Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/30/2018
03:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Phishing Campaign Underscores Threat from Low Budget, Low Skilled Attackers

For just over $1,000, a phishing operation successfully spied on members of the Tibetan community for 19 months, Toronto University's Citizen Lab found.

A recent digital spying operation targeted at the Tibetan community once again revealed just how little it takes for attackers to mount an effective malicious campaign these days.

Researchers at the University of Toronto's Citizen Lab were able to gain an inside view of the phishing campaign by taking advantage of some sloppy mistakes by the operator.

Over a period of eight months the researchers observed the operator setting up phishing lures, building fake Web pages, registering dozens of decoy domains, and sending emails to targeted individuals and organizations within the Tibetan community.

They estimated that during the 19 months when the operation was active, the attackers likely spent a mere $1,068 on infrastructure costs: $878 for domain registration and $190 for renting servers. Citizen Lab's researchers found that it took just basic Web development and system admin skills to run the operation, which though sloppy, was still surprisingly successful.

The attackers managed to compromise the email accounts of at least two of their intended targets and used their contact lists to send phishing lures to other targets. "We suspect there were likely other successful compromises beyond these accounts based on decoy documents we collected that appear to be private files likely extracted from compromised accounts," Citizen Lab's director Ronald Deibert said in a blog Tuesday.

According to Deibert, Citizen Lab was unable to find any evidence directly linking the operation to a specific criminal group or nation-state sponsor. But the group's targeting strongly suggests a China link: besides Tibetan activists, the operators also appeared to be interested in people from within China's Uyghur minority community, as well as a media group founded by members of the Falun Gong religious group, and other groups in Hong Kong and Burma.

It is possible the group behind the phishing campaign were freelancers or independent contractors working on behalf of a government agency in China. The sloppiness of the campaign suggests the threat actors were operating with little fear of getting caught. "The profile of the operator suggests it may be a low-level contractor," says Masashi Nishihata, research manager at Citizen Lab. "It is unclear how the operators selected targets. Nor is it clear if the operators had a specific sponsor and who was the ultimate consumer of data collected."

Citizen Lab's research showed how in addition to conducting malicious campaigns on the cheap, threat actors also often will use only what is necessary to meet their objectives. Few will ever resort to using sophisticated costly tools and attack methods if they can break into a target system using inexpensive, basic techniques. "This case shows that it doesn't take deep pockets or sophisticated technical skills to mount an effective digital spying operation. While the operation was done on the cheap, it had some successes," Nishihata says.

On a Low Budget

The Citizen Lab findings are similar to other reports that also have shown the enormous returns that criminals and cyber spies can garner from relatively meager investments. Last November, a Recorded Future report dissecting the costs of cybercrime operations found that an individual or group willing to spend between $3,500 and $5,000 on a botnet operation could easily net between 400% and 600% in direct and indirect returns.

Just like Citizen Lab discovered with the Tibetan phishing campaign, Recorded Future's researchers found that threat actors often require little technical skills to carry out lucrative campaigns. So many tools and services are available - and in such a wide price range - on the Dark Web that anyone from a newbie to a sophisticated nation-state actor can find something for their needs, Recorded Future found.

A Trend Micro report last October found that in some underground cyber markets — like those catering to the Middle East and North African threat community — there is almost no bar for entry for malicious actors. Many common attack tools, including those used for SQL injection, keystroke logging, and malware obfuscation, are available for free to members on these networks.

This trend highlights the need for organizations to pay attention to the basics, experts say. Contrary to perception, adversaries often apply low-level tools and tactics to carry out attacks so basic practices such as timely patching and strong authentication can help mitigate them as well.

The Tibetan phishing campaign is one example. "Addressing this problem requires raising the low bar and making digital spying more expensive for adversaries," Nishihata says. "Much of the threat posed by the basic phishing techniques used in this operation could be blunted through use of security features like two-factor authentication."

Related Content:

 

 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16395
PUBLISHED: 2019-09-17
GnuCOBOL 2.2 has a stack-based buffer overflow in the cb_name() function in cobc/tree.c via crafted COBOL source code.
CVE-2019-16396
PUBLISHED: 2019-09-17
GnuCOBOL 2.2 has a use-after-free in the end_scope_of_program_name() function in cobc/parser.y via crafted COBOL source code.
CVE-2019-16199
PUBLISHED: 2019-09-17
eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process.
CVE-2019-16391
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php.
CVE-2019-16392
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.