Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10:30 AM
Connect Directly
E-Mail vvv

Attackers Aren't Invincible & We Must Use That to Our Advantage

The bad guys only seem infallible. Use their weaknesses to beat them.

Sixth and final installment in a series about the human element in cybersecurity. 

As we close out this series, we look outside of organizations to explore the human weaknesses of attackers. Unlike previous articles, in which we looked introspectively at the defenders and how to reduce mistakes, this installment examines the other side of the equation and how we can use attacker mistakes to our advantage.

Attackers are humans just like defenders and so are subject to the same errors and imperfections that we are. They can be single operators, members of a larger crime syndicate, nation-state actors, rogue organizations, or any one of a number of other "hackers." Their intent can be financial gain; retribution to an organization, individual, or employer; disruption or destruction; global dominance; or a variety of other motives. In this article, we use "attackers" to refer to the malware authors who develop the malware used in attacks, and the human hackers at the keyboard who utilize malware, social engineering, and other techniques to conduct cyberattacks on infrastructure, networks, applications, servers, data, and devices.

Common Mistakes
From the defender's perspective, one of the most advantageous mistakes that attackers make is writing a bug, error, or vulnerability into their code. Malware authors, who are programmers like the ones we discussed in our previous article, are not perfect. Prime examples of their imperfections include the "kill switch" found in early WannaCry ransomware malware and, more recently, exception handling errors in LockerGoga ransomware.

In addition, attackers often rely on the same or similar attacks. Attackers who are constrained by resources, time, or capabilities may turn to standard exploit kits and regularly use the same malware. Even when the malware files differ, segments of the malware code are often recycled and reused. Different malware files often point to the same infrastructure, such as the same command and control IP in multiple attacks. Moreover, even when entirely novel malware is used, attackers consistently use the same tactics, techniques, and procedures (TTPs).

When attackers make mistakes, they sometimes simply fail at achieving their desired goals of stealing, spying, exploitation, or disruption and are forced to spend more resources on a given attack. Furthermore, they provide a weakness that defenders can use to their advantage to better prevent, detect, and respond to attacks.

Maximize Mistakes
While our series has been focused on helping defenders understand how to minimize their mistakes, now we want to turn the tables and maximize attacker mistakes.

We can best capitalize on attacker mistakes of coding errors, malware, and TTP reuse and recycling by aggregating and sharing this threat intelligence. With the right data, defenders can build dossiers on threat actors, identify attacker motives and means, and then use this knowledge to limit attacker opportunity through threat modeling. While organizations can, and often do, develop their own threat intelligence, the fast and frequent exchange of threat intelligence among defenders amplifies the positive impact of this work.

For example, if an organization hit with an attack immediately shares that information with its peers, it can essentially help create a "cyber vaccine" that prevents other organizations from falling victim to the same attack. This can be particularly critical in cases of attacker coding errors because identifying these errors often requires malware analysis. Many organizations lack those advanced capabilities and must rely on more sophisticated teams for that analysis. Some security vendors have already begun to incorporate this exchange. When one customer sees a new attack, the associated threat intelligence is extracted and then incorporated into the product for the benefit of every customer.

Organizations can also encourage attacker mistakes and make the cost of an attack higher for the attacker by deploying advanced capabilities such as deception technologies and moving target defenses, which force the attacker to run in circles looking for the target and allow defenders to learn attacker TTPs in the process. Overall, by understanding attackers and their attack profiles, defenders can create an environment where attackers must invest more to make an attack successful.

Change the Paradigm
While society is beginning to understand that cybersecurity attacks are common and difficult to prevent, some organizations are still reluctant to reveal attack details out of fear that doing so would reflect poorly on the organization. As the subject matter experts on cybersecurity, we defenders have the responsibility to educate non-cybersecurity folks on the inevitability of attacks — and breaches — so that both are viewed as part of the cost of doing business in today's environment, and not weaknesses that were a result of someone dropping the ball. Organizations must be able to speak freely about attacks and incidents, without legal counsel restricting information-sharing out of concern that the data can and will be used against the organization in the future. With information sharing, we can collectively make the most out of attacker mistakes.

Cybersecurity is like an arms race. As we grow ever more dependent on technology and billions of interconnected devices, while generating an exponentially increasing volume of data (2.5 quintillion bytes of data at our current pace), we know that attackers will evolve and advance. Therefore, we defenders must evolve and advance as well. And we can make great strides toward doing so, toward getting better at our game and leveling the playing field, by recognizing and minimizing the inevitable human error of end users, security leaders, security analysts, IT security administrators, and programmers — and maximizing inescapable attacker error.

Related Content:



Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Roselle Safran is President of Rosint Labs, a cybersecurity consultancy to security teams, leaders, and startups. She is also the Entrepreneur in Residence at Lytical Ventures, a venture capital firm that invests in cybersecurity startups. Previously, Roselle was CEO and ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-14
An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user.
PUBLISHED: 2021-04-14
An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the va...
PUBLISHED: 2021-04-14
An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user.
PUBLISHED: 2021-04-14
An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead...
PUBLISHED: 2021-04-14
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.