Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/2/2013
11:06 AM
Levi Gundert
Levi Gundert
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Zero-Day Drive-By Attacks: Accelerating & Expanding

The zero-day attack business is no longer just about money, and patching is no longer the best defense.

Similar to a criminal drive-by, the watering-hole attack redirects unsuspecting victims; the difference is that the redirection (usually via obfuscated JavaScript) is placed on a carefully chosen website where the intended victim will likely browse in the course of their daily employment activities. Indiscriminately exploiting victims is pointless for nation state actors, rather it is a select group of targets that must be compromised in order for the attack to be deemed a success (which for them may entail a better-than-average holiday bonus).

Further, because the intended victims’ computers may be fully patched, nation state actors don’t need a full exploit pack. Instead they can rely on one or two zero-day exploits. (A “zero-day” is security industry jargon for exploit code that targets a previously unknown software vulnerability.) Since government resources are exponentially larger than criminals’, zero-day exploits are purchased from third party brokers or developed internally and used in watering-hole attacks to increase the chances of success.

Two such attacks occurred in May. The first campaign compromised the US Department of Labor’s Site Exposure Matrices (SEM) website -- a very specific watering-hole -- and injected JavaScript code which redirected visitors to dol.ns01.us. Naturally, this website was hosting a zero-day exploit for Internet Explorer (CVE-2013-1347). Following successful exploitation a Remote Access Trojan (RAT) was installed on the victim’s computer.

Subsequent attacks occurred in the same fashion days later when oil and energy company websites were modified to host redirection code. Ten oil/energy sites redirected victims to three different websites hosting exploits. In fact the same Department of Labor Internet Explorer zero day exploit was used in tandem with a Java (CVE-2012-1723) and Firefox/Thunderbird (CVE-2013-1690) exploit. While a zero-day exploit doesn’t remain zero day for long, it is a powerful tool with plenty of potency for quick and targeted campaigns.

Unfortunately the use of zero day-exploits in drive-by attacks appears to be accelerating. In the past two months different zero-day exploits for Internet Explorer were discovered as part of larger strategic web compromise attack campaigns. In the most recent attack a RAT was installed on victim computers and in October Microsoft released a security advisory citing a different Internet Explorer vulnerability that was actively being exploited in Asia.

It’s evident that governments, businesses, and individuals are all at risk for drive-by attacks. When dealing with the criminal set and their exploit packs the answer has always been, patch! Since exploit packs historically bundle large amounts of shell code corresponding to known vulnerabilities, the most efficient method for "p0wnage" prevention was a robust vulnerability identification and security patch management program. Zero-day exploits make this defensive strategy obsolete. So the question becomes what is the answer when comprehensive patching is no longer the solution?

A sensible answer is behavior scoring because there are plenty of common malicious indicators between recent attacks. One practical way to implement the scoring is via a web proxy, specifically to fetch and preview web content before serving it to the requestor. The presence of obfuscated JavaScript code, redirection tags, shell code, and dynamic DNS domains can all be scored, and any content above the tolerance threshold should be rejected before it impacts the end user. Nevertheless, nation state attackers’ behaviors and methodologies will evolve and new defense strategies will need to be implemented.

Finally, it’s not the end of the world if a watering-hole attack succeeds, so long as network (and ideally host) security monitoring programs detect the breach before the company or agency’s intellectual property crown jewels are removed.

Drive-by attacker’s planning and timing can’t be prevented, but we can remove the weapon’s effectiveness.

 

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/3/2013 | 3:40:05 PM
Re: Patching not enough
That's a great observation and point about how, to quote Gartner,  information security is becoming a big data problem that will require a major shift in mind set and skills sets of security professionals. 

 

 

 
levigundert
50%
50%
levigundert,
User Rank: Guru
12/3/2013 | 1:56:44 PM
Re: Patching not enough
Absolutely. If the solution is going to be homegrown, the required resources - primarily human and time - are going to be substantial. It's more likely (especially for small and medium size businesses) that a behavioral prevention product will be purchased from a vendor that is already spending considerable resources on acquiring the right data and hiring top data science talent.

It's certainly possible to create an in-house solution, but it's likely to be cost-prohibitive for all but the largest organizations. Many of the Big Data tools are open source and straight forward to setup, but the barriers to entry are high for acquiring the data and talent necessary to compete with security vendor efforts.

That being said, security professionals should become familiar with Big Data tools and methodologies because it's the future of agile security programs.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/3/2013 | 12:33:23 PM
Re: Patching not enough
"...big data insight, talented data scientists, and evolving predicative signal identification.." that seems like a pretty steep learning curve for today's typical  information security professional, not to mention a totally different orientation. What do you think the corporate security team would look like in order to successfully develop and manage a behavioral solution? 
levigundert
50%
50%
levigundert,
User Rank: Guru
12/3/2013 | 12:00:24 PM
Re: Patching not enough
Thanks for the question Marilyn. Quite a few security vendors are currently competing to provide superior behavior scoring solutions. I'm obviously partial to what we're doing at Cisco with our cloud based approach, but the point is that subscribing to static threat intelligence lists - malicious IP addresses, domains, etc. - and creating derivative access lists (ACLs) is only going to protect users up to a point. From a risk management perspective that may be enough, but I think most INFOSEC departments realize that the emergence of zero day drive-by campaigns means new solutions are required.

A successful behavioral security solution is predicated on: big data insight, talented data scientists, and evolving predicative signal identification. This space is still new and I don't have proprietary metrics from different security providers specifically around zero day drive-by attacks, but I do know that businesses are interested in proven behavioral solutions.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
12/3/2013 | 9:38:04 AM
Patching not enough
Thanks for your detailed overview of the evolution of the zero-day attack, Levi. You make a great case for the need for new defenses that go beyond vulnerability identification and patch management. In terms of a "sensible" solution such as behavior scoring, where are you seeing that approach being adopted and how successful it is to date? 
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This is not what I meant by "I would like to share some desk space"
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27221
PUBLISHED: 2021-01-21
In Eclipse OpenJ9 up to version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
CVE-2021-1067
PUBLISHED: 2021-01-20
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the implementation of the RPMB command status, in which an attacker can write to the Write Protect Configuration Block, which may lead to denial of service or escalation of privileges.
CVE-2021-1068
PUBLISHED: 2021-01-20
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVDEC component, in which an attacker can read from or write to a memory location that is outside the intended boundary of the buffer, which may lead to denial of service or escalation of privileges.
CVE-2021-1069
PUBLISHED: 2021-01-20
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVHost function, which may lead to abnormal reboot due to a null pointer reference, causing data loss.
CVE-2020-26252
PUBLISHED: 2021-01-20
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server ...