Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/30/2018
03:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Phishing Campaign Underscores Threat from Low Budget, Low Skilled Attackers

For just over $1,000, a phishing operation successfully spied on members of the Tibetan community for 19 months, Toronto University's Citizen Lab found.

A recent digital spying operation targeted at the Tibetan community once again revealed just how little it takes for attackers to mount an effective malicious campaign these days.

Researchers at the University of Toronto's Citizen Lab were able to gain an inside view of the phishing campaign by taking advantage of some sloppy mistakes by the operator.

Over a period of eight months the researchers observed the operator setting up phishing lures, building fake Web pages, registering dozens of decoy domains, and sending emails to targeted individuals and organizations within the Tibetan community.

They estimated that during the 19 months when the operation was active, the attackers likely spent a mere $1,068 on infrastructure costs: $878 for domain registration and $190 for renting servers. Citizen Lab's researchers found that it took just basic Web development and system admin skills to run the operation, which though sloppy, was still surprisingly successful.

The attackers managed to compromise the email accounts of at least two of their intended targets and used their contact lists to send phishing lures to other targets. "We suspect there were likely other successful compromises beyond these accounts based on decoy documents we collected that appear to be private files likely extracted from compromised accounts," Citizen Lab's director Ronald Deibert said in a blog Tuesday.

According to Deibert, Citizen Lab was unable to find any evidence directly linking the operation to a specific criminal group or nation-state sponsor. But the group's targeting strongly suggests a China link: besides Tibetan activists, the operators also appeared to be interested in people from within China's Uyghur minority community, as well as a media group founded by members of the Falun Gong religious group, and other groups in Hong Kong and Burma.

It is possible the group behind the phishing campaign were freelancers or independent contractors working on behalf of a government agency in China. The sloppiness of the campaign suggests the threat actors were operating with little fear of getting caught. "The profile of the operator suggests it may be a low-level contractor," says Masashi Nishihata, research manager at Citizen Lab. "It is unclear how the operators selected targets. Nor is it clear if the operators had a specific sponsor and who was the ultimate consumer of data collected."

Citizen Lab's research showed how in addition to conducting malicious campaigns on the cheap, threat actors also often will use only what is necessary to meet their objectives. Few will ever resort to using sophisticated costly tools and attack methods if they can break into a target system using inexpensive, basic techniques. "This case shows that it doesn't take deep pockets or sophisticated technical skills to mount an effective digital spying operation. While the operation was done on the cheap, it had some successes," Nishihata says.

On a Low Budget

The Citizen Lab findings are similar to other reports that also have shown the enormous returns that criminals and cyber spies can garner from relatively meager investments. Last November, a Recorded Future report dissecting the costs of cybercrime operations found that an individual or group willing to spend between $3,500 and $5,000 on a botnet operation could easily net between 400% and 600% in direct and indirect returns.

Just like Citizen Lab discovered with the Tibetan phishing campaign, Recorded Future's researchers found that threat actors often require little technical skills to carry out lucrative campaigns. So many tools and services are available - and in such a wide price range - on the Dark Web that anyone from a newbie to a sophisticated nation-state actor can find something for their needs, Recorded Future found.

A Trend Micro report last October found that in some underground cyber markets — like those catering to the Middle East and North African threat community — there is almost no bar for entry for malicious actors. Many common attack tools, including those used for SQL injection, keystroke logging, and malware obfuscation, are available for free to members on these networks.

This trend highlights the need for organizations to pay attention to the basics, experts say. Contrary to perception, adversaries often apply low-level tools and tactics to carry out attacks so basic practices such as timely patching and strong authentication can help mitigate them as well.

The Tibetan phishing campaign is one example. "Addressing this problem requires raising the low bar and making digital spying more expensive for adversaries," Nishihata says. "Much of the threat posed by the basic phishing techniques used in this operation could be blunted through use of security features like two-factor authentication."

Related Content:

 

 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13842
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). A dangerous AT command was made available even though it is unused. The LG ID is LVE-SMP-200010 (June 2020).
CVE-2020-13843
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. Local users can cause a denial of service because checking of the userdata partition is mishandled. The LG ID is LVE-SMP-200014 (June 2020).
CVE-2020-13839
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via a custom AT command handler buffer overflow. The LG ID is LVE-SMP-200007 (June 2020).
CVE-2020-13840
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via an MTK AT command handler buffer overflow. The LG ID is LVE-SMP-200008 (June 2020).
CVE-2020-13841
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 9 and 10 (MTK chipsets). An AT command handler allows attackers to bypass intended access restrictions. The LG ID is LVE-SMP-200009 (June 2020).