04:47 PM
Connect Directly

The Best Spies Money Can Buy

Security firms have found evidence that espionage agents are buying time on leased botnets: Will cybercriminals services lead to more efficient spying?

During the past decade, cybercriminals have specialized in the various tasks needed to compromise computers, steal data, and make money. Now, more elusive nation-state attackers could be using rented botnets and cybercriminal services to streamline their own operations, security experts say.

In June, security firm FireEye detected evidence of such a connection when it found instances of a remote-access Trojan whose code seemed to have been reused to infect machines with fake antivirus software. In another incident, cybercriminals sold access to compromised military and government computers, allowing would-be cyberspies to get direct access to their targets, says Darien Kindlund, senior staff scientist at FireEye.

The two examples are part of a building body of evidence that suggests attackers representing what the military and security industry refer to as the advanced persistent threat (APT) are not shying away from using criminals' resources to help them in their missions.

"If military and government hosts are being sold on the black market, who are the most likely buyers -- spammers?' No, they could buy something cheaper on a different network. But for APT? 'Yes, it meets their mission objectives," Kindlund says.

Criminals looking to rent time on a botnet will likely try to avoid using military and government servers for fear of more intense repercussions. Yet the same servers are the targets for APT attacks, Kindlund argues. The cybercriminal element on the Internet certainly seems ready to handle sales of botnets to any comer, including espionage agents.

"These malware criminals may not necessarily know that their buyers are APT actors because they provide generic, easy-to-use Web interfaces to allow anyone to 'rent' machine time on compromised systems," Kindlund says.

McAfee acknowledges that buying hacked systems within a targeted company would be an easy way to get behind the company's defenses. Yet the company has not found much evidence of espionage agents using criminal botnets to carry out their missions, says Stuart McClure, general manager for risk compliance at McAfee. Contacting a criminal group to purchase compromised machines carries a large risk of tipping the hand of a spy, he says.

"If I was the bad guy, I would go after the command-and-control servers themselves and just hack those," McClure says. "Then I would figure out which systems the C&Cs had control over, and I would just take over those."

Other security firms also believe the link between cybercriminals and nation-state attackers might be fairly uncommon. Evidence linking code might not mean a common code base, but a common exploit, says Rik Ferguson, director of security research for Trend Micro's Europe, Middle East, and Africa business unit.

"There is very little crossover in terms of the actual Trojan malware used in espionage attacks versus criminal attacks," Ferguson says. "However, there may be crossovers in terms of the vulnerabilities that cause the initial infection."

In the end, it depends on who is trying to steal information. It's unlikely that an intelligence agency will go to the only version of the mob and ask for an informant in a particular company or government office, McAfee's McClure says. Instead, they will create their own tools.

"At the end of the day, if you are a spy agency, you are going to develop your own stuff," he says. ""You may get ideas from others ... but I don't think the elite guys are ever going" to do business with criminals, he says.

Yet,criminals could decide that the market for intellectual property is lucrative enough to make a profit. In that case, all bets are off, FireEye's Kindlund says.

"If we look at the logical conclusion of this trend, we see that eventually different cybercrime groups emerge, each specializing in different stages of the overall 'business' model ... [including] exfiltrated intel sales," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-07-09
Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute arbitrary code via a crafted JLS image file.

Published: 2014-07-09
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

Published: 2014-07-09
Adobe Flash Player before and 14.x before on Windows and OS X and before on Linux, Adobe AIR before on Android, Adobe AIR SDK before, and Adobe AIR SDK & Compiler before allow attackers to bypass intended access restrictions via uns...

Published: 2014-07-09
Adobe Flash Player before and 14.x before on Windows and OS X and before on Linux, Adobe AIR before on Android, Adobe AIR SDK before, and Adobe AIR SDK & Compiler before allow attackers to bypass intended access restrictions via uns...

Published: 2014-07-09
The NTP implementation in Cisco IOS and IOS XE does not properly support use of the access-group command for a "deny all" configuration, which allows remote attackers to bypass intended restrictions on time synchronization via a standard query, aka Bug ID CSCuj66318.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.