Attacks/Breaches
2/9/2017
10:30 AM
Dave Klein
Dave Klein
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Harvest Season: Why Cyberthieves Want Your Compute Power

Attackers are hijacking compute power in order to pull off their other crimes.

What's the hottest commodity cyberthieves are going after these days? Credit card numbers? Medical records? Politicians’ emails?

Those may be big, attractive targets. But more and more, attackers are going after unwitting organizations' compute power. That's what lets them steal all those other things in volume and commit all manner of online crimes.

We're witnessing a resurgence in compute power hijacking — what the thieves call "harvesting" — for a variety of nefarious purposes. A big driver is the trend toward ever-larger-scale data theft. Why break into an individual’s laptop to steal one credit card number when you can break into a retailer’s data center and steal millions? Another driver is the surge in cryptocurrency mining, a rapidly growing source of illicit profits.

To exfiltrate multiple terabytes of data at a time requires enormous computing power. To get it, bad actors are targeting legitimate enterprise data centers across all industries and company sizes. Once sophisticated hackers gain a foothold within a data center, they can dwell undetected for months. Indeed, the average "dwell time" for a successful breach is around 150 days, according to Mandiant’s 2016 M-Trends report. And hijackers need only a fraction of the host’s computing power to carry out their schemes. Consequently, their harvesting goes unnoticed.

Uncovering a Hidden Mine
Here’s an example of the damage hijackers can do. Last year, a midtier insurance firm came to our company with a problem. It suspected its data center had been compromised, but couldn’t confirm it. We sent analysts in to investigate. Sure enough, the company had a problem — beyond its wildest suspicions. Not only had the insurer been breached, but the attackers had set up shop, changed the firewall and DNS rules, and were running a massive botnet operation out of the data center. This security-conscious company had become the unwitting "botlord" of some 10,000 machines worldwide.

Our team shut down the operation and cleaned up the infected systems. In the process, we discovered what the attackers were really doing and why they needed all that compute power: Monero mining.

Monero is a form of cryptocurrency, a derivative of Bitcoin. Monero or Bitcoin mining refers to discovering, capturing, and processing Bitcoin transactions floating around the Internet. It’s effectively a competition that favors miners with the most computing power. Right under our customer’s nose, the attackers were using hijacked computing power to run a Monero mining bank to collect transaction fees.

Harvested compute power can be used to fuel any kind of illicit online activity. This includes ransomware or distributed denial-of-service attacks. A clever attacker can initiate a DDoS attack in one country using compute power from another, making the attack harder to trace and easy to deny.

Locks Are No Help Once the Thief Is in the House
What can enterprises do to protect their valuable computing power from hijackers? Perimeter defenses such as firewalls and intrusion prevention systems are essential, but compute harvesting takes place within the data center, after the "walls" have already been breached. Organizations must face the fact that they can’t stop every attack, and redirect some of their security efforts to vulnerabilities inside the data center. 

And in today’s highly virtualized, cloud or hybrid data centers, those vulnerabilities are often easy to exploit. Server and network virtualization, combined with ever-increasing traffic, network speed, and server density have created an enormous visibility gap. Administrators simply can't "see" what's going on deep in their data centers, at the process level. That’s why sophisticated malware can move laterally almost indefinitely until it finds an opening.

Enterprises must take new measures to secure assets within the data center from threats that have successfully breached the perimeter. There are a number of techniques in a growing, emerging market (including GuardiCore as well as other vendors) gaining traction today that security teams can deploy to fight attackers 

Distributed deception, also known as dynamic deception, is a significant advancement over conventional "honeypots" planted as bait for attackers. In traditional static deception designs, honeypots are placed throughout a company's environment. This is resource-intensive to implement, configure, and maintain. Using a distributed deception approach, suspicious reconnaissance behavior is detected throughout the environment, then tunneled away from the production network to centrally located honeypots. By centralizing the honeypots, and relying on other techniques to detect and redirect the attackers, distributed deception is easier to implement and maintain, has fewer false positives, and provides a better containment area for investigation and threat confirmation.

Reputation analysis, the ability to recognize something that doesn’t belong, is another emerging threat-detection tool. It typically relies on having access to a threat intelligence network that’s tracking suspicious IP addresses, domain names, or file hashes associated with known malicious activity.

Visualizing data center applications and workflows and then wrapping policies around them is also essential. Micro-segmentation refers to the ability to implement and enforce security controls around individual or groups of applications within the data center. Any policy violation automatically triggers an alert to initiate an investigation. Of course, this requires deep visibility into data center activity, down to the process level, which is a challenge. But with today's visualization tools, administrators can map their data center applications and processes, making micro-segmentation more practical for more organizations.

Related Content:

Dave Klein is Regional Director of Sales Engineering & Architecture at GuardiCore. He has over 20 years of experience working with large organizations in the design and implementation of security solutions across very large scale data center and cloud environments. At ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.