Attacks/Breaches

1/30/2018
03:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Phishing Campaign Underscores Threat from Low Budget, Low Skilled Attackers

For just over $1,000, a phishing operation successfully spied on members of the Tibetan community for 19 months, Toronto University's Citizen Lab found.

A recent digital spying operation targeted at the Tibetan community once again revealed just how little it takes for attackers to mount an effective malicious campaign these days.

Researchers at the University of Toronto's Citizen Lab were able to gain an inside view of the phishing campaign by taking advantage of some sloppy mistakes by the operator.

Over a period of eight months the researchers observed the operator setting up phishing lures, building fake Web pages, registering dozens of decoy domains, and sending emails to targeted individuals and organizations within the Tibetan community.

They estimated that during the 19 months when the operation was active, the attackers likely spent a mere $1,068 on infrastructure costs: $878 for domain registration and $190 for renting servers. Citizen Lab's researchers found that it took just basic Web development and system admin skills to run the operation, which though sloppy, was still surprisingly successful.

The attackers managed to compromise the email accounts of at least two of their intended targets and used their contact lists to send phishing lures to other targets. "We suspect there were likely other successful compromises beyond these accounts based on decoy documents we collected that appear to be private files likely extracted from compromised accounts," Citizen Lab's director Ronald Deibert said in a blog Tuesday.

According to Deibert, Citizen Lab was unable to find any evidence directly linking the operation to a specific criminal group or nation-state sponsor. But the group's targeting strongly suggests a China link: besides Tibetan activists, the operators also appeared to be interested in people from within China's Uyghur minority community, as well as a media group founded by members of the Falun Gong religious group, and other groups in Hong Kong and Burma.

It is possible the group behind the phishing campaign were freelancers or independent contractors working on behalf of a government agency in China. The sloppiness of the campaign suggests the threat actors were operating with little fear of getting caught. "The profile of the operator suggests it may be a low-level contractor," says Masashi Nishihata, research manager at Citizen Lab. "It is unclear how the operators selected targets. Nor is it clear if the operators had a specific sponsor and who was the ultimate consumer of data collected."

Citizen Lab's research showed how in addition to conducting malicious campaigns on the cheap, threat actors also often will use only what is necessary to meet their objectives. Few will ever resort to using sophisticated costly tools and attack methods if they can break into a target system using inexpensive, basic techniques. "This case shows that it doesn't take deep pockets or sophisticated technical skills to mount an effective digital spying operation. While the operation was done on the cheap, it had some successes," Nishihata says.

On a Low Budget

The Citizen Lab findings are similar to other reports that also have shown the enormous returns that criminals and cyber spies can garner from relatively meager investments. Last November, a Recorded Future report dissecting the costs of cybercrime operations found that an individual or group willing to spend between $3,500 and $5,000 on a botnet operation could easily net between 400% and 600% in direct and indirect returns.

Just like Citizen Lab discovered with the Tibetan phishing campaign, Recorded Future's researchers found that threat actors often require little technical skills to carry out lucrative campaigns. So many tools and services are available - and in such a wide price range - on the Dark Web that anyone from a newbie to a sophisticated nation-state actor can find something for their needs, Recorded Future found.

A Trend Micro report last October found that in some underground cyber markets — like those catering to the Middle East and North African threat community — there is almost no bar for entry for malicious actors. Many common attack tools, including those used for SQL injection, keystroke logging, and malware obfuscation, are available for free to members on these networks.

This trend highlights the need for organizations to pay attention to the basics, experts say. Contrary to perception, adversaries often apply low-level tools and tactics to carry out attacks so basic practices such as timely patching and strong authentication can help mitigate them as well.

The Tibetan phishing campaign is one example. "Addressing this problem requires raising the low bar and making digital spying more expensive for adversaries," Nishihata says. "Much of the threat posed by the basic phishing techniques used in this operation could be blunted through use of security features like two-factor authentication."

Related Content:

 

 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-13435
PUBLISHED: 2018-08-16
** DISPUTED ** An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method to disable passcode authentication. NOTE: the vendor indicates that this is not an attack of interest w...
CVE-2018-13446
PUBLISHED: 2018-08-16
** DISPUTED ** An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. ...
CVE-2018-14567
PUBLISHED: 2018-08-16
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVE-2018-15122
PUBLISHED: 2018-08-16
An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a compiled .NET object (such as DLL or EXE) with an embedded resource file by clicking on the resource.
CVE-2018-11509
PUBLISHED: 2018-08-16
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.