Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/24/2019
10:30 AM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Attackers Aren't Invincible & We Must Use That to Our Advantage

The bad guys only seem infallible. Use their weaknesses to beat them.

Sixth and final installment in a series about the human element in cybersecurity. 

As we close out this series, we look outside of organizations to explore the human weaknesses of attackers. Unlike previous articles, in which we looked introspectively at the defenders and how to reduce mistakes, this installment examines the other side of the equation and how we can use attacker mistakes to our advantage.

Attackers
Attackers are humans just like defenders and so are subject to the same errors and imperfections that we are. They can be single operators, members of a larger crime syndicate, nation-state actors, rogue organizations, or any one of a number of other "hackers." Their intent can be financial gain; retribution to an organization, individual, or employer; disruption or destruction; global dominance; or a variety of other motives. In this article, we use "attackers" to refer to the malware authors who develop the malware used in attacks, and the human hackers at the keyboard who utilize malware, social engineering, and other techniques to conduct cyberattacks on infrastructure, networks, applications, servers, data, and devices.

Common Mistakes
From the defender's perspective, one of the most advantageous mistakes that attackers make is writing a bug, error, or vulnerability into their code. Malware authors, who are programmers like the ones we discussed in our previous article, are not perfect. Prime examples of their imperfections include the "kill switch" found in early WannaCry ransomware malware and, more recently, exception handling errors in LockerGoga ransomware.

In addition, attackers often rely on the same or similar attacks. Attackers who are constrained by resources, time, or capabilities may turn to standard exploit kits and regularly use the same malware. Even when the malware files differ, segments of the malware code are often recycled and reused. Different malware files often point to the same infrastructure, such as the same command and control IP in multiple attacks. Moreover, even when entirely novel malware is used, attackers consistently use the same tactics, techniques, and procedures (TTPs).

Repercussions
When attackers make mistakes, they sometimes simply fail at achieving their desired goals of stealing, spying, exploitation, or disruption and are forced to spend more resources on a given attack. Furthermore, they provide a weakness that defenders can use to their advantage to better prevent, detect, and respond to attacks.

Maximize Mistakes
While our series has been focused on helping defenders understand how to minimize their mistakes, now we want to turn the tables and maximize attacker mistakes.

We can best capitalize on attacker mistakes of coding errors, malware, and TTP reuse and recycling by aggregating and sharing this threat intelligence. With the right data, defenders can build dossiers on threat actors, identify attacker motives and means, and then use this knowledge to limit attacker opportunity through threat modeling. While organizations can, and often do, develop their own threat intelligence, the fast and frequent exchange of threat intelligence among defenders amplifies the positive impact of this work.

For example, if an organization hit with an attack immediately shares that information with its peers, it can essentially help create a "cyber vaccine" that prevents other organizations from falling victim to the same attack. This can be particularly critical in cases of attacker coding errors because identifying these errors often requires malware analysis. Many organizations lack those advanced capabilities and must rely on more sophisticated teams for that analysis. Some security vendors have already begun to incorporate this exchange. When one customer sees a new attack, the associated threat intelligence is extracted and then incorporated into the product for the benefit of every customer.

Organizations can also encourage attacker mistakes and make the cost of an attack higher for the attacker by deploying advanced capabilities such as deception technologies and moving target defenses, which force the attacker to run in circles looking for the target and allow defenders to learn attacker TTPs in the process. Overall, by understanding attackers and their attack profiles, defenders can create an environment where attackers must invest more to make an attack successful.

Change the Paradigm
While society is beginning to understand that cybersecurity attacks are common and difficult to prevent, some organizations are still reluctant to reveal attack details out of fear that doing so would reflect poorly on the organization. As the subject matter experts on cybersecurity, we defenders have the responsibility to educate non-cybersecurity folks on the inevitability of attacks — and breaches — so that both are viewed as part of the cost of doing business in today's environment, and not weaknesses that were a result of someone dropping the ball. Organizations must be able to speak freely about attacks and incidents, without legal counsel restricting information-sharing out of concern that the data can and will be used against the organization in the future. With information sharing, we can collectively make the most out of attacker mistakes.

Conclusion
Cybersecurity is like an arms race. As we grow ever more dependent on technology and billions of interconnected devices, while generating an exponentially increasing volume of data (2.5 quintillion bytes of data at our current pace), we know that attackers will evolve and advance. Therefore, we defenders must evolve and advance as well. And we can make great strides toward doing so, toward getting better at our game and leveling the playing field, by recognizing and minimizing the inevitable human error of end users, security leaders, security analysts, IT security administrators, and programmers — and maximizing inescapable attacker error.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Roselle Safran is President of Rosint Labs, a cybersecurity consultancy to security teams, leaders, and startups. She is also the Entrepreneur in Residence at Lytical Ventures, a venture capital firm that invests in cybersecurity startups. Previously, Roselle was CEO and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: -when I told you that our cyber-defense was from another age
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18934
PUBLISHED: 2019-11-19
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with `--enable-ipsecmod` support, and ipsecmod is enabled and used in the configuration.
CVE-2012-6070
PUBLISHED: 2019-11-19
Falconpl before 0.9.6.9-git20120606 misuses the libcurl API which may allow remote attackers to interfere with security checks.
CVE-2012-6071
PUBLISHED: 2019-11-19
nuSOAP before 0.7.3-5 does not properly check the hostname of a cert.
CVE-2012-6135
PUBLISHED: 2019-11-19
RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.
CVE-2016-10002
PUBLISHED: 2019-11-19
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.