Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/2/2019
02:00 PM
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

In Cybercrime's Evolution, Active, Automated Attacks Are the Latest Fad

Staying ahead can feel impossible, but understanding that perfection is impossible can free you to make decisions about managing risk.

Every few years, there is a significant and often unexpected shift in the tactics that online criminals use to exploit us for profit. In the early 2000s, criminals ran roughshod through people's computers by exploiting simple buffer overflows and scripting flaws in email clients and using SQL injection attacks. That evolved into drive-by downloads through flaws in browsers and their clunky plug-ins. Late in the decade, criminals began employing social components, initially offering up fake antivirus products and then impersonating law enforcement agencies to trick us into paying imaginary fines and tickets. In 2013, someone got the bright idea to recycle an old trick at mass scale: ransomware.

If history has taught us anything, it's that there are cycles to threats, and at some point in the future, ransomware as we know it today will begin to wane and morph into a new type of attack. Many factors can lead to the end of a good scam. In this case, we have finally removed Java and Adobe Flash Player from most of our home PCs, our browsers keep themselves up to date, and Windows, Mac, and even Linux largely update themselves with reasonable regularity.

This of course hasn't eliminated "spray and pray" malware. It has just made it less profitable. The majority of ransomware infections these days seem to originate via email and are affecting lower volumes of victims than in the heyday of mass web exploitation.

While there has always been a divide between unskilled and skilled cybercriminals, with the declining utility and increasing risk of traditional tactics, at least some of the latter are beginning to recognize that they need to up their game.

Unskilled online criminals will continue to pay for spam runs or hire already infected PCs to indiscriminately distribute commodity malware. The others? They've got a new scam. And it isn't something that is likely to catch on with the script kiddies. They're going out and behaving as rogue penetration testers.

We first noticed this with the SamSam gang. They were able to operate discreetly enough that it took the community nearly two years to notice. Why? They operated at low volume. Few samples made it to services like VirusTotal, few victims were important enough to garner attention, and few security vendors noticed the blips in their statistical analysis of enormous malware volumes.

Penetration testing takes skill, but it also takes patience. To many people with hacking skills, getting paid to break into systems sounds like a dream come true until they face the reality. The goal isn't just to break in; the real goal is to document how you broke in and write a report about it. Cybercriminals are simply bypassing this boring part and infecting the systems with malware instead.

These "criminal penetration tests" are seemingly very successful. While SamSam wrote the blueprint, we have seen the pattern copied by LockerGoga, MegaCortex, Ryuk, and others.

The attack pattern we're seeing/we've seen goes like this:

1. Find some low-hanging fruit.

  • Do a Shodan search for open RDP.
  • Find a vulnerable service exposed in DMZ.
  • Hire already infected machines from botnet operator.

2. Sort through results and pick interesting targets.
3. Identify computers that hold interesting or sensitive data.
4. Encrypt, ransom, or steal data for profit.

I think that this is a significant change in behavior and it brings us to an important change in tactic: the automated, active attack.

This blended approach, using both automated discovery and human intelligence to choose targets, combined with the deployment of low-volume custom malware, is enough to severely cripple most organizations. Most organizations' defenses are only prepared to deal with automated malware distribution, not semitargeted attacks.

This approach is very lucrative for cybercriminals because it can yield anywhere from $50,000 to over $1 million per victim, and can be targeted at nearly any organization. Even the smallest of firms potentially have tens of thousands of dollars on hand when it's time for payroll, and if they don't have backups, paying the ransom could be their best option.

While security through obscurity is a terrible idea with regard to cryptography, it can't hurt when applied to information security. By no means should it be your only strategy, but simply upping your game a few notches can help you avoid being discovered through the simple scans and spams that criminals are using to initiate these attacks.

As mentioned, patterns have begun to emerge out of investigations of these attacks. The SamSam group, and others as well, have frequently sought out improperly exposed remote desktop (RDP) connections. Requiring a VPN, multifactor authentication or strong, unique passwords would prevent many attacks. Disabling web server banners advertising precise versions of helper software like PHP, Perl, Ruby, or even your CMS type can help you avoid being identified by unsophisticated automated scans.

Better yet is building a culture of security within your organization and focusing on how you can increase the maturity of your security preparedness. Keeping up is hard and staying ahead can feel impossible, but understanding that you can't be perfect can free you to make decisions about managing risk rather trying to do the impossible.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Chester Wisniewski has been involved in the information security industry since the late 1980s. He is currently a principal research scientist in the Office of the CTO at Sophos. Chet divides his time between research, public speaking, writing and attempting to communicate ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18216
PUBLISHED: 2019-10-20
** DISPUTED ** The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access ...
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.