[BreachExchange] When Obscurity Is Not a Defense

[Audrey McNeil]

https://www.dataprivacymonitor.com/cybersecurity/when-obscurity-
is-not-a-defense/

Many organizations facing a data-security incident struggle to understand
how or why their organization was targeted in an attack. Most simply
believe they are too small or too obscure to be targeted by malicious cyber
actors. Even larger, well-known businesses are lulled into complacency,
mistaking years without a major security incident as evidence that their
business is an unlikely target, or believing that a small corner of their
business, perhaps the new cloud instance they’re testing, will go
unnoticed. They reason that with bigger or more prominent fish in the
ocean, their relative obscurity is a strong line of defense. But this
reasoning misunderstands how victims of cyber attacks typically become
victims, and how easy it is for attackers to find and compromise vulnerable
targets across the internet. While some victims are targeted for a specific
purpose, especially by nation-state actors, many are not. More often they
are opportunistic victims or victims of collateral damage directed at
others. Understanding how attackers target victims is critical to proper
network defense and to accurately assessing an organization’s risk
scenarios.

Targets of opportunity

This article highlights four common ways attackers find their victims:
phishing campaigns, watering hole attacks, malvertising, and mass internet
scans for vulnerable or open systems. Knowing how these techniques find
victims is key to understanding that every organization with
internet-accessible systems and data is a target.

Phishing campaigns

Now one of the most widely known attack methods, phishing campaigns blanket
the internet with emails containing malicious attachments or links. They
target individuals and organizations of all sizes, and often worm their way
from one victim to the next using victims’ compromised accounts and address
book contacts to spread, making the phishing campaign that much more
effective because malicious messages arrive from a trusted or known source.
The purpose behind many of these attacks is to harvest users’ credentials
for sale or use in follow-on attacks. Other phishing campaigns with
malicious attachments install ransomware; malware that collects banking
details, credentials or other sensitive data; or remote access tools,
signaling to the attacker when a catch is on the line.

Despite increased awareness and training, this attack method remains
popular because it works, and our experience demonstrates that any
organization can fall victim to these attacks.

Watering hole attacks

A second way attackers find targets of opportunity is through a so-called
watering hole attack, where attackers compromise a legitimate website (the
watering hole), inject malicious code into the site and then wait for
victims to visit it. When a victim arrives at the site, the injected code
checks the visitor’s browser and plug-ins for vulnerabilities and exploits
them in the background. These attacks sometimes target specific industries
or categories of individuals (targeting government contractors, for
example, by compromising a site covering a related subject), but they also
often target the general population by compromising widely visited pages
like news sites. Victims are often surprised to learn these attacks can
compromise a user’s system as soon as the victim visits the compromised
site. The user doesn’t have to click on a link, download anything or take
other action – when a user visits the compromised site with a vulnerable
browser or plug-in, the attack is complete. Adobe Flash is a well-known
plug-in with a history of serious and frequent vulnerabilities. Despite
these known vulnerabilities and plans to retire the plug-in next year, we
see frequent examples of attackers targeting this plug-in to compromise
users’ systems.

Malvertising

Malvertising (malicious advertising) is a close cousin of the watering hole
attack, but instead of compromising the site that unsuspecting victims
visit, the attacker buys advertising space on the legitimate site and
populates the purchased space with an advertisement containing malicious
code. When the malicious advertisement loads into a user’s vulnerable
browser, the code compromises the user’s system behind the scenes, again
with no additional action by or notice to the user.

Mass internet scans

Perhaps the most opportunistic way attackers find victims on the internet
is through mass scans of the entire internet for publicly exposed
vulnerabilities. Although internet-wide scans may sound impractical or
sophisticated, several tools and services automate the process, making it
easy for even unsophisticated attackers. A tool released last month named
AutoSploit, for example, combines the power of the Shodan search engine
(which scans the internet and catalogs exposed systems and open ports) with
the Metasploit penetration-testing framework (which contains a database of
known exploits and automates the exploitation process) to search the
internet for vulnerable systems and automatically exploit them. Other tools
automate the discovery of servers with open remote-desktop protocol (RDP)
services, the discovery of cloud storage locations like Amazon S3 buckets
that customers have failed to secure or the presence of sensitive access
keys mistakenly published in public repositories like GitHub.

This means that if your organization places a server or an IoT device on
the internet with an insecure service or known vulnerability, or places
sensitive data in an improperly configured S3 bucket or other cloud storage
location, it’s only a matter of time before an attacker (or security
researcher) discovers it.

Attackers who find these vulnerabilities leverage them in many ways. Some
infect compromised systems with ransomware or develop other ways to extort
victims; some steal sensitive data to sell or otherwise monetize through
fraud; others sell the RDP or cloud-service access they compromise to
buyers who use that access for other criminal activity (including
cryptocurrency mining and using the compromised servers as hop points, or
proxies, to conceal the true source of their malicious activity). An
avalanche of news storiesand my firm’s experience dealing with scores of
clients victimized in these ways confirm these are real scenarios that
organizations of all sizes face every day.

Collateral damage from attacks targeting others

Aside from the opportunistic attacks described above, several examples from
the past year demonstrate how targeted attacks by sophisticated actors can
affect a wide range of unintended and unexpected victims. Two prominent
examples are the May 2017 WannaCry outbreak and the June 2017 NotPetya
attacks. WannaCry, which authorities have recently attributed to the North
Korean government, masqueraded as a common ransomware attack, but was, in
fact, a purely destructive attack meant to disrupt its victims. Although
it’s unclear whether the North Korean government unleashed WannaCry on a
particular target, we know the virus spread across the globe rapidly,
infecting targets of opportunity along the way and causing significant
damage.

Similarly, the U.S. and U.K. governments recently attributed the NotPetya
attack to the Russian government and its desire to destabilize Ukraine’s
financial, energy and government sectors. Despite this limited motive, the
virus spread to businesses around the world, causing significant collateral
damage to many other organizations, including the law firm DLA Piper and
the Danish conglomerate A.P. Moller-Maersk.

We also saw in 2017 a supply-chain attack affecting the popular privacy
tool CCleaner. Here, the suspected nation-state attacker’s apparent motive
was espionage against 12 technology companies. Yet, despite this limited
motive, the attack compromised CCleaner’s legitimate update process to
inject malicious code into approximately 2.27 million end-users’ systems.
Although the attacker delivered the attack’s second-stage malware into only
a small fraction of limited targets, every user that downloaded the
malicious update was infected with the first-stage malware and exposed to
further compromise.

These examples demonstrate how sophisticated attacks by nation-state actors
can affect organizations of all sizes, even if the affected organization is
not an intended target.

Assessing the risk

The scenarios described above have the potential to create serious legal,
regulatory and reputational risk. Each scenario that impacts the
confidentiality, integrity or availability of personal data, however
briefly, is a “breach of security” and an internally recordable incident
under the European Union’s General Data Protection Regulation (GDPR)
Article 33(5). Depending on the data affected and the risk of harm to
individuals, the incidents may also trigger notification obligations under
GDPR Articles 33 and 34, and under various U.S. state and federal
breach-notification laws. (The GDPR takes effect in May and includes
extraterritorial provisions that apply to organizations operating outside
the EU in certain circumstances.)

Moreover, an organization that fails to implement reasonable and
appropriate security measures to address these risk scenarios could expose
itself to increased litigation and regulatory risk. GDPR Article 32, for
example, requires data controllers and processors to “ensure the ongoing
confidentiality, integrity, availability and resilience of processing
systems and services” after assessing “the risks that are presented … to
personal data transmitted, stored or otherwise processed.” Likewise,
various state and federal regulators may view failing to address these risk
scenarios as unfair or deceptive business practices, or violations of
regulations mandating reasonable security measures (e.g., the HIPAA
Security Rule or the N.Y. Department of Financial Services Cybersecurity
Requirements).

And because many scenarios outlined above result in mandatory notification
obligations or public disclosures by security researchers, these incidents
create reputational risk for organizations that may lose customers’ – or,
perhaps more important, business partners’ – confidence in their
operations. Especially under the GDPR’s new requirement that processors
notify controllers of personal data breaches “without undue delay” (see
Article 33(2)), repeated notifications of even small incidents could cause
significant reputational damage and business loss.

Therefore, understanding how these attacker techniques translate into
opportunistic attacks and collateral damage to all connected organizations
is a critical first step to properly evaluating an organization’s legal,
regulatory and reputational risk scenarios. And the variety and complexity
of these attacks once again reinforces why organizations undertaking risk
assessments must work with internal or external assessors with a strong
understanding of these threats.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20180223/7c124bbf/attachment.html>