Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/9/2017
10:30 AM
Dave Klein
Dave Klein
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
100%
0%

Harvest Season: Why Cyberthieves Want Your Compute Power

Attackers are hijacking compute power in order to pull off their other crimes.

What's the hottest commodity cyberthieves are going after these days? Credit card numbers? Medical records? Politicians’ emails?

Those may be big, attractive targets. But more and more, attackers are going after unwitting organizations' compute power. That's what lets them steal all those other things in volume and commit all manner of online crimes.

We're witnessing a resurgence in compute power hijacking — what the thieves call "harvesting" — for a variety of nefarious purposes. A big driver is the trend toward ever-larger-scale data theft. Why break into an individual’s laptop to steal one credit card number when you can break into a retailer’s data center and steal millions? Another driver is the surge in cryptocurrency mining, a rapidly growing source of illicit profits.

To exfiltrate multiple terabytes of data at a time requires enormous computing power. To get it, bad actors are targeting legitimate enterprise data centers across all industries and company sizes. Once sophisticated hackers gain a foothold within a data center, they can dwell undetected for months. Indeed, the average "dwell time" for a successful breach is around 150 days, according to Mandiant’s 2016 M-Trends report. And hijackers need only a fraction of the host’s computing power to carry out their schemes. Consequently, their harvesting goes unnoticed.

Uncovering a Hidden Mine
Here’s an example of the damage hijackers can do. Last year, a midtier insurance firm came to our company with a problem. It suspected its data center had been compromised, but couldn’t confirm it. We sent analysts in to investigate. Sure enough, the company had a problem — beyond its wildest suspicions. Not only had the insurer been breached, but the attackers had set up shop, changed the firewall and DNS rules, and were running a massive botnet operation out of the data center. This security-conscious company had become the unwitting "botlord" of some 10,000 machines worldwide.

Our team shut down the operation and cleaned up the infected systems. In the process, we discovered what the attackers were really doing and why they needed all that compute power: Monero mining.

Monero is a form of cryptocurrency, a derivative of Bitcoin. Monero or Bitcoin mining refers to discovering, capturing, and processing Bitcoin transactions floating around the Internet. It’s effectively a competition that favors miners with the most computing power. Right under our customer’s nose, the attackers were using hijacked computing power to run a Monero mining bank to collect transaction fees.

Harvested compute power can be used to fuel any kind of illicit online activity. This includes ransomware or distributed denial-of-service attacks. A clever attacker can initiate a DDoS attack in one country using compute power from another, making the attack harder to trace and easy to deny.

Locks Are No Help Once the Thief Is in the House
What can enterprises do to protect their valuable computing power from hijackers? Perimeter defenses such as firewalls and intrusion prevention systems are essential, but compute harvesting takes place within the data center, after the "walls" have already been breached. Organizations must face the fact that they can’t stop every attack, and redirect some of their security efforts to vulnerabilities inside the data center. 

And in today’s highly virtualized, cloud or hybrid data centers, those vulnerabilities are often easy to exploit. Server and network virtualization, combined with ever-increasing traffic, network speed, and server density have created an enormous visibility gap. Administrators simply can't "see" what's going on deep in their data centers, at the process level. That’s why sophisticated malware can move laterally almost indefinitely until it finds an opening.

Enterprises must take new measures to secure assets within the data center from threats that have successfully breached the perimeter. There are a number of techniques in a growing, emerging market (including GuardiCore as well as other vendors) gaining traction today that security teams can deploy to fight attackers 

Distributed deception, also known as dynamic deception, is a significant advancement over conventional "honeypots" planted as bait for attackers. In traditional static deception designs, honeypots are placed throughout a company's environment. This is resource-intensive to implement, configure, and maintain. Using a distributed deception approach, suspicious reconnaissance behavior is detected throughout the environment, then tunneled away from the production network to centrally located honeypots. By centralizing the honeypots, and relying on other techniques to detect and redirect the attackers, distributed deception is easier to implement and maintain, has fewer false positives, and provides a better containment area for investigation and threat confirmation.

Reputation analysis, the ability to recognize something that doesn’t belong, is another emerging threat-detection tool. It typically relies on having access to a threat intelligence network that’s tracking suspicious IP addresses, domain names, or file hashes associated with known malicious activity.

Visualizing data center applications and workflows and then wrapping policies around them is also essential. Micro-segmentation refers to the ability to implement and enforce security controls around individual or groups of applications within the data center. Any policy violation automatically triggers an alert to initiate an investigation. Of course, this requires deep visibility into data center activity, down to the process level, which is a challenge. But with today's visualization tools, administrators can map their data center applications and processes, making micro-segmentation more practical for more organizations.

Related Content:

Dave Klein is Regional Director of Sales Engineering & Architecture at GuardiCore. He has over 20 years of experience working with large organizations in the design and implementation of security solutions across very large scale data center and cloud environments. At ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7245
PUBLISHED: 2020-01-23
Incorrect username validation in the registration processes of CTFd through 2.2.2 allows a remote attacker to take over an arbitrary account after initiating a password reset. This is related to register() and reset_password() in auth.py. To exploit the vulnerability, one must register with a userna...
CVE-2019-14885
PUBLISHED: 2020-01-23
A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information...
CVE-2019-17570
PUBLISHED: 2020-01-23
An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue...
CVE-2020-6007
PUBLISHED: 2020-01-23
Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.
CVE-2012-4606
PUBLISHED: 2020-01-23
Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update 3 contains a Local Privilege Escalation Vulnerability which could allow local users with access to a guest operating system to gain elevated privileges.