DDoS Archive

Ransomware, DDoS extortion, and encrypted communications abound as cybercriminals in the region refine their tradecraft.

Ransomware infections increased by 233% this past year in the Middle East and North Africa as part of a shift toward more savvy and aggressive cybercrime operations in a region where criminals just last year mostly were sharing malware tools, phony documents, and services for free or on the cheap.

Researchers at Trend Micro found that cybercrime in the region has matured rapidly in the past year, with hackers employing the Telegram messaging app for encrypted communications and money-laundering services to replace rudimentary cash-out transaction methods that in many cases converted stolen physical items into cash. “The increase in money-laundering services also shows the demand for monetizing ill-gotten gains has increased over time,” says Jon Clay, global threat communications director at Trend Micro. “This all shows an increase in money-motivated cybercrimes within this region.”

The shift from email, Skype, and Facebook Messenger to Telegram as well as WhatsApp for encrypted communications and money-laundering schemes is about flying under the radar as the cybercrime gangs in the region have evolved into more experienced and lucrative operations. They now offer so-called broker services or “contracts” for moving money, using European banks, PayPal, Western Union, and banks in the region. They offer commissions between 10% to upward of 50% to convert stolen funds into a different currency, preferring to cash out in stronger currencies, such as the US dollar via US banks.

SQL injection tools, keyloggers, port numbers for Internet-connected SCADA equipment, and hacking instruction manuals all had been offered for free in the region’s underground in 2017, according to previous Trend Micro research. The WannaCry ransomware sample was sold for $50. Freely shared tools still exist there today, according to Clay, but the criminals are moving to more stealthy and secure infrastructures to hide their activities.

One of the biggest changes Trend Micro saw was the move from a tool that was “open source (and likely insecure) to a private communications tool,” he says. “This tool encrypts all communications between the members and can ensure law enforcement cannot access. This has provided the underground community with a much more secure and private means of communications.”

Aside from ransomware, distributed denial-of-service (DDoS) attacks and website defacements remain a popular attack by hackers in the region. What was once the domain of hacktivists has become yet another money-making opportunity for cybercriminals to extort their victims with destructive attacks on their websites, for example.

The oil and gas industry remains one of the biggest targets in the region – half of all cyberattacks  hit that sector – due to its pervasiveness and financially lucrative status. These organizations can’t afford a ransomware or DDoS attack to disrupt sensitive operations. “These factors make it more likely that a compromised victim may pay an extortion or ransom fee,” Clay says.

Law enforcement, too, has matured in its fight against cybercrime, which, in turn, has forced attackers to better hide their tracks. So far, Trend Micro hasn’t detected any links between the cybercrime world there and nation-state operations. “In our analysis of the actors themselves, we’re seeing predominately young males with either a high school or college education. As such, they are likely very good with technology, aggressive in their work, but still need more time to build their skillsets,” Clay says.

Going Global
All of this means yet another international cybercrime region is emerging as a threat to nations such as the US. “This is a region that is increasing in their cybercriminal operations and will likely target organizations within the US,” Clay says. “With an increase in the US oil and gas industry, these actors are learning what works within their own region and can take that knowledge and apply it into attacks within the US region.”

They already are selling tools in both Arabic and English-speaking underground forums, notes Mayra Rosario Fuentes, senior threat researcher at Trend Micro. “They are no longer just targeting their own region.”

The Middle East and North Africa will become a bigger player in global cybercrime. “This should be a call for the regional law enforcement and government to improve their laws and ability to arrest and convict these criminals,” Clay says. “It is also a call for organizations to recognize this region as a threat to their operations and improve their security capabilities to thwart attacks from this region.”

Source: https://www.darkreading.com/vulnerabilities—threats/middle-east-north-africa-cybercrime-ups-its-game/d/d-id/1333354

Researchers last week detected a new, fileless version of the malicious remote access tool njRAT that propagates as a worm via removable drives.

Also known as BLADABINDI or njw0rm, the njRAT acts as a backdoor, capable of cyber espionage, keylogging, distributed denial of service attacks, retrieving and executing files, and stealing credentials from web browsers.

This particular variant, identified as Worm.Win32.BLADABINDI.AA, leverages AutoIt, a free automation script language for Windows, to compile the final payload and the main script into one executable. The technique makes the ultimate payload difficult to detect, Trend Micro threats analyst Carl Maverick R. Pascual reported today in a company blog post.

An analysis of the executable’s script determined that it deletes any file named Tr.exe from the %TEMP% directory and replaces it with its own malicious version, plus a copy of itself. All additional files downloaded from the C2 server, which is located at water-boom [.]duckdns[.]org, will also be stored in the %TEMP% folder.

The dropped Tr.exe file is actually a second AutoIt-compiled script that contains yet another executable, this one base-64 encoded. Tr.exe “will use an auto-run registry… named AdobeMX that will execute PowerShell to load the encoded executable via reflective loading,” states the blog post,” meaning that the executable will load from memory instead of via the system’s disks.

Worm.Win32.BLADABINDI.AA is similar to its predecessors in that its C&C-related URL uses the dynamic domain name system service. Pascual believes this could be to allow the attackers “to hide the server’s actual IP address or change/update it as necessary.”

“The worm’s payload, propagation, and technique of filelessly delivering the backdoor in the affected system make it a significant threat,” the blog post concludes. “Users and especially businesses that still use removable media in the workplace should practice security hygiene. Restrict and secure the use of removable media or USB functionality, or tools like PowerShell… and proactively monitor the gateway, endpoints, networks, and servers for anomalous behaviors and indicators such as C&C communication and information theft.” Trend Micro also recommends employing an endpoint solution that can detect fileless malware attacks through behavior monitoring.

Source: https://www.scmagazine.com/home/security-news/cybercrime/malicious-developer-creates-wormable-fileless-variant-of-njrat/

When I went through my initial military training for what would become known as information technology (IT), one of the core things I remember was block diagramming. This is a process of drawing out the path of communications flow between any two end points.

In terms of cybersecurity, this concept is critical in understanding how information flows through a network, where potential vulnerabilities reside and what are the best methods to secure the network. Most organizations that have employed network diagrams to document their network do not typically address how data flows within the network and rely on the nature of the network diagram to depict data flow.

These diagrams typically start at the demarcation point [where the Internet Service Provider (ISP) entry point is], the equipment and then a router or security appliance, followed by some switching equipment. As data flows through the demarcation point, there is an opportunity to scan, filter and identify systems accessing or trying to access systems that are internal and external to the network.

This location in the network is a key monitoring point for observing unfiltered and filtered network traffic. By examining the unfiltered and filtered network traffic, the network owner can determine if the security measures in place are working as intended.

The ‘Defense in Depth’ Approach to Cybersecurity

With the knowledge gained by mapping the data flow, the network architect or owner can create choke points within the network. The idea is to implement the “defense in depth” approach to securing the network.

Defense in depth is a common concept in cybersecurity. Its purpose is to place compensating security measures in place of — or to protect — known vulnerabilities within a network. As cybersecurity expert Thomas M. Chen points out in the “Computer and Information Security Handbook,” the thought process behind the defense in depth concept “is to hinder the attacker as much as possible with multiple layers of defense [therefore increasing] the cost for attacker to be successful.”

Security expert Richard Bejtlich also emphasizes this defense in depth concept in his book, “The Tao of Network Security Monitoring.” However, according to Bejtlich, security zoning, or segmentation, is the practice of breaking up a network into smaller and more manageable networks that serve a specific purpose or work with specific types of data. This practice naturally creates additional layers of security.

Bejtlich specifically identifies four common security zones: perimeter, wireless (Wi-Fi), demilitarized zone (DMZ) and the intranet (internal network). Each of these zones, if implemented, requires separate security measures to ensure that attackers do not gain unauthorized access to the network or its resources.

Internet of Things Devices Creating New Cybersecurity Challenges

Unfortunately, in today’s networked environments and the proliferation of mobile devices — which has led to the reclassification of networks to be the Internet of Things (IoT) — many of these classical cybersecurity rules have gone out the proverbial window. In the Security Now! podcast, cybersecurity expert Steve Gibson introduced the idea of implementing a wireless network infrastructure that uses three routers, so that these IoT devices do not interact with any sensitive or potentially sensitive data.

The lack of IoT security made news in the third quarter of 2016 with massive distributed denial of service (DDoS) attacks on some well-known targets in Europe and the United States, one of which took down a major portion of the Internet. Today’s organizations also face cybersecurity issues relating to bring your own device (BYOD) policies and how to allow such devices with access to organizational data onto protected networks.

While BYOD policies reduce an organization’s IT equipment budget by passing that cost to their employees, there is a risk of the loss of intellectual property and the lack of control over the unsecure external networks to which those mobile devices may connect. Organizations that have implemented these BYOD environments must consider these security risks, along with the potential for the introduction of malware onto organizational networks or the potential for a network to be compromised with the inclusion of a botnet.

Using the Layered Approach to Organizational Cybersecurity Has Grown in Importance

With myriad potential security issues resulting from BYOD policies and the introduction of IoT devices within a network, a layered approach to protecting sensitive data is more important than ever. Administrators and network owner-operators need to understand what types of data are passing over their networks, what systems or devices are authorized to utilize the company network and how data flows between devices and the outside world.

For example, if an organization utilizes closed-circuit television (CCTV) to monitor its property and the monitoring system has a network capability, should that capability implemented to allow remote monitoring? Will that create a vulnerability in the network or in the physical security of the property?

There is always the risk that a security measure can create a new vulnerability. It is therefore prudent for cybersecurity personnel to test their network environment for new vulnerabilities or holes in their security. By doing something as simple as making block diagrams, they may quickly recognize where vulnerabilities reside when any new hardware, software or sensor is installed.

Source: https://incyberdefense.com/editors-picks/layered-approach-cybersecurity/

As the threat of state-sponsored cyber-attacks increases, multiple nations are putting together ‘cyber-armies’ able to fight back. The US Cyber Command was created in 2009 with the aim of defending the country’s infrastructure from attack. North Korea also has a cyber warfare unit and in the UK, it was recently revealed that the nation is increasing its ability to wage war in cyberspace with the creation of a new offensive force of up to 2,000 people.

Another country upping its game is Nigeria, which has itself suffered from numerous incidents of cyber-terrorism after jihadist militants Boko Haram migrated to the internet. The nation claims Boko Haram is leveraging social media for recruitment and was responsible for defacing the Defence Headquarters website. The group is also blamed for a hack on the Independent National Electoral Commission (INEC) website on a presidential election day.

In 2016, the Nigerian Army announced plans to take the war against insurgency to the nation’s cyber space. The result is the Nigerian Army Cyber Warfare Command: 150 IT trained officers and men drawn from the corps and services in the Nigerian Army. Their aim: to monitor, defend and assault in cyberspace through distributed denial of service (DDoS) attacks on criminals, nation states and terrorists.

So what led to the setup of the Command? “There have been a lot of issues with Boko Haram and also general cybersecurity problems,” says Eric Vanderburg, vice president of cybersecurity at TCDI, who is also an author and speaker on information security. “Crime is widespread in Africa, but their economy is one of the largest.”

The Nigerian army says it has acquired state of the art technical equipment and experts from IBM are currently configuring its newly procured servers. With the capacity to protect the country’s critical infrastructure, the command will also monitor the Nigerian Army’s networks and advise field commanders on how to use the computer-based weapons systems.

But there will be challenges as the country tries to tackle years of crime taking place in cyberspace. For example, Nigeria is simply training existing officers who might have no previous knowledge or experience in cybersecurity.

“They are all former army and military personnel,” says Vanderburg. “But they really need – even if only for leadership – someone to provide that guidance and specific knowledge on some of the key areas to the new recruits to train them through a programme. I just don’t see how it could be effective without bringing in some experienced people.”

If there isn’t much action, Nigeria’s Command could be more about appearances. “I think it is posturing,” Vanderburg says. “They have resisted some of the cooperation from the US – we had the US-Africa Command, for example.”

In addition: “They have previously said they have eradicated the Boko Haram threat but it’s really still there beneath the surface,” Vanderburg points out. “I think that’s going to be a lot of what happens here: they will do something with the cyber command, maybe fix some small issue and declare the cyber problem fixed.”

Nigeria also wants to show criminals and other nations it is doing something about cybercrime in a country known for its scams and phishing emails. “I think there is going to be an increasing focus on Africa: with how many cyber-attacks are coming out of it and international pressure to solve the problem,” Vanderburg says.

Internationally, Vanderburg stresses the need for a group in each country as well as cooperation between nations. “Each country should have something that helps coordinate local resources in response to cyber threats, but those groups need to work together on an international scale to now identify the problem. If, for example, an event impacts five countries, each of those could then have local units able to respond it.”

Source:https://www.forbes.com/sites/kateoflahertyuk/2018/11/26/the-nigerian-cyber-warfare-command-waging-war-in-cyberspace/#142d9f342fba

Threats are now emerging beyond home and medical devices towards IoT control systems connected to national infrastructures. It is no exaggeration to say that IoT vulnerabilities are a threat to our national and personal security – dangers brought into sharp relief by the growing weaponisation of cybersecurity on the world stage

Cybersecurity agenda

Over the last decade, the scale of cyber attacks have increased dramatically and there has been a huge increase in the scale of cyber attacks against global IT infrastructures. The increase in the number of attack vectors enabled by the internet, the level of sophistication of the attacks, the ‘staying power’ of the cyber gangs, are all markers of how cybersecurity has become the subject of major international conflict.

The rewards of cyber crime over the last decade have been lavish and can be measured in trillions of dollars. And the size of this cyber treasure chest will only increase exponentially over the next decade.

The cyber war is an asymmetric battle. According to Carbon Black, cyber criminals are spending an estimated $1 trillion each year on finding weaknesses in the cyber defences of organisations and businesses, while the same organisations and businesses are spending a mere $96 billion per year to defend themselves against these attacks.

But it’s not always the case that these threats are created by what people in the West would call ‘rogue’ states or actors.

Militarisation of cyber attacks

The biggest single factor that has emerged in the cybersecurity landscape over the last decade is the brazen and overt participation of nation states in the battle. The size of a state’s cyber capability has now become the biggest statement of its national power and global influence.

So loud are the noises around cybersecurity that cyber-aggression appears to have bumped the threat of nuclear and biowarfare down the security agenda.

In the mid-noughties there appears to have been a joint US/Israeli project to attack Iran’s nuclear programme. A virus was created which attacked the SCADA infrastructure around this programme and thus the centrifuges which were being used to enrich uranium.

Stuxnet surfaced once activated in 2010 when it preyed upon Siemens PLCs to the extent that around a third of Iran’s centrifuges were taken out of action. This might be termed a ‘successful’ attack upon the process control layer of a large utility project.

To say that cyber warfare is preferable to weapons of mass destruction might appear an understatement. However one should at the same time be mindful of the huge impacts cyber attacks could have on energy and utility companies, upon hospitals, and upon the military apparatus and democratic institutions we take for granted. Lives can be placed at risk.

Internet of Things

The massive increase in the number of devices connected to the internet continues unabated. This year there will be in the region of 23bn connected devices. This number is projected by IHS to rise to 75bn by 2025. This huge growth presents an ever increasing ‘attack surface’ for the cyber gangs to attack.

The traditional target area for IoT cyber attacks has its origins very much in the home device front. A prime example would be the 2016 Mirai botnet attack which infected around 600,000 IoT devices. The devices affected in the main were internet routers, but connected cameras were also compromised.

Mirai wreaked havoc by launching a distributed denial of service (DDoS) attack and overwhelming the devices’ networks.

By 2018 the hackers had switched their focus to the wireless protocols which exist for smart home devices, specifically the Z-Wave wireless protocol. This year, a vulnerability was discovered which affected up to 100 million smart home devices. Burglar alarms, security cameras, and door locks could be disabled, for example, allowing thieves to enter unchecked.

Another major area of vulnerability is that of accessing an individual’s home banking systems via the ‘voice hacking’ of smart speakers.

The recent news about FreeRTOS – a real-time operating system ported to around 35 microcontroller platforms – being an easy target for hackers has further eroded confidence in the security of IoT home devices.

As well as connected domestic appliances there is growing concern about the threats to healthcare devices. There are around 100m such devices installed worldwide. From insulin pumps, to diagnostic equipment, to remote patient monitoring, the areas for potential attack are huge and life-threatening.

Industrial IoT

Cybersecurity firm Carbon Black issued its Quarterly Incident Response Threat Report in November. The report represents an analysis of the latest attack trends seen by the world’s top incident response (IR) firms.

The report found that a growing number of attacks are now taking advantage of IoT vulnerabilities. An alarming 38 percent of IR professionals saw attacks on enterprise IoT devices, which can become a point of entry to organisations’ primary networks, allowing island hopping (whereby attackers target organisations with the intention of accessing an affiliate’s network).

This latter point underscores the continuing trend of exploiting IoT devices in the enterprise domain to attack business and to move from there into other ‘supply chain’ networks in order to disrupt additional enterprise operations.

The threats emerging away from these home and medical devices towards IoT control systems connected to national infrastructures are increasing in number and truly terrifying.

Process control devices in the industrial world present vulnerabilities in our oil and gas industries, and in our water purification and power plants. A nation’s vital utility infrastructure could potentially be brought to its knees by cyber attacks against the IoT device layer.

This threat isn’t new, although comparatively rare in the past. The Industroyer (Crashoverride) malware framework took out approximately one fifth of Kiev’s power for one hour in December 2015. A number of other different malware attacks targeted against industrial control systems in energy plants have also been discovered in the last few years.

It is now well understood that nation states such as Russia, China and North Korea have been probing other nations’ power generation facilities with a view to potential future hacks. The dangers are well understood by many governments but as of yet these vital infrastructure areas are still massively vulnerable to attack.

Understanding the risks

Only recently, Ciaran Martin, head of the UK’s National Cyber Security Centre (the NCSC) gave an apocalyptic warning about cyber threats to the UK. Martin said that Britain will be hit by a life-threatening ‘category 1’ cyber emergency in the near future.

Similar warnings have been coming out of the US recently, and President Trump’s National Cyber Strategy outlined the same types of threats against US infrastructure. Trump has constantly talked about the threats to US Power Grids – primarily again via the IoT layer – and it’s an area of deep concern for the Federal Government.

In the last month, Trump has been offering to share cyber attack and defence capabilities with NATO allies at the same time as UN calls for an ‘amnesty’ in the use of cyber attacks against critical infrastructures.

But at the business level the understanding of cyber risks is patchy. British business is predominantly uneducated and complacent when it comes to the risks posed by cyber threats and the vulnerability of IoT devices wherever they might be on their network.

Who is responsible?

In the IoT domain for both home and enterprise devices we need secure device design and manufacture, secure deployment, and secure onward protection.

It is the device manufacturer’s responsibility that IoT devices are delivered uninfected with malware, or rogue components. They have a responsibility to ensure that default passwords cannot be implemented in a live environment and to ensure that system software is able to be patched and updated going forward as new threats are understood.

But there is a dual responsibility between device supplier and the end user. Users of these devices in public sector organisations and business enterprises also have a responsibility to ensure that this layer of their IT infrastructure is of itself secure and that it cannot be compromised by weaknesses in other layers of their own cyber defence, or by malware which might be passed on through their supply chain, i.e. ‘island hopping.’

The role of businesses

Starting with the boardroom, businesses must enact a top-down approach to avoid backlash from the market. All companies should be aware that their cybersecurity will be subject to considerable public scrutiny when things go wrong. The directors of companies need to take an active interest in their companies’ cybersecurity policies.

News published in early November told us that Facebook had lost 1m users in Europe in the last couple of months after its highly publicised breaches, and we can expect them to lose more user share going forward.

In the home IoT market, consumer confidence is key. If any particular brand of fridge, TV, baby alarm, speaker, or burglar alarm was exposed as being the source of attacks, consumers will vote with their wallets.

A recent survey conducted by Opinium in the UK showed that businesses which were breached or caused other businesses to be breached would experience repercussions from other businesses.

One in five businesses would take legal action to recover financial losses incurred from a breach as a result of a supplier’s negligence, and a similar number would use the incident to negotiate a further discount. Just three percent of businesses said they would take no action.

The survey also showed that victims of cybercrime could find it more difficult to attract new customers, with 35 percent of the business leaders questioned saying they would not work with a supplier they thought would make them more vulnerable to cybercrime. Just over a quarter said they would avoid using a company that had been publicly associated with a major cybersecurity breach.

Shareholders tend to react when market share is impacted, when the brand of a company is trashed in the market, or when a CEO’s position is undermined by high profile incidents.

CEOs and senior executives have been put on notice that the buck stops with the boardroom. The directors of companies need to take an active interest in their companies’ cybersecurity policies.

Regulatory headwinds

Although only guidelines, the UK has made an admirable headstart towards IoT regulation with its recently released ‘secure by design’ guidelines.

The code – which the government claims is a ‘world first’ – has 13 guidelines, to ensure connected items are ‘secure by design’. It is long overdue and needs to be replicated by other countries.

The guidelines include: no default passwords; a vulnerability disclosure policy; pushed software updates; the secure storage of credentials and security-sensitive data; encrypted in transit communications and secure key management; resilience to outages; monitoring of telemetry data; and making it easy for users to delete personal data from any device.

The code of practice is designed with the home device market in mind. However, the guidelines can have a strong influence on the move towards industrial IoT regulatory requirements too.

In this latter scenario, primary responsibility would pass more towards the implementer or the end user of the industrial control technology.

It’s remarkable that these guidelines took so long to surface given the UK’s long history of consumer protection.

Similarly, the EU has a history of tackling technology giants who impinge on the privacy of individuals (GDPR being the latest culmination), so it’s surprising that a similar code of practice hasn’t emerged from Brussels yet. We can only assume that regulations are ‘in the pipeline.’

As for the IoT layer in the enterprise domain, the IIoT, expect a lot of focus to be driven by governments anxious to protect core businesses and infrastructure. Oil, gas, power generation, aviation and water industries are all highly dependent on IoT to run their businesses effectively.

These are obviously all vulnerable right now. It’s clear that notice has been given by aggressor states that these infrastructures are eminently hackable. It seems to me that the only thing stopping significant disruption is fear of reprisals.

Take The Sunday Times report in October that claimed British military forces had practised a cyber attack that would ‘plunge Moscow into darkness.’ This attack would be an immediate response if Putin’s forces were to move against the West.

Britain no longer possesses small battlefield nuclear weapons – in the eyes of the UK government and many others, cyberweapons have become the most effective military deterrent.

Source: https://thestack.com/iot/2018/11/22/iot-cybersecurity-where-we-are-and-what-needs-to-change/