08:23 PM
Tim Wilson
Tim Wilson
Quick Hits

Study: Nation-States Are Primary Drivers Behind APTs

Most enterprises still ineffective in defending themselves from sophisticated attacks, Fortinet report says

Advanced persistent threats are generally created by nation-states and are most frequently used for cyberespionage, according to a new study published Tuesday.

According to FortiGuard Labs' report -- "Threats on the Horizon: The Rise of the Advanced Persistent Threat" -- the APT has become a tool of the trade for government-sponsored intelligence gathering.

"There are only a few groups globally that have the capability, skills, funding and infrastructure to launch an APT," the report states. China, Israel, Russia, and the United States are the most capable, but it is likely that other countries are also at least researching the tactic, if not creating APTs yet, Fortinet says.

While early analysis of APTs -- and even the definition of the term -- touched on a wide range of perpetrators and scenarios for sophisticated attacks, it is now apparent that the level of skill and resources required to create an APT severely limits the number of attackers who could potentially launch them, says Richard Henderson, security strategist at FortiGuard Labs and one of the authors of the report.

"What we're seeing is that these attacks are being used primarily for cyberespionage at the state level," Henderson says. "Nation-states are using them mostly these days as a means of collecting intelligence."

What defines today's APT is its level of sophistication and ability to stay hidden for long periods of time, enabling the attacker to use it as an ongoing tap into the information systems of rival governments or foreign businesses, Henderson says. While early examples, such as Stuxnet, may have been tools of sabotage, today's APTs are more likely to lie quietly and collect data.

"APTs don't have a typical attack pattern," the report says. "Once malware is in place on a target computer, it can lay dormant for months or years at a time. This becomes especially concerning when thinking about APTs from a national infrastructure standpoint. It's very possible that a site, such as a major city power grid, is compromised right now and the malware is just waiting for someone to press a button."

While APTs are, by definition, sophisticated and multilayered, they virtually always begin with a simple compromise, such as a phishing attack or website infection, Henderson observes. Companies reported more than 142 million unsuccessful hacking attempts in the first half of 2013 alone, according to the report; users were tricked into trying to visit a potentially malicious website more than 3.14 billion times.

Yet most enterprises still don't do a very good job of protecting themselves from this type of first-level attack, Henderson says.

"One of the things that surprised me most in the report is how poor companies are in teaching employees how to recognize the signs of an attack," Henderson states. "It is still fairly easy for any attacker to find out who you are and send you a convincing fake message from your boss' boss, telling you to go to link or access a malicious site."

And email is not the only means of infection, Henderson observes. "Watering holes, drive-by downloads, PDF infections -- these are infections that can happen without any action by the user."

Preventing this sort of user-level infection is the first step in defending against APTs, Henderson says, but IT organizations need to step up their games as well. "Companies still aren't making patching a priority," he notes. "They are worried about interrupting business continuity, but they are waiting too long to make their updates."

The recent Citadel infection at NBC.com exploited a vulnerability that had been disclosed just two weeks before, Henderson observes. "In that case, a zero-day wasn't needed," he notes. "The attackers got the advantage just by moving faster than the defenders on a known vulnerability."

The best defense against APTs is to know where your sensitive data is kept and how it moves in and out of the network, Henderson advises. "Encryption is a good first step, but you should know where your data is being moved to, and watch the data leaving your network. A sympathetic insider can do a lot of damage."

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-02-01
Algorithmic complexity vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x through 3.1.2 allows remote attackers to cause a denial of service (CPU consumption) via vectors that trigger colliding hash-table keys. NOTE: this vulnerability exists because of an incomplete fix for CVE-2...

Published: 2015-02-01
ASUS JAPAN RT-AC87U routers with firmware and earlier, RT-AC68U routers with firmware and earlier, RT-AC56S routers with firmware and earlier, RT-N66U routers with firmware and earlier, and RT-N56U routers with firmware

Published: 2015-02-01
Cross-site request forgery (CSRF) vulnerability on ASUS JAPAN RT-AC87U routers with firmware and earlier, RT-AC68U routers with firmware and earlier, RT-AC56S routers with firmware and earlier, RT-N66U routers with firmware and earl...

Published: 2015-02-01
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shel...

Published: 2015-02-01
Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6 and earlier, CANopen Communication Library 1.0.2 and earlier, EtherNet/IP Communication Library 1.0.0 and earlier, EM X8...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.