing Bitcoin transactions floating around the Internet. It’s effectively a competition that favors miners with the most computing power. Right under our customer’s nose, the attackers were using hijacked computing power to run a Monero mining bank to collect transaction fees.

Harvested compute power can be used to fuel any kind of illicit online activity. This includes ransomware or distributed denial-of-service attacks. A clever attacker can initiate a DDoS attack in one country using compute power from another, making the attack harder to trace and easy to deny.

Locks Are No Help Once the Thief Is in the House
What can enterprises do to protect their valuable computing power from hijackers? Perimeter defenses such as firewalls and intrusion prevention systems are essential, but compute harvesting takes place within the data center, after the "walls" have already been breached. Organizations must face the fact that they can’t stop every attack, and redirect some of their security efforts to vulnerabilities inside the data center. 

And in today’s highly virtualized, cloud or hybrid data centers, those vulnerabilities are often easy to exploit. Server and network virtualization, combined with ever-increasing traffic, network speed, and server density have created an enormous visibility gap. Administrators simply can't "see" what's going on deep in their data centers, at the process level. That’s why sophisticated malware can move laterally almost indefinitely until it finds an opening.

Enterprises must take new measures to secure assets within the data center from threats that have successfully breached the perimeter. There are a number of techniques in a growing, emerging market (including GuardiCore as well as other vendors) gaining traction today that security teams can deploy to fight attackers 

Distributed deception, also known as dynamic deception, is a significant advancement over conventional "honeypots" planted as bait for attackers. In traditional static deception designs, honeypots are placed throughout a company's environment. This is resource-intensive to implement, configure, and maintain. Using a distributed deception approach, suspicious reconnaissance behavior is detected throughout the environment, then tunneled away from the production network to centrally located honeypots. By centralizing the honeypots, and relying on other techniques to detect and redirect the attackers, distributed deception is easier to implement and maintain, has fewer false positives, and provides a better containment area for investigation and threat confirmation.

Reputation analysis, the ability to recognize something that doesn’t belong, is another emerging threat-detection tool. It typically relies on having access to a threat intelligence network that’s tracking suspicious IP addresses, domain names, or file hashes associated with known malicious activity.

Visualizing data center applications and workflows and then wrapping policies around them is also essential. Micro-segmentation refers to the ability to implement and enforce security controls around individual or groups of applications within the data center. Any policy violation automatically triggers an alert to initiate an investigation. Of course, this requires deep visibility into data center activity, down to the process level, which is a challenge. But with today's visualization tools, administrators can map their data center applications and processes, making micro-segmentation more practical for more organizations.

Related Content:

Dave Klein is Regional Director of Sales Engineering & Architecture at GuardiCore. He has over 20 years of experience working with large organizations in the design and implementation of security solutions across very large scale data center and cloud environments. At ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17538
PUBLISHED: 2018-09-26
Axon (formerly TASER International) Evidence Sync 3.15.89 is vulnerable to process injection.
CVE-2018-11763
PUBLISHED: 2018-09-25
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
CVE-2018-14634
PUBLISHED: 2018-09-25
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerabl...
CVE-2018-1664
PUBLISHED: 2018-09-25
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cache. ...
CVE-2018-1669
PUBLISHED: 2018-09-25
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote atta...