Professional Documents
Culture Documents
The Logicnow Cyber Threat Guide: Nine Types of Internet Threats and How To Stop Them
The Logicnow Cyber Threat Guide: Nine Types of Internet Threats and How To Stop Them
w w w.logicnow.com
Contents
4
Introduction
10
14
18
Phishing Attack
22
Drive-by Download
26
30
32
36
40
Data Destruction
Introduction
Defending networks from attacks is no easy task for IT
professionals. Attacks range in capability and threat; and
over reacting or implementing the wrong technology can be
costly and make it easier for the bad guys.
This ebook sets out the types of attacks a typical network
faces and offers some of the successful mitigation
strategies IT professionals have implemented against them.
Ultimately, treat this guide as a first step in designing
your defense-in-depth strategy. IT professionals must
truly understand the risk to the business and that IT
security does not have magic solutions. There is not a
single technology that can prevent all the bad things from
happening, despite what vendors say.
Cyber attacks, malware, and system vulnerabilities have
all been mystified and media-hyped beyond any sort
of reasonable analysis. In fact, the most effective IT
strategies against all unknown and known threats are
generally the same. Patch and update the operating
system, patch and update third-party applications, restrict
www.logicnow.com
Introduction
www.logicnow.com
What is it?
Millions of malware infections and hostile actors are looking for
vulnerabilities to exploit. A great example of this sort of attack
is the Moon Worm. This was a self-replicating program that
infected Linksys routers by exploiting an authentication bypass
vulnerability in various models from the vendors E-Series
product line. It moved from router to router by scanning for
its next victim. If it didnt find a vulnerable router it moved on
to the next IP address. By using commercial software, such as
Metasploit, Nessus or the free tool NMAP, these programs can
locate vulnerable services on the Internet.
Variations:
Worms and other self-propagating malware come in a wide
variety. Some target specific vulnerabilities in software with
specific exploit packages, such as the first generation of
NIMDA and Code Red worms. Others simply use a brute
force approach to passwords in an attempt to gain access to
protected systems.
www.logicnow.com
Some attacks
in software with specific exploit
packages. Others simply use a
brute force approach to passwords
in an attempt to gain access to
protected systems.
Scripting Capability
10
89
www.logicnow.com
What is it?
In late 2014/early 2015, both the PlayStation Network and Xbox
Live went down after a group called LizardSquad began using
a tool called LizardStresser to attack the network connections.
LizardStresser leveraged poorly secured routers that had default
passwords. As a result thousands of routers were turned into
internet-facing cannons that blasted garbage Internet traffic at
the IP addresses critical to the gaming networks.
By leveraging tools such as NTP amplification, DNS reflection
and SYN flood, huge amounts of traffic can quickly overwhelm a
business infrastructure and effectively knock it off the Internet.
In a sinister twist, cybercriminals may try to extort money from
a potential victim threatening them with a DDOS attack if they
dont pay.
Variations:
DDOS has been around for a very long time. In general, the
attacks are categorized as connection-based or resource
based in addition to the newer type of amplification attacks.
Connection-based attacks simply attempt to open as many
simultaneous connections as possible with the targeted server in
order to degrade its performance. A Resource Exhaustion attack
occurs when the server is overwhelmed with requests. In order
to produce faster Resource Exhaustion, the attacker can slow the
rate of response, or hold open the TCP/IP connection by sending
confusing, or non-RFC compliant, packets. This essentially tricks
the server into thinking it will receive more data shortly. This is
the equivalent of mimicking a bad cell phone connection: Hello,
Hello, Hello, can you hear me?
11
www.logicnow.com
CloudFlare
WireShark, NetFlow, Observium
Sophos, SonicWall, Cisco
MAX Remote Management / MAX Mail integration
13
14
www.logicnow.com
What is it?
Brute Force attacks either from malware looking for its next host
to infect, or a malicious actor running a script generally target a
single service exposed to the Internet, such as Remote Desktop,
VNC, Outlook Web Access, and SMTP services. Attacks consist of a
predictable and systematic checking of all possible passwords until
the correct one is found. This then grants access to the network, in
many cases with domain administrator privileges. At this stage its
unfortunately game over for the defenders.
Depending on the robustness of your security logging, these
attacks may not be easy to detect. A high-volume Brute Force
attack can exhibit similar consequences as a DDOS attack, only
typically from just one or two IP addresses. Brute Force attacks and
their cousins, SQL Injection, are a threat to all services exposed
to the Internet. One of the most commonly attacked platforms
is WordPress, as all installations have an easily located admin
login page. Once the attackers have guessed correctly they gain
unrestricted access to that account. If this site is hosted inside the
companys network then complete network exploitation is likely.
Variations:
SQL injection attacks: Here an unauthorized user injects SQL code
into fields where the SQL Server expects data values, and uses
an available database connection to access your data. This type
of attack can be extremely damaging because it lets the intruders
execute commands directly against your database. This is a more
sophisticated version of the Brute Force attack, as many different
combinations of SQL injection need to be tried in order to gain
access to the user ID and password table, which is frequently
unencrypted or poorly encrypted.
15
Theit Windows
Authentication
mode Brute Force attack
When
comes to SQL
Server authentication
is less vulnerable
to Brute
Force
vulnerability,
the situation
is grim.
Olderattacks
versions of SQL running
on SQL
Server
Authentication
features that allow you to
as the
attacker
is likely tohave
runnointo
detect when the system is under a Brute Force attack. This means
a login lockout after a finite number
that the SQL Server Authentication is a perfect target for this type
of attack attempts.
of attack.
16
www.logicnow.com
17
Phishing Attack
18
www.logicnow.com
What is it?
In November 2013, the UKs National Cyber Crime Unit warned
of a mass email-spamming event targeting tens of millions of UK
customers predominantly small and medium-sized businesses.
The emails carried an attachment that appeared to be linked to the
correspondence in the message, for example a voicemail, fax, or
details of a suspicious transaction or invoice.
Variations:
Phishing emails remain the primary Vector for Malware attacks
and are almost evenly distributed between two variants with a
malicious Email Attachment (39.9%) or Email with Malicious link
(37.4%). On a positive note, all Phishing emails have one thing in
common: they arrive via email. This situation allows for multiple
opportunities to mitigate the threat.
Phishing Attack
19
Phishing Attack
What do I need to do?
You have to understand that users are at some point going to click
on or open something nasty. This understanding should inform
your response and with an understanding of the threat, allow you
to roll out a defense-in-depth strategy.
20
www.logicnow.com
Managed Antivirus
Web Protection
Email Protection
Managed Online Backup
Mobile Device Management
Phishing Attack
21
Drive-by Download
22
www.logicnow.com
What is it?
In May of 2015, MadAdsMedia, a US-based advertising network
was compromised by cybercriminals. They planted links that
took visitors to multiple Adobe Flash exploits delivered by a
cybercrime exploit kit. Its estimated that up to 12,500 users
per day may have been affected by this threat.
In this particular case, the Nuclear Exploit kit was used to
good effect. Exploit kits are efficient at distributing malware to
users surfing the web. Such kits include exploits for multiple
vulnerabilities within a single malicious webpage. Built-in checks
target systems, web browsers and browser plugins, such as
Flash Player, Adobe Reader, Java, or Microsoft Silverlight for
anything that is not fully patched. An attack is then launched to
exploit that specific out-of-date software.
Drive-by Download
23
Drive-by Download
What do I need to do?
Just like with the Phishing email described earlier, there
is a lot IT professionals can do to mitigate this sort of
attack by implementing multiple layers of defense.
Analysis shows that email with malicious links (37.4%)
and web-based Drive by Download (16.6%) account for
54% of security incidents. Robust in-depth defenses can
protect users from visiting harmful webpages where these
threats reside. Focusing on web-based attacks is another
quick win for security and would use many of the same
technologies deployed against Phishing attacks.
www.logicnow.com
Managed Antivirus
Web Protection
Drive-by Download
25
26
www.logicnow.com
What is it?
While the KPMG employee did exist, and the email looked like it came
from a valid KPMG email address, it was actually based on a server
in Russia and the telephone number listed was a Skype account
registered using an IP address in Israel. This attack was successful,
and many subsequent Automated Clearing House (ACH) attacks have
made big news in past years.
In many ways Spear Phishing is an old-fashion confidence trick, and
on the surface is therefore difficult to defend against, because it does
not appear to be a technology-based threat, but instead an attack on
trust. As cybercriminals have evolved from crudely fashioned Nigerian
419 scams to cute Russian girls, the line between common Phishing
and Spam has blurred not so with these types of targeted attacks.
Variations:
Spear Phishing will be targeted towards an organization and its
advanced cousin, Whale Phishing, is reserved for senior executives.
27
* https://www.trustedsec.com/social-engineer-toolkit/
28
www.logicnow.com
Managed Antivirus
Web Protection
29
30
www.logicnow.com
31
32
www.logicnow.com
What is it?
In February of 2015, The APT group Desert Falcons claimed
some 3,000 hacking victims in more than 50 countries. Most of
them were located within Palestine, Egypt, Israel, and Jordan,
but there have also been discoveries in Saudi Arabia, the UAE,
the US, South Korea, Morocco, and Qatar among other places.
The victims include military and government organizations,
employees responsible for health organizations and combating
money laundering, economic and financial institutions, leading
media entities, research and educational institutions, energy and
utilities providers, activists and political leaders, physical security
companies, and other targets that have access to important
geopolitical information.
What separates APT actors from other malicious actors is their
level of sophistication, organization and resources. APT actors will
target a specific organization or entity and perpetrate a sustained
campaign until they achieve their goals. Their persistence,
adaptability, and ability to vary attack forms also differentiate APT
actors. They may act independently or more likely, as part of a
larger team or effort. In the case of teams, activities may be fully
compartmentalized, much like how a business separates roles,
functions and organizations internally.
Variations:
There are well over 100 known APT groups documented by
security researchers. One of the most well known is Anonymous,
which claims thousands of hacktivists under its banner.
Importantly, its hard to differentiate between APT, hacktivist,
fledgling nation state sponsored actors, and sophisticated
criminals. Thus under the catch-all banner of APT you will have
varying degrees of sophistication, but they will generally have
three things in common:
They target you to steal all your Internet things
They tend to specialize either along a line of ideologically
/ culturally / politically / religious motivation or focus on
technological espionage either seeking knowledge and
information for advancement of an ideological/ political/
cultural/agenda or the theft of intellectual property
Persistence this type of actor continues the attack, probing
weakness, Brute Forcing, Spear Phishing, researching, and
even conducting DDOS in order to ruin your day
33
* https://www.sans.org/critical-security-controls/
34
www.logicnow.com
Wire Shark
Windows Bitlocker
WatchGuard
Zonefox
Splunk
Snort
Sophos
SonicWall
RSA
PGP
Observium
NetFlow
NMap
Nessus
Microsoft
Metasploit
LogRythm
Goldren Images
Firmware updates
Due
CloudFlare
Cisco Meraki
Cisco
Checkpoint
Bit 9
Becrypt
Azure
Aruba Networks
App Locker
Amazon
Alien Vault
http://www.asd.gov.au/infosec/
mitigationstrategies.htm
Email Protection
Mail Protection
Managed Antivirus
All in addition to End User Security Awareness Training Program (ongoing), Service Provider
Security Awareness Training Program (ongoing) and Internal Network Segmentation.
35
36
www.logicnow.com
What is it?
In February 2015, Moscow-based cybersecurity firm Kaspersky
Lab revealed a number of sophisticated cyberattacks by statesponsored hackers, labeled the Equation Group. Reuters
reported that two former National Security Agency (NSA)
employees confirmed the validity of the analysis and said that
operatives within the NSA valued these spying programs as
highly as Stuxnet.
The report also stated that, the Equation group and the Stuxnet
developers are either the same or working closely together.
Various security experts have traced back the Stuxnet attacks
to the US and Israeli governments. According to the report, the
Equation Group hackers were able to rewrite the hard-drive
software of infected computers, which makes the normal attack
recovery procedures (replacing the hard drive, reformatting the
drive, wiping a computers operating system and reinstalling
software) ineffective, since spyware-manipulating firmware is
impossible to detect or remove.
Variations:
An exact count of which nations are developing cyber warfare
capability is not readily available, however most developed
nations (and a few developing ones) are actively building this
capability. For now its accurate to say 50 to 100 countries have
varying degrees of capability. A nation-state engaging in offensive
cyber warfare embodies the worst aspects of any APT group. The
sophistication and expertise of the advanced hackers let loose
on a private, or government organization are terrifying to behold.
Millions of dollars in physical damage is possible, not to mention
massive disruption and ensuing panic. These APT cyber units of
national military and intelligence agencies are given classified
budgets with access to almost unprecedented resources. A
significant philosophical difference exists between APT criminal
groups and hacktivist APT actors. A nation-states offensive APT
cyber units have access to top training resources, and no fear of
criminal prosecution for their acts. They operate with obscurity
and have no fear of facing retribution. The government they serve
typically directs the legality and ethics of their acts.
37
38
www.logicnow.com
Wire Shark
Windows Bitlocker
WatchGuard
Zonefox
Splunk
Snort
Sophos
SonicWall
RSA
PGP
Observium
NetFlow
NMap
Nessus
Microsoft
Metasploit
LogRythm
Goldren Images
Firmware updates
Due
CloudFlare
Cisco Meraki
Cisco
Checkpoint
Bit 9
Becrypt
Azure
Aruba Networks
App Locker
Amazon
Alien Vault
http://www.asd.gov.au/infosec/
mitigationstrategies.htm
Email Protection
Mail Protection
Managed Antivirus
All in addition to End User Security Awareness Training Program (ongoing), Service Provider
Security Awareness Training Program (ongoing) and Internal Network Segmentation.
39
Data Destruction
40
www.logicnow.com
What is it?
The December 2014 attack on Sony Pictures Entertainment has
set a new benchmark in the damage cybercriminals can inflict
on an enterprise that has a cavalier attitude towards information
security. Security firm Mandiant reported the hacks purpose
was to both destroy property and release confidential info. In
response to the damage this attack caused, including the release
of highly compromising emails, and data destruction, the FBI
released a flash alert to warn other organizations of the danger.
Elements of the Sony attack included massive Intellectual
Property damage (through movie releases), data destruction,
unauthorized disclosure of confidential information, Denial of
Service (through credential theft), and reputational damage
(leading to the firing of senior executives).
Variations:
In the annals of cybercrime there has not been such a collection
of different security incidents all happening rapidly over a short
period of time. There are only a few incidents to identify where
the motive of the attackers has been so malicious. At no point did
the attackers try and extort money out of Sony they only had
digital mayhem in their plans. Given the state of cybersecurity
and what feels like a continuous and unrelenting victory streak
for the bad guys, a tremendous number of businesses would
likely suffer the same damage from a similar cyberattack. The
claim that the malware used in this attack was not detectable
by antivirus programs is suspect and distracts us from the fact
that Sony had a passwords.xls document that was neither
encrypted nor password protected, which listed all passwords
including ones with administrative access. As discussed earlier in
this document: if a single vendors antivirus solution is the only
security control in place at a global company then the results of
this hack were entirely predictable and avoidable.
Data Destruction
41
Data Destruction
What do I need to do?
As an IT Professional you need to design a security solution that addresses the
risks the business is facing. Implementing a whole bunch of technology is rarely
the best solution. Designing a simple, manageable network and establishing a
continuous monitoring solution will be easy security wins. In virtually all the
recent data breaches basic security was not in place, and organizations relied
too heavily on perimeter defenses.
Selling fear only works to a certain extent and is generally not sustainable.
The Sony attack is used in this paper to illustrate the worst
Security is about a great deal more and combines the use of technology
possible scenario, and what happens if the
alongside elements of people and process.
organization is unprepared for attack. The Sony
As an IT professional, the best place to
attack, following in the footsteps of the Saudi
start is with a security assessment, a plan
All your hard work will
Amoco attack and Stuxnet have given rise to
to remediate the critical items the business
the data destruction attack. Recent successful
be ineffective if your
identifies, and then a solution to monitor the
attacks on Critical Infrastructure in the Ukraine
management does not
system for compliance. It is often the simple
and Israel show the motivation of APT actors
things that are most effective when it comes
support and endorse a
to inflict physical harm through hacking. A new
to security. According to James Lewiss seminal
type of threat, perhaps the nastiest evolution
security program.
paper on Cybersecurity in 2013*, little if
so far is the malicious hacking of business,
anything has changed since then:
government or organization systems to
destroy data, or to extort a ransom from the
More than 90% of successful breaches
target. The consequences of a massive data breach have evolved
required only the most basic techniques
from the looting of Personal Private Information, and Intellectual
Only 3% of breaches were unavoidable without difficult or expensive actions
Property theft to attempts to destroy or get paid for threatening
96% of successful breaches could have been avoided if the victim had put in
to destroy a target. The layered security defense including
place simple or intermediate controls
excellent business resiliency capability in the form of robust
75% of attacks use publicly known vulnerabilities in commercial software
backup - is the key to surviving the worst attack malicious actors
that could be prevented by regular patching
can devise.
42
www.logicnow.com
* https://csis.org/files/publication/130212_Lewis_RaisingBarCybersecurity.pdf
Data Destruction
43
DISCLAIMER
2016 LOGICnow Ltd. All rights reserved. All product and company names herein may be trademarks of their respective owners. The information and content in this document
is provided for informational purposes only and is provided as is with no warranty of any kind, either express or implied, including but not limited to the implied warranties
of merchantability, fitness for a particular purpose, and non-infringement. LOGICnow is not liable for any damages, including any consequential damages, of any kind that may
result from the use of this document. The information is obtained from publicly available sources. Though reasonable effort has been made to ensure the accuracy of the data
provided, LOGICnow makes no claim, promise or guarantee about the completeness, accuracy, recency or adequacy of information and is not responsible for misprints, out-ofdate information, or errors. LogicNow makes no warranty, express or implied, and assumes no legal liability or responsibility for the accuracy or completeness of any information
contained in this document.
If you believe there are any factual errors in this document, please contact us and we will review your concerns as soon as is practical.
w w w.log icnow.com