Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/20/2018
04:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

'Hidden Tunnels' Help Hackers Launch Financial Services Attacks

Hackers are using the infrastructure, meant to transmit data between applications, for command and control.

The security tools and strategies financial services organizations use to protect their data could be leveraged by cybercriminals who sneak in undetected via "hidden tunnels" to conceal their theft, according to a new report published by Vectra.

Ironically, financial firms have the biggest non-government security budgets in the world, Vectra says. Bank of America invests more than $600 million in cybersecurity each year, while JPMorgan Chase spends $500 million. Equifax, while smaller than both, spends an annual $85 million on security.

Yet, in Equifax's case – despite budget, staff, and a security operations center – in 2017 it took 78 days for it to detect a massive breach of its network, in which attackers accessed 145.5 million Social Security numbers, 17.6 million driver's license numbers, 20.3 million phone numbers, and 1.8 million email addresses.

The question of how attackers were able to exfiltrate so much data, and whether the same thing could happen at another financial firm, prompted Vectra researchers to take a closer look at exactly what happened.

A Review of the Equifacts
Equifax's breach started when a Web server was exploited to access the corporate network. The attackers avoided using tools that would alert the company's security team, instead building command-and-control (C&C) tunnels into Equifax. They installed more than 30 Web shells with different addresses to burrow into Equifax and, once inside the network, customized their hacking tools to exploit Equifax software, evade firewalls, and exfiltrate information.

For six months following the Equifax breach, Vectra researchers combed metadata from 246 opt-in customers and more than 4.5 million devices to learn more about attacker behaviors and network trends. They found the same activity that led to the Equifax breach is prevalent throughout the financial services industry.

What stood out most is the use of hidden tunnels in HTTP, HTTPS, and DNS traffic, which threat actors use to get into networks protected with strong access controls. These tunnels have been used for about three to four years, says Chris Morales, head of security analytics at Vectra, where researchers had been looking into this tactic long before Equifax was hit.

"Attackers don't use hidden tunnels unless they have to," he explains. When enterprise security defenses are strong, threat actors have to seek new ways to break through them.

Tunneling Into Financial Services
Financial firms have stronger security than most, securing Web applications with layers upon layers of access controls. Because apps are locked down, data has to be sent through "hidden tunnels" to move across an organization. There are legitimate use cases for this: Specific stock-tickers commercial apps and internal financial services use tunnels to communicate.

The high volume of traffic flowing to and from enterprise Web applications creates an ideal place for attackers to hide, Morales says. Hidden tunnels are tough to detect because communications are hidden within connections that use normal, permitted protocols. Messages can be embedded as text in headers, cookies, and other fields, researchers say.

Morales breaks down how an attack might work: A threat actor might start with an entry point as simple as a phishing campaign. With a foothold in the organization, the attactor can use reconnaissance techniques to learn the network – the number of devices and how he can make his footprint more durable and infect more machines.

"As he does all those things, he'll need to find ways to look like normal traffic," Morales explains. "Maybe he'll find a network scanning machine and perform recon from there because it'll look more normal." Once a tunnel is established, the hacker passes data in small chunks so it isn't picked up by anomaly detection systems.

Attackers could leverage tools purchased on the Dark Web to exfiltrate data and bypass access controls. "The tools are out there, and attackers have a great ecosystem for sharing them," says Mike Banic, vice president of marketing at Vectra. "In some cases, their ecosystem could be better than the defenders."

Compared with the industry average, there are fewer C&C behaviors in financial services, and HTTP C&C communications are lower overall, the report states. However, there are significantly more tunnels per 10,000 devices in financial services than all other industries combined.

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
6/26/2018 | 10:59:41 PM
Re: On Equifax
> results driven at the expense of ALL ELSE which means downtime is bad.  And that means application of security patches can be delayed forever.

And that means problems at the highest levels just as much as it means problems at the lower levels. What do you want to bet the reporting structure was such that the CISO was reporting to the CIO despite the conflict of interest?
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
6/26/2018 | 10:58:05 PM
Re: On Equifax
@REISEN: Indeed. For the CEO to present that (let alone think that), it suggests that there was a fundamental failure in how the CISO position was handled. I tend to suspect that Equifax's CISO was treated as the typical lower-case-c-suiter that the role is too often treated as -- as opposed to someone who is actually at the strategy table.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
6/21/2018 | 3:56:19 PM
Re: On Equifax
It is an interesting place, certainly not a FUN work environment - look up reviews and it seems fairly political and results driven at the expense of ALL ELSE which means downtime is bad.  And that means application of security patches can be delayed forever.
gif-washco
50%
50%
gif-washco,
User Rank: Strategist
6/21/2018 | 3:33:25 PM
Re: On Equifax
I agree. If the organization has good leadership and IT management processes, a single person would not have caused such a problem (or used as an excuse, in this case). The true issue with Equifax is leadership and management, not a single person who may have not patched a server. When the entire Equifax board of directors were re-elected after the massive security breach and no ramifications were incurred by this same BoD, the lack of responsbile leadership is telling...

 

 
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
6/21/2018 | 7:59:10 AM
On Equifax
Telling story in more ways than one - excellent analysis of what went bad at Equifax and in telling contrast to the stupid comment by the ex-CEO that the entire breach - ALL OF IT - was due to one, repeat, ONE IT staffer who failed to apply an update.  Incredible ignorance level at the C-Suite.  And respect falls away rapidly thereafter for their understanding of IT in general ( OUTSOURCE, CUT EXPENSE ) and securityin particular.
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.