Feeds

Most resistance to 'Aurora' hack attacks futile, says report

As many as 100 companies pwned!

5 things you didn’t know about cloud backup

Most businesses are defenseless against the types of attacks that recently hit Google and at least 33 other companies, according to a report to be published Monday that estimates the actual number of targeted companies could top 100.

The attackers behind the cyber assault dubbed Aurora patiently stalked their hand-chosen victims over a matter of months in a campaign to identify specific end users and applications that could be targeted to gain entry to corporate networks, the report, prepared by security firm iSec Partners, concluded. Emails or instant messages that appeared to come from friends and trusted colleagues were combined with potent zero-day vulnerabilities targeting common applications. In many cases, exploits were tweaked to circumvent specific versions of anti-virus programs.

The findings are significant because they suggest that many of the best practices corporate IT departments have been following for years are ineffective against the attacks, which Google said were successful at piercing its defenses and accessing its trade secrets. iSec founding partner Alex Stamos said that with the exception of Google and a handful of other organizations with budgets to support expensive information security teams, companies are unprepared to defend themselves against this new caliber of attacks.

"Attackers are willing to spend months attacking people in these companies, and they write custom malware specific to those companies," he told The Register. "The malware for each of these companies has been customized based on the versions of vulnerable software they're running, as well as what kind of anti-virus they're using. The problem is to defend against that level of attacker - the game is completely different than what most companies are doing."

In the days immediately following Google's January admission, investigators said as many as 33 other companies were hit by the same attacks. But according to Stamos, that estimate was based on the analysis of just one command and control channel under the control of the attackers. After sifting through the contents of another 60 or so additional channels, Stamos said the number of compromised companies could be as high as 100, many with woefully unprepared IT departments.

The attackers showed painstaking perseverance in gathering information about vulnerable end users, often casing social networks to learn the identities of friends and business associates so instant messages and emails with poisoned links will appear more innocuous. They also employed an encyclopedic knowledge of corporate networking weaknesses that allowed them to convert a compromise of a single computer into a vector that would surrender unfettered access to a company's most valuable crown jewels.

"These guys really understand how to take control of one laptop and turn it into domain admin access," Stamos explained. "People are not well prepared for this kind of stuff."

For companies to reverse the tide, they will have to make fundamental changes to the way they think about and manage security inside their network perimeters. Chief among the changes is disabling all services that despite repeated warnings often remain on, such as LAN Manager Hash. Other recommendations include logging and inspecting all queries made to internal domain name system servers and building safeguards into the network that prevent key resources from being accessed even when a client on the system has been commandeered.

Windows machines, the authors also recommend, should only be run in unprivileged mode for the vast majority of users. A PDF of the report is here. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.