E-spionage Via Advanced Threats
e-Espionage via Advanced Threats: You won't know what hit you
Intrusion by stealth - Advanced Persistent Threats
HOW APTs WORK
Recapping from the previous article, APT campaigns tend to use a number of means to achieve intrusion, but no set pattern is followed and the mix varies from case to case.
Social Engineering is used to uncover details about staff in target organisations;
Spear-phishing campaigns are launched at selected staff members;
Custom Trojan is hidden in email attachments or web links;
Disguising outbound communications and open firewall ports;
Establishing backdoors to import more malware; and
Establishing a persistent presence.
'Social engineering' is pretty simple: it's gathering information about target users via 'open sources, like their LinkedIn and Facebook pages. The hackers then email the targets, including references to people, meetings or interests known to them, so the emails appear to be genuine. Attachments that appear bona fide often contain exploit code to instruct the user's machine to download an undetectable custom-built Trojan.
Once activated, the Trojan allows the attackers to gain control of the user's PC, to upload specific files or emails, and to gain access to the wider network. Then, the attack is broadened to other systems by stealing domain administrative and user credentials. The next step installs utilities to capture data and e-mails, to list running processes and to install hidden executables.
Stolen data is then sent to the attackers' remote servers and, should they detect remediation efforts, they'll try to establish additional footholds and modify their malware. Don't imagine this is cyber-conjecture. It isn't; it's reality.
DESIGNED TO EVADE DETECTION
You probably have a full array of defences, and your security team is watching logs and reports, so how could attackers get through your firewalls, intrusion detection systems, spyware catchers, virus scanners and SIEM systems? It's simple: these attacks are specifically designed to circumvent traditional defenses, by using custom-built malware that doesn't match known signatures or patterns. 'The extent of customisation found in a piece of malware can range from a simple repack of existing malware to avoid AV detection to code written from the ground up for a specific attack,' according to Verizon Business'data breach report.
Rules-based 'detect and prevent' techniques are next to powerless against APT attacks, yet some security vendors claim to have solutions that work. 'They either don't understand APT, don't understand how computers work, or are lying' or possibly all three,' says Gavin Reed from CISCO. 'If there were a way to identify/detect APT that could be written on an ASIC or software signature that you deploy, it wouldn't be an Advanced Persistent Threat.'
Custom Trojans have long been used in military espionage by security agencies to uncover vital intelligence, as Mossad reportedly did to glean information on nuclear facilities in Syria. Custom Trojans are now common in commercial espionage, where data theft and APT campaigns operate 'under the radar" carefully 'blending' their data exfiltration with normal network traffic.
A recent Australian example is a financial institution, where documents were sent to a hostile website through a 'disguised' open port. The firewall showed the offending port closed, and there were no alerts to the contrary from other security systems. The attack was detected with the help of behaviour-based security technology, which flagged as suspicious the outflow of information across the firewall.
by: Astal mark
Payday Assistance For Various Needs Are You Ready For The Everywhere Web? (part-2) How To Buy A Servo Motor Your Choice Of Abrasives A Developers Point Of View International Freight Transportation - How To Choose? Choose The Best Cable Deals To Suit Your Needs Need Fast Cash- Great Assistance For Those Needy Arrangements Before You Come Dear!!!! Best Creams Back Their Claims With Reviews 4 Points To Decide About Diy Super Funds Weber Grill On Sale: Finding Your Best Grill Reasons For You To Buy Digital Camera