Attacks/Breaches
9/26/2011
04:47 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

The Best Spies Money Can Buy

Security firms have found evidence that espionage agents are buying time on leased botnets: Will cybercriminals services lead to more efficient spying?

During the past decade, cybercriminals have specialized in the various tasks needed to compromise computers, steal data, and make money. Now, more elusive nation-state attackers could be using rented botnets and cybercriminal services to streamline their own operations, security experts say.

In June, security firm FireEye detected evidence of such a connection when it found instances of a remote-access Trojan whose code seemed to have been reused to infect machines with fake antivirus software. In another incident, cybercriminals sold access to compromised military and government computers, allowing would-be cyberspies to get direct access to their targets, says Darien Kindlund, senior staff scientist at FireEye.

The two examples are part of a building body of evidence that suggests attackers representing what the military and security industry refer to as the advanced persistent threat (APT) are not shying away from using criminals' resources to help them in their missions.

"If military and government hosts are being sold on the black market, who are the most likely buyers -- spammers?' No, they could buy something cheaper on a different network. But for APT? 'Yes, it meets their mission objectives," Kindlund says.

Criminals looking to rent time on a botnet will likely try to avoid using military and government servers for fear of more intense repercussions. Yet the same servers are the targets for APT attacks, Kindlund argues. The cybercriminal element on the Internet certainly seems ready to handle sales of botnets to any comer, including espionage agents.

"These malware criminals may not necessarily know that their buyers are APT actors because they provide generic, easy-to-use Web interfaces to allow anyone to 'rent' machine time on compromised systems," Kindlund says.

McAfee acknowledges that buying hacked systems within a targeted company would be an easy way to get behind the company's defenses. Yet the company has not found much evidence of espionage agents using criminal botnets to carry out their missions, says Stuart McClure, general manager for risk compliance at McAfee. Contacting a criminal group to purchase compromised machines carries a large risk of tipping the hand of a spy, he says.

"If I was the bad guy, I would go after the command-and-control servers themselves and just hack those," McClure says. "Then I would figure out which systems the C&Cs had control over, and I would just take over those."

Other security firms also believe the link between cybercriminals and nation-state attackers might be fairly uncommon. Evidence linking code might not mean a common code base, but a common exploit, says Rik Ferguson, director of security research for Trend Micro's Europe, Middle East, and Africa business unit.

"There is very little crossover in terms of the actual Trojan malware used in espionage attacks versus criminal attacks," Ferguson says. "However, there may be crossovers in terms of the vulnerabilities that cause the initial infection."

In the end, it depends on who is trying to steal information. It's unlikely that an intelligence agency will go to the only version of the mob and ask for an informant in a particular company or government office, McAfee's McClure says. Instead, they will create their own tools.

"At the end of the day, if you are a spy agency, you are going to develop your own stuff," he says. ""You may get ideas from others ... but I don't think the elite guys are ever going" to do business with criminals, he says.

Yet,criminals could decide that the market for intellectual property is lucrative enough to make a profit. In that case, all bets are off, FireEye's Kindlund says.

"If we look at the logical conclusion of this trend, we see that eventually different cybercrime groups emerge, each specializing in different stages of the overall 'business' model ... [including] exfiltrated intel sales," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web