Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/2/2019
02:00 PM
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

In Cybercrime's Evolution, Active, Automated Attacks Are the Latest Fad

Staying ahead can feel impossible, but understanding that perfection is impossible can free you to make decisions about managing risk.

Every few years, there is a significant and often unexpected shift in the tactics that online criminals use to exploit us for profit. In the early 2000s, criminals ran roughshod through people's computers by exploiting simple buffer overflows and scripting flaws in email clients and using SQL injection attacks. That evolved into drive-by downloads through flaws in browsers and their clunky plug-ins. Late in the decade, criminals began employing social components, initially offering up fake antivirus products and then impersonating law enforcement agencies to trick us into paying imaginary fines and tickets. In 2013, someone got the bright idea to recycle an old trick at mass scale: ransomware.

If history has taught us anything, it's that there are cycles to threats, and at some point in the future, ransomware as we know it today will begin to wane and morph into a new type of attack. Many factors can lead to the end of a good scam. In this case, we have finally removed Java and Adobe Flash Player from most of our home PCs, our browsers keep themselves up to date, and Windows, Mac, and even Linux largely update themselves with reasonable regularity.

This of course hasn't eliminated "spray and pray" malware. It has just made it less profitable. The majority of ransomware infections these days seem to originate via email and are affecting lower volumes of victims than in the heyday of mass web exploitation.

While there has always been a divide between unskilled and skilled cybercriminals, with the declining utility and increasing risk of traditional tactics, at least some of the latter are beginning to recognize that they need to up their game.

Unskilled online criminals will continue to pay for spam runs or hire already infected PCs to indiscriminately distribute commodity malware. The others? They've got a new scam. And it isn't something that is likely to catch on with the script kiddies. They're going out and behaving as rogue penetration testers.

We first noticed this with the SamSam gang. They were able to operate discreetly enough that it took the community nearly two years to notice. Why? They operated at low volume. Few samples made it to services like VirusTotal, few victims were important enough to garner attention, and few security vendors noticed the blips in their statistical analysis of enormous malware volumes.

Penetration testing takes skill, but it also takes patience. To many people with hacking skills, getting paid to break into systems sounds like a dream come true until they face the reality. The goal isn't just to break in; the real goal is to document how you broke in and write a report about it. Cybercriminals are simply bypassing this boring part and infecting the systems with malware instead.

These "criminal penetration tests" are seemingly very successful. While SamSam wrote the blueprint, we have seen the pattern copied by LockerGoga, MegaCortex, Ryuk, and others.

The attack pattern we're seeing/we've seen goes like this:

1. Find some low-hanging fruit.

  • Do a Shodan search for open RDP.
  • Find a vulnerable service exposed in DMZ.
  • Hire already infected machines from botnet operator.

2. Sort through results and pick interesting targets.
3. Identify computers that hold interesting or sensitive data.
4. Encrypt, ransom, or steal data for profit.

I think that this is a significant change in behavior and it brings us to an important change in tactic: the automated, active attack.

This blended approach, using both automated discovery and human intelligence to choose targets, combined with the deployment of low-volume custom malware, is enough to severely cripple most organizations. Most organizations' defenses are only prepared to deal with automated malware distribution, not semitargeted attacks.

This approach is very lucrative for cybercriminals because it can yield anywhere from $50,000 to over $1 million per victim, and can be targeted at nearly any organization. Even the smallest of firms potentially have tens of thousands of dollars on hand when it's time for payroll, and if they don't have backups, paying the ransom could be their best option.

While security through obscurity is a terrible idea with regard to cryptography, it can't hurt when applied to information security. By no means should it be your only strategy, but simply upping your game a few notches can help you avoid being discovered through the simple scans and spams that criminals are using to initiate these attacks.

As mentioned, patterns have begun to emerge out of investigations of these attacks. The SamSam group, and others as well, have frequently sought out improperly exposed remote desktop (RDP) connections. Requiring a VPN, multifactor authentication or strong, unique passwords would prevent many attacks. Disabling web server banners advertising precise versions of helper software like PHP, Perl, Ruby, or even your CMS type can help you avoid being identified by unsophisticated automated scans.

Better yet is building a culture of security within your organization and focusing on how you can increase the maturity of your security preparedness. Keeping up is hard and staying ahead can feel impossible, but understanding that you can't be perfect can free you to make decisions about managing risk rather trying to do the impossible.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Chester Wisniewski has been involved in the information security industry since the late 1980s. He is currently a principal research scientist in the Office of the CTO at Sophos. Chet divides his time between research, public speaking, writing and attempting to communicate ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8818
PUBLISHED: 2020-02-25
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore...
CVE-2020-8819
PUBLISHED: 2020-02-25
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass ...
CVE-2020-9385
PUBLISHED: 2020-02-25
A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c, when called from eanx in upcean.c during EAN barcode generation.
CVE-2020-9382
PUBLISHED: 2020-02-24
An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defined by this extension) via MediaWiki's } parser function.
CVE-2020-1938
PUBLISHED: 2020-02-24
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that ...