Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

Study: Simulated Attacks Uncover Real-World Problems in IT Security

Some 70% of simulated attacks on real networks were able to move laterally within the network, while more than half infiltrated the perimeter and exfiltrated data.

Organizations continue to focus on protecting the perimeter while neglecting to monitor bad guys getting inside and ultimately pilfering data, says a security researcher at SafeBreach, which released a new report today.

In 3,400 breach methods used for 11.5 million attack simulations, SafeBreach in its new Hacker's Playbook Findings Report found that virtual attackers had a more than a 60% success rate of using malware to infiltrate networks. And once in, the malware could move laterally roughly 70% of the time. In half the cases, they could exit networks with data, according to simulated attacks SafeBreach conducted on its customers.

"The most surprising thing is that there is so much focus on the hard-candy shell of the perimeter without paying enough attention to the soft, squishy middle," says Chris Webber, a security strategist at SafeBreach. "It is not that hard to get past the perimeter and once the attacker is in, it is really easy to move around laterally and then exfiltrate out." 

Webber points to the amount of money and solutions he has seen customers pour into protecting the perimeter, yet the majority of simulated malware attacks were still able to move around and steal information.

When it comes to malware infiltration methods, the research found nesting, or "packing," malware executables fooled security controllers more than 50% of the time. For example, packed executables inside JavaScript had a 60.9% success rate of infiltrating a network, while an executable inside a VBScript (VBS) using HTTP managed to make it in 56.5%, and an executable inside a compiled HTML file format (CHM) extension had a 55.9% success rate.

But WannaCry 2.0's method of exploiting a server message block (SMB) vulnerability in Windows achieved a 63.4% success rate in simulated attacks SafeBreach performed, pushing it to the top of successful infiltration methods.

Financial malware Carbanak, which relies on Google's App Script, Sheets, and Forms cloud-based services to communicate its malware commands, also ranked among the top five infiltration methods used in the study. 

"So, in the case of Carbanak, the infiltration 'move' we highlighted was indeed the transfer of the specific Carbanak malware file via HTTP," Webber says. "This could be stopped, for example, by network controllers configured to scan for malicious files and block them before they make their way to the endpoints/hosts for installation to disk."

Concerns over lateral movement appear to be overlooked by a number of organizations, says Webber.

"Folks are focused on keeping things out and not worrying about the other phases of the kill chain," Webber says.

That approach could be a problem, the report notes, given Petya and EternalRocks were both identified as having worm-burrowing capabilities that could move laterally in the network.

Data exfiltration is the last hurdle cyberthieves face, and they usually opt for the easiest method of stealing data, the report found. Traditional clear or encrypted Web traffic, or traditional Web ports, are the preferred method for attackers to exit the network with their cache of data, according to the report.

"A lot of outbound traffic is making its way out through Port 443 (HTTPS) and Port 123 (NTP)," Webber says. "They are pumping out all of your data past your controls by stuffing the data into encrypted packets that look like packets for things like keeping time on your computer and sending it out over NTP [Network Time Protocal]."

Port 123 had a 63.1% exfiltration success rate and Port 443 had 53.7%, according to the report.

Fixing the Links

Webber says it is not enough to try to stop attackers from breaking into the network, nor is it adequate to try to box them in by preventing their entry and exit. Paying attention to lateral moves within the network is also important, he notes.

However, organizations face limited resources. "It comes down to understanding each company. If you have a ton of credit card data, then you spend all the more time from preventing them from exiting the network. But if you have a manufacturing company, then you are more concerned about getting hit with a ransomware attack that can stop your operations. You would probably care more about internal segmentation to prevent worms from moving across your system," he says.

He adds that the best moves companies can take to secure their systems is to optimize their current security solutions, constantly update the configurations as needed, and then test the changes they make.

Related Content:

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2079
PUBLISHED: 2019-11-22
A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
CVE-2019-11325
PUBLISHED: 2019-11-21
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
CVE-2019-18887
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
CVE-2019-18888
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. T...
CVE-2019-18889
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.