Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/2/2019
02:00 PM
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

In Cybercrime's Evolution, Active, Automated Attacks Are the Latest Fad

Staying ahead can feel impossible, but understanding that perfection is impossible can free you to make decisions about managing risk.

Every few years, there is a significant and often unexpected shift in the tactics that online criminals use to exploit us for profit. In the early 2000s, criminals ran roughshod through people's computers by exploiting simple buffer overflows and scripting flaws in email clients and using SQL injection attacks. That evolved into drive-by downloads through flaws in browsers and their clunky plug-ins. Late in the decade, criminals began employing social components, initially offering up fake antivirus products and then impersonating law enforcement agencies to trick us into paying imaginary fines and tickets. In 2013, someone got the bright idea to recycle an old trick at mass scale: ransomware.

If history has taught us anything, it's that there are cycles to threats, and at some point in the future, ransomware as we know it today will begin to wane and morph into a new type of attack. Many factors can lead to the end of a good scam. In this case, we have finally removed Java and Adobe Flash Player from most of our home PCs, our browsers keep themselves up to date, and Windows, Mac, and even Linux largely update themselves with reasonable regularity.

This of course hasn't eliminated "spray and pray" malware. It has just made it less profitable. The majority of ransomware infections these days seem to originate via email and are affecting lower volumes of victims than in the heyday of mass web exploitation.

While there has always been a divide between unskilled and skilled cybercriminals, with the declining utility and increasing risk of traditional tactics, at least some of the latter are beginning to recognize that they need to up their game.

Unskilled online criminals will continue to pay for spam runs or hire already infected PCs to indiscriminately distribute commodity malware. The others? They've got a new scam. And it isn't something that is likely to catch on with the script kiddies. They're going out and behaving as rogue penetration testers.

We first noticed this with the SamSam gang. They were able to operate discreetly enough that it took the community nearly two years to notice. Why? They operated at low volume. Few samples made it to services like VirusTotal, few victims were important enough to garner attention, and few security vendors noticed the blips in their statistical analysis of enormous malware volumes.

Penetration testing takes skill, but it also takes patience. To many people with hacking skills, getting paid to break into systems sounds like a dream come true until they face the reality. The goal isn't just to break in; the real goal is to document how you broke in and write a report about it. Cybercriminals are simply bypassing this boring part and infecting the systems with malware instead.

These "criminal penetration tests" are seemingly very successful. While SamSam wrote the blueprint, we have seen the pattern copied by LockerGoga, MegaCortex, Ryuk, and others.

The attack pattern we're seeing/we've seen goes like this:

1. Find some low-hanging fruit.

  • Do a Shodan search for open RDP.
  • Find a vulnerable service exposed in DMZ.
  • Hire already infected machines from botnet operator.

2. Sort through results and pick interesting targets.
3. Identify computers that hold interesting or sensitive data.
4. Encrypt, ransom, or steal data for profit.

I think that this is a significant change in behavior and it brings us to an important change in tactic: the automated, active attack.

This blended approach, using both automated discovery and human intelligence to choose targets, combined with the deployment of low-volume custom malware, is enough to severely cripple most organizations. Most organizations' defenses are only prepared to deal with automated malware distribution, not semitargeted attacks.

This approach is very lucrative for cybercriminals because it can yield anywhere from $50,000 to over $1 million per victim, and can be targeted at nearly any organization. Even the smallest of firms potentially have tens of thousands of dollars on hand when it's time for payroll, and if they don't have backups, paying the ransom could be their best option.

While security through obscurity is a terrible idea with regard to cryptography, it can't hurt when applied to information security. By no means should it be your only strategy, but simply upping your game a few notches can help you avoid being discovered through the simple scans and spams that criminals are using to initiate these attacks.

As mentioned, patterns have begun to emerge out of investigations of these attacks. The SamSam group, and others as well, have frequently sought out improperly exposed remote desktop (RDP) connections. Requiring a VPN, multifactor authentication or strong, unique passwords would prevent many attacks. Disabling web server banners advertising precise versions of helper software like PHP, Perl, Ruby, or even your CMS type can help you avoid being identified by unsophisticated automated scans.

Better yet is building a culture of security within your organization and focusing on how you can increase the maturity of your security preparedness. Keeping up is hard and staying ahead can feel impossible, but understanding that you can't be perfect can free you to make decisions about managing risk rather trying to do the impossible.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Chester Wisniewski has been involved in the information security industry since the late 1980s. He is currently a principal research scientist in the Office of the CTO at Sophos. Chet divides his time between research, public speaking, writing and attempting to communicate ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17210
PUBLISHED: 2019-07-20
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass t...
CVE-2019-12934
PUBLISHED: 2019-07-20
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
CVE-2019-9229
PUBLISHED: 2019-07-20
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can...
CVE-2019-12815
PUBLISHED: 2019-07-19
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
CVE-2019-13569
PUBLISHED: 2019-07-19
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.