Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/22/2018
02:44 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Cybercriminals Battle Against Banks' Incident Response

'Filess' attacks account for more than half of successful breaches of bank networks, new data shows.

Financial institutions traditionally have established some of the most secure perimeters and defenses against cybercriminals and nation-state actors, but new studies show how they often struggle to detect or quell ongoing attacks that have infiltrated their internal networks.

CISOs from major financial firms surveyed and interviewed recently by Carbon Black say they're seeing attackers moving across their networks under the cover of legitimate applications and tools such as Windows PowerShell (89%), Windows Management Interface (59%), and SSH (28%). Those camouflaged, memory-based attacks – aka file less attacks – were used in more than half of successful breaches of the bank networks, according to Carbon Black.

In addition to the usual Windows utility suspects, Google Drive, unsigned digital certificates, and legit processes hiding malicious code (aka process hollowing), each were found in about 10% of cases at banks.

Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies, says these methods work for the bad guys because banks often don't pay close attention to the security of their internal networks. Her firm, which provides penetration testing to banks in Europe and elsewhere, uses legitimate tools in those engagements. "When doing pen tests, we try to act as close as possible to the actions of the attacker - including 'living off the land' - so that the organization can understand how well its internal monitoring tools for attacks like SIEM or SOC work," she says.

The pen testers run Mimikatz PowerShell version as well as the "procdump" utility, where they copy operating system memory. "You can extract passwords from this dump on your laptop, which naturally will go unnoticed by the protection systems. Such methods show high efficiency," she days, with the pen testers able to steal passwords from the operating system memory using Mimikatz in 100% of banks they tested.

Persistent attackers aren't backing down when banks detect them and launch their incident response processes, either. One in four bank CISOs in the Carbon Black study say their institution faced attackers fighting back when they got spotted, trying to deter defenses and the investigation into the attack.

"They are leaving wipers or destructive malware to inhibit [IR], deleting logs, and inhibiting the capacity of forensics tools," for example, says Tom Kellermann, chief cybersecurity officer at Carbon Black. "Sometimes they are using DDoS to create smokescreens during events."

These counter-IR activities are forcing banks to be be more proactive and aggressive as well, he says. "They need to have threat hunting teams. You can't just rely on telemetry and alerts."

While banks are often relying on their IR playbooks, attackers have the freedom to freelance and counter IR activities. They're changing their malware code on the fly when it gets detected, deleting activity logs to hide their tracks, and even targeting bank security analysts and engineers to help their cause. Carbon Black found in its study that one in ten bank victims say they spotted secondary command-and-control infrastructure set up in their networks – which can make response even more difficult.

Positive Technologies' Galloway says attackers also encrypt their data transmissions over the victim's network, falsify time-stamps in files, and employ file compressors and anti-debugging methods that can thwart discovery of their activity and tools.

While 90% of banks in the Carbon Black survey said they had experienced a ransomware attack threat, Kellermann says another data point appears more ominous: one in ten had spotted destructive attacks that were not ransomware-related.  "I think that's going to grow," he says, as attack groups use destructive malware such as data-wipers to "burn the house down" on their way out for cover or to send a message.

"The real dangers to financial institutions isn't just dealing with identity fraud and wire fraud," Kellermann says.

Pen testers at Positive Technologies, meantime, found gaping holes in their bank client networks: 75% of banks had employees who opened links in phishing attack tests, and 25% of them provided their credentials in a phony authentication form in the test. Positive Technologies' analysts were able to access banks' financial applications in 58% of their engagements, and compromise ATM management workstations in 25% of the cases, according to a report published this week.

And banks weren't savvy at catching the pen-tests, either. "The actions of pen testers were noticed by security employees in less than 10% of banks that we tested," Galloway says.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RobiP
50%
50%
RobiP,
User Rank: Strategist
6/14/2018 | 5:50:11 PM
Better Network Forensics
This post validates the re-energed focus on better network forensics.  Attackers will find the unprotected hosts and hide, but it's harder to hide movements on the network.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: He still insists that security by obscurity is the way to go.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9681
PUBLISHED: 2019-09-17
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X...
CVE-2019-9009
PUBLISHED: 2019-09-17
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.
CVE-2018-20336
PUBLISHED: 2019-09-17
An issue was discovered in Asuswrt-Merlin 384.6. There is a stack-based buffer overflow issue in parse_req_queries function in wanduck.c via a long string over UDP, which may lead to an information leak.
CVE-2019-12755
PUBLISHED: 2019-09-17
Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby there is an unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.
CVE-2019-14826
PUBLISHED: 2019-09-17
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.