Feeds

Most resistance to 'Aurora' hack attacks futile, says report

As many as 100 companies pwned!

The Power of One eBook: Top reasons to choose HP BladeSystem

Most businesses are defenseless against the types of attacks that recently hit Google and at least 33 other companies, according to a report to be published Monday that estimates the actual number of targeted companies could top 100.

The attackers behind the cyber assault dubbed Aurora patiently stalked their hand-chosen victims over a matter of months in a campaign to identify specific end users and applications that could be targeted to gain entry to corporate networks, the report, prepared by security firm iSec Partners, concluded. Emails or instant messages that appeared to come from friends and trusted colleagues were combined with potent zero-day vulnerabilities targeting common applications. In many cases, exploits were tweaked to circumvent specific versions of anti-virus programs.

The findings are significant because they suggest that many of the best practices corporate IT departments have been following for years are ineffective against the attacks, which Google said were successful at piercing its defenses and accessing its trade secrets. iSec founding partner Alex Stamos said that with the exception of Google and a handful of other organizations with budgets to support expensive information security teams, companies are unprepared to defend themselves against this new caliber of attacks.

"Attackers are willing to spend months attacking people in these companies, and they write custom malware specific to those companies," he told The Register. "The malware for each of these companies has been customized based on the versions of vulnerable software they're running, as well as what kind of anti-virus they're using. The problem is to defend against that level of attacker - the game is completely different than what most companies are doing."

In the days immediately following Google's January admission, investigators said as many as 33 other companies were hit by the same attacks. But according to Stamos, that estimate was based on the analysis of just one command and control channel under the control of the attackers. After sifting through the contents of another 60 or so additional channels, Stamos said the number of compromised companies could be as high as 100, many with woefully unprepared IT departments.

The attackers showed painstaking perseverance in gathering information about vulnerable end users, often casing social networks to learn the identities of friends and business associates so instant messages and emails with poisoned links will appear more innocuous. They also employed an encyclopedic knowledge of corporate networking weaknesses that allowed them to convert a compromise of a single computer into a vector that would surrender unfettered access to a company's most valuable crown jewels.

"These guys really understand how to take control of one laptop and turn it into domain admin access," Stamos explained. "People are not well prepared for this kind of stuff."

For companies to reverse the tide, they will have to make fundamental changes to the way they think about and manage security inside their network perimeters. Chief among the changes is disabling all services that despite repeated warnings often remain on, such as LAN Manager Hash. Other recommendations include logging and inspecting all queries made to internal domain name system servers and building safeguards into the network that prevent key resources from being accessed even when a client on the system has been commandeered.

Windows machines, the authors also recommend, should only be run in unprivileged mode for the vast majority of users. A PDF of the report is here. ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.